xmrig | 883446f4dbb0891c31f799548cac24393750d660b5fc23548e2615dee8aa5564

Analysis

max time kernel
64s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 12:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
Size

1.2MB
MD5

0bc922aa4274d4a50449be178eb59ae6
SHA1

0d0ae88a0b29749942039d6b6a0b9394bda8e915
SHA256

883446f4dbb0891c31f799548cac24393750d660b5fc23548e2615dee8aa5564
SHA512

a3f683bab95583441ac4c86ce1bd92ebd57a923d458527b37b7fa1205ffed40f603e45a8711b9da84de19b71e210ab9b8a230287f429c81491fe0914d0dbc48c
SSDEEP

24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcqdIzWokCiHovICOkj3F:knw9oUUEEDl37jcqdI9QOTF

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 51 IoCs

miner

resource	yara_rule
behavioral2/memory/2092-16-0x00007FF7EC860000-0x00007FF7ECC51000-memory.dmp	xmrig
behavioral2/memory/2588-67-0x00007FF792890000-0x00007FF792C81000-memory.dmp	xmrig
behavioral2/memory/4680-68-0x00007FF7F0240000-0x00007FF7F0631000-memory.dmp	xmrig
behavioral2/memory/4064-55-0x00007FF6D9D90000-0x00007FF6DA181000-memory.dmp	xmrig
behavioral2/memory/1048-49-0x00007FF6B5970000-0x00007FF6B5D61000-memory.dmp	xmrig
behavioral2/memory/4824-45-0x00007FF7F0000000-0x00007FF7F03F1000-memory.dmp	xmrig
behavioral2/memory/4428-37-0x00007FF6BB330000-0x00007FF6BB721000-memory.dmp	xmrig
behavioral2/memory/3064-100-0x00007FF7851D0000-0x00007FF7855C1000-memory.dmp	xmrig
behavioral2/memory/3648-108-0x00007FF60FCD0000-0x00007FF6100C1000-memory.dmp	xmrig
behavioral2/memory/1384-105-0x00007FF601040000-0x00007FF601431000-memory.dmp	xmrig
behavioral2/memory/3484-104-0x00007FF790140000-0x00007FF790531000-memory.dmp	xmrig
behavioral2/memory/3808-128-0x00007FF6CACD0000-0x00007FF6CB0C1000-memory.dmp	xmrig
behavioral2/memory/1652-322-0x00007FF7E4F40000-0x00007FF7E5331000-memory.dmp	xmrig
behavioral2/memory/3804-160-0x00007FF6DE9D0000-0x00007FF6DEDC1000-memory.dmp	xmrig
behavioral2/memory/1928-157-0x00007FF7F7D00000-0x00007FF7F80F1000-memory.dmp	xmrig
behavioral2/memory/1936-149-0x00007FF7C89F0000-0x00007FF7C8DE1000-memory.dmp	xmrig
behavioral2/memory/4520-139-0x00007FF788660000-0x00007FF788A51000-memory.dmp	xmrig
behavioral2/memory/2092-137-0x00007FF7EC860000-0x00007FF7ECC51000-memory.dmp	xmrig
behavioral2/memory/320-134-0x00007FF64F7A0000-0x00007FF64FB91000-memory.dmp	xmrig
behavioral2/memory/2272-131-0x00007FF65C630000-0x00007FF65CA21000-memory.dmp	xmrig
behavioral2/memory/3936-1383-0x00007FF774320000-0x00007FF774711000-memory.dmp	xmrig
behavioral2/memory/4100-1388-0x00007FF62EE40000-0x00007FF62F231000-memory.dmp	xmrig
behavioral2/memory/5108-1375-0x00007FF7C2140000-0x00007FF7C2531000-memory.dmp	xmrig
behavioral2/memory/4068-2039-0x00007FF624F40000-0x00007FF625331000-memory.dmp	xmrig
behavioral2/memory/2856-2050-0x00007FF7C13F0000-0x00007FF7C17E1000-memory.dmp	xmrig
behavioral2/memory/2388-2083-0x00007FF769F80000-0x00007FF76A371000-memory.dmp	xmrig
behavioral2/memory/320-2085-0x00007FF64F7A0000-0x00007FF64FB91000-memory.dmp	xmrig
behavioral2/memory/2092-2095-0x00007FF7EC860000-0x00007FF7ECC51000-memory.dmp	xmrig
behavioral2/memory/4824-2097-0x00007FF7F0000000-0x00007FF7F03F1000-memory.dmp	xmrig
behavioral2/memory/4428-2099-0x00007FF6BB330000-0x00007FF6BB721000-memory.dmp	xmrig
behavioral2/memory/4520-2103-0x00007FF788660000-0x00007FF788A51000-memory.dmp	xmrig
behavioral2/memory/1048-2102-0x00007FF6B5970000-0x00007FF6B5D61000-memory.dmp	xmrig
behavioral2/memory/4064-2105-0x00007FF6D9D90000-0x00007FF6DA181000-memory.dmp	xmrig
behavioral2/memory/1928-2107-0x00007FF7F7D00000-0x00007FF7F80F1000-memory.dmp	xmrig
behavioral2/memory/4680-2109-0x00007FF7F0240000-0x00007FF7F0631000-memory.dmp	xmrig
behavioral2/memory/2588-2111-0x00007FF792890000-0x00007FF792C81000-memory.dmp	xmrig
behavioral2/memory/1652-2113-0x00007FF7E4F40000-0x00007FF7E5331000-memory.dmp	xmrig
behavioral2/memory/3936-2117-0x00007FF774320000-0x00007FF774711000-memory.dmp	xmrig
behavioral2/memory/5108-2116-0x00007FF7C2140000-0x00007FF7C2531000-memory.dmp	xmrig
behavioral2/memory/4100-2140-0x00007FF62EE40000-0x00007FF62F231000-memory.dmp	xmrig
behavioral2/memory/3064-2142-0x00007FF7851D0000-0x00007FF7855C1000-memory.dmp	xmrig
behavioral2/memory/3484-2150-0x00007FF790140000-0x00007FF790531000-memory.dmp	xmrig
behavioral2/memory/1384-2149-0x00007FF601040000-0x00007FF601431000-memory.dmp	xmrig
behavioral2/memory/2856-2152-0x00007FF7C13F0000-0x00007FF7C17E1000-memory.dmp	xmrig
behavioral2/memory/3808-2154-0x00007FF6CACD0000-0x00007FF6CB0C1000-memory.dmp	xmrig
behavioral2/memory/3648-2146-0x00007FF60FCD0000-0x00007FF6100C1000-memory.dmp	xmrig
behavioral2/memory/4068-2145-0x00007FF624F40000-0x00007FF625331000-memory.dmp	xmrig
behavioral2/memory/2272-2156-0x00007FF65C630000-0x00007FF65CA21000-memory.dmp	xmrig
behavioral2/memory/3804-2158-0x00007FF6DE9D0000-0x00007FF6DEDC1000-memory.dmp	xmrig
behavioral2/memory/1936-2160-0x00007FF7C89F0000-0x00007FF7C8DE1000-memory.dmp	xmrig
behavioral2/memory/2388-2168-0x00007FF769F80000-0x00007FF76A371000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2092	pOQZoYP.exe
4824	TWjivFI.exe
4520	fFRcJql.exe
1048	EtXxiiZ.exe
4428	smdGbgP.exe
4064	ZlIzhnj.exe
1928	bXkCmJf.exe
4680	ocTkhYj.exe
5108	khsHsmz.exe
1652	UCWvYlE.exe
2588	aksLIAq.exe
3936	Czlilrw.exe
4100	WrHgyKi.exe
3064	JgcbPDO.exe
3484	gWZLNDJ.exe
3648	cuChHnp.exe
1384	iwHNogm.exe
4068	MLBXYMx.exe
2856	IBYXGbu.exe
3808	fqaalnj.exe
2272	GYGczAt.exe
1936	RREpWRO.exe
3804	SEajYPT.exe
2388	FauNtBw.exe
1704	AZlqUsM.exe
3360	UWwegHL.exe
4056	tdOJiLt.exe
3272	YJJhgGj.exe
932	nsnZUMP.exe
1636	TnynJdj.exe
4892	GmGCSga.exe
2652	OWmpXpO.exe
2968	SsqOlPo.exe
3356	mTfbKGT.exe
4476	svRIHeO.exe
4384	XcASmST.exe
744	omcDeLp.exe
1804	KVTqeGC.exe
832	myoukwc.exe
4484	NogiWRl.exe
4708	YqZvHwn.exe
1332	auwnUfZ.exe
4820	zlVuSub.exe
4332	oeZsIyv.exe
4504	tZjaWRQ.exe
2312	eHTBMkq.exe
1664	frIgsTX.exe
1176	pWpOmmo.exe
888	StIHQqs.exe
3960	GaGdmfo.exe
3964	uiGyZKP.exe
1880	JpGwVmf.exe
4576	HSjaPwb.exe
4028	lsVgiee.exe
4672	GqPMUNs.exe
5048	xAAZOvd.exe
4440	QzJyPfi.exe
1260	zKWGWJq.exe
4896	ARKcnAb.exe
868	ZlQqeqz.exe
2136	FNgQTFI.exe
3760	pNWplJa.exe
3088	oaELUmE.exe
1948	vADzTVx.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/320-0-0x00007FF64F7A0000-0x00007FF64FB91000-memory.dmp	upx
behavioral2/files/0x000c000000023ba8-5.dat	upx
behavioral2/files/0x000a000000023bb6-8.dat	upx
behavioral2/files/0x000a000000023bb5-10.dat	upx
behavioral2/memory/2092-16-0x00007FF7EC860000-0x00007FF7ECC51000-memory.dmp	upx
behavioral2/files/0x000a000000023bb7-22.dat	upx
behavioral2/files/0x000a000000023bb8-27.dat	upx
behavioral2/memory/4520-29-0x00007FF788660000-0x00007FF788A51000-memory.dmp	upx
behavioral2/files/0x000a000000023bba-35.dat	upx
behavioral2/files/0x000a000000023bb9-36.dat	upx
behavioral2/files/0x000c000000023bb0-56.dat	upx
behavioral2/files/0x000a000000023bbc-57.dat	upx
behavioral2/memory/1652-63-0x00007FF7E4F40000-0x00007FF7E5331000-memory.dmp	upx
behavioral2/memory/2588-67-0x00007FF792890000-0x00007FF792C81000-memory.dmp	upx
behavioral2/files/0x0031000000023bbe-71.dat	upx
behavioral2/memory/3936-73-0x00007FF774320000-0x00007FF774711000-memory.dmp	upx
behavioral2/memory/5108-70-0x00007FF7C2140000-0x00007FF7C2531000-memory.dmp	upx
behavioral2/memory/4680-68-0x00007FF7F0240000-0x00007FF7F0631000-memory.dmp	upx
behavioral2/files/0x0031000000023bbd-61.dat	upx
behavioral2/memory/4064-55-0x00007FF6D9D90000-0x00007FF6DA181000-memory.dmp	upx
behavioral2/memory/1048-49-0x00007FF6B5970000-0x00007FF6B5D61000-memory.dmp	upx
behavioral2/files/0x000a000000023bbb-48.dat	upx
behavioral2/memory/4824-45-0x00007FF7F0000000-0x00007FF7F03F1000-memory.dmp	upx
behavioral2/memory/1928-41-0x00007FF7F7D00000-0x00007FF7F80F1000-memory.dmp	upx
behavioral2/memory/4428-37-0x00007FF6BB330000-0x00007FF6BB721000-memory.dmp	upx
behavioral2/files/0x0031000000023bbf-77.dat	upx
behavioral2/files/0x000a000000023bc1-85.dat	upx
behavioral2/files/0x000a000000023bc2-97.dat	upx
behavioral2/memory/3064-100-0x00007FF7851D0000-0x00007FF7855C1000-memory.dmp	upx
behavioral2/memory/3648-108-0x00007FF60FCD0000-0x00007FF6100C1000-memory.dmp	upx
behavioral2/memory/4068-113-0x00007FF624F40000-0x00007FF625331000-memory.dmp	upx
behavioral2/files/0x000a000000023bc5-111.dat	upx
behavioral2/files/0x000a000000023bc6-120.dat	upx
behavioral2/memory/2856-116-0x00007FF7C13F0000-0x00007FF7C17E1000-memory.dmp	upx
behavioral2/files/0x000a000000023bc4-110.dat	upx
behavioral2/memory/1384-105-0x00007FF601040000-0x00007FF601431000-memory.dmp	upx
behavioral2/memory/3484-104-0x00007FF790140000-0x00007FF790531000-memory.dmp	upx
behavioral2/files/0x000a000000023bc3-99.dat	upx
behavioral2/files/0x000a000000023bc0-86.dat	upx
behavioral2/memory/4100-81-0x00007FF62EE40000-0x00007FF62F231000-memory.dmp	upx
behavioral2/files/0x000a000000023bc7-125.dat	upx
behavioral2/memory/3808-128-0x00007FF6CACD0000-0x00007FF6CB0C1000-memory.dmp	upx
behavioral2/files/0x000a000000023bc9-140.dat	upx
behavioral2/files/0x000a000000023bcb-148.dat	upx
behavioral2/files/0x000a000000023bca-152.dat	upx
behavioral2/files/0x000a000000023bcc-159.dat	upx
behavioral2/files/0x000a000000023bce-167.dat	upx
behavioral2/files/0x000a000000023bcf-174.dat	upx
behavioral2/files/0x000a000000023bd2-189.dat	upx
behavioral2/memory/1652-322-0x00007FF7E4F40000-0x00007FF7E5331000-memory.dmp	upx
behavioral2/files/0x000a000000023bd1-184.dat	upx
behavioral2/files/0x000a000000023bd0-179.dat	upx
behavioral2/files/0x000a000000023bcd-162.dat	upx
behavioral2/memory/3804-160-0x00007FF6DE9D0000-0x00007FF6DEDC1000-memory.dmp	upx
behavioral2/memory/1928-157-0x00007FF7F7D00000-0x00007FF7F80F1000-memory.dmp	upx
behavioral2/memory/2388-156-0x00007FF769F80000-0x00007FF76A371000-memory.dmp	upx
behavioral2/files/0x000a000000023bc8-141.dat	upx
behavioral2/memory/1936-149-0x00007FF7C89F0000-0x00007FF7C8DE1000-memory.dmp	upx
behavioral2/memory/4520-139-0x00007FF788660000-0x00007FF788A51000-memory.dmp	upx
behavioral2/memory/2092-137-0x00007FF7EC860000-0x00007FF7ECC51000-memory.dmp	upx
behavioral2/memory/320-134-0x00007FF64F7A0000-0x00007FF64FB91000-memory.dmp	upx
behavioral2/memory/2272-131-0x00007FF65C630000-0x00007FF65CA21000-memory.dmp	upx
behavioral2/memory/3936-1383-0x00007FF774320000-0x00007FF774711000-memory.dmp	upx
behavioral2/memory/4100-1388-0x00007FF62EE40000-0x00007FF62F231000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\zngTDiY.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\XWNgECT.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\bwraGpd.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\yyiIvND.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\QJIophJ.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\OLhEqgs.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\qzhjfeb.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\IIogHqK.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\FOlfWeA.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\vUZjuvr.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\bWrWnnn.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\ODfmlaJ.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\kdjzSqu.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\LZiZNSM.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\hCdlQxi.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\VPCESeZ.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\wehGOuQ.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\KQliCqa.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\eeLGmQA.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\njmBdrF.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\mTfbKGT.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\sDFGegA.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\RIgmLxb.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\oWMtnVW.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\MsnuVTZ.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\lDNtcND.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\MNaZpGI.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\IPJYLpr.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\xIspRBo.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\UWwegHL.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\HSjaPwb.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\EEuBeBv.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\ZMlzaHZ.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\CZcQOLE.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\fZWVRPl.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\BJZWIAI.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\UkAnXrU.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\UacrFjl.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\vkymSAp.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\RULqszf.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\rRXdkFU.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\CljRDap.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\GNvSLiv.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\SDeQUOg.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\quKElQN.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\mbmnJTO.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\HSXtGzv.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\swUlFHs.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\CUCFgki.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\TcUGUWh.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\iwHNogm.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\GaGdmfo.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\gobkntU.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\rOkeOWZ.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\OvJPOGJ.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\iMonnWg.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\tdOJiLt.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\TjBvvtT.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\QiZKgIh.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\mZbAkdI.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\tlcjmYD.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\fFRcJql.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\ZlIzhnj.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
File created	C:\Windows\System32\gtsqyHm.exe	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 320 wrote to memory of 2092	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	86
PID 320 wrote to memory of 2092	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	86
PID 320 wrote to memory of 4824	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	87
PID 320 wrote to memory of 4824	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	87
PID 320 wrote to memory of 4520	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	88
PID 320 wrote to memory of 4520	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	88
PID 320 wrote to memory of 1048	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	89
PID 320 wrote to memory of 1048	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	89
PID 320 wrote to memory of 4428	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	90
PID 320 wrote to memory of 4428	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	90
PID 320 wrote to memory of 4064	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	91
PID 320 wrote to memory of 4064	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	91
PID 320 wrote to memory of 1928	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	92
PID 320 wrote to memory of 1928	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	92
PID 320 wrote to memory of 4680	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	93
PID 320 wrote to memory of 4680	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	93
PID 320 wrote to memory of 5108	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	94
PID 320 wrote to memory of 5108	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	94
PID 320 wrote to memory of 1652	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	95
PID 320 wrote to memory of 1652	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	95
PID 320 wrote to memory of 2588	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	96
PID 320 wrote to memory of 2588	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	96
PID 320 wrote to memory of 3936	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	97
PID 320 wrote to memory of 3936	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	97
PID 320 wrote to memory of 4100	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	98
PID 320 wrote to memory of 4100	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	98
PID 320 wrote to memory of 3064	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	99
PID 320 wrote to memory of 3064	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	99
PID 320 wrote to memory of 3484	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	100
PID 320 wrote to memory of 3484	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	100
PID 320 wrote to memory of 3648	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	101
PID 320 wrote to memory of 3648	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	101
PID 320 wrote to memory of 1384	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	102
PID 320 wrote to memory of 1384	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	102
PID 320 wrote to memory of 4068	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	103
PID 320 wrote to memory of 4068	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	103
PID 320 wrote to memory of 2856	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	104
PID 320 wrote to memory of 2856	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	104
PID 320 wrote to memory of 3808	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	105
PID 320 wrote to memory of 3808	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	105
PID 320 wrote to memory of 2272	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	106
PID 320 wrote to memory of 2272	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	106
PID 320 wrote to memory of 1936	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	107
PID 320 wrote to memory of 1936	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	107
PID 320 wrote to memory of 3804	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	108
PID 320 wrote to memory of 3804	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	108
PID 320 wrote to memory of 2388	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	109
PID 320 wrote to memory of 2388	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	109
PID 320 wrote to memory of 1704	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	110
PID 320 wrote to memory of 1704	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	110
PID 320 wrote to memory of 4056	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	111
PID 320 wrote to memory of 4056	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	111
PID 320 wrote to memory of 3360	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	112
PID 320 wrote to memory of 3360	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	112
PID 320 wrote to memory of 3272	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	113
PID 320 wrote to memory of 3272	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	113
PID 320 wrote to memory of 932	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	114
PID 320 wrote to memory of 932	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	114
PID 320 wrote to memory of 1636	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	115
PID 320 wrote to memory of 1636	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	115
PID 320 wrote to memory of 4892	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	116
PID 320 wrote to memory of 4892	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	116
PID 320 wrote to memory of 2652	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	117
PID 320 wrote to memory of 2652	320	0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe	117

