xmrig | f809449e785472cc3de5783655e09822babf3d62156a8167a37046d4147d3863

Analysis

max time kernel
61s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01-05-2024 11:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
Size

1.4MB
MD5

0ba889b039a6f31daa9faddc42bd48ce
SHA1

0b822285d600f89c4f3008f9684083425c19dfc1
SHA256

f809449e785472cc3de5783655e09822babf3d62156a8167a37046d4147d3863
SHA512

65d231ceebc57f16dc561ce0b7f076fbcee7139cd9da031a4bca0d07b991b86b26c985b9436225778dcb4326ea54041d7e18ff40c971c46783505b9106434931
SSDEEP

24576:JanwhSe11QSONCpGJCjETPlGC78XIO9C1MKTbcMfHhGjw2qPIC4T:knw9oUUEEDlGUjc2HhG82qwD

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/4768-60-0x00007FF7F8350000-0x00007FF7F8741000-memory.dmp	xmrig
behavioral2/memory/2612-63-0x00007FF730FB0000-0x00007FF7313A1000-memory.dmp	xmrig
behavioral2/memory/1572-451-0x00007FF6412B0000-0x00007FF6416A1000-memory.dmp	xmrig
behavioral2/memory/3920-461-0x00007FF7EFCA0000-0x00007FF7F0091000-memory.dmp	xmrig
behavioral2/memory/1056-475-0x00007FF6D8B70000-0x00007FF6D8F61000-memory.dmp	xmrig
behavioral2/memory/1064-479-0x00007FF70DA30000-0x00007FF70DE21000-memory.dmp	xmrig
behavioral2/memory/3160-487-0x00007FF633370000-0x00007FF633761000-memory.dmp	xmrig
behavioral2/memory/3796-491-0x00007FF61B290000-0x00007FF61B681000-memory.dmp	xmrig
behavioral2/memory/1712-497-0x00007FF6A89D0000-0x00007FF6A8DC1000-memory.dmp	xmrig
behavioral2/memory/996-503-0x00007FF7D4120000-0x00007FF7D4511000-memory.dmp	xmrig
behavioral2/memory/1908-501-0x00007FF61A6A0000-0x00007FF61AA91000-memory.dmp	xmrig
behavioral2/memory/2196-482-0x00007FF686250000-0x00007FF686641000-memory.dmp	xmrig
behavioral2/memory/3156-471-0x00007FF6D87F0000-0x00007FF6D8BE1000-memory.dmp	xmrig
behavioral2/memory/3184-465-0x00007FF73B250000-0x00007FF73B641000-memory.dmp	xmrig
behavioral2/memory/4576-467-0x00007FF631220000-0x00007FF631611000-memory.dmp	xmrig
behavioral2/memory/4760-74-0x00007FF705E10000-0x00007FF706201000-memory.dmp	xmrig
behavioral2/memory/4772-70-0x00007FF650050000-0x00007FF650441000-memory.dmp	xmrig
behavioral2/memory/3840-69-0x00007FF645410000-0x00007FF645801000-memory.dmp	xmrig
behavioral2/memory/1760-65-0x00007FF6243B0000-0x00007FF6247A1000-memory.dmp	xmrig
behavioral2/memory/64-58-0x00007FF60E4F0000-0x00007FF60E8E1000-memory.dmp	xmrig
behavioral2/memory/2932-53-0x00007FF624770000-0x00007FF624B61000-memory.dmp	xmrig
behavioral2/memory/708-27-0x00007FF6523A0000-0x00007FF652791000-memory.dmp	xmrig
behavioral2/memory/4952-19-0x00007FF63DB00000-0x00007FF63DEF1000-memory.dmp	xmrig
behavioral2/memory/1088-1984-0x00007FF6D8D50000-0x00007FF6D9141000-memory.dmp	xmrig
behavioral2/memory/4620-1999-0x00007FF62EAA0000-0x00007FF62EE91000-memory.dmp	xmrig
behavioral2/memory/4952-2035-0x00007FF63DB00000-0x00007FF63DEF1000-memory.dmp	xmrig
behavioral2/memory/708-2037-0x00007FF6523A0000-0x00007FF652791000-memory.dmp	xmrig
behavioral2/memory/2932-2040-0x00007FF624770000-0x00007FF624B61000-memory.dmp	xmrig
behavioral2/memory/64-2045-0x00007FF60E4F0000-0x00007FF60E8E1000-memory.dmp	xmrig
behavioral2/memory/4768-2047-0x00007FF7F8350000-0x00007FF7F8741000-memory.dmp	xmrig
behavioral2/memory/2612-2050-0x00007FF730FB0000-0x00007FF7313A1000-memory.dmp	xmrig
behavioral2/memory/3840-2051-0x00007FF645410000-0x00007FF645801000-memory.dmp	xmrig
behavioral2/memory/1760-2044-0x00007FF6243B0000-0x00007FF6247A1000-memory.dmp	xmrig
behavioral2/memory/1088-2042-0x00007FF6D8D50000-0x00007FF6D9141000-memory.dmp	xmrig
behavioral2/memory/1712-2079-0x00007FF6A89D0000-0x00007FF6A8DC1000-memory.dmp	xmrig
behavioral2/memory/2196-2084-0x00007FF686250000-0x00007FF686641000-memory.dmp	xmrig
behavioral2/memory/4760-2091-0x00007FF705E10000-0x00007FF706201000-memory.dmp	xmrig
behavioral2/memory/3160-2083-0x00007FF633370000-0x00007FF633761000-memory.dmp	xmrig
behavioral2/memory/3796-2081-0x00007FF61B290000-0x00007FF61B681000-memory.dmp	xmrig
behavioral2/memory/1908-2074-0x00007FF61A6A0000-0x00007FF61AA91000-memory.dmp	xmrig
behavioral2/memory/3184-2067-0x00007FF73B250000-0x00007FF73B641000-memory.dmp	xmrig
behavioral2/memory/1572-2065-0x00007FF6412B0000-0x00007FF6416A1000-memory.dmp	xmrig
behavioral2/memory/4576-2061-0x00007FF631220000-0x00007FF631611000-memory.dmp	xmrig
behavioral2/memory/1056-2057-0x00007FF6D8B70000-0x00007FF6D8F61000-memory.dmp	xmrig
behavioral2/memory/4772-2075-0x00007FF650050000-0x00007FF650441000-memory.dmp	xmrig
behavioral2/memory/1064-2053-0x00007FF70DA30000-0x00007FF70DE21000-memory.dmp	xmrig
behavioral2/memory/996-2069-0x00007FF7D4120000-0x00007FF7D4511000-memory.dmp	xmrig
behavioral2/memory/3920-2064-0x00007FF7EFCA0000-0x00007FF7F0091000-memory.dmp	xmrig
behavioral2/memory/3156-2059-0x00007FF6D87F0000-0x00007FF6D8BE1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4952	kKZnRsg.exe
708	STOeAmd.exe
1760	tXenuCA.exe
1088	aojfVTi.exe
2932	QDhshCq.exe
64	iEeHHhH.exe
3840	ELHnkWq.exe
4768	KhnBtyv.exe
2612	DtHktDb.exe
4772	kaUMwgA.exe
4760	slzKjnC.exe
1908	VJAmJZk.exe
996	yOVnhLk.exe
1572	VaffZlJ.exe
3920	weqoFmk.exe
3184	fhyZSPj.exe
4576	rcHkvJp.exe
3156	blLNVkv.exe
1056	lWgeciH.exe
1064	yXUHxjB.exe
2196	fZwYvrH.exe
3160	yFXTfNI.exe
3796	mjTGXAi.exe
1712	aLChZTd.exe
1612	LEFwkLH.exe
60	GvgZzBI.exe
4440	VqvzVBO.exe
1856	olcaGRp.exe
1248	ZOBkSrQ.exe
624	CGISWnh.exe
1976	meCXNDW.exe
1104	GSWHNdc.exe
3644	uMHwbHn.exe
2272	XBudsrg.exe
2852	EpusYZg.exe
5108	RmGQXkb.exe
1472	NZlfDwA.exe
3104	OkItBnJ.exe
4884	ysgUvTk.exe
5064	PDgxmhF.exe
3112	tcrkvFK.exe
2232	tHQITYG.exe
4532	ECEepTc.exe
3836	lDFDciv.exe
4048	sMchkEs.exe
4584	dweJboB.exe
3372	ghbCHMe.exe
440	YDJyyep.exe
1864	PhhSkuv.exe
728	jOXHVcN.exe
1212	xYUeHOP.exe
4752	wkFhzIm.exe
2632	PwfPNVv.exe
404	AUgBITN.exe
4304	jgAqSGn.exe
1900	rkbMmSy.exe
4252	SynBkYT.exe
564	NPxwRBP.exe
4516	FOtKMTS.exe
4860	WOFYFwk.exe
2596	iGTNJbH.exe
1092	oqPvzgZ.exe
1992	IUDdubg.exe
3592	TsMksBU.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4620-0-0x00007FF62EAA0000-0x00007FF62EE91000-memory.dmp	upx
behavioral2/files/0x000b000000023b7e-6.dat	upx
behavioral2/files/0x000a000000023b87-36.dat	upx
behavioral2/files/0x000a000000023b85-35.dat	upx
behavioral2/files/0x000a000000023b89-46.dat	upx
behavioral2/files/0x000a000000023b8a-47.dat	upx
behavioral2/memory/4768-60-0x00007FF7F8350000-0x00007FF7F8741000-memory.dmp	upx
behavioral2/memory/2612-63-0x00007FF730FB0000-0x00007FF7313A1000-memory.dmp	upx
behavioral2/files/0x000a000000023b8c-67.dat	upx
behavioral2/files/0x000a000000023b8b-71.dat	upx
behavioral2/files/0x000a000000023b8d-75.dat	upx
behavioral2/files/0x000a000000023b8f-87.dat	upx
behavioral2/files/0x000a000000023b91-97.dat	upx
behavioral2/files/0x000a000000023b96-122.dat	upx
behavioral2/files/0x000a000000023b98-132.dat	upx
behavioral2/files/0x000a000000023b9e-162.dat	upx
behavioral2/memory/1572-451-0x00007FF6412B0000-0x00007FF6416A1000-memory.dmp	upx
behavioral2/memory/3920-461-0x00007FF7EFCA0000-0x00007FF7F0091000-memory.dmp	upx
behavioral2/memory/1056-475-0x00007FF6D8B70000-0x00007FF6D8F61000-memory.dmp	upx
behavioral2/memory/1064-479-0x00007FF70DA30000-0x00007FF70DE21000-memory.dmp	upx
behavioral2/memory/3160-487-0x00007FF633370000-0x00007FF633761000-memory.dmp	upx
behavioral2/memory/3796-491-0x00007FF61B290000-0x00007FF61B681000-memory.dmp	upx
behavioral2/memory/1712-497-0x00007FF6A89D0000-0x00007FF6A8DC1000-memory.dmp	upx
behavioral2/memory/996-503-0x00007FF7D4120000-0x00007FF7D4511000-memory.dmp	upx
behavioral2/memory/1908-501-0x00007FF61A6A0000-0x00007FF61AA91000-memory.dmp	upx
behavioral2/memory/2196-482-0x00007FF686250000-0x00007FF686641000-memory.dmp	upx
behavioral2/memory/3156-471-0x00007FF6D87F0000-0x00007FF6D8BE1000-memory.dmp	upx
behavioral2/memory/3184-465-0x00007FF73B250000-0x00007FF73B641000-memory.dmp	upx
behavioral2/memory/4576-467-0x00007FF631220000-0x00007FF631611000-memory.dmp	upx
behavioral2/files/0x000a000000023ba0-172.dat	upx
behavioral2/files/0x000a000000023b9f-168.dat	upx
behavioral2/files/0x000a000000023b9d-157.dat	upx
behavioral2/files/0x000a000000023b9c-152.dat	upx
behavioral2/files/0x000a000000023b9b-147.dat	upx
behavioral2/files/0x000a000000023b9a-142.dat	upx
behavioral2/files/0x000a000000023b99-138.dat	upx
behavioral2/files/0x000a000000023b97-128.dat	upx
behavioral2/files/0x000a000000023b95-118.dat	upx
behavioral2/files/0x000a000000023b94-112.dat	upx
behavioral2/files/0x000a000000023b93-107.dat	upx
behavioral2/files/0x000a000000023b92-103.dat	upx
behavioral2/files/0x000a000000023b90-93.dat	upx
behavioral2/files/0x000a000000023b8e-83.dat	upx
behavioral2/memory/4760-74-0x00007FF705E10000-0x00007FF706201000-memory.dmp	upx
behavioral2/memory/4772-70-0x00007FF650050000-0x00007FF650441000-memory.dmp	upx
behavioral2/memory/3840-69-0x00007FF645410000-0x00007FF645801000-memory.dmp	upx
behavioral2/memory/1760-65-0x00007FF6243B0000-0x00007FF6247A1000-memory.dmp	upx
behavioral2/memory/64-58-0x00007FF60E4F0000-0x00007FF60E8E1000-memory.dmp	upx
behavioral2/memory/2932-53-0x00007FF624770000-0x00007FF624B61000-memory.dmp	upx
behavioral2/files/0x000a000000023b88-49.dat	upx
behavioral2/memory/1088-41-0x00007FF6D8D50000-0x00007FF6D9141000-memory.dmp	upx
behavioral2/files/0x000a000000023b84-31.dat	upx
behavioral2/files/0x000a000000023b83-29.dat	upx
behavioral2/memory/708-27-0x00007FF6523A0000-0x00007FF652791000-memory.dmp	upx
behavioral2/files/0x000a000000023b86-26.dat	upx
behavioral2/memory/4952-19-0x00007FF63DB00000-0x00007FF63DEF1000-memory.dmp	upx
behavioral2/files/0x000a000000023b82-11.dat	upx
behavioral2/memory/1088-1984-0x00007FF6D8D50000-0x00007FF6D9141000-memory.dmp	upx
behavioral2/memory/4620-1999-0x00007FF62EAA0000-0x00007FF62EE91000-memory.dmp	upx
behavioral2/memory/4952-2035-0x00007FF63DB00000-0x00007FF63DEF1000-memory.dmp	upx
behavioral2/memory/708-2037-0x00007FF6523A0000-0x00007FF652791000-memory.dmp	upx
behavioral2/memory/2932-2040-0x00007FF624770000-0x00007FF624B61000-memory.dmp	upx
behavioral2/memory/64-2045-0x00007FF60E4F0000-0x00007FF60E8E1000-memory.dmp	upx
behavioral2/memory/4768-2047-0x00007FF7F8350000-0x00007FF7F8741000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\pQrpPSE.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\cjzSyGX.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\QPhgqkv.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\SynBkYT.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\QuHeGQb.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\ZFKPEZZ.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\EpusYZg.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\lpyzWXr.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\HoHaeFT.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\pCNfKIA.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\TxyZhRQ.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\XBudsrg.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\DXfuNXf.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\DSUvJgB.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\qaHUmwX.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\obnsDKV.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\dTuYdDb.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\nsjgPJw.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\WOFYFwk.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\xnVRSIQ.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\QcHcMCt.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\WFTdslH.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\VaffZlJ.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\NPxwRBP.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\fhxTWsQ.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\rWgsYtJ.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\snPATrv.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\kuCXrmI.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\oQsbnyN.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\GrDGvvj.