Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02/05/2024, 13:33
Behavioral task
behavioral1
Sample
0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe
Resource
win7-20240215-en
General
-
Target
0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
0ea43f5606f25d535a978e1365a61cfb
-
SHA1
4986ddb9d103530e78ff6dc1c03065e94d256cee
-
SHA256
dc57f6dee2a4e72ebd86a532e8cd2bbf252b10ddea6c87268b74c2947b1741da
-
SHA512
a863197c80c60e81d3f1539c8472961acf47aeff15df7a4bcae9242325cfc53863a0935b44bdc0b8dcba08626c394e9a6db6ffb1afa9a10cc83ec350f1e2da36
-
SSDEEP
24576:JanwhSe11QSONCpGJCjETPlGC78XIO6zRIhRmuSOefh+:knw9oUUEEDlGUh+hNz
Malware Config
Signatures
-
XMRig Miner payload 46 IoCs
resource yara_rule behavioral2/memory/2968-16-0x00007FF789360000-0x00007FF789751000-memory.dmp xmrig behavioral2/memory/4936-301-0x00007FF6A9C40000-0x00007FF6AA031000-memory.dmp xmrig behavioral2/memory/4748-303-0x00007FF6358D0000-0x00007FF635CC1000-memory.dmp xmrig behavioral2/memory/4752-305-0x00007FF6B4040000-0x00007FF6B4431000-memory.dmp xmrig behavioral2/memory/2104-306-0x00007FF7C4F30000-0x00007FF7C5321000-memory.dmp xmrig behavioral2/memory/4124-308-0x00007FF63F380000-0x00007FF63F771000-memory.dmp xmrig behavioral2/memory/1612-309-0x00007FF75F930000-0x00007FF75FD21000-memory.dmp xmrig behavioral2/memory/2356-310-0x00007FF70A1D0000-0x00007FF70A5C1000-memory.dmp xmrig behavioral2/memory/1812-311-0x00007FF6F9BC0000-0x00007FF6F9FB1000-memory.dmp xmrig behavioral2/memory/1756-317-0x00007FF6EB040000-0x00007FF6EB431000-memory.dmp xmrig behavioral2/memory/3740-319-0x00007FF737C40000-0x00007FF738031000-memory.dmp xmrig behavioral2/memory/1808-322-0x00007FF6CDBF0000-0x00007FF6CDFE1000-memory.dmp xmrig behavioral2/memory/2428-324-0x00007FF767830000-0x00007FF767C21000-memory.dmp xmrig behavioral2/memory/896-328-0x00007FF7CF6C0000-0x00007FF7CFAB1000-memory.dmp xmrig behavioral2/memory/4816-326-0x00007FF704200000-0x00007FF7045F1000-memory.dmp xmrig behavioral2/memory/3236-323-0x00007FF7CBF40000-0x00007FF7CC331000-memory.dmp xmrig behavioral2/memory/2236-316-0x00007FF7754C0000-0x00007FF7758B1000-memory.dmp xmrig behavioral2/memory/1636-313-0x00007FF718FA0000-0x00007FF719391000-memory.dmp xmrig behavioral2/memory/4996-312-0x00007FF663F70000-0x00007FF664361000-memory.dmp xmrig behavioral2/memory/8-35-0x00007FF7DD8E0000-0x00007FF7DDCD1000-memory.dmp xmrig behavioral2/memory/2252-1805-0x00007FF727610000-0x00007FF727A01000-memory.dmp xmrig behavioral2/memory/1588-1811-0x00007FF621D70000-0x00007FF622161000-memory.dmp xmrig behavioral2/memory/3972-2060-0x00007FF765110000-0x00007FF765501000-memory.dmp xmrig behavioral2/memory/3972-2065-0x00007FF765110000-0x00007FF765501000-memory.dmp xmrig behavioral2/memory/3244-2067-0x00007FF795060000-0x00007FF795451000-memory.dmp xmrig behavioral2/memory/8-2069-0x00007FF7DD8E0000-0x00007FF7DDCD1000-memory.dmp xmrig behavioral2/memory/1504-2071-0x00007FF73F260000-0x00007FF73F651000-memory.dmp xmrig behavioral2/memory/4936-2073-0x00007FF6A9C40000-0x00007FF6AA031000-memory.dmp xmrig behavioral2/memory/4748-2075-0x00007FF6358D0000-0x00007FF635CC1000-memory.dmp xmrig behavioral2/memory/4752-2079-0x00007FF6B4040000-0x00007FF6B4431000-memory.dmp xmrig behavioral2/memory/2104-2077-0x00007FF7C4F30000-0x00007FF7C5321000-memory.dmp xmrig behavioral2/memory/2356-2085-0x00007FF70A1D0000-0x00007FF70A5C1000-memory.dmp xmrig behavioral2/memory/1812-2087-0x00007FF6F9BC0000-0x00007FF6F9FB1000-memory.dmp xmrig behavioral2/memory/1636-2091-0x00007FF718FA0000-0x00007FF719391000-memory.dmp xmrig behavioral2/memory/1756-2094-0x00007FF6EB040000-0x00007FF6EB431000-memory.dmp xmrig behavioral2/memory/3740-2097-0x00007FF737C40000-0x00007FF738031000-memory.dmp xmrig behavioral2/memory/1808-2099-0x00007FF6CDBF0000-0x00007FF6CDFE1000-memory.dmp xmrig behavioral2/memory/3236-2101-0x00007FF7CBF40000-0x00007FF7CC331000-memory.dmp xmrig behavioral2/memory/2428-2103-0x00007FF767830000-0x00007FF767C21000-memory.dmp xmrig behavioral2/memory/4816-2105-0x00007FF704200000-0x00007FF7045F1000-memory.dmp xmrig behavioral2/memory/896-2107-0x00007FF7CF6C0000-0x00007FF7CFAB1000-memory.dmp xmrig behavioral2/memory/2236-2095-0x00007FF7754C0000-0x00007FF7758B1000-memory.dmp xmrig behavioral2/memory/4996-2089-0x00007FF663F70000-0x00007FF664361000-memory.dmp xmrig behavioral2/memory/1612-2083-0x00007FF75F930000-0x00007FF75FD21000-memory.dmp xmrig behavioral2/memory/4124-2081-0x00007FF63F380000-0x00007FF63F771000-memory.dmp xmrig behavioral2/memory/2252-2278-0x00007FF727610000-0x00007FF727A01000-memory.dmp xmrig -
Executes dropped EXE 64 IoCs
pid Process 1588 SwuoJCS.exe 2968 LlZxYwb.exe 3972 cOfraYS.exe 3244 LgtIPgN.exe 8 qTPYMMB.exe 1504 RaxBPSr.exe 4936 zIaBDdA.exe 4748 fRPzkQT.exe 4752 nGvCiuv.exe 2104 UCgYvER.exe 4124 GPeTKHr.exe 1612 DJxfiar.exe 2356 hnDeCQX.exe 1812 rnhMZwP.exe 4996 TOoUPAR.exe 1636 Fwfplcc.exe 2236 nYGlVci.exe 1756 jVelmPn.exe 3740 inyCjnA.exe 1808 eVfuwHU.exe 3236 sDNJNVx.exe 2428 YUMGAnv.exe 4816 HSXenFr.exe 896 DPTzMGN.exe 4700 tzOeSxN.exe 1376 PGXZVAI.exe 3464 nrTjwXN.exe 4248 BhPjSHo.exe 3332 wvteKWK.exe 5088 KMDZffa.exe 544 rulwqAw.exe 892 kVudlAP.exe 2164 MmLxYBi.exe 4016 GXACuOA.exe 4056 dBohhlF.exe 4464 wsjrfmf.exe 1592 dKSHnPC.exe 984 WAnTrBD.exe 3516 PLEiMaw.exe 3732 aRAgwFj.exe 4476 fbXwxhO.exe 4204 igpRwGZ.exe 3544 jTrndZz.exe 952 SgMXORu.exe 1560 giWTtCC.exe 1996 kDcLiwo.exe 536 DJEYqXZ.exe 3452 YyymhoK.exe 1992 OUlOdcb.exe 1848 KPRpFhv.exe 2108 lrIXwRr.exe 5028 qnsrfjc.exe 1660 mnJTycu.exe 2204 WjZFVPk.exe 4564 SPCUnfu.exe 2452 XItuYEU.exe 228 uZZUrbB.exe 2384 fYJvoxc.exe 1400 RGVcVkN.exe 4524 xUxijaE.exe 4684 YThtCNU.exe 404 lmnFooO.exe 4180 LHzJVsR.exe 3548 mAvIknW.exe -
resource yara_rule behavioral2/memory/2252-0-0x00007FF727610000-0x00007FF727A01000-memory.dmp upx behavioral2/files/0x000700000002325f-7.dat upx behavioral2/files/0x000e000000023157-4.dat upx behavioral2/memory/2968-16-0x00007FF789360000-0x00007FF789751000-memory.dmp upx behavioral2/memory/3972-23-0x00007FF765110000-0x00007FF765501000-memory.dmp upx behavioral2/files/0x0007000000023260-24.dat upx behavioral2/files/0x0007000000023261-30.dat upx behavioral2/files/0x0007000000023263-42.dat upx behavioral2/files/0x000800000002325c-47.dat upx behavioral2/files/0x0007000000023264-50.dat upx behavioral2/files/0x0007000000023265-55.dat upx behavioral2/files/0x0007000000023266-62.dat upx behavioral2/files/0x0007000000023268-68.dat upx behavioral2/files/0x000700000002326a-82.dat upx behavioral2/files/0x000700000002326b-87.dat upx behavioral2/files/0x000700000002326e-102.dat upx behavioral2/files/0x0007000000023271-117.dat upx behavioral2/files/0x0007000000023273-127.dat upx behavioral2/memory/4936-301-0x00007FF6A9C40000-0x00007FF6AA031000-memory.dmp upx behavioral2/memory/4748-303-0x00007FF6358D0000-0x00007FF635CC1000-memory.dmp upx behavioral2/memory/4752-305-0x00007FF6B4040000-0x00007FF6B4431000-memory.dmp upx behavioral2/memory/2104-306-0x00007FF7C4F30000-0x00007FF7C5321000-memory.dmp upx behavioral2/memory/4124-308-0x00007FF63F380000-0x00007FF63F771000-memory.dmp upx behavioral2/memory/1612-309-0x00007FF75F930000-0x00007FF75FD21000-memory.dmp upx behavioral2/memory/2356-310-0x00007FF70A1D0000-0x00007FF70A5C1000-memory.dmp upx behavioral2/memory/1812-311-0x00007FF6F9BC0000-0x00007FF6F9FB1000-memory.dmp upx behavioral2/memory/1756-317-0x00007FF6EB040000-0x00007FF6EB431000-memory.dmp upx behavioral2/memory/3740-319-0x00007FF737C40000-0x00007FF738031000-memory.dmp upx behavioral2/memory/1808-322-0x00007FF6CDBF0000-0x00007FF6CDFE1000-memory.dmp upx behavioral2/memory/2428-324-0x00007FF767830000-0x00007FF767C21000-memory.dmp upx behavioral2/memory/896-328-0x00007FF7CF6C0000-0x00007FF7CFAB1000-memory.dmp upx behavioral2/memory/4816-326-0x00007FF704200000-0x00007FF7045F1000-memory.dmp upx behavioral2/memory/3236-323-0x00007FF7CBF40000-0x00007FF7CC331000-memory.dmp upx behavioral2/memory/2236-316-0x00007FF7754C0000-0x00007FF7758B1000-memory.dmp upx behavioral2/memory/1636-313-0x00007FF718FA0000-0x00007FF719391000-memory.dmp upx behavioral2/memory/4996-312-0x00007FF663F70000-0x00007FF664361000-memory.dmp upx behavioral2/files/0x000700000002327b-167.dat upx behavioral2/files/0x000700000002327a-165.dat upx behavioral2/files/0x0007000000023279-160.dat upx behavioral2/files/0x0007000000023278-155.dat upx behavioral2/files/0x0007000000023277-147.dat upx behavioral2/files/0x0007000000023276-142.dat upx behavioral2/files/0x0007000000023275-137.dat upx behavioral2/files/0x0007000000023274-132.dat upx behavioral2/files/0x0007000000023272-122.dat upx behavioral2/files/0x0007000000023270-112.dat upx behavioral2/files/0x000700000002326f-107.dat upx behavioral2/files/0x000700000002326d-97.dat upx behavioral2/files/0x000700000002326c-92.dat upx behavioral2/files/0x0007000000023269-80.dat upx behavioral2/files/0x0007000000023267-70.dat upx behavioral2/files/0x0007000000023262-37.dat upx behavioral2/memory/1504-36-0x00007FF73F260000-0x00007FF73F651000-memory.dmp upx behavioral2/memory/8-35-0x00007FF7DD8E0000-0x00007FF7DDCD1000-memory.dmp upx behavioral2/memory/3244-26-0x00007FF795060000-0x00007FF795451000-memory.dmp upx behavioral2/memory/1588-13-0x00007FF621D70000-0x00007FF622161000-memory.dmp upx behavioral2/files/0x000800000002325e-10.dat upx behavioral2/memory/2252-1805-0x00007FF727610000-0x00007FF727A01000-memory.dmp upx behavioral2/memory/1588-1811-0x00007FF621D70000-0x00007FF622161000-memory.dmp upx behavioral2/memory/3972-2060-0x00007FF765110000-0x00007FF765501000-memory.dmp upx behavioral2/memory/3972-2065-0x00007FF765110000-0x00007FF765501000-memory.dmp upx behavioral2/memory/3244-2067-0x00007FF795060000-0x00007FF795451000-memory.dmp upx behavioral2/memory/8-2069-0x00007FF7DD8E0000-0x00007FF7DDCD1000-memory.dmp upx behavioral2/memory/1504-2071-0x00007FF73F260000-0x00007FF73F651000-memory.dmp upx -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\CIxloeR.