xmrig | e45228b7c3e4f819ff39795d62e957a3990cb3527a05964ca2b8aba9f0a0d5af

Analysis

max time kernel
92s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01-05-2024 19:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
Size

1.1MB
MD5

0cac4566639204c0faf557653254be1f
SHA1

a3d7f521e75735ceda2beea1396c0a931afe45a9
SHA256

e45228b7c3e4f819ff39795d62e957a3990cb3527a05964ca2b8aba9f0a0d5af
SHA512

08c7985c95619a05f1b200fa0931355cb02bf65ab6f7cdb60a738d7b384befce78da88d8344b150132a54c8c7d0aaeee3cef17ff150d5b0d48faef3c603702a5
SSDEEP

24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zjP+sjI1u:knw9oUUEEDl37jcq4nPt

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 50 IoCs

miner

resource	yara_rule
behavioral2/memory/2472-47-0x00007FF685530000-0x00007FF685921000-memory.dmp	xmrig
behavioral2/memory/1676-322-0x00007FF6569C0000-0x00007FF656DB1000-memory.dmp	xmrig
behavioral2/memory/4644-330-0x00007FF67A520000-0x00007FF67A911000-memory.dmp	xmrig
behavioral2/memory/1744-336-0x00007FF66B910000-0x00007FF66BD01000-memory.dmp	xmrig
behavioral2/memory/1664-339-0x00007FF67E450000-0x00007FF67E841000-memory.dmp	xmrig
behavioral2/memory/1868-347-0x00007FF730E40000-0x00007FF731231000-memory.dmp	xmrig
behavioral2/memory/3976-342-0x00007FF6580C0000-0x00007FF6584B1000-memory.dmp	xmrig
behavioral2/memory/1340-354-0x00007FF6E6260000-0x00007FF6E6651000-memory.dmp	xmrig
behavioral2/memory/4944-368-0x00007FF714470000-0x00007FF714861000-memory.dmp	xmrig
behavioral2/memory/1888-367-0x00007FF734920000-0x00007FF734D11000-memory.dmp	xmrig
behavioral2/memory/2280-377-0x00007FF6619C0000-0x00007FF661DB1000-memory.dmp	xmrig
behavioral2/memory/3604-376-0x00007FF746EA0000-0x00007FF747291000-memory.dmp	xmrig
behavioral2/memory/3396-373-0x00007FF7E7940000-0x00007FF7E7D31000-memory.dmp	xmrig
behavioral2/memory/4028-369-0x00007FF654B00000-0x00007FF654EF1000-memory.dmp	xmrig
behavioral2/memory/3128-360-0x00007FF75AB30000-0x00007FF75AF21000-memory.dmp	xmrig
behavioral2/memory/2076-59-0x00007FF6B0900000-0x00007FF6B0CF1000-memory.dmp	xmrig
behavioral2/memory/4164-52-0x00007FF7B2480000-0x00007FF7B2871000-memory.dmp	xmrig
behavioral2/memory/3052-49-0x00007FF778DB0000-0x00007FF7791A1000-memory.dmp	xmrig
behavioral2/memory/4356-48-0x00007FF6F66B0000-0x00007FF6F6AA1000-memory.dmp	xmrig
behavioral2/memory/3844-46-0x00007FF76D5E0000-0x00007FF76D9D1000-memory.dmp	xmrig
behavioral2/memory/4016-29-0x00007FF7D9C10000-0x00007FF7DA001000-memory.dmp	xmrig
behavioral2/memory/3472-11-0x00007FF7A8E80000-0x00007FF7A9271000-memory.dmp	xmrig
behavioral2/memory/2888-1966-0x00007FF6A1580000-0x00007FF6A1971000-memory.dmp	xmrig
behavioral2/memory/4016-1967-0x00007FF7D9C10000-0x00007FF7DA001000-memory.dmp	xmrig
behavioral2/memory/4144-1994-0x00007FF6D8A30000-0x00007FF6D8E21000-memory.dmp	xmrig
behavioral2/memory/3184-1996-0x00007FF7EF7A0000-0x00007FF7EFB91000-memory.dmp	xmrig
behavioral2/memory/3472-2028-0x00007FF7A8E80000-0x00007FF7A9271000-memory.dmp	xmrig
behavioral2/memory/2888-2030-0x00007FF6A1580000-0x00007FF6A1971000-memory.dmp	xmrig
behavioral2/memory/4016-2032-0x00007FF7D9C10000-0x00007FF7DA001000-memory.dmp	xmrig
behavioral2/memory/3844-2036-0x00007FF76D5E0000-0x00007FF76D9D1000-memory.dmp	xmrig
behavioral2/memory/4164-2035-0x00007FF7B2480000-0x00007FF7B2871000-memory.dmp	xmrig
behavioral2/memory/2472-2038-0x00007FF685530000-0x00007FF685921000-memory.dmp	xmrig
behavioral2/memory/3052-2040-0x00007FF778DB0000-0x00007FF7791A1000-memory.dmp	xmrig
behavioral2/memory/4356-2042-0x00007FF6F66B0000-0x00007FF6F6AA1000-memory.dmp	xmrig
behavioral2/memory/2076-2044-0x00007FF6B0900000-0x00007FF6B0CF1000-memory.dmp	xmrig
behavioral2/memory/4144-2046-0x00007FF6D8A30000-0x00007FF6D8E21000-memory.dmp	xmrig
behavioral2/memory/1676-2048-0x00007FF6569C0000-0x00007FF656DB1000-memory.dmp	xmrig
behavioral2/memory/1664-2051-0x00007FF67E450000-0x00007FF67E841000-memory.dmp	xmrig
behavioral2/memory/1744-2056-0x00007FF66B910000-0x00007FF66BD01000-memory.dmp	xmrig
behavioral2/memory/1340-2060-0x00007FF6E6260000-0x00007FF6E6651000-memory.dmp	xmrig
behavioral2/memory/1888-2064-0x00007FF734920000-0x00007FF734D11000-memory.dmp	xmrig
behavioral2/memory/4944-2066-0x00007FF714470000-0x00007FF714861000-memory.dmp	xmrig
behavioral2/memory/3128-2062-0x00007FF75AB30000-0x00007FF75AF21000-memory.dmp	xmrig
behavioral2/memory/1868-2059-0x00007FF730E40000-0x00007FF731231000-memory.dmp	xmrig
behavioral2/memory/3976-2054-0x00007FF6580C0000-0x00007FF6584B1000-memory.dmp	xmrig
behavioral2/memory/4644-2052-0x00007FF67A520000-0x00007FF67A911000-memory.dmp	xmrig
behavioral2/memory/2280-2081-0x00007FF6619C0000-0x00007FF661DB1000-memory.dmp	xmrig
behavioral2/memory/4028-2079-0x00007FF654B00000-0x00007FF654EF1000-memory.dmp	xmrig
behavioral2/memory/3396-2077-0x00007FF7E7940000-0x00007FF7E7D31000-memory.dmp	xmrig
behavioral2/memory/3604-2074-0x00007FF746EA0000-0x00007FF747291000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3472	wBJzorf.exe
2888	poXdRVp.exe
4016	iFVFmvR.exe
4164	UWeHNSK.exe
3844	zFEaxre.exe
2472	jvnxkhi.exe
4356	uNrJQGk.exe
3052	qZyjeRU.exe
2076	OsEFEyX.exe
4144	cWQvZBW.exe
1676	tPmOnJq.exe
4644	lPNytuB.exe
1744	OSkqkhn.exe
1664	sMJSaMm.exe
3976	RjzXZpw.exe
1868	IHolNiU.exe
1340	aPmnqGq.exe
3128	rdRJsni.exe
1888	hBCLydu.exe
4944	ngzugef.exe
4028	sTTyvQc.exe
3396	srnoWdY.exe
3604	UeuDtFC.exe
2280	WfDdipB.exe
2200	EyAIesk.exe
1000	FacuqLD.exe
5108	FbBNLCh.exe
1592	JAxfJMC.exe
2344	pQTIeQU.exe
3412	GIJagUN.exe
2880	gxFtpJZ.exe
2112	aYDURcO.exe
3096	rTqsUkX.exe
2172	omtUWoD.exe
1804	CUkMOFO.exe
4992	ocNzYkz.exe
1912	AZcJuPF.exe
1452	WEovjUC.exe
3616	xlXbMsG.exe
572	jrPjsif.exe
1848	hovRNUb.exe
2180	nRqMnnJ.exe
2360	WhwoMnf.exe
4744	yeOYupN.exe
2004	vcsHROJ.exe
3660	ftjVVJr.exe
2008	OTwKsLQ.exe
3904	IRZRqYQ.exe
4320	wkxyskR.exe
4004	MpqiaGl.exe
4688	kXViYgs.exe
3840	PbStGFw.exe
532	OJwAAzs.exe
4500	yPGkvZL.exe
1584	DvQCnHv.exe
4308	hqPIeGQ.exe
488	cRILXkx.exe
4984	FsgqMxd.exe
5088	HnQNEsN.exe
3228	vrbwSKw.exe
4588	rUDvEpy.exe
1180	sbulatR.exe
904	vkYJecR.exe
4912	HNKDSre.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3184-0-0x00007FF7EF7A0000-0x00007FF7EFB91000-memory.dmp	upx
behavioral2/files/0x000800000002343c-4.dat	upx
behavioral2/files/0x0007000000023443-7.dat	upx
behavioral2/files/0x000800000002343f-16.dat	upx
behavioral2/files/0x0007000000023445-25.dat	upx
behavioral2/files/0x0007000000023444-32.dat	upx
behavioral2/files/0x0007000000023447-39.dat	upx
behavioral2/files/0x0007000000023448-42.dat	upx
behavioral2/memory/2472-47-0x00007FF685530000-0x00007FF685921000-memory.dmp	upx
behavioral2/files/0x0007000000023449-54.dat	upx
behavioral2/files/0x000700000002344a-61.dat	upx
behavioral2/files/0x000700000002344f-86.dat	upx
behavioral2/files/0x0007000000023451-96.dat	upx
behavioral2/files/0x0007000000023453-106.dat	upx
behavioral2/files/0x0007000000023457-126.dat	upx
behavioral2/files/0x0007000000023459-136.dat	upx
behavioral2/files/0x000700000002345e-161.dat	upx
behavioral2/memory/1676-322-0x00007FF6569C0000-0x00007FF656DB1000-memory.dmp	upx
behavioral2/memory/4644-330-0x00007FF67A520000-0x00007FF67A911000-memory.dmp	upx
behavioral2/memory/1744-336-0x00007FF66B910000-0x00007FF66BD01000-memory.dmp	upx
behavioral2/memory/1664-339-0x00007FF67E450000-0x00007FF67E841000-memory.dmp	upx
behavioral2/memory/1868-347-0x00007FF730E40000-0x00007FF731231000-memory.dmp	upx
behavioral2/memory/3976-342-0x00007FF6580C0000-0x00007FF6584B1000-memory.dmp	upx
behavioral2/memory/1340-354-0x00007FF6E6260000-0x00007FF6E6651000-memory.dmp	upx
behavioral2/memory/4944-368-0x00007FF714470000-0x00007FF714861000-memory.dmp	upx
behavioral2/memory/1888-367-0x00007FF734920000-0x00007FF734D11000-memory.dmp	upx
behavioral2/memory/2280-377-0x00007FF6619C0000-0x00007FF661DB1000-memory.dmp	upx
behavioral2/memory/3604-376-0x00007FF746EA0000-0x00007FF747291000-memory.dmp	upx
behavioral2/memory/3396-373-0x00007FF7E7940000-0x00007FF7E7D31000-memory.dmp	upx
behavioral2/memory/4028-369-0x00007FF654B00000-0x00007FF654EF1000-memory.dmp	upx
behavioral2/memory/3128-360-0x00007FF75AB30000-0x00007FF75AF21000-memory.dmp	upx
behavioral2/files/0x0007000000023460-171.dat	upx
behavioral2/files/0x000700000002345f-166.dat	upx
behavioral2/files/0x000700000002345d-156.dat	upx
behavioral2/files/0x000700000002345c-151.dat	upx
behavioral2/files/0x000700000002345b-146.dat	upx
behavioral2/files/0x000700000002345a-141.dat	upx
behavioral2/files/0x0007000000023458-131.dat	upx
behavioral2/files/0x0007000000023456-121.dat	upx
behavioral2/files/0x0007000000023455-116.dat	upx
behavioral2/files/0x0007000000023454-111.dat	upx
behavioral2/files/0x0007000000023452-101.dat	upx
behavioral2/files/0x0007000000023450-91.dat	upx
behavioral2/files/0x000700000002344e-81.dat	upx
behavioral2/files/0x000700000002344d-76.dat	upx
behavioral2/files/0x000700000002344c-71.dat	upx
behavioral2/files/0x000700000002344b-66.dat	upx
behavioral2/memory/4144-60-0x00007FF6D8A30000-0x00007FF6D8E21000-memory.dmp	upx
behavioral2/memory/2076-59-0x00007FF6B0900000-0x00007FF6B0CF1000-memory.dmp	upx
behavioral2/memory/4164-52-0x00007FF7B2480000-0x00007FF7B2871000-memory.dmp	upx
behavioral2/memory/3052-49-0x00007FF778DB0000-0x00007FF7791A1000-memory.dmp	upx
behavioral2/memory/4356-48-0x00007FF6F66B0000-0x00007FF6F6AA1000-memory.dmp	upx
behavioral2/memory/3844-46-0x00007FF76D5E0000-0x00007FF76D9D1000-memory.dmp	upx
behavioral2/files/0x0007000000023446-34.dat	upx
behavioral2/memory/4016-29-0x00007FF7D9C10000-0x00007FF7DA001000-memory.dmp	upx
behavioral2/memory/2888-12-0x00007FF6A1580000-0x00007FF6A1971000-memory.dmp	upx
behavioral2/memory/3472-11-0x00007FF7A8E80000-0x00007FF7A9271000-memory.dmp	upx
behavioral2/memory/2888-1966-0x00007FF6A1580000-0x00007FF6A1971000-memory.dmp	upx
behavioral2/memory/4016-1967-0x00007FF7D9C10000-0x00007FF7DA001000-memory.dmp	upx
behavioral2/memory/4144-1994-0x00007FF6D8A30000-0x00007FF6D8E21000-memory.dmp	upx
behavioral2/memory/3184-1996-0x00007FF7EF7A0000-0x00007FF7EFB91000-memory.dmp	upx
behavioral2/memory/3472-2028-0x00007FF7A8E80000-0x00007FF7A9271000-memory.dmp	upx
behavioral2/memory/2888-2030-0x00007FF6A1580000-0x00007FF6A1971000-memory.dmp	upx
behavioral2/memory/4016-2032-0x00007FF7D9C10000-0x00007FF7DA001000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\OWnBfRb.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\OPDXJhP.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\ZASIWcO.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\EyAIesk.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\TZhpBAP.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\oUgmcdv.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\jiofgck.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\KlMUnNL.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\jvnxkhi.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\WSLjRDr.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\cSdEFQL.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\IJEAvaf.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\sGjfZVM.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\QLNQRcO.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\KAfOork.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\riBsYPe.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\PQFydhc.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\zlelMmE.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\vhOpWtJ.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\tqYDQzZ.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\BJJZezo.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\xoFKfQn.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\DTuaKYv.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\ixLAhlC.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\VApKXeu.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\ouSfxTX.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\muLRgSc.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\uKDhrOx.