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\kZfhiAD.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\JCUXxvZ.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\gUoJyyb.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\KCBZjdz.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\KttYjYS.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\DvzBqHr.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\lzVQGxK.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\LOzMqfr.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\tyUXnRn.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\iLhTNAs.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\zQFmbGM.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\zikbWSy.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\cWSfqXI.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\rXNjbmM.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\ggsBbuQ.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\UJcRexX.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\iKvePcb.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\TeZuxCR.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\cNhydmF.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\IhxOwrQ.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\cCJLvYF.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\oeUsTaQ.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\YROlBqE.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\KzLsJog.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\jgAqSGn.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\BYSuPZh.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\FDZgxdb.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\COghPrv.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\qHniopY.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\iXOVByF.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\dfRLctb.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\mjTGXAi.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\OkItBnJ.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
File created	C:\Windows\System32\emAgFLj.exe	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 4952	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	84
PID 4620 wrote to memory of 4952	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	84
PID 4620 wrote to memory of 708	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	85
PID 4620 wrote to memory of 708	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	85
PID 4620 wrote to memory of 1760	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	86
PID 4620 wrote to memory of 1760	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	86
PID 4620 wrote to memory of 1088	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	87
PID 4620 wrote to memory of 1088	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	87
PID 4620 wrote to memory of 2932	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	88
PID 4620 wrote to memory of 2932	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	88
PID 4620 wrote to memory of 64	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	89
PID 4620 wrote to memory of 64	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	89
PID 4620 wrote to memory of 3840	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	90
PID 4620 wrote to memory of 3840	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	90
PID 4620 wrote to memory of 4768	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	91
PID 4620 wrote to memory of 4768	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	91
PID 4620 wrote to memory of 2612	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	92
PID 4620 wrote to memory of 2612	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	92
PID 4620 wrote to memory of 4772	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	93
PID 4620 wrote to memory of 4772	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	93
PID 4620 wrote to memory of 1908	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	94
PID 4620 wrote to memory of 1908	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	94
PID 4620 wrote to memory of 4760	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	95
PID 4620 wrote to memory of 4760	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	95
PID 4620 wrote to memory of 996	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	96
PID 4620 wrote to memory of 996	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	96
PID 4620 wrote to memory of 1572	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	97
PID 4620 wrote to memory of 1572	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	97
PID 4620 wrote to memory of 3920	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	98
PID 4620 wrote to memory of 3920	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	98
PID 4620 wrote to memory of 3184	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	99
PID 4620 wrote to memory of 3184	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	99
PID 4620 wrote to memory of 4576	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	100
PID 4620 wrote to memory of 4576	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	100
PID 4620 wrote to memory of 3156	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	101
PID 4620 wrote to memory of 3156	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	101
PID 4620 wrote to memory of 1056	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	102
PID 4620 wrote to memory of 1056	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	102
PID 4620 wrote to memory of 1064	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	103
PID 4620 wrote to memory of 1064	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	103
PID 4620 wrote to memory of 2196	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	104
PID 4620 wrote to memory of 2196	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	104
PID 4620 wrote to memory of 3160	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	105
PID 4620 wrote to memory of 3160	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	105
PID 4620 wrote to memory of 3796	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	106
PID 4620 wrote to memory of 3796	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	106
PID 4620 wrote to memory of 1712	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	107
PID 4620 wrote to memory of 1712	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	107
PID 4620 wrote to memory of 1612	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	108
PID 4620 wrote to memory of 1612	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	108
PID 4620 wrote to memory of 60	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	109
PID 4620 wrote to memory of 60	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	109
PID 4620 wrote to memory of 4440	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	110
PID 4620 wrote to memory of 4440	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	110
PID 4620 wrote to memory of 1856	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	111
PID 4620 wrote to memory of 1856	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	111
PID 4620 wrote to memory of 1248	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	112
PID 4620 wrote to memory of 1248	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	112
PID 4620 wrote to memory of 624	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	113
PID 4620 wrote to memory of 624	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	113
PID 4620 wrote to memory of 1976	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	114
PID 4620 wrote to memory of 1976	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	114
PID 4620 wrote to memory of 1104	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	115
PID 4620 wrote to memory of 1104	4620	0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0ba889b039a6f31daa9faddc42bd48ce_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Windows\System32\kKZnRsg.exe
  C:\Windows\System32\kKZnRsg.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System32\STOeAmd.exe
  C:\Windows\System32\STOeAmd.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System32\tXenuCA.exe
  C:\Windows\System32\tXenuCA.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System32\aojfVTi.exe
  C:\Windows\System32\aojfVTi.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System32\QDhshCq.exe
  C:\Windows\System32\QDhshCq.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System32\iEeHHhH.exe
  C:\Windows\System32\iEeHHhH.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System32\ELHnkWq.exe
  C:\Windows\System32\ELHnkWq.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System32\KhnBtyv.exe
  C:\Windows\System32\KhnBtyv.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System32\DtHktDb.exe
  C:\Windows\System32\DtHktDb.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System32\kaUMwgA.exe
  C:\Windows\System32\kaUMwgA.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System32\VJAmJZk.exe
  C:\Windows\System32\VJAmJZk.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System32\slzKjnC.exe
  C:\Windows\System32\slzKjnC.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System32\yOVnhLk.exe
  C:\Windows\System32\yOVnhLk.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System32\VaffZlJ.exe
  C:\Windows\System32\VaffZlJ.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System32\weqoFmk.exe
  C:\Windows\System32\weqoFmk.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System32\fhyZSPj.exe
  C:\Windows\System32\fhyZSPj.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System32\rcHkvJp.exe
  C:\Windows\System32\rcHkvJp.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System32\blLNVkv.exe
  C:\Windows\System32\blLNVkv.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System32\lWgeciH.exe
  C:\Windows\System32\lWgeciH.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System32\yXUHxjB.exe
  C:\Windows\System32\yXUHxjB.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System32\fZwYvrH.exe
  C:\Windows\System32\fZwYvrH.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System32\yFXTfNI.exe
  C:\Windows\System32\yFXTfNI.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System32\mjTGXAi.exe
  C:\Windows\System32\mjTGXAi.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System32\aLChZTd.exe
  C:\Windows\System32\aLChZTd.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System32\LEFwkLH.exe
  C:\Windows\System32\LEFwkLH.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System32\GvgZzBI.exe
  C:\Windows\System32\GvgZzBI.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System32\VqvzVBO.exe
  C:\Windows\System32\VqvzVBO.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System32\olcaGRp.exe
  C:\Windows\System32\olcaGRp.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System32\ZOBkSrQ.exe
  C:\Windows\System32\ZOBkSrQ.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System32\CGISWnh.exe
  C:\Windows\System32\CGISWnh.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System32\meCXNDW.exe
  C:\Windows\System32\meCXNDW.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System32\GSWHNdc.exe
  C:\Windows\System32\GSWHNdc.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System32\uMHwbHn.exe
  C:\Windows\System32\uMHwbHn.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System32\XBudsrg.exe
  C:\Windows\System32\XBudsrg.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System32\EpusYZg.exe
  C:\Windows\System32\EpusYZg.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System32\RmGQXkb.exe
  C:\Windows\System32\RmGQXkb.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System32\NZlfDwA.exe