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\tIchYdD.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\eomVpmX.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\WjZFVPk.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\bMEPOCh.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\LlZxYwb.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\BhPjSHo.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\PLEiMaw.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\xBXsjOZ.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\EXrCeVV.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\sGqSVSA.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\nFOrQdZ.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\igpRwGZ.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\SPCUnfu.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\QzeGwrX.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\oWkTVJq.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\cdIXntX.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\hTFVSud.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\LLIlqoN.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\yyknrJJ.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\vDztdTe.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\vaDSPiM.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\MUQIaWN.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\vwhquQP.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\vtxmSOB.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\IeqKBwf.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\VDmDoge.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\pZYWpXz.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\PrJYpTG.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\pxysple.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\EfUredr.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\TFesKxd.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\qDNBSTZ.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\LepgDcp.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\YZMlYle.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\PGRGiUi.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\DXVmJek.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\dJzGPzy.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\aqSAVWO.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\NrErfHz.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\ZwdfdEW.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\mKoJFiD.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\iMkfhxC.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\SnfckJA.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\SSjztQt.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\LZyiiwG.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\TLbhvdT.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\FcREHrR.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\HfAChuq.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\mlePizQ.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\FtQgBFV.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\zkfRoLM.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\mwHhgtO.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\SCWfYoU.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\OUlOdcb.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\tbxtQnT.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\AGppdHe.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\oEwsdlp.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\jMDtFHo.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\ChOPtve.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\hfRssGG.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\YwEPyxr.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\yOlApHt.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe File created C:\Windows\System32\tNiOean.exe 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2252 wrote to memory of 1588 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 92 PID 2252 wrote to memory of 1588 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 92 PID 2252 wrote to memory of 2968 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 93 PID 2252 wrote to memory of 2968 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 93 PID 2252 wrote to memory of 3972 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 94 PID 2252 wrote to memory of 3972 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 94 PID 2252 wrote to memory of 3244 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 95 PID 2252 wrote to memory of 3244 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 95 PID 2252 wrote to memory of 8 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 96 PID 2252 wrote to memory of 8 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 96 PID 2252 wrote to memory of 1504 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 97 PID 2252 wrote to memory of 1504 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 97 PID 2252 wrote to memory of 4936 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 98 PID 2252 wrote to memory of 4936 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 98 PID 2252 wrote to memory of 4748 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 99 PID 2252 wrote to memory of 4748 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 99 PID 2252 wrote to memory of 4752 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 100 PID 2252 wrote to memory of 4752 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 100 PID 2252 wrote to memory of 2104 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 101 PID 2252 wrote to memory of 2104 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 101 PID 2252 wrote to memory of 4124 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 102 PID 2252 wrote to memory of 4124 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 102 PID 2252 wrote to memory of 1612 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 103 PID 2252 wrote to memory of 1612 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 103 PID 2252 wrote to memory of 2356 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 104 PID 2252 wrote to memory of 2356 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 104 PID 2252 wrote to memory of 1812 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 105 PID 2252 wrote to memory of 1812 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 105 PID 2252 wrote to memory of 4996 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 106 PID 2252 wrote to memory of 4996 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 106 PID 2252 wrote to memory of 1636 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 107 PID 2252 wrote to memory of 1636 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 107 PID 2252 wrote to memory of 2236 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 108 PID 2252 wrote to memory of 2236 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 108 PID 2252 wrote to memory of 1756 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 109 PID 2252 wrote to memory of 1756 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 109 PID 2252 wrote to memory of 3740 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 110 PID 2252 wrote to memory of 3740 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 110 PID 2252 wrote to memory of 1808 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 111 PID 2252 wrote to memory of 1808 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 111 PID 2252 wrote to memory of 3236 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 112 PID 2252 wrote to memory of 3236 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 112 PID 2252 wrote to memory of 2428 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 113 PID 2252 wrote to memory of 2428 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 113 PID 2252 wrote to memory of 4816 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 114 PID 2252 wrote to memory of 4816 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 114 PID 2252 wrote to memory of 896 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 115 PID 2252 wrote to memory of 896 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 115 PID 2252 wrote to memory of 4700 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 116 PID 2252 wrote to memory of 4700 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 116 PID 2252 wrote to memory of 1376 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 117 PID 2252 wrote to memory of 1376 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 117 PID 2252 wrote to memory of 3464 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 118 PID 2252 wrote to memory of 3464 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 118 PID 2252 wrote to memory of 4248 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 119 PID 2252 wrote to memory of 4248 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 119 PID 2252 wrote to memory of 3332 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 120 PID 2252 wrote to memory of 3332 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 120 PID 2252 wrote to memory of 5088 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 121 PID 2252 wrote to memory of 5088 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 121 PID 2252 wrote to memory of 544 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 122 PID 2252 wrote to memory of 544 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 122 PID 2252 wrote to memory of 892 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 123 PID 2252 wrote to memory of 892 2252 0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe 123