C:\Users\Admin\AppData\Local\Temp\0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0bc922aa4274d4a50449be178eb59ae6_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:320
- C:\Windows\System32\pOQZoYP.exe
  C:\Windows\System32\pOQZoYP.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System32\TWjivFI.exe
  C:\Windows\System32\TWjivFI.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System32\fFRcJql.exe
  C:\Windows\System32\fFRcJql.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System32\EtXxiiZ.exe
  C:\Windows\System32\EtXxiiZ.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System32\smdGbgP.exe
  C:\Windows\System32\smdGbgP.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System32\ZlIzhnj.exe
  C:\Windows\System32\ZlIzhnj.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System32\bXkCmJf.exe
  C:\Windows\System32\bXkCmJf.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System32\ocTkhYj.exe
  C:\Windows\System32\ocTkhYj.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System32\khsHsmz.exe
  C:\Windows\System32\khsHsmz.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System32\UCWvYlE.exe
  C:\Windows\System32\UCWvYlE.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System32\aksLIAq.exe
  C:\Windows\System32\aksLIAq.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System32\Czlilrw.exe
  C:\Windows\System32\Czlilrw.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System32\WrHgyKi.exe
  C:\Windows\System32\WrHgyKi.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System32\JgcbPDO.exe
  C:\Windows\System32\JgcbPDO.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System32\gWZLNDJ.exe
  C:\Windows\System32\gWZLNDJ.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System32\cuChHnp.exe
  C:\Windows\System32\cuChHnp.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System32\iwHNogm.exe
  C:\Windows\System32\iwHNogm.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System32\MLBXYMx.exe
  C:\Windows\System32\MLBXYMx.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System32\IBYXGbu.exe
  C:\Windows\System32\IBYXGbu.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System32\fqaalnj.exe
  C:\Windows\System32\fqaalnj.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System32\GYGczAt.exe
  C:\Windows\System32\GYGczAt.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System32\RREpWRO.exe
  C:\Windows\System32\RREpWRO.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System32\SEajYPT.exe
  C:\Windows\System32\SEajYPT.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System32\FauNtBw.exe
  C:\Windows\System32\FauNtBw.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System32\AZlqUsM.exe
  C:\Windows\System32\AZlqUsM.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System32\tdOJiLt.exe
  C:\Windows\System32\tdOJiLt.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System32\UWwegHL.exe
  C:\Windows\System32\UWwegHL.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System32\YJJhgGj.exe
  C:\Windows\System32\YJJhgGj.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System32\nsnZUMP.exe
  C:\Windows\System32\nsnZUMP.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System32\TnynJdj.exe
  C:\Windows\System32\TnynJdj.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System32\GmGCSga.exe
  C:\Windows\System32\GmGCSga.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System32\OWmpXpO.exe
  C:\Windows\System32\OWmpXpO.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System32\SsqOlPo.exe
  C:\Windows\System32\SsqOlPo.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System32\mTfbKGT.exe
  C:\Windows\System32\mTfbKGT.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System32\svRIHeO.exe
  C:\Windows\System32\svRIHeO.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System32\XcASmST.exe
  C:\Windows\System32\XcASmST.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System32\omcDeLp.exe
  C:\Windows\System32\omcDeLp.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System32\KVTqeGC.exe
  C:\Windows\System32\KVTqeGC.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System32\myoukwc.exe
  C:\Windows\System32\myoukwc.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System32\NogiWRl.exe
  C:\Windows\System32\NogiWRl.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System32\YqZvHwn.exe
  C:\Windows\System32\YqZvHwn.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System32\auwnUfZ.exe
  C:\Windows\System32\auwnUfZ.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System32\zlVuSub.exe
  C:\Windows\System32\zlVuSub.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System32\oeZsIyv.exe
  C:\Windows\System32\oeZsIyv.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System32\tZjaWRQ.exe
  C:\Windows\System32\tZjaWRQ.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System32\eHTBMkq.exe
  C:\Windows\System32\eHTBMkq.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System32\frIgsTX.exe
  C:\Windows\System32\frIgsTX.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System32\pWpOmmo.exe
  C:\Windows\System32\pWpOmmo.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System32\StIHQqs.exe
  C:\Windows\System32\StIHQqs.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System32\GaGdmfo.exe
  C:\Windows\System32\GaGdmfo.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System32\uiGyZKP.exe
  C:\Windows\System32\uiGyZKP.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System32\JpGwVmf.exe
  C:\Windows\System32\JpGwVmf.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System32\HSjaPwb.exe
  C:\Windows\System32\HSjaPwb.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System32\lsVgiee.exe
  C:\Windows\System32\lsVgiee.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System32\GqPMUNs.exe
  C:\Windows\System32\GqPMUNs.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System32\xAAZOvd.exe
  C:\Windows\System32\xAAZOvd.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System32\QzJyPfi.exe
  C:\Windows\System32\QzJyPfi.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System32\zKWGWJq.exe
  C:\Windows\System32\zKWGWJq.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System32\ARKcnAb.exe
  C:\Windows\System32\ARKcnAb.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System32\ZlQqeqz.exe
  C:\Windows\System32\ZlQqeqz.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System32\FNgQTFI.exe
  C:\Windows\System32\FNgQTFI.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System32\pNWplJa.exe
  C:\Windows\System32\pNWplJa.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System32\oaELUmE.exe
  C:\Windows\System32\oaELUmE.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System32\vADzTVx.exe
  C:\Windows\System32\vADzTVx.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System32\dBTpwVJ.exe
  C:\Windows\System32\dBTpwVJ.exe
  2⤵
  PID:2820
- C:\Windows\System32\gSlLkkm.exe
  C:\Windows\System32\gSlLkkm.exe
  2⤵
  PID:2756
- C:\Windows\System32\ZzIRVPG.exe
  C:\Windows\System32\ZzIRVPG.exe
  2⤵
  PID:5140
- C:\Windows\System32\haSJCLM.exe
  C:\Windows\System32\haSJCLM.exe
  2⤵
  PID:5164
- C:\Windows\System32\bTlLsmR.exe
  C:\Windows\System32\bTlLsmR.exe
  2⤵
  PID:5196
- C:\Windows\System32\iYQqXiN.exe
  C:\Windows\System32\iYQqXiN.exe
  2⤵
  PID:5224
- C:\Windows\System32\mLKjJsP.exe
  C:\Windows\System32\mLKjJsP.exe
  2⤵
  PID:5252
- C:\Windows\System32\MEWCNwM.exe
  C:\Windows\System32\MEWCNwM.exe
  2⤵
  PID:5276
- C:\Windows\System32\TjBvvtT.exe
  C:\Windows\System32\TjBvvtT.exe
  2⤵
  PID:5308
- C:\Windows\System32\xVilxGn.exe
  C:\Windows\System32\xVilxGn.exe
  2⤵
  PID:5332
- C:\Windows\System32\dAHgETZ.exe
  C:\Windows\System32\dAHgETZ.exe
  2⤵
  PID:5364
- C:\Windows\System32\sLmnBmD.exe
  C:\Windows\System32\sLmnBmD.exe
  2⤵
  PID:5400
- C:\Windows\System32\oFifnVO.exe
  C:\Windows\System32\oFifnVO.exe
  2⤵
  PID:5416
- C:\Windows\System32\jiowWUt.exe
  C:\Windows\System32\jiowWUt.exe
  2⤵
  PID:5480
- C:\Windows\System32\AFwVdPG.exe
  C:\Windows\System32\AFwVdPG.exe
  2⤵
  PID:5496
- C:\Windows\System32\HSXtGzv.exe
  C:\Windows\System32\HSXtGzv.exe
  2⤵
  PID:5520
- C:\Windows\System32\rfeNpvr.exe
  C:\Windows\System32\rfeNpvr.exe
  2⤵
  PID:5540
- C:\Windows\System32\uKztKUv.exe
  C:\Windows\System32\uKztKUv.exe
  2⤵
  PID:5560
- C:\Windows\System32\tPADtTt.exe
  C:\Windows\System32\tPADtTt.exe
  2⤵
  PID:5576
- C:\Windows\System32\lOKSHlz.exe
  C:\Windows\System32\lOKSHlz.exe
  2⤵
  PID:5608
- C:\Windows\System32\gHMpcmi.exe
  C:\Windows\System32\gHMpcmi.exe
  2⤵
  PID:5668
- C:\Windows\System32\RULqszf.exe
  C:\Windows\System32\RULqszf.exe
  2⤵
  PID:5696
- C:\Windows\System32\SJXgslY.exe
  C:\Windows\System32\SJXgslY.exe
  2⤵
  PID:5724
- C:\Windows\System32\RwxQuOa.exe
  C:\Windows\System32\RwxQuOa.exe
  2⤵
  PID:5752
- C:\Windows\System32\lIGmADh.exe
  C:\Windows\System32\lIGmADh.exe
  2⤵
  PID:5780
- C:\Windows\System32\nsohVCN.exe
  C:\Windows\System32\nsohVCN.exe
  2⤵
  PID:5804
- C:\Windows\System32\UGzYTXX.exe
  C:\Windows\System32\UGzYTXX.exe
  2⤵
  PID:5820
- C:\Windows\System32\qyaitti.exe
  C:\Windows\System32\qyaitti.exe
  2⤵
  PID:5844
- C:\Windows\System32\lRWBFwK.exe
  C:\Windows\System32\lRWBFwK.exe
  2⤵
  PID:5860
- C:\Windows\System32\pyKsKRj.exe
  C:\Windows\System32\pyKsKRj.exe
  2⤵
  PID:5912
- C:\Windows\System32\BFguqiC.exe
  C:\Windows\System32\BFguqiC.exe
  2⤵
  PID:5936
- C:\Windows\System32\EEuBeBv.exe
  C:\Windows\System32\EEuBeBv.exe
  2⤵
  PID:5964
- C:\Windows\System32\MRrWYjD.exe
  C:\Windows\System32\MRrWYjD.exe
  2⤵
  PID:6008
- C:\Windows\System32\yyiIvND.exe
  C:\Windows\System32\yyiIvND.exe
  2⤵
  PID:6024
- C:\Windows\System32\WUZdPbB.exe
  C:\Windows\System32\WUZdPbB.exe
  2⤵
  PID:6048
- C:\Windows\System32\ZXjERWz.exe
  C:\Windows\System32\ZXjERWz.exe
  2⤵
  PID:6068
- C:\Windows\System32\EAbmpsb.exe
  C:\Windows\System32\EAbmpsb.exe
  2⤵
  PID:6092
- C:\Windows\System32\gLTAbQy.exe
  C:\Windows\System32\gLTAbQy.exe
  2⤵
  PID:6116
- C:\Windows\System32\EjIchMn.exe
  C:\Windows\System32\EjIchMn.exe
  2⤵
  PID:6136
- C:\Windows\System32\wThklCl.exe
  C:\Windows\System32\wThklCl.exe
  2⤵
  PID:4016
- C:\Windows\System32\TQnULhK.exe
  C:\Windows\System32\TQnULhK.exe
  2⤵
  PID:5292
- C:\Windows\System32\zngTDiY.exe
  C:\Windows\System32\zngTDiY.exe
  2⤵
  PID:5288
- C:\Windows\System32\KTnxNXW.exe
  C:\Windows\System32\KTnxNXW.exe
  2⤵
  PID:5244
- C:\Windows\System32\BLEbNre.exe
  C:\Windows\System32\BLEbNre.exe
  2⤵
  PID:5180
- C:\Windows\System32\CncdLwm.exe
  C:\Windows\System32\CncdLwm.exe
  2⤵
  PID:4548
- C:\Windows\System32\gBVedPd.exe
  C:\Windows\System32\gBVedPd.exe