  C:\Windows\System32\NZlfDwA.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System32\OkItBnJ.exe
  C:\Windows\System32\OkItBnJ.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System32\ysgUvTk.exe
  C:\Windows\System32\ysgUvTk.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System32\PDgxmhF.exe
  C:\Windows\System32\PDgxmhF.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System32\tcrkvFK.exe
  C:\Windows\System32\tcrkvFK.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System32\tHQITYG.exe
  C:\Windows\System32\tHQITYG.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System32\ECEepTc.exe
  C:\Windows\System32\ECEepTc.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System32\lDFDciv.exe
  C:\Windows\System32\lDFDciv.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System32\sMchkEs.exe
  C:\Windows\System32\sMchkEs.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System32\dweJboB.exe
  C:\Windows\System32\dweJboB.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System32\ghbCHMe.exe
  C:\Windows\System32\ghbCHMe.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System32\YDJyyep.exe
  C:\Windows\System32\YDJyyep.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System32\PhhSkuv.exe
  C:\Windows\System32\PhhSkuv.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System32\jOXHVcN.exe
  C:\Windows\System32\jOXHVcN.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System32\xYUeHOP.exe
  C:\Windows\System32\xYUeHOP.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System32\wkFhzIm.exe
  C:\Windows\System32\wkFhzIm.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System32\PwfPNVv.exe
  C:\Windows\System32\PwfPNVv.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System32\AUgBITN.exe
  C:\Windows\System32\AUgBITN.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System32\jgAqSGn.exe
  C:\Windows\System32\jgAqSGn.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System32\rkbMmSy.exe
  C:\Windows\System32\rkbMmSy.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System32\SynBkYT.exe
  C:\Windows\System32\SynBkYT.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System32\NPxwRBP.exe
  C:\Windows\System32\NPxwRBP.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System32\FOtKMTS.exe
  C:\Windows\System32\FOtKMTS.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System32\WOFYFwk.exe
  C:\Windows\System32\WOFYFwk.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System32\iGTNJbH.exe
  C:\Windows\System32\iGTNJbH.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System32\oqPvzgZ.exe
  C:\Windows\System32\oqPvzgZ.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System32\IUDdubg.exe
  C:\Windows\System32\IUDdubg.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System32\TsMksBU.exe
  C:\Windows\System32\TsMksBU.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System32\JByQMRi.exe
  C:\Windows\System32\JByQMRi.exe
  2⤵
  PID:4292
- C:\Windows\System32\bGtBSvJ.exe
  C:\Windows\System32\bGtBSvJ.exe
  2⤵
  PID:1780
- C:\Windows\System32\eGFyAwy.exe
  C:\Windows\System32\eGFyAwy.exe
  2⤵
  PID:1648
- C:\Windows\System32\NuHHsUr.exe
  C:\Windows\System32\NuHHsUr.exe
  2⤵
  PID:2468
- C:\Windows\System32\QuHeGQb.exe
  C:\Windows\System32\QuHeGQb.exe
  2⤵
  PID:4212
- C:\Windows\System32\DumVGlC.exe
  C:\Windows\System32\DumVGlC.exe
  2⤵
  PID:3748
- C:\Windows\System32\QBFyJtH.exe
  C:\Windows\System32\QBFyJtH.exe
  2⤵
  PID:544
- C:\Windows\System32\aGDtrKu.exe
  C:\Windows\System32\aGDtrKu.exe
  2⤵
  PID:4312
- C:\Windows\System32\VCInKGS.exe
  C:\Windows\System32\VCInKGS.exe
  2⤵
  PID:2828
- C:\Windows\System32\XnsUdcr.exe
  C:\Windows\System32\XnsUdcr.exe
  2⤵
  PID:764
- C:\Windows\System32\wcrDaco.exe
  C:\Windows\System32\wcrDaco.exe
  2⤵
  PID:3004
- C:\Windows\System32\iKvePcb.exe
  C:\Windows\System32\iKvePcb.exe
  2⤵
  PID:2956
- C:\Windows\System32\qxiSAtX.exe
  C:\Windows\System32\qxiSAtX.exe
  2⤵
  PID:1772
- C:\Windows\System32\aCPOtLj.exe
  C:\Windows\System32\aCPOtLj.exe
  2⤵
  PID:4288
- C:\Windows\System32\vxPciGe.exe
  C:\Windows\System32\vxPciGe.exe
  2⤵
  PID:1484
- C:\Windows\System32\ydwSRtL.exe
  C:\Windows\System32\ydwSRtL.exe
  2⤵
  PID:5068
- C:\Windows\System32\mymHqdL.exe
  C:\Windows\System32\mymHqdL.exe
  2⤵
  PID:5076
- C:\Windows\System32\EYTkoaa.exe
  C:\Windows\System32\EYTkoaa.exe
  2⤵
  PID:5012
- C:\Windows\System32\RzOaDbh.exe
  C:\Windows\System32\RzOaDbh.exe
  2⤵
  PID:4464
- C:\Windows\System32\oVIkWus.exe
  C:\Windows\System32\oVIkWus.exe
  2⤵
  PID:4748
- C:\Windows\System32\inKdSda.exe
  C:\Windows\System32\inKdSda.exe
  2⤵
  PID:5124
- C:\Windows\System32\VTdTOBP.exe
  C:\Windows\System32\VTdTOBP.exe
  2⤵
  PID:5152
- C:\Windows\System32\VlMNdkU.exe
  C:\Windows\System32\VlMNdkU.exe
  2⤵
  PID:5176
- C:\Windows\System32\iQedRQU.exe
  C:\Windows\System32\iQedRQU.exe
  2⤵
  PID:5208
- C:\Windows\System32\sVNmqfy.exe
  C:\Windows\System32\sVNmqfy.exe
  2⤵
  PID:5236
- C:\Windows\System32\mlopzjX.exe
  C:\Windows\System32\mlopzjX.exe
  2⤵
  PID:5264
- C:\Windows\System32\YCXAimN.exe
  C:\Windows\System32\YCXAimN.exe
  2⤵
  PID:5288
- C:\Windows\System32\COghPrv.exe
  C:\Windows\System32\COghPrv.exe
  2⤵
  PID:5320
- C:\Windows\System32\BUHSEJC.exe
  C:\Windows\System32\BUHSEJC.exe
  2⤵
  PID:5348
- C:\Windows\System32\lyqInaU.exe
  C:\Windows\System32\lyqInaU.exe
  2⤵
  PID:5372
- C:\Windows\System32\HkEBWip.exe
  C:\Windows\System32\HkEBWip.exe
  2⤵
  PID:5404
- C:\Windows\System32\tYzGUrm.exe
  C:\Windows\System32\tYzGUrm.exe
  2⤵
  PID:5432
- C:\Windows\System32\NcVEZKs.exe
  C:\Windows\System32\NcVEZKs.exe
  2⤵
  PID:5460
- C:\Windows\System32\emAgFLj.exe
  C:\Windows\System32\emAgFLj.exe
  2⤵
  PID:5488
- C:\Windows\System32\LesjGHN.exe
  C:\Windows\System32\LesjGHN.exe
  2⤵
  PID:5512
- C:\Windows\System32\ZMAQojf.exe
  C:\Windows\System32\ZMAQojf.exe
  2⤵
  PID:5544
- C:\Windows\System32\FUsvyrS.exe
  C:\Windows\System32\FUsvyrS.exe
  2⤵
  PID:5572
- C:\Windows\System32\YzWOCVn.exe
  C:\Windows\System32\YzWOCVn.exe
  2⤵
  PID:5596
- C:\Windows\System32\eEulIZR.exe
  C:\Windows\System32\eEulIZR.exe
  2⤵
  PID:5628
- C:\Windows\System32\CKjSbAE.exe
  C:\Windows\System32\CKjSbAE.exe
  2⤵
  PID:5660
- C:\Windows\System32\eYggwEB.exe
  C:\Windows\System32\eYggwEB.exe
  2⤵
  PID:5684
- C:\Windows\System32\gQoGhZX.exe
  C:\Windows\System32\gQoGhZX.exe
  2⤵
  PID:5712
- C:\Windows\System32\WpwRrnx.exe
  C:\Windows\System32\WpwRrnx.exe
  2⤵
  PID:5740
- C:\Windows\System32\HjxZFPA.exe
  C:\Windows\System32\HjxZFPA.exe
  2⤵
  PID:5768
- C:\Windows\System32\iFQxyhT.exe
  C:\Windows\System32\iFQxyhT.exe
  2⤵
  PID:5796
- C:\Windows\System32\IfBNfaw.exe
  C:\Windows\System32\IfBNfaw.exe
  2⤵
  PID:5820
- C:\Windows\System32\spBtKhr.exe
  C:\Windows\System32\spBtKhr.exe
  2⤵
  PID:5852
- C:\Windows\System32\QCbJaBD.exe
  C:\Windows\System32\QCbJaBD.exe
  2⤵
  PID:5880
- C:\Windows\System32\PoNQdtQ.exe
  C:\Windows\System32\PoNQdtQ.exe
  2⤵
  PID:5904
- C:\Windows\System32\yOJtIoz.exe
  C:\Windows\System32\yOJtIoz.exe
  2⤵
  PID:5936
- C:\Windows\System32\yuhvShs.exe
  C:\Windows\System32\yuhvShs.exe
  2⤵
  PID:5964
- C:\Windows\System32\DDHRuVr.exe
  C:\Windows\System32\DDHRuVr.exe
  2⤵
  PID:5992
- C:\Windows\System32\yWNmFYf.exe
  C:\Windows\System32\yWNmFYf.exe
  2⤵
  PID:6020
- C:\Windows\System32\grElJpf.exe
  C:\Windows\System32\grElJpf.exe
  2⤵
  PID:6048
- C:\Windows\System32\MylrQVN.exe
  C:\Windows\System32\MylrQVN.exe
  2⤵
  PID:6080
- C:\Windows\System32\ljKABNX.exe
  C:\Windows\System32\ljKABNX.exe
  2⤵
  PID:6104
- C:\Windows\System32\BOiYSgD.exe
  C:\Windows\System32\BOiYSgD.exe
  2⤵
  PID:6128
- C:\Windows\System32\lpyzWXr.exe
  C:\Windows\System32\lpyzWXr.exe
  2⤵
  PID:4564
- C:\Windows\System32\QaiRmIU.exe
  C:\Windows\System32\QaiRmIU.exe
  2⤵
  PID:376
- C:\Windows\System32\zGIJuaK.exe
  C:\Windows\System32\zGIJuaK.exe
  2⤵
  PID:2420
- C:\Windows\System32\IXfXdkY.exe
  C:\Windows\System32\IXfXdkY.exe
  2⤵
  PID:3800
- C:\Windows\System32\GJZOAOJ.exe
  C:\Windows\System32\GJZOAOJ.exe
  2⤵
  PID:5184
- C:\Windows\System32\hTfHtUt.exe
  C:\Windows\System32\hTfHtUt.exe
  2⤵
  PID:5252
- C:\Windows\System32\dulttrY.exe
  C:\Windows\System32\dulttrY.exe
  2⤵
  PID:5280
- C:\Windows\System32\ZFKPEZZ.exe
  C:\Windows\System32\ZFKPEZZ.exe
  2⤵
  PID:5340
- C:\Windows\System32\AsqtNCo.exe
  C:\Windows\System32\AsqtNCo.exe
  2⤵
  PID:5440
- C:\Windows\System32\MFaiNkG.exe
  C:\Windows\System32\MFaiNkG.exe
  2⤵
  PID:1808
- C:\Windows\System32\qUfGLNp.exe
  C:\Windows\System32\qUfGLNp.exe
  2⤵
  PID:5564
- C:\Windows\System32\kZfhiAD.exe
  C:\Windows\System32\kZfhiAD.exe
  2⤵
  PID:1804
- C:\Windows\System32\KmOtpdv.exe
  C:\Windows\System32\KmOtpdv.exe
  2⤵
  PID:5648
- C:\Windows\System32\vZGtePk.exe
  C:\Windows\System32\vZGtePk.exe
  2⤵
  PID:5692
- C:\Windows\System32\CLUOOzN.exe
  C:\Windows\System32\CLUOOzN.exe
  2⤵
  PID:5776
- C:\Windows\System32\ppJoDlp.exe
  C:\Windows\System32\ppJoDlp.exe
  2⤵
  PID:5868
- C:\Windows\System32\lIwIrCd.exe
  C:\Windows\System32\lIwIrCd.exe
  2⤵
  PID:5888
- C:\Windows\System32\ibDNJEP.exe
  C:\Windows\System32\ibDNJEP.exe
  2⤵
  PID:5912
- C:\Windows\System32\DxTEAcs.exe
  C:\Windows\System32\DxTEAcs.exe
  2⤵
  PID:5984
- C:\Windows\System32\ifQupsg.exe
  C:\Windows\System32\ifQupsg.exe
  2⤵
  PID:4320
- C:\Windows\System32\MsRLRQW.exe
  C:\Windows\System32\MsRLRQW.exe
  2⤵
  PID:760
- C:\Windows\System32\cVfKLJF.exe
  C:\Windows\System32\cVfKLJF.exe
  2⤵
  PID:3208
- C:\Windows\System32\mPTnhNW.exe
  C:\Windows\System32\mPTnhNW.exe
  2⤵
  PID:1232
- C:\Windows\System32\rKvVBCn.exe
  C:\Windows\System32\rKvVBCn.exe
  2⤵
  PID:2700
- C:\Windows\System32\tyUXnRn.exe
  C:\Windows\System32\tyUXnRn.exe
  2⤵
  PID:1660
- C:\Windows\System32\AvNjsNj.exe
  C:\Windows\System32\AvNjsNj.exe
  2⤵
  PID:2324
- C:\Windows\System32\lBUvLwM.exe
  C:\Windows\System32\lBUvLwM.exe
  2⤵
  PID:3876
- C:\Windows\System32\hJFCbQj.exe
  C:\Windows\System32\hJFCbQj.exe
  2⤵
  PID:4796
- C:\Windows\System32\qLuyZNs.exe
  C:\Windows\System32\qLuyZNs.exe
  2⤵
  PID:5216
- C:\Windows\System32\KCEPMbb.exe
  C:\Windows\System32\KCEPMbb.exe
  2⤵
  PID:5284
- C:\Windows\System32\zRAFnuR.exe
  C:\Windows\System32\zRAFnuR.exe
  2⤵
  PID:3980
- C:\Windows\System32\ScUTgvb.exe
  C:\Windows\System32\ScUTgvb.exe
  2⤵
  PID:5520
- C:\Windows\System32\iXOVByF.exe
  C:\Windows\System32\iXOVByF.exe
  2⤵
  PID:5496
- C:\Windows\System32\AecSZjc.exe
  C:\Windows\System32\AecSZjc.exe
  2⤵
  PID:5668
- C:\Windows\System32\JFqLtsG.exe
  C:\Windows\System32\JFqLtsG.exe
  2⤵
  PID:5732
- C:\Windows\System32\pmRFrpq.exe
  C:\Windows\System32\pmRFrpq.exe
  2⤵
  PID:5812
- C:\Windows\System32\aEwBUJQ.exe
  C:\Windows\System32\aEwBUJQ.exe
  2⤵
  PID:2400
- C:\Windows\System32\BYSuPZh.exe
  C:\Windows\System32\BYSuPZh.exe
  2⤵
  PID:2972
- C:\Windows\System32\fyeBayH.exe
  C:\Windows\System32\fyeBayH.exe
  2⤵
  PID:6012
- C:\Windows\System32\ZFXDuEW.exe
  C:\Windows\System32\ZFXDuEW.exe
  2⤵
  PID:6028
- C:\Windows\System32\hCTpksC.exe
  C:\Windows\System32\hCTpksC.exe
  2⤵
  PID:5100
- C:\Windows\System32\TCgDitJ.exe
  C:\Windows\System32\TCgDitJ.exe
  2⤵
  PID:5356
- C:\Windows\System32\HrGqZZb.exe
  C:\Windows\System32\HrGqZZb.exe
  2⤵
  PID:6136
- C:\Windows\System32\xnVRSIQ.exe
  C:\Windows\System32\xnVRSIQ.exe
  2⤵
  PID:1320
- C:\Windows\System32\BwChkHC.exe
  C:\Windows\System32\BwChkHC.exe
  2⤵
  PID:684
- C:\Windows\System32\DvzBqHr.exe
  C:\Windows\System32\DvzBqHr.exe
  2⤵
  PID:2004
- C:\Windows\System32\IFLfGwS.exe
  C:\Windows\System32\IFLfGwS.exe
  2⤵
  PID:5368
- C:\Windows\System32\JCUXxvZ.exe
  C:\Windows\System32\JCUXxvZ.exe
  2⤵
  PID:5392
- C:\Windows\System32\DJJVxbe.exe
  C:\Windows\System32\DJJVxbe.exe
  2⤵
  PID:6120
- C:\Windows\System32\xDNFQYS.exe
  C:\Windows\System32\xDNFQYS.exe
  2⤵
  PID:6196