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\KPSWXTz.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\SgKNPGi.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\tNAvPyR.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\XROGhTP.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\RpGlCvU.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\kTjUYfW.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\esxoyEZ.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\lwpBjWD.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\GMCwhFA.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\acXgTlZ.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\KLpziBU.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\DEnVFIc.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\gBdpIhD.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\vOBYTCc.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\BvPAwKg.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\AIkqTzT.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\VwCIpwX.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\dLmicca.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\sbuKGSb.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\KwayiAQ.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\gknYJGU.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\KXxVWkS.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\NuImGry.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\hIlvibH.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\NzCgRsi.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\cILttcZ.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\ufkDeTm.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\XaOmgAE.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\QFnUayi.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\MTbyRpV.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\yUaitHc.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\OTbOEPt.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\oEZJngA.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\lKLkpoC.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\RIzDuVL.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
File created	C:\Windows\System32\tAzuBUy.exe	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 3472	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	84
PID 3184 wrote to memory of 3472	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	84
PID 3184 wrote to memory of 2888	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	85
PID 3184 wrote to memory of 2888	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	85
PID 3184 wrote to memory of 4016	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	86
PID 3184 wrote to memory of 4016	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	86
PID 3184 wrote to memory of 3844	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	87
PID 3184 wrote to memory of 3844	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	87
PID 3184 wrote to memory of 4164	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	88
PID 3184 wrote to memory of 4164	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	88
PID 3184 wrote to memory of 2472	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	89
PID 3184 wrote to memory of 2472	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	89
PID 3184 wrote to memory of 4356	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	90
PID 3184 wrote to memory of 4356	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	90
PID 3184 wrote to memory of 3052	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	91
PID 3184 wrote to memory of 3052	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	91
PID 3184 wrote to memory of 2076	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	92
PID 3184 wrote to memory of 2076	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	92
PID 3184 wrote to memory of 4144	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	94
PID 3184 wrote to memory of 4144	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	94
PID 3184 wrote to memory of 1676	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	95
PID 3184 wrote to memory of 1676	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	95
PID 3184 wrote to memory of 4644	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	96
PID 3184 wrote to memory of 4644	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	96
PID 3184 wrote to memory of 1744	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	97
PID 3184 wrote to memory of 1744	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	97
PID 3184 wrote to memory of 1664	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	98
PID 3184 wrote to memory of 1664	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	98
PID 3184 wrote to memory of 3976	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	99
PID 3184 wrote to memory of 3976	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	99
PID 3184 wrote to memory of 1868	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	100
PID 3184 wrote to memory of 1868	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	100
PID 3184 wrote to memory of 1340	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	101
PID 3184 wrote to memory of 1340	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	101
PID 3184 wrote to memory of 3128	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	102
PID 3184 wrote to memory of 3128	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	102
PID 3184 wrote to memory of 1888	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	103
PID 3184 wrote to memory of 1888	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	103
PID 3184 wrote to memory of 4944	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	104
PID 3184 wrote to memory of 4944	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	104
PID 3184 wrote to memory of 4028	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	105
PID 3184 wrote to memory of 4028	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	105
PID 3184 wrote to memory of 3396	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	106
PID 3184 wrote to memory of 3396	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	106
PID 3184 wrote to memory of 3604	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	107
PID 3184 wrote to memory of 3604	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	107
PID 3184 wrote to memory of 2280	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	108
PID 3184 wrote to memory of 2280	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	108
PID 3184 wrote to memory of 2200	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	109
PID 3184 wrote to memory of 2200	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	109
PID 3184 wrote to memory of 1000	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	110
PID 3184 wrote to memory of 1000	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	110
PID 3184 wrote to memory of 5108	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	111
PID 3184 wrote to memory of 5108	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	111
PID 3184 wrote to memory of 1592	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	112
PID 3184 wrote to memory of 1592	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	112
PID 3184 wrote to memory of 2344	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	113
PID 3184 wrote to memory of 2344	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	113
PID 3184 wrote to memory of 3412	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	114
PID 3184 wrote to memory of 3412	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	114
PID 3184 wrote to memory of 2880	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	115
PID 3184 wrote to memory of 2880	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	115
PID 3184 wrote to memory of 2112	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	116
PID 3184 wrote to memory of 2112	3184	0cac4566639204c0faf557653254be1f_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\0cac4566639204c0faf557653254be1f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0cac4566639204c0faf557653254be1f_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Windows\System32\wBJzorf.exe
  C:\Windows\System32\wBJzorf.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System32\poXdRVp.exe
  C:\Windows\System32\poXdRVp.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System32\iFVFmvR.exe
  C:\Windows\System32\iFVFmvR.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System32\zFEaxre.exe
  C:\Windows\System32\zFEaxre.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System32\UWeHNSK.exe
  C:\Windows\System32\UWeHNSK.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System32\jvnxkhi.exe
  C:\Windows\System32\jvnxkhi.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System32\uNrJQGk.exe
  C:\Windows\System32\uNrJQGk.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System32\qZyjeRU.exe
  C:\Windows\System32\qZyjeRU.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System32\OsEFEyX.exe
  C:\Windows\System32\OsEFEyX.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System32\cWQvZBW.exe
  C:\Windows\System32\cWQvZBW.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System32\tPmOnJq.exe
  C:\Windows\System32\tPmOnJq.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System32\lPNytuB.exe
  C:\Windows\System32\lPNytuB.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System32\OSkqkhn.exe
  C:\Windows\System32\OSkqkhn.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System32\sMJSaMm.exe
  C:\Windows\System32\sMJSaMm.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System32\RjzXZpw.exe
  C:\Windows\System32\RjzXZpw.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System32\IHolNiU.exe
  C:\Windows\System32\IHolNiU.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System32\aPmnqGq.exe
  C:\Windows\System32\aPmnqGq.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System32\rdRJsni.exe
  C:\Windows\System32\rdRJsni.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System32\hBCLydu.exe
  C:\Windows\System32\hBCLydu.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System32\ngzugef.exe
  C:\Windows\System32\ngzugef.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System32\sTTyvQc.exe
  C:\Windows\System32\sTTyvQc.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System32\srnoWdY.exe
  C:\Windows\System32\srnoWdY.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System32\UeuDtFC.exe
  C:\Windows\System32\UeuDtFC.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System32\WfDdipB.exe
  C:\Windows\System32\WfDdipB.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System32\EyAIesk.exe
  C:\Windows\System32\EyAIesk.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System32\FacuqLD.exe
  C:\Windows\System32\FacuqLD.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System32\FbBNLCh.exe
  C:\Windows\System32\FbBNLCh.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System32\JAxfJMC.exe
  C:\Windows\System32\JAxfJMC.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System32\pQTIeQU.exe
  C:\Windows\System32\pQTIeQU.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System32\GIJagUN.exe
  C:\Windows\System32\GIJagUN.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System32\gxFtpJZ.exe
  C:\Windows\System32\gxFtpJZ.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System32\aYDURcO.exe
  C:\Windows\System32\aYDURcO.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System32\rTqsUkX.exe
  C:\Windows\System32\rTqsUkX.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System32\omtUWoD.exe
  C:\Windows\System32\omtUWoD.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System32\CUkMOFO.exe
  C:\Windows\System32\CUkMOFO.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System32\ocNzYkz.exe