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0ea43f5606f25d535a978e1365a61cfb_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\System32\SwuoJCS.exeC:\Windows\System32\SwuoJCS.exe2⤵
- Executes dropped EXE
PID:1588
-
-
C:\Windows\System32\LlZxYwb.exeC:\Windows\System32\LlZxYwb.exe2⤵
- Executes dropped EXE
PID:2968
-
-
C:\Windows\System32\cOfraYS.exeC:\Windows\System32\cOfraYS.exe2⤵
- Executes dropped EXE
PID:3972
-
-
C:\Windows\System32\LgtIPgN.exeC:\Windows\System32\LgtIPgN.exe2⤵
- Executes dropped EXE
PID:3244
-
-
C:\Windows\System32\qTPYMMB.exeC:\Windows\System32\qTPYMMB.exe2⤵
- Executes dropped EXE
PID:8
-
-
C:\Windows\System32\RaxBPSr.exeC:\Windows\System32\RaxBPSr.exe2⤵
- Executes dropped EXE
PID:1504
-
-
C:\Windows\System32\zIaBDdA.exeC:\Windows\System32\zIaBDdA.exe2⤵
- Executes dropped EXE
PID:4936
-
-
C:\Windows\System32\fRPzkQT.exeC:\Windows\System32\fRPzkQT.exe2⤵
- Executes dropped EXE
PID:4748
-
-
C:\Windows\System32\nGvCiuv.exeC:\Windows\System32\nGvCiuv.exe2⤵
- Executes dropped EXE
PID:4752
-
-
C:\Windows\System32\UCgYvER.exeC:\Windows\System32\UCgYvER.exe2⤵
- Executes dropped EXE
PID:2104
-
-
C:\Windows\System32\GPeTKHr.exeC:\Windows\System32\GPeTKHr.exe2⤵
- Executes dropped EXE
PID:4124
-
-
C:\Windows\System32\DJxfiar.exeC:\Windows\System32\DJxfiar.exe2⤵
- Executes dropped EXE
PID:1612
-
-
C:\Windows\System32\hnDeCQX.exeC:\Windows\System32\hnDeCQX.exe2⤵
- Executes dropped EXE
PID:2356
-
-
C:\Windows\System32\rnhMZwP.exeC:\Windows\System32\rnhMZwP.exe2⤵
- Executes dropped EXE
PID:1812
-
-
C:\Windows\System32\TOoUPAR.exeC:\Windows\System32\TOoUPAR.exe2⤵
- Executes dropped EXE
PID:4996
-
-
C:\Windows\System32\Fwfplcc.exeC:\Windows\System32\Fwfplcc.exe2⤵
- Executes dropped EXE
PID:1636
-
-
C:\Windows\System32\nYGlVci.exeC:\Windows\System32\nYGlVci.exe2⤵
- Executes dropped EXE
PID:2236
-
-
C:\Windows\System32\jVelmPn.exeC:\Windows\System32\jVelmPn.exe2⤵
- Executes dropped EXE
PID:1756
-
-
C:\Windows\System32\inyCjnA.exeC:\Windows\System32\inyCjnA.exe2⤵
- Executes dropped EXE
PID:3740
-
-
C:\Windows\System32\eVfuwHU.exeC:\Windows\System32\eVfuwHU.exe2⤵
- Executes dropped EXE
PID:1808
-
-
C:\Windows\System32\sDNJNVx.exeC:\Windows\System32\sDNJNVx.exe2⤵
- Executes dropped EXE
PID:3236
-
-
C:\Windows\System32\YUMGAnv.exeC:\Windows\System32\YUMGAnv.exe2⤵
- Executes dropped EXE
PID:2428
-
-
C:\Windows\System32\HSXenFr.exeC:\Windows\System32\HSXenFr.exe2⤵
- Executes dropped EXE
PID:4816
-
-
C:\Windows\System32\DPTzMGN.exeC:\Windows\System32\DPTzMGN.exe2⤵
- Executes dropped EXE
PID:896
-
-
C:\Windows\System32\tzOeSxN.exeC:\Windows\System32\tzOeSxN.exe2⤵
- Executes dropped EXE
PID:4700
-
-
C:\Windows\System32\PGXZVAI.exeC:\Windows\System32\PGXZVAI.exe2⤵
- Executes dropped EXE
PID:1376
-
-
C:\Windows\System32\nrTjwXN.exeC:\Windows\System32\nrTjwXN.exe2⤵
- Executes dropped EXE
PID:3464
-
-
C:\Windows\System32\BhPjSHo.exeC:\Windows\System32\BhPjSHo.exe2⤵
- Executes dropped EXE
PID:4248
-
-
C:\Windows\System32\wvteKWK.exeC:\Windows\System32\wvteKWK.exe2⤵
- Executes dropped EXE
PID:3332
-
-
C:\Windows\System32\KMDZffa.exeC:\Windows\System32\KMDZffa.exe2⤵
- Executes dropped EXE
PID:5088
-
-
C:\Windows\System32\rulwqAw.exeC:\Windows\System32\rulwqAw.exe2⤵
- Executes dropped EXE
PID:544
-
-
C:\Windows\System32\kVudlAP.exeC:\Windows\System32\kVudlAP.exe2⤵
- Executes dropped EXE
PID:892
-
-
C:\Windows\System32\MmLxYBi.exeC:\Windows\System32\MmLxYBi.exe2⤵
- Executes dropped EXE
PID:2164
-
-
C:\Windows\System32\GXACuOA.exeC:\Windows\System32\GXACuOA.exe2⤵
- Executes dropped EXE
PID:4016
-
-
C:\Windows\System32\dBohhlF.exeC:\Windows\System32\dBohhlF.exe2⤵
- Executes dropped EXE
PID:4056
-
-
C:\Windows\System32\wsjrfmf.exeC:\Windows\System32\wsjrfmf.exe2⤵
- Executes dropped EXE
PID:4464
-
-
C:\Windows\System32\dKSHnPC.exeC:\Windows\System32\dKSHnPC.exe2⤵
- Executes dropped EXE
PID:1592
-
-
C:\Windows\System32\WAnTrBD.exeC:\Windows\System32\WAnTrBD.exe2⤵
- Executes dropped EXE
PID:984
-
-
C:\Windows\System32\PLEiMaw.exeC:\Windows\System32\PLEiMaw.exe2⤵
- Executes dropped EXE
PID:3516
-
-
C:\Windows\System32\aRAgwFj.exeC:\Windows\System32\aRAgwFj.exe2⤵
- Executes dropped EXE
PID:3732
-
-
C:\Windows\System32\fbXwxhO.exeC:\Windows\System32\fbXwxhO.exe2⤵
- Executes dropped EXE
PID:4476
-
-
C:\Windows\System32\igpRwGZ.exeC:\Windows\System32\igpRwGZ.exe2⤵
- Executes dropped EXE
PID:4204
-
-
C:\Windows\System32\jTrndZz.exeC:\Windows\System32\jTrndZz.exe2⤵
- Executes dropped EXE
PID:3544
-
-
C:\Windows\System32\SgMXORu.exeC:\Windows\System32\SgMXORu.exe2⤵
- Executes dropped EXE
PID:952
-
-
C:\Windows\System32\giWTtCC.exeC:\Windows\System32\giWTtCC.exe2⤵
- Executes dropped EXE
PID:1560
-
-
C:\Windows\System32\kDcLiwo.exeC:\Windows\System32\kDcLiwo.exe2⤵
- Executes dropped EXE
PID:1996
-
-
C:\Windows\System32\DJEYqXZ.exeC:\Windows\System32\DJEYqXZ.exe2⤵
- Executes dropped EXE
PID:536
-
-
C:\Windows\System32\YyymhoK.exeC:\Windows\System32\YyymhoK.exe2⤵
- Executes dropped EXE
PID:3452
-
-
C:\Windows\System32\OUlOdcb.exeC:\Windows\System32\OUlOdcb.exe2⤵
- Executes dropped EXE
PID:1992
-
-
C:\Windows\System32\KPRpFhv.exeC:\Windows\System32\KPRpFhv.exe2⤵
- Executes dropped EXE
PID:1848
-
-
C:\Windows\System32\lrIXwRr.exeC:\Windows\System32\lrIXwRr.exe2⤵
- Executes dropped EXE
PID:2108
-
-
C:\Windows\System32\qnsrfjc.exeC:\Windows\System32\qnsrfjc.exe2⤵
- Executes dropped EXE
PID:5028
-
-
C:\Windows\System32\mnJTycu.exeC:\Windows\System32\mnJTycu.exe2⤵
- Executes dropped EXE
PID:1660
-
-
C:\Windows\System32\WjZFVPk.exeC:\Windows\System32\WjZFVPk.exe2⤵
- Executes dropped EXE
PID:2204
-
-
C:\Windows\System32\SPCUnfu.exeC:\Windows\System32\SPCUnfu.exe2⤵
- Executes dropped EXE
PID:4564
-
-
C:\Windows\System32\XItuYEU.exeC:\Windows\System32\XItuYEU.exe2⤵
- Executes dropped EXE
PID:2452
-
-
C:\Windows\System32\uZZUrbB.exeC:\Windows\System32\uZZUrbB.exe2⤵
- Executes dropped EXE
PID:228
-
-
C:\Windows\System32\fYJvoxc.exeC:\Windows\System32\fYJvoxc.exe2⤵
- Executes dropped EXE
PID:2384
-
-
C:\Windows\System32\RGVcVkN.exeC:\Windows\System32\RGVcVkN.exe2⤵
- Executes dropped EXE
PID:1400
-
-
C:\Windows\System32\xUxijaE.exeC:\Windows\System32\xUxijaE.exe2⤵
- Executes dropped EXE
PID:4524
-
-
C:\Windows\System32\YThtCNU.exeC:\Windows\System32\YThtCNU.exe2⤵
- Executes dropped EXE
PID:4684
-
-
C:\Windows\System32\lmnFooO.exeC:\Windows\System32\lmnFooO.exe2⤵
- Executes dropped EXE
PID:404
-
-
C:\Windows\System32\LHzJVsR.exeC:\Windows\System32\LHzJVsR.exe2⤵
- Executes dropped EXE
PID:4180
-
-
C:\Windows\System32\mAvIknW.exeC:\Windows\System32\mAvIknW.exe2⤵
- Executes dropped EXE
PID:3548
-
-
C:\Windows\System32\IJZNCuR.exeC:\Windows\System32\IJZNCuR.exe2⤵PID:4812
-
-
C:\Windows\System32\HTQNKtr.exeC:\Windows\System32\HTQNKtr.exe2⤵PID:2448
-
-
C:\Windows\System32\FPXozrT.exeC:\Windows\System32\FPXozrT.exe2⤵PID:1396
-
-
C:\Windows\System32\oQfqbMU.exeC:\Windows\System32\oQfqbMU.exe2⤵PID:5016
-
-
C:\Windows\System32\OjFfcPd.exeC:\Windows\System32\OjFfcPd.exe2⤵PID:1600
-
-
C:\Windows\System32\KSqEJgO.exeC:\Windows\System32\KSqEJgO.exe2⤵PID:3812
-
-
C:\Windows\System32\VBTYKxs.exeC:\Windows\System32\VBTYKxs.exe2⤵PID:1576
-
-
C:\Windows\System32\hKuxYmk.exeC:\Windows\System32\hKuxYmk.exe2⤵PID:5144
-
-
C:\Windows\System32\eyqKRUE.exeC:\Windows\System32\eyqKRUE.exe2⤵PID:5172
-
-
C:\Windows\System32\BexIKHp.exeC:\Windows\System32\BexIKHp.exe2⤵PID:5204
-
-
C:\Windows\System32\qFGsiHF.exeC:\Windows\System32\qFGsiHF.exe2⤵PID:5240
-
-
C:\Windows\System32\fDEoIKy.exeC:\Windows\System32\fDEoIKy.exe2⤵PID:5264
-
-
C:\Windows\System32\iErhXro.exeC:\Windows\System32\iErhXro.exe2⤵PID:5304
-
-
C:\Windows\System32\kgRGSzo.exeC:\Windows\System32\kgRGSzo.exe2⤵PID:5376
-
-
C:\Windows\System32\vDztdTe.exeC:\Windows\System32\vDztdTe.exe2⤵PID:5404
-
-
C:\Windows\System32\fwglKKt.exeC:\Windows\System32\fwglKKt.exe2⤵PID:5436
-
-
C:\Windows\System32\lDIZWYg.exeC:\Windows\System32\lDIZWYg.exe2⤵PID:5496
-
-
C:\Windows\System32\DPYoJzX.exeC:\Windows\System32\DPYoJzX.exe2⤵PID:5528
-
-
C:\Windows\System32\BuDvLLG.exeC:\Windows\System32\BuDvLLG.exe2⤵PID:5544
-
-
C:\Windows\System32\pZhGWER.exeC:\Windows\System32\pZhGWER.exe2⤵PID:5572
-
-
C:\Windows\System32\DXVmJek.exeC:\Windows\System32\DXVmJek.exe2⤵PID:5608
-
-
C:\Windows\System32\BGYVGdy.exeC:\Windows\System32\BGYVGdy.exe2⤵PID:5628
-
-
C:\Windows\System32\sxczfxL.exeC:\Windows\System32\sxczfxL.exe2⤵PID:5664
-
-
C:\Windows\System32\dYxrwrS.exeC:\Windows\System32\dYxrwrS.exe2⤵PID:5684
-
-
C:\Windows\System32\VOkXVsK.exeC:\Windows\System32\VOkXVsK.exe2⤵PID:5712
-
-
C:\Windows\System32\pMMxFKd.exeC:\Windows\System32\pMMxFKd.exe2⤵PID:5740
-
-
C:\Windows\System32\rSzjSDZ.exeC:\Windows\System32\rSzjSDZ.exe2⤵PID:5764