- C:\Windows\System32\HYlYBUq.exe
  C:\Windows\System32\HYlYBUq.exe
  2⤵
  PID:6216
- C:\Windows\System32\IIEliXY.exe
  C:\Windows\System32\IIEliXY.exe
  2⤵
  PID:6232
- C:\Windows\System32\SPPQjzw.exe
  C:\Windows\System32\SPPQjzw.exe
  2⤵
  PID:6264
- C:\Windows\System32\WKvDtyd.exe
  C:\Windows\System32\WKvDtyd.exe
  2⤵
  PID:6280
- C:\Windows\System32\oxLoLyk.exe
  C:\Windows\System32\oxLoLyk.exe
  2⤵
  PID:6300
- C:\Windows\System32\pUwxvTf.exe
  C:\Windows\System32\pUwxvTf.exe
  2⤵
  PID:6320
- C:\Windows\System32\JWEhJLg.exe
  C:\Windows\System32\JWEhJLg.exe
  2⤵
  PID:6340
- C:\Windows\System32\HRGcqOB.exe
  C:\Windows\System32\HRGcqOB.exe
  2⤵
  PID:6360
- C:\Windows\System32\VksgNpK.exe
  C:\Windows\System32\VksgNpK.exe
  2⤵
  PID:6412
- C:\Windows\System32\tQRyvVa.exe
  C:\Windows\System32\tQRyvVa.exe
  2⤵
  PID:6444
- C:\Windows\System32\SrGbDiu.exe
  C:\Windows\System32\SrGbDiu.exe
  2⤵
  PID:6464
- C:\Windows\System32\MdoGLUh.exe
  C:\Windows\System32\MdoGLUh.exe
  2⤵
  PID:6488
- C:\Windows\System32\jWqknSc.exe
  C:\Windows\System32\jWqknSc.exe
  2⤵
  PID:6508
- C:\Windows\System32\LUhywoo.exe
  C:\Windows\System32\LUhywoo.exe
  2⤵
  PID:6544
- C:\Windows\System32\NjcRxjX.exe
  C:\Windows\System32\NjcRxjX.exe
  2⤵
  PID:6564
- C:\Windows\System32\EdcpCDk.exe
  C:\Windows\System32\EdcpCDk.exe
  2⤵
  PID:6608
- C:\Windows\System32\lMGErXZ.exe
  C:\Windows\System32\lMGErXZ.exe
  2⤵
  PID:6624
- C:\Windows\System32\TKAfknM.exe
  C:\Windows\System32\TKAfknM.exe
  2⤵
  PID:6648
- C:\Windows\System32\WxWouJu.exe
  C:\Windows\System32\WxWouJu.exe
  2⤵
  PID:6668
- C:\Windows\System32\lvqbsNU.exe
  C:\Windows\System32\lvqbsNU.exe
  2⤵
  PID:6708
- C:\Windows\System32\IcwyQwS.exe
  C:\Windows\System32\IcwyQwS.exe
  2⤵
  PID:6728
- C:\Windows\System32\KnRobVa.exe
  C:\Windows\System32\KnRobVa.exe
  2⤵
  PID:6744
- C:\Windows\System32\qGYyXOW.exe
  C:\Windows\System32\qGYyXOW.exe
  2⤵
  PID:6768
- C:\Windows\System32\dHcjISu.exe
  C:\Windows\System32\dHcjISu.exe
  2⤵
  PID:6828
- C:\Windows\System32\JkFQWJd.exe
  C:\Windows\System32\JkFQWJd.exe
  2⤵
  PID:6864
- C:\Windows\System32\wXQtvKm.exe
  C:\Windows\System32\wXQtvKm.exe
  2⤵
  PID:6908
- C:\Windows\System32\zgwbNIM.exe
  C:\Windows\System32\zgwbNIM.exe
  2⤵
  PID:6932
- C:\Windows\System32\HGDeoRX.exe
  C:\Windows\System32\HGDeoRX.exe
  2⤵
  PID:6948
- C:\Windows\System32\HTDIVDC.exe
  C:\Windows\System32\HTDIVDC.exe
  2⤵
  PID:6992
- C:\Windows\System32\LRYgoMN.exe
  C:\Windows\System32\LRYgoMN.exe
  2⤵
  PID:7052
- C:\Windows\System32\UVxVIZm.exe
  C:\Windows\System32\UVxVIZm.exe
  2⤵
  PID:7076
- C:\Windows\System32\hRprDCq.exe
  C:\Windows\System32\hRprDCq.exe
  2⤵
  PID:7100
- C:\Windows\System32\OdSlkpv.exe
  C:\Windows\System32\OdSlkpv.exe
  2⤵
  PID:7120
- C:\Windows\System32\qFEeYqV.exe
  C:\Windows\System32\qFEeYqV.exe
  2⤵
  PID:7152
- C:\Windows\System32\hTXvlOu.exe
  C:\Windows\System32\hTXvlOu.exe
  2⤵
  PID:5296
- C:\Windows\System32\PTCLZzK.exe
  C:\Windows\System32\PTCLZzK.exe
  2⤵
  PID:6164
- C:\Windows\System32\ZazgAHk.exe
  C:\Windows\System32\ZazgAHk.exe
  2⤵
  PID:6244
- C:\Windows\System32\eTIdNFQ.exe
  C:\Windows\System32\eTIdNFQ.exe
  2⤵
  PID:6276
- C:\Windows\System32\zMaHvGs.exe
  C:\Windows\System32\zMaHvGs.exe
  2⤵
  PID:6376
- C:\Windows\System32\IHVZsND.exe
  C:\Windows\System32\IHVZsND.exe
  2⤵
  PID:6456
- C:\Windows\System32\HPSJIua.exe
  C:\Windows\System32\HPSJIua.exe
  2⤵
  PID:6436
- C:\Windows\System32\wGRwmhA.exe
  C:\Windows\System32\wGRwmhA.exe
  2⤵
  PID:6504
- C:\Windows\System32\UImXRUq.exe
  C:\Windows\System32\UImXRUq.exe
  2⤵
  PID:6476
- C:\Windows\System32\JLfgCuv.exe
  C:\Windows\System32\JLfgCuv.exe
  2⤵
  PID:6632
- C:\Windows\System32\vBvmoGZ.exe
  C:\Windows\System32\vBvmoGZ.exe
  2⤵
  PID:6676
- C:\Windows\System32\DZuaazU.exe
  C:\Windows\System32\DZuaazU.exe
  2⤵
  PID:6752
- C:\Windows\System32\etJmmfF.exe
  C:\Windows\System32\etJmmfF.exe
  2⤵
  PID:6916
- C:\Windows\System32\EdPYqfa.exe
  C:\Windows\System32\EdPYqfa.exe
  2⤵
  PID:6984
- C:\Windows\System32\zWsYaCJ.exe
  C:\Windows\System32\zWsYaCJ.exe
  2⤵
  PID:7004
- C:\Windows\System32\BwZdNfJ.exe
  C:\Windows\System32\BwZdNfJ.exe
  2⤵
  PID:7064
- C:\Windows\System32\KodoJni.exe
  C:\Windows\System32\KodoJni.exe
  2⤵
  PID:7144
- C:\Windows\System32\dRbecEi.exe
  C:\Windows\System32\dRbecEi.exe
  2⤵
  PID:7164
- C:\Windows\System32\ajxZXHX.exe
  C:\Windows\System32\ajxZXHX.exe
  2⤵
  PID:6204
- C:\Windows\System32\QcHcMCt.exe
  C:\Windows\System32\QcHcMCt.exe
  2⤵
  PID:6336
- C:\Windows\System32\BGHSwQs.exe
  C:\Windows\System32\BGHSwQs.exe
  2⤵
  PID:6368
- C:\Windows\System32\aWUUYGg.exe
  C:\Windows\System32\aWUUYGg.exe
  2⤵
  PID:6556
- C:\Windows\System32\rombrHZ.exe
  C:\Windows\System32\rombrHZ.exe
  2⤵
  PID:7020
- C:\Windows\System32\txeXhPl.exe
  C:\Windows\System32\txeXhPl.exe
  2⤵
  PID:6288
- C:\Windows\System32\jLKHxge.exe
  C:\Windows\System32\jLKHxge.exe
  2⤵
  PID:6576
- C:\Windows\System32\KTDjcla.exe
  C:\Windows\System32\KTDjcla.exe
  2⤵
  PID:6500
- C:\Windows\System32\GboRXSP.exe
  C:\Windows\System32\GboRXSP.exe
  2⤵
  PID:6572
- C:\Windows\System32\eFHQThK.exe
  C:\Windows\System32\eFHQThK.exe
  2⤵
  PID:6784
- C:\Windows\System32\qxrECgR.exe
  C:\Windows\System32\qxrECgR.exe
  2⤵
  PID:7172
- C:\Windows\System32\YBbKOvm.exe
  C:\Windows\System32\YBbKOvm.exe
  2⤵
  PID:7192
- C:\Windows\System32\FzbDBYp.exe
  C:\Windows\System32\FzbDBYp.exe
  2⤵
  PID:7216
- C:\Windows\System32\zEqCIbg.exe
  C:\Windows\System32\zEqCIbg.exe
  2⤵
  PID:7240
- C:\Windows\System32\WiFpPkc.exe
  C:\Windows\System32\WiFpPkc.exe
  2⤵
  PID:7256
- C:\Windows\System32\KkTHpqA.exe
  C:\Windows\System32\KkTHpqA.exe
  2⤵
  PID:7292
- C:\Windows\System32\jfLAjVn.exe
  C:\Windows\System32\jfLAjVn.exe
  2⤵
  PID:7332
- C:\Windows\System32\xCDFcBa.exe
  C:\Windows\System32\xCDFcBa.exe
  2⤵
  PID:7352
- C:\Windows\System32\paBBMqk.exe
  C:\Windows\System32\paBBMqk.exe
  2⤵
  PID:7368
- C:\Windows\System32\ROtmZxJ.exe
  C:\Windows\System32\ROtmZxJ.exe
  2⤵
  PID:7404
- C:\Windows\System32\UGYGdJW.exe
  C:\Windows\System32\UGYGdJW.exe
  2⤵
  PID:7432
- C:\Windows\System32\YZaebDh.exe
  C:\Windows\System32\YZaebDh.exe
  2⤵
  PID:7452
- C:\Windows\System32\VlAMoHe.exe
  C:\Windows\System32\VlAMoHe.exe
  2⤵
  PID:7468
- C:\Windows\System32\atDItTN.exe
  C:\Windows\System32\atDItTN.exe
  2⤵
  PID:7484
- C:\Windows\System32\SYviztY.exe
  C:\Windows\System32\SYviztY.exe
  2⤵
  PID:7520
- C:\Windows\System32\SvTLSPm.exe
  C:\Windows\System32\SvTLSPm.exe
  2⤵
  PID:7540
- C:\Windows\System32\tNABvRl.exe
  C:\Windows\System32\tNABvRl.exe
  2⤵
  PID:7560
- C:\Windows\System32\gQfyADz.exe
  C:\Windows\System32\gQfyADz.exe
  2⤵
  PID:7628
- C:\Windows\System32\mnreZEO.exe
  C:\Windows\System32\mnreZEO.exe
  2⤵
  PID:7672
- C:\Windows\System32\hSzHpsP.exe
  C:\Windows\System32\hSzHpsP.exe
  2⤵
  PID:7708
- C:\Windows\System32\pQrpPSE.exe
  C:\Windows\System32\pQrpPSE.exe
  2⤵
  PID:7732
- C:\Windows\System32\iVhurZH.exe
  C:\Windows\System32\iVhurZH.exe
  2⤵
  PID:7756
- C:\Windows\System32\ClwVBus.exe
  C:\Windows\System32\ClwVBus.exe
  2⤵
  PID:7772
- C:\Windows\System32\eyrtLVn.exe
  C:\Windows\System32\eyrtLVn.exe
  2⤵
  PID:7792
- C:\Windows\System32\TMWHTIH.exe
  C:\Windows\System32\TMWHTIH.exe
  2⤵
  PID:7812
- C:\Windows\System32\HNbUFNA.exe
  C:\Windows\System32\HNbUFNA.exe
  2⤵
  PID:7856
- C:\Windows\System32\euvIKwV.exe
  C:\Windows\System32\euvIKwV.exe
  2⤵
  PID:7908
- C:\Windows\System32\YdypPWo.exe
  C:\Windows\System32\YdypPWo.exe
  2⤵
  PID:7936
- C:\Windows\System32\THxVUru.exe
  C:\Windows\System32\THxVUru.exe
  2⤵
  PID:7964
- C:\Windows\System32\dtSBxzn.exe
  C:\Windows\System32\dtSBxzn.exe
  2⤵
  PID:7980
- C:\Windows\System32\TjPfBUH.exe
  C:\Windows\System32\TjPfBUH.exe
  2⤵
  PID:8000
- C:\Windows\System32\DXfuNXf.exe
  C:\Windows\System32\DXfuNXf.exe
  2⤵
  PID:8024
- C:\Windows\System32\vVMXbCf.exe
  C:\Windows\System32\vVMXbCf.exe
  2⤵
  PID:8052
- C:\Windows\System32\cjzSyGX.exe
  C:\Windows\System32\cjzSyGX.exe
  2⤵
  PID:8088
- C:\Windows\System32\ADkhhpS.exe
  C:\Windows\System32\ADkhhpS.exe
  2⤵
  PID:8104
- C:\Windows\System32\DSUvJgB.exe
  C:\Windows\System32\DSUvJgB.exe
  2⤵
  PID:8124
- C:\Windows\System32\gUoJyyb.exe
  C:\Windows\System32\gUoJyyb.exe
  2⤵
  PID:8144
- C:\Windows\System32\UmMXiaM.exe
  C:\Windows\System32\UmMXiaM.exe
  2⤵
  PID:6760
- C:\Windows\System32\hcUrYKK.exe
  C:\Windows\System32\hcUrYKK.exe
  2⤵
  PID:7200
- C:\Windows\System32\rWgsYtJ.exe
  C:\Windows\System32\rWgsYtJ.exe
  2⤵
  PID:7264
- C:\Windows\System32\EhBLtwI.exe
  C:\Windows\System32\EhBLtwI.exe
  2⤵
  PID:7348
- C:\Windows\System32\zLjbVjm.exe
  C:\Windows\System32\zLjbVjm.exe
  2⤵
  PID:7388
- C:\Windows\System32\UeoSmMc.exe
  C:\Windows\System32\UeoSmMc.exe
  2⤵
  PID:7448
- C:\Windows\System32\nfCWbkQ.exe
  C:\Windows\System32\nfCWbkQ.exe
  2⤵
  PID:7572
- C:\Windows\System32\VPFvUDE.exe
  C:\Windows\System32\VPFvUDE.exe
  2⤵
  PID:7652
- C:\Windows\System32\iLhTNAs.exe
  C:\Windows\System32\iLhTNAs.exe
  2⤵
  PID:7700
- C:\Windows\System32\kVTgbzV.exe
  C:\Windows\System32\kVTgbzV.exe
  2⤵
  PID:7740
- C:\Windows\System32\dvQkhuL.exe
  C:\Windows\System32\dvQkhuL.exe
  2⤵
  PID:7764
- C:\Windows\System32\iqhcQyW.exe
  C:\Windows\System32\iqhcQyW.exe
  2⤵
  PID:7788
- C:\Windows\System32\UwXrlEz.exe
  C:\Windows\System32\UwXrlEz.exe
  2⤵
  PID:7892
- C:\Windows\System32\yIETsDu.exe
  C:\Windows\System32\yIETsDu.exe
  2⤵
  PID:7932
- C:\Windows\System32\iJadgiM.exe
  C:\Windows\System32\iJadgiM.exe
  2⤵
  PID:8008
- C:\Windows\System32\fJUSicE.exe
  C:\Windows\System32\fJUSicE.exe
  2⤵
  PID:8020
- C:\Windows\System32\MQXcyak.exe
  C:\Windows\System32\MQXcyak.exe
  2⤵
  PID:7492
- C:\Windows\System32\dwRRJqy.exe
  C:\Windows\System32\dwRRJqy.exe
  2⤵
  PID:7384
- C:\Windows\System32\hEDHVzN.exe
  C:\Windows\System32\hEDHVzN.exe
  2⤵
  PID:7548
- C:\Windows\System32\UdlzzgE.exe
  C:\Windows\System32\UdlzzgE.exe
  2⤵
  PID:7768
- C:\Windows\System32\eSGCMou.exe
  C:\Windows\System32\eSGCMou.exe
  2⤵
  PID:7960
- C:\Windows\System32\JzlGElY.exe
  C:\Windows\System32\JzlGElY.exe
  2⤵
  PID:7928
- C:\Windows\System32\dHFdRDQ.exe
  C:\Windows\System32\dHFdRDQ.exe
  2⤵
  PID:7204
- C:\Windows\System32\nnJkLBz.exe
  C:\Windows\System32\nnJkLBz.exe
  2⤵
  PID:7440
- C:\Windows\System32\YduANOa.exe
  C:\Windows\System32\YduANOa.exe
  2⤵
  PID:7688
- C:\Windows\System32\NlqAeSb.exe
  C:\Windows\System32\NlqAeSb.exe
  2⤵
  PID:7824
- C:\Windows\System32\CBtjogo.exe
  C:\Windows\System32\CBtjogo.exe
  2⤵
  PID:7972
- C:\Windows\System32\JhOEuRT.exe
  C:\Windows\System32\JhOEuRT.exe
  2⤵
  PID:8232
- C:\Windows\System32\OLuDjLB.exe
  C:\Windows\System32\OLuDjLB.exe
  2⤵
  PID:8252
- C:\Windows\System32\qAMcSfC.exe
  C:\Windows\System32\qAMcSfC.exe
  2⤵
  PID:8276
- C:\Windows\System32\dfRLctb.exe
  C:\Windows\System32\dfRLctb.exe
  2⤵
  PID:8292
- C:\Windows\System32\MNlowYq.exe
  C:\Windows\System32\MNlowYq.exe
  2⤵
  PID:8336
- C:\Windows\System32\sRXygGs.exe
  C:\Windows\System32\sRXygGs.exe
  2⤵
  PID:8356
- C:\Windows\System32\vhhExJq.exe
  C:\Windows\System32\vhhExJq.exe
  2⤵
  PID:8384
- C:\Windows\System32\zikbWSy.exe
  C:\Windows\System32\zikbWSy.exe
  2⤵
  PID:8424
- C:\Windows\System32\cBSSOUo.exe
  C:\Windows\System32\cBSSOUo.exe
  2⤵
  PID:8440
- C:\Windows\System32\WwBNBSo.exe
  C:\Windows\System32\WwBNBSo.exe
  2⤵
  PID:8460
- C:\Windows\System32\uWDuUgH.exe
  C:\Windows\System32\uWDuUgH.exe
  2⤵
  PID:8476
- C:\Windows\System32\DCkexeu.exe
  C:\Windows\System32\DCkexeu.exe
  2⤵
  PID:8496
- C:\Windows\System32\fhxTWsQ.exe
  C:\Windows\System32\fhxTWsQ.exe
  2⤵
  PID:8528
- C:\Windows\System32\yjVxcRb.exe
  C:\Windows\System32\yjVxcRb.exe
  2⤵
  PID:8544
- C:\Windows\System32\ZReUQtT.exe
  C:\Windows\System32\ZReUQtT.exe
  2⤵
  PID:8568