  C:\Windows\System32\ocNzYkz.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System32\AZcJuPF.exe
  C:\Windows\System32\AZcJuPF.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System32\WEovjUC.exe
  C:\Windows\System32\WEovjUC.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System32\xlXbMsG.exe
  C:\Windows\System32\xlXbMsG.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System32\jrPjsif.exe
  C:\Windows\System32\jrPjsif.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System32\hovRNUb.exe
  C:\Windows\System32\hovRNUb.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System32\nRqMnnJ.exe
  C:\Windows\System32\nRqMnnJ.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System32\WhwoMnf.exe
  C:\Windows\System32\WhwoMnf.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System32\yeOYupN.exe
  C:\Windows\System32\yeOYupN.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System32\vcsHROJ.exe
  C:\Windows\System32\vcsHROJ.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System32\ftjVVJr.exe
  C:\Windows\System32\ftjVVJr.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System32\OTwKsLQ.exe
  C:\Windows\System32\OTwKsLQ.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System32\IRZRqYQ.exe
  C:\Windows\System32\IRZRqYQ.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System32\wkxyskR.exe
  C:\Windows\System32\wkxyskR.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System32\MpqiaGl.exe
  C:\Windows\System32\MpqiaGl.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System32\kXViYgs.exe
  C:\Windows\System32\kXViYgs.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System32\PbStGFw.exe
  C:\Windows\System32\PbStGFw.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System32\OJwAAzs.exe
  C:\Windows\System32\OJwAAzs.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System32\yPGkvZL.exe
  C:\Windows\System32\yPGkvZL.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System32\DvQCnHv.exe
  C:\Windows\System32\DvQCnHv.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System32\hqPIeGQ.exe
  C:\Windows\System32\hqPIeGQ.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System32\cRILXkx.exe
  C:\Windows\System32\cRILXkx.exe
  2⤵
  - Executes dropped EXE
  PID:488
- C:\Windows\System32\FsgqMxd.exe
  C:\Windows\System32\FsgqMxd.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System32\HnQNEsN.exe
  C:\Windows\System32\HnQNEsN.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System32\vrbwSKw.exe
  C:\Windows\System32\vrbwSKw.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System32\rUDvEpy.exe
  C:\Windows\System32\rUDvEpy.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System32\sbulatR.exe
  C:\Windows\System32\sbulatR.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System32\vkYJecR.exe
  C:\Windows\System32\vkYJecR.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System32\HNKDSre.exe
  C:\Windows\System32\HNKDSre.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System32\lQlbIlW.exe
  C:\Windows\System32\lQlbIlW.exe
  2⤵
  PID:2604
- C:\Windows\System32\wACMTEL.exe
  C:\Windows\System32\wACMTEL.exe
  2⤵
  PID:1908
- C:\Windows\System32\CzChdIp.exe
  C:\Windows\System32\CzChdIp.exe
  2⤵
  PID:2960
- C:\Windows\System32\vTbQUQo.exe
  C:\Windows\System32\vTbQUQo.exe
  2⤵
  PID:3264
- C:\Windows\System32\QLNQRcO.exe
  C:\Windows\System32\QLNQRcO.exe
  2⤵
  PID:1872
- C:\Windows\System32\MkuWDae.exe
  C:\Windows\System32\MkuWDae.exe
  2⤵
  PID:3084
- C:\Windows\System32\CMvlwFW.exe
  C:\Windows\System32\CMvlwFW.exe
  2⤵
  PID:5012
- C:\Windows\System32\zHFDBuK.exe
  C:\Windows\System32\zHFDBuK.exe
  2⤵
  PID:3156
- C:\Windows\System32\fUwPzLD.exe
  C:\Windows\System32\fUwPzLD.exe
  2⤵
  PID:4928
- C:\Windows\System32\GRZQlGP.exe
  C:\Windows\System32\GRZQlGP.exe
  2⤵
  PID:2752
- C:\Windows\System32\nXEqgOx.exe
  C:\Windows\System32\nXEqgOx.exe
  2⤵
  PID:2720
- C:\Windows\System32\AADarzI.exe
  C:\Windows\System32\AADarzI.exe
  2⤵
  PID:244
- C:\Windows\System32\cGgGZox.exe
  C:\Windows\System32\cGgGZox.exe
  2⤵
  PID:3232
- C:\Windows\System32\wKPpSYk.exe
  C:\Windows\System32\wKPpSYk.exe
  2⤵
  PID:3520
- C:\Windows\System32\XATfeam.exe
  C:\Windows\System32\XATfeam.exe
  2⤵
  PID:796
- C:\Windows\System32\GPfrocq.exe
  C:\Windows\System32\GPfrocq.exe
  2⤵
  PID:1692
- C:\Windows\System32\mqnNBVt.exe
  C:\Windows\System32\mqnNBVt.exe
  2⤵
  PID:3452
- C:\Windows\System32\VHRSTMT.exe
  C:\Windows\System32\VHRSTMT.exe
  2⤵
  PID:4368
- C:\Windows\System32\JbGEoOr.exe
  C:\Windows\System32\JbGEoOr.exe
  2⤵
  PID:3556
- C:\Windows\System32\McJnbaH.exe
  C:\Windows\System32\McJnbaH.exe
  2⤵
  PID:1392
- C:\Windows\System32\SgKNPGi.exe
  C:\Windows\System32\SgKNPGi.exe
  2⤵
  PID:4492
- C:\Windows\System32\JZgnLjR.exe
  C:\Windows\System32\JZgnLjR.exe
  2⤵
  PID:2452
- C:\Windows\System32\lSJvEOp.exe
  C:\Windows\System32\lSJvEOp.exe
  2⤵
  PID:4816
- C:\Windows\System32\CJzEObZ.exe
  C:\Windows\System32\CJzEObZ.exe
  2⤵
  PID:3668
- C:\Windows\System32\iDLhMsu.exe
  C:\Windows\System32\iDLhMsu.exe
  2⤵
  PID:2392
- C:\Windows\System32\KAfOork.exe
  C:\Windows\System32\KAfOork.exe
  2⤵
  PID:4696
- C:\Windows\System32\fJckhpY.exe
  C:\Windows\System32\fJckhpY.exe
  2⤵
  PID:4724
- C:\Windows\System32\tanPWwr.exe
  C:\Windows\System32\tanPWwr.exe
  2⤵
  PID:4676
- C:\Windows\System32\RefWABM.exe
  C:\Windows\System32\RefWABM.exe
  2⤵
  PID:3044
- C:\Windows\System32\rUmwoNQ.exe
  C:\Windows\System32\rUmwoNQ.exe
  2⤵
  PID:2380
- C:\Windows\System32\ezrPEPg.exe
  C:\Windows\System32\ezrPEPg.exe
  2⤵
  PID:496
- C:\Windows\System32\Zgpbzub.exe
  C:\Windows\System32\Zgpbzub.exe
  2⤵
  PID:4892
- C:\Windows\System32\hVguSqM.exe
  C:\Windows\System32\hVguSqM.exe
  2⤵
  PID:4484
- C:\Windows\System32\mTrKMVF.exe
  C:\Windows\System32\mTrKMVF.exe
  2⤵
  PID:2564
- C:\Windows\System32\QPUEEcK.exe
  C:\Windows\System32\QPUEEcK.exe
  2⤵
  PID:2588
- C:\Windows\System32\yBqWOhA.exe
  C:\Windows\System32\yBqWOhA.exe
  2⤵
  PID:5172
- C:\Windows\System32\BYsnkcP.exe
  C:\Windows\System32\BYsnkcP.exe
  2⤵
  PID:5188
- C:\Windows\System32\RZoDgNi.exe
  C:\Windows\System32\RZoDgNi.exe
  2⤵
  PID:5224
- C:\Windows\System32\xlwTcep.exe
  C:\Windows\System32\xlwTcep.exe
  2⤵
  PID:5244
- C:\Windows\System32\XVhuXUp.exe
  C:\Windows\System32\XVhuXUp.exe
  2⤵
  PID:5268
- C:\Windows\System32\xZDTgwI.exe
  C:\Windows\System32\xZDTgwI.exe
  2⤵
  PID:5292
- C:\Windows\System32\mLNCZHE.exe
  C:\Windows\System32\mLNCZHE.exe
  2⤵
  PID:5312
- C:\Windows\System32\BXHYPzc.exe
  C:\Windows\System32\BXHYPzc.exe
  2⤵
  PID:5332
- C:\Windows\System32\AYRcMxZ.exe
  C:\Windows\System32\AYRcMxZ.exe
  2⤵
  PID:5360
- C:\Windows\System32\nMnGFna.exe
  C:\Windows\System32\nMnGFna.exe
  2⤵
  PID:5380
- C:\Windows\System32\CcSHSrp.exe
  C:\Windows\System32\CcSHSrp.exe
  2⤵
  PID:5436
- C:\Windows\System32\lsZEXkV.exe
  C:\Windows\System32\lsZEXkV.exe
  2⤵
  PID:5488
- C:\Windows\System32\KLpziBU.exe
  C:\Windows\System32\KLpziBU.exe
  2⤵
  PID:5516
- C:\Windows\System32\ibYelof.exe
  C:\Windows\System32\ibYelof.exe
  2⤵
  PID:5532
- C:\Windows\System32\ISJuBpy.exe
  C:\Windows\System32\ISJuBpy.exe
  2⤵
  PID:5556
- C:\Windows\System32\iVAyOaW.exe
  C:\Windows\System32\iVAyOaW.exe
  2⤵
  PID:5572
- C:\Windows\System32\OXTwEpb.exe
  C:\Windows\System32\OXTwEpb.exe
  2⤵
  PID:5600
- C:\Windows\System32\UUkQmkf.exe
  C:\Windows\System32\UUkQmkf.exe
  2⤵
  PID:5616
- C:\Windows\System32\oEZJngA.exe
  C:\Windows\System32\oEZJngA.exe
  2⤵
  PID:5696
- C:\Windows\System32\LBghqnk.exe
  C:\Windows\System32\LBghqnk.exe
  2⤵
  PID:5716
- C:\Windows\System32\kZSJZlZ.exe
  C:\Windows\System32\kZSJZlZ.exe
  2⤵
  PID:5752
- C:\Windows\System32\twznlmA.exe
  C:\Windows\System32\twznlmA.exe
  2⤵
  PID:5776
- C:\Windows\System32\DrIPPgw.exe
  C:\Windows\System32\DrIPPgw.exe
  2⤵
  PID:5796
- C:\Windows\System32\xHhZkHW.exe
  C:\Windows\System32\xHhZkHW.exe
  2⤵
  PID:5888
- C:\Windows\System32\riBsYPe.exe
  C:\Windows\System32\riBsYPe.exe
  2⤵
  PID:5920
- C:\Windows\System32\qWKwtkC.exe
  C:\Windows\System32\qWKwtkC.exe
  2⤵
  PID:5940
- C:\Windows\System32\MLXmXFG.exe
  C:\Windows\System32\MLXmXFG.exe
  2⤵
  PID:5976
- C:\Windows\System32\uyThAfa.exe
  C:\Windows\System32\uyThAfa.exe
  2⤵
  PID:6000
- C:\Windows\System32\HzOLeto.exe
  C:\Windows\System32\HzOLeto.exe
  2⤵
  PID:6032
- C:\Windows\System32\VeguWkC.exe
  C:\Windows\System32\VeguWkC.exe
  2⤵
  PID:6076
- C:\Windows\System32\NVUtVaB.exe
  C:\Windows\System32\NVUtVaB.exe
  2⤵
  PID:6100
- C:\Windows\System32\zLhHHcZ.exe
  C:\Windows\System32\zLhHHcZ.exe
  2⤵
  PID:6116
- C:\Windows\System32\yTCdUhc.exe
  C:\Windows\System32\yTCdUhc.exe
  2⤵
  PID:6136
- C:\Windows\System32\mcGXZMi.exe
  C:\Windows\System32\mcGXZMi.exe
  2⤵
  PID:2212
- C:\Windows\System32\JlIgLot.exe
  C:\Windows\System32\JlIgLot.exe
  2⤵
  PID:5276
- C:\Windows\System32\VtMhdBu.exe
  C:\Windows\System32\VtMhdBu.exe
  2⤵
  PID:5372
- C:\Windows\System32\KxKVzhc.exe
  C:\Windows\System32\KxKVzhc.exe
  2⤵
  PID:2664
- C:\Windows\System32\XDYokRa.exe
  C:\Windows\System32\XDYokRa.exe
  2⤵
  PID:5408
- C:\Windows\System32\RJFXlBc.exe
  C:\Windows\System32\RJFXlBc.exe
  2⤵
  PID:5500
- C:\Windows\System32\zvJfcJw.exe
  C:\Windows\System32\zvJfcJw.exe
  2⤵
  PID:5692
- C:\Windows\System32\aSHDxlx.exe
  C:\Windows\System32\aSHDxlx.exe
  2⤵
  PID:5684
- C:\Windows\System32\MnSnRvS.exe
  C:\Windows\System32\MnSnRvS.exe
  2⤵
  PID:5748
- C:\Windows\System32\XaOmgAE.exe
  C:\Windows\System32\XaOmgAE.exe
  2⤵
  PID:4412
- C:\Windows\System32\oFavwcm.exe
  C:\Windows\System32\oFavwcm.exe
  2⤵
  PID:5864
- C:\Windows\System32\pMEWVMt.exe
  C:\Windows\System32\pMEWVMt.exe
  2⤵
  PID:5916
- C:\Windows\System32\rVZOgdT.exe
  C:\Windows\System32\rVZOgdT.exe
  2⤵
  PID:6020
- C:\Windows\System32\DEnVFIc.exe
  C:\Windows\System32\DEnVFIc.exe
  2⤵
  PID:6112
- C:\Windows\System32\HNbrdSp.exe
  C:\Windows\System32\HNbrdSp.exe
  2⤵
  PID:6124
- C:\Windows\System32\tLUgzLd.exe
  C:\Windows\System32\tLUgzLd.exe
  2⤵
  PID:5184
- C:\Windows\System32\RpGlCvU.exe
  C:\Windows\System32\RpGlCvU.exe
  2⤵
  PID:736
- C:\Windows\System32\BCtemyw.exe
  C:\Windows\System32\BCtemyw.exe
  2⤵
  PID:2964
- C:\Windows\System32\FdJZoFX.exe
  C:\Windows\System32\FdJZoFX.exe
  2⤵
  PID:5280
- C:\Windows\System32\LhUwlIK.exe
  C:\Windows\System32\LhUwlIK.exe
  2⤵
  PID:4628
- C:\Windows\System32\eAHtbsO.exe
  C:\Windows\System32\eAHtbsO.exe
  2⤵
  PID:5420
- C:\Windows\System32\QyYoNJZ.exe
  C:\Windows\System32\QyYoNJZ.exe
  2⤵
  PID:5568
- C:\Windows\System32\hPOZvij.exe
  C:\Windows\System32\hPOZvij.exe
  2⤵
  PID:3384
- C:\Windows\System32\QDdGMEq.exe
  C:\Windows\System32\QDdGMEq.exe
  2⤵
  PID:5660
- C:\Windows\System32\CQCupNV.exe
  C:\Windows\System32\CQCupNV.exe
  2⤵
  PID:5644
- C:\Windows\System32\nOoclAa.exe
  C:\Windows\System32\nOoclAa.exe
  2⤵
  PID:5156
- C:\Windows\System32\awtIEax.exe
  C:\Windows\System32\awtIEax.exe
  2⤵
  PID:1200
- C:\Windows\System32\pmhMpvz.exe
  C:\Windows\System32\pmhMpvz.exe
  2⤵
  PID:5324
- C:\Windows\System32\bSqYGho.exe
  C:\Windows\System32\bSqYGho.exe
  2⤵
  PID:4300
- C:\Windows\System32\BwAiBkP.exe
  C:\Windows\System32\BwAiBkP.exe
  2⤵
  PID:5540
- C:\Windows\System32\saFlCxj.exe
  C:\Windows\System32\saFlCxj.exe
  2⤵
  PID:2404
- C:\Windows\System32\aZytoKD.exe
  C:\Windows\System32\aZytoKD.exe
  2⤵
  PID:2560
- C:\Windows\System32\XrfzdvZ.exe
  C:\Windows\System32\XrfzdvZ.exe
  2⤵
  PID:3704
- C:\Windows\System32\DwpNSPc.exe
  C:\Windows\System32\DwpNSPc.exe
  2⤵
  PID:5876
- C:\Windows\System32\UExLdwi.exe
  C:\Windows\System32\UExLdwi.exe
  2⤵
  PID:6168
- C:\Windows\System32\cjxHkxC.exe
  C:\Windows\System32\cjxHkxC.exe
  2⤵
  PID:6208
- C:\Windows\System32\UdzgZII.exe
  C:\Windows\System32\UdzgZII.exe
  2⤵
  PID:6228
- C:\Windows\System32\KFaCquj.exe
  C:\Windows\System32\KFaCquj.exe
  2⤵
  PID:6252
- C:\Windows\System32\VNFTEWi.exe
