xmrig | 0984d6a676151c747b85c23743301c019917a2672ea60f2ac70a60d2d305616f

Analysis

max time kernel
129s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 00:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
Size

1.6MB
MD5

0f45cd27fc31b84a567c065f32391103
SHA1

27dc2d9d81306001bfe8969bfc4c82dbc7bd38a2
SHA256

0984d6a676151c747b85c23743301c019917a2672ea60f2ac70a60d2d305616f
SHA512

70e7f65fcd25d2e480ee012c1f5b224514d4ade3031190cb6677ae33b4a719f333921c531ecede10cf8074ee2b26209d67bb02cef091ba7b7640ea8798907d4b
SSDEEP

24576:JanwhSe11QSONCpGJCjETPlGC78XIO9C1MKTbcMfHhGjw2Do+BRrCfUgSav76foI:knw9oUUEEDlGUjc2HhG82DiBze

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 50 IoCs

miner

resource	yara_rule
behavioral2/memory/3660-449-0x00007FF671400000-0x00007FF6717F1000-memory.dmp	xmrig
behavioral2/memory/3128-462-0x00007FF6B8F90000-0x00007FF6B9381000-memory.dmp	xmrig
behavioral2/memory/3492-469-0x00007FF716D60000-0x00007FF717151000-memory.dmp	xmrig
behavioral2/memory/3276-455-0x00007FF775000000-0x00007FF7753F1000-memory.dmp	xmrig
behavioral2/memory/5020-450-0x00007FF731740000-0x00007FF731B31000-memory.dmp	xmrig
behavioral2/memory/2748-474-0x00007FF6FEF60000-0x00007FF6FF351000-memory.dmp	xmrig
behavioral2/memory/3792-28-0x00007FF7E2570000-0x00007FF7E2961000-memory.dmp	xmrig
behavioral2/memory/1132-22-0x00007FF742660000-0x00007FF742A51000-memory.dmp	xmrig
behavioral2/memory/4812-19-0x00007FF7832E0000-0x00007FF7836D1000-memory.dmp	xmrig
behavioral2/memory/884-8-0x00007FF73F6E0000-0x00007FF73FAD1000-memory.dmp	xmrig
behavioral2/memory/3096-476-0x00007FF625AC0000-0x00007FF625EB1000-memory.dmp	xmrig
behavioral2/memory/4772-488-0x00007FF7EA740000-0x00007FF7EAB31000-memory.dmp	xmrig
behavioral2/memory/4396-495-0x00007FF7904C0000-0x00007FF7908B1000-memory.dmp	xmrig
behavioral2/memory/2448-487-0x00007FF735540000-0x00007FF735931000-memory.dmp	xmrig
behavioral2/memory/2392-478-0x00007FF6ACE10000-0x00007FF6AD201000-memory.dmp	xmrig
behavioral2/memory/3252-499-0x00007FF7293E0000-0x00007FF7297D1000-memory.dmp	xmrig
behavioral2/memory/5036-513-0x00007FF67ECE0000-0x00007FF67F0D1000-memory.dmp	xmrig
behavioral2/memory/1900-522-0x00007FF62FFD0000-0x00007FF6303C1000-memory.dmp	xmrig
behavioral2/memory/2928-511-0x00007FF7ECE80000-0x00007FF7ED271000-memory.dmp	xmrig
behavioral2/memory/1376-507-0x00007FF7C2000000-0x00007FF7C23F1000-memory.dmp	xmrig
behavioral2/memory/2880-504-0x00007FF70F880000-0x00007FF70FC71000-memory.dmp	xmrig
behavioral2/memory/4812-1951-0x00007FF7832E0000-0x00007FF7836D1000-memory.dmp	xmrig
behavioral2/memory/1540-1952-0x00007FF7A7C00000-0x00007FF7A7FF1000-memory.dmp	xmrig
behavioral2/memory/4420-1985-0x00007FF65BAD0000-0x00007FF65BEC1000-memory.dmp	xmrig
behavioral2/memory/3040-1986-0x00007FF7303D0000-0x00007FF7307C1000-memory.dmp	xmrig
behavioral2/memory/1924-1988-0x00007FF6398B0000-0x00007FF639CA1000-memory.dmp	xmrig
behavioral2/memory/884-1993-0x00007FF73F6E0000-0x00007FF73FAD1000-memory.dmp	xmrig
behavioral2/memory/1132-1995-0x00007FF742660000-0x00007FF742A51000-memory.dmp	xmrig
behavioral2/memory/4812-1997-0x00007FF7832E0000-0x00007FF7836D1000-memory.dmp	xmrig
behavioral2/memory/3792-1999-0x00007FF7E2570000-0x00007FF7E2961000-memory.dmp	xmrig
behavioral2/memory/1540-2003-0x00007FF7A7C00000-0x00007FF7A7FF1000-memory.dmp	xmrig
behavioral2/memory/3040-2005-0x00007FF7303D0000-0x00007FF7307C1000-memory.dmp	xmrig
behavioral2/memory/3660-2007-0x00007FF671400000-0x00007FF6717F1000-memory.dmp	xmrig
behavioral2/memory/4420-2002-0x00007FF65BAD0000-0x00007FF65BEC1000-memory.dmp	xmrig
behavioral2/memory/2748-2017-0x00007FF6FEF60000-0x00007FF6FF351000-memory.dmp	xmrig