  2⤵
  PID:1216
- C:\Windows\System32\dUMpfmR.exe
  C:\Windows\System32\dUMpfmR.exe
  2⤵
  PID:3352
- C:\Windows\System32\NgZgSFG.exe
  C:\Windows\System32\NgZgSFG.exe
  2⤵
  PID:5052
- C:\Windows\System32\QuIaftD.exe
  C:\Windows\System32\QuIaftD.exe
  2⤵
  PID:1144
- C:\Windows\System32\Xlxghsg.exe
  C:\Windows\System32\Xlxghsg.exe
  2⤵
  PID:684
- C:\Windows\System32\RUPecOM.exe
  C:\Windows\System32\RUPecOM.exe
  2⤵
  PID:4608
- C:\Windows\System32\mLGPyfd.exe
  C:\Windows\System32\mLGPyfd.exe
  2⤵
  PID:3716
- C:\Windows\System32\ySVFyVc.exe
  C:\Windows\System32\ySVFyVc.exe
  2⤵
  PID:4052
- C:\Windows\System32\DyBoDPZ.exe
  C:\Windows\System32\DyBoDPZ.exe
  2⤵
  PID:4704
- C:\Windows\System32\RJLCJhT.exe
  C:\Windows\System32\RJLCJhT.exe
  2⤵
  PID:1584
- C:\Windows\System32\EKEUKFa.exe
  C:\Windows\System32\EKEUKFa.exe
  2⤵
  PID:1308
- C:\Windows\System32\MPIyoMi.exe
  C:\Windows\System32\MPIyoMi.exe
  2⤵
  PID:4416
- C:\Windows\System32\RvTLOfG.exe
  C:\Windows\System32\RvTLOfG.exe
  2⤵
  PID:4808
- C:\Windows\System32\FSYhUoo.exe
  C:\Windows\System32\FSYhUoo.exe
  2⤵
  PID:3836
- C:\Windows\System32\TbXRFzC.exe
  C:\Windows\System32\TbXRFzC.exe
  2⤵
  PID:2208
- C:\Windows\System32\qVMdRVt.exe
  C:\Windows\System32\qVMdRVt.exe
  2⤵
  PID:3652
- C:\Windows\System32\gtsqyHm.exe
  C:\Windows\System32\gtsqyHm.exe
  2⤵
  PID:3160
- C:\Windows\System32\ZXXXAou.exe
  C:\Windows\System32\ZXXXAou.exe
  2⤵
  PID:5376
- C:\Windows\System32\OkuVror.exe
  C:\Windows\System32\OkuVror.exe
  2⤵
  PID:968
- C:\Windows\System32\ywoICkt.exe
  C:\Windows\System32\ywoICkt.exe
  2⤵
  PID:3368
- C:\Windows\System32\blyxyfs.exe
  C:\Windows\System32\blyxyfs.exe
  2⤵
  PID:5508
- C:\Windows\System32\FDpqdoY.exe
  C:\Windows\System32\FDpqdoY.exe
  2⤵
  PID:5552
- C:\Windows\System32\FstiPrS.exe
  C:\Windows\System32\FstiPrS.exe
  2⤵
  PID:5620
- C:\Windows\System32\PjXoxlz.exe
  C:\Windows\System32\PjXoxlz.exe
  2⤵
  PID:5676
- C:\Windows\System32\ZMlzaHZ.exe
  C:\Windows\System32\ZMlzaHZ.exe
  2⤵
  PID:5748
- C:\Windows\System32\AZneqdJ.exe
  C:\Windows\System32\AZneqdJ.exe
  2⤵
  PID:5796
- C:\Windows\System32\OOkgAVj.exe
  C:\Windows\System32\OOkgAVj.exe
  2⤵
  PID:5868
- C:\Windows\System32\SWVBQgm.exe
  C:\Windows\System32\SWVBQgm.exe
  2⤵
  PID:5944
- C:\Windows\System32\ujOWOse.exe
  C:\Windows\System32\ujOWOse.exe
  2⤵
  PID:6056
- C:\Windows\System32\yvUFFqd.exe
  C:\Windows\System32\yvUFFqd.exe
  2⤵
  PID:6088
- C:\Windows\System32\wczbTZN.exe
  C:\Windows\System32\wczbTZN.exe
  2⤵
  PID:5324
- C:\Windows\System32\PHMjLUB.exe
  C:\Windows\System32\PHMjLUB.exe
  2⤵
  PID:5208
- C:\Windows\System32\dJYbwYQ.exe
  C:\Windows\System32\dJYbwYQ.exe
  2⤵
  PID:1708
- C:\Windows\System32\zgINHNs.exe
  C:\Windows\System32\zgINHNs.exe
  2⤵
  PID:2120
- C:\Windows\System32\bhLYcYy.exe
  C:\Windows\System32\bhLYcYy.exe
  2⤵
  PID:3928
- C:\Windows\System32\jXGSvSj.exe
  C:\Windows\System32\jXGSvSj.exe
  2⤵
  PID:5064
- C:\Windows\System32\dHEoxlO.exe
  C:\Windows\System32\dHEoxlO.exe
  2⤵
  PID:4304
- C:\Windows\System32\XVnrool.exe
  C:\Windows\System32\XVnrool.exe
  2⤵
  PID:2548
- C:\Windows\System32\gSGsCtf.exe
  C:\Windows\System32\gSGsCtf.exe
  2⤵
  PID:3940
- C:\Windows\System32\IgiVMJT.exe
  C:\Windows\System32\IgiVMJT.exe
  2⤵
  PID:1188
- C:\Windows\System32\tFfuIzk.exe
  C:\Windows\System32\tFfuIzk.exe
  2⤵
  PID:5412
- C:\Windows\System32\loxeHLD.exe
  C:\Windows\System32\loxeHLD.exe
  2⤵
  PID:4380
- C:\Windows\System32\Dquzuoc.exe
  C:\Windows\System32\Dquzuoc.exe
  2⤵
  PID:5548
- C:\Windows\System32\NpPHOCU.exe
  C:\Windows\System32\NpPHOCU.exe
  2⤵
  PID:5584
- C:\Windows\System32\qyUZrmp.exe
  C:\Windows\System32\qyUZrmp.exe
  2⤵
  PID:5768
- C:\Windows\System32\iVFjtBw.exe
  C:\Windows\System32\iVFjtBw.exe
  2⤵
  PID:5812
- C:\Windows\System32\nFIeQgd.exe
  C:\Windows\System32\nFIeQgd.exe
  2⤵
  PID:4588
- C:\Windows\System32\FufqmNW.exe
  C:\Windows\System32\FufqmNW.exe
  2⤵
  PID:1780
- C:\Windows\System32\wOHqBVe.exe
  C:\Windows\System32\wOHqBVe.exe
  2⤵
  PID:4448
- C:\Windows\System32\wIcJdfQ.exe
  C:\Windows\System32\wIcJdfQ.exe
  2⤵
  PID:4844
- C:\Windows\System32\nNEAEuR.exe
  C:\Windows\System32\nNEAEuR.exe
  2⤵
  PID:3728
- C:\Windows\System32\mjzAEeh.exe
  C:\Windows\System32\mjzAEeh.exe
  2⤵
  PID:5456
- C:\Windows\System32\XtsZgWQ.exe
  C:\Windows\System32\XtsZgWQ.exe
  2⤵
  PID:5880
- C:\Windows\System32\wQsumFl.exe
  C:\Windows\System32\wQsumFl.exe
  2⤵
  PID:4212
- C:\Windows\System32\QgiFNee.exe
  C:\Windows\System32\QgiFNee.exe
  2⤵
  PID:3120
- C:\Windows\System32\hCdlQxi.exe
  C:\Windows\System32\hCdlQxi.exe
  2⤵
  PID:5740
- C:\Windows\System32\uxNndJE.exe
  C:\Windows\System32\uxNndJE.exe
  2⤵
  PID:3236
- C:\Windows\System32\CZcQOLE.exe
  C:\Windows\System32\CZcQOLE.exe
  2⤵
  PID:5652
- C:\Windows\System32\AVIeFfi.exe
  C:\Windows\System32\AVIeFfi.exe
  2⤵
  PID:6172
- C:\Windows\System32\KkvPlBY.exe
  C:\Windows\System32\KkvPlBY.exe
  2⤵
  PID:6188
- C:\Windows\System32\annzpHv.exe
  C:\Windows\System32\annzpHv.exe
  2⤵
  PID:6204
- C:\Windows\System32\fPrkXtP.exe
  C:\Windows\System32\fPrkXtP.exe
  2⤵
  PID:6224
- C:\Windows\System32\hZvEfnr.exe
  C:\Windows\System32\hZvEfnr.exe
  2⤵
  PID:6256
- C:\Windows\System32\gobkntU.exe
  C:\Windows\System32\gobkntU.exe
  2⤵
  PID:6304
- C:\Windows\System32\hVXWjki.exe
  C:\Windows\System32\hVXWjki.exe
  2⤵
  PID:6332
- C:\Windows\System32\JiBQAgZ.exe
  C:\Windows\System32\JiBQAgZ.exe
  2⤵
  PID:6348
- C:\Windows\System32\ShxyGsB.exe
  C:\Windows\System32\ShxyGsB.exe
  2⤵
  PID:6388
- C:\Windows\System32\uAUekKw.exe
  C:\Windows\System32\uAUekKw.exe
  2⤵
  PID:6416
- C:\Windows\System32\hyXWrlx.exe
  C:\Windows\System32\hyXWrlx.exe
  2⤵
  PID:6436
- C:\Windows\System32\ndAieMe.exe
  C:\Windows\System32\ndAieMe.exe
  2⤵
  PID:6452
- C:\Windows\System32\ayXEgbq.exe
  C:\Windows\System32\ayXEgbq.exe
  2⤵
  PID:6476
- C:\Windows\System32\iuuXkmG.exe
  C:\Windows\System32\iuuXkmG.exe
  2⤵
  PID:6520
- C:\Windows\System32\gFKGyLr.exe
  C:\Windows\System32\gFKGyLr.exe
  2⤵
  PID:6556
- C:\Windows\System32\IgfJBjG.exe
  C:\Windows\System32\IgfJBjG.exe
  2⤵
  PID:6572
- C:\Windows\System32\VHDHOky.exe
  C:\Windows\System32\VHDHOky.exe
  2⤵
  PID:6592
- C:\Windows\System32\EcrlnQs.exe
  C:\Windows\System32\EcrlnQs.exe
  2⤵
  PID:6640
- C:\Windows\System32\ZyOhrhf.exe
  C:\Windows\System32\ZyOhrhf.exe
  2⤵
  PID:6664
- C:\Windows\System32\QiZKgIh.exe
  C:\Windows\System32\QiZKgIh.exe
  2⤵
  PID:6688
- C:\Windows\System32\cLvxZHc.exe
  C:\Windows\System32\cLvxZHc.exe
  2⤵
  PID:6704
- C:\Windows\System32\dBPZivb.exe
  C:\Windows\System32\dBPZivb.exe
  2⤵
  PID:6736
- C:\Windows\System32\eeLGmQA.exe
  C:\Windows\System32\eeLGmQA.exe
  2⤵
  PID:6752
- C:\Windows\System32\ytrQlNS.exe
  C:\Windows\System32\ytrQlNS.exe
  2⤵
  PID:6780
- C:\Windows\System32\CSYXDQF.exe
  C:\Windows\System32\CSYXDQF.exe
  2⤵
  PID:6796
- C:\Windows\System32\KEZJBLz.exe
  C:\Windows\System32\KEZJBLz.exe
  2⤵
  PID:6820
- C:\Windows\System32\jzFmHMf.exe
  C:\Windows\System32\jzFmHMf.exe
  2⤵
  PID:6864
- C:\Windows\System32\nDVHoHS.exe
  C:\Windows\System32\nDVHoHS.exe
  2⤵
  PID:6924
- C:\Windows\System32\lTNeque.exe
  C:\Windows\System32\lTNeque.exe
  2⤵
  PID:6952
- C:\Windows\System32\lWcMRUK.exe
  C:\Windows\System32\lWcMRUK.exe
  2⤵
  PID:6976
- C:\Windows\System32\RePmnEF.exe
  C:\Windows\System32\RePmnEF.exe
  2⤵
  PID:6992
- C:\Windows\System32\aHqfphC.exe
  C:\Windows\System32\aHqfphC.exe
  2⤵
  PID:7016
- C:\Windows\System32\VwwmHUq.exe
  C:\Windows\System32\VwwmHUq.exe
  2⤵
  PID:7032
- C:\Windows\System32\ROrBqCz.exe
  C:\Windows\System32\ROrBqCz.exe
  2⤵
  PID:7060
- C:\Windows\System32\qtUMmrt.exe
  C:\Windows\System32\qtUMmrt.exe
  2⤵
  PID:7076
- C:\Windows\System32\gxExdLu.exe
  C:\Windows\System32\gxExdLu.exe
  2⤵
  PID:7156
- C:\Windows\System32\JzxVmLm.exe
  C:\Windows\System32\JzxVmLm.exe
  2⤵
  PID:6156
- C:\Windows\System32\xDUyzpJ.exe
  C:\Windows\System32\xDUyzpJ.exe
  2⤵
  PID:6200
- C:\Windows\System32\SRtUjfR.exe
  C:\Windows\System32\SRtUjfR.exe
  2⤵
  PID:6212
- C:\Windows\System32\hppHLHi.exe
  C:\Windows\System32\hppHLHi.exe
  2⤵
  PID:6292
- C:\Windows\System32\VPCESeZ.exe
  C:\Windows\System32\VPCESeZ.exe
  2⤵
  PID:6340
- C:\Windows\System32\DTOWTrF.exe
  C:\Windows\System32\DTOWTrF.exe
  2⤵
  PID:6408
- C:\Windows\System32\CEzaWjR.exe
  C:\Windows\System32\CEzaWjR.exe
  2⤵
  PID:6552
- C:\Windows\System32\PBhHOCp.exe
  C:\Windows\System32\PBhHOCp.exe
  2⤵
  PID:6608
- C:\Windows\System32\SrzILVV.exe
  C:\Windows\System32\SrzILVV.exe
  2⤵
  PID:6632
- C:\Windows\System32\FlSWYdd.exe
  C:\Windows\System32\FlSWYdd.exe
  2⤵
  PID:6748
- C:\Windows\System32\UeYPlLK.exe
  C:\Windows\System32\UeYPlLK.exe
  2⤵
  PID:6776
- C:\Windows\System32\UkAnXrU.exe
  C:\Windows\System32\UkAnXrU.exe
  2⤵
  PID:6896
- C:\Windows\System32\XuHOiUj.exe
  C:\Windows\System32\XuHOiUj.exe
  2⤵
  PID:6888
- C:\Windows\System32\YyUjGHK.exe
  C:\Windows\System32\YyUjGHK.exe
  2⤵
  PID:6988
- C:\Windows\System32\bPKZtAi.exe
  C:\Windows\System32\bPKZtAi.exe
  2⤵
  PID:7040
- C:\Windows\System32\tTRqTwi.exe
  C:\Windows\System32\tTRqTwi.exe
  2⤵
  PID:7148
- C:\Windows\System32\hJhDZFS.exe
  C:\Windows\System32\hJhDZFS.exe
  2⤵
  PID:6040
- C:\Windows\System32\TZfKfvK.exe
  C:\Windows\System32\TZfKfvK.exe
  2⤵
  PID:6196
- C:\Windows\System32\CMoWhbg.exe
  C:\Windows\System32\CMoWhbg.exe
  2⤵
  PID:6512
- C:\Windows\System32\jhgqhEm.exe
  C:\Windows\System32\jhgqhEm.exe
  2⤵
  PID:6580
- C:\Windows\System32\QRVEBwz.exe
  C:\Windows\System32\QRVEBwz.exe
  2⤵
  PID:6768
- C:\Windows\System32\MqRsCFJ.exe
  C:\Windows\System32\MqRsCFJ.exe
  2⤵
  PID:6936
- C:\Windows\System32\nbxrdnl.exe
  C:\Windows\System32\nbxrdnl.exe
  2⤵
  PID:7028
- C:\Windows\System32\FDZbFdy.exe
  C:\Windows\System32\FDZbFdy.exe
  2⤵
  PID:7164
- C:\Windows\System32\uuTUecA.exe
  C:\Windows\System32\uuTUecA.exe
  2⤵
  PID:6720
- C:\Windows\System32\zjyTezV.exe
  C:\Windows\System32\zjyTezV.exe
  2⤵
  PID:7012
- C:\Windows\System32\rRXdkFU.exe
  C:\Windows\System32\rRXdkFU.exe
  2⤵
  PID:6600
- C:\Windows\System32\kcxjaZR.exe
  C:\Windows\System32\kcxjaZR.exe
  2⤵
  PID:7172
- C:\Windows\System32\XWNgECT.exe
  C:\Windows\System32\XWNgECT.exe
  2⤵
  PID:7196
- C:\Windows\System32\kdewgtx.exe
  C:\Windows\System32\kdewgtx.exe
  2⤵
  PID:7240
- C:\Windows\System32\CZoLXJT.exe
  C:\Windows\System32\CZoLXJT.exe
  2⤵
  PID:7264
- C:\Windows\System32\mLzetIX.exe
  C:\Windows\System32\mLzetIX.exe
  2⤵
  PID:7288
- C:\Windows\System32\KYbfzfS.exe
  C:\Windows\System32\KYbfzfS.exe
  2⤵
  PID:7308
- C:\Windows\System32\IIogHqK.exe
  C:\Windows\System32\IIogHqK.exe
  2⤵