  C:\Windows\System32\VNFTEWi.exe
  2⤵
  PID:6272
- C:\Windows\System32\OMgtjdb.exe
  C:\Windows\System32\OMgtjdb.exe
  2⤵
  PID:6328
- C:\Windows\System32\FCsSpnU.exe
  C:\Windows\System32\FCsSpnU.exe
  2⤵
  PID:6344
- C:\Windows\System32\JOskdhW.exe
  C:\Windows\System32\JOskdhW.exe
  2⤵
  PID:6364
- C:\Windows\System32\bjfdrag.exe
  C:\Windows\System32\bjfdrag.exe
  2⤵
  PID:6404
- C:\Windows\System32\NnvLtdx.exe
  C:\Windows\System32\NnvLtdx.exe
  2⤵
  PID:6428
- C:\Windows\System32\wsUtDkT.exe
  C:\Windows\System32\wsUtDkT.exe
  2⤵
  PID:6456
- C:\Windows\System32\ZtGICBL.exe
  C:\Windows\System32\ZtGICBL.exe
  2⤵
  PID:6488
- C:\Windows\System32\iAQLmXv.exe
  C:\Windows\System32\iAQLmXv.exe
  2⤵
  PID:6504
- C:\Windows\System32\tNAvPyR.exe
  C:\Windows\System32\tNAvPyR.exe
  2⤵
  PID:6528
- C:\Windows\System32\AviNjEz.exe
  C:\Windows\System32\AviNjEz.exe
  2⤵
  PID:6544
- C:\Windows\System32\eRMGQHe.exe
  C:\Windows\System32\eRMGQHe.exe
  2⤵
  PID:6572
- C:\Windows\System32\DNgMPHK.exe
  C:\Windows\System32\DNgMPHK.exe
  2⤵
  PID:6592
- C:\Windows\System32\fgKEkfS.exe
  C:\Windows\System32\fgKEkfS.exe
  2⤵
  PID:6612
- C:\Windows\System32\ZGKjNlW.exe
  C:\Windows\System32\ZGKjNlW.exe
  2⤵
  PID:6660
- C:\Windows\System32\eYqGWOj.exe
  C:\Windows\System32\eYqGWOj.exe
  2⤵
  PID:6680
- C:\Windows\System32\ggELToL.exe
  C:\Windows\System32\ggELToL.exe
  2⤵
  PID:6728
- C:\Windows\System32\psbHOaa.exe
  C:\Windows\System32\psbHOaa.exe
  2⤵
  PID:6756
- C:\Windows\System32\ukTrClr.exe
  C:\Windows\System32\ukTrClr.exe
  2⤵
  PID:6788
- C:\Windows\System32\XPJbwxY.exe
  C:\Windows\System32\XPJbwxY.exe
  2⤵
  PID:6828
- C:\Windows\System32\BurhqaG.exe
  C:\Windows\System32\BurhqaG.exe
  2⤵
  PID:6860
- C:\Windows\System32\cvHNuNT.exe
  C:\Windows\System32\cvHNuNT.exe
  2⤵
  PID:6884
- C:\Windows\System32\YWUKEzB.exe
  C:\Windows\System32\YWUKEzB.exe
  2⤵
  PID:6900
- C:\Windows\System32\WSLjRDr.exe
  C:\Windows\System32\WSLjRDr.exe
  2⤵
  PID:6924
- C:\Windows\System32\yeSrtrS.exe
  C:\Windows\System32\yeSrtrS.exe
  2⤵
  PID:6940
- C:\Windows\System32\NuImGry.exe
  C:\Windows\System32\NuImGry.exe
  2⤵
  PID:6968
- C:\Windows\System32\temIfbu.exe
  C:\Windows\System32\temIfbu.exe
  2⤵
  PID:7004
- C:\Windows\System32\IvbkYaG.exe
  C:\Windows\System32\IvbkYaG.exe
  2⤵
  PID:7024
- C:\Windows\System32\QFRMWKZ.exe
  C:\Windows\System32\QFRMWKZ.exe
  2⤵
  PID:7044
- C:\Windows\System32\BwiUIPF.exe
  C:\Windows\System32\BwiUIPF.exe
  2⤵
  PID:7064
- C:\Windows\System32\uglSFkn.exe
  C:\Windows\System32\uglSFkn.exe
  2⤵
  PID:7096
- C:\Windows\System32\lubLjjp.exe
  C:\Windows\System32\lubLjjp.exe
  2⤵
  PID:7148
- C:\Windows\System32\DnTnTCg.exe
  C:\Windows\System32\DnTnTCg.exe
  2⤵
  PID:4756
- C:\Windows\System32\sgmvBEs.exe
  C:\Windows\System32\sgmvBEs.exe
  2⤵
  PID:6180
- C:\Windows\System32\McxaNQY.exe
  C:\Windows\System32\McxaNQY.exe
  2⤵
  PID:6240
- C:\Windows\System32\qJMQPAm.exe
  C:\Windows\System32\qJMQPAm.exe
  2⤵
  PID:6288
- C:\Windows\System32\IUeayao.exe
  C:\Windows\System32\IUeayao.exe
  2⤵
  PID:6336
- C:\Windows\System32\xmTjaPY.exe
  C:\Windows\System32\xmTjaPY.exe
  2⤵
  PID:6384
- C:\Windows\System32\KiaPlpC.exe
  C:\Windows\System32\KiaPlpC.exe
  2⤵
  PID:6424
- C:\Windows\System32\vXrWamJ.exe
  C:\Windows\System32\vXrWamJ.exe
  2⤵
  PID:6500
- C:\Windows\System32\loqTlIC.exe
  C:\Windows\System32\loqTlIC.exe
  2⤵
  PID:6584
- C:\Windows\System32\xJvxZAG.exe
  C:\Windows\System32\xJvxZAG.exe
  2⤵
  PID:6752
- C:\Windows\System32\pLBHczW.exe
  C:\Windows\System32\pLBHczW.exe
  2⤵
  PID:6844
- C:\Windows\System32\spyFlpy.exe
  C:\Windows\System32\spyFlpy.exe
  2⤵
  PID:6936
- C:\Windows\System32\cSdEFQL.exe
  C:\Windows\System32\cSdEFQL.exe
  2⤵
  PID:6912
- C:\Windows\System32\AIkqTzT.exe
  C:\Windows\System32\AIkqTzT.exe
  2⤵
  PID:6948
- C:\Windows\System32\iDeFYRA.exe
  C:\Windows\System32\iDeFYRA.exe
  2⤵
  PID:7056
- C:\Windows\System32\QFnUayi.exe
  C:\Windows\System32\QFnUayi.exe
  2⤵
  PID:7156
- C:\Windows\System32\deinkzD.exe
  C:\Windows\System32\deinkzD.exe
  2⤵
  PID:5352
- C:\Windows\System32\OWnBfRb.exe
  C:\Windows\System32\OWnBfRb.exe
  2⤵
  PID:6360
- C:\Windows\System32\ZbeQJEd.exe
  C:\Windows\System32\ZbeQJEd.exe
  2⤵
  PID:6496
- C:\Windows\System32\OCeBcCR.exe
  C:\Windows\System32\OCeBcCR.exe
  2⤵
  PID:6712
- C:\Windows\System32\KYuaJlz.exe
  C:\Windows\System32\KYuaJlz.exe
  2⤵
  PID:6796
- C:\Windows\System32\OLvuZjI.exe
  C:\Windows\System32\OLvuZjI.exe
  2⤵
  PID:7036
- C:\Windows\System32\sunBvly.exe
  C:\Windows\System32\sunBvly.exe
  2⤵
  PID:7140
- C:\Windows\System32\pxOTNyl.exe
  C:\Windows\System32\pxOTNyl.exe
  2⤵
  PID:6196
- C:\Windows\System32\lnRvnNH.exe
  C:\Windows\System32\lnRvnNH.exe
  2⤵
  PID:6580
- C:\Windows\System32\OfvbAcE.exe
  C:\Windows\System32\OfvbAcE.exe
  2⤵
  PID:6352
- C:\Windows\System32\HjzRVuH.exe
  C:\Windows\System32\HjzRVuH.exe
  2⤵
  PID:7172
- C:\Windows\System32\UeSEaFs.exe
  C:\Windows\System32\UeSEaFs.exe
  2⤵
  PID:7196
- C:\Windows\System32\dFOqwbu.exe
  C:\Windows\System32\dFOqwbu.exe
  2⤵
  PID:7224
- C:\Windows\System32\Oacthgo.exe
  C:\Windows\System32\Oacthgo.exe
  2⤵
  PID:7252
- C:\Windows\System32\vocBzla.exe
  C:\Windows\System32\vocBzla.exe
  2⤵
  PID:7284
- C:\Windows\System32\bAYXWLf.exe
  C:\Windows\System32\bAYXWLf.exe
  2⤵
  PID:7300
- C:\Windows\System32\qwUHcLL.exe
  C:\Windows\System32\qwUHcLL.exe
  2⤵
  PID:7320
- C:\Windows\System32\bPrcDWY.exe
  C:\Windows\System32\bPrcDWY.exe
  2⤵
  PID:7368
- C:\Windows\System32\kDHAAZG.exe
  C:\Windows\System32\kDHAAZG.exe
  2⤵
  PID:7392
- C:\Windows\System32\SOTWwUt.exe
  C:\Windows\System32\SOTWwUt.exe
  2⤵
  PID:7432
- C:\Windows\System32\pFBqxoh.exe
  C:\Windows\System32\pFBqxoh.exe
  2⤵
  PID:7460
- C:\Windows\System32\uGbZgna.exe
  C:\Windows\System32\uGbZgna.exe
  2⤵
  PID:7476
- C:\Windows\System32\pMYwqti.exe
  C:\Windows\System32\pMYwqti.exe
  2⤵
  PID:7512
- C:\Windows\System32\MPKEPZA.exe
  C:\Windows\System32\MPKEPZA.exe
  2⤵
  PID:7536
- C:\Windows\System32\bfueGXN.exe
  C:\Windows\System32\bfueGXN.exe
  2⤵
  PID:7564
- C:\Windows\System32\GuJKTnE.exe
  C:\Windows\System32\GuJKTnE.exe
  2⤵
  PID:7580
- C:\Windows\System32\NrJofrw.exe
  C:\Windows\System32\NrJofrw.exe
  2⤵
  PID:7612
- C:\Windows\System32\DnDnSyL.exe
  C:\Windows\System32\DnDnSyL.exe
  2⤵
  PID:7628
- C:\Windows\System32\VIUOVlf.exe
  C:\Windows\System32\VIUOVlf.exe
  2⤵
  PID:7656
- C:\Windows\System32\TZhpBAP.exe
  C:\Windows\System32\TZhpBAP.exe
  2⤵
  PID:7692
- C:\Windows\System32\tumTHIx.exe
  C:\Windows\System32\tumTHIx.exe
  2⤵
  PID:7716
- C:\Windows\System32\KRfmAev.exe
  C:\Windows\System32\KRfmAev.exe
  2⤵
  PID:7736
- C:\Windows\System32\BxZWdDd.exe
  C:\Windows\System32\BxZWdDd.exe
  2⤵
  PID:7764
- C:\Windows\System32\PQFydhc.exe
  C:\Windows\System32\PQFydhc.exe
  2⤵
  PID:7804
- C:\Windows\System32\zPWPddQ.exe
  C:\Windows\System32\zPWPddQ.exe
  2⤵
  PID:7848
- C:\Windows\System32\mZTXHaV.exe
  C:\Windows\System32\mZTXHaV.exe
  2⤵
  PID:7868
- C:\Windows\System32\WJPPONU.exe
  C:\Windows\System32\WJPPONU.exe
  2⤵
  PID:7908
- C:\Windows\System32\FvGEsou.exe
  C:\Windows\System32\FvGEsou.exe
  2⤵
  PID:7924
- C:\Windows\System32\bZsZkni.exe
  C:\Windows\System32\bZsZkni.exe
  2⤵
  PID:7952
- C:\Windows\System32\xcFTQqF.exe
  C:\Windows\System32\xcFTQqF.exe
  2⤵
  PID:7988
- C:\Windows\System32\VzxZBsX.exe
  C:\Windows\System32\VzxZBsX.exe
  2⤵
  PID:8012
- C:\Windows\System32\aAjyceC.exe
  C:\Windows\System32\aAjyceC.exe
  2⤵
  PID:8032
- C:\Windows\System32\tAzuBUy.exe
  C:\Windows\System32\tAzuBUy.exe
  2⤵
  PID:8052
- C:\Windows\System32\vhOpWtJ.exe
  C:\Windows\System32\vhOpWtJ.exe
  2⤵
  PID:8072
- C:\Windows\System32\RvaTFrx.exe
  C:\Windows\System32\RvaTFrx.exe
  2⤵
  PID:8088
- C:\Windows\System32\Cnjdsgf.exe
  C:\Windows\System32\Cnjdsgf.exe
  2⤵
  PID:8112
- C:\Windows\System32\AkBeHzO.exe
  C:\Windows\System32\AkBeHzO.exe
  2⤵
  PID:8160
- C:\Windows\System32\bDLhhYH.exe
  C:\Windows\System32\bDLhhYH.exe
  2⤵
  PID:1496
- C:\Windows\System32\NRsbhXX.exe
  C:\Windows\System32\NRsbhXX.exe
  2⤵
  PID:7208
- C:\Windows\System32\MYVCRLW.exe
  C:\Windows\System32\MYVCRLW.exe
  2⤵
  PID:7292
- C:\Windows\System32\tTjPzPe.exe
  C:\Windows\System32\tTjPzPe.exe
  2⤵
  PID:7376
- C:\Windows\System32\jzntbdW.exe
  C:\Windows\System32\jzntbdW.exe
  2⤵
  PID:7444
- C:\Windows\System32\fdqpiEU.exe
  C:\Windows\System32\fdqpiEU.exe
  2⤵
  PID:7508
- C:\Windows\System32\uwAZCFK.exe
  C:\Windows\System32\uwAZCFK.exe
  2⤵
  PID:7592
- C:\Windows\System32\IJEAvaf.exe
  C:\Windows\System32\IJEAvaf.exe
  2⤵
  PID:7588
- C:\Windows\System32\kSmdqDu.exe
  C:\Windows\System32\kSmdqDu.exe
  2⤵
  PID:7640
- C:\Windows\System32\JQANQFo.exe
  C:\Windows\System32\JQANQFo.exe
  2⤵
  PID:7728
- C:\Windows\System32\QtOVYRE.exe
  C:\Windows\System32\QtOVYRE.exe
  2⤵
  PID:7828
- C:\Windows\System32\aVOvydY.exe
  C:\Windows\System32\aVOvydY.exe
  2⤵
  PID:7904
- C:\Windows\System32\fHLjeRh.exe
  C:\Windows\System32\fHLjeRh.exe
  2⤵
  PID:8004
- C:\Windows\System32\SqNmrfl.exe
  C:\Windows\System32\SqNmrfl.exe
  2⤵
  PID:8044
- C:\Windows\System32\zlelMmE.exe
  C:\Windows\System32\zlelMmE.exe
  2⤵
  PID:8096
- C:\Windows\System32\RkuVeCx.exe
  C:\Windows\System32\RkuVeCx.exe
  2⤵
  PID:8128
- C:\Windows\System32\twdVRVo.exe
  C:\Windows\System32\twdVRVo.exe
  2⤵
  PID:7236
- C:\Windows\System32\mlwQTKa.exe
  C:\Windows\System32\mlwQTKa.exe
  2⤵
  PID:7420
- C:\Windows\System32\fjOAvTq.exe
  C:\Windows\System32\fjOAvTq.exe
  2⤵
  PID:7504
- C:\Windows\System32\xGQvodu.exe
  C:\Windows\System32\xGQvodu.exe
  2⤵
  PID:7576
- C:\Windows\System32\YmHZfOH.exe
  C:\Windows\System32\YmHZfOH.exe
  2⤵
  PID:7876
- C:\Windows\System32\BWYmgpM.exe
  C:\Windows\System32\BWYmgpM.exe
  2⤵
  PID:8040
- C:\Windows\System32\lOoeFpF.exe
  C:\Windows\System32\lOoeFpF.exe
  2⤵
  PID:8172
- C:\Windows\System32\AAhyFRq.exe
  C:\Windows\System32\AAhyFRq.exe
  2⤵
  PID:7344
- C:\Windows\System32\WzTeEKL.exe
  C:\Windows\System32\WzTeEKL.exe
  2⤵
  PID:7756
- C:\Windows\System32\HrkzjsE.exe
  C:\Windows\System32\HrkzjsE.exe
  2⤵
  PID:7248
- C:\Windows\System32\VABSpjH.exe
  C:\Windows\System32\VABSpjH.exe
  2⤵
  PID:7552
- C:\Windows\System32\bQFsQGB.exe
  C:\Windows\System32\bQFsQGB.exe
  2⤵
  PID:8196
- C:\Windows\System32\NjTWrFO.exe
  C:\Windows\System32\NjTWrFO.exe
  2⤵
  PID:8220
- C:\Windows\System32\WBbNTvz.exe
  C:\Windows\System32\WBbNTvz.exe
  2⤵
  PID:8272
- C:\Windows\System32\dWkZBij.exe
  C:\Windows\System32\dWkZBij.exe
  2⤵
  PID:8292
- C:\Windows\System32\dRZVSjW.exe
  C:\Windows\System32\dRZVSjW.exe
  2⤵
  PID:8308
- C:\Windows\System32\hPdmdvK.exe
  C:\Windows\System32\hPdmdvK.exe
  2⤵
  PID:8336
- C:\Windows\System32\AAOdkCB.exe
  C:\Windows\System32\AAOdkCB.exe
  2⤵
  PID:8376
- C:\Windows\System32\TIvAoEG.exe
  C:\Windows\System32\TIvAoEG.exe
  2⤵
  PID:8416
- C:\Windows\System32\wegDaeA.exe
  C:\Windows\System32\wegDaeA.exe
  2⤵
  PID:8432
- C:\Windows\System32\fBGPJQy.exe
  C:\Windows\System32\fBGPJQy.exe
  2⤵
  PID:8468
- C:\Windows\System32\dyvDjfd.exe
  C:\Windows\System32\dyvDjfd.exe
  2⤵
  PID:8488
- C:\Windows\System32\cPJsFUm.exe
  C:\Windows\System32\cPJsFUm.exe
  2⤵
  PID:8504
- C:\Windows\System32\ozsvnqq.exe
  C:\Windows\System32\ozsvnqq.exe
  2⤵
  PID:8544
- C:\Windows\System32\vrjZPrR.exe
  C:\Windows\System32\vrjZPrR.exe
  2⤵
  PID:8576
- C:\Windows\System32\OPDXJhP.exe
  C:\Windows\System32\OPDXJhP.exe
  2⤵
  PID:8604
- C:\Windows\System32\jeewoFC.exe
  C:\Windows\System32\jeewoFC.exe
  2⤵
  PID:8632
- C:\Windows\System32\iArUKJs.exe
  C:\Windows\System32\iArUKJs.exe
  2⤵
  PID:8652
- C:\Windows\System32\LNendzx.exe
  C:\Windows\System32\LNendzx.exe
  2⤵
  PID:8668
- C:\Windows\System32\DRlYQvy.exe
  C:\Windows\System32\DRlYQvy.exe
  2⤵
  PID:8692
- C:\Windows\System32\VprLyEE.exe
  C:\Windows\System32\VprLyEE.exe
  2⤵
  PID:8732