-
-
C:\Windows\System32\xpWxpVw.exeC:\Windows\System32\xpWxpVw.exe2⤵PID:5792
-
-
C:\Windows\System32\pkFzcAj.exeC:\Windows\System32\pkFzcAj.exe2⤵PID:5820
-
-
C:\Windows\System32\nknjOTL.exeC:\Windows\System32\nknjOTL.exe2⤵PID:5872
-
-
C:\Windows\System32\KpjuMIA.exeC:\Windows\System32\KpjuMIA.exe2⤵PID:5900
-
-
C:\Windows\System32\FxhXdff.exeC:\Windows\System32\FxhXdff.exe2⤵PID:5924
-
-
C:\Windows\System32\PlRrHDG.exeC:\Windows\System32\PlRrHDG.exe2⤵PID:5952
-
-
C:\Windows\System32\QDehiTK.exeC:\Windows\System32\QDehiTK.exe2⤵PID:6024
-
-
C:\Windows\System32\IsVYNsT.exeC:\Windows\System32\IsVYNsT.exe2⤵PID:6044
-
-
C:\Windows\System32\KVczZID.exeC:\Windows\System32\KVczZID.exe2⤵PID:6064
-
-
C:\Windows\System32\VDmDoge.exeC:\Windows\System32\VDmDoge.exe2⤵PID:6108
-
-
C:\Windows\System32\cdIXntX.exeC:\Windows\System32\cdIXntX.exe2⤵PID:6128
-
-
C:\Windows\System32\cnrFvKe.exeC:\Windows\System32\cnrFvKe.exe2⤵PID:3140
-
-
C:\Windows\System32\SkUxHsa.exeC:\Windows\System32\SkUxHsa.exe2⤵PID:4216
-
-
C:\Windows\System32\VGzAcTG.exeC:\Windows\System32\VGzAcTG.exe2⤵PID:1104
-
-
C:\Windows\System32\jBEXMHN.exeC:\Windows\System32\jBEXMHN.exe2⤵PID:5196
-
-
C:\Windows\System32\CRmJiWJ.exeC:\Windows\System32\CRmJiWJ.exe2⤵PID:5212
-
-
C:\Windows\System32\YeRYkWj.exeC:\Windows\System32\YeRYkWj.exe2⤵PID:5256
-
-
C:\Windows\System32\PZfZNZJ.exeC:\Windows\System32\PZfZNZJ.exe2⤵PID:5296
-
-
C:\Windows\System32\PcqUPPz.exeC:\Windows\System32\PcqUPPz.exe2⤵PID:3456
-
-
C:\Windows\System32\gnHMxpi.exeC:\Windows\System32\gnHMxpi.exe2⤵PID:3476
-
-
C:\Windows\System32\CnBbXPD.exeC:\Windows\System32\CnBbXPD.exe2⤵PID:1952
-
-
C:\Windows\System32\QAOJwCJ.exeC:\Windows\System32\QAOJwCJ.exe2⤵PID:5432
-
-
C:\Windows\System32\BdHWSJg.exeC:\Windows\System32\BdHWSJg.exe2⤵PID:5648
-
-
C:\Windows\System32\KxyjflG.exeC:\Windows\System32\KxyjflG.exe2⤵PID:5584
-
-
C:\Windows\System32\lFOpOrJ.exeC:\Windows\System32\lFOpOrJ.exe2⤵PID:5536
-
-
C:\Windows\System32\kjEdbzR.exeC:\Windows\System32\kjEdbzR.exe2⤵PID:5484
-
-
C:\Windows\System32\gXAykkT.exeC:\Windows\System32\gXAykkT.exe2⤵PID:5788
-
-
C:\Windows\System32\GqYhCEY.exeC:\Windows\System32\GqYhCEY.exe2⤵PID:3672
-
-
C:\Windows\System32\nkQdctW.exeC:\Windows\System32\nkQdctW.exe2⤵PID:5828
-
-
C:\Windows\System32\hTFVSud.exeC:\Windows\System32\hTFVSud.exe2⤵PID:5936
-
-
C:\Windows\System32\tWUEJlA.exeC:\Windows\System32\tWUEJlA.exe2⤵PID:5864
-
-
C:\Windows\System32\FCktDNw.exeC:\Windows\System32\FCktDNw.exe2⤵PID:6020
-
-
C:\Windows\System32\fAiwelq.exeC:\Windows\System32\fAiwelq.exe2⤵PID:6056
-
-
C:\Windows\System32\bqZdMjC.exeC:\Windows\System32\bqZdMjC.exe2⤵PID:3748
-
-
C:\Windows\System32\lCZHmNp.exeC:\Windows\System32\lCZHmNp.exe2⤵PID:5384
-
-
C:\Windows\System32\jUZBdLh.exeC:\Windows\System32\jUZBdLh.exe2⤵PID:2136
-
-
C:\Windows\System32\jEBjJEl.exeC:\Windows\System32\jEBjJEl.exe2⤵PID:5372
-
-
C:\Windows\System32\wNuhIPZ.exeC:\Windows\System32\wNuhIPZ.exe2⤵PID:5468
-
-
C:\Windows\System32\vvPfmeu.exeC:\Windows\System32\vvPfmeu.exe2⤵PID:1980
-
-
C:\Windows\System32\OJQmHiS.exeC:\Windows\System32\OJQmHiS.exe2⤵PID:5452
-
-
C:\Windows\System32\LrXcfsg.exeC:\Windows\System32\LrXcfsg.exe2⤵PID:4280
-
-
C:\Windows\System32\uRTQGec.exeC:\Windows\System32\uRTQGec.exe2⤵PID:5704
-
-
C:\Windows\System32\dJzGPzy.exeC:\Windows\System32\dJzGPzy.exe2⤵PID:5456
-
-
C:\Windows\System32\sQkEdGp.exeC:\Windows\System32\sQkEdGp.exe2⤵PID:5748
-
-
C:\Windows\System32\TEWVGUY.exeC:\Windows\System32\TEWVGUY.exe2⤵PID:620
-
-
C:\Windows\System32\rJXiOje.exeC:\Windows\System32\rJXiOje.exe2⤵PID:2532
-
-
C:\Windows\System32\ZHSnXFN.exeC:\Windows\System32\ZHSnXFN.exe2⤵PID:6040
-
-
C:\Windows\System32\JsGbYym.exeC:\Windows\System32\JsGbYym.exe2⤵PID:5316
-
-
C:\Windows\System32\joCRCUW.exeC:\Windows\System32\joCRCUW.exe2⤵PID:5156
-
-
C:\Windows\System32\LOwWvhQ.exeC:\Windows\System32\LOwWvhQ.exe2⤵PID:3096
-
-
C:\Windows\System32\KBpfXji.exeC:\Windows\System32\KBpfXji.exe2⤵PID:6072
-
-
C:\Windows\System32\cDeLyTD.exeC:\Windows\System32\cDeLyTD.exe2⤵PID:5292
-
-
C:\Windows\System32\FtKEgfc.exeC:\Windows\System32\FtKEgfc.exe2⤵PID:5480
-
-
C:\Windows\System32\QlYtLOj.exeC:\Windows\System32\QlYtLOj.exe2⤵PID:1132
-
-
C:\Windows\System32\jPmEhvK.exeC:\Windows\System32\jPmEhvK.exe2⤵PID:5676
-
-
C:\Windows\System32\UWBahOX.exeC:\Windows\System32\UWBahOX.exe2⤵PID:6172
-
-
C:\Windows\System32\JruewnW.exeC:\Windows\System32\JruewnW.exe2⤵PID:6188
-
-
C:\Windows\System32\qDNBSTZ.exeC:\Windows\System32\qDNBSTZ.exe2⤵PID:6208
-
-
C:\Windows\System32\LnDcbYB.exeC:\Windows\System32\LnDcbYB.exe2⤵PID:6244
-
-
C:\Windows\System32\EogouTs.exeC:\Windows\System32\EogouTs.exe2⤵PID:6268
-
-
C:\Windows\System32\LLIlqoN.exeC:\Windows\System32\LLIlqoN.exe2⤵PID:6308
-
-
C:\Windows\System32\iURoYQt.exeC:\Windows\System32\iURoYQt.exe2⤵PID:6328
-
-
C:\Windows\System32\LepgDcp.exeC:\Windows\System32\LepgDcp.exe2⤵PID:6352
-
-
C:\Windows\System32\HfAChuq.exeC:\Windows\System32\HfAChuq.exe2⤵PID:6388
-
-
C:\Windows\System32\uNovwso.exeC:\Windows\System32\uNovwso.exe2⤵PID:6408
-
-
C:\Windows\System32\OSRnoVP.exeC:\Windows\System32\OSRnoVP.exe2⤵PID:6436
-
-
C:\Windows\System32\xvSWMhB.exeC:\Windows\System32\xvSWMhB.exe2⤵PID:6472
-
-
C:\Windows\System32\vjcDpFs.exeC:\Windows\System32\vjcDpFs.exe2⤵PID:6512
-
-
C:\Windows\System32\uZZDfxJ.exeC:\Windows\System32\uZZDfxJ.exe2⤵PID:6532
-
-
C:\Windows\System32\wXdKCOy.exeC:\Windows\System32\wXdKCOy.exe2⤵PID:6560
-
-
C:\Windows\System32\eWemJzW.exeC:\Windows\System32\eWemJzW.exe2⤵PID:6600
-
-
C:\Windows\System32\HMeFPuf.exeC:\Windows\System32\HMeFPuf.exe2⤵PID:6624
-
-
C:\Windows\System32\eWEzXvD.exeC:\Windows\System32\eWEzXvD.exe2⤵PID:6640
-
-
C:\Windows\System32\YZOevMo.exeC:\Windows\System32\YZOevMo.exe2⤵PID:6660
-
-
C:\Windows\System32\EmTcmDg.exeC:\Windows\System32\EmTcmDg.exe2⤵PID:6676
-
-
C:\Windows\System32\hWRtVDV.exeC:\Windows\System32\hWRtVDV.exe2⤵PID:6696
-
-
C:\Windows\System32\WBQwPZK.exeC:\Windows\System32\WBQwPZK.exe2⤵PID:6712
-
-
C:\Windows\System32\oNigNuC.exeC:\Windows\System32\oNigNuC.exe2⤵PID:6736
-
-
C:\Windows\System32\gegnZOc.exeC:\Windows\System32\gegnZOc.exe2⤵PID:6756
-
-
C:\Windows\System32\hRoxUnJ.exeC:\Windows\System32\hRoxUnJ.exe2⤵PID:6804
-
-
C:\Windows\System32\cDMNKtR.exeC:\Windows\System32\cDMNKtR.exe2⤵PID:6864
-
-
C:\Windows\System32\qughcfm.exeC:\Windows\System32\qughcfm.exe2⤵PID:6900
-
-
C:\Windows\System32\MEimMMz.exeC:\Windows\System32\MEimMMz.exe2⤵PID:6924
-
-
C:\Windows\System32\GpUvIIT.exeC:\Windows\System32\GpUvIIT.exe2⤵PID:6952
-
-
C:\Windows\System32\skdTCFC.exeC:\Windows\System32\skdTCFC.exe2⤵PID:6968
-
-
C:\Windows\System32\lotjPyh.exeC:\Windows\System32\lotjPyh.exe2⤵PID:6988
-
-
C:\Windows\System32\uPdKFoI.exeC:\Windows\System32\uPdKFoI.exe2⤵PID:7052
-
-
C:\Windows\System32\OIshEAU.exeC:\Windows\System32\OIshEAU.exe2⤵PID:7076
-
-
C:\Windows\System32\ORGfyoz.exeC:\Windows\System32\ORGfyoz.exe2⤵PID:7104
-
-
C:\Windows\System32\ngGpBtC.exeC:\Windows\System32\ngGpBtC.exe2⤵PID:7124
-
-
C:\Windows\System32\XhSarKP.exeC:\Windows\System32\XhSarKP.exe2⤵PID:7144
-
-
C:\Windows\System32\hjWuebL.exeC:\Windows\System32\hjWuebL.exe2⤵PID:6196
-
-
C:\Windows\System32\GJrrdpX.exeC:\Windows\System32\GJrrdpX.exe2⤵PID:6240
-
-
C:\Windows\System32\QIXuQrm.exeC:\Windows\System32\QIXuQrm.exe2⤵PID:6284
-
-
C:\Windows\System32\CdkEcIg.exeC:\Windows\System32\CdkEcIg.exe2⤵PID:6360
-
-
C:\Windows\System32\VLvtDBh.exeC:\Windows\System32\VLvtDBh.exe2⤵PID:6400
-
-
C:\Windows\System32\vsBmZwg.exeC:\Windows\System32\vsBmZwg.exe2⤵PID:6488
-
-
C:\Windows\System32\SXKYGbv.exeC:\Windows\System32\SXKYGbv.exe2⤵PID:6528
-
-
C:\Windows\System32\fxBeUfh.exeC:\Windows\System32\fxBeUfh.exe2⤵PID:6556
-
-
C:\Windows\System32\VvZtgiV.exeC:\Windows\System32\VvZtgiV.exe2⤵PID:6612
-
-
C:\Windows\System32\wNPArQK.exeC:\Windows\System32\wNPArQK.exe2⤵PID:6728
-
-
C:\Windows\System32\uZSSARd.exeC:\Windows\System32\uZSSARd.exe2⤵PID:6652
-
-
C:\Windows\System32\rDLLXaI.exeC:\Windows\System32\rDLLXaI.exe2⤵PID:6752
-
-
C:\Windows\System32\LsFPAPb.exeC:\Windows\System32\LsFPAPb.exe2⤵PID:6772
-
-
C:\Windows\System32\HVHuqGl.exeC:\Windows\System32\HVHuqGl.exe2⤵PID:6884
-
-
C:\Windows\System32\hjGUCsG.exeC:\Windows\System32\hjGUCsG.exe2⤵PID:6976
-
-
C:\Windows\System32\tbxtQnT.exeC:\Windows\System32\tbxtQnT.exe2⤵PID:6960
-
-
C:\Windows\System32\kXWwnDa.exeC:\Windows\System32\kXWwnDa.exe2⤵PID:7012
-
-
C:\Windows\System32\dTeLaue.exeC:\Windows\System32\dTeLaue.exe2⤵PID:7116
-
-
C:\Windows\System32\hnfWsWF.exeC:\Windows\System32\hnfWsWF.exe2⤵PID:7164
-
-
C:\Windows\System32\mKoJFiD.exeC:\Windows\System32\mKoJFiD.exe2⤵PID:6372
-
-
C:\Windows\System32\kpMMnJu.exeC:\Windows\System32\kpMMnJu.exe2⤵PID:6840
-
-
C:\Windows\System32\uxvTjDm.exeC:\Windows\System32\uxvTjDm.exe2⤵PID:6764
-
-
C:\Windows\System32\zpWRsiP.exeC:\Windows\System32\zpWRsiP.exe2⤵PID:6948
-
-
C:\Windows\System32\yNPRcws.exeC:\Windows\System32\yNPRcws.exe2⤵PID:7136
-
-
C:\Windows\System32\syPBnJc.exeC:\Windows\System32\syPBnJc.exe2⤵PID:6916
-
-
C:\Windows\System32\bcUgcav.exeC:\Windows\System32\bcUgcav.exe2⤵PID:6500
-
-
C:\Windows\System32\tOXOkUP.exeC:\Windows\System32\tOXOkUP.exe2⤵PID:7032
-
-
C:\Windows\System32\fQpzSCP.exeC:\Windows\System32\fQpzSCP.exe2⤵PID:6260
-
-
C:\Windows\System32\CLrvUNO.exeC:\Windows\System32\CLrvUNO.exe2⤵PID:7180
-
-
C:\Windows\System32\HxiOlTE.exeC:\Windows\System32\HxiOlTE.exe2⤵PID:7220
-
-
C:\Windows\System32\YpjjROl.exeC:\Windows\System32\YpjjROl.exe2⤵PID:7236
-
-
C:\Windows\System32\XnJaMlB.exeC:\Windows\System32\XnJaMlB.exe2⤵PID:7264