  PID:7340
- C:\Windows\System32\aZmojUW.exe
  C:\Windows\System32\aZmojUW.exe
  2⤵
  PID:7364
- C:\Windows\System32\WtqmDNo.exe
  C:\Windows\System32\WtqmDNo.exe
  2⤵
  PID:7388
- C:\Windows\System32\gFqkCBh.exe
  C:\Windows\System32\gFqkCBh.exe
  2⤵
  PID:7420
- C:\Windows\System32\UIkZbro.exe
  C:\Windows\System32\UIkZbro.exe
  2⤵
  PID:7464
- C:\Windows\System32\AGThEYu.exe
  C:\Windows\System32\AGThEYu.exe
  2⤵
  PID:7488
- C:\Windows\System32\JBCiAPt.exe
  C:\Windows\System32\JBCiAPt.exe
  2⤵
  PID:7572
- C:\Windows\System32\CqUHkHh.exe
  C:\Windows\System32\CqUHkHh.exe
  2⤵
  PID:7588
- C:\Windows\System32\oopaGpN.exe
  C:\Windows\System32\oopaGpN.exe
  2⤵
  PID:7604
- C:\Windows\System32\tlbbKOv.exe
  C:\Windows\System32\tlbbKOv.exe
  2⤵
  PID:7636
- C:\Windows\System32\vVwPKZr.exe
  C:\Windows\System32\vVwPKZr.exe
  2⤵
  PID:7656
- C:\Windows\System32\sDFGegA.exe
  C:\Windows\System32\sDFGegA.exe
  2⤵
  PID:7676
- C:\Windows\System32\LfHGnDG.exe
  C:\Windows\System32\LfHGnDG.exe
  2⤵
  PID:7696
- C:\Windows\System32\LlUXSKI.exe
  C:\Windows\System32\LlUXSKI.exe
  2⤵
  PID:7764
- C:\Windows\System32\YyBXLqL.exe
  C:\Windows\System32\YyBXLqL.exe
  2⤵
  PID:7780
- C:\Windows\System32\RfPcKmo.exe
  C:\Windows\System32\RfPcKmo.exe
  2⤵
  PID:7812
- C:\Windows\System32\CUsuiha.exe
  C:\Windows\System32\CUsuiha.exe
  2⤵
  PID:7864
- C:\Windows\System32\gAyDLYx.exe
  C:\Windows\System32\gAyDLYx.exe
  2⤵
  PID:7892
- C:\Windows\System32\mZbAkdI.exe
  C:\Windows\System32\mZbAkdI.exe
  2⤵
  PID:7916
- C:\Windows\System32\UwkRvBk.exe
  C:\Windows\System32\UwkRvBk.exe
  2⤵
  PID:7932
- C:\Windows\System32\FubxuoB.exe
  C:\Windows\System32\FubxuoB.exe
  2⤵
  PID:7956
- C:\Windows\System32\JobADqO.exe
  C:\Windows\System32\JobADqO.exe
  2⤵
  PID:7972
- C:\Windows\System32\SVrgbbt.exe
  C:\Windows\System32\SVrgbbt.exe
  2⤵
  PID:8000
- C:\Windows\System32\pESzacB.exe
  C:\Windows\System32\pESzacB.exe
  2⤵
  PID:8016
- C:\Windows\System32\QsAhdVa.exe
  C:\Windows\System32\QsAhdVa.exe
  2⤵
  PID:8064
- C:\Windows\System32\soJvdEP.exe
  C:\Windows\System32\soJvdEP.exe
  2⤵
  PID:8116
- C:\Windows\System32\kXRHZBB.exe
  C:\Windows\System32\kXRHZBB.exe
  2⤵
  PID:8136
- C:\Windows\System32\iJrVKLp.exe
  C:\Windows\System32\iJrVKLp.exe
  2⤵
  PID:8156
- C:\Windows\System32\vUZjuvr.exe
  C:\Windows\System32\vUZjuvr.exe
  2⤵
  PID:8180
- C:\Windows\System32\jtgSlny.exe
  C:\Windows\System32\jtgSlny.exe
  2⤵
  PID:6180
- C:\Windows\System32\TWrygov.exe
  C:\Windows\System32\TWrygov.exe
  2⤵
  PID:7188
- C:\Windows\System32\EvTGTvh.exe
  C:\Windows\System32\EvTGTvh.exe
  2⤵
  PID:7352
- C:\Windows\System32\Qrnurju.exe
  C:\Windows\System32\Qrnurju.exe
  2⤵
  PID:7396
- C:\Windows\System32\rKbzDdo.exe
  C:\Windows\System32\rKbzDdo.exe
  2⤵
  PID:7444
- C:\Windows\System32\vGiQkUq.exe
  C:\Windows\System32\vGiQkUq.exe
  2⤵
  PID:7456
- C:\Windows\System32\YRPsfFV.exe
  C:\Windows\System32\YRPsfFV.exe
  2⤵
  PID:7500
- C:\Windows\System32\KJvwoIz.exe
  C:\Windows\System32\KJvwoIz.exe
  2⤵
  PID:7528
- C:\Windows\System32\sUEZwPM.exe
  C:\Windows\System32\sUEZwPM.exe
  2⤵
  PID:7616
- C:\Windows\System32\dMdMgdK.exe
  C:\Windows\System32\dMdMgdK.exe
  2⤵
  PID:7720
- C:\Windows\System32\LCxiyci.exe
  C:\Windows\System32\LCxiyci.exe
  2⤵
  PID:7788
- C:\Windows\System32\wxcHEaA.exe
  C:\Windows\System32\wxcHEaA.exe
  2⤵
  PID:7852
- C:\Windows\System32\TRpWgVo.exe
  C:\Windows\System32\TRpWgVo.exe
  2⤵
  PID:7908
- C:\Windows\System32\udjKFqh.exe
  C:\Windows\System32\udjKFqh.exe
  2⤵
  PID:7968
- C:\Windows\System32\ICVmGUv.exe
  C:\Windows\System32\ICVmGUv.exe
  2⤵
  PID:8036
- C:\Windows\System32\YRXdroL.exe
  C:\Windows\System32\YRXdroL.exe
  2⤵
  PID:8152
- C:\Windows\System32\hLzRDLA.exe
  C:\Windows\System32\hLzRDLA.exe
  2⤵
  PID:6744
- C:\Windows\System32\bQhFREx.exe
  C:\Windows\System32\bQhFREx.exe
  2⤵
  PID:6680
- C:\Windows\System32\NyAHvay.exe
  C:\Windows\System32\NyAHvay.exe
  2⤵
  PID:7276
- C:\Windows\System32\ugyPASf.exe
  C:\Windows\System32\ugyPASf.exe
  2⤵
  PID:7412
- C:\Windows\System32\PjdBPFg.exe
  C:\Windows\System32\PjdBPFg.exe
  2⤵
  PID:7448
- C:\Windows\System32\JTsFGjx.exe
  C:\Windows\System32\JTsFGjx.exe
  2⤵
  PID:7752
- C:\Windows\System32\TEhUjAP.exe
  C:\Windows\System32\TEhUjAP.exe
  2⤵
  PID:7992
- C:\Windows\System32\yOXuSab.exe
  C:\Windows\System32\yOXuSab.exe
  2⤵
  PID:8048
- C:\Windows\System32\vvUplGD.exe
  C:\Windows\System32\vvUplGD.exe
  2⤵
  PID:7360
- C:\Windows\System32\bxstIJb.exe
  C:\Windows\System32\bxstIJb.exe
  2⤵
  PID:7480
- C:\Windows\System32\XVXEaqc.exe
  C:\Windows\System32\XVXEaqc.exe
  2⤵
  PID:7684
- C:\Windows\System32\siVijDV.exe
  C:\Windows\System32\siVijDV.exe
  2⤵
  PID:7356
- C:\Windows\System32\oaRVOZg.exe
  C:\Windows\System32\oaRVOZg.exe
  2⤵
  PID:7652
- C:\Windows\System32\OIqDzqk.exe
  C:\Windows\System32\OIqDzqk.exe
  2⤵
  PID:8200
- C:\Windows\System32\WDerSOd.exe
  C:\Windows\System32\WDerSOd.exe
  2⤵
  PID:8236
- C:\Windows\System32\iLfEkLI.exe
  C:\Windows\System32\iLfEkLI.exe
  2⤵
  PID:8260
- C:\Windows\System32\ErAPFgo.exe
  C:\Windows\System32\ErAPFgo.exe
  2⤵
  PID:8280
- C:\Windows\System32\fawVCEt.exe
  C:\Windows\System32\fawVCEt.exe
  2⤵
  PID:8304
- C:\Windows\System32\tgwwNRZ.exe
  C:\Windows\System32\tgwwNRZ.exe
  2⤵
  PID:8348
- C:\Windows\System32\yQdIOMK.exe
  C:\Windows\System32\yQdIOMK.exe
  2⤵
  PID:8372
- C:\Windows\System32\bXuAogp.exe
  C:\Windows\System32\bXuAogp.exe
  2⤵
  PID:8404
- C:\Windows\System32\CljRDap.exe
  C:\Windows\System32\CljRDap.exe
  2⤵
  PID:8420
- C:\Windows\System32\MsnuVTZ.exe
  C:\Windows\System32\MsnuVTZ.exe
  2⤵
  PID:8444
- C:\Windows\System32\awyKDHy.exe
  C:\Windows\System32\awyKDHy.exe
  2⤵
  PID:8464
- C:\Windows\System32\SGujVsg.exe
  C:\Windows\System32\SGujVsg.exe
  2⤵
  PID:8512
- C:\Windows\System32\SMYLRWA.exe
  C:\Windows\System32\SMYLRWA.exe
  2⤵
  PID:8532
- C:\Windows\System32\eTOxKBL.exe
  C:\Windows\System32\eTOxKBL.exe
  2⤵
  PID:8556
- C:\Windows\System32\EFTZPRo.exe
  C:\Windows\System32\EFTZPRo.exe
  2⤵
  PID:8596
- C:\Windows\System32\OmkaUYi.exe
  C:\Windows\System32\OmkaUYi.exe
  2⤵
  PID:8648
- C:\Windows\System32\lKdTkOK.exe
  C:\Windows\System32\lKdTkOK.exe
  2⤵
  PID:8664
- C:\Windows\System32\wOdJSBW.exe
  C:\Windows\System32\wOdJSBW.exe
  2⤵
  PID:8680
- C:\Windows\System32\WiYkttm.exe
  C:\Windows\System32\WiYkttm.exe
  2⤵
  PID:8696
- C:\Windows\System32\eGQhyzK.exe
  C:\Windows\System32\eGQhyzK.exe
  2⤵
  PID:8748
- C:\Windows\System32\ihAYLAW.exe
  C:\Windows\System32\ihAYLAW.exe
  2⤵
  PID:8768
- C:\Windows\System32\qVklxEb.exe
  C:\Windows\System32\qVklxEb.exe
  2⤵
  PID:8792
- C:\Windows\System32\knMGPJG.exe
  C:\Windows\System32\knMGPJG.exe
  2⤵
  PID:8840
- C:\Windows\System32\FLuXGno.exe
  C:\Windows\System32\FLuXGno.exe
  2⤵
  PID:8860
- C:\Windows\System32\Kloywsp.exe
  C:\Windows\System32\Kloywsp.exe
  2⤵
  PID:8900
- C:\Windows\System32\ENoXyLv.exe
  C:\Windows\System32\ENoXyLv.exe
  2⤵
  PID:8924
- C:\Windows\System32\lVhuBFZ.exe
  C:\Windows\System32\lVhuBFZ.exe
  2⤵
  PID:8944
- C:\Windows\System32\RIgmLxb.exe
  C:\Windows\System32\RIgmLxb.exe
  2⤵
  PID:8972
- C:\Windows\System32\DPoBpkQ.exe
  C:\Windows\System32\DPoBpkQ.exe
  2⤵
  PID:9012
- C:\Windows\System32\gFznctD.exe
  C:\Windows\System32\gFznctD.exe
  2⤵
  PID:9028
- C:\Windows\System32\hNDqxPW.exe
  C:\Windows\System32\hNDqxPW.exe
  2⤵
  PID:9056
- C:\Windows\System32\KAAaKfn.exe
  C:\Windows\System32\KAAaKfn.exe
  2⤵
  PID:9084
- C:\Windows\System32\lwkMvQE.exe
  C:\Windows\System32\lwkMvQE.exe
  2⤵
  PID:9124
- C:\Windows\System32\gxxvsTe.exe
  C:\Windows\System32\gxxvsTe.exe
  2⤵
  PID:9148
- C:\Windows\System32\VigLbyx.exe
  C:\Windows\System32\VigLbyx.exe
  2⤵
  PID:9168
- C:\Windows\System32\CYHAdBr.exe
  C:\Windows\System32\CYHAdBr.exe
  2⤵
  PID:9200
- C:\Windows\System32\BTooTHR.exe
  C:\Windows\System32\BTooTHR.exe
  2⤵
  PID:8196
- C:\Windows\System32\QHiEBXW.exe
  C:\Windows\System32\QHiEBXW.exe
  2⤵
  PID:8276
- C:\Windows\System32\wehGOuQ.exe
  C:\Windows\System32\wehGOuQ.exe
  2⤵
  PID:8252
- C:\Windows\System32\Ddhktey.exe
  C:\Windows\System32\Ddhktey.exe
  2⤵
  PID:8336
- C:\Windows\System32\VhMurEV.exe
  C:\Windows\System32\VhMurEV.exe
  2⤵
  PID:8440
- C:\Windows\System32\BFXxAxd.exe
  C:\Windows\System32\BFXxAxd.exe
  2⤵
  PID:8500
- C:\Windows\System32\WIIDjne.exe
  C:\Windows\System32\WIIDjne.exe
  2⤵
  PID:8604
- C:\Windows\System32\Izwkdnd.exe
  C:\Windows\System32\Izwkdnd.exe
  2⤵
  PID:1396
- C:\Windows\System32\gLPMdeI.exe
  C:\Windows\System32\gLPMdeI.exe
  2⤵
  PID:8692
- C:\Windows\System32\VegbbGd.exe
  C:\Windows\System32\VegbbGd.exe
  2⤵
  PID:8784
- C:\Windows\System32\wgJMTNs.exe
  C:\Windows\System32\wgJMTNs.exe
  2⤵
  PID:8876
- C:\Windows\System32\GdzUFLw.exe
  C:\Windows\System32\GdzUFLw.exe
  2⤵
  PID:8916
- C:\Windows\System32\QzjbElz.exe
  C:\Windows\System32\QzjbElz.exe
  2⤵
  PID:8964
- C:\Windows\System32\zkLBpig.exe
  C:\Windows\System32\zkLBpig.exe
  2⤵
  PID:9024
- C:\Windows\System32\jRKpyru.exe
  C:\Windows\System32\jRKpyru.exe
  2⤵
  PID:9076
- C:\Windows\System32\JCbtkyG.exe
  C:\Windows\System32\JCbtkyG.exe
  2⤵
  PID:9156
- C:\Windows\System32\FwmEORn.exe
  C:\Windows\System32\FwmEORn.exe
  2⤵
  PID:9208
- C:\Windows\System32\mMLJvVA.exe
  C:\Windows\System32\mMLJvVA.exe
  2⤵
  PID:8324
- C:\Windows\System32\vNvIsah.exe
  C:\Windows\System32\vNvIsah.exe
  2⤵
  PID:8552
- C:\Windows\System32\VmExTyD.exe
  C:\Windows\System32\VmExTyD.exe
  2⤵
  PID:8644
- C:\Windows\System32\zqJeOSw.exe
  C:\Windows\System32\zqJeOSw.exe
  2⤵
  PID:8688
- C:\Windows\System32\jeoMkZW.exe
  C:\Windows\System32\jeoMkZW.exe
  2⤵
  PID:8968
- C:\Windows\System32\nrGjveB.exe
  C:\Windows\System32\nrGjveB.exe
  2⤵
  PID:8884
- C:\Windows\System32\KzSXRlp.exe
  C:\Windows\System32\KzSXRlp.exe
  2⤵
  PID:2732
- C:\Windows\System32\XbvCSzt.exe
  C:\Windows\System32\XbvCSzt.exe
  2⤵
  PID:4552
- C:\Windows\System32\oBVnzrj.exe
  C:\Windows\System32\oBVnzrj.exe
  2⤵
  PID:8572
- C:\Windows\System32\StHZtHp.exe
  C:\Windows\System32\StHZtHp.exe
  2⤵
  PID:436
- C:\Windows\System32\MMMjNPd.exe
  C:\Windows\System32\MMMjNPd.exe
  2⤵
  PID:8856
- C:\Windows\System32\rOkeOWZ.exe
  C:\Windows\System32\rOkeOWZ.exe
  2⤵
  PID:8476
- C:\Windows\System32\cSNJwrr.exe
  C:\Windows\System32\cSNJwrr.exe
  2⤵
  PID:9116
- C:\Windows\System32\oWMtnVW.exe
  C:\Windows\System32\oWMtnVW.exe
  2⤵
  PID:9236
- C:\Windows\System32\PseXOER.exe
  C:\Windows\System32\PseXOER.exe
  2⤵
  PID:9264
- C:\Windows\System32\dYlVnyf.exe
  C:\Windows\System32\dYlVnyf.exe
  2⤵
  PID:9284
- C:\Windows\System32\BddAwyq.exe
  C:\Windows\System32\BddAwyq.exe
  2⤵
  PID:9300