- C:\Windows\System32\XROGhTP.exe
  C:\Windows\System32\XROGhTP.exe
  2⤵
  PID:8756
- C:\Windows\System32\Pvxxpwe.exe
  C:\Windows\System32\Pvxxpwe.exe
  2⤵
  PID:8776
- C:\Windows\System32\ufIzGaq.exe
  C:\Windows\System32\ufIzGaq.exe
  2⤵
  PID:8792
- C:\Windows\System32\YfgQyZQ.exe
  C:\Windows\System32\YfgQyZQ.exe
  2⤵
  PID:8808
- C:\Windows\System32\qHMxUvB.exe
  C:\Windows\System32\qHMxUvB.exe
  2⤵
  PID:8860
- C:\Windows\System32\gJcfjEf.exe
  C:\Windows\System32\gJcfjEf.exe
  2⤵
  PID:8908
- C:\Windows\System32\OWvqnVY.exe
  C:\Windows\System32\OWvqnVY.exe
  2⤵
  PID:8932
- C:\Windows\System32\gvUUdet.exe
  C:\Windows\System32\gvUUdet.exe
  2⤵
  PID:8956
- C:\Windows\System32\tqYDQzZ.exe
  C:\Windows\System32\tqYDQzZ.exe
  2⤵
  PID:8976
- C:\Windows\System32\MTltDjo.exe
  C:\Windows\System32\MTltDjo.exe
  2⤵
  PID:9004
- C:\Windows\System32\VwCIpwX.exe
  C:\Windows\System32\VwCIpwX.exe
  2⤵
  PID:9052
- C:\Windows\System32\iUHabZc.exe
  C:\Windows\System32\iUHabZc.exe
  2⤵
  PID:9080
- C:\Windows\System32\qvzmSMG.exe
  C:\Windows\System32\qvzmSMG.exe
  2⤵
  PID:9108
- C:\Windows\System32\ddFxJwW.exe
  C:\Windows\System32\ddFxJwW.exe
  2⤵
  PID:9128
- C:\Windows\System32\lowSuhY.exe
  C:\Windows\System32\lowSuhY.exe
  2⤵
  PID:9160
- C:\Windows\System32\kTjUYfW.exe
  C:\Windows\System32\kTjUYfW.exe
  2⤵
  PID:9176
- C:\Windows\System32\ljWTHbn.exe
  C:\Windows\System32\ljWTHbn.exe
  2⤵
  PID:9200
- C:\Windows\System32\BJJZezo.exe
  C:\Windows\System32\BJJZezo.exe
  2⤵
  PID:7784
- C:\Windows\System32\sbuKGSb.exe
  C:\Windows\System32\sbuKGSb.exe
  2⤵
  PID:8284
- C:\Windows\System32\InYdbfy.exe
  C:\Windows\System32\InYdbfy.exe
  2⤵
  PID:8388
- C:\Windows\System32\MFzhEhA.exe
  C:\Windows\System32\MFzhEhA.exe
  2⤵
  PID:8444
- C:\Windows\System32\DfCSNTY.exe
  C:\Windows\System32\DfCSNTY.exe
  2⤵
  PID:8536
- C:\Windows\System32\txyovgD.exe
  C:\Windows\System32\txyovgD.exe
  2⤵
  PID:8588
- C:\Windows\System32\MTbyRpV.exe
  C:\Windows\System32\MTbyRpV.exe
  2⤵
  PID:8628
- C:\Windows\System32\CTiZOUb.exe
  C:\Windows\System32\CTiZOUb.exe
  2⤵
  PID:8648
- C:\Windows\System32\eamtVKw.exe
  C:\Windows\System32\eamtVKw.exe
  2⤵
  PID:8784
- C:\Windows\System32\iMsMbwu.exe
  C:\Windows\System32\iMsMbwu.exe
  2⤵
  PID:8816
- C:\Windows\System32\bopVbQN.exe
  C:\Windows\System32\bopVbQN.exe
  2⤵
  PID:8900
- C:\Windows\System32\RAdkbeK.exe
  C:\Windows\System32\RAdkbeK.exe
  2⤵
  PID:8916
- C:\Windows\System32\gMQlryn.exe
  C:\Windows\System32\gMQlryn.exe
  2⤵
  PID:9024
- C:\Windows\System32\HpeMDDx.exe
  C:\Windows\System32\HpeMDDx.exe
  2⤵
  PID:9120
- C:\Windows\System32\ouqqUWx.exe
  C:\Windows\System32\ouqqUWx.exe
  2⤵
  PID:9136
- C:\Windows\System32\nlGoUcv.exe
  C:\Windows\System32\nlGoUcv.exe
  2⤵
  PID:8244
- C:\Windows\System32\WIUcYDp.exe
  C:\Windows\System32\WIUcYDp.exe
  2⤵
  PID:8180
- C:\Windows\System32\wVYyeXm.exe
  C:\Windows\System32\wVYyeXm.exe
  2⤵
  PID:8500
- C:\Windows\System32\oUgmcdv.exe
  C:\Windows\System32\oUgmcdv.exe
  2⤵
  PID:8516
- C:\Windows\System32\aWtEyln.exe
  C:\Windows\System32\aWtEyln.exe
  2⤵
  PID:8716
- C:\Windows\System32\JTBogVa.exe
  C:\Windows\System32\JTBogVa.exe
  2⤵
  PID:8832
- C:\Windows\System32\aLKvDKr.exe
  C:\Windows\System32\aLKvDKr.exe
  2⤵
  PID:9092
- C:\Windows\System32\gwbPUyy.exe
  C:\Windows\System32\gwbPUyy.exe
  2⤵
  PID:9192
- C:\Windows\System32\ElTSEio.exe
  C:\Windows\System32\ElTSEio.exe
  2⤵
  PID:8848
- C:\Windows\System32\AOOeuVy.exe
  C:\Windows\System32\AOOeuVy.exe
  2⤵
  PID:8844
- C:\Windows\System32\qZEVShF.exe
  C:\Windows\System32\qZEVShF.exe
  2⤵
  PID:8332
- C:\Windows\System32\fzGHHLk.exe
  C:\Windows\System32\fzGHHLk.exe
  2⤵
  PID:9228
- C:\Windows\System32\JNugeug.exe
  C:\Windows\System32\JNugeug.exe
  2⤵
  PID:9260
- C:\Windows\System32\AnZMdkm.exe
  C:\Windows\System32\AnZMdkm.exe
  2⤵
  PID:9284
- C:\Windows\System32\azMnILf.exe
  C:\Windows\System32\azMnILf.exe
  2⤵
  PID:9332
- C:\Windows\System32\yefCsGp.exe
  C:\Windows\System32\yefCsGp.exe
  2⤵
  PID:9356
- C:\Windows\System32\OhBaWNw.exe
  C:\Windows\System32\OhBaWNw.exe
  2⤵
  PID:9384
- C:\Windows\System32\cbAGLmK.exe
  C:\Windows\System32\cbAGLmK.exe
  2⤵
  PID:9412
- C:\Windows\System32\QIOAnhy.exe
  C:\Windows\System32\QIOAnhy.exe
  2⤵
  PID:9428
- C:\Windows\System32\mISPTSz.exe
  C:\Windows\System32\mISPTSz.exe
  2⤵
  PID:9468
- C:\Windows\System32\VRrRXtK.exe
  C:\Windows\System32\VRrRXtK.exe
  2⤵
  PID:9488
- C:\Windows\System32\DWlXrAi.exe
  C:\Windows\System32\DWlXrAi.exe
  2⤵
  PID:9528
- C:\Windows\System32\lCpHXjr.exe
  C:\Windows\System32\lCpHXjr.exe
  2⤵
  PID:9552
- C:\Windows\System32\OMtdKYv.exe
  C:\Windows\System32\OMtdKYv.exe
  2⤵
  PID:9580
- C:\Windows\System32\zNIhQcd.exe
  C:\Windows\System32\zNIhQcd.exe
  2⤵
  PID:9608
- C:\Windows\System32\AzLcqEK.exe
  C:\Windows\System32\AzLcqEK.exe
  2⤵
  PID:9632
- C:\Windows\System32\hQuZuSt.exe
  C:\Windows\System32\hQuZuSt.exe
  2⤵
  PID:9664
- C:\Windows\System32\XQzWiMF.exe
  C:\Windows\System32\XQzWiMF.exe
  2⤵
  PID:9688
- C:\Windows\System32\FOQzolM.exe
  C:\Windows\System32\FOQzolM.exe
  2⤵
  PID:9704
- C:\Windows\System32\qVxihYG.exe
  C:\Windows\System32\qVxihYG.exe
  2⤵
  PID:9728
- C:\Windows\System32\gBdpIhD.exe
  C:\Windows\System32\gBdpIhD.exe
  2⤵
  PID:9752
- C:\Windows\System32\cPuvuih.exe
  C:\Windows\System32\cPuvuih.exe
  2⤵
  PID:9816
- C:\Windows\System32\dLmicca.exe
  C:\Windows\System32\dLmicca.exe
  2⤵
  PID:9832
- C:\Windows\System32\SpakFWm.exe
  C:\Windows\System32\SpakFWm.exe
  2⤵
  PID:9848
- C:\Windows\System32\JJdufvk.exe
  C:\Windows\System32\JJdufvk.exe
  2⤵
  PID:9876
- C:\Windows\System32\YFOWgpC.exe
  C:\Windows\System32\YFOWgpC.exe
  2⤵
  PID:9900
- C:\Windows\System32\xDgdKUq.exe
  C:\Windows\System32\xDgdKUq.exe
  2⤵
  PID:9924
- C:\Windows\System32\osqugWk.exe
  C:\Windows\System32\osqugWk.exe
  2⤵
  PID:9960
- C:\Windows\System32\iavIUqS.exe
  C:\Windows\System32\iavIUqS.exe
  2⤵
  PID:10008
- C:\Windows\System32\EpoLZKA.exe
  C:\Windows\System32\EpoLZKA.exe
  2⤵
  PID:10028
- C:\Windows\System32\ZyEaCQa.exe
  C:\Windows\System32\ZyEaCQa.exe
  2⤵
  PID:10064
- C:\Windows\System32\lKLkpoC.exe
  C:\Windows\System32\lKLkpoC.exe
  2⤵
  PID:10084
- C:\Windows\System32\vOBYTCc.exe
  C:\Windows\System32\vOBYTCc.exe
  2⤵
  PID:10100
- C:\Windows\System32\amqOoJI.exe
  C:\Windows\System32\amqOoJI.exe
  2⤵
  PID:10128
- C:\Windows\System32\cfgDOrC.exe
  C:\Windows\System32\cfgDOrC.exe
  2⤵
  PID:10172
- C:\Windows\System32\esxoyEZ.exe
  C:\Windows\System32\esxoyEZ.exe
  2⤵
  PID:10196
- C:\Windows\System32\tUxtnck.exe
  C:\Windows\System32\tUxtnck.exe
  2⤵
  PID:10216
- C:\Windows\System32\vEkYqwg.exe
  C:\Windows\System32\vEkYqwg.exe
  2⤵
  PID:7624
- C:\Windows\System32\qUzmsni.exe
  C:\Windows\System32\qUzmsni.exe
  2⤵
  PID:9292
- C:\Windows\System32\VjZGVBe.exe
  C:\Windows\System32\VjZGVBe.exe
  2⤵
  PID:9368
- C:\Windows\System32\shzWqHv.exe
  C:\Windows\System32\shzWqHv.exe
  2⤵
  PID:9424
- C:\Windows\System32\TgAwCQj.exe
  C:\Windows\System32\TgAwCQj.exe
  2⤵
  PID:9476
- C:\Windows\System32\ANyVBWe.exe
  C:\Windows\System32\ANyVBWe.exe
  2⤵
  PID:9536
- C:\Windows\System32\fiNyTRc.exe
  C:\Windows\System32\fiNyTRc.exe
  2⤵
  PID:9624
- C:\Windows\System32\mwaimYw.exe
  C:\Windows\System32\mwaimYw.exe
  2⤵
  PID:9672
- C:\Windows\System32\jiofgck.exe
  C:\Windows\System32\jiofgck.exe
  2⤵
  PID:9736
- C:\Windows\System32\GoQJOuJ.exe
  C:\Windows\System32\GoQJOuJ.exe
  2⤵
  PID:9828
- C:\Windows\System32\puhKYwh.exe
  C:\Windows\System32\puhKYwh.exe
  2⤵
  PID:9892
- C:\Windows\System32\kRydIDQ.exe
  C:\Windows\System32\kRydIDQ.exe
  2⤵
  PID:9920
- C:\Windows\System32\kxVVcOf.exe
  C:\Windows\System32\kxVVcOf.exe
  2⤵
  PID:9988
- C:\Windows\System32\kQGTuJl.exe
  C:\Windows\System32\kQGTuJl.exe
  2⤵
  PID:10040
- C:\Windows\System32\hIlvibH.exe
  C:\Windows\System32\hIlvibH.exe
  2⤵
  PID:10152
- C:\Windows\System32\AuChXoH.exe
  C:\Windows\System32\AuChXoH.exe
  2⤵
  PID:10228
- C:\Windows\System32\lwpBjWD.exe
  C:\Windows\System32\lwpBjWD.exe
  2⤵
  PID:9340
- C:\Windows\System32\NflngDI.exe
  C:\Windows\System32\NflngDI.exe
  2⤵
  PID:9452
- C:\Windows\System32\hBGFpAD.exe
  C:\Windows\System32\hBGFpAD.exe
  2⤵
  PID:9644
- C:\Windows\System32\QmrZIwV.exe
  C:\Windows\System32\QmrZIwV.exe
  2⤵
  PID:9764
- C:\Windows\System32\nbrICvq.exe
  C:\Windows\System32\nbrICvq.exe
  2⤵
  PID:9976
- C:\Windows\System32\QHIGnvt.exe
  C:\Windows\System32\QHIGnvt.exe
  2⤵
  PID:10076
- C:\Windows\System32\NUbEBCs.exe
  C:\Windows\System32\NUbEBCs.exe
  2⤵
  PID:9272
- C:\Windows\System32\jqwrjfQ.exe
  C:\Windows\System32\jqwrjfQ.exe
  2⤵
  PID:9396
- C:\Windows\System32\RIzDuVL.exe
  C:\Windows\System32\RIzDuVL.exe
  2⤵
  PID:9724
- C:\Windows\System32\WEySpXs.exe
  C:\Windows\System32\WEySpXs.exe
  2⤵
  PID:9968
- C:\Windows\System32\bKQQPPc.exe
  C:\Windows\System32\bKQQPPc.exe
  2⤵
  PID:9860
- C:\Windows\System32\WDKtklm.exe
  C:\Windows\System32\WDKtklm.exe
  2⤵
  PID:10256
- C:\Windows\System32\cxHhWLj.exe
  C:\Windows\System32\cxHhWLj.exe
  2⤵
  PID:10272
- C:\Windows\System32\UnFTgoa.exe
  C:\Windows\System32\UnFTgoa.exe
  2⤵
  PID:10296
- C:\Windows\System32\alCOMBc.exe
  C:\Windows\System32\alCOMBc.exe
  2⤵
  PID:10320
- C:\Windows\System32\KwayiAQ.exe
  C:\Windows\System32\KwayiAQ.exe
  2⤵
  PID:10344
- C:\Windows\System32\TPUdWRj.exe
  C:\Windows\System32\TPUdWRj.exe
  2⤵
  PID:10360
- C:\Windows\System32\aciBfHg.exe
  C:\Windows\System32\aciBfHg.exe
  2⤵
  PID:10444
- C:\Windows\System32\oEGYdXG.exe
  C:\Windows\System32\oEGYdXG.exe
  2⤵
  PID:10472
- C:\Windows\System32\EZDxpSY.exe
  C:\Windows\System32\EZDxpSY.exe
  2⤵
  PID:10496
- C:\Windows\System32\xXGdCFC.exe
  C:\Windows\System32\xXGdCFC.exe
  2⤵
  PID:10512
- C:\Windows\System32\TZozvoc.exe
  C:\Windows\System32\TZozvoc.exe
  2⤵
  PID:10556
- C:\Windows\System32\aiInaUL.exe
  C:\Windows\System32\aiInaUL.exe
  2⤵
  PID:10592
- C:\Windows\System32\UIXXwfy.exe
  C:\Windows\System32\UIXXwfy.exe
  2⤵
  PID:10612
- C:\Windows\System32\WibYiqd.exe
  C:\Windows\System32\WibYiqd.exe
  2⤵
  PID:10640
- C:\Windows\System32\axwTXaq.exe
  C:\Windows\System32\axwTXaq.exe
  2⤵
  PID:10664
- C:\Windows\System32\hfUgkLU.exe
  C:\Windows\System32\hfUgkLU.exe
  2⤵
  PID:10684
- C:\Windows\System32\xVzpTGX.exe
  C:\Windows\System32\xVzpTGX.exe
  2⤵
  PID:10704
- C:\Windows\System32\uwxnJjT.exe
  C:\Windows\System32\uwxnJjT.exe
  2⤵
  PID:10728
- C:\Windows\System32\yUaitHc.exe
  C:\Windows\System32\yUaitHc.exe
  2⤵
  PID:10756
- C:\Windows\System32\QoteuFN.exe
  C:\Windows\System32\QoteuFN.exe
  2⤵
  PID:10776
- C:\Windows\System32\gMRGdov.exe
  C:\Windows\System32\gMRGdov.exe
  2⤵
  PID:10800
- C:\Windows\System32\rRrBVqe.exe
  C:\Windows\System32\rRrBVqe.exe
  2⤵
  PID:10820
- C:\Windows\System32\SLZQJlk.exe
  C:\Windows\System32\SLZQJlk.exe
  2⤵
  PID:10868
- C:\Windows\System32\RQQygVG.exe
  C:\Windows\System32\RQQygVG.exe
  2⤵
  PID:10920
- C:\Windows\System32\VApKXeu.exe
  C:\Windows\System32\VApKXeu.exe
  2⤵
  PID:10944
- C:\Windows\System32\zxpnyiS.exe
  C:\Windows\System32\zxpnyiS.exe
  2⤵
  PID:10960
- C:\Windows\System32\xoFKfQn.exe
  C:\Windows\System32\xoFKfQn.exe
  2⤵
  PID:10980
- C:\Windows\System32\kWZNStH.exe
  C:\Windows\System32\kWZNStH.exe
  2⤵
  PID:11024
- C:\Windows\System32\gdvSkkq.exe
  C:\Windows\System32\gdvSkkq.exe
  2⤵
  PID:11048
- C:\Windows\System32\evWjVUL.exe
  C:\Windows\System32\evWjVUL.exe
  2⤵
  PID:11088
- C:\Windows\System32\VpckFqq.exe
  C:\Windows\System32\VpckFqq.exe
  2⤵
  PID:11112
- C:\Windows\System32\XGDhijx.exe
  C:\Windows\System32\XGDhijx.exe
  2⤵
  PID:11136
- C:\Windows\System32\KUXKdvJ.exe
  C:\Windows\System32\KUXKdvJ.exe
  2⤵
  PID:11160
- C:\Windows\System32\ZMNNyBS.exe
  C:\Windows\System32\ZMNNyBS.exe
  2⤵
  PID:11204
- C:\Windows\System32\knUudgz.exe
  C:\Windows\System32\knUudgz.exe
  2⤵
  PID:11228
- C:\Windows\System32\KlMUnNL.exe