-
-
C:\Windows\System32\ltKRRem.exeC:\Windows\System32\ltKRRem.exe2⤵PID:7284
-
-
C:\Windows\System32\EKwCuEb.exeC:\Windows\System32\EKwCuEb.exe2⤵PID:7312
-
-
C:\Windows\System32\cdZSzpA.exeC:\Windows\System32\cdZSzpA.exe2⤵PID:7372
-
-
C:\Windows\System32\EqApvdU.exeC:\Windows\System32\EqApvdU.exe2⤵PID:7452
-
-
C:\Windows\System32\vwhquQP.exeC:\Windows\System32\vwhquQP.exe2⤵PID:7484
-
-
C:\Windows\System32\pkEWOVo.exeC:\Windows\System32\pkEWOVo.exe2⤵PID:7500
-
-
C:\Windows\System32\qZKwqNJ.exeC:\Windows\System32\qZKwqNJ.exe2⤵PID:7528
-
-
C:\Windows\System32\GmcYabf.exeC:\Windows\System32\GmcYabf.exe2⤵PID:7544
-
-
C:\Windows\System32\FgIxCnc.exeC:\Windows\System32\FgIxCnc.exe2⤵PID:7560
-
-
C:\Windows\System32\vfuhWze.exeC:\Windows\System32\vfuhWze.exe2⤵PID:7576
-
-
C:\Windows\System32\KAdtpvP.exeC:\Windows\System32\KAdtpvP.exe2⤵PID:7640
-
-
C:\Windows\System32\TBmRtfV.exeC:\Windows\System32\TBmRtfV.exe2⤵PID:7720
-
-
C:\Windows\System32\duvNTvq.exeC:\Windows\System32\duvNTvq.exe2⤵PID:7736
-
-
C:\Windows\System32\rtDTAXw.exeC:\Windows\System32\rtDTAXw.exe2⤵PID:7752
-
-
C:\Windows\System32\QAorTgZ.exeC:\Windows\System32\QAorTgZ.exe2⤵PID:7784
-
-
C:\Windows\System32\NGFdZud.exeC:\Windows\System32\NGFdZud.exe2⤵PID:7804
-
-
C:\Windows\System32\tYFuHSl.exeC:\Windows\System32\tYFuHSl.exe2⤵PID:7820
-
-
C:\Windows\System32\RCltiyK.exeC:\Windows\System32\RCltiyK.exe2⤵PID:7848
-
-
C:\Windows\System32\pPLBrrP.exeC:\Windows\System32\pPLBrrP.exe2⤵PID:7864
-
-
C:\Windows\System32\YZMlYle.exeC:\Windows\System32\YZMlYle.exe2⤵PID:7924
-
-
C:\Windows\System32\IWUzlns.exeC:\Windows\System32\IWUzlns.exe2⤵PID:7964
-
-
C:\Windows\System32\ZaKqjco.exeC:\Windows\System32\ZaKqjco.exe2⤵PID:7992
-
-
C:\Windows\System32\IzWHcnG.exeC:\Windows\System32\IzWHcnG.exe2⤵PID:8008
-
-
C:\Windows\System32\HfyvYRz.exeC:\Windows\System32\HfyvYRz.exe2⤵PID:8032
-
-
C:\Windows\System32\CuVLrQh.exeC:\Windows\System32\CuVLrQh.exe2⤵PID:8060
-
-
C:\Windows\System32\KLGcOKr.exeC:\Windows\System32\KLGcOKr.exe2⤵PID:8148
-
-
C:\Windows\System32\vvfiuLR.exeC:\Windows\System32\vvfiuLR.exe2⤵PID:8164
-
-
C:\Windows\System32\UClDpPv.exeC:\Windows\System32\UClDpPv.exe2⤵PID:8184
-
-
C:\Windows\System32\WEPlSml.exeC:\Windows\System32\WEPlSml.exe2⤵PID:6964
-
-
C:\Windows\System32\FkWNdPZ.exeC:\Windows\System32\FkWNdPZ.exe2⤵PID:7212
-
-
C:\Windows\System32\JCSzJGV.exeC:\Windows\System32\JCSzJGV.exe2⤵PID:7280
-
-
C:\Windows\System32\EzHTGJn.exeC:\Windows\System32\EzHTGJn.exe2⤵PID:7248
-
-
C:\Windows\System32\QchcZSv.exeC:\Windows\System32\QchcZSv.exe2⤵PID:7320
-
-
C:\Windows\System32\OqLzXRe.exeC:\Windows\System32\OqLzXRe.exe2⤵PID:7392
-
-
C:\Windows\System32\qNQXflj.exeC:\Windows\System32\qNQXflj.exe2⤵PID:7400
-
-
C:\Windows\System32\ERdyMfu.exeC:\Windows\System32\ERdyMfu.exe2⤵PID:7512
-
-
C:\Windows\System32\ICSiptk.exeC:\Windows\System32\ICSiptk.exe2⤵PID:7508
-
-
C:\Windows\System32\VnrFnBb.exeC:\Windows\System32\VnrFnBb.exe2⤵PID:7540
-
-
C:\Windows\System32\kdfdyDX.exeC:\Windows\System32\kdfdyDX.exe2⤵PID:7648
-
-
C:\Windows\System32\KfotZui.exeC:\Windows\System32\KfotZui.exe2⤵PID:7656
-
-
C:\Windows\System32\gmYxXeW.exeC:\Windows\System32\gmYxXeW.exe2⤵PID:7816
-
-
C:\Windows\System32\AjWTsfr.exeC:\Windows\System32\AjWTsfr.exe2⤵PID:7884
-
-
C:\Windows\System32\xABadUj.exeC:\Windows\System32\xABadUj.exe2⤵PID:7920
-
-
C:\Windows\System32\GhjVKpo.exeC:\Windows\System32\GhjVKpo.exe2⤵PID:7960
-
-
C:\Windows\System32\PgXFCAH.exeC:\Windows\System32\PgXFCAH.exe2⤵PID:8024
-
-
C:\Windows\System32\leYkBQG.exeC:\Windows\System32\leYkBQG.exe2⤵PID:8056
-
-
C:\Windows\System32\QveiTcG.exeC:\Windows\System32\QveiTcG.exe2⤵PID:8120
-
-
C:\Windows\System32\rdfAxkQ.exeC:\Windows\System32\rdfAxkQ.exe2⤵PID:8180
-
-
C:\Windows\System32\ToApNmI.exeC:\Windows\System32\ToApNmI.exe2⤵PID:7396
-
-
C:\Windows\System32\WTHHvWL.exeC:\Windows\System32\WTHHvWL.exe2⤵PID:7344
-
-
C:\Windows\System32\FEKPVvZ.exeC:\Windows\System32\FEKPVvZ.exe2⤵PID:7412
-
-
C:\Windows\System32\qFzMwfA.exeC:\Windows\System32\qFzMwfA.exe2⤵PID:7704
-
-
C:\Windows\System32\WKBXgaw.exeC:\Windows\System32\WKBXgaw.exe2⤵PID:7772
-
-
C:\Windows\System32\mUKkcLL.exeC:\Windows\System32\mUKkcLL.exe2⤵PID:7976
-
-
C:\Windows\System32\PtgPvnQ.exeC:\Windows\System32\PtgPvnQ.exe2⤵PID:8048
-
-
C:\Windows\System32\PcTqlPm.exeC:\Windows\System32\PcTqlPm.exe2⤵PID:7232
-
-
C:\Windows\System32\koGnskK.exeC:\Windows\System32\koGnskK.exe2⤵PID:7380
-
-
C:\Windows\System32\dvbzVRH.exeC:\Windows\System32\dvbzVRH.exe2⤵PID:7728
-
-
C:\Windows\System32\kuMjMXD.exeC:\Windows\System32\kuMjMXD.exe2⤵PID:7768
-
-
C:\Windows\System32\ailwpXn.exeC:\Windows\System32\ailwpXn.exe2⤵PID:7364
-
-
C:\Windows\System32\oaqiJKQ.exeC:\Windows\System32\oaqiJKQ.exe2⤵PID:7624
-
-
C:\Windows\System32\PGRGiUi.exeC:\Windows\System32\PGRGiUi.exe2⤵PID:8224
-
-
C:\Windows\System32\mkkmyho.exeC:\Windows\System32\mkkmyho.exe2⤵PID:8272
-
-
C:\Windows\System32\gKldtix.exeC:\Windows\System32\gKldtix.exe2⤵PID:8316
-
-
C:\Windows\System32\jRvWIXU.exeC:\Windows\System32\jRvWIXU.exe2⤵PID:8348
-
-
C:\Windows\System32\BucJYbL.exeC:\Windows\System32\BucJYbL.exe2⤵PID:8392
-
-
C:\Windows\System32\Utwfxfb.exeC:\Windows\System32\Utwfxfb.exe2⤵PID:8420
-
-
C:\Windows\System32\JLjLoBt.exeC:\Windows\System32\JLjLoBt.exe2⤵PID:8436
-
-
C:\Windows\System32\uzndwpS.exeC:\Windows\System32\uzndwpS.exe2⤵PID:8468
-
-
C:\Windows\System32\ZzPswOa.exeC:\Windows\System32\ZzPswOa.exe2⤵PID:8496
-
-
C:\Windows\System32\TZwgxMe.exeC:\Windows\System32\TZwgxMe.exe2⤵PID:8532
-
-
C:\Windows\System32\wowjvbO.exeC:\Windows\System32\wowjvbO.exe2⤵PID:8556
-
-
C:\Windows\System32\VcyHqaW.exeC:\Windows\System32\VcyHqaW.exe2⤵PID:8576
-
-
C:\Windows\System32\fmfVrDV.exeC:\Windows\System32\fmfVrDV.exe2⤵PID:8608
-
-
C:\Windows\System32\eQbnnlI.exeC:\Windows\System32\eQbnnlI.exe2⤵PID:8640
-
-
C:\Windows\System32\UxrXOeC.exeC:\Windows\System32\UxrXOeC.exe2⤵PID:8664
-
-
C:\Windows\System32\rJKnZbQ.exeC:\Windows\System32\rJKnZbQ.exe2⤵PID:8684
-
-
C:\Windows\System32\iMkfhxC.exeC:\Windows\System32\iMkfhxC.exe2⤵PID:8708
-
-
C:\Windows\System32\mcBGleV.exeC:\Windows\System32\mcBGleV.exe2⤵PID:8728
-
-
C:\Windows\System32\swOqjea.exeC:\Windows\System32\swOqjea.exe2⤵PID:8744
-
-
C:\Windows\System32\mtnGplF.exeC:\Windows\System32\mtnGplF.exe2⤵PID:8764
-
-
C:\Windows\System32\ghKxeqM.exeC:\Windows\System32\ghKxeqM.exe2⤵PID:8784
-
-
C:\Windows\System32\YDDRYYZ.exeC:\Windows\System32\YDDRYYZ.exe2⤵PID:8820
-
-
C:\Windows\System32\AGppdHe.exeC:\Windows\System32\AGppdHe.exe2⤵PID:8860
-
-
C:\Windows\System32\CgMzriC.exeC:\Windows\System32\CgMzriC.exe2⤵PID:8884
-
-
C:\Windows\System32\IpvcgVE.exeC:\Windows\System32\IpvcgVE.exe2⤵PID:8904
-
-
C:\Windows\System32\yOlApHt.exeC:\Windows\System32\yOlApHt.exe2⤵PID:8948
-
-
C:\Windows\System32\HCfhtEs.exeC:\Windows\System32\HCfhtEs.exe2⤵PID:8964
-
-
C:\Windows\System32\bOHDtBA.exeC:\Windows\System32\bOHDtBA.exe2⤵PID:8992
-
-
C:\Windows\System32\bnDsZjj.exeC:\Windows\System32\bnDsZjj.exe2⤵PID:9012
-
-
C:\Windows\System32\WRUVIxB.exeC:\Windows\System32\WRUVIxB.exe2⤵PID:9032
-
-
C:\Windows\System32\pfpHPgw.exeC:\Windows\System32\pfpHPgw.exe2⤵PID:9076
-
-
C:\Windows\System32\mlePizQ.exeC:\Windows\System32\mlePizQ.exe2⤵PID:9120
-
-
C:\Windows\System32\hfXQjWU.exeC:\Windows\System32\hfXQjWU.exe2⤵PID:9148
-
-
C:\Windows\System32\CaufHeL.exeC:\Windows\System32\CaufHeL.exe2⤵PID:9180
-
-
C:\Windows\System32\SnfckJA.exeC:\Windows\System32\SnfckJA.exe2⤵PID:9196
-
-
C:\Windows\System32\eMItTTL.exeC:\Windows\System32\eMItTTL.exe2⤵PID:9212
-
-
C:\Windows\System32\ApQAwrk.exeC:\Windows\System32\ApQAwrk.exe2⤵PID:7568
-
-
C:\Windows\System32\tMIhIwV.exeC:\Windows\System32\tMIhIwV.exe2⤵PID:8216
-
-
C:\Windows\System32\MXCCWcT.exeC:\Windows\System32\MXCCWcT.exe2⤵PID:8284
-
-
C:\Windows\System32\LpjucQP.exeC:\Windows\System32\LpjucQP.exe2⤵PID:8336
-
-
C:\Windows\System32\AEHHJrH.exeC:\Windows\System32\AEHHJrH.exe2⤵PID:8540
-
-
C:\Windows\System32\awFrEOh.exeC:\Windows\System32\awFrEOh.exe2⤵PID:8592
-
-
C:\Windows\System32\TodjiGv.exeC:\Windows\System32\TodjiGv.exe2⤵PID:8700
-
-
C:\Windows\System32\lzKJNUM.exeC:\Windows\System32\lzKJNUM.exe2⤵PID:8792
-
-
C:\Windows\System32\YORsdJJ.exeC:\Windows\System32\YORsdJJ.exe2⤵PID:8724
-
-
C:\Windows\System32\qRubdws.exeC:\Windows\System32\qRubdws.exe2⤵PID:8872
-
-
C:\Windows\System32\xIQSCcv.exeC:\Windows\System32\xIQSCcv.exe2⤵PID:3284
-
-
C:\Windows\System32\LZyiiwG.exeC:\Windows\System32\LZyiiwG.exe2⤵PID:8868
-
-
C:\Windows\System32\pfFunYU.exeC:\Windows\System32\pfFunYU.exe2⤵PID:8944
-
-
C:\Windows\System32\jMSeqgp.exeC:\Windows\System32\jMSeqgp.exe2⤵PID:9112
-
-
C:\Windows\System32\fNHPtLO.exeC:\Windows\System32\fNHPtLO.exe2⤵PID:9172
-
-
C:\Windows\System32\bRURbeX.exeC:\Windows\System32\bRURbeX.exe2⤵PID:8200
-
-
C:\Windows\System32\bQddyJC.exeC:\Windows\System32\bQddyJC.exe2⤵PID:8380
-
-
C:\Windows\System32\WsnvCSt.exeC:\Windows\System32\WsnvCSt.exe2⤵PID:8516
-
-
C:\Windows\System32\BWfFGaX.exeC:\Windows\System32\BWfFGaX.exe2⤵PID:8572
-
-
C:\Windows\System32\cNAgvyl.exeC:\Windows\System32\cNAgvyl.exe2⤵PID:8840
-
-
C:\Windows\System32\jXYiplB.exeC:\Windows\System32\jXYiplB.exe2⤵PID:9008
-
-
C:\Windows\System32\vaDSPiM.exeC:\Windows\System32\vaDSPiM.exe2⤵PID:9116
-
-
C:\Windows\System32\aqSAVWO.exeC:\Windows\System32\aqSAVWO.exe2⤵PID:9104
-
-
C:\Windows\System32\rqsFQkp.exeC:\Windows\System32\rqsFQkp.exe2⤵PID:8388
-
-
C:\Windows\System32\lgfgdbT.exeC:\Windows\System32\lgfgdbT.exe2⤵PID:8812
-
-