behavioral2/memory/5020-2023-0x00007FF731740000-0x00007FF731B31000-memory.dmp	xmrig
behavioral2/memory/3252-2027-0x00007FF7293E0000-0x00007FF7297D1000-memory.dmp	xmrig
behavioral2/memory/1376-2033-0x00007FF7C2000000-0x00007FF7C23F1000-memory.dmp	xmrig
behavioral2/memory/2928-2035-0x00007FF7ECE80000-0x00007FF7ED271000-memory.dmp	xmrig
behavioral2/memory/2880-2031-0x00007FF70F880000-0x00007FF70FC71000-memory.dmp	xmrig
behavioral2/memory/4396-2030-0x00007FF7904C0000-0x00007FF7908B1000-memory.dmp	xmrig
behavioral2/memory/3128-2019-0x00007FF6B8F90000-0x00007FF6B9381000-memory.dmp	xmrig
behavioral2/memory/3492-2025-0x00007FF716D60000-0x00007FF717151000-memory.dmp	xmrig
behavioral2/memory/3276-2021-0x00007FF775000000-0x00007FF7753F1000-memory.dmp	xmrig
behavioral2/memory/2392-2015-0x00007FF6ACE10000-0x00007FF6AD201000-memory.dmp	xmrig
behavioral2/memory/4772-2012-0x00007FF7EA740000-0x00007FF7EAB31000-memory.dmp	xmrig
behavioral2/memory/2448-2010-0x00007FF735540000-0x00007FF735931000-memory.dmp	xmrig
behavioral2/memory/3096-2014-0x00007FF625AC0000-0x00007FF625EB1000-memory.dmp	xmrig
behavioral2/memory/5036-2051-0x00007FF67ECE0000-0x00007FF67F0D1000-memory.dmp	xmrig
behavioral2/memory/1900-2085-0x00007FF62FFD0000-0x00007FF6303C1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
884	rYNNrHj.exe
4812	flgyyqV.exe
1132	qxsdHLG.exe
3792	UBBUPJi.exe
1540	xJOsBCv.exe
4420	lgoChZs.exe
3040	DRkGBnS.exe
3660	DIamzCw.exe
5020	SYKlcfM.exe
3276	tfauTaN.exe
3128	rQXEecu.exe
3492	QtqIeNw.exe
2748	BzICSYE.exe
3096	bwFBcnr.exe
2392	Nrvfajz.exe
2448	OitHcwc.exe
4772	hNukhPs.exe
4396	UtWTmaC.exe
3252	uqMUrHC.exe
2880	nYkvSRW.exe
1376	NcBWUUm.exe
2928	vRakrSX.exe
5036	uYvijdM.exe
1900	iMEsWDo.exe
3464	ZYOhbQU.exe
3604	McHOZkO.exe
3948	TxSgCkV.exe
5044	etuFGCA.exe
2160	RtKicDc.exe
1616	fnYcXIP.exe
3980	PwxLklA.exe
5012	HCDtPZT.exe
2212	YhoQubl.exe
3928	BUTNFjk.exe
1648	fgKktQI.exe
2428	apStTrF.exe
1724	ukcIouH.exe
4936	CrIVyVc.exe
1200	rjXhhUQ.exe
2772	UoFJPoD.exe
1840	sUPcIFz.exe
2804	ApbnfNs.exe
64	usuXrFM.exe
4856	FDJwkNo.exe
3416	dYEgpYE.exe
1752	MeMyDNv.exe
1120	FGhuKRB.exe
3844	jgXmgro.exe
4400	vjOBdVf.exe
2380	UPVuTir.exe
5056	AwUxgsj.exe
228	oObJnnT.exe
116	dAGWYnp.exe
3364	TFfMJAZ.exe
400	PPxabOi.exe
3860	Uuozhwx.exe
4480	eUszVrd.exe
4604	MiVxoxb.exe
4628	bRMquQB.exe
4236	maesaay.exe
1856	OqvfiDN.exe
3008	xSuDpgH.exe
1604	KocDMpn.exe
4636	JdoXMUu.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1924-0-0x00007FF6398B0000-0x00007FF639CA1000-memory.dmp	upx
behavioral2/files/0x000c000000023b9d-5.dat	upx
behavioral2/files/0x000a000000023baa-12.dat	upx
behavioral2/files/0x000a000000023bab-16.dat	upx
behavioral2/files/0x000a000000023bac-24.dat	upx
behavioral2/files/0x000a000000023bad-29.dat	upx
behavioral2/memory/4420-39-0x00007FF65BAD0000-0x00007FF65BEC1000-memory.dmp	upx
behavioral2/files/0x000a000000023bb0-44.dat	upx
behavioral2/files/0x000a000000023bb1-53.dat	upx
behavioral2/files/0x000a000000023bb2-58.dat	upx
behavioral2/files/0x0031000000023bb4-66.dat	upx
behavioral2/files/0x0031000000023bb5-73.dat	upx
behavioral2/files/0x0031000000023bb6-78.dat	upx
behavioral2/files/0x000a000000023bb8-86.dat	upx
behavioral2/files/0x000a000000023bbb-103.dat	upx
behavioral2/files/0x000a000000023bc0-128.dat	upx
behavioral2/files/0x000a000000023bc2-138.dat	upx
behavioral2/files/0x000a000000023bc8-168.dat	upx
behavioral2/memory/3660-449-0x00007FF671400000-0x00007FF6717F1000-memory.dmp	upx
behavioral2/memory/3128-462-0x00007FF6B8F90000-0x00007FF6B9381000-memory.dmp	upx
behavioral2/memory/3492-469-0x00007FF716D60000-0x00007FF717151000-memory.dmp	upx
behavioral2/memory/3276-455-0x00007FF775000000-0x00007FF7753F1000-memory.dmp	upx