  C:\Windows\System32\KlMUnNL.exe
  2⤵
  PID:11256
- C:\Windows\System32\ouSfxTX.exe
  C:\Windows\System32\ouSfxTX.exe
  2⤵
  PID:10248
- C:\Windows\System32\zVsuIde.exe
  C:\Windows\System32\zVsuIde.exe
  2⤵
  PID:10336
- C:\Windows\System32\lsUSdhD.exe
  C:\Windows\System32\lsUSdhD.exe
  2⤵
  PID:10340
- C:\Windows\System32\muLRgSc.exe
  C:\Windows\System32\muLRgSc.exe
  2⤵
  PID:10376
- C:\Windows\System32\ZASIWcO.exe
  C:\Windows\System32\ZASIWcO.exe
  2⤵
  PID:10484
- C:\Windows\System32\AAAHCdX.exe
  C:\Windows\System32\AAAHCdX.exe
  2⤵
  PID:10576
- C:\Windows\System32\wZCvBSY.exe
  C:\Windows\System32\wZCvBSY.exe
  2⤵
  PID:10636
- C:\Windows\System32\CbESWBm.exe
  C:\Windows\System32\CbESWBm.exe
  2⤵
  PID:10652
- C:\Windows\System32\ehirhwa.exe
  C:\Windows\System32\ehirhwa.exe
  2⤵
  PID:10720
- C:\Windows\System32\sGjfZVM.exe
  C:\Windows\System32\sGjfZVM.exe
  2⤵
  PID:10828
- C:\Windows\System32\GTDpLRk.exe
  C:\Windows\System32\GTDpLRk.exe
  2⤵
  PID:10896
- C:\Windows\System32\FvRSpJv.exe
  C:\Windows\System32\FvRSpJv.exe
  2⤵
  PID:10956
- C:\Windows\System32\bbdcRvm.exe
  C:\Windows\System32\bbdcRvm.exe
  2⤵
  PID:11020
- C:\Windows\System32\whEUiyE.exe
  C:\Windows\System32\whEUiyE.exe
  2⤵
  PID:11080
- C:\Windows\System32\BtCUBDj.exe
  C:\Windows\System32\BtCUBDj.exe
  2⤵
  PID:11172
- C:\Windows\System32\ZeDIKxJ.exe
  C:\Windows\System32\ZeDIKxJ.exe
  2⤵
  PID:9456
- C:\Windows\System32\fyDedZL.exe
  C:\Windows\System32\fyDedZL.exe
  2⤵
  PID:10716
- C:\Windows\System32\XuVFmck.exe
  C:\Windows\System32\XuVFmck.exe
  2⤵
  PID:10808
- C:\Windows\System32\FxiFaur.exe
  C:\Windows\System32\FxiFaur.exe
  2⤵
  PID:11120
- C:\Windows\System32\luKPaXR.exe
  C:\Windows\System32\luKPaXR.exe
  2⤵
  PID:9604
- C:\Windows\System32\cTXWaPd.exe
  C:\Windows\System32\cTXWaPd.exe
  2⤵
  PID:2124
- C:\Windows\System32\OMdNZDz.exe
  C:\Windows\System32\OMdNZDz.exe
  2⤵
  PID:10632
- C:\Windows\System32\PgYuUMW.exe
  C:\Windows\System32\PgYuUMW.exe
  2⤵
  PID:10600
- C:\Windows\System32\ZryDIHw.exe
  C:\Windows\System32\ZryDIHw.exe
  2⤵
  PID:11280
- C:\Windows\System32\IALSNYQ.exe
  C:\Windows\System32\IALSNYQ.exe
  2⤵
  PID:11364
- C:\Windows\System32\LguPvnI.exe
  C:\Windows\System32\LguPvnI.exe
  2⤵
  PID:11384
- C:\Windows\System32\ruIiGFL.exe
  C:\Windows\System32\ruIiGFL.exe
  2⤵
  PID:11424
- C:\Windows\System32\sivwYjn.exe
  C:\Windows\System32\sivwYjn.exe
  2⤵
  PID:11444
- C:\Windows\System32\vGnyarT.exe
  C:\Windows\System32\vGnyarT.exe
  2⤵
  PID:11472
- C:\Windows\System32\gyhOivV.exe
  C:\Windows\System32\gyhOivV.exe
  2⤵
  PID:11488
- C:\Windows\System32\EOSDNgd.exe
  C:\Windows\System32\EOSDNgd.exe
  2⤵
  PID:11536
- C:\Windows\System32\oNPPASN.exe
  C:\Windows\System32\oNPPASN.exe
  2⤵
  PID:11576
- C:\Windows\System32\gknYJGU.exe
  C:\Windows\System32\gknYJGU.exe
  2⤵
  PID:11600
- C:\Windows\System32\KpvKQrG.exe
  C:\Windows\System32\KpvKQrG.exe
  2⤵
  PID:11632
- C:\Windows\System32\BRnRGTb.exe
  C:\Windows\System32\BRnRGTb.exe
  2⤵
  PID:11660
- C:\Windows\System32\VKBAZbd.exe
  C:\Windows\System32\VKBAZbd.exe
  2⤵
  PID:11692
- C:\Windows\System32\WbHnqlS.exe
  C:\Windows\System32\WbHnqlS.exe
  2⤵
  PID:11716
- C:\Windows\System32\WMWUDFn.exe
  C:\Windows\System32\WMWUDFn.exe
  2⤵
  PID:11744
- C:\Windows\System32\zdrQOAC.exe
  C:\Windows\System32\zdrQOAC.exe
  2⤵
  PID:11772
- C:\Windows\System32\BZrLqqS.exe
  C:\Windows\System32\BZrLqqS.exe
  2⤵
  PID:11792
- C:\Windows\System32\CxJLFUU.exe
  C:\Windows\System32\CxJLFUU.exe
  2⤵
  PID:11816
- C:\Windows\System32\vYskRKm.exe
  C:\Windows\System32\vYskRKm.exe
  2⤵
  PID:11832
- C:\Windows\System32\LQodHaN.exe
  C:\Windows\System32\LQodHaN.exe
  2⤵
  PID:11884
- C:\Windows\System32\UNguZpy.exe
  C:\Windows\System32\UNguZpy.exe
  2⤵
  PID:11908
- C:\Windows\System32\DruCswZ.exe
  C:\Windows\System32\DruCswZ.exe
  2⤵
  PID:11928
- C:\Windows\System32\oMCcSPP.exe
  C:\Windows\System32\oMCcSPP.exe
  2⤵
  PID:11948
- C:\Windows\System32\naiEilF.exe
  C:\Windows\System32\naiEilF.exe
  2⤵
  PID:11972
- C:\Windows\System32\ORMlpve.exe
  C:\Windows\System32\ORMlpve.exe
  2⤵
  PID:12016
- C:\Windows\System32\XRyznUA.exe
  C:\Windows\System32\XRyznUA.exe
  2⤵
  PID:12048
- C:\Windows\System32\skacPuU.exe
  C:\Windows\System32\skacPuU.exe
  2⤵
  PID:12072
- C:\Windows\System32\yCCmjyo.exe
  C:\Windows\System32\yCCmjyo.exe
  2⤵
  PID:12108
- C:\Windows\System32\KXxVWkS.exe
  C:\Windows\System32\KXxVWkS.exe
  2⤵
  PID:12136
- C:\Windows\System32\GMCwhFA.exe
  C:\Windows\System32\GMCwhFA.exe
  2⤵
  PID:12164
- C:\Windows\System32\RowZCoR.exe
  C:\Windows\System32\RowZCoR.exe
  2⤵
  PID:12192
- C:\Windows\System32\HCNNHLd.exe
  C:\Windows\System32\HCNNHLd.exe
  2⤵
  PID:12216
- C:\Windows\System32\zCLgWtQ.exe
  C:\Windows\System32\zCLgWtQ.exe
  2⤵
  PID:12240
- C:\Windows\System32\mzLEEeh.exe
  C:\Windows\System32\mzLEEeh.exe
  2⤵
  PID:12264
- C:\Windows\System32\gBCkQiu.exe
  C:\Windows\System32\gBCkQiu.exe
  2⤵
  PID:10288
- C:\Windows\System32\gncFNlT.exe
  C:\Windows\System32\gncFNlT.exe
  2⤵
  PID:10504
- C:\Windows\System32\mSCwiIH.exe
  C:\Windows\System32\mSCwiIH.exe
  2⤵
  PID:10672
- C:\Windows\System32\ibWSabH.exe
  C:\Windows\System32\ibWSabH.exe
  2⤵
  PID:10936
- C:\Windows\System32\LgRAgGr.exe
  C:\Windows\System32\LgRAgGr.exe
  2⤵
  PID:11316
- C:\Windows\System32\wgCLfIH.exe
  C:\Windows\System32\wgCLfIH.exe
  2⤵
  PID:10368
- C:\Windows\System32\ZRsDmGy.exe
  C:\Windows\System32\ZRsDmGy.exe
  2⤵
  PID:11376
- C:\Windows\System32\mrIMFXA.exe
  C:\Windows\System32\mrIMFXA.exe
  2⤵
  PID:11452
- C:\Windows\System32\AXCmZoF.exe
  C:\Windows\System32\AXCmZoF.exe
  2⤵
  PID:11524
- C:\Windows\System32\MaVBYSP.exe
  C:\Windows\System32\MaVBYSP.exe
  2⤵
  PID:11556
- C:\Windows\System32\YynRDNW.exe
  C:\Windows\System32\YynRDNW.exe
  2⤵
  PID:11644
- C:\Windows\System32\LoTLkea.exe
  C:\Windows\System32\LoTLkea.exe
  2⤵
  PID:11704
- C:\Windows\System32\diTVkLR.exe
  C:\Windows\System32\diTVkLR.exe
  2⤵
  PID:11760
- C:\Windows\System32\eKceTET.exe
  C:\Windows\System32\eKceTET.exe
  2⤵
  PID:11824
- C:\Windows\System32\fTgOPIT.exe
  C:\Windows\System32\fTgOPIT.exe
  2⤵
  PID:11924
- C:\Windows\System32\yBbdNxf.exe
  C:\Windows\System32\yBbdNxf.exe
  2⤵
  PID:11992
- C:\Windows\System32\VXpwlBH.exe
  C:\Windows\System32\VXpwlBH.exe
  2⤵
  PID:12036
- C:\Windows\System32\JZxsexa.exe
  C:\Windows\System32\JZxsexa.exe
  2⤵
  PID:12128
- C:\Windows\System32\iMMyaMl.exe
  C:\Windows\System32\iMMyaMl.exe
  2⤵
  PID:12176
- C:\Windows\System32\XtUcIPA.exe
  C:\Windows\System32\XtUcIPA.exe
  2⤵
  PID:12228
- C:\Windows\System32\EcwnJST.exe
  C:\Windows\System32\EcwnJST.exe
  2⤵
  PID:10552
- C:\Windows\System32\vubifsC.exe
  C:\Windows\System32\vubifsC.exe
  2⤵
  PID:10976
- C:\Windows\System32\gesdLwh.exe
  C:\Windows\System32\gesdLwh.exe
  2⤵
  PID:11332
- C:\Windows\System32\iRDasPR.exe
  C:\Windows\System32\iRDasPR.exe
  2⤵
  PID:11404
- C:\Windows\System32\nVYvLsi.exe
  C:\Windows\System32\nVYvLsi.exe
  2⤵
  PID:11572
- C:\Windows\System32\IdeHEKk.exe
  C:\Windows\System32\IdeHEKk.exe
  2⤵
  PID:11672
- C:\Windows\System32\vkvHWRj.exe
  C:\Windows\System32\vkvHWRj.exe
  2⤵
  PID:11732
- C:\Windows\System32\eFaFSkx.exe
  C:\Windows\System32\eFaFSkx.exe
  2⤵
  PID:11868
- C:\Windows\System32\YAcuyXX.exe
  C:\Windows\System32\YAcuyXX.exe
  2⤵
  PID:12092
- C:\Windows\System32\PSXYbkr.exe
  C:\Windows\System32\PSXYbkr.exe
  2⤵
  PID:12224
- C:\Windows\System32\XpkVwNK.exe
  C:\Windows\System32\XpkVwNK.exe
  2⤵
  PID:11324
- C:\Windows\System32\LZhKcvF.exe
  C:\Windows\System32\LZhKcvF.exe
  2⤵
  PID:11156
- C:\Windows\System32\VJLGHAh.exe
  C:\Windows\System32\VJLGHAh.exe
  2⤵
  PID:12184
- C:\Windows\System32\MraRBIT.exe
  C:\Windows\System32\MraRBIT.exe
  2⤵
  PID:11648
- C:\Windows\System32\luQBnGG.exe
  C:\Windows\System32\luQBnGG.exe
  2⤵
  PID:12292
- C:\Windows\System32\NtBMGYA.exe
  C:\Windows\System32\NtBMGYA.exe
  2⤵
  PID:12316
- C:\Windows\System32\MJSjwtY.exe
  C:\Windows\System32\MJSjwtY.exe
  2⤵
  PID:12336
- C:\Windows\System32\lZVAUsT.exe
  C:\Windows\System32\lZVAUsT.exe
  2⤵
  PID:12360
- C:\Windows\System32\NtlgtPL.exe
  C:\Windows\System32\NtlgtPL.exe
  2⤵
  PID:12380
- C:\Windows\System32\NCtBtoC.exe
  C:\Windows\System32\NCtBtoC.exe
  2⤵
  PID:12400
- C:\Windows\System32\CrAcobQ.exe
  C:\Windows\System32\CrAcobQ.exe
  2⤵
  PID:12420
- C:\Windows\System32\PhQwJjL.exe
  C:\Windows\System32\PhQwJjL.exe
  2⤵
  PID:12484
- C:\Windows\System32\gwaVZdR.exe
  C:\Windows\System32\gwaVZdR.exe
  2⤵
  PID:12508
- C:\Windows\System32\ZRqPiHg.exe
  C:\Windows\System32\ZRqPiHg.exe
  2⤵
  PID:12524
- C:\Windows\System32\bYdiZFK.exe
  C:\Windows\System32\bYdiZFK.exe
  2⤵
  PID:12576
- C:\Windows\System32\PSVyZgd.exe
  C:\Windows\System32\PSVyZgd.exe
  2⤵
  PID:12600
- C:\Windows\System32\yXiLbAQ.exe
  C:\Windows\System32\yXiLbAQ.exe
  2⤵
  PID:12624
- C:\Windows\System32\PgcaoRc.exe
  C:\Windows\System32\PgcaoRc.exe
  2⤵
  PID:12648
- C:\Windows\System32\mrmejyj.exe
  C:\Windows\System32\mrmejyj.exe
  2⤵
  PID:12668
- C:\Windows\System32\LlxKAei.exe
  C:\Windows\System32\LlxKAei.exe
  2⤵
  PID:12700
- C:\Windows\System32\IWmexRH.exe
  C:\Windows\System32\IWmexRH.exe
  2⤵
  PID:12724
- C:\Windows\System32\CBXBzZD.exe
  C:\Windows\System32\CBXBzZD.exe
  2⤵
  PID:12756
- C:\Windows\System32\FGUxIbh.exe
  C:\Windows\System32\FGUxIbh.exe
  2⤵
  PID:12784
- C:\Windows\System32\ditHRRm.exe
  C:\Windows\System32\ditHRRm.exe
  2⤵
  PID:12816
- C:\Windows\System32\CpUAEWd.exe
  C:\Windows\System32\CpUAEWd.exe
  2⤵
  PID:12840
- C:\Windows\System32\VJXEHIH.exe
  C:\Windows\System32\VJXEHIH.exe
  2⤵
  PID:12864
- C:\Windows\System32\SboMssi.exe
  C:\Windows\System32\SboMssi.exe
  2⤵
  PID:12880
- C:\Windows\System32\NzCgRsi.exe
  C:\Windows\System32\NzCgRsi.exe
  2⤵
  PID:12928
- C:\Windows\System32\AUEScZq.exe
  C:\Windows\System32\AUEScZq.exe
  2⤵
  PID:12948
- C:\Windows\System32\oIKIvVq.exe
  C:\Windows\System32\oIKIvVq.exe
  2⤵
  PID:12992
- C:\Windows\System32\uKDhrOx.exe
  C:\Windows\System32\uKDhrOx.exe
  2⤵
  PID:13012
- C:\Windows\System32\usPlyAG.exe
  C:\Windows\System32\usPlyAG.exe
  2⤵
  PID:13032
- C:\Windows\System32\lyVOyVP.exe
  C:\Windows\System32\lyVOyVP.exe
  2⤵
  PID:13072
- C:\Windows\System32\HvMthUZ.exe
  C:\Windows\System32\HvMthUZ.exe
  2⤵
  PID:13092
- C:\Windows\System32\HQIMyaO.exe
  C:\Windows\System32\HQIMyaO.exe
  2⤵
  PID:13116
- C:\Windows\System32\zXpeOsz.exe
  C:\Windows\System32\zXpeOsz.exe
  2⤵
  PID:13148
- C:\Windows\System32\ObaktlW.exe
  C:\Windows\System32\ObaktlW.exe
  2⤵
  PID:13164
- C:\Windows\System32\LvIsWOQ.exe
  C:\Windows\System32\LvIsWOQ.exe
  2⤵
  PID:13192
- C:\Windows\System32\AqNeAol.exe
  C:\Windows\System32\AqNeAol.exe
  2⤵
  PID:13220
- C:\Windows\System32\mpKikLg.exe
  C:\Windows\System32\mpKikLg.exe
  2⤵
  PID:13244
- C:\Windows\System32\PYzdKks.exe
  C:\Windows\System32\PYzdKks.exe
  2⤵
  PID:13292
- C:\Windows\System32\DTuaKYv.exe
  C:\Windows\System32\DTuaKYv.exe
  2⤵
  PID:12056
- C:\Windows\System32\ihuzNNU.exe
  C:\Windows\System32\ihuzNNU.exe
  2⤵
  PID:12344
- C:\Windows\System32\aHeAkhU.exe
  C:\Windows\System32\aHeAkhU.exe
  2⤵
  PID:5032
- C:\Windows\System32\vmOfwLA.exe
  C:\Windows\System32\vmOfwLA.exe
  2⤵
  PID:12388
- C:\Windows\System32\Kxuwyku.exe
  C:\Windows\System32\Kxuwyku.exe
  2⤵
  PID:12456
- C:\Windows\System32\SIziqGJ.exe
  C:\Windows\System32\SIziqGJ.exe
  2⤵
  PID:12556
- C:\Windows\System32\lrFjBMF.exe
  C:\Windows\System32\lrFjBMF.exe
  2⤵
  PID:12584
- C:\Windows\System32\AeXZFse.exe
  C:\Windows\System32\AeXZFse.exe
  2⤵
  PID:12640
- C:\Windows\System32\swTCDTa.exe
  C:\Windows\System32\swTCDTa.exe
  2⤵
  PID:12716
- C:\Windows\System32\ccAShce.exe
  C:\Windows\System32\ccAShce.exe
  2⤵
  PID:12744
- C:\Windows\System32\rurjhhW.exe
  C:\Windows\System32\rurjhhW.exe
  2⤵
  PID:12848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\EyAIesk.exe