C:\Windows\System32\sWQsUoo.exeC:\Windows\System32\sWQsUoo.exe2⤵PID:8356
-
-
C:\Windows\System32\ZBVyuwt.exeC:\Windows\System32\ZBVyuwt.exe2⤵PID:8288
-
-
C:\Windows\System32\OJyXYDs.exeC:\Windows\System32\OJyXYDs.exe2⤵PID:9256
-
-
C:\Windows\System32\YbGaiuB.exeC:\Windows\System32\YbGaiuB.exe2⤵PID:9280
-
-
C:\Windows\System32\nYjTUii.exeC:\Windows\System32\nYjTUii.exe2⤵PID:9308
-
-
C:\Windows\System32\kgUYFte.exeC:\Windows\System32\kgUYFte.exe2⤵PID:9344
-
-
C:\Windows\System32\wtjUuga.exeC:\Windows\System32\wtjUuga.exe2⤵PID:9372
-
-
C:\Windows\System32\SsdBzxq.exeC:\Windows\System32\SsdBzxq.exe2⤵PID:9396
-
-
C:\Windows\System32\CUUJWLr.exeC:\Windows\System32\CUUJWLr.exe2⤵PID:9412
-
-
C:\Windows\System32\tJKIrMx.exeC:\Windows\System32\tJKIrMx.exe2⤵PID:9436
-
-
C:\Windows\System32\BLlqUZr.exeC:\Windows\System32\BLlqUZr.exe2⤵PID:9456
-
-
C:\Windows\System32\jYxfKxQ.exeC:\Windows\System32\jYxfKxQ.exe2⤵PID:9476
-
-
C:\Windows\System32\GjmutjV.exeC:\Windows\System32\GjmutjV.exe2⤵PID:9548
-
-
C:\Windows\System32\DpLeAbF.exeC:\Windows\System32\DpLeAbF.exe2⤵PID:9600
-
-
C:\Windows\System32\jzblSuc.exeC:\Windows\System32\jzblSuc.exe2⤵PID:9652
-
-
C:\Windows\System32\DdAACHz.exeC:\Windows\System32\DdAACHz.exe2⤵PID:9668
-
-
C:\Windows\System32\gXrGJgy.exeC:\Windows\System32\gXrGJgy.exe2⤵PID:9692
-
-
C:\Windows\System32\NyQilHW.exeC:\Windows\System32\NyQilHW.exe2⤵PID:9712
-
-
C:\Windows\System32\dNsLMvg.exeC:\Windows\System32\dNsLMvg.exe2⤵PID:9740
-
-
C:\Windows\System32\XqjERro.exeC:\Windows\System32\XqjERro.exe2⤵PID:9760
-
-
C:\Windows\System32\pZYWpXz.exeC:\Windows\System32\pZYWpXz.exe2⤵PID:9784
-
-
C:\Windows\System32\oeGTtTJ.exeC:\Windows\System32\oeGTtTJ.exe2⤵PID:9824
-
-
C:\Windows\System32\hhlWeKO.exeC:\Windows\System32\hhlWeKO.exe2⤵PID:9880
-
-
C:\Windows\System32\OVwOnpp.exeC:\Windows\System32\OVwOnpp.exe2⤵PID:9896
-
-
C:\Windows\System32\QzeGwrX.exeC:\Windows\System32\QzeGwrX.exe2⤵PID:9920
-
-
C:\Windows\System32\LTrcDoQ.exeC:\Windows\System32\LTrcDoQ.exe2⤵PID:9940
-
-
C:\Windows\System32\sYdyScy.exeC:\Windows\System32\sYdyScy.exe2⤵PID:9964
-
-
C:\Windows\System32\oLCWsLw.exeC:\Windows\System32\oLCWsLw.exe2⤵PID:10004
-
-
C:\Windows\System32\rNAKwzW.exeC:\Windows\System32\rNAKwzW.exe2⤵PID:10020
-
-
C:\Windows\System32\lwYbxcq.exeC:\Windows\System32\lwYbxcq.exe2⤵PID:10052
-
-
C:\Windows\System32\ChBvLcv.exeC:\Windows\System32\ChBvLcv.exe2⤵PID:10076
-
-
C:\Windows\System32\wVtmdKC.exeC:\Windows\System32\wVtmdKC.exe2⤵PID:10096
-
-
C:\Windows\System32\LiDIGgy.exeC:\Windows\System32\LiDIGgy.exe2⤵PID:10120
-
-
C:\Windows\System32\ZclRLxX.exeC:\Windows\System32\ZclRLxX.exe2⤵PID:10148
-
-
C:\Windows\System32\qXWjbDy.exeC:\Windows\System32\qXWjbDy.exe2⤵PID:10192
-
-
C:\Windows\System32\XpseCjb.exeC:\Windows\System32\XpseCjb.exe2⤵PID:10212
-
-
C:\Windows\System32\YObGKlg.exeC:\Windows\System32\YObGKlg.exe2⤵PID:8780
-
-
C:\Windows\System32\GftWfDZ.exeC:\Windows\System32\GftWfDZ.exe2⤵PID:9188
-
-
C:\Windows\System32\lIlCdhQ.exeC:\Windows\System32\lIlCdhQ.exe2⤵PID:9408
-
-
C:\Windows\System32\rlREqpA.exeC:\Windows\System32\rlREqpA.exe2⤵PID:9452
-
-
C:\Windows\System32\xbaviUb.exeC:\Windows\System32\xbaviUb.exe2⤵PID:9472
-
-
C:\Windows\System32\RxYYKhW.exeC:\Windows\System32\RxYYKhW.exe2⤵PID:9500
-
-
C:\Windows\System32\SiHYNyc.exeC:\Windows\System32\SiHYNyc.exe2⤵PID:9564
-
-
C:\Windows\System32\tNiOean.exeC:\Windows\System32\tNiOean.exe2⤵PID:9660
-
-
C:\Windows\System32\PEfQowK.exeC:\Windows\System32\PEfQowK.exe2⤵PID:9708
-
-
C:\Windows\System32\hdaGrHp.exeC:\Windows\System32\hdaGrHp.exe2⤵PID:9732
-
-
C:\Windows\System32\gQqlfnW.exeC:\Windows\System32\gQqlfnW.exe2⤵PID:9792
-
-
C:\Windows\System32\YDRMNuP.exeC:\Windows\System32\YDRMNuP.exe2⤵PID:9812
-
-
C:\Windows\System32\AamUNCH.exeC:\Windows\System32\AamUNCH.exe2⤵PID:9872
-
-
C:\Windows\System32\wsewkZc.exeC:\Windows\System32\wsewkZc.exe2⤵PID:9904
-
-
C:\Windows\System32\ScFdknM.exeC:\Windows\System32\ScFdknM.exe2⤵PID:9928
-
-
C:\Windows\System32\OSYRZBL.exeC:\Windows\System32\OSYRZBL.exe2⤵PID:9984
-
-
C:\Windows\System32\NiXAinO.exeC:\Windows\System32\NiXAinO.exe2⤵PID:10048
-
-
C:\Windows\System32\kdemZap.exeC:\Windows\System32\kdemZap.exe2⤵PID:10092
-
-
C:\Windows\System32\ElbqsHK.exeC:\Windows\System32\ElbqsHK.exe2⤵PID:10132
-
-
C:\Windows\System32\rbLWeEA.exeC:\Windows\System32\rbLWeEA.exe2⤵PID:9336
-
-
C:\Windows\System32\pYzoCxB.exeC:\Windows\System32\pYzoCxB.exe2⤵PID:9556
-
-
C:\Windows\System32\pQDxFwB.exeC:\Windows\System32\pQDxFwB.exe2⤵PID:2244
-
-
C:\Windows\System32\xBXsjOZ.exeC:\Windows\System32\xBXsjOZ.exe2⤵PID:9352
-
-
C:\Windows\System32\vwBDqLM.exeC:\Windows\System32\vwBDqLM.exe2⤵PID:9852
-
-
C:\Windows\System32\noHIVpH.exeC:\Windows\System32\noHIVpH.exe2⤵PID:9948
-
-
C:\Windows\System32\nnYqcia.exeC:\Windows\System32\nnYqcia.exe2⤵PID:10012
-
-
C:\Windows\System32\rGJHEls.exeC:\Windows\System32\rGJHEls.exe2⤵PID:9704
-
-
C:\Windows\System32\SSjztQt.exeC:\Windows\System32\SSjztQt.exe2⤵PID:9860
-
-
C:\Windows\System32\OdGhgax.exeC:\Windows\System32\OdGhgax.exe2⤵PID:9288
-
-
C:\Windows\System32\vRqbhRi.exeC:\Windows\System32\vRqbhRi.exe2⤵PID:9328
-
-
C:\Windows\System32\PyHngjg.exeC:\Windows\System32\PyHngjg.exe2⤵PID:10280
-
-
C:\Windows\System32\vOBDKRZ.exeC:\Windows\System32\vOBDKRZ.exe2⤵PID:10328
-
-
C:\Windows\System32\kBeLcLi.exeC:\Windows\System32\kBeLcLi.exe2⤵PID:10344
-
-
C:\Windows\System32\MtpENhY.exeC:\Windows\System32\MtpENhY.exe2⤵PID:10360
-
-
C:\Windows\System32\CIxloeR.exeC:\Windows\System32\CIxloeR.exe2⤵PID:10388
-
-
C:\Windows\System32\aaLcAOI.exeC:\Windows\System32\aaLcAOI.exe2⤵PID:10404
-
-
C:\Windows\System32\OmgvMPg.exeC:\Windows\System32\OmgvMPg.exe2⤵PID:10424
-
-
C:\Windows\System32\aQOzvfk.exeC:\Windows\System32\aQOzvfk.exe2⤵PID:10452
-
-
C:\Windows\System32\nIhlqpn.exeC:\Windows\System32\nIhlqpn.exe2⤵PID:10488
-
-
C:\Windows\System32\PkdlvYC.exeC:\Windows\System32\PkdlvYC.exe2⤵PID:10588
-
-
C:\Windows\System32\iVxSsoc.exeC:\Windows\System32\iVxSsoc.exe2⤵PID:10648
-
-
C:\Windows\System32\MtlxgFd.exeC:\Windows\System32\MtlxgFd.exe2⤵PID:10668
-
-
C:\Windows\System32\LyGwKDm.exeC:\Windows\System32\LyGwKDm.exe2⤵PID:10684
-
-
C:\Windows\System32\SPTgOeA.exeC:\Windows\System32\SPTgOeA.exe2⤵PID:10736
-
-
C:\Windows\System32\buStTMt.exeC:\Windows\System32\buStTMt.exe2⤵PID:10784
-
-
C:\Windows\System32\JxawWQh.exeC:\Windows\System32\JxawWQh.exe2⤵PID:10816
-
-
C:\Windows\System32\GGUdIVv.exeC:\Windows\System32\GGUdIVv.exe2⤵PID:10844
-
-
C:\Windows\System32\pPeoRrr.exeC:\Windows\System32\pPeoRrr.exe2⤵PID:10884
-
-
C:\Windows\System32\DQrieQj.exeC:\Windows\System32\DQrieQj.exe2⤵PID:10912
-
-
C:\Windows\System32\qEEQfFo.exeC:\Windows\System32\qEEQfFo.exe2⤵PID:10928
-
-
C:\Windows\System32\RVdXXTH.exeC:\Windows\System32\RVdXXTH.exe2⤵PID:10948
-
-
C:\Windows\System32\BuHdiXU.exeC:\Windows\System32\BuHdiXU.exe2⤵PID:10972
-
-
C:\Windows\System32\FWvuwDu.exeC:\Windows\System32\FWvuwDu.exe2⤵PID:11008
-
-
C:\Windows\System32\ONlgLgl.exeC:\Windows\System32\ONlgLgl.exe2⤵PID:11060
-
-
C:\Windows\System32\BAmmbNJ.exeC:\Windows\System32\BAmmbNJ.exe2⤵PID:11092
-
-
C:\Windows\System32\PhMjJmY.exeC:\Windows\System32\PhMjJmY.exe2⤵PID:11108
-
-
C:\Windows\System32\JeEPVNq.exeC:\Windows\System32\JeEPVNq.exe2⤵PID:11136
-
-
C:\Windows\System32\tozlUxk.exeC:\Windows\System32\tozlUxk.exe2⤵PID:11156
-
-
C:\Windows\System32\PrJYpTG.exeC:\Windows\System32\PrJYpTG.exe2⤵PID:11172
-
-
C:\Windows\System32\YHMKWVE.exeC:\Windows\System32\YHMKWVE.exe2⤵PID:11200
-
-
C:\Windows\System32\CqJbrMU.exeC:\Windows\System32\CqJbrMU.exe2⤵PID:11228
-
-
C:\Windows\System32\KfORoEO.exeC:\Windows\System32\KfORoEO.exe2⤵PID:11244
-
-
C:\Windows\System32\VujSCiW.exeC:\Windows\System32\VujSCiW.exe2⤵PID:9404
-
-
C:\Windows\System32\fibBjhj.exeC:\Windows\System32\fibBjhj.exe2⤵PID:10040
-
-
C:\Windows\System32\FQIOOMz.exeC:\Windows\System32\FQIOOMz.exe2⤵PID:10384
-
-
C:\Windows\System32\vOSfYFH.exeC:\Windows\System32\vOSfYFH.exe2⤵PID:10496
-
-
C:\Windows\System32\imkIvsu.exeC:\Windows\System32\imkIvsu.exe2⤵PID:10380
-
-
C:\Windows\System32\RfLCVOj.exeC:\Windows\System32\RfLCVOj.exe2⤵PID:10272
-
-
C:\Windows\System32\nlnIbRy.exeC:\Windows\System32\nlnIbRy.exe2⤵PID:10324
-
-
C:\Windows\System32\IhOATJY.exeC:\Windows\System32\IhOATJY.exe2⤵PID:10400
-
-
C:\Windows\System32\EjFoEjz.exeC:\Windows\System32\EjFoEjz.exe2⤵PID:10352
-
-
C:\Windows\System32\UxThkGw.exeC:\Windows\System32\UxThkGw.exe2⤵PID:10748
-
-
C:\Windows\System32\pxysple.exeC:\Windows\System32\pxysple.exe2⤵PID:10856
-
-
C:\Windows\System32\tIchYdD.exeC:\Windows\System32\tIchYdD.exe2⤵PID:10900
-
-
C:\Windows\System32\UEENszF.exeC:\Windows\System32\UEENszF.exe2⤵PID:10956
-
-
C:\Windows\System32\PgOVOrL.exeC:\Windows\System32\PgOVOrL.exe2⤵PID:11020
-
-
C:\Windows\System32\ZKgBIIa.exeC:\Windows\System32\ZKgBIIa.exe2⤵PID:11088
-
-
C:\Windows\System32\CZYFopk.exeC:\Windows\System32\CZYFopk.exe2⤵PID:11152
-
-
C:\Windows\System32\FbRmUtM.exeC:\Windows\System32\FbRmUtM.exe2⤵PID:11196
-
-
C:\Windows\System32\RxpfDzW.exeC:\Windows\System32\RxpfDzW.exe2⤵PID:11240
-
-
C:\Windows\System32\nFEoFle.exeC:\Windows\System32\nFEoFle.exe2⤵PID:10260
-
-
C:\Windows\System32\rbjCQnI.exeC:\Windows\System32\rbjCQnI.exe2⤵PID:10548
-
-
C:\Windows\System32\HUwqEyh.exeC:\Windows\System32\HUwqEyh.exe2⤵PID:9608
-
-
C:\Windows\System32\bmSYQFN.exeC:\Windows\System32\bmSYQFN.exe2⤵PID:10632
-
-
C:\Windows\System32\eHKdyZv.exeC:\Windows\System32\eHKdyZv.exe2⤵PID:10804
-
-
C:\Windows\System32\DnzqlGa.exeC:\Windows\System32\DnzqlGa.exe2⤵PID:10944