- C:\Windows\System32\UIwKRyq.exe
  C:\Windows\System32\UIwKRyq.exe
  2⤵
  PID:8664
- C:\Windows\System32\lCoBewT.exe
  C:\Windows\System32\lCoBewT.exe
  2⤵
  PID:8688
- C:\Windows\System32\wTzMwFC.exe
  C:\Windows\System32\wTzMwFC.exe
  2⤵
  PID:8712
- C:\Windows\System32\JMLjrZL.exe
  C:\Windows\System32\JMLjrZL.exe
  2⤵
  PID:8740
- C:\Windows\System32\fNiPMqR.exe
  C:\Windows\System32\fNiPMqR.exe
  2⤵
  PID:8756
- C:\Windows\System32\pMagIor.exe
  C:\Windows\System32\pMagIor.exe
  2⤵
  PID:8776
- C:\Windows\System32\SZyATZA.exe
  C:\Windows\System32\SZyATZA.exe
  2⤵
  PID:8796
- C:\Windows\System32\RqVvtJF.exe
  C:\Windows\System32\RqVvtJF.exe
  2⤵
  PID:8812
- C:\Windows\System32\Eskvbsq.exe
  C:\Windows\System32\Eskvbsq.exe
  2⤵
  PID:8836
- C:\Windows\System32\oluNZcX.exe
  C:\Windows\System32\oluNZcX.exe
  2⤵
  PID:8884
- C:\Windows\System32\gasKFOS.exe
  C:\Windows\System32\gasKFOS.exe
  2⤵
  PID:8916
- C:\Windows\System32\tWwmNUS.exe
  C:\Windows\System32\tWwmNUS.exe
  2⤵
  PID:8936
- C:\Windows\System32\QLBSRrh.exe
  C:\Windows\System32\QLBSRrh.exe
  2⤵
  PID:8988
- C:\Windows\System32\AQuJwOi.exe
  C:\Windows\System32\AQuJwOi.exe
  2⤵
  PID:9024
- C:\Windows\System32\OGpwvUA.exe
  C:\Windows\System32\OGpwvUA.exe
  2⤵
  PID:9044
- C:\Windows\System32\oTvOHOf.exe
  C:\Windows\System32\oTvOHOf.exe
  2⤵
  PID:9068
- C:\Windows\System32\JPVvjhJ.exe
  C:\Windows\System32\JPVvjhJ.exe
  2⤵
  PID:9088
- C:\Windows\System32\LdAxEFu.exe
  C:\Windows\System32\LdAxEFu.exe
  2⤵
  PID:9120
- C:\Windows\System32\zZbekLT.exe
  C:\Windows\System32\zZbekLT.exe
  2⤵
  PID:9144
- C:\Windows\System32\XrVPVID.exe
  C:\Windows\System32\XrVPVID.exe
  2⤵
  PID:9172
- C:\Windows\System32\jzilVtY.exe
  C:\Windows\System32\jzilVtY.exe
  2⤵
  PID:9200
- C:\Windows\System32\pSoiSbm.exe
  C:\Windows\System32\pSoiSbm.exe
  2⤵
  PID:7360
- C:\Windows\System32\LflREIL.exe
  C:\Windows\System32\LflREIL.exe
  2⤵
  PID:8332
- C:\Windows\System32\pqGRfDO.exe
  C:\Windows\System32\pqGRfDO.exe
  2⤵
  PID:8380
- C:\Windows\System32\uPfiwoY.exe
  C:\Windows\System32\uPfiwoY.exe
  2⤵
  PID:8404
- C:\Windows\System32\JKxcucn.exe
  C:\Windows\System32\JKxcucn.exe
  2⤵
  PID:8472
- C:\Windows\System32\TeZuxCR.exe
  C:\Windows\System32\TeZuxCR.exe
  2⤵
  PID:8540
- C:\Windows\System32\bLxdHhk.exe
  C:\Windows\System32\bLxdHhk.exe
  2⤵
  PID:8556
- C:\Windows\System32\SwRaCND.exe
  C:\Windows\System32\SwRaCND.exe
  2⤵
  PID:8648
- C:\Windows\System32\IrnacmY.exe
  C:\Windows\System32\IrnacmY.exe
  2⤵
  PID:8752
- C:\Windows\System32\hQjRwGO.exe
  C:\Windows\System32\hQjRwGO.exe
  2⤵
  PID:8820
- C:\Windows\System32\oJsycqs.exe
  C:\Windows\System32\oJsycqs.exe
  2⤵
  PID:8804
- C:\Windows\System32\enkVTFf.exe
  C:\Windows\System32\enkVTFf.exe
  2⤵
  PID:8928
- C:\Windows\System32\KLavseR.exe
  C:\Windows\System32\KLavseR.exe
  2⤵
  PID:9000
- C:\Windows\System32\wykXmbI.exe
  C:\Windows\System32\wykXmbI.exe
  2⤵
  PID:9052
- C:\Windows\System32\EooFlzl.exe
  C:\Windows\System32\EooFlzl.exe
  2⤵
  PID:9132
- C:\Windows\System32\WunaGLS.exe
  C:\Windows\System32\WunaGLS.exe
  2⤵
  PID:8132
- C:\Windows\System32\HAfXYNE.exe
  C:\Windows\System32\HAfXYNE.exe
  2⤵
  PID:8368
- C:\Windows\System32\FEOBrQb.exe
  C:\Windows\System32\FEOBrQb.exe
  2⤵
  PID:8468
- C:\Windows\System32\gJvONnM.exe
  C:\Windows\System32\gJvONnM.exe
  2⤵
  PID:8580
- C:\Windows\System32\zqOZPUq.exe
  C:\Windows\System32\zqOZPUq.exe
  2⤵
  PID:8676
- C:\Windows\System32\wMjVoLs.exe
  C:\Windows\System32\wMjVoLs.exe
  2⤵
  PID:8860
- C:\Windows\System32\KtFUWEA.exe
  C:\Windows\System32\KtFUWEA.exe
  2⤵
  PID:8932
- C:\Windows\System32\OXMwJGY.exe
  C:\Windows\System32\OXMwJGY.exe
  2⤵
  PID:9036
- C:\Windows\System32\xpAUkZz.exe
  C:\Windows\System32\xpAUkZz.exe
  2⤵
  PID:8260
- C:\Windows\System32\GpnrwJd.exe
  C:\Windows\System32\GpnrwJd.exe
  2⤵
  PID:8788
- C:\Windows\System32\UkUMHnw.exe
  C:\Windows\System32\UkUMHnw.exe
  2⤵
  PID:9384
- C:\Windows\System32\kKCXQfX.exe
  C:\Windows\System32\kKCXQfX.exe
  2⤵
  PID:9400
- C:\Windows\System32\HoHaeFT.exe
  C:\Windows\System32\HoHaeFT.exe
  2⤵
  PID:9416
- C:\Windows\System32\UZmJINE.exe
  C:\Windows\System32\UZmJINE.exe
  2⤵
  PID:9444
- C:\Windows\System32\lpWVSaH.exe
  C:\Windows\System32\lpWVSaH.exe
  2⤵
  PID:9460
- C:\Windows\System32\Ialjjfj.exe
  C:\Windows\System32\Ialjjfj.exe
  2⤵
  PID:9480
- C:\Windows\System32\EaVZLES.exe
  C:\Windows\System32\EaVZLES.exe
  2⤵
  PID:9496
- C:\Windows\System32\AeFPkRB.exe
  C:\Windows\System32\AeFPkRB.exe
  2⤵
  PID:9524
- C:\Windows\System32\kKmYYiG.exe
  C:\Windows\System32\kKmYYiG.exe
  2⤵
  PID:9560
- C:\Windows\System32\PTYuUuh.exe
  C:\Windows\System32\PTYuUuh.exe
  2⤵
  PID:9604
- C:\Windows\System32\oTFkwfQ.exe
  C:\Windows\System32\oTFkwfQ.exe
  2⤵
  PID:9624
- C:\Windows\System32\sgVnZDH.exe
  C:\Windows\System32\sgVnZDH.exe
  2⤵
  PID:9656
- C:\Windows\System32\UtKssUO.exe
  C:\Windows\System32\UtKssUO.exe
  2⤵
  PID:9672
- C:\Windows\System32\SwVInfi.exe
  C:\Windows\System32\SwVInfi.exe
  2⤵
  PID:9692
- C:\Windows\System32\qaHUmwX.exe
  C:\Windows\System32\qaHUmwX.exe
  2⤵
  PID:9736
- C:\Windows\System32\wmoVfFW.exe
  C:\Windows\System32\wmoVfFW.exe
  2⤵
  PID:9760
- C:\Windows\System32\VfeYHXe.exe
  C:\Windows\System32\VfeYHXe.exe
  2⤵
  PID:9812
- C:\Windows\System32\zTSOsCS.exe
  C:\Windows\System32\zTSOsCS.exe
  2⤵
  PID:9836
- C:\Windows\System32\orkcXxK.exe
  C:\Windows\System32\orkcXxK.exe
  2⤵
  PID:9872
- C:\Windows\System32\VKqJYhY.exe
  C:\Windows\System32\VKqJYhY.exe
  2⤵
  PID:9892
- C:\Windows\System32\IxVaeRg.exe
  C:\Windows\System32\IxVaeRg.exe
  2⤵
  PID:9908
- C:\Windows\System32\OXjiElm.exe
  C:\Windows\System32\OXjiElm.exe
  2⤵
  PID:9936
- C:\Windows\System32\KYyQwlC.exe
  C:\Windows\System32\KYyQwlC.exe
  2⤵
  PID:9976
- C:\Windows\System32\omgaGZT.exe
  C:\Windows\System32\omgaGZT.exe
  2⤵
  PID:9996
- C:\Windows\System32\sSTUjBB.exe
  C:\Windows\System32\sSTUjBB.exe
  2⤵
  PID:10032
- C:\Windows\System32\oqzjaCt.exe
  C:\Windows\System32\oqzjaCt.exe
  2⤵
  PID:10072
- C:\Windows\System32\YOExvrO.exe
  C:\Windows\System32\YOExvrO.exe
  2⤵
  PID:10100
- C:\Windows\System32\OeLIthX.exe
  C:\Windows\System32\OeLIthX.exe
  2⤵
  PID:10124
- C:\Windows\System32\CHdIeJX.exe
  C:\Windows\System32\CHdIeJX.exe
  2⤵
  PID:10140
- C:\Windows\System32\jjwoJDF.exe
  C:\Windows\System32\jjwoJDF.exe
  2⤵
  PID:10164
- C:\Windows\System32\opesNdW.exe
  C:\Windows\System32\opesNdW.exe
  2⤵
  PID:10180
- C:\Windows\System32\QHdrkIH.exe
  C:\Windows\System32\QHdrkIH.exe
  2⤵
  PID:10236
- C:\Windows\System32\dYPsZda.exe
  C:\Windows\System32\dYPsZda.exe
  2⤵
  PID:8960
- C:\Windows\System32\ROttYaG.exe
  C:\Windows\System32\ROttYaG.exe
  2⤵
  PID:8996
- C:\Windows\System32\SEmDhKN.exe
  C:\Windows\System32\SEmDhKN.exe
  2⤵
  PID:8720
- C:\Windows\System32\aJBofRZ.exe
  C:\Windows\System32\aJBofRZ.exe
  2⤵
  PID:9244
- C:\Windows\System32\eOICkmj.exe
  C:\Windows\System32\eOICkmj.exe
  2⤵
  PID:9328
- C:\Windows\System32\IgJgWLN.exe
  C:\Windows\System32\IgJgWLN.exe
  2⤵
  PID:9248
- C:\Windows\System32\AUAkGLS.exe
  C:\Windows\System32\AUAkGLS.exe
  2⤵
  PID:9308
- C:\Windows\System32\AmMefrl.exe
  C:\Windows\System32\AmMefrl.exe
  2⤵
  PID:9396
- C:\Windows\System32\wemOdlG.exe
  C:\Windows\System32\wemOdlG.exe
  2⤵
  PID:9536
- C:\Windows\System32\dHaxQKi.exe
  C:\Windows\System32\dHaxQKi.exe
  2⤵
  PID:8564
- C:\Windows\System32\IhxOwrQ.exe
  C:\Windows\System32\IhxOwrQ.exe
  2⤵
  PID:9620
- C:\Windows\System32\framgCi.exe
  C:\Windows\System32\framgCi.exe
  2⤵
  PID:9712
- C:\Windows\System32\fpdKfLT.exe
  C:\Windows\System32\fpdKfLT.exe
  2⤵
  PID:9800
- C:\Windows\System32\ciUftiV.exe
  C:\Windows\System32\ciUftiV.exe
  2⤵
  PID:9848
- C:\Windows\System32\ykBxsvS.exe
  C:\Windows\System32\ykBxsvS.exe
  2⤵
  PID:9904
- C:\Windows\System32\BloHAUZ.exe
  C:\Windows\System32\BloHAUZ.exe
  2⤵
  PID:9964
- C:\Windows\System32\KGYhTAG.exe
  C:\Windows\System32\KGYhTAG.exe
  2⤵
  PID:9992
- C:\Windows\System32\xoOlziK.exe
  C:\Windows\System32\xoOlziK.exe
  2⤵
  PID:10096
- C:\Windows\System32\dJQUefc.exe
  C:\Windows\System32\dJQUefc.exe
  2⤵
  PID:10108
- C:\Windows\System32\zfsVTTr.exe
  C:\Windows\System32\zfsVTTr.exe
  2⤵
  PID:10156
- C:\Windows\System32\IZeXdLv.exe
  C:\Windows\System32\IZeXdLv.exe
  2⤵
  PID:10216
- C:\Windows\System32\UiHyfPE.exe
  C:\Windows\System32\UiHyfPE.exe
  2⤵
  PID:8536
- C:\Windows\System32\PuuzmNP.exe
  C:\Windows\System32\PuuzmNP.exe
  2⤵
  PID:9252
- C:\Windows\System32\cNhydmF.exe
  C:\Windows\System32\cNhydmF.exe
  2⤵
  PID:9428
- C:\Windows\System32\nqptlVf.exe
  C:\Windows\System32\nqptlVf.exe
  2⤵
  PID:9392
- C:\Windows\System32\DhdEUZW.exe
  C:\Windows\System32\DhdEUZW.exe
  2⤵
  PID:9768
- C:\Windows\System32\QJkahpR.exe
  C:\Windows\System32\QJkahpR.exe
  2⤵
  PID:10028
- C:\Windows\System32\DvLQTjD.exe
  C:\Windows\System32\DvLQTjD.exe
  2⤵
  PID:9240
- C:\Windows\System32\mQtaTJk.exe
  C:\Windows\System32\mQtaTJk.exe
  2⤵
  PID:8436
- C:\Windows\System32\UVhlHTJ.exe
  C:\Windows\System32\UVhlHTJ.exe
  2⤵
  PID:9516
- C:\Windows\System32\VaBkxst.exe
  C:\Windows\System32\VaBkxst.exe
  2⤵
  PID:9944
- C:\Windows\System32\TMAZWZM.exe
  C:\Windows\System32\TMAZWZM.exe
  2⤵
  PID:9316
- C:\Windows\System32\CViatUq.exe
  C:\Windows\System32\CViatUq.exe
  2⤵
  PID:9928
- C:\Windows\System32\PrWfTqB.exe
  C:\Windows\System32\PrWfTqB.exe
  2⤵
  PID:9724
- C:\Windows\System32\GIfzvvf.exe
  C:\Windows\System32\GIfzvvf.exe
  2⤵
  PID:10256
- C:\Windows\System32\sIcWcqM.exe
  C:\Windows\System32\sIcWcqM.exe
  2⤵
  PID:10276
- C:\Windows\System32\JqvkPBg.exe
  C:\Windows\System32\JqvkPBg.exe
  2⤵
  PID:10296
- C:\Windows\System32\guRlvya.exe
  C:\Windows\System32\guRlvya.exe
  2⤵
  PID:10328
- C:\Windows\System32\rYvMDFY.exe
  C:\Windows\System32\rYvMDFY.exe
  2⤵
  PID:10356
- C:\Windows\System32\KpsEBEh.exe
  C:\Windows\System32\KpsEBEh.exe
  2⤵
  PID:10408
- C:\Windows\System32\DCkoglE.exe
  C:\Windows\System32\DCkoglE.exe
  2⤵
  PID:10436
- C:\Windows\System32\bIYbqaO.exe
  C:\Windows\System32\bIYbqaO.exe
  2⤵
  PID:10456
- C:\Windows\System32\uCAsiUy.exe
  C:\Windows\System32\uCAsiUy.exe
  2⤵
  PID:10480
- C:\Windows\System32\vTZVvPg.exe
  C:\Windows\System32\vTZVvPg.exe
  2⤵
  PID:10500
- C:\Windows\System32\eOIIdID.exe
  C:\Windows\System32\eOIIdID.exe
  2⤵
  PID:10524
- C:\Windows\System32\QXOqPON.exe
  C:\Windows\System32\QXOqPON.exe
  2⤵
  PID:10540
- C:\Windows\System32\mefmkGv.exe
  C:\Windows\System32\mefmkGv.exe
  2⤵
  PID:10560
- C:\Windows\System32\WtzlRBa.exe
  C:\Windows\System32\WtzlRBa.exe
  2⤵
  PID:10596
- C:\Windows\System32\ZhTOSdW.exe
  C:\Windows\System32\ZhTOSdW.exe
  2⤵
  PID:10620
- C:\Windows\System32\CsipKWL.exe
  C:\Windows\System32\CsipKWL.exe
  2⤵
  PID:10636
- C:\Windows\System32\OkgJGvQ.exe
  C:\Windows\System32\OkgJGvQ.exe
  2⤵
  PID:10652
- C:\Windows\System32\uqIvPcQ.exe
  C:\Windows\System32\uqIvPcQ.exe
  2⤵
  PID:10720
- C:\Windows\System32\obnsDKV.exe
  C:\Windows\System32\obnsDKV.exe
  2⤵
  PID:10740
- C:\Windows\System32\lzVQGxK.exe
  C:\Windows\System32\lzVQGxK.exe
  2⤵
  PID:10764
- C:\Windows\System32\BGoSHTr.exe
  C:\Windows\System32\BGoSHTr.exe
  2⤵
  PID:10804
- C:\Windows\System32\wZyfbGl.exe
  C:\Windows\System32\wZyfbGl.exe
  2⤵
  PID:10848
- C:\Windows\System32\QZbrmYs.exe
  C:\Windows\System32\QZbrmYs.exe
  2⤵
  PID:10892
- C:\Windows\System32\jmKLSlc.exe
  C:\Windows\System32\jmKLSlc.exe
  2⤵
  PID:10912
- C:\Windows\System32\CPAFXqL.exe
  C:\Windows\System32\CPAFXqL.exe
  2⤵
  PID:10928
- C:\Windows\System32\cCJLvYF.exe
  C:\Windows\System32\cCJLvYF.exe
  2⤵
  PID:10948
- C:\Windows\System32\sMATZhT.exe
  C:\Windows\System32\sMATZhT.exe
  2⤵
  PID:10980
- C:\Windows\System32\iKjwMVY.exe
  C:\Windows\System32\iKjwMVY.exe
  2⤵
  PID:11004
- C:\Windows\System32\BOnqrOp.exe