behavioral2/memory/5020-450-0x00007FF731740000-0x00007FF731B31000-memory.dmp	upx
behavioral2/files/0x000a000000023bc7-163.dat	upx
behavioral2/files/0x000a000000023bc6-158.dat	upx
behavioral2/files/0x000a000000023bc5-153.dat	upx
behavioral2/files/0x000a000000023bc4-148.dat	upx
behavioral2/files/0x000a000000023bc3-143.dat	upx
behavioral2/files/0x000a000000023bc1-133.dat	upx
behavioral2/files/0x000a000000023bbf-123.dat	upx
behavioral2/files/0x000a000000023bbe-118.dat	upx
behavioral2/files/0x000a000000023bbd-113.dat	upx
behavioral2/files/0x000a000000023bbc-108.dat	upx
behavioral2/files/0x000a000000023bba-98.dat	upx
behavioral2/files/0x000a000000023bb9-93.dat	upx
behavioral2/files/0x000a000000023bb7-83.dat	upx
behavioral2/files/0x000a000000023bb3-63.dat	upx
behavioral2/memory/2748-474-0x00007FF6FEF60000-0x00007FF6FF351000-memory.dmp	upx
behavioral2/files/0x000a000000023baf-46.dat	upx
behavioral2/files/0x000a000000023bae-41.dat	upx
behavioral2/memory/3040-40-0x00007FF7303D0000-0x00007FF7307C1000-memory.dmp	upx
behavioral2/memory/1540-35-0x00007FF7A7C00000-0x00007FF7A7FF1000-memory.dmp	upx
behavioral2/memory/3792-28-0x00007FF7E2570000-0x00007FF7E2961000-memory.dmp	upx
behavioral2/memory/1132-22-0x00007FF742660000-0x00007FF742A51000-memory.dmp	upx
behavioral2/memory/4812-19-0x00007FF7832E0000-0x00007FF7836D1000-memory.dmp	upx
behavioral2/memory/884-8-0x00007FF73F6E0000-0x00007FF73FAD1000-memory.dmp	upx
behavioral2/memory/3096-476-0x00007FF625AC0000-0x00007FF625EB1000-memory.dmp	upx
behavioral2/memory/4772-488-0x00007FF7EA740000-0x00007FF7EAB31000-memory.dmp	upx
behavioral2/memory/4396-495-0x00007FF7904C0000-0x00007FF7908B1000-memory.dmp	upx
behavioral2/memory/2448-487-0x00007FF735540000-0x00007FF735931000-memory.dmp	upx
behavioral2/memory/2392-478-0x00007FF6ACE10000-0x00007FF6AD201000-memory.dmp	upx
behavioral2/memory/3252-499-0x00007FF7293E0000-0x00007FF7297D1000-memory.dmp	upx
behavioral2/memory/5036-513-0x00007FF67ECE0000-0x00007FF67F0D1000-memory.dmp	upx
behavioral2/memory/1900-522-0x00007FF62FFD0000-0x00007FF6303C1000-memory.dmp	upx
behavioral2/memory/2928-511-0x00007FF7ECE80000-0x00007FF7ED271000-memory.dmp	upx
behavioral2/memory/1376-507-0x00007FF7C2000000-0x00007FF7C23F1000-memory.dmp	upx
behavioral2/memory/2880-504-0x00007FF70F880000-0x00007FF70FC71000-memory.dmp	upx
behavioral2/memory/4812-1951-0x00007FF7832E0000-0x00007FF7836D1000-memory.dmp	upx
behavioral2/memory/1540-1952-0x00007FF7A7C00000-0x00007FF7A7FF1000-memory.dmp	upx
behavioral2/memory/4420-1985-0x00007FF65BAD0000-0x00007FF65BEC1000-memory.dmp	upx
behavioral2/memory/3040-1986-0x00007FF7303D0000-0x00007FF7307C1000-memory.dmp	upx
behavioral2/memory/1924-1988-0x00007FF6398B0000-0x00007FF639CA1000-memory.dmp	upx
behavioral2/memory/884-1993-0x00007FF73F6E0000-0x00007FF73FAD1000-memory.dmp	upx
behavioral2/memory/1132-1995-0x00007FF742660000-0x00007FF742A51000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\NCimGOv.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\sizUxyZ.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\iOsMqQy.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\mvUZpEu.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\BxDVlKV.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\TcFXGYM.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\MWPEJGZ.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\XJVAYZd.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\mXlfGnR.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\YAMjrhm.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\SCsEUJD.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\kgahDAI.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\FQYisDj.