Filesize
1.2MB

MD5
b2c1ab9865ae82d2d25eb5483d8e6716

SHA1
e2f708d2934117d0061b81edeb71132554cc9911

SHA256
30d2c5a3003612968156fa07415f433024ef07f99aaf8969e6e1cae82f035c4a

SHA512
bbfe98f211323ae90480d5c77dbb96175d05928f4e1ac1c80f21397010f237b82464fd2539806c26a2ce16bede96e9b6c464fd3ca89b64fde8abdf33efca65eb

Download Submit
C:\Windows\System32\FacuqLD.exe

Filesize
1.2MB

MD5
00a7cbbff78c1117393010f2e8a5ee26

SHA1
7db53d64525bd14c9a537228173841512d658756

SHA256
a83f1a004affe3a1ae61c4406d8c9c23c9e664553ed82a06f80ff7d606cdb516

SHA512
d8db3651cd4955a555fc0efca6d9e961f61280dcb1ae26eec47c3362b0e92d1ff41397615dd4b88b767e92b5c1f70adb7901aacb941126a7dd728bee4eb42be3

Download Submit
C:\Windows\System32\FbBNLCh.exe

Filesize
1.2MB

MD5
932656a979b36ceb6ef66d06a5e3a725

SHA1
ed01ec3c09ded9d700f789cf9dd6b5cd61af9ef4

SHA256
e1ec234ae45c12c350e46b122701f5fc3cdd8342f31e0ad7015185b6835d1d9c

SHA512
721ca8912bad0eb2047f90196ec6947edad8ee01cf2312a8d50bb96371d0cbc77c60f68c6093a75d566126998c45eb81eeff5babfe680051a4e4fcaf58e19734

Download Submit
C:\Windows\System32\GIJagUN.exe

Filesize
1.2MB

MD5
f1e402e5bbf3ff09493024dc1de3bcdd

SHA1
2f8549a5a029733b4dd02c2a34ae91db51c5ecd0

SHA256
a6682173cff907e465a9180eb6b2b0ec0cb6629660c6987c84ce79e328761c6d

SHA512
1b424f97f635db3932a42066b12fa5544a1bb531f9c2c0b7b717ccb37d29df6982c79dad65d65f327fb59e8bbd82956f8fe77dc3d5936a6fe1d2a7758116b584

Download Submit
C:\Windows\System32\IHolNiU.exe

Filesize
1.2MB

MD5
0c2c71a767a58abae0254527e39f140a

SHA1
ea098b57c768b0f6b645363eef233b135f979af5

SHA256
847fd1888c64f81137645764ccdc738d88283060e72075ab00990a34ca8dde13

SHA512
66c2fdc4079c3eb0daae83bce617d9e7297b817ed8297506c58c3ceb077af69cb49e844711aaffe84abeece88351e9ae6e84dd3c41cb7f2baa5705d34f05c5f0

Download Submit
C:\Windows\System32\JAxfJMC.exe

Filesize
1.2MB

MD5
04c4c03e8b8797796d916b3ce4665d9f

SHA1
fd365c6d1425f2f25c227a3eda27b90b6da27604

SHA256
594580a6881926c216bcf303a1d66169fa44cef4acbedca3c78570152c1b7c89

SHA512
3cb210f13a0938785640e9ab639c087df6e7e09c3b6fe6bcec87a28ccccf9818be041aa9a41d42678976bafb3d9fe10280d846fa9879abda599e397c445d6ac1

Download Submit
C:\Windows\System32\OSkqkhn.exe

Filesize
1.2MB

MD5
b7dc32bd3a228f6ea1b4f91aefce0cac

SHA1
cecee6c5ccd437f820ffb73452a2804824e77fb3

SHA256
c7507a10e1230d91b5d039dc994a742cb335316af61988c251920ce5b6814940

SHA512
2007e70e3ee45cecd30fe53b0548d61bf2d692b80ebc7218f2d83c2a90df77e9c384ecc9e9359808fa013329810e7ccad006dcb7ee52a49521852b50be14fa19

Download Submit
C:\Windows\System32\OsEFEyX.exe

Filesize
1.2MB

MD5
eb4ca026f7fe25b63f1b7e7c7330d962

SHA1
47a73d296a4d584ea9e4fd1c201876a7da8f968d

SHA256
0afef6bb2bf86ce727cd8111d90131e4ed896e52ab5462a9ff8d84a51b039685

SHA512
cd94b175a1ee075c53af9f822a429171cb00a41a70df774905af98a7e19100142c4f7968721b49b8ac3e7d806ffef6beae6ac29c782a0a2349ba764a3b7e5cb3

Download Submit
C:\Windows\System32\RjzXZpw.exe

Filesize
1.2MB

MD5
e5111a1ed12f65501ab5496dfa8e78b5

SHA1
683f24fbea6a361c71e9d749b61d9bc6cf2c770b

SHA256
2d32edb5680a3a5599ae2248f464eb04041e2dd2c268512cab6be6b7ea87a842

SHA512
d972ddaf3de1258fb70fb842bddcfad011b60bc7c73c26e88adef6dab3e0c2a898ffc83518372e9d1e489fc81fb29d69c3eaffdbab5bfe6a6eed99b8e43ba8d9

Download Submit
C:\Windows\System32\UWeHNSK.exe

Filesize
1.1MB

MD5
1d53618ce315979b01acba759ba2d52a

SHA1
04ba0c29218bd2acbd4561d3e0243cb03e785b17

SHA256
d1d176c99372b6a4119a33337b13744daaca5708396d742b764144ef4d784799

SHA512
9626e4a212d73e66fccdc98d9adf615da2214a26367269cc5e6b897eeff5414eefb6fd9acc660769c9e9d734114388219686bfdc25f893d7fa095522d3c34608

Download Submit
C:\Windows\System32\UeuDtFC.exe

Filesize
1.2MB

MD5
7c25bebb6f12fb008015025a4369d93e

SHA1
6573b548962c09b2bc7af28dd5b0a5194801cab7

SHA256
b8a84958ea9e2e74d8a3418ffce54cf568bcd8cfc68a8885ecbc20e1f6d5905a

SHA512
6d195fea7f6f715548d8421a88958fa0c04b03a1cd5189700a6ba30275cb72bfc3fcda8161b325c9c9cf79a77960c9c6d6c5abea725d578e23341013b7242d09

Download Submit
C:\Windows\System32\WfDdipB.exe

Filesize
1.2MB

MD5
9379c814d7864f9e8b54bcc1cf91985f

SHA1
a8a26ba911d8d7c269abe27c4dbc2b03bb8b84c3

SHA256
9e4e4cc6d24a65cfa41b5ef8810921d9730a61ad8a4f3f5cb6d4ef0bae813f0f

SHA512
5c17cf64397d1229f65d9d57bb5641c1e4855bb0c401a45deb928bcc3c33acda3b97909d43bf35440aeeaf7ef286af3894e85fc0533075197da07ba1bc3c0e4c

Download Submit
C:\Windows\System32\aPmnqGq.exe

Filesize
1.2MB

MD5
24682531ed6dd886742f9a1b53c09b34

SHA1
efd0ac5fa0e6834ecf48ca3f2c2593c8f9442684

SHA256
58cd50bc1c9f1b12ed9ff87f3c851ad58a2cdb93636eff74eaa953d6b40e4623

SHA512
e1b5fc4764c63ecee615619b8929d63ad8343946dc749af0df38d107f44beb7b9aecd426509c9e88e20a247666302a7b0895b3d113bf8a10143e82d709673137

Download Submit
C:\Windows\System32\aYDURcO.exe

Filesize
1.2MB

MD5
174d36a862213c3c1c321b775aea56bc

SHA1
5ad6112cd6ee2eaa06f617a02527f9f050754ea7

SHA256
0e19292bbfd9451c9864d4851e7471e84d99f5a29ae901e72e56687c6ee7fe68

SHA512
ec1c315420d620bf20e4551834ac1ed27676910461d020b11e7f7b2b297fdae308a5ebe0a918690c7028d786f5f0951e7e834a49df89d4e31945e07944bb60bd

Download Submit
C:\Windows\System32\cWQvZBW.exe

Filesize
1.2MB

MD5
181ddf58740864c7745fbbaabc901fcb

SHA1
fb5637303685ccb4811f905aa11f0f8b61940366

SHA256
dc1c544c775b9e5fbf1460d32755e3e1f74c0097a02cac167448b1b6a7862833

SHA512
b6db46c6143532e58342a8b6184228aadbc65358d3bf063c91005044c4edf903c24288c25453a2e9f3fdade258d8dba132ece337e6e24fac025d98eca8cbfdeb

Download Submit
C:\Windows\System32\gxFtpJZ.exe

Filesize
1.2MB

MD5
6a09cc52c654202670c2c48915cb1b37

SHA1
00500da91b719b3f353a107b67f49266538e6afe

SHA256
218644078d6ec96cb5143b87dbaf9476eb22bf904c4a3019dc444a215a22cd21

SHA512
915e2d4416e50aa3267c2bdcfb3cd04ab8c5184471165c804900da8d221cfde3641c557cf856fb09067f438db6367edfa21835325f836ca053ce06c3e9208083

Download Submit
C:\Windows\System32\hBCLydu.exe

Filesize
1.2MB

MD5
e39e4cb6499e37268f45cb44ac9af36b

SHA1
97bf54ab5bd7a6ac7e6a1211133e119e944da8d8

SHA256
20fb2ff96709ad269958d9f499c364db8f4cba1b4c0a61606f80431a140ce73f

SHA512
21282d44a7ae7eb709074d43e86112ef4c768cd6db5bd6b128692c3156f33bf9bf9f6b77ab0dba066996fc84793348c21b67986dfa0a18f5e82c7d5aa7eb130d