- C:\Windows\System32\hiwkdsB.exe
  C:\Windows\System32\hiwkdsB.exe
  2⤵
  PID:9324
- C:\Windows\System32\bWrWnnn.exe
  C:\Windows\System32\bWrWnnn.exe
  2⤵
  PID:9416
- C:\Windows\System32\qvaXshF.exe
  C:\Windows\System32\qvaXshF.exe
  2⤵
  PID:9432
- C:\Windows\System32\qSSgAeK.exe
  C:\Windows\System32\qSSgAeK.exe
  2⤵
  PID:9448
- C:\Windows\System32\fifRsrv.exe
  C:\Windows\System32\fifRsrv.exe
  2⤵
  PID:9508
- C:\Windows\System32\hkPqWtz.exe
  C:\Windows\System32\hkPqWtz.exe
  2⤵
  PID:9524
- C:\Windows\System32\ASYbjbE.exe
  C:\Windows\System32\ASYbjbE.exe
  2⤵
  PID:9552
- C:\Windows\System32\lpBQBrQ.exe
  C:\Windows\System32\lpBQBrQ.exe
  2⤵
  PID:9572
- C:\Windows\System32\tmnAhCA.exe
  C:\Windows\System32\tmnAhCA.exe
  2⤵
  PID:9592
- C:\Windows\System32\GNvSLiv.exe
  C:\Windows\System32\GNvSLiv.exe
  2⤵
  PID:9616
- C:\Windows\System32\Xljhkuc.exe
  C:\Windows\System32\Xljhkuc.exe
  2⤵
  PID:9640
- C:\Windows\System32\CkbdNzZ.exe
  C:\Windows\System32\CkbdNzZ.exe
  2⤵
  PID:9676
- C:\Windows\System32\tOhFFrQ.exe
  C:\Windows\System32\tOhFFrQ.exe
  2⤵
  PID:9692
- C:\Windows\System32\DzrvZZY.exe
  C:\Windows\System32\DzrvZZY.exe
  2⤵
  PID:9716
- C:\Windows\System32\tqJNSoR.exe
  C:\Windows\System32\tqJNSoR.exe
  2⤵
  PID:9732
- C:\Windows\System32\KziIORt.exe
  C:\Windows\System32\KziIORt.exe
  2⤵
  PID:9800
- C:\Windows\System32\AEzHfeK.exe
  C:\Windows\System32\AEzHfeK.exe
  2⤵
  PID:9828
- C:\Windows\System32\iYOViea.exe
  C:\Windows\System32\iYOViea.exe
  2⤵
  PID:9868
- C:\Windows\System32\OvJPOGJ.exe
  C:\Windows\System32\OvJPOGJ.exe
  2⤵
  PID:9892
- C:\Windows\System32\JVRdJWP.exe
  C:\Windows\System32\JVRdJWP.exe
  2⤵
  PID:9924
- C:\Windows\System32\gkopZVn.exe
  C:\Windows\System32\gkopZVn.exe
  2⤵
  PID:9952
- C:\Windows\System32\KUnEran.exe
  C:\Windows\System32\KUnEran.exe
  2⤵
  PID:9976
- C:\Windows\System32\iMonnWg.exe
  C:\Windows\System32\iMonnWg.exe
  2⤵
  PID:10008
- C:\Windows\System32\fIhpIWT.exe
  C:\Windows\System32\fIhpIWT.exe
  2⤵
  PID:10028
- C:\Windows\System32\YmYfEbn.exe
  C:\Windows\System32\YmYfEbn.exe
  2⤵
  PID:10068
- C:\Windows\System32\xAXPLty.exe
  C:\Windows\System32\xAXPLty.exe
  2⤵
  PID:10092
- C:\Windows\System32\WmhoPSs.exe
  C:\Windows\System32\WmhoPSs.exe
  2⤵
  PID:10112
- C:\Windows\System32\gElpexe.exe
  C:\Windows\System32\gElpexe.exe
  2⤵
  PID:10136
- C:\Windows\System32\LyTybmj.exe
  C:\Windows\System32\LyTybmj.exe
  2⤵
  PID:10188
- C:\Windows\System32\ebFeQMY.exe
  C:\Windows\System32\ebFeQMY.exe
  2⤵
  PID:10204
- C:\Windows\System32\wqMtGfH.exe
  C:\Windows\System32\wqMtGfH.exe
  2⤵
  PID:10224
- C:\Windows\System32\PFKceif.exe
  C:\Windows\System32\PFKceif.exe
  2⤵
  PID:9252
- C:\Windows\System32\iEVCsia.exe
  C:\Windows\System32\iEVCsia.exe
  2⤵
  PID:9308
- C:\Windows\System32\zEYntKH.exe
  C:\Windows\System32\zEYntKH.exe
  2⤵
  PID:9332
- C:\Windows\System32\fJvfTXO.exe
  C:\Windows\System32\fJvfTXO.exe
  2⤵
  PID:9336
- C:\Windows\System32\AZhRdXi.exe
  C:\Windows\System32\AZhRdXi.exe
  2⤵
  PID:9444
- C:\Windows\System32\kEjZPGc.exe
  C:\Windows\System32\kEjZPGc.exe
  2⤵
  PID:9472
- C:\Windows\System32\KRXXWte.exe
  C:\Windows\System32\KRXXWte.exe
  2⤵
  PID:9516
- C:\Windows\System32\ZFRQCLW.exe
  C:\Windows\System32\ZFRQCLW.exe
  2⤵
  PID:9560
- C:\Windows\System32\qvLhFLH.exe
  C:\Windows\System32\qvLhFLH.exe
  2⤵
  PID:9624
- C:\Windows\System32\KPxlyEY.exe
  C:\Windows\System32\KPxlyEY.exe
  2⤵
  PID:9684
- C:\Windows\System32\oaegvAr.exe
  C:\Windows\System32\oaegvAr.exe
  2⤵
  PID:9760
- C:\Windows\System32\ODfmlaJ.exe
  C:\Windows\System32\ODfmlaJ.exe
  2⤵
  PID:9876
- C:\Windows\System32\kenNkZt.exe
  C:\Windows\System32\kenNkZt.exe
  2⤵
  PID:9912
- C:\Windows\System32\FOlfWeA.exe
  C:\Windows\System32\FOlfWeA.exe
  2⤵
  PID:4224
- C:\Windows\System32\fZWVRPl.exe
  C:\Windows\System32\fZWVRPl.exe
  2⤵
  PID:10064
- C:\Windows\System32\qPXnKwj.exe
  C:\Windows\System32\qPXnKwj.exe
  2⤵
  PID:10128
- C:\Windows\System32\iHLBZIt.exe
  C:\Windows\System32\iHLBZIt.exe
  2⤵
  PID:10196
- C:\Windows\System32\WuflbAz.exe
  C:\Windows\System32\WuflbAz.exe
  2⤵
  PID:9248
- C:\Windows\System32\SDeQUOg.exe
  C:\Windows\System32\SDeQUOg.exe
  2⤵
  PID:9356
- C:\Windows\System32\svzhjgJ.exe
  C:\Windows\System32\svzhjgJ.exe
  2⤵
  PID:428
- C:\Windows\System32\hQtREmf.exe
  C:\Windows\System32\hQtREmf.exe
  2⤵
  PID:9536
- C:\Windows\System32\nlVhSql.exe
  C:\Windows\System32\nlVhSql.exe
  2⤵
  PID:9808
- C:\Windows\System32\KaHRpCw.exe
  C:\Windows\System32\KaHRpCw.exe
  2⤵
  PID:10176
- C:\Windows\System32\QHEMYtf.exe
  C:\Windows\System32\QHEMYtf.exe
  2⤵
  PID:9428
- C:\Windows\System32\lmjkVDh.exe
  C:\Windows\System32\lmjkVDh.exe
  2⤵
  PID:9728
- C:\Windows\System32\pfHZqBq.exe
  C:\Windows\System32\pfHZqBq.exe
  2⤵
  PID:9908
- C:\Windows\System32\wQMAZli.exe
  C:\Windows\System32\wQMAZli.exe
  2⤵
  PID:9564
- C:\Windows\System32\PNDGCux.exe
  C:\Windows\System32\PNDGCux.exe
  2⤵
  PID:10024
- C:\Windows\System32\nZjcOhT.exe
  C:\Windows\System32\nZjcOhT.exe
  2⤵
  PID:3880
- C:\Windows\System32\WStpPJD.exe
  C:\Windows\System32\WStpPJD.exe
  2⤵
  PID:3684
- C:\Windows\System32\JYjjPRr.exe
  C:\Windows\System32\JYjjPRr.exe
  2⤵
  PID:10276
- C:\Windows\System32\ZNgoMYO.exe
  C:\Windows\System32\ZNgoMYO.exe
  2⤵
  PID:10316
- C:\Windows\System32\ogLhpvx.exe
  C:\Windows\System32\ogLhpvx.exe
  2⤵
  PID:10372
- C:\Windows\System32\yYBgIpa.exe
  C:\Windows\System32\yYBgIpa.exe
  2⤵
  PID:10388
- C:\Windows\System32\TDAfLID.exe
  C:\Windows\System32\TDAfLID.exe
  2⤵
  PID:10412
- C:\Windows\System32\BJZWIAI.exe
  C:\Windows\System32\BJZWIAI.exe
  2⤵
  PID:10432
- C:\Windows\System32\GHQyLWD.exe
  C:\Windows\System32\GHQyLWD.exe
  2⤵
  PID:10472
- C:\Windows\System32\zEWmsNX.exe
  C:\Windows\System32\zEWmsNX.exe
  2⤵
  PID:10488
- C:\Windows\System32\ZuEdbvq.exe
  C:\Windows\System32\ZuEdbvq.exe
  2⤵
  PID:10504
- C:\Windows\System32\cDuscRJ.exe
  C:\Windows\System32\cDuscRJ.exe
  2⤵
  PID:10556
- C:\Windows\System32\XdceqUz.exe
  C:\Windows\System32\XdceqUz.exe
  2⤵
  PID:10584
- C:\Windows\System32\cWizpkk.exe
  C:\Windows\System32\cWizpkk.exe
  2⤵
  PID:10600
- C:\Windows\System32\eopdcOf.exe
  C:\Windows\System32\eopdcOf.exe
  2⤵
  PID:10628
- C:\Windows\System32\NViuCpd.exe
  C:\Windows\System32\NViuCpd.exe
  2⤵
  PID:10644
- C:\Windows\System32\RSBoXLo.exe
  C:\Windows\System32\RSBoXLo.exe
  2⤵
  PID:10676
- C:\Windows\System32\TkzsGrx.exe
  C:\Windows\System32\TkzsGrx.exe
  2⤵
  PID:10692
- C:\Windows\System32\lDNtcND.exe
  C:\Windows\System32\lDNtcND.exe
  2⤵
  PID:10764
- C:\Windows\System32\fLJiQtl.exe
  C:\Windows\System32\fLJiQtl.exe
  2⤵
  PID:10780
- C:\Windows\System32\anIZoGZ.exe
  C:\Windows\System32\anIZoGZ.exe
  2⤵
  PID:10808
- C:\Windows\System32\tYQkywO.exe
  C:\Windows\System32\tYQkywO.exe
  2⤵
  PID:10828
- C:\Windows\System32\DdgoEjT.exe
  C:\Windows\System32\DdgoEjT.exe
  2⤵
  PID:10852
- C:\Windows\System32\JOTteIn.exe
  C:\Windows\System32\JOTteIn.exe
  2⤵
  PID:10880
- C:\Windows\System32\EgavfyE.exe
  C:\Windows\System32\EgavfyE.exe
  2⤵
  PID:10908
- C:\Windows\System32\WdQrHEt.exe
  C:\Windows\System32\WdQrHEt.exe
  2⤵
  PID:10936
- C:\Windows\System32\ZeBaKjJ.exe
  C:\Windows\System32\ZeBaKjJ.exe
  2⤵
  PID:10952
- C:\Windows\System32\qASAFdp.exe
  C:\Windows\System32\qASAFdp.exe
  2⤵
  PID:10992
- C:\Windows\System32\SDEhddO.exe
  C:\Windows\System32\SDEhddO.exe
  2⤵
  PID:11012
- C:\Windows\System32\ExUlePQ.exe
  C:\Windows\System32\ExUlePQ.exe
  2⤵
  PID:11060
- C:\Windows\System32\vKHmvWY.exe
  C:\Windows\System32\vKHmvWY.exe
  2⤵
  PID:11080
- C:\Windows\System32\iRuNQjs.exe
  C:\Windows\System32\iRuNQjs.exe
  2⤵
  PID:11108
- C:\Windows\System32\KCgMAvk.exe
  C:\Windows\System32\KCgMAvk.exe
  2⤵
  PID:11132
- C:\Windows\System32\ULDGfoe.exe
  C:\Windows\System32\ULDGfoe.exe
  2⤵
  PID:11176
- C:\Windows\System32\UVZNybn.exe
  C:\Windows\System32\UVZNybn.exe
  2⤵
  PID:11200
- C:\Windows\System32\sdKyRdK.exe
  C:\Windows\System32\sdKyRdK.exe
  2⤵
  PID:11224
- C:\Windows\System32\OIyrrMS.exe
  C:\Windows\System32\OIyrrMS.exe
  2⤵
  PID:11240
- C:\Windows\System32\SCACnbF.exe
  C:\Windows\System32\SCACnbF.exe
  2⤵
  PID:11260
- C:\Windows\System32\KRfgqVm.exe
  C:\Windows\System32\KRfgqVm.exe
  2⤵
  PID:10248
- C:\Windows\System32\MaOiNRa.exe
  C:\Windows\System32\MaOiNRa.exe
  2⤵
  PID:9496
- C:\Windows\System32\IUGBNhY.exe
  C:\Windows\System32\IUGBNhY.exe
  2⤵
  PID:10380
- C:\Windows\System32\zNRxWcx.exe
  C:\Windows\System32\zNRxWcx.exe
  2⤵
  PID:10400
- C:\Windows\System32\OrBSanj.exe
  C:\Windows\System32\OrBSanj.exe
  2⤵
  PID:10496
- C:\Windows\System32\wyNFDJN.exe
  C:\Windows\System32\wyNFDJN.exe
  2⤵
  PID:10572
- C:\Windows\System32\KAqKdMr.exe
  C:\Windows\System32\KAqKdMr.exe
  2⤵
  PID:10612
- C:\Windows\System32\qojHhpE.exe
  C:\Windows\System32\qojHhpE.exe
  2⤵
  PID:10720
- C:\Windows\System32\iARizYA.exe
  C:\Windows\System32\iARizYA.exe
  2⤵
  PID:10772
- C:\Windows\System32\zPIMjjF.exe
  C:\Windows\System32\zPIMjjF.exe
  2⤵
  PID:10820
- C:\Windows\System32\azxoHFq.exe
  C:\Windows\System32\azxoHFq.exe
  2⤵
  PID:10904
- C:\Windows\System32\zQFblwo.exe
  C:\Windows\System32\zQFblwo.exe
  2⤵
  PID:10976
- C:\Windows\System32\muzNFdo.exe
  C:\Windows\System32\muzNFdo.exe
  2⤵
  PID:11032
- C:\Windows\System32\sCKXTvr.exe
  C:\Windows\System32\sCKXTvr.exe
  2⤵
  PID:11088
- C:\Windows\System32\uPwfseN.exe
  C:\Windows\System32\uPwfseN.exe
  2⤵
  PID:11128
- C:\Windows\System32\WulmnWe.exe
  C:\Windows\System32\WulmnWe.exe
  2⤵
  PID:11216
- C:\Windows\System32\iNSFPhw.exe
  C:\Windows\System32\iNSFPhw.exe
  2⤵
  PID:11232
- C:\Windows\System32\BktWFRY.exe
  C:\Windows\System32\BktWFRY.exe
  2⤵
  PID:3052
- C:\Windows\System32\xIspRBo.exe
  C:\Windows\System32\xIspRBo.exe
  2⤵
  PID:10444
- C:\Windows\System32\oltKbIj.exe
  C:\Windows\System32\oltKbIj.exe
  2⤵
  PID:10548
- C:\Windows\System32\QYuzIUo.exe
  C:\Windows\System32\QYuzIUo.exe
  2⤵
  PID:10660
- C:\Windows\System32\LXrZKhC.exe
  C:\Windows\System32\LXrZKhC.exe
  2⤵
  PID:10804
- C:\Windows\System32\pESzNiZ.exe
  C:\Windows\System32\pESzNiZ.exe
  2⤵
  PID:11188
- C:\Windows\System32\GceUacE.exe
  C:\Windows\System32\GceUacE.exe
  2⤵
  PID:11248
- C:\Windows\System32\cEISsid.exe
  C:\Windows\System32\cEISsid.exe
  2⤵
  PID:10292
- C:\Windows\System32\XQGJMQM.exe
  C:\Windows\System32\XQGJMQM.exe
  2⤵
  PID:10724
- C:\Windows\System32\TrXmPwi.exe
  C:\Windows\System32\TrXmPwi.exe
  2⤵
  PID:10948
- C:\Windows\System32\vAwSktq.exe
  C:\Windows\System32\vAwSktq.exe
  2⤵
  PID:11148
- C:\Windows\System32\DkzzzvC.exe
  C:\Windows\System32\DkzzzvC.exe
  2⤵
  PID:11104