  C:\Windows\System32\BOnqrOp.exe
  2⤵
  PID:11024
- C:\Windows\System32\CfQYIKU.exe
  C:\Windows\System32\CfQYIKU.exe
  2⤵
  PID:11048
- C:\Windows\System32\yIcUDZV.exe
  C:\Windows\System32\yIcUDZV.exe
  2⤵
  PID:11080
- C:\Windows\System32\SVsKiIY.exe
  C:\Windows\System32\SVsKiIY.exe
  2⤵
  PID:11144
- C:\Windows\System32\UvyVyLS.exe
  C:\Windows\System32\UvyVyLS.exe
  2⤵
  PID:11160
- C:\Windows\System32\JoPfIrm.exe
  C:\Windows\System32\JoPfIrm.exe
  2⤵
  PID:11180
- C:\Windows\System32\lrJTKHG.exe
  C:\Windows\System32\lrJTKHG.exe
  2⤵
  PID:11200
- C:\Windows\System32\oeUsTaQ.exe
  C:\Windows\System32\oeUsTaQ.exe
  2⤵
  PID:11236
- C:\Windows\System32\AEcyKbb.exe
  C:\Windows\System32\AEcyKbb.exe
  2⤵
  PID:10188
- C:\Windows\System32\akacniS.exe
  C:\Windows\System32\akacniS.exe
  2⤵
  PID:10312
- C:\Windows\System32\ceGeLqg.exe
  C:\Windows\System32\ceGeLqg.exe
  2⤵
  PID:10392
- C:\Windows\System32\lsmpjid.exe
  C:\Windows\System32\lsmpjid.exe
  2⤵
  PID:10452
- C:\Windows\System32\nIalExK.exe
  C:\Windows\System32\nIalExK.exe
  2⤵
  PID:10536
- C:\Windows\System32\FDZgxdb.exe
  C:\Windows\System32\FDZgxdb.exe
  2⤵
  PID:10592
- C:\Windows\System32\zQFmbGM.exe
  C:\Windows\System32\zQFmbGM.exe
  2⤵
  PID:10612
- C:\Windows\System32\LOzMqfr.exe
  C:\Windows\System32\LOzMqfr.exe
  2⤵
  PID:10704
- C:\Windows\System32\ZABZfLX.exe
  C:\Windows\System32\ZABZfLX.exe
  2⤵
  PID:10772
- C:\Windows\System32\NtVbUKj.exe
  C:\Windows\System32\NtVbUKj.exe
  2⤵
  PID:10904
- C:\Windows\System32\xqnxWdu.exe
  C:\Windows\System32\xqnxWdu.exe
  2⤵
  PID:10924
- C:\Windows\System32\SqiAEZn.exe
  C:\Windows\System32\SqiAEZn.exe
  2⤵
  PID:10956
- C:\Windows\System32\SADeJZi.exe
  C:\Windows\System32\SADeJZi.exe
  2⤵
  PID:11020
- C:\Windows\System32\TXHlsvB.exe
  C:\Windows\System32\TXHlsvB.exe
  2⤵
  PID:11104
- C:\Windows\System32\kOlcrVe.exe
  C:\Windows\System32\kOlcrVe.exe
  2⤵
  PID:11172
- C:\Windows\System32\alFttzQ.exe
  C:\Windows\System32\alFttzQ.exe
  2⤵
  PID:11220
- C:\Windows\System32\cTztYGX.exe
  C:\Windows\System32\cTztYGX.exe
  2⤵
  PID:11244
- C:\Windows\System32\snPATrv.exe
  C:\Windows\System32\snPATrv.exe
  2⤵
  PID:10320
- C:\Windows\System32\kuCXrmI.exe
  C:\Windows\System32\kuCXrmI.exe
  2⤵
  PID:10468
- C:\Windows\System32\mdhuEUm.exe
  C:\Windows\System32\mdhuEUm.exe
  2⤵
  PID:10628
- C:\Windows\System32\cuFmHVc.exe
  C:\Windows\System32\cuFmHVc.exe
  2⤵
  PID:10512
- C:\Windows\System32\XpzEYNV.exe
  C:\Windows\System32\XpzEYNV.exe
  2⤵
  PID:10776
- C:\Windows\System32\uXaaFYw.exe
  C:\Windows\System32\uXaaFYw.exe
  2⤵
  PID:10908
- C:\Windows\System32\phGcBrX.exe
  C:\Windows\System32\phGcBrX.exe
  2⤵
  PID:11012
- C:\Windows\System32\ebXpIVq.exe
  C:\Windows\System32\ebXpIVq.exe
  2⤵
  PID:11068
- C:\Windows\System32\NtRuMpc.exe
  C:\Windows\System32\NtRuMpc.exe
  2⤵
  PID:10556
- C:\Windows\System32\uoavrom.exe
  C:\Windows\System32\uoavrom.exe
  2⤵
  PID:11124
- C:\Windows\System32\SoUENfj.exe
  C:\Windows\System32\SoUENfj.exe
  2⤵
  PID:11280
- C:\Windows\System32\IBbiBwh.exe
  C:\Windows\System32\IBbiBwh.exe
  2⤵
  PID:11296
- C:\Windows\System32\DXazTdb.exe
  C:\Windows\System32\DXazTdb.exe
  2⤵
  PID:11312
- C:\Windows\System32\cWSfqXI.exe
  C:\Windows\System32\cWSfqXI.exe
  2⤵
  PID:11372
- C:\Windows\System32\zEwuQwZ.exe
  C:\Windows\System32\zEwuQwZ.exe
  2⤵
  PID:11408
- C:\Windows\System32\pCNfKIA.exe
  C:\Windows\System32\pCNfKIA.exe
  2⤵
  PID:11428
- C:\Windows\System32\rSizaQn.exe
  C:\Windows\System32\rSizaQn.exe
  2⤵
  PID:11472
- C:\Windows\System32\PLeLLwc.exe
  C:\Windows\System32\PLeLLwc.exe
  2⤵
  PID:11492
- C:\Windows\System32\zNRiXvS.exe
  C:\Windows\System32\zNRiXvS.exe
  2⤵
  PID:11512
- C:\Windows\System32\DnbiAUO.exe
  C:\Windows\System32\DnbiAUO.exe
  2⤵
  PID:11560
- C:\Windows\System32\vliHahx.exe
  C:\Windows\System32\vliHahx.exe
  2⤵
  PID:11580
- C:\Windows\System32\seggQVw.exe
  C:\Windows\System32\seggQVw.exe
  2⤵
  PID:11612
- C:\Windows\System32\wwHyjkG.exe
  C:\Windows\System32\wwHyjkG.exe
  2⤵
  PID:11636
- C:\Windows\System32\pmAwVfq.exe
  C:\Windows\System32\pmAwVfq.exe
  2⤵
  PID:11664
- C:\Windows\System32\KttYjYS.exe
  C:\Windows\System32\KttYjYS.exe
  2⤵
  PID:11692
- C:\Windows\System32\fUyilaz.exe
  C:\Windows\System32\fUyilaz.exe
  2⤵
  PID:11708
- C:\Windows\System32\FswRjXE.exe
  C:\Windows\System32\FswRjXE.exe
  2⤵
  PID:11756
- C:\Windows\System32\uSeAxpC.exe
  C:\Windows\System32\uSeAxpC.exe
  2⤵
  PID:11776
- C:\Windows\System32\aeAJpwD.exe
  C:\Windows\System32\aeAJpwD.exe
  2⤵
  PID:11816
- C:\Windows\System32\sRbEtVR.exe
  C:\Windows\System32\sRbEtVR.exe
  2⤵
  PID:11836
- C:\Windows\System32\WFTdslH.exe
  C:\Windows\System32\WFTdslH.exe
  2⤵
  PID:11856
- C:\Windows\System32\cczNhGK.exe
  C:\Windows\System32\cczNhGK.exe
  2⤵
  PID:11872
- C:\Windows\System32\DSXihOj.exe
  C:\Windows\System32\DSXihOj.exe
  2⤵
  PID:11904
- C:\Windows\System32\mZmlefs.exe
  C:\Windows\System32\mZmlefs.exe
  2⤵
  PID:11940
- C:\Windows\System32\jKSPnKu.exe
  C:\Windows\System32\jKSPnKu.exe
  2⤵
  PID:11980
- C:\Windows\System32\WFyIPYV.exe
  C:\Windows\System32\WFyIPYV.exe
  2⤵
  PID:12020
- C:\Windows\System32\VyFqPhP.exe
  C:\Windows\System32\VyFqPhP.exe
  2⤵
  PID:12040
- C:\Windows\System32\GkjvnXy.exe
  C:\Windows\System32\GkjvnXy.exe
  2⤵
  PID:12068
- C:\Windows\System32\YGqaAwJ.exe
  C:\Windows\System32\YGqaAwJ.exe
  2⤵
  PID:12084
- C:\Windows\System32\lGiJXIs.exe
  C:\Windows\System32\lGiJXIs.exe
  2⤵
  PID:12100
- C:\Windows\System32\CVCwgvz.exe
  C:\Windows\System32\CVCwgvz.exe
  2⤵
  PID:12164
- C:\Windows\System32\thMGdli.exe
  C:\Windows\System32\thMGdli.exe
  2⤵
  PID:12184
- C:\Windows\System32\bDhDHnC.exe
  C:\Windows\System32\bDhDHnC.exe
  2⤵
  PID:12200
- C:\Windows\System32\xnZGIsU.exe
  C:\Windows\System32\xnZGIsU.exe
  2⤵
  PID:12220
- C:\Windows\System32\NTarHXP.exe
  C:\Windows\System32\NTarHXP.exe
  2⤵
  PID:12240
- C:\Windows\System32\hcgQCpj.exe
  C:\Windows\System32\hcgQCpj.exe
  2⤵
  PID:12264
- C:\Windows\System32\qHniopY.exe
  C:\Windows\System32\qHniopY.exe
  2⤵
  PID:10840
- C:\Windows\System32\lENCfUX.exe
  C:\Windows\System32\lENCfUX.exe
  2⤵
  PID:11344
- C:\Windows\System32\tbIRQZE.exe
  C:\Windows\System32\tbIRQZE.exe
  2⤵
  PID:11348
- C:\Windows\System32\xMYYpXe.exe
  C:\Windows\System32\xMYYpXe.exe
  2⤵
  PID:11484
- C:\Windows\System32\mdACYsT.exe
  C:\Windows\System32\mdACYsT.exe
  2⤵
  PID:11544
- C:\Windows\System32\xSHCMDM.exe
  C:\Windows\System32\xSHCMDM.exe
  2⤵
  PID:11600
- C:\Windows\System32\uzAvQLf.exe
  C:\Windows\System32\uzAvQLf.exe
  2⤵
  PID:11620
- C:\Windows\System32\nufPhmU.exe
  C:\Windows\System32\nufPhmU.exe
  2⤵
  PID:11688
- C:\Windows\System32\MkFrQXy.exe
  C:\Windows\System32\MkFrQXy.exe
  2⤵
  PID:11772
- C:\Windows\System32\lMLulcg.exe
  C:\Windows\System32\lMLulcg.exe
  2⤵
  PID:11864
- C:\Windows\System32\OuhOsza.exe
  C:\Windows\System32\OuhOsza.exe
  2⤵
  PID:11912
- C:\Windows\System32\nkWmJeg.exe
  C:\Windows\System32\nkWmJeg.exe
  2⤵
  PID:12000
- C:\Windows\System32\XNmETEn.exe
  C:\Windows\System32\XNmETEn.exe
  2⤵
  PID:12060
- C:\Windows\System32\qJlLAjp.exe
  C:\Windows\System32\qJlLAjp.exe
  2⤵
  PID:12180
- C:\Windows\System32\YPENvgZ.exe
  C:\Windows\System32\YPENvgZ.exe
  2⤵
  PID:12232
- C:\Windows\System32\oANmzFP.exe
  C:\Windows\System32\oANmzFP.exe
  2⤵
  PID:10376
- C:\Windows\System32\bdvDbWm.exe
  C:\Windows\System32\bdvDbWm.exe
  2⤵
  PID:10756
- C:\Windows\System32\hKQkJvG.exe
  C:\Windows\System32\hKQkJvG.exe
  2⤵
  PID:11340
- C:\Windows\System32\eCnRpDC.exe
  C:\Windows\System32\eCnRpDC.exe
  2⤵
  PID:11524
- C:\Windows\System32\HrHQRDv.exe
  C:\Windows\System32\HrHQRDv.exe
  2⤵
  PID:11632
- C:\Windows\System32\BZeFXqu.exe
  C:\Windows\System32\BZeFXqu.exe
  2⤵
  PID:11704
- C:\Windows\System32\VlNAVdd.exe
  C:\Windows\System32\VlNAVdd.exe
  2⤵
  PID:11952
- C:\Windows\System32\fbpEwEX.exe
  C:\Windows\System32\fbpEwEX.exe
  2⤵
  PID:12120
- C:\Windows\System32\iNQGuxT.exe
  C:\Windows\System32\iNQGuxT.exe
  2⤵
  PID:12212
- C:\Windows\System32\IWmySPr.exe
  C:\Windows\System32\IWmySPr.exe
  2⤵
  PID:11396
- C:\Windows\System32\TbyaGMr.exe
  C:\Windows\System32\TbyaGMr.exe
  2⤵
  PID:11928
- C:\Windows\System32\KQsZGYK.exe
  C:\Windows\System32\KQsZGYK.exe
  2⤵
  PID:11628
- C:\Windows\System32\gUyyJkj.exe
  C:\Windows\System32\gUyyJkj.exe
  2⤵
  PID:12320
- C:\Windows\System32\NovlUVE.exe
  C:\Windows\System32\NovlUVE.exe
  2⤵
  PID:12336
- C:\Windows\System32\QBekvsP.exe
  C:\Windows\System32\QBekvsP.exe
  2⤵
  PID:12364
- C:\Windows\System32\TumiLRi.exe
  C:\Windows\System32\TumiLRi.exe
  2⤵
  PID:12392
- C:\Windows\System32\rXNjbmM.exe
  C:\Windows\System32\rXNjbmM.exe
  2⤵
  PID:12412
- C:\Windows\System32\cLeKpXy.exe
  C:\Windows\System32\cLeKpXy.exe
  2⤵
  PID:12432
- C:\Windows\System32\AstXDEE.exe
  C:\Windows\System32\AstXDEE.exe
  2⤵
  PID:12464
- C:\Windows\System32\NETiWbl.exe
  C:\Windows\System32\NETiWbl.exe
  2⤵
  PID:12488
- C:\Windows\System32\SWmgTXl.exe
  C:\Windows\System32\SWmgTXl.exe
  2⤵
  PID:12528
- C:\Windows\System32\MhTlBGy.exe
  C:\Windows\System32\MhTlBGy.exe
  2⤵
  PID:12568
- C:\Windows\System32\upFzGIb.exe
  C:\Windows\System32\upFzGIb.exe
  2⤵
  PID:12588
- C:\Windows\System32\HfsrEdd.exe
  C:\Windows\System32\HfsrEdd.exe
  2⤵
  PID:12628
- C:\Windows\System32\KiwdRMH.exe
  C:\Windows\System32\KiwdRMH.exe
  2⤵
  PID:12652
- C:\Windows\System32\WznMDiL.exe
  C:\Windows\System32\WznMDiL.exe
  2⤵
  PID:12672
- C:\Windows\System32\lViUEBo.exe
  C:\Windows\System32\lViUEBo.exe
  2⤵
  PID:12712
- C:\Windows\System32\NXjulXQ.exe
  C:\Windows\System32\NXjulXQ.exe
  2⤵
  PID:12740
- C:\Windows\System32\MkEdIqB.exe
  C:\Windows\System32\MkEdIqB.exe
  2⤵
  PID:12756
- C:\Windows\System32\gYfdttP.exe
  C:\Windows\System32\gYfdttP.exe
  2⤵
  PID:12776
- C:\Windows\System32\URcmsvi.exe
  C:\Windows\System32\URcmsvi.exe
  2⤵
  PID:12796
- C:\Windows\System32\HmlDRex.exe
  C:\Windows\System32\HmlDRex.exe
  2⤵
  PID:12832
- C:\Windows\System32\ZaUwuVQ.exe
  C:\Windows\System32\ZaUwuVQ.exe
  2⤵
  PID:12884
- C:\Windows\System32\FRIwiER.exe
  C:\Windows\System32\FRIwiER.exe
  2⤵
  PID:12900
- C:\Windows\System32\LZGEIiF.exe
  C:\Windows\System32\LZGEIiF.exe
  2⤵
  PID:12928
- C:\Windows\System32\QkfsDev.exe
  C:\Windows\System32\QkfsDev.exe
  2⤵
  PID:12948
- C:\Windows\System32\KzYJGKt.exe
  C:\Windows\System32\KzYJGKt.exe
  2⤵
  PID:12984
- C:\Windows\System32\KFkMPgP.exe
  C:\Windows\System32\KFkMPgP.exe
  2⤵
  PID:13024
- C:\Windows\System32\ggsBbuQ.exe
  C:\Windows\System32\ggsBbuQ.exe
  2⤵
  PID:13044
- C:\Windows\System32\TGZTKjw.exe
  C:\Windows\System32\TGZTKjw.exe
  2⤵
  PID:13068
- C:\Windows\System32\oQsbnyN.exe
  C:\Windows\System32\oQsbnyN.exe
  2⤵
  PID:13092
- C:\Windows\System32\QYfHQqn.exe
  C:\Windows\System32\QYfHQqn.exe
  2⤵
  PID:13132
- C:\Windows\System32\eqFclXO.exe
  C:\Windows\System32\eqFclXO.exe
  2⤵
  PID:13160
- C:\Windows\System32\IFbPgdv.exe
  C:\Windows\System32\IFbPgdv.exe
  2⤵
  PID:13180
- C:\Windows\System32\ekjPrFP.exe
  C:\Windows\System32\ekjPrFP.exe
  2⤵
  PID:13228
- C:\Windows\System32\UZWYOQG.exe
  C:\Windows\System32\UZWYOQG.exe
  2⤵
  PID:13244
- C:\Windows\System32\UJcRexX.exe
  C:\Windows\System32\UJcRexX.exe
  2⤵
  PID:13280
- C:\Windows\System32\JJOINgP.exe
  C:\Windows\System32\JJOINgP.exe
  2⤵
  PID:13296
- C:\Windows\System32\YcVqwtg.exe
  C:\Windows\System32\YcVqwtg.exe
  2⤵
  PID:12308
- C:\Windows\System32\mZQKJby.exe
  C:\Windows\System32\mZQKJby.exe
  2⤵
  PID:11288
- C:\Windows\System32\GrDGvvj.exe
  C:\Windows\System32\GrDGvvj.exe
  2⤵
  PID:12328
- C:\Windows\System32\GwIVNoD.exe
  C:\Windows\System32\GwIVNoD.exe
  2⤵
  PID:12424
- C:\Windows\System32\pkOpzLV.exe
  C:\Windows\System32\pkOpzLV.exe
  2⤵
  PID:12520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\CGISWnh.exe