-
-
C:\Windows\System32\TyThZRn.exeC:\Windows\System32\TyThZRn.exe2⤵PID:9808
-
-
C:\Windows\System32\olQFaWv.exeC:\Windows\System32\olQFaWv.exe2⤵PID:10444
-
-
C:\Windows\System32\KbznNnE.exeC:\Windows\System32\KbznNnE.exe2⤵PID:11236
-
-
C:\Windows\System32\uTdgYgm.exeC:\Windows\System32\uTdgYgm.exe2⤵PID:11252
-
-
C:\Windows\System32\wicJnnJ.exeC:\Windows\System32\wicJnnJ.exe2⤵PID:10656
-
-
C:\Windows\System32\mVcEwlC.exeC:\Windows\System32\mVcEwlC.exe2⤵PID:3808
-
-
C:\Windows\System32\GGDqvwH.exeC:\Windows\System32\GGDqvwH.exe2⤵PID:11276
-
-
C:\Windows\System32\dDrHxIq.exeC:\Windows\System32\dDrHxIq.exe2⤵PID:11304
-
-
C:\Windows\System32\MUQIaWN.exeC:\Windows\System32\MUQIaWN.exe2⤵PID:11340
-
-
C:\Windows\System32\bMEPOCh.exeC:\Windows\System32\bMEPOCh.exe2⤵PID:11372
-
-
C:\Windows\System32\hvZkJbd.exeC:\Windows\System32\hvZkJbd.exe2⤵PID:11424
-
-
C:\Windows\System32\DqpvsWD.exeC:\Windows\System32\DqpvsWD.exe2⤵PID:11452
-
-
C:\Windows\System32\hqiTmOd.exeC:\Windows\System32\hqiTmOd.exe2⤵PID:11496
-
-
C:\Windows\System32\eyhheLI.exeC:\Windows\System32\eyhheLI.exe2⤵PID:11520
-
-
C:\Windows\System32\jAOcRBK.exeC:\Windows\System32\jAOcRBK.exe2⤵PID:11548
-
-
C:\Windows\System32\dEPlJIZ.exeC:\Windows\System32\dEPlJIZ.exe2⤵PID:11568
-
-
C:\Windows\System32\tfsCZHy.exeC:\Windows\System32\tfsCZHy.exe2⤵PID:11620
-
-
C:\Windows\System32\QogoQJB.exeC:\Windows\System32\QogoQJB.exe2⤵PID:11644
-
-
C:\Windows\System32\wdcoslg.exeC:\Windows\System32\wdcoslg.exe2⤵PID:11664
-
-
C:\Windows\System32\rkZwtYO.exeC:\Windows\System32\rkZwtYO.exe2⤵PID:11688
-
-
C:\Windows\System32\sXImNah.exeC:\Windows\System32\sXImNah.exe2⤵PID:11704
-
-
C:\Windows\System32\JxynckT.exeC:\Windows\System32\JxynckT.exe2⤵PID:11760
-
-
C:\Windows\System32\gTMUQJI.exeC:\Windows\System32\gTMUQJI.exe2⤵PID:11804
-
-
C:\Windows\System32\ZwdfdEW.exeC:\Windows\System32\ZwdfdEW.exe2⤵PID:11840
-
-
C:\Windows\System32\rIwlmjk.exeC:\Windows\System32\rIwlmjk.exe2⤵PID:11872
-
-
C:\Windows\System32\lzHNNLb.exeC:\Windows\System32\lzHNNLb.exe2⤵PID:11888
-
-
C:\Windows\System32\YTzfBgn.exeC:\Windows\System32\YTzfBgn.exe2⤵PID:11928
-
-
C:\Windows\System32\WcUyFhr.exeC:\Windows\System32\WcUyFhr.exe2⤵PID:11964
-
-
C:\Windows\System32\TvLnwKF.exeC:\Windows\System32\TvLnwKF.exe2⤵PID:11992
-
-
C:\Windows\System32\mkmzXoG.exeC:\Windows\System32\mkmzXoG.exe2⤵PID:12036
-
-
C:\Windows\System32\RZTvIAy.exeC:\Windows\System32\RZTvIAy.exe2⤵PID:12060
-
-
C:\Windows\System32\JRAnArN.exeC:\Windows\System32\JRAnArN.exe2⤵PID:12100
-
-
C:\Windows\System32\iOsNapL.exeC:\Windows\System32\iOsNapL.exe2⤵PID:12116
-
-
C:\Windows\System32\SdFlYOC.exeC:\Windows\System32\SdFlYOC.exe2⤵PID:12156
-
-
C:\Windows\System32\SQxFHCM.exeC:\Windows\System32\SQxFHCM.exe2⤵PID:12180
-
-
C:\Windows\System32\OwtnfPz.exeC:\Windows\System32\OwtnfPz.exe2⤵PID:12200
-
-
C:\Windows\System32\GQUgCsz.exeC:\Windows\System32\GQUgCsz.exe2⤵PID:12224
-
-
C:\Windows\System32\ImjsiHs.exeC:\Windows\System32\ImjsiHs.exe2⤵PID:12256
-
-
C:\Windows\System32\eVROMGf.exeC:\Windows\System32\eVROMGf.exe2⤵PID:10556
-
-
C:\Windows\System32\NrErfHz.exeC:\Windows\System32\NrErfHz.exe2⤵PID:11324
-
-
C:\Windows\System32\rLQufBZ.exeC:\Windows\System32\rLQufBZ.exe2⤵PID:11384
-
-
C:\Windows\System32\UqsfFYQ.exeC:\Windows\System32\UqsfFYQ.exe2⤵PID:11480
-
-
C:\Windows\System32\xvaxhVV.exeC:\Windows\System32\xvaxhVV.exe2⤵PID:11576
-
-
C:\Windows\System32\WQdEZxq.exeC:\Windows\System32\WQdEZxq.exe2⤵PID:2240
-
-
C:\Windows\System32\sPnytsE.exeC:\Windows\System32\sPnytsE.exe2⤵PID:11672
-
-
C:\Windows\System32\vtxmSOB.exeC:\Windows\System32\vtxmSOB.exe2⤵PID:11696
-
-
C:\Windows\System32\TOCmYjy.exeC:\Windows\System32\TOCmYjy.exe2⤵PID:11820
-
-
C:\Windows\System32\kKxmuAc.exeC:\Windows\System32\kKxmuAc.exe2⤵PID:11884
-
-
C:\Windows\System32\mabawzh.exeC:\Windows\System32\mabawzh.exe2⤵PID:11936
-
-
C:\Windows\System32\gMYQEkm.exeC:\Windows\System32\gMYQEkm.exe2⤵PID:11984
-
-
C:\Windows\System32\FDmhMVM.exeC:\Windows\System32\FDmhMVM.exe2⤵PID:2064
-
-
C:\Windows\System32\zXKVkRG.exeC:\Windows\System32\zXKVkRG.exe2⤵PID:3512
-
-
C:\Windows\System32\ybeexsc.exeC:\Windows\System32\ybeexsc.exe2⤵PID:12216
-
-
C:\Windows\System32\mrLtEim.exeC:\Windows\System32\mrLtEim.exe2⤵PID:12276
-
-
C:\Windows\System32\CpyWfwV.exeC:\Windows\System32\CpyWfwV.exe2⤵PID:11284
-
-
C:\Windows\System32\EnXbxdD.exeC:\Windows\System32\EnXbxdD.exe2⤵PID:11444
-
-
C:\Windows\System32\bAZlVOv.exeC:\Windows\System32\bAZlVOv.exe2⤵PID:11608
-
-
C:\Windows\System32\qHqOJva.exeC:\Windows\System32\qHqOJva.exe2⤵PID:11684
-
-
C:\Windows\System32\IFSeALF.exeC:\Windows\System32\IFSeALF.exe2⤵PID:11896
-
-
C:\Windows\System32\kVHFgFQ.exeC:\Windows\System32\kVHFgFQ.exe2⤵PID:12132
-
-
C:\Windows\System32\oWkTVJq.exeC:\Windows\System32\oWkTVJq.exe2⤵PID:12264
-
-
C:\Windows\System32\jzWprug.exeC:\Windows\System32\jzWprug.exe2⤵PID:11636
-
-
C:\Windows\System32\sErWuDB.exeC:\Windows\System32\sErWuDB.exe2⤵PID:12028
-
-
C:\Windows\System32\izcaQTh.exeC:\Windows\System32\izcaQTh.exe2⤵PID:12280
-
-
C:\Windows\System32\jMDtFHo.exeC:\Windows\System32\jMDtFHo.exe2⤵PID:11728
-
-
C:\Windows\System32\ChOPtve.exeC:\Windows\System32\ChOPtve.exe2⤵PID:12320
-
-
C:\Windows\System32\ocYZqnf.exeC:\Windows\System32\ocYZqnf.exe2⤵PID:12344
-
-
C:\Windows\System32\uHsqfDL.exeC:\Windows\System32\uHsqfDL.exe2⤵PID:12372
-
-
C:\Windows\System32\vxawyqx.exeC:\Windows\System32\vxawyqx.exe2⤵PID:12392
-
-
C:\Windows\System32\qZBLEwx.exeC:\Windows\System32\qZBLEwx.exe2⤵PID:12412
-
-
C:\Windows\System32\vTTvioa.exeC:\Windows\System32\vTTvioa.exe2⤵PID:12436
-
-
C:\Windows\System32\jBFwiKQ.exeC:\Windows\System32\jBFwiKQ.exe2⤵PID:12500
-
-
C:\Windows\System32\sLBQhMS.exeC:\Windows\System32\sLBQhMS.exe2⤵PID:12524
-
-
C:\Windows\System32\JGBMFXO.exeC:\Windows\System32\JGBMFXO.exe2⤵PID:12548
-
-
C:\Windows\System32\hfRssGG.exeC:\Windows\System32\hfRssGG.exe2⤵PID:12564
-
-
C:\Windows\System32\XBUmnAu.exeC:\Windows\System32\XBUmnAu.exe2⤵PID:12608
-
-
C:\Windows\System32\CPiwjWi.exeC:\Windows\System32\CPiwjWi.exe2⤵PID:12636
-
-
C:\Windows\System32\qLkFmuf.exeC:\Windows\System32\qLkFmuf.exe2⤵PID:12652
-
-
C:\Windows\System32\xYTaFMs.exeC:\Windows\System32\xYTaFMs.exe2⤵PID:12748
-
-
C:\Windows\System32\FtQgBFV.exeC:\Windows\System32\FtQgBFV.exe2⤵PID:12824
-
-
C:\Windows\System32\LGJVytQ.exeC:\Windows\System32\LGJVytQ.exe2⤵PID:12840
-
-
C:\Windows\System32\fCGTlbB.exeC:\Windows\System32\fCGTlbB.exe2⤵PID:12856
-
-
C:\Windows\System32\HKYpJlY.exeC:\Windows\System32\HKYpJlY.exe2⤵PID:12912
-
-
C:\Windows\System32\TGALUEL.exeC:\Windows\System32\TGALUEL.exe2⤵PID:12928
-
-
C:\Windows\System32\OUhAwhN.exeC:\Windows\System32\OUhAwhN.exe2⤵PID:12976
-
-
C:\Windows\System32\UshzHlV.exeC:\Windows\System32\UshzHlV.exe2⤵PID:13004
-
-
C:\Windows\System32\vUFkxvQ.exeC:\Windows\System32\vUFkxvQ.exe2⤵PID:13056
-
-
C:\Windows\System32\NloVBbe.exeC:\Windows\System32\NloVBbe.exe2⤵PID:13072
-
-
C:\Windows\System32\frhbKIc.exeC:\Windows\System32\frhbKIc.exe2⤵PID:13092
-
-
C:\Windows\System32\mPaCMVX.exeC:\Windows\System32\mPaCMVX.exe2⤵PID:13116
-
-
C:\Windows\System32\OsXyCGV.exeC:\Windows\System32\OsXyCGV.exe2⤵PID:13164
-
-
C:\Windows\System32\EfUredr.exeC:\Windows\System32\EfUredr.exe2⤵PID:13188
-
-
C:\Windows\System32\LlBoYeY.exeC:\Windows\System32\LlBoYeY.exe2⤵PID:13224
-
-
C:\Windows\System32\MnWDRIH.exeC:\Windows\System32\MnWDRIH.exe2⤵PID:13248
-
-
C:\Windows\System32\aKlkMiO.exeC:\Windows\System32\aKlkMiO.exe2⤵PID:13276
-
-
C:\Windows\System32\vhgUbRk.exeC:\Windows\System32\vhgUbRk.exe2⤵PID:13304
-
-
C:\Windows\System32\DErVCpr.exeC:\Windows\System32\DErVCpr.exe2⤵PID:12364
-
-
C:\Windows\System32\AssfQfM.exeC:\Windows\System32\AssfQfM.exe2⤵PID:12388
-
-
C:\Windows\System32\SfGKznh.exeC:\Windows\System32\SfGKznh.exe2⤵PID:12472
-
-
C:\Windows\System32\xHNeqfb.exeC:\Windows\System32\xHNeqfb.exe2⤵PID:12496
-
-
C:\Windows\System32\ilpJfyE.exeC:\Windows\System32\ilpJfyE.exe2⤵PID:12508
-
-
C:\Windows\System32\sLrUCcO.exeC:\Windows\System32\sLrUCcO.exe2⤵PID:12588
-
-
C:\Windows\System32\wgAdJoW.exeC:\Windows\System32\wgAdJoW.exe2⤵PID:12664
-
-
C:\Windows\System32\NcuQfVi.exeC:\Windows\System32\NcuQfVi.exe2⤵PID:12672
-
-
C:\Windows\System32\eomVpmX.exeC:\Windows\System32\eomVpmX.exe2⤵PID:12732
-
-
C:\Windows\System32\bJtyWoh.exeC:\Windows\System32\bJtyWoh.exe2⤵PID:12756
-
-
C:\Windows\System32\RjwWpaC.exeC:\Windows\System32\RjwWpaC.exe2⤵PID:12876
-
-
C:\Windows\System32\DVnOCpd.exeC:\Windows\System32\DVnOCpd.exe2⤵PID:12892
-
-
C:\Windows\System32\YwEPyxr.exeC:\Windows\System32\YwEPyxr.exe2⤵PID:12920
-
-
C:\Windows\System32\oEwsdlp.exeC:\Windows\System32\oEwsdlp.exe2⤵PID:13036
-
-
C:\Windows\System32\VGdUcuL.exeC:\Windows\System32\VGdUcuL.exe2⤵PID:13104
-
-
C:\Windows\System32\PsZuOmg.exeC:\Windows\System32\PsZuOmg.exe2⤵PID:13132
-
-
C:\Windows\System32\sGWiRiC.exeC:\Windows\System32\sGWiRiC.exe2⤵PID:13184
-
-
C:\Windows\System32\liDuHdv.exeC:\Windows\System32\liDuHdv.exe2⤵PID:13068
-
-
C:\Windows\System32\XbxHBlW.exeC:\Windows\System32\XbxHBlW.exe2⤵PID:12940
-
-
C:\Windows\System32\WURJJTB.exeC:\Windows\System32\WURJJTB.exe2⤵PID:13124
-
-
C:\Windows\System32\JsMOdSn.exeC:\Windows\System32\JsMOdSn.exe2⤵PID:13160
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD56144b540afe594ce03bc013d8bc0b886
SHA1d8f8978329f5351b37a0e8471df04452491726f2
SHA25643220fc1dc8578507f4b054139d0e2dd1300e27c18a7a61b36c735e89b4821ed
SHA5122d25d2dff5ef1278dab06ad5a0268fbc667e8ba9f2255652ce806a5c3259492ee20fa01a72599222d6d0b02b4833b4971e0b272786edfb93600068c218a5b8a7