- C:\Windows\System32\WOirwAp.exe
  C:\Windows\System32\WOirwAp.exe
  2⤵
  PID:10592
- C:\Windows\System32\CLyZszY.exe
  C:\Windows\System32\CLyZszY.exe
  2⤵
  PID:11288
- C:\Windows\System32\RtdIKWD.exe
  C:\Windows\System32\RtdIKWD.exe
  2⤵
  PID:11336
- C:\Windows\System32\eUBlGRd.exe
  C:\Windows\System32\eUBlGRd.exe
  2⤵
  PID:11364
- C:\Windows\System32\QJIophJ.exe
  C:\Windows\System32\QJIophJ.exe
  2⤵
  PID:11392
- C:\Windows\System32\TTUlFHp.exe
  C:\Windows\System32\TTUlFHp.exe
  2⤵
  PID:11420
- C:\Windows\System32\jMZBJal.exe
  C:\Windows\System32\jMZBJal.exe
  2⤵
  PID:11436
- C:\Windows\System32\PnuoHua.exe
  C:\Windows\System32\PnuoHua.exe
  2⤵
  PID:11456
- C:\Windows\System32\NAAAcYC.exe
  C:\Windows\System32\NAAAcYC.exe
  2⤵
  PID:11472
- C:\Windows\System32\upUNlQZ.exe
  C:\Windows\System32\upUNlQZ.exe
  2⤵
  PID:11516
- C:\Windows\System32\RBYvOjF.exe
  C:\Windows\System32\RBYvOjF.exe
  2⤵
  PID:11560
- C:\Windows\System32\aRNKLyW.exe
  C:\Windows\System32\aRNKLyW.exe
  2⤵
  PID:11584
- C:\Windows\System32\quKElQN.exe
  C:\Windows\System32\quKElQN.exe
  2⤵
  PID:11632
- C:\Windows\System32\GytoOXs.exe
  C:\Windows\System32\GytoOXs.exe
  2⤵
  PID:11656
- C:\Windows\System32\dPpFRrB.exe
  C:\Windows\System32\dPpFRrB.exe
  2⤵
  PID:11676
- C:\Windows\System32\mKSQqRn.exe
  C:\Windows\System32\mKSQqRn.exe
  2⤵
  PID:11708
- C:\Windows\System32\pLfYWvK.exe
  C:\Windows\System32\pLfYWvK.exe
  2⤵
  PID:11740
- C:\Windows\System32\FwLoIxE.exe
  C:\Windows\System32\FwLoIxE.exe
  2⤵
  PID:11764
- C:\Windows\System32\swUlFHs.exe
  C:\Windows\System32\swUlFHs.exe
  2⤵
  PID:11788
- C:\Windows\System32\DkdSgcC.exe
  C:\Windows\System32\DkdSgcC.exe
  2⤵
  PID:11832
- C:\Windows\System32\cKidbsQ.exe
  C:\Windows\System32\cKidbsQ.exe
  2⤵
  PID:11856
- C:\Windows\System32\oqdGxvd.exe
  C:\Windows\System32\oqdGxvd.exe
  2⤵
  PID:11876
- C:\Windows\System32\AwwfqaF.exe
  C:\Windows\System32\AwwfqaF.exe
  2⤵
  PID:11900
- C:\Windows\System32\GYZEdyv.exe
  C:\Windows\System32\GYZEdyv.exe
  2⤵
  PID:11928
- C:\Windows\System32\InDGrKO.exe
  C:\Windows\System32\InDGrKO.exe
  2⤵
  PID:11968
- C:\Windows\System32\scTDEUT.exe
  C:\Windows\System32\scTDEUT.exe
  2⤵
  PID:12000
- C:\Windows\System32\uISqBwq.exe
  C:\Windows\System32\uISqBwq.exe
  2⤵
  PID:12024
- C:\Windows\System32\QpQkkHk.exe
  C:\Windows\System32\QpQkkHk.exe
  2⤵
  PID:12052
- C:\Windows\System32\OSXxvfe.exe
  C:\Windows\System32\OSXxvfe.exe
  2⤵
  PID:12076
- C:\Windows\System32\mbmnJTO.exe
  C:\Windows\System32\mbmnJTO.exe
  2⤵
  PID:12096
- C:\Windows\System32\NpIliVp.exe
  C:\Windows\System32\NpIliVp.exe
  2⤵
  PID:12116
- C:\Windows\System32\ztAPRQR.exe
  C:\Windows\System32\ztAPRQR.exe
  2⤵
  PID:12144
- C:\Windows\System32\vfzErXC.exe
  C:\Windows\System32\vfzErXC.exe
  2⤵
  PID:12164
- C:\Windows\System32\QdPkXWL.exe
  C:\Windows\System32\QdPkXWL.exe
  2⤵
  PID:12216
- C:\Windows\System32\XClKVOM.exe
  C:\Windows\System32\XClKVOM.exe
  2⤵
  PID:12248
- C:\Windows\System32\annARUs.exe
  C:\Windows\System32\annARUs.exe
  2⤵
  PID:12276
- C:\Windows\System32\hcGKpmh.exe
  C:\Windows\System32\hcGKpmh.exe
  2⤵
  PID:11296
- C:\Windows\System32\CaqmJVX.exe
  C:\Windows\System32\CaqmJVX.exe
  2⤵
  PID:11360
- C:\Windows\System32\JsVgmJJ.exe
  C:\Windows\System32\JsVgmJJ.exe
  2⤵
  PID:11408
- C:\Windows\System32\XbdZmzd.exe
  C:\Windows\System32\XbdZmzd.exe
  2⤵
  PID:11452
- C:\Windows\System32\EOLizdE.exe
  C:\Windows\System32\EOLizdE.exe
  2⤵
  PID:11508
- C:\Windows\System32\eEOomTG.exe
  C:\Windows\System32\eEOomTG.exe
  2⤵
  PID:11608
- C:\Windows\System32\ghAADTt.exe
  C:\Windows\System32\ghAADTt.exe
  2⤵
  PID:11684
- C:\Windows\System32\XDFuwHQ.exe
  C:\Windows\System32\XDFuwHQ.exe
  2⤵
  PID:11772
- C:\Windows\System32\EdinkHg.exe
  C:\Windows\System32\EdinkHg.exe
  2⤵
  PID:11824
- C:\Windows\System32\qzOkVit.exe
  C:\Windows\System32\qzOkVit.exe
  2⤵
  PID:11864
- C:\Windows\System32\xfShYho.exe
  C:\Windows\System32\xfShYho.exe
  2⤵
  PID:11948
- C:\Windows\System32\Dniqxcs.exe
  C:\Windows\System32\Dniqxcs.exe
  2⤵
  PID:12044
- C:\Windows\System32\TkgmfQY.exe
  C:\Windows\System32\TkgmfQY.exe
  2⤵
  PID:12064
- C:\Windows\System32\hllvpjP.exe
  C:\Windows\System32\hllvpjP.exe
  2⤵
  PID:12132
- C:\Windows\System32\kdjzSqu.exe
  C:\Windows\System32\kdjzSqu.exe
  2⤵
  PID:12172
- C:\Windows\System32\CAaIPkD.exe
  C:\Windows\System32\CAaIPkD.exe
  2⤵
  PID:12260
- C:\Windows\System32\OnUqJhD.exe
  C:\Windows\System32\OnUqJhD.exe
  2⤵
  PID:11356
- C:\Windows\System32\OIvKIdt.exe
  C:\Windows\System32\OIvKIdt.exe
  2⤵
  PID:11556
- C:\Windows\System32\MNaZpGI.exe
  C:\Windows\System32\MNaZpGI.exe
  2⤵
  PID:11580
- C:\Windows\System32\jOXdrjY.exe
  C:\Windows\System32\jOXdrjY.exe
  2⤵
  PID:11748
- C:\Windows\System32\IySfXGS.exe
  C:\Windows\System32\IySfXGS.exe
  2⤵
  PID:11920
- C:\Windows\System32\GfZhToM.exe
  C:\Windows\System32\GfZhToM.exe
  2⤵
  PID:11984
- C:\Windows\System32\tlcjmYD.exe
  C:\Windows\System32\tlcjmYD.exe
  2⤵
  PID:11332
- C:\Windows\System32\PNxPsCL.exe
  C:\Windows\System32\PNxPsCL.exe
  2⤵
  PID:11672
- C:\Windows\System32\LpuGcCx.exe
  C:\Windows\System32\LpuGcCx.exe
  2⤵
  PID:11916
- C:\Windows\System32\tMuJFJj.exe
  C:\Windows\System32\tMuJFJj.exe
  2⤵
  PID:11908
- C:\Windows\System32\biDSYgw.exe
  C:\Windows\System32\biDSYgw.exe
  2⤵
  PID:12152
- C:\Windows\System32\AehQTnl.exe
  C:\Windows\System32\AehQTnl.exe
  2⤵
  PID:12304
- C:\Windows\System32\xxiXwlh.exe
  C:\Windows\System32\xxiXwlh.exe
  2⤵
  PID:12360
- C:\Windows\System32\hcJvoet.exe
  C:\Windows\System32\hcJvoet.exe
  2⤵
  PID:12384
- C:\Windows\System32\VxIUQxV.exe
  C:\Windows\System32\VxIUQxV.exe
  2⤵
  PID:12412
- C:\Windows\System32\lqoWddX.exe
  C:\Windows\System32\lqoWddX.exe
  2⤵
  PID:12444
- C:\Windows\System32\yxAwPqR.exe
  C:\Windows\System32\yxAwPqR.exe
  2⤵
  PID:12480
- C:\Windows\System32\FPTgqRI.exe
  C:\Windows\System32\FPTgqRI.exe
  2⤵
  PID:12500
- C:\Windows\System32\vdRmcri.exe
  C:\Windows\System32\vdRmcri.exe
  2⤵
  PID:12524
- C:\Windows\System32\jLEgbqe.exe
  C:\Windows\System32\jLEgbqe.exe
  2⤵
  PID:12568
- C:\Windows\System32\cXAZwgQ.exe
  C:\Windows\System32\cXAZwgQ.exe
  2⤵
  PID:12588
- C:\Windows\System32\gblTpfx.exe
  C:\Windows\System32\gblTpfx.exe
  2⤵
  PID:12608
- C:\Windows\System32\TjgSSPO.exe
  C:\Windows\System32\TjgSSPO.exe
  2⤵
  PID:12652
- C:\Windows\System32\tThJnEj.exe
  C:\Windows\System32\tThJnEj.exe
  2⤵
  PID:12668
- C:\Windows\System32\jMKoGZr.exe
  C:\Windows\System32\jMKoGZr.exe
  2⤵
  PID:12704
- C:\Windows\System32\JGrggNU.exe
  C:\Windows\System32\JGrggNU.exe
  2⤵
  PID:12732
- C:\Windows\System32\DiINmdM.exe
  C:\Windows\System32\DiINmdM.exe
  2⤵
  PID:12756
- C:\Windows\System32\zYFOwbr.exe
  C:\Windows\System32\zYFOwbr.exe
  2⤵
  PID:12776
- C:\Windows\System32\iPoVMeL.exe
  C:\Windows\System32\iPoVMeL.exe
  2⤵
  PID:12804
- C:\Windows\System32\VmWRqIq.exe
  C:\Windows\System32\VmWRqIq.exe
  2⤵
  PID:12828
- C:\Windows\System32\pvSbgPt.exe
  C:\Windows\System32\pvSbgPt.exe
  2⤵
  PID:12852
- C:\Windows\System32\zHwXBUY.exe
  C:\Windows\System32\zHwXBUY.exe
  2⤵
  PID:12972
- C:\Windows\System32\OLhEqgs.exe
  C:\Windows\System32\OLhEqgs.exe
  2⤵
  PID:12988
- C:\Windows\System32\ODaxTef.exe
  C:\Windows\System32\ODaxTef.exe
  2⤵
  PID:13004
- C:\Windows\System32\OLpwfoL.exe
  C:\Windows\System32\OLpwfoL.exe
  2⤵
  PID:13020
- C:\Windows\System32\oxwKohp.exe
  C:\Windows\System32\oxwKohp.exe
  2⤵
  PID:13036
- C:\Windows\System32\DSrwIDE.exe
  C:\Windows\System32\DSrwIDE.exe
  2⤵
  PID:13052
- C:\Windows\System32\yqCQFyX.exe
  C:\Windows\System32\yqCQFyX.exe
  2⤵
  PID:13068
- C:\Windows\System32\yuHQnbt.exe
  C:\Windows\System32\yuHQnbt.exe
  2⤵
  PID:13084
- C:\Windows\System32\dxVLDOD.exe
  C:\Windows\System32\dxVLDOD.exe
  2⤵
  PID:13104
- C:\Windows\System32\qzhjfeb.exe
  C:\Windows\System32\qzhjfeb.exe
  2⤵
  PID:13132
- C:\Windows\System32\vkymSAp.exe
  C:\Windows\System32\vkymSAp.exe
  2⤵
  PID:13224
- C:\Windows\System32\KQliCqa.exe
  C:\Windows\System32\KQliCqa.exe
  2⤵
  PID:13272
- C:\Windows\System32\RxqaKSx.exe
  C:\Windows\System32\RxqaKSx.exe
  2⤵
  PID:13292
- C:\Windows\System32\aIzpUmK.exe
  C:\Windows\System32\aIzpUmK.exe
  2⤵
  PID:11552
- C:\Windows\System32\fapWcuw.exe
  C:\Windows\System32\fapWcuw.exe
  2⤵
  PID:12368
- C:\Windows\System32\CZFeXVI.exe
  C:\Windows\System32\CZFeXVI.exe
  2⤵
  PID:12440
- C:\Windows\System32\JqoGuuR.exe
  C:\Windows\System32\JqoGuuR.exe
  2⤵
  PID:12452
- C:\Windows\System32\pknWuOO.exe
  C:\Windows\System32\pknWuOO.exe
  2⤵
  PID:4364
- C:\Windows\System32\ZfkGFaG.exe
  C:\Windows\System32\ZfkGFaG.exe
  2⤵
  PID:12536
- C:\Windows\System32\GzlcnJD.exe
  C:\Windows\System32\GzlcnJD.exe
  2⤵
  PID:12632
- C:\Windows\System32\NvrUpQg.exe
  C:\Windows\System32\NvrUpQg.exe
  2⤵
  PID:12700
- C:\Windows\System32\OJVLLGd.exe
  C:\Windows\System32\OJVLLGd.exe
  2⤵
  PID:12748
- C:\Windows\System32\KEnFlWE.exe
  C:\Windows\System32\KEnFlWE.exe
  2⤵
  PID:12788
- C:\Windows\System32\WMEmxdT.exe
  C:\Windows\System32\WMEmxdT.exe
  2⤵
  PID:12916
- C:\Windows\System32\IPJYLpr.exe
  C:\Windows\System32\IPJYLpr.exe
  2⤵
  PID:12920
- C:\Windows\System32\BAQhNqJ.exe
  C:\Windows\System32\BAQhNqJ.exe
  2⤵
  PID:12944
- C:\Windows\System32\nmOEnED.exe
  C:\Windows\System32\nmOEnED.exe
  2⤵
  PID:13032
- C:\Windows\System32\yIfZySF.exe
  C:\Windows\System32\yIfZySF.exe
  2⤵
  PID:13100
- C:\Windows\System32\yuhytVZ.exe
  C:\Windows\System32\yuhytVZ.exe
  2⤵
  PID:13060
- C:\Windows\System32\RosuqZO.exe
  C:\Windows\System32\RosuqZO.exe
  2⤵
  PID:13212
- C:\Windows\System32\kbWOPYQ.exe
  C:\Windows\System32\kbWOPYQ.exe
  2⤵
  PID:13260
- C:\Windows\System32\zAeowCO.exe
  C:\Windows\System32\zAeowCO.exe
  2⤵
  PID:12328
- C:\Windows\System32\ukHVJpY.exe
  C:\Windows\System32\ukHVJpY.exe
  2⤵
  PID:11432
- C:\Windows\System32\CukrbAU.exe
  C:\Windows\System32\CukrbAU.exe
  2⤵
  PID:12512
- C:\Windows\System32\VDMKkGT.exe
  C:\Windows\System32\VDMKkGT.exe
  2⤵
  PID:12616
- C:\Windows\System32\zHfmpbQ.exe
  C:\Windows\System32\zHfmpbQ.exe
  2⤵
  PID:12848
- C:\Windows\System32\UacrFjl.exe
  C:\Windows\System32\UacrFjl.exe
  2⤵
  PID:12928
- C:\Windows\System32\CUCFgki.exe
  C:\Windows\System32\CUCFgki.exe
  2⤵
  PID:12984
- C:\Windows\System32\ZkxcONl.exe
  C:\Windows\System32\ZkxcONl.exe
  2⤵
  PID:13096
- C:\Windows\System32\NQQrytG.exe
  C:\Windows\System32\NQQrytG.exe
  2⤵
  PID:13176
- C:\Windows\System32\mIPlJNP.exe
  C:\Windows\System32\mIPlJNP.exe
  2⤵
  PID:12724
- C:\Windows\System32\njmBdrF.exe
  C:\Windows\System32\njmBdrF.exe
  2⤵
  PID:12968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\AZlqUsM.exe