Filesize
1.4MB

MD5
ed1b3aeec6854bc6ed04765d7d3e16f4

SHA1
13cbc353f3f8aabbd795224ad62771875f9d553d

SHA256
f26db643d00a56790334f5b4716ebacf275c03d72d8c368477f058e4cc709188

SHA512
cb76d4a8f0b502371c7919f23e273f852a134a8f0f41365e54edc83f165670d94050dab0cc8e47fb0eace5523cd9627c12ec77b05bf41c37da8fad9a2777efff

Download Submit
C:\Windows\System32\DtHktDb.exe

Filesize
1.4MB

MD5
26bc75e02d11c4948e389a4f6290f293

SHA1
ff445ad63f5cbd6573decb626b73335b28b0ae8b

SHA256
b438caef58c8e7d536f40ce32be332beab6d2bbe552bb4729d321281a3dc166b

SHA512
e2339704aa00d039ae230b43aecdbef947d05a5248ea78fbd19e3b1d507a2dddb92f50ff5b5fd6ab20eeeb903e2d0e0725e1afdceff6bcd6bfcd1b6445bc244d

Download Submit
C:\Windows\System32\ELHnkWq.exe

Filesize
1.4MB

MD5
3941859ff2360b41aebd5077137556b2

SHA1
a36ef8eb1cf7186812f3beb974dda73f65c465bd

SHA256
71aa2644ba1849a8ba882528905391b5f037325c758ec44a85d9b91d2b1d5b2e

SHA512
2cf7e91449ae2c207238ea5f18d2eb170eaae6730ef0aeeb7722db578ee0e2793db166c563a1e1b294f64d8dfc4edfdacef3fb419b302db34cde58a972a6ab41

Download Submit
C:\Windows\System32\GSWHNdc.exe

Filesize
1.4MB

MD5
f258af0dcb96f0f7d92937f9ca8bcd60

SHA1
1463359154d3d43465ee7c2de10decc01ba3b18a

SHA256
9dd130571d2abdee6855174b71b30de7190b0bb3a7531d71dbd80a8ef65bd2bc

SHA512
674bd521fbeab578a09ce372ddb0f224c6ae57d534768729a4b2b8bb741e93e8ac939da2a0145522b3cc2dbb25bd7ea2655854747df27829527c3bfd1534b62c

Download Submit
C:\Windows\System32\GvgZzBI.exe

Filesize
1.4MB

MD5
2ec7cfe151306211d05dde210798f906

SHA1
74cee45dd54665be49aadd25619ae64d45e79f7e

SHA256
0fa5959d3f0891d802a949adeec4ba4a0b53fbc4ef58d63d6c6cb6f0571b77e2

SHA512
c718007ca7220206c47dc9d6df4d6797751f42477aee72f63f16ae27a91c228ad1e16c29cfa6d599f5cec6332f5bc28ee2dbacac017df253c245565b5139efd3

Download Submit
C:\Windows\System32\KhnBtyv.exe

Filesize
1.4MB

MD5
7383bbaa1bbdf90c1f17e6e84f834044

SHA1
1c44724461f5212f513b39bc9d6ea036425b6395

SHA256
c124feff7f966f6db3639c6a1045b5a6f91402d20ce2c684a8fc693d8f16b9d6

SHA512
792b04d595d6a69b86e31f5b4aecba9e16b2bb9d7f4197c716790ce12f7aa8846d7795d6e45527b50557576022e782196ae830ccdd181af1769a562797d81567

Download Submit
C:\Windows\System32\LEFwkLH.exe

Filesize
1.4MB

MD5
8a1f484a2e19224d22d02ad5ea7e33a5

SHA1
516f2b1d243a156719448d087921545c98d92885

SHA256
b162de7bcfddff3f7ea991ff89be6a347ecd5c2d16fbcf7ab7d5803843bc4e0d

SHA512
b3693a6f4c8a25c39fd5f516c58eee0a698f261ea606a8052eb8520d5372016b71ebfc1c4f90ebd2119732a9d0a001098c4cff26ea490bbca05311235ab65956

Download Submit
C:\Windows\System32\QDhshCq.exe

Filesize
1.4MB

MD5
00134833a7e73808794f808af6ba62cd

SHA1
65e67f27f40fa7e92aaae3da68c19a1011903701

SHA256
fdf3250e01bee00caf9534234884e9e4152d4bc504595cc951b1f60da20d5f8e

SHA512
724244cafd89de725e9e88c76d76406015d9f2d2b0a7eead20b5153a7924c1b2a1be929addaf80cfa8829c759926566941a85741f99741a7bec003df3c3fb233

Download Submit
C:\Windows\System32\STOeAmd.exe

Filesize
1.4MB

MD5
6d15496399950b6a02e141e066d21e09

SHA1
fa55572d5e6f731abcce6558e11aba636e456e38

SHA256
f7c15c7bda0371f96fc287a9fd3bea639099399a7e44390c27c63ae4db73c2db

SHA512
141c0f0d602f57609674d2af52b515517dc5f7c08b442f9dc7a029fe9d62d58ffa5a082952e023848f8bfa165d5b84ce24e9f7a0d1440900c585bb9fc16a6d97

Download Submit
C:\Windows\System32\VJAmJZk.exe

Filesize
1.4MB

MD5
c97102de78ebf29d4ac25e557d689831

SHA1
94f3c0f86bdecad64ad056366b4d57169873ed18

SHA256
12e911d7df4cd08d736534025460fa4e799f0a62b0776f93a43510d01ba56027

SHA512
5bc68be8ad79c79a738eddd2aa4dd6eb22167968fc8e171b29864caea64022b55f03c791bbe6533e27639b24a64ece3ff21dd17ff40b2ce6906ba3be2e555aed

Download Submit
C:\Windows\System32\VaffZlJ.exe

Filesize
1.4MB

MD5
3b41fb30ba82310d93f4118d68d4f956

SHA1
202e731d41ca327f76ee0fc645a09bd2a66d6679

SHA256
999288d168460b5a2b4f210216b149f6492036ac8ab456961b2b39900232c046

SHA512
d1da5cf97f1d7bfb553b5861af9292f79e50a4085efe81cb518b3714c54a1040675d56881ce64e68286a7b65d093870708c2f3c580fcac20ff8e72ac6511b668

Download Submit
C:\Windows\System32\VqvzVBO.exe

Filesize
1.4MB

MD5
888aa3e6ac304e667eae6432b8bb2c8f

SHA1
03f80bb6c2a78159e746f927b99c16cfe8b7fdf8

SHA256
2c7714bf1c56481287c55d90588873d823a770a9fdba0c8cf30f9b998ecbd86f

SHA512
c00d26d64078a579c1a8b7b57c829b67648bea89b8bfdf9795f42322e1e553f5a015fb146a64a21c642123f9efead0c28c7bfa6721b1b93de670a8200aebd707

Download Submit
C:\Windows\System32\ZOBkSrQ.exe

Filesize
1.4MB

MD5
7eee3099d35c3643ba82477f106b5245

SHA1
4d7371b257f62e848f52e6566d499713533444cb

SHA256
aa2cfce31afbd3706bdadb347299050568552a56bfadee36c94e367acb7be981

SHA512
856930eec2860d480629d771bb417adc7987f1ce88fab2818fb902072a9ea3da75ff161f0ff7d9f383f35b766ff1f7b29d0f05b48f8e7f221cc52ef7f51b9e06

Download Submit
C:\Windows\System32\aLChZTd.exe

Filesize
1.4MB

MD5
06b43fd6b07bcc3a6126ee8080f9c57d

SHA1
156264ea5447a685b3493ed4e00eaa10a6fe6541

SHA256
289553430baeff95a00e9ab1b42cbf55db5743872705ea0dcab90a6e09d54a77

SHA512
23098304addf9dd63d33276c5ab8969032b16a7393baee99661e681b6f5ab22b8b3e1b460879b46423b54cca4d2bdca3442123611484872ef77ff3c708711da8

Download Submit
C:\Windows\System32\aojfVTi.exe

Filesize
1.4MB

MD5
528928db35dab985fe74ac7ccc3a4e32

SHA1
17e2f12ba394950ff995f94b35ff38acb367950b

SHA256
7984c54fc421115bfc22097c1baa0dc2ad9bfae6db4483a8195a8ab6becf5346

SHA512
fa5ab88e346e13e26ffb0b5f8834154cb67b4ce19ed9b4f705e9d8e7e0b512703377c124954743ad871181b828c25e58ef5cfc129d39c0195005e070664e5be3

Download Submit
C:\Windows\System32\blLNVkv.exe

Filesize
1.4MB

MD5
45fa5ef3e8f49f1d52a25cf2ac6f578f

SHA1
05ebdc93ca05598f5ad795ff3f04d1434556c76e

SHA256
473ed2221087ea9f7d3500b66e9f3de6c61ca9c8cd02e7d2c9a4f8cbe64a47ef

SHA512
26ccad4b4c96c84700ca7aa856d410aea3c895ae5b38b0dca93a15d1a2b781a62891e24704a57524f280ead7a6adb7244fba61f93329cc8fffd1f23cb020638d

Download Submit
C:\Windows\System32\fZwYvrH.exe

Filesize
1.4MB

MD5
91c034bbb3611d8018f5e67a11bf02cc

SHA1
d852581aec81021b8819bc6cdc7ac0ae10eb379e

SHA256
33cba0678050554faaff21fb801ee059ba86585aee44db07d881205f60170a10

SHA512
ba627c2036bde25c844e9c5612ca0bb4153f9683a62c9f46c651032e4fab304fad821ae11f341f4abac3798d3d9836a05707200290d8d3bfd8726f74b14e7d16