-
Filesize
1.3MB
MD576e3679f002dd6d4e19475465c1a20c6
SHA184050b97787d1bba3b651b4530a9f0e25f3866dd
SHA25634dfb8a79bed3ebb478873bf1b7ab04eeb94338a3cf7de32bc8a7ce1aa0b284c
SHA512776cbeff1d53e95578c8420707753cbc36e044b2b4b4507324e276f83106db93a3d68a424801f62f502b311951c9bab2c4c11e46a841f495b3be3703f5902275
-
Filesize
1.3MB
MD5752d4e55981154210fee6f5cee7c92c0
SHA1570eb76c4ee109fcde1f797b05173a476fbb7108
SHA256a721aef32bde3e29211992b55f51358b3a980422c738ae5d17c29a94a6831968
SHA512308ef38d605c9fe5b429af9f608d306e7691f9dbbf04d01cf4f6c1bc29a9d8b6ebc388ac587d0a1769a94989939ecf16bfc20d2923c3d19868f6945519c5df7d
-
Filesize
1.3MB
MD5d1e82daa78dbb6a2de9c7cb8176eff5a
SHA1321c872e8c92af1b1b82557a3e4b09b8f2ca0828
SHA25622355d07a3f52cfa24356b1bb694f3ee0c12398cce6915cb949b5b87bb7c677e
SHA512c21dcf488a6ff94657d5b1cc833c1a41fd176ab88c5bb26e81a1dfd7a820500dc1cf0c35efb449000218343308cb9a6bef8ecc164480f0e332064869598cf363
-
Filesize
1.3MB
MD5ca3f6cf8840c8773bf3529460536fab5
SHA1e2bc73d87e9766b92c30d9fa820e82dcae8b03ae
SHA25610caddfe4f5453bc47b9230cc82d511a66b00f11770f80cbf672d1acc36e0e56
SHA512d54d3c6baceca985d8fe7dea37dd4dda123fbe1ab0b05edba600755ef26350ac85e7baa1855ea568615ae040b8016e1940104f3f3959972e1f9dcfe5f3c05792
-
Filesize
1.3MB
MD5b8c808ab712e910d21419777184b211d
SHA19dc6e861040486384b79d65eab9aa37beacd7059
SHA25649d81ab3d5a8f5f61c7f2ea95159ee2d2f743549227133c3796bfc7592246192
SHA5126a978da56dec54c6bcd55aa65d370c45ed22c1f857e3040aca4c9e8917465edd76c3d8c228f4d994ddd9d45ebc9741eda61dcb813256a05726a515ada27198fd
-
Filesize
1.3MB
MD522c4f1d6f15bad1ef40d5e4f13ba8541
SHA1d6cc83c2fcbb7b68cec1e50a9a2eb60b11f1fb37
SHA25607db4958209c5569e8e0b66346d814195c8d1f83e1622fb2905bd038c7deaf84
SHA5122d9947e5c1ba2a1a59722b4c19be2441ede77116ebd85209efd2ca4bafb34bdaee1fbcdd65b7e96f5f19ba53ced29ca75284df0ca439bc7a77d62624520df5c2
-
Filesize
1.3MB
MD5facdfdf8b4af48b061039e0e1618ca39
SHA1773be9d5673f0699c35a76edcbaeb9f8fa027261
SHA2561413f3e0a3b4a8dfbaaf3886e483915ab71bee772340a378be3b5267684684e4
SHA51264c707693ffed9ea2fa6d3bcfc55a0d44c5e0523e2ae24029dc84fd3a1d80277a7daca73bf0ee35ddfeb813736db063af3679885fb9aefdc8f9904e6bc94e63e
-
Filesize
1.3MB
MD5f76bd3d262be9827d6a44e94ce39230d
SHA1c4a1b4b217bd5386be2276ae49fd73df77cd9568
SHA2561291ef8217e552ee6496a61df8188fcdb43050b3aaedf2bc34f6cc48ebabe0db
SHA512f7cff4248bdf0a4e9a137f7ebf18f82897b7eca71fe935b45ec4c214757e7a48b58848e324917fc8365e5bb80fa90022b3b99dd8bd36fed983699a1a5eb72a60
-
Filesize
1.3MB
MD584375caa67f0fbe383689297b9b44efe
SHA1b43479b1f7d3d6a4b6aae4dc6701b7c1aa071d59
SHA2569cb07c6b79a19f9b860ac29c004bb4b2e8e79cb4b12db222306cc67d2ee87e1d
SHA51219fe5ee45b0776ae036a86e9f198b6a1c44342488be2c7e498ce0f72d7fca3757f160e33037294ab0e0b02468ec0e9f694788aafa2603d9123ee94c3ae42423f
-
Filesize
1.3MB
MD51e8ab8641aecf59424f6948b66a12b70
SHA1a37d9ec207cb7d78dfe7ad2821854d36af02c1b6
SHA256b6811ccdbcab9b139c2a4ac29c8e5281908471c0096a00851d1e2714d8a16132
SHA5125a68fbe2a9987326d4f2bc7c99814147502f3b64f59725211e49fb49d98bfbf096006eaae57377d00a2385ea20357e575faf24635a8eec58f99c4f010c4688d6
-
Filesize
1.3MB
MD5b76d757c7bf2f3bd44088bf13c53c43c
SHA164c44dc8b821d445e425534eccf07c47077429fc
SHA256f478a561cf22e042963c67b55f265da70cc464ac47088b67bf2fb3b2a1d3999c
SHA512735cffbe7357f079618e073382a1ba0e92faa396c76a89173afb4edfae9fe2a03d7ecc2e97aa68dacbc77ce3c3789cd618dfedd85c1c0848775948d619296944
-
Filesize
1.3MB
MD57f1d96bb5bb516c4b124eb8a378c5a06
SHA130cdb30bc37615251c9ce752e912350767d90337
SHA2568ec31e6c828044cd825bd8f4fd0446a1c6dd6d842cc500d2c9497e9f0e8ab1bc
SHA512ad212d40e60ded15e7d9cc82c194a57148109d1c7c3e2bd6140810cdeda2f2d60b58c8fb87d781c81037628a1da50e3d551a96cef91fcf1d4bc2564e0e477e12
-
Filesize
1.3MB
MD5c55758fda0f45a885b0d800a19ee9592
SHA192ead16a2453ad594182daf2ebe20562f39024b8
SHA256731f2ce24a936197d9720f76a40e801cb70702304c3fb64c3c5ab303c0fed6eb
SHA512f40bf0ec09c20f826a596c31abbf94b97ed049834bb93d3aaaf641350d36c9e8615fc22ee2f9874d41ceb3d03c3273744030c0d0d14d5460e41dc8ee633bc9e0
-
Filesize
1.3MB
MD5669b43810f105e2d2a6626961c69a4d2
SHA1a9caa2e8d78a4a0afe92cd5f611c469bb2e3fd7d
SHA256a23bf8ac97a2446fc153b5b41194661794c6bb22abe0917d67fd00e3b80902a4
SHA512776f2b4e0e582e81b036ffae9d4e43eb82667be12630145fe410338119610d37266aa8866176f6c3fa977ebf4e79fea0359fcffc0a55e577e9ac30dd44d5892b
-
Filesize
1.3MB
MD5fb036058505937febc5e19e4ba1e1689
SHA10d49b89144c4aec8324ce230b2cce30fe9c0d988
SHA256914db1c012a299be0023b3c0ce2e432f1d3447dc6215f4112bbd2b1fc5de8459
SHA5125b81aba4299e5c09af801bac68ef1195a8168cf54de0e90bcade7d4ac72a44f3e47b1649106fd6454d14bc2c2e689ab6037f2f047dcf05fbf865c3ddc7a7b523
-
Filesize
1.3MB
MD5b6318ff67f963852223fabae62779832
SHA146fd4e5ce623fcaee27160c29eb0d974791865ae
SHA25682312884c5555ce16a76cad2d5e736427eafd3c36a3a66bed81c0ab20489fa80
SHA5127d9b2bf2bf80964066dc457fcead90f4870495c2d232b08a63de06e5207c10e1f35af760115043b74581ce1ec10aa7dabf8c314d46504464c3efe2758c7a1e5a
-
Filesize
1.3MB
MD5ca49c7261e60222d487d4841e65231a1
SHA13326915ea0a394785535f2d3c8ff4fb3e15e05e1
SHA256ee3c66550462fcf898ccbbdd80f6761f530080c7bd4d3146217bc65ec944562d
SHA5129bc5332d9cffbb2641ecf50849ef28a3cf1cb8ad2d62e494c91ca138fa546c82cef9900ff14732dc0200273efdd7099048f57e0985f8c07eb73f0a657bab32bf
-
Filesize
1.3MB
MD5aeb7bb82859ca74677be3a662e63b12f
SHA11a969757879b5eb9bec3d0b0a9dc842565e812f5
SHA25668c817449843a666b86ec153b12dfa99b6c7a406fd510011ecb938b535cb47c7
SHA51298e32835667b8c9087a1075ea408c322cec35605335ee1e32a87d4c48d294b375f33e2a823cdc54febe17317d811b3dc2be21ad923f2d34f782accc45a796ee6
-
Filesize
1.3MB
MD564dcbf68d2d760aae39740158e9f28dd
SHA1d258aa4a62c5c7801fc0cee0f6d9a013844bdd03
SHA25681362cd4c7b370a0cc89ea8ab22071501899fa025e049a69ff17fcf6f047c8ca
SHA512e929eaa4fb3243fa82843011d5809cb76e83a50cb2b2cba20fb5960bc0daf402956ca8801a728c5de72c59d781f70a3a814051c8c3eaed33f0dacaf3776c6a5f
-
Filesize
1.3MB
MD5a047e8e7e32ecd119531541538ffca7f
SHA1a3dc3de4dad64371948c49bd13e53d67562d755e
SHA25636e039a639307830dead59cbee417e64bb052a72a6e218072b63621b3eb90206
SHA5126277638738a1d4b202090fde91505091cb3d7711658ce33fe00eeb7872044e875ab1c87f1461ef34b914e8d1cf04d925e2e0f1bb0b0828e8a87b73a3c378ac30
-
Filesize
1.3MB
MD56c713d9d5030bb758c383451255c7510
SHA1e3a2b7cfb6022618797e6f5e84e6ba5c3c5d8183
SHA2561a7d13c67088a8852314291732f549a26af407e1395ff36f32540315d9d00ca0
SHA512c37148725da34a8c8aa8a5f8a4b7e7b9e3842004f66e895899e2812d2693ea13be4d7c31ed90fd50ecb50d59e502e43244deba871e93127dea67f833f1ea5c06
-
Filesize
1.3MB
MD57e55e342affeaaad2002b7d97ec599cd
SHA18bb4d628dec2f02aa699e93fb4031db242d5b33d
SHA2562b00914ec9503961deb8f3708beed707d89b99e769e607637e33d003585b71ae
SHA512385c04cffd1753c809b59775b4b1d166387b1d98781754ee0591b972c6171e1c1ab9dc261585857a7088b7ac836e53c7a88fec139e7df267b6a7ed8eb5eb9ed9
-
Filesize
1.3MB
MD52cffd09e8dd0a68e6336803ff11f4570
SHA1faae80960a7bc531894d00cf05b468ce46f9017e
SHA256f6e5906d454cb403f528daa1f841b519bb4c2c0497ad18e37482d424732d2c06
SHA51217293493aa24e4bbe088305163a4c7602e8673d360b7b416f816dd2dfcb564935f6b0d08d6ff6659a83c4129db4d0f64ed0ad78e8b359ae33d6bafc3e2ec7f09
-
Filesize
1.3MB
MD533874609066d1fcb6a948811925e2a64
SHA186da0cae68a39b6d3a3979571ddfe2b20472316c
SHA256e5a3a8acc95feee9d6a91797064e0fbaa592cd11db816d3d597e3870e7a50fc6
SHA512f010c26dd72f0b1b5a6410f456cc518f2e178ccb99df0a054d650d1ee775dacb98db2c711d09e89914390e7eb66ddc72a04fcd895d8d79ac85d9d68f5e0ca3c7
-
Filesize
1.3MB
MD5bee1d450b08b1dea4ae8313d080f8d4e
SHA13afd065ca4779eff25d554c799e352d73c2d41eb
SHA25668b09e191741d8cf1ceda326ed8522b13b126710ffc28b453b7abd339e2ed89e
SHA512df73689889eeaed4980e70a7d2ccb18e3fb8eae3d5033fe62f8be93c5c2c4b1fbe3ca31d7c67b159b35fa4583cd84a4a9463d3a68116319d82b0f81ffbb3854a
-
Filesize
1.3MB
MD556586b9b261b47209318019673b7482f
SHA102fe91211a81f161ca2d889b45f8803d96a60848
SHA256d21a943cf671c27c68b6b324446a9a53a40b5b5cbf651da59e363bc9d718ca05
SHA512c190a58022e7f53cd7be409ae1496792de9e621bafa336a5556277244461955a83c242d7ea8ffac51ffdf920f13eb2848885239b37d7c86f164aec0c515563c7
-
Filesize
1.3MB
MD5847b1d42d19ed8d84245a904444c347b
SHA1b15b464fa774f76aa20a1a1dd9d36a70d5e19d63
SHA256e3df9597941ffc553453a0220337719d74177576421b2c11e5a7c2586e11e5aa
SHA5126dc4575403ee445522441128cc021e65036e79dac2d846b040c272f9f334ea22e40d5c63e2645a47522346141ee5bc071363a2b31aa4cc0baedee8f84fb1ec66
-
Filesize
1.3MB
MD55c1330fd73cc8487b17411c26d00aaab
SHA16117f72b6693e708285b94a47526a5d146e9ee8b
SHA256abe57446884a549633442391acdd35f3eb5891f1ab6317696c2e0d7ba6311149
SHA512733d3468ac61712daffd559951128c6ba76f5ed2cfce02d84dfbd8a3325afc5ac7c6b54b8c14b49a6314e00182c7799983e7452ce7772ee5ce34012aa2745fce
-
Filesize
1.3MB
MD52fff46deb3465ecab75637f717a9f60f
SHA11299cf6cde80819b04a8c977176cf521e54f6e6b
SHA256b82d8a5550ee5a57c2641d601fab25313503dac42b6f54048237de41b16f70a6
SHA5122636362573bc8ed90c6d18bafeee3b1a2ec8e1be840cc16fc1a0d757891d1d5a6aa7a04d848355f9b3114fa48c2b7b607eb14224016c33f49fa8c4788564eb74
-
Filesize
1.3MB
MD588a55a9ccb3701fb1a40ef80d60391bb
SHA1fd5b8088b760a3825eb3c74b71f8439bb2d9a12c
SHA2567497ff4ed9794dfffc1b75489c2b331e8b7bb20f325dc0009b3e6e3c01b028b9
SHA512f45388dbdf3bb691db172cd58993853c6ed533c0b5d510fe565a7074c0d369a36d37c66018d6fabd7ad6c8dd7b7ed3b9d5287e7b6f5ebbb2133c799c4cfb446b
-
Filesize
1.3MB
MD55ddf0425330d6693e0734ef177842679
SHA1b4aff1406b22181a1a3f8e5b17a0fef0237d3728
SHA25625cc30bc48a6a9322cd8b32f19a9069195ad18387f9ddbb2ffae8303cad4e161
SHA512fb6c2123e5981771ac709faf626b7a3e653bcaa8f84dc11bb0669b9a97f9472a7e866ecb9523b2310d6ec3d59c9ae7a5301609b7d0ea32db699ff05ef5313d41