Filesize
1.2MB

MD5
32f052c8990e842a2247d0dbda825551

SHA1
39772299f07e3488e47231eebc00cf735bfc17eb

SHA256
9dd54ac2422482d7b2f9b02f0db8cbfd5d3543db2aeb0308ef679126f43a6554

SHA512
335391375d669ce50a3f0467751e96ef2c710c0a89ed267d2fc51937ec199a230fb771d8cdca93ed4f41c507d388f6082aa1c851d69e7a3b014ca19ca7a307b1

Download Submit
C:\Windows\System32\Czlilrw.exe

Filesize
1.2MB

MD5
a831670577aec77fa2f45cc8fe536a34

SHA1
782ed76b4c9aa10078e8fcc7452ca6c647a41614

SHA256
8cbf200f8d5feacfb8e2bd8ac57a869517168bc6a1dcd8bd8813de61a82122d6

SHA512
591ccb663efe0241caf3da5f65fa6d3e8d114cada3def53bb6b58f749a693ffe94087dd5eb30eda8d85d4e523861bc15795455438101d9caa136a4bcbae4b5ac

Download Submit
C:\Windows\System32\EtXxiiZ.exe

Filesize
1.2MB

MD5
b27fcab4c766e99fc7c802ee74cc87a7

SHA1
eb76127eba72f1fc830d8acc33b00c76747ddb0b

SHA256
761594961baa7d1ac556eec7fcb6c4eb53d0b4cb1ef17da1b0353d03270b51dc

SHA512
c9911c6b1885d92aefffb8cf87b0dd54b53c8c6d014bddab028f7600c86d549fe1eca1620bdd36350ad7ec5dd207fa0ee65710eb160839521b638855da8f4fbe

Download Submit
C:\Windows\System32\FauNtBw.exe

Filesize
1.2MB

MD5
0afb997ef6f1d1b3bb8e74d2dbb4d370

SHA1
44ca59689d87411ba272ebbdb3bb771d4f942b71

SHA256
6c5dea3e540ee81488ac54850db375a775aab5285eb5a9413f77dfb1d999c0ef

SHA512
04139070a313dab9a2258359146273052274974ad4e12ab29342855377541d903b10ef6296d65eda8ab550d3145e073d22d911351f108c6937413b76aa7876a3

Download Submit
C:\Windows\System32\GYGczAt.exe

Filesize
1.2MB

MD5
16c58f86525bfb600f9bed52c4607ed7

SHA1
a22420eba8d5e9695ec1c1ba5467c2aa617975d4

SHA256
e38fa32d27c4e80dc5bf7028916644878863e684e2ea9656832de4d509230f58

SHA512
cc2d1f8251a63453eb51bd1d8f595ee9aae32a8b4591ffbf851db90287e71ead909afb25d91c4a966fd876c463e9e7dbcce8534ac98afea5fe516e7a18735b43

Download Submit
C:\Windows\System32\GmGCSga.exe

Filesize
1.2MB

MD5
c09532b66bfc7b4b48d8b0e54e70e0b4

SHA1
3663a49d5374c4a86606134f3d090fe2413d91ca

SHA256
48842835969ec227689c992ccd5aaa29324f2e22ee38cf643b22051a8cf6dca0

SHA512
b22f512921e47660f910dca6b3c265ae92b3a901a6ac90ab36601cf61b6bf4733faf0a04de6a8e1be25900234794fa61fa0956666b1886028d1279aa7d1805af

Download Submit
C:\Windows\System32\IBYXGbu.exe

Filesize
1.2MB

MD5
0be58375f7ec32c0db6adf9797e3d8ce

SHA1
a330f3944631d58dca2baa073b4488f20af162a5

SHA256
ea33d101241f6eef29306045aa6a7b8b7dab1e2dfbf493dd8f65e0564cf4d132

SHA512
21a7fec7090bc61c359ec7f1ad09dbf2539575edb1003fd18ba374cc32db6c0251275db076d2251ee1e925ab5118138a968bd4595bac77175e9d29d1481cc025

Download Submit
C:\Windows\System32\JgcbPDO.exe

Filesize
1.2MB

MD5
e0764e0dfc25385d0a4c213104764e02

SHA1
38b665bff2b1bb89524cbc8fcdee8e1cd4008a5a

SHA256
6d17d72e74e54efe4fead1fcd3ed7579476ffe8302f513af2c411b3da278afac

SHA512
f49e091b155cf638e0201db0190b5bdede2eebf774371c08f8997a9d1f31d0d8855efcae70273138b8fe57ef98fdfde82c33e7a10961728b45fda0aefc9f9afd

Download Submit
C:\Windows\System32\MLBXYMx.exe

Filesize
1.2MB

MD5
ce22948a2c70bd433f61e8453b9cd0de

SHA1
564c35754ad7c11b6cb01ea1783e2fed68236e2b

SHA256
22d726933477acf93b75fe56931e9b6652fc4ee1d0ebb1d0ec1bce30cea68324

SHA512
468c44b7892a4f9d4b4e6b5037d3a619447388a190b879f20a76e9123b9f69efa3b65df3a027b08f292a947585706f0ace47ebea3dd196b830c22068251a3f4a

Download Submit
C:\Windows\System32\OWmpXpO.exe

Filesize
1.2MB

MD5
b4f6e796110447ac5e429e2b821c706b

SHA1
d5810a347d6d422a5e62e9d49279dfe1787a3911

SHA256
4e24152a8d897373f6625a3d68080a794b7e0c7f3973cf5fd951b6aec29eeec7

SHA512
8a634443a9510674723a0cd6740cac7e81f9f6fc67a150f3d06d453cda6bb0cdaaaa928cf98aff245c9baba03afefa6d59718e06e4c5bbf355a7498cfca8a9a8

Download Submit
C:\Windows\System32\RREpWRO.exe

Filesize
1.2MB

MD5
f2e75582194c1fbf63b3164fd3fa5e50

SHA1
c91e95ca63973d98737dbfb3a820f3c3f461d408

SHA256
437fd5ccaa5e10132d52c020ff55be902ae9c850046b29dba85225eb223ecdf8

SHA512
7194a8f20485407e82505c5dc53f90daaa3634500c0b3cfbf3166663ad8e8642101a81e4542fbf362df23b85740b5ad46c1c37a2c14d7ff2b524cad5f94b794f

Download Submit
C:\Windows\System32\SEajYPT.exe

Filesize
1.2MB

MD5
457de860559607eae2a0a22e08c054e3

SHA1
ea707bb78a7bc862ca71b1cdbc4f56d46b065209

SHA256
66ace005125dee3517446d9a60089c15f8fcb4777d471b0c8c7f6a962c9c092e

SHA512
4a8b5ff3ac390fdb2fe8369420adca5c95b04ec1f4d71f8a3ffc3d4e931f420477400e3b051591832f16da9ef716698d533e298d61e69720de51f23994e85341

Download Submit
C:\Windows\System32\TWjivFI.exe

Filesize
1.2MB

MD5
1e804e92a1ff6495b9246b3907d6e143

SHA1
7138ede5828053c390a68d834b794fb80bc379b7

SHA256
533471c9fc96ef6f0a8eab850130e2c28cf14c9d1c57a4ba03e33de56afab85a

SHA512
de009d738368bb11e4ad1b5bde3f768bfcdade75f318631020448e534dc390ecaac7dc40048f68c28a36d3ab21f44141043971b43ca50be38f45dbc92ee74f01

Download Submit
C:\Windows\System32\TnynJdj.exe

Filesize
1.2MB

MD5
bc43d230f071dd82582ff9b777a5980a

SHA1
5a9125d7d2ba7d57af7cca5093052f44bad6444e

SHA256
d4eeddab752054a6137111feaadd1b77e6e4675e5c057dc3a0a1d28607db7f18

SHA512
80d52f551434477ca9499776b4aa9d7ce7f95ec0cf7d624502efc5a62f92de1913964d787ff67b511c2f534350b0a403b46118ca16c02479941adb2c8e3f949b

Download Submit
C:\Windows\System32\UCWvYlE.exe

Filesize
1.2MB

MD5
619c78b8b0a6b0f1d3c57dbfe766f65e

SHA1
d486a03f9dee090654219a28c465f24d659a80f2

SHA256
204a88e43a27a2b5d683ce06bad6f9b4038cab4da9ae15c819037ea9fa408d4d

SHA512
39dee55aa80b5f7c83baea3c206f41868d655bd2cbba60dcbd11d393a6eac73040d73c9994f6addc13ab4541645c4831b39c9c924d6f80d4d22ddda5e543010c

Download Submit
C:\Windows\System32\UWwegHL.exe

Filesize
1.2MB

MD5
6648e45ced6dc2b66b9bac1900aea4a6

SHA1
b3c76c74d13c8d18666b67eeb57e8949e56eda64

SHA256
1a69d6ccf9d5072fbb8017deec73399d74a5aa440f421abcffaae10bbd6970b4

SHA512
d52f6395d22dec5c81495eae20abb1ec10138b253e4cea541f82f68ca7b0f2e2080b0076ea381e3bafccf969510ad9b5d01fa07699c277dd5dc1104daf3075be

Download Submit
C:\Windows\System32\WrHgyKi.exe

Filesize
1.2MB

MD5
2fc0995e733854a3aaeffbaa4c054e20

SHA1
04e52550fb8ee941d71cb173a73b6bbe178d72d4

SHA256
8d069b008fd94e10dec84d822326690a7cc41fe26db8230b5292ac8d77fe07b9

SHA512
46a719447c2f7bdaa7dd215112d585517fc185dbd066f3becfb80e50d29a5c77c4ae7477e4bf2a19087dfceab5d255d5d9b7a5eb084f00a857fdd789d52617a7

Download Submit
C:\Windows\System32\YJJhgGj.exe

Filesize
1.2MB

MD5
986dcab543fa5798c2d6f4bc2ff55f26

SHA1
744b9b930ff4f86350caf3c7660b48a162c2345c

SHA256
b83b0874cf47344b6dd462105f34ea082699d2f2779b1423196cc49860749440

SHA512
02df6b91821d7ed70fdd8301b532418ff728485c9150c9f3e1fd4cfd25dfc68783d14bb4dee3fd1c8282e7a701e57ff91a58ed84c3855ef9ad1c8a5fc7a40a03