Download Submit
C:\Windows\System32\fhyZSPj.exe

Filesize
1.4MB

MD5
c15e5d1ce0436fe26557ba2ebedb51dd

SHA1
609e6cf9b85febc9c82416c8be6dc02159c23a38

SHA256
57a592b9ea64397ff16679769c2df6326f9d303e6576fd2b924c61265ef212d4

SHA512
f4158788acbfe60d148cf74c3555e135722dfe34e7a9d5e9155f02334878d97de4268bb99c001a7a691f6a1ccac71147cc9653350514467ba85661a9ed946bff

Download Submit
C:\Windows\System32\iEeHHhH.exe

Filesize
1.4MB

MD5
d0ff556e896a4c47e1048176ba34f156

SHA1
6fcb7ce936789adffbeb8f1b6b989f78546fdd06

SHA256
a74961e5754a2705b57e2a1e2c893011e66752c87ed1fb12e6a12d20cec0ea0a

SHA512
e5938f072ab308797cfc2b7e8e825b00d3eb7fcd500470b650fab8183b4b7a0286cf1fce29152b174f15fe3fe586aad6991d147b3753ac8cb96f2cd66fcf3bbe

Download Submit
C:\Windows\System32\kKZnRsg.exe

Filesize
1.4MB

MD5
f2003f0284667cd8e6ed33420e206acd

SHA1
c88ff2d174b828d2f446588c85bada2c8e7d52a5

SHA256
cc464b365073ad6c1032590cf46514ed040b0f82847872f13d51b3a1105713d2

SHA512
142ff0e2f5168916e4482c372ecfd45f8cfb2e391c1f94fe44a3c7a49840ebad11e82392ca3a3d290ddebe40cdcac30902ba436f9e7f43786f69be7d591c257b

Download Submit
C:\Windows\System32\kaUMwgA.exe

Filesize
1.4MB

MD5
3122293c45dfd09d2632ad97dcb4ca8f

SHA1
4a575423af58d6aeeabcacc601c20dd3396d15de

SHA256
a661beb7e1e15bbb1300882992299c5b8f73b3c7772de7d1798ea74692c630f8

SHA512
f7924244393e8e82ee47b7cde084d9ffef6e0e3580d8a4b681e1d5a9f40f3f7bbc9d37e907af997b11f4f0ac8a9ff0ae4c7ee88edec6cbf2ca34b9468a041159

Download Submit
C:\Windows\System32\lWgeciH.exe

Filesize
1.4MB

MD5
51194d64da7dac9a98a1054c593a7981

SHA1
4e2d2d5b16830c8ed85d243a7c5e1579b22f969a

SHA256
defc721e0bab008cd2c3171ced925d7435cb279a482a027e28082bb15731f64d

SHA512
739990e9ffe55364f430875835e589269d0565439c4f93c29af08c57309cd3d24421a11b80ca2b7ab9149a07b60aea91409edfc1efd03c4bbfc1c4fb2d39c9e4

Download Submit
C:\Windows\System32\meCXNDW.exe

Filesize
1.4MB

MD5
096f174f89c66a8655cf181d5333e4dc

SHA1
3e7370d24a9635bec4c5a23e331a88c74316b5d8

SHA256
845dae5eba1adcea70996a257a2b63c8c9637be9e9ee730ce983add89b656931

SHA512
a7f44683479f7d5cccbf3002eb7ee2654b956c2f8449e82c3bc70b6fbf01b2fd31bc132bcc43296dd09b3687fb6c447104d50eb7d0a4a38640ae7758a68c74e5

Download Submit
C:\Windows\System32\mjTGXAi.exe

Filesize
1.4MB

MD5
037d4007976ab159b831fad205edb383

SHA1
f2027d5570ac6ef66e46afc79b9c12cd42d3d941

SHA256
4d4d8c6951d850585f85c62986400ac478294d1e6aa79faa9388ac46ede9be6d

SHA512
aec0620822ea5f24bfeac64b45590d7e3fa7295bbdd2aafe8e806e43153816ff4d74e7b29e68a8b9c251d3831860535ccc8cd3df9e0d544622c39841cfb2934a

Download Submit
C:\Windows\System32\olcaGRp.exe

Filesize
1.4MB

MD5
7933103c0bb8a428ac38b9bac369785f

SHA1
e5d6e29b8cf673181e6021e1f3235e33eb351138

SHA256
08efc8f5428c6030847ad6533c284247a0ba94fc50aae3766404041ea8c517d6

SHA512
555f232fa9e1fe145e0a91f8b804d8a7814b1d750a0e2d8aa9f8c8cb95beecb2ebac73bf33ff4c260986072a06727cde3fa8e42d54a8f9e765a21b98a2feb431

Download Submit
C:\Windows\System32\rcHkvJp.exe

Filesize
1.4MB

MD5
9b46abd8e5357b8dba8c622b921dbc1e

SHA1
0f65ea7dc2e62385700a8ed5ac2a87c7cee95fd1

SHA256
181bcc6739120d9de6c76a8acdb142a8befe98d90da321cc62af23e6219877cd

SHA512
e0daf68a7d26bac7c9058c8cfdee9d5270993305d248a4ad1cd64dc5d7a6cce730984f28f2321a3cddfda34ef8e9e5ad778cca72d5d9106ae0e239ba23910169

Download Submit
C:\Windows\System32\slzKjnC.exe

Filesize
1.4MB

MD5
5b149ceabfec269159de5231d2445003

SHA1
7d3726c66f270cf9309e886b1fe8916ede3f2ca6

SHA256
7dbf6afeb874d656c138b790d978bcc8fef6a0fc59376362c549cef20dc165b9

SHA512
1d9e76e94cc295f80d03a363b407e61d743e817fa641fc04a287bd31d7f6d1f1a2cec99f10a390d4127487662672ac58c732ca4f4e05390c336f1d860651c6e0

Download Submit
C:\Windows\System32\tXenuCA.exe

Filesize
1.4MB

MD5
eb0f93002ececf2e7d90f4cfbc90f7b7

SHA1
9d06a79fecc9cd402555058aa08d3ca91afb04de

SHA256
1c73b18e14cb0851699e7c11cf48b71356432cf3a6ac6cb69f6b6f741ac039bc

SHA512
44a86657467fef62b1d670fbc795c1a90fa0b2d70dace73a25101b0eb67f4331d876619b60f4f4f62119ce88d8e6862a91dfc04152fef395cf02cbf27a682f95

Download Submit
C:\Windows\System32\weqoFmk.exe

Filesize
1.4MB

MD5
f50875f784bbf6b05268902085f41f3c

SHA1
b1d22bc7ec3ab61143d3f343ce0d5fa21e28537f

SHA256
ad1a6604f51e04a2be1ab82e83d9d1a4a4846029d758d8873f7bb76dca2d10f3

SHA512
77508456102de0a269020cf8e3b71ea3f58026b55889f12940a57bc8139787e9073b0992021fdecb24c2aeea2ce974af85cbafda6ceb6e1c4ab1fcaafbee9fb9

Download Submit
C:\Windows\System32\yFXTfNI.exe

Filesize
1.4MB

MD5
51f156adf64320a27a9f0fbcc51c4721

SHA1
24000c548abd98cf88706f9daf95407efde103c5

SHA256
a32e69150bf35545905c5b92ece5629edf6f3fece8e1049e1d32b568f2169ed4

SHA512
72300dc7b3f1ee6d889af2293705433271471968cd60fa8a56f512a28b13882d0e1127ea4a133c41fb43973911eb90ac8162a908694ac98ddb036262ec48ce90

Download Submit
C:\Windows\System32\yOVnhLk.exe

Filesize
1.4MB

MD5
c953ca47e74a393228744e0f885350c1

SHA1
1cbc78d19b4de23700c20f6e5c0c20e9fcd7d485

SHA256
e029e0fe611ef99d9aae5ec9966d34205757b6ffd2d49cdea0fc607794cfeb2e

SHA512
89a7821651817e371abb521098bd7284d78c7138111c54a936d568d2f34e487d64bda9c6162df9c94d8d586d436aa88aa006ebaf4ed1d3745f9418ffef4123f5

Download Submit
C:\Windows\System32\yXUHxjB.exe

Filesize
1.4MB

MD5
bd8c41af3ca7d5ad00793ca753af6a0f

SHA1
db317d19235d820621561f7f2c3e533681bb5c51

SHA256
f0bac3a2bd97c44e0eb9d2f0999d5354875d39d2bce443b70c35f961bd81d719

SHA512
907a8b99f81dce738004041f98baf40873039ed2fc3a2c7778c151a7b110520e7a3325bc05894a893f63cbae614ee52c95c3ee93c74d9e79376bef767d661d64

Download Submit
memory/64-58-0x00007FF60E4F0000-0x00007FF60E8E1000-memory.dmp

Filesize
3.9MB

Download
memory/64-2045-0x00007FF60E4F0000-0x00007FF60E8E1000-memory.dmp

Filesize
3.9MB

Download
memory/708-2037-0x00007FF6523A0000-0x00007FF652791000-memory.dmp

Filesize
3.9MB

Download
memory/708-27-0x00007FF6523A0000-0x00007FF652791000-memory.dmp

Filesize
3.9MB

Download
memory/996-503-0x00007FF7D4120000-0x00007FF7D4511000-memory.dmp

Filesize
3.9MB

Download
memory/996-2069-0x00007FF7D4120000-0x00007FF7D4511000-memory.dmp

Filesize
3.9MB

Download
memory/1056-2057-0x00007FF6D8B70000-0x00007FF6D8F61000-memory.dmp

Filesize
3.9MB

Download
memory/1056-475-0x00007FF6D8B70000-0x00007FF6D8F61000-memory.dmp

Filesize
3.9MB

Download
memory/1064-479-0x00007FF70DA30000-0x00007FF70DE21000-memory.dmp

Filesize
3.9MB

Download
memory/1064-2053-0x00007FF70DA30000-0x00007FF70DE21000-memory.dmp

Filesize
3.9MB

Download
memory/1088-2042-0x00007FF6D8D50000-0x00007FF6D9141000-memory.dmp

Filesize
3.9MB

Download
memory/1088-41-0x00007FF6D8D50000-0x00007FF6D9141000-memory.dmp

Filesize
3.9MB

Download
memory/1088-1984-0x00007FF6D8D50000-0x00007FF6D9141000-memory.dmp

Filesize
3.9MB

Download
memory/1572-451-0x00007FF6412B0000-0x00007FF6416A1000-memory.dmp

Filesize
3.9MB

Download
memory/1572-2065-0x00007FF6412B0000-0x00007FF6416A1000-memory.dmp

Filesize
3.9MB

Download
memory/1712-497-0x00007FF6A89D0000-0x00007FF6A8DC1000-memory.dmp

Filesize
3.9MB

Download
memory/1712-2079-0x00007FF6A89D0000-0x00007FF6A8DC1000-memory.dmp

Filesize
3.9MB

Download
memory/1760-65-0x00007FF6243B0000-0x00007FF6247A1000-memory.dmp

Filesize
3.9MB

Download
memory/1760-2044-0x00007FF6243B0000-0x00007FF6247A1000-memory.dmp

Filesize
3.9MB

Download
memory/1908-2074-0x00007FF61A6A0000-0x00007FF61AA91000-memory.dmp

Filesize
3.9MB

Download
memory/1908-501-0x00007FF61A6A0000-0x00007FF61AA91000-memory.dmp

Filesize
3.9MB

Download
memory/2196-482-0x00007FF686250000-0x00007FF686641000-memory.dmp

Filesize
3.9MB

Download
memory/2196-2084-0x00007FF686250000-0x00007FF686641000-memory.dmp

Filesize
3.9MB

Download
memory/2612-63-0x00007FF730FB0000-0x00007FF7313A1000-memory.dmp

Filesize
3.9MB

Download
memory/2612-2050-0x00007FF730FB0000-0x00007FF7313A1000-memory.dmp

Filesize
3.9MB

Download
memory/2932-2040-0x00007FF624770000-0x00007FF624B61000-memory.dmp

Filesize
3.9MB

Download
memory/2932-53-0x00007FF624770000-0x00007FF624B61000-memory.dmp

Filesize
3.9MB

Download
memory/3156-2059-0x00007FF6D87F0000-0x00007FF6D8BE1000-memory.dmp

Filesize
3.9MB

Download
memory/3156-471-0x00007FF6D87F0000-0x00007FF6D8BE1000-memory.dmp

Filesize
3.9MB

Download
memory/3160-487-0x00007FF633370000-0x00007FF633761000-memory.dmp

Filesize
3.9MB

Download
memory/3160-2083-0x00007FF633370000-0x00007FF633761000-memory.dmp

Filesize
3.9MB

Download
memory/3184-2067-0x00007FF73B250000-0x00007FF73B641000-memory.dmp

Filesize
3.9MB

Download
memory/3184-465-0x00007FF73B250000-0x00007FF73B641000-memory.dmp

Filesize
3.9MB

Download
memory/3796-491-0x00007FF61B290000-0x00007FF61B681000-memory.dmp

Filesize
3.9MB

Download
memory/3796-2081-0x00007FF61B290000-0x00007FF61B681000-memory.dmp

Filesize
3.9MB

Download
memory/3840-69-0x00007FF645410000-0x00007FF645801000-memory.dmp

Filesize
3.9MB

Download
memory/3840-2051-0x00007FF645410000-0x00007FF645801000-memory.dmp

Filesize
3.9MB

Download
memory/3920-2064-0x00007FF7EFCA0000-0x00007FF7F0091000-memory.dmp

Filesize
3.9MB

Download
memory/3920-461-0x00007FF7EFCA0000-0x00007FF7F0091000-memory.dmp

Filesize
3.9MB

Download
memory/4576-2061-0x00007FF631220000-0x00007FF631611000-memory.dmp

Filesize
3.9MB

Download
memory/4576-467-0x00007FF631220000-0x00007FF631611000-memory.dmp

Filesize
3.9MB

Download
memory/4620-0-0x00007FF62EAA0000-0x00007FF62EE91000-memory.dmp

Filesize
3.9MB

Download
memory/4620-1-0x0000021909170000-0x0000021909180000-memory.dmp

Filesize
64KB

Download
memory/4620-1999-0x00007FF62EAA0000-0x00007FF62EE91000-memory.dmp

Filesize
3.9MB

Download
memory/4760-2091-0x00007FF705E10000-0x00007FF706201000-memory.dmp

Filesize
3.9MB

Download
memory/4760-74-0x00007FF705E10000-0x00007FF706201000-memory.dmp

Filesize
3.9MB

Download
memory/4768-60-0x00007FF7F8350000-0x00007FF7F8741000-memory.dmp

Filesize
3.9MB

Download
memory/4768-2047-0x00007FF7F8350000-0x00007FF7F8741000-memory.dmp

Filesize
3.9MB

Download
memory/4772-70-0x00007FF650050000-0x00007FF650441000-memory.dmp

Filesize
3.9MB

Download
memory/4772-2075-0x00007FF650050000-0x00007FF650441000-memory.dmp

Filesize
3.9MB

Download
memory/4952-2035-0x00007FF63DB00000-0x00007FF63DEF1000-memory.dmp

Filesize
3.9MB

Download
memory/4952-19-0x00007FF63DB00000-0x00007FF63DEF1000-memory.dmp

Filesize
3.9MB

Download