Download Submit
C:\Windows\System32\iFVFmvR.exe

Filesize
1.1MB

MD5
1cb4efefbeecb891ab98123b00e0da3d

SHA1
3d91b7b6730ee83581336850062dd09d855658e0

SHA256
92ba7472fef73fe0c37ba61c416add3f068ba3a8b6c59af421a7d9475f8d13f6

SHA512
b179789ec88c91eba95aaaf8af9c4f1194168859fed981ed0c3388fbda66384e2188827dfc281fd27e48c8071d761044480aa37139900cf24b5ec0d7dc84b94d

Download Submit
C:\Windows\System32\jvnxkhi.exe

Filesize
1.2MB

MD5
ebc19da69e14b05c3f281200ab896fd3

SHA1
2d508ade3fb49c894bcc1c2580fffd4ff8bd7ff0

SHA256
9e75b39c3a42276ae0ef6a3f1e54a1fd0406ba263087e965a1c74fc815df9274

SHA512
5d0b94ab8ad6a64774dd1bd564c31d8a5fe887ee314bde3fbf827be3938f6fbee917cada0a94bbc33d809c22c03955ef688e65c107b5af7a0edfaced4eca1d85

Download Submit
C:\Windows\System32\lPNytuB.exe

Filesize
1.2MB

MD5
0a3633c75330b316fd1c359b7eb53fb0

SHA1
64a7043fe33e1a0450c2c16726bf6ab04d1aaf6a

SHA256
f9707f7bf514fae6790770de8bd970c82deb469433c7dedc32cdbbe834bbe248

SHA512
2ad2d5d79390aef2f04d0b8dfc40cd7d739b313e1d8da341d1a9c9ade9e1a75886fcfb52c99fea3fc5b028d1a67619754be1d66bb5b266880da34db70d5e2245

Download Submit
C:\Windows\System32\ngzugef.exe

Filesize
1.2MB

MD5
f22053fe4ec7f1aba7ca9652c9cc8be7

SHA1
05874250dbd7f88ba4b806647f78544542fb00a7

SHA256
aa7fbd6e7cf1cbadf787deb6efa77cf3a8680b9d42d7c3313eee8fde6b80cf1d

SHA512
164e82c1a83ee9714b9a321497ab63c03f04f5f78e8911302f28d0931b1ebe9af1ed0b92068463b32a01a21e3ca5c9f9ed5379c02fdd5f9bc4b80120958c928f

Download Submit
C:\Windows\System32\pQTIeQU.exe

Filesize
1.2MB

MD5
a5e86e97721cf362a4dd04f16704dfa0

SHA1
835eefaeff899c3dd3b050d279af44c9f3956ef2

SHA256
371c0fac40dbcd9b70d4043c9667d5b85efc052eca7cc3011d6a35b3099bd40a

SHA512
2913395c8c72a48403ec1e67817ba32232526a19448a53eb90223a56e7e961fb8d0c47bc11770ecc0ee46581e4a198dd71158c389a292d6188717c5226634a4d

Download Submit
C:\Windows\System32\poXdRVp.exe

Filesize
1.1MB

MD5
fbdb8ad1649f804f78edee29f9240cc0

SHA1
8cae4297cc01677feeac8d9f5805922695614841

SHA256
9c717a5e7d5b61f6daf5c9ad48579f09edf3b648749daf48b5f5919cc6d17042

SHA512
a1632548ea9eb603f0af8447ae53caa8b7e82670eb4f2cc958318613ebfdee40f29e955787d142e4439bb53622f9c3ea5a3e71233ba11cdf0d35330c0148ad84

Download Submit
C:\Windows\System32\qZyjeRU.exe

Filesize
1.2MB

MD5
1e0feba06b4fdde803d3de7b272933ad

SHA1
ff63669bdbf26ab8c8b6da06873802e47adce380

SHA256
bb0718c68504f5669424b733c0edda5b68328fa208bc232833dc5c0acec33188

SHA512
9fa4d2c69a73678f461c35a71f1556ff7621c122707f173abd1fe4f06ff8c2d4ca128e12ed5a404b2d9aa8c2e35da59dc0e2ad66ad03bc5b477f34226baec50c

Download Submit
C:\Windows\System32\rdRJsni.exe

Filesize
1.2MB

MD5
9cd4a5abd6b0e3a3a86783c4b7642dc4

SHA1
c2740a50ef40202e8dd04652ca79f5354e7a449a

SHA256
bc0d5a96dcf2de94b3cef4c376d7170414e9a35161d8deb689826bb26c844a3a

SHA512
7a99eff186b15f640c7f3a056083edcd666e6d860e90fa39fecb4a7fb481d8a7ddf8daad7c50cc4e468bd8968785b4bbc70be3c607889d6fbfba361cdfe12b17

Download Submit
C:\Windows\System32\sMJSaMm.exe

Filesize
1.2MB

MD5
75983adb7ea162c3e5dfbfe76165fff5

SHA1
d564c6233aacc7e1962dd0290ea00c7c5cfb5bc8

SHA256
302ff9a913e4ab02f13a147b390a83b73e9e433dc7d6cd1844e2dc9580333c7b

SHA512
8d0a29e417303dd35ce6899556d89e3558610f2d3cd7eaa5544c861307991cfe1f3bfeb48ca04f43a9325744acb50acb5fe6e7707117c4df15c56bca3cf58bce

Download Submit
C:\Windows\System32\sTTyvQc.exe

Filesize
1.2MB

MD5
8c13f6c58a7d772774ea4638a5711575

SHA1
3e9d3eb759cfa5b091930d07e2ad965b1fca0a2d

SHA256
b787c989f02906ac74af290956de789a61c3f56be803a92c02614ac27387e82c

SHA512
3955412b006ff74203dc95aa72c7dcba832aafe525b2381b29df3e88cc1eec45e6df8f2a8465f113a8dbc89ff21305d528976cdfb9e7d3aec8722284fd1ae930

Download Submit
C:\Windows\System32\srnoWdY.exe

Filesize
1.2MB

MD5
4c5e4309932334027ea7c9e018e03781

SHA1
c5017432729fd0d3cf7724badca6b154687cf796

SHA256
b54531e44545df777976a4474b9a33dc581d7437b0efa2089c1149121d88fdd8

SHA512
07175c6bfc1ff117ba6b616b1fedcfe42c6acb539d618fea8f35ccf5921a42b3284c5391ab2d62dc51231b5cf21c1596bd120f7730ece911b1c9ee1e896268d7

Download Submit
C:\Windows\System32\tPmOnJq.exe

Filesize
1.2MB

MD5
e13c2da96fe8bdcc2278afd44379b368

SHA1
ec39ec53732dfaac6f1cf376666514e45223a5c1

SHA256
8d0b2906bf2accdffc0039e6fca9b685dfeb3545645995195fcf3f062808a33e

SHA512
77b71788f879d7848b194b644b957645ffde43c5ab1554ed1ce064a6a4e730dcb4257b26f037915d7d829cd3e3596080e0fe4a534a20d72fe01c1b6ee4b31146

Download Submit
C:\Windows\System32\uNrJQGk.exe

Filesize
1.2MB

MD5
119918e46a77a94d8ea74dbf3a92e65b

SHA1
3e568b0d807fdd3bb1527d66ad8495dfaedc52f8

SHA256
02f49afcdc43f4f7f1e946329dbe258a60354dec2bd83b77505c1c3308762d31

SHA512
d66766d6b57fd6d76fe472183a9422c344d2fcf4c07c762883e1739cc7652b6b3d604b50b20aec34d814baa3e8e4f03af813e7306740a701aa440e9f22f73284

Download Submit
C:\Windows\System32\wBJzorf.exe

Filesize
1.1MB

MD5
919e6fcca8fb283a85e05f3f92f80822

SHA1
f38d23193a0f8cf74dd7d3bc889d8bb28da385bb

SHA256
30321e029d98371e294dd0d99355ad3f74be4aae5511bee07a23169b20368277

SHA512
62103f3c9244027aa8318b396e287372a2e621236564166dccbdb7b0d255e488a5a148eb73ce86a8425d5fd1d9b139f453d12a9a2033e05ae21bf7f7f71ec206

Download Submit
C:\Windows\System32\zFEaxre.exe

Filesize
1.1MB

MD5
150d982a413a623b3d99fac8c5c4f735

SHA1
c0639ce93eeb95f4d606f36945df5c06c25cb735

SHA256
5be4fe181fe8861f1caff416b1fe3f81f54d69e722740d7ba85fc699847a1d99

SHA512
9789eb942fcb0a60fdce207c535caf5df255abc1f9c8886e300853f3a4808eea8423059b6591e3ae72e4fafee42e5f86347baf8cca1972d46a8fccdbd4db1e63

Download Submit
memory/1340-354-0x00007FF6E6260000-0x00007FF6E6651000-memory.dmp

Filesize
3.9MB

Download
memory/1340-2060-0x00007FF6E6260000-0x00007FF6E6651000-memory.dmp

Filesize
3.9MB

Download
memory/1664-2051-0x00007FF67E450000-0x00007FF67E841000-memory.dmp

Filesize
3.9MB

Download
memory/1664-339-0x00007FF67E450000-0x00007FF67E841000-memory.dmp

Filesize
3.9MB

Download
memory/1676-2048-0x00007FF6569C0000-0x00007FF656DB1000-memory.dmp

Filesize
3.9MB

Download
memory/1676-322-0x00007FF6569C0000-0x00007FF656DB1000-memory.dmp

Filesize
3.9MB

Download
memory/1744-336-0x00007FF66B910000-0x00007FF66BD01000-memory.dmp

Filesize
3.9MB

Download
memory/1744-2056-0x00007FF66B910000-0x00007FF66BD01000-memory.dmp

Filesize
3.9MB

Download
memory/1868-2059-0x00007FF730E40000-0x00007FF731231000-memory.dmp

Filesize
3.9MB

Download
memory/1868-347-0x00007FF730E40000-0x00007FF731231000-memory.dmp

Filesize
3.9MB

Download
memory/1888-367-0x00007FF734920000-0x00007FF734D11000-memory.dmp

Filesize
3.9MB

Download
memory/1888-2064-0x00007FF734920000-0x00007FF734D11000-memory.dmp

Filesize
3.9MB

Download
memory/2076-2044-0x00007FF6B0900000-0x00007FF6B0CF1000-memory.dmp

Filesize
3.9MB

Download
memory/2076-59-0x00007FF6B0900000-0x00007FF6B0CF1000-memory.dmp

Filesize
3.9MB

Download
memory/2280-377-0x00007FF6619C0000-0x00007FF661DB1000-memory.dmp

Filesize
3.9MB

Download
memory/2280-2081-0x00007FF6619C0000-0x00007FF661DB1000-memory.dmp

Filesize
3.9MB

Download
memory/2472-47-0x00007FF685530000-0x00007FF685921000-memory.dmp

Filesize
3.9MB

Download
memory/2472-2038-0x00007FF685530000-0x00007FF685921000-memory.dmp

Filesize
3.9MB

Download
memory/2888-2030-0x00007FF6A1580000-0x00007FF6A1971000-memory.dmp

Filesize
3.9MB

Download
memory/2888-12-0x00007FF6A1580000-0x00007FF6A1971000-memory.dmp

Filesize
3.9MB

Download
memory/2888-1966-0x00007FF6A1580000-0x00007FF6A1971000-memory.dmp

Filesize
3.9MB

Download
memory/3052-2040-0x00007FF778DB0000-0x00007FF7791A1000-memory.dmp

Filesize
3.9MB

Download
memory/3052-49-0x00007FF778DB0000-0x00007FF7791A1000-memory.dmp

Filesize
3.9MB

Download
memory/3128-2062-0x00007FF75AB30000-0x00007FF75AF21000-memory.dmp

Filesize
3.9MB

Download
memory/3128-360-0x00007FF75AB30000-0x00007FF75AF21000-memory.dmp

Filesize
3.9MB

Download
memory/3184-1-0x000001B1E5230000-0x000001B1E5240000-memory.dmp

Filesize
64KB

Download
memory/3184-0-0x00007FF7EF7A0000-0x00007FF7EFB91000-memory.dmp

Filesize
3.9MB

Download
memory/3184-1996-0x00007FF7EF7A0000-0x00007FF7EFB91000-memory.dmp

Filesize
3.9MB

Download
memory/3396-2077-0x00007FF7E7940000-0x00007FF7E7D31000-memory.dmp

Filesize
3.9MB

Download
memory/3396-373-0x00007FF7E7940000-0x00007FF7E7D31000-memory.dmp

Filesize
3.9MB

Download
memory/3472-2028-0x00007FF7A8E80000-0x00007FF7A9271000-memory.dmp

Filesize
3.9MB

Download
memory/3472-11-0x00007FF7A8E80000-0x00007FF7A9271000-memory.dmp

Filesize
3.9MB

Download
memory/3604-2074-0x00007FF746EA0000-0x00007FF747291000-memory.dmp

Filesize
3.9MB

Download
memory/3604-376-0x00007FF746EA0000-0x00007FF747291000-memory.dmp

Filesize
3.9MB

Download
memory/3844-2036-0x00007FF76D5E0000-0x00007FF76D9D1000-memory.dmp

Filesize
3.9MB

Download
memory/3844-46-0x00007FF76D5E0000-0x00007FF76D9D1000-memory.dmp

Filesize
3.9MB

Download
memory/3976-342-0x00007FF6580C0000-0x00007FF6584B1000-memory.dmp

Filesize
3.9MB

Download
memory/3976-2054-0x00007FF6580C0000-0x00007FF6584B1000-memory.dmp

Filesize
3.9MB

Download
memory/4016-1967-0x00007FF7D9C10000-0x00007FF7DA001000-memory.dmp

Filesize
3.9MB

Download
memory/4016-2032-0x00007FF7D9C10000-0x00007FF7DA001000-memory.dmp

Filesize
3.9MB

Download
memory/4016-29-0x00007FF7D9C10000-0x00007FF7DA001000-memory.dmp

Filesize
3.9MB

Download
memory/4028-2079-0x00007FF654B00000-0x00007FF654EF1000-memory.dmp

Filesize
3.9MB

Download
memory/4028-369-0x00007FF654B00000-0x00007FF654EF1000-memory.dmp

Filesize
3.9MB

Download
memory/4144-2046-0x00007FF6D8A30000-0x00007FF6D8E21000-memory.dmp

Filesize
3.9MB

Download
memory/4144-1994-0x00007FF6D8A30000-0x00007FF6D8E21000-memory.dmp

Filesize
3.9MB

Download
memory/4144-60-0x00007FF6D8A30000-0x00007FF6D8E21000-memory.dmp

Filesize
3.9MB

Download
memory/4164-52-0x00007FF7B2480000-0x00007FF7B2871000-memory.dmp

Filesize
3.9MB

Download
memory/4164-2035-0x00007FF7B2480000-0x00007FF7B2871000-memory.dmp

Filesize
3.9MB

Download
memory/4356-2042-0x00007FF6F66B0000-0x00007FF6F6AA1000-memory.dmp

Filesize
3.9MB

Download
memory/4356-48-0x00007FF6F66B0000-0x00007FF6F6AA1000-memory.dmp

Filesize
3.9MB

Download
memory/4644-330-0x00007FF67A520000-0x00007FF67A911000-memory.dmp

Filesize
3.9MB

Download
memory/4644-2052-0x00007FF67A520000-0x00007FF67A911000-memory.dmp

Filesize
3.9MB

Download
memory/4944-2066-0x00007FF714470000-0x00007FF714861000-memory.dmp

Filesize
3.9MB

Download
memory/4944-368-0x00007FF714470000-0x00007FF714861000-memory.dmp

Filesize
3.9MB

Download