Download Submit
C:\Windows\System32\ZlIzhnj.exe

Filesize
1.2MB

MD5
af2325955b9adef70361bedf9db80181

SHA1
f2a480cf99333836d08b28a13a4ee1e0e4522e23

SHA256
59667e8e6d7a4c5933b0ce588a85fbe6a656519b88121d2c587baf4e14c87982

SHA512
e4f210bc159760ad0bb13ba4d6acb8adf8bbb5a38316af2796084f5075304d79a40bd7fa17c4080e6274d81fbddffe5c365ab1be6aa0c75db1fc12bd82593cb0

Download Submit
C:\Windows\System32\aksLIAq.exe

Filesize
1.2MB

MD5
52cc90244e925ac07b675f8c14f7bf0f

SHA1
e3f4ab59452831ace384fa76c4bdd0000abd1f16

SHA256
b161c93bb850e135a7fe33f758785c71d117b4a6c3e1ee472818e44d92f9416e

SHA512
23dca58a3a00e4fda229df23aed57f71118230052a1a3906cdabf8d27873babb72aacec351b9629ace186e5d17dfb4123693141381eee44c02b0f1883de92b7e

Download Submit
C:\Windows\System32\bXkCmJf.exe

Filesize
1.2MB

MD5
3e22e352d3c1dd6f29ef309d31c78662

SHA1
3941a6d1fb536b92a21e4118fef664d12a7b23e1

SHA256
fa52221bd614fbecb707eeaa742a45e2169eed7f55ac7ced26099dfb2ca5bfa5

SHA512
63a16daa42be540e15fd89a5fe4049e8c9cfd07869bc7364ee310f1b66bd5f5c9cb295de3c9ae9834ea53d32bf7a137411000340faa8c1b03db3ba9c9ae7aef4

Download Submit
C:\Windows\System32\cuChHnp.exe

Filesize
1.2MB

MD5
63e33f82ba4ae988d7cfc2cc024f0daf

SHA1
9afaf3de3de9a97b1ef240b1a8457ae83f96069d

SHA256
9c6d6ee9d90ca7872c52ea65ef3a19bb0beb100c0ba235c00694a82bac272771

SHA512
94aa1360a861be5f1eda684bc1ff559856d10819cd09f01843f42a0a633f4d839ec2e2babdf014d66d9deef91c3365202a11b80ac900578768836ea1d256235c

Download Submit
C:\Windows\System32\fFRcJql.exe

Filesize
1.2MB

MD5
b83ac308fe5f702c4d5871963f74593c

SHA1
50c43103f26bf7f8fcece2c86bf46ce362e40853

SHA256
6528f5fdc290581f742c69fd65f6de373b01162704cbe69003157e2d8951f329

SHA512
ac9d9a598440980247ab5d508e407aa7a335a5bc97e9ea81d1f4ddec9006023ce49b062cada6a9a7fead96842b2c30aaad1851161c94ca18938b343baba7fe2a

Download Submit
C:\Windows\System32\fqaalnj.exe

Filesize
1.2MB

MD5
588cf72c67251203d8c8ecff51abe445

SHA1
4b9a526f15fadd302753fca062751ad25e54f2d0

SHA256
7ef5577363e55307a302fb8cd0b939047a93ddde2f729e283157357fc242337a

SHA512
4f9efa7bd17d0952c0f2ce776d08a630f5ece87e2295f41c66c009a759d7aef8f29722563373e93dc02771aae52aab300301e4fec057d611f8c2422572f4fadc

Download Submit
C:\Windows\System32\gWZLNDJ.exe

Filesize
1.2MB

MD5
ec210744c62442c09a25bd57797f9e6a

SHA1
cf01cea61541a29676ad99a69b9857f36145a33e

SHA256
04a47e8fc8bc339aead0dd559dee61d52355497873a83b794e4fc2a666ace364

SHA512
17b59ab6021ef131f490a3f7949aaa0abdb28cb561f418b40ba1008fb39dc45a6fbdee7ce45069929e8cbf34870f7268ce077ef86c0d02efc081619152fa592a

Download Submit
C:\Windows\System32\iwHNogm.exe

Filesize
1.2MB

MD5
e1710dec2cf0afa0fcde72fad640edbb

SHA1
1e32b11b4c925853efad5f9416884a4d040cf400

SHA256
74e25d31655d06e855d9f693711ce7e6ac04b765b10cedafa4a6be28350b26cf

SHA512
ad2dffd7a59289a28ccb66da7490dbc693496f3cb6693b31cb2fac5d473d0be0eede83ed1a205b8fb6da7d1c5054dc67a3c6037fb0691ed08e87252205c437be

Download Submit
C:\Windows\System32\khsHsmz.exe

Filesize
1.2MB

MD5
e12cd23be2b8391b528de0868601af99

SHA1
005bb744e7b7fb8d135732f01619ef0cf1efde93

SHA256
ca7f73b5f30808dc8858128dc45dd4da1eacba18306d6a5716337509da62cef5

SHA512
8f91aeb38a6b85ec0b4aab0e84a44ffc47226d8a24fc83a4e7dcdf2c94008ac50144e0223f9162e382746001c2ed09458f354085fb3df982b90c0a5f6449096e

Download Submit
C:\Windows\System32\nsnZUMP.exe

Filesize
1.2MB

MD5
84752c74f02e525a1ee02e0620de8a86

SHA1
be12fafa50f20f0a1385365f8a4d9e8d8646b7cb

SHA256
ddf05fabb9d7258cd65f885266c705c4bb91e493ac8db1221fd8f28cb3949104

SHA512
73a6bd308a2321c18d975d5034d9da00a6297ee76c9c762dc0c000e75f8ab60a9325b5ccc533bfe255127e4d7dfcc606a62c4225051170cd5a71a1e0f0b1e779

Download Submit
C:\Windows\System32\ocTkhYj.exe

Filesize
1.2MB

MD5
1605f6c5f1d17f7b6e6e53621e3b2811

SHA1
5bcb5696181b2936df5f38a9e97f409238f01252

SHA256
027d8b2d81c1f5a924c99f0518a2d45bd027502676ee882ffdc646366d2d1bf7

SHA512
3c240ea8287adc3c52a117149536a103f199ccff998df74c1d1434b37ed847778e8e53d2581edf1db357385fd2541ad8597790f50086839a5c905e6cbf086712

Download Submit
C:\Windows\System32\pOQZoYP.exe

Filesize
1.2MB

MD5
cf4acd7e1154f84817a7e85303520b99

SHA1
6c3992850089722d7bb0cf0d05a1721365e5e014

SHA256
7fa116962070e847c141c44d7f583b5b754668d86aa94df3dbe77c84d33b6b48

SHA512
24bb2dffb8dc0bb43bddbd6cc6d62b4f72a3be65759e5effad1de517553334632b6d2ac256758524220f083062e0be64a0f5a207a985022e9dd18c70438de4a6

Download Submit
C:\Windows\System32\smdGbgP.exe

Filesize
1.2MB

MD5
24290b56b21809a691b123b1bfafd1c1

SHA1
e8ba39b24d3e57db529d14c39fed7ba0ba065197

SHA256
c454876db9a3213deb4ce55936a4130ffd430dac2d2f36c1f877aca5e3977c24

SHA512
4d585b8e9e701b116041dc18d115f5de9bdae4a87747aeb221496496c868552e34a2c37698bbdf6480ab587a7cc212b9b2a94d83b6cca914b6fd70a1d1f8ea0c

Download Submit
C:\Windows\System32\tdOJiLt.exe

Filesize
1.2MB

MD5
c05993bb45026cdb7b23a48236cd67d2

SHA1
9acf51d30b25ccfe881af04b56b469b5139ea93f

SHA256
de5df85759487581736536fa07517bcdef82007fb10d9c72fa59440b82aaf765

SHA512
2b6ced589d1fe7ad0f3045e0b38b2a5d296962b1875c50dd802979d1bc73a5f4b772b6ccb5ce53ea30fa23870e2e5c87379b8aa7c04bd1aa92a45efb41a8693a

Download Submit
memory/320-134-0x00007FF64F7A0000-0x00007FF64FB91000-memory.dmp

Filesize
3.9MB

Download
memory/320-2085-0x00007FF64F7A0000-0x00007FF64FB91000-memory.dmp

Filesize
3.9MB

Download
memory/320-0-0x00007FF64F7A0000-0x00007FF64FB91000-memory.dmp

Filesize
3.9MB

Download
memory/320-1-0x000002AA73BA0000-0x000002AA73BB0000-memory.dmp

Filesize
64KB

Download
memory/1048-2102-0x00007FF6B5970000-0x00007FF6B5D61000-memory.dmp

Filesize
3.9MB

Download
memory/1048-49-0x00007FF6B5970000-0x00007FF6B5D61000-memory.dmp

Filesize
3.9MB

Download
memory/1384-105-0x00007FF601040000-0x00007FF601431000-memory.dmp

Filesize
3.9MB

Download
memory/1384-2149-0x00007FF601040000-0x00007FF601431000-memory.dmp

Filesize
3.9MB

Download
memory/1652-2113-0x00007FF7E4F40000-0x00007FF7E5331000-memory.dmp

Filesize
3.9MB

Download
memory/1652-322-0x00007FF7E4F40000-0x00007FF7E5331000-memory.dmp

Filesize
3.9MB

Download
memory/1652-63-0x00007FF7E4F40000-0x00007FF7E5331000-memory.dmp

Filesize
3.9MB

Download
memory/1928-41-0x00007FF7F7D00000-0x00007FF7F80F1000-memory.dmp

Filesize
3.9MB

Download
memory/1928-157-0x00007FF7F7D00000-0x00007FF7F80F1000-memory.dmp

Filesize
3.9MB

Download
memory/1928-2107-0x00007FF7F7D00000-0x00007FF7F80F1000-memory.dmp

Filesize
3.9MB

Download
memory/1936-2160-0x00007FF7C89F0000-0x00007FF7C8DE1000-memory.dmp

Filesize
3.9MB

Download
memory/1936-149-0x00007FF7C89F0000-0x00007FF7C8DE1000-memory.dmp

Filesize
3.9MB

Download
memory/2092-2095-0x00007FF7EC860000-0x00007FF7ECC51000-memory.dmp

Filesize
3.9MB

Download
memory/2092-137-0x00007FF7EC860000-0x00007FF7ECC51000-memory.dmp

Filesize
3.9MB

Download
memory/2092-16-0x00007FF7EC860000-0x00007FF7ECC51000-memory.dmp

Filesize
3.9MB

Download
memory/2272-2156-0x00007FF65C630000-0x00007FF65CA21000-memory.dmp

Filesize
3.9MB

Download
memory/2272-131-0x00007FF65C630000-0x00007FF65CA21000-memory.dmp

Filesize
3.9MB

Download
memory/2388-2083-0x00007FF769F80000-0x00007FF76A371000-memory.dmp

Filesize
3.9MB

Download
memory/2388-156-0x00007FF769F80000-0x00007FF76A371000-memory.dmp

Filesize
3.9MB

Download
memory/2388-2168-0x00007FF769F80000-0x00007FF76A371000-memory.dmp

Filesize
3.9MB

Download
memory/2588-67-0x00007FF792890000-0x00007FF792C81000-memory.dmp

Filesize
3.9MB

Download
memory/2588-2111-0x00007FF792890000-0x00007FF792C81000-memory.dmp

Filesize
3.9MB

Download
memory/2856-2050-0x00007FF7C13F0000-0x00007FF7C17E1000-memory.dmp

Filesize
3.9MB

Download
memory/2856-116-0x00007FF7C13F0000-0x00007FF7C17E1000-memory.dmp

Filesize
3.9MB

Download
memory/2856-2152-0x00007FF7C13F0000-0x00007FF7C17E1000-memory.dmp

Filesize
3.9MB

Download
memory/3064-100-0x00007FF7851D0000-0x00007FF7855C1000-memory.dmp

Filesize
3.9MB

Download
memory/3064-2142-0x00007FF7851D0000-0x00007FF7855C1000-memory.dmp

Filesize
3.9MB

Download
memory/3484-104-0x00007FF790140000-0x00007FF790531000-memory.dmp

Filesize
3.9MB

Download
memory/3484-2150-0x00007FF790140000-0x00007FF790531000-memory.dmp

Filesize
3.9MB

Download
memory/3648-2146-0x00007FF60FCD0000-0x00007FF6100C1000-memory.dmp

Filesize
3.9MB

Download
memory/3648-108-0x00007FF60FCD0000-0x00007FF6100C1000-memory.dmp

Filesize
3.9MB

Download
memory/3804-2158-0x00007FF6DE9D0000-0x00007FF6DEDC1000-memory.dmp

Filesize
3.9MB

Download
memory/3804-160-0x00007FF6DE9D0000-0x00007FF6DEDC1000-memory.dmp

Filesize
3.9MB

Download
memory/3808-128-0x00007FF6CACD0000-0x00007FF6CB0C1000-memory.dmp

Filesize
3.9MB

Download
memory/3808-2154-0x00007FF6CACD0000-0x00007FF6CB0C1000-memory.dmp

Filesize
3.9MB

Download
memory/3936-2117-0x00007FF774320000-0x00007FF774711000-memory.dmp

Filesize
3.9MB

Download
memory/3936-1383-0x00007FF774320000-0x00007FF774711000-memory.dmp

Filesize
3.9MB

Download
memory/3936-73-0x00007FF774320000-0x00007FF774711000-memory.dmp

Filesize
3.9MB

Download
memory/4064-2105-0x00007FF6D9D90000-0x00007FF6DA181000-memory.dmp

Filesize
3.9MB

Download
memory/4064-55-0x00007FF6D9D90000-0x00007FF6DA181000-memory.dmp

Filesize
3.9MB

Download
memory/4068-2145-0x00007FF624F40000-0x00007FF625331000-memory.dmp

Filesize
3.9MB

Download
memory/4068-113-0x00007FF624F40000-0x00007FF625331000-memory.dmp

Filesize
3.9MB

Download
memory/4068-2039-0x00007FF624F40000-0x00007FF625331000-memory.dmp

Filesize
3.9MB

Download
memory/4100-2140-0x00007FF62EE40000-0x00007FF62F231000-memory.dmp

Filesize
3.9MB

Download
memory/4100-81-0x00007FF62EE40000-0x00007FF62F231000-memory.dmp

Filesize
3.9MB

Download
memory/4100-1388-0x00007FF62EE40000-0x00007FF62F231000-memory.dmp

Filesize
3.9MB

Download
memory/4428-37-0x00007FF6BB330000-0x00007FF6BB721000-memory.dmp

Filesize
3.9MB

Download
memory/4428-2099-0x00007FF6BB330000-0x00007FF6BB721000-memory.dmp

Filesize
3.9MB

Download
memory/4520-139-0x00007FF788660000-0x00007FF788A51000-memory.dmp

Filesize
3.9MB

Download
memory/4520-2103-0x00007FF788660000-0x00007FF788A51000-memory.dmp

Filesize
3.9MB

Download
memory/4520-29-0x00007FF788660000-0x00007FF788A51000-memory.dmp

Filesize
3.9MB

Download
memory/4680-2109-0x00007FF7F0240000-0x00007FF7F0631000-memory.dmp

Filesize
3.9MB

Download
memory/4680-68-0x00007FF7F0240000-0x00007FF7F0631000-memory.dmp

Filesize
3.9MB

Download
memory/4824-45-0x00007FF7F0000000-0x00007FF7F03F1000-memory.dmp

Filesize
3.9MB

Download
memory/4824-2097-0x00007FF7F0000000-0x00007FF7F03F1000-memory.dmp

Filesize
3.9MB

Download
memory/5108-1375-0x00007FF7C2140000-0x00007FF7C2531000-memory.dmp

Filesize
3.9MB

Download
memory/5108-70-0x00007FF7C2140000-0x00007FF7C2531000-memory.dmp

Filesize
3.9MB

Download
memory/5108-2116-0x00007FF7C2140000-0x00007FF7C2531000-memory.dmp

Filesize
3.9MB

Download