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\sTEQyGS.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\fRzhqwH.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\tCbyDhP.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\YPEZiWM.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\qjHcWZc.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\oAlUhWG.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\hFiBkFR.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\KmOYeSs.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\njrIOMT.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\IFOXBVv.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\McHOZkO.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\SkhrhQF.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\GaAWyGc.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\YHeZiOF.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\IzygNdz.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\NThNSkx.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\OfqqEkB.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\uqMUrHC.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\dYEgpYE.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\QqvCTbN.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\thfAKZS.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\KgMSmRv.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\kugtsFw.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\GqtWqOv.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\MmQROKv.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\UpLXUAQ.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\JyAHmRF.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\PvadKDi.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\TVgQbHF.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\IAAyUYB.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\wTkLzeC.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\IMEwfoo.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\UqdBAjz.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\FGhuKRB.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\CLMgmao.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\OpOzeIi.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\AwUxgsj.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\DhzGLBX.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\Heobsqk.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\eVmbcIA.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\udZMcyb.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\IYJvnPP.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\bzpdglX.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\BNpNOHj.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\KgLllxP.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\maesaay.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\NBudwtb.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\oAczVVt.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\ZBBwspL.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\cmpAduu.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
File created	C:\Windows\System32\ZIJOOZW.exe	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 884	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	85
PID 1924 wrote to memory of 884	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	85
PID 1924 wrote to memory of 4812	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	86
PID 1924 wrote to memory of 4812	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	86
PID 1924 wrote to memory of 1132	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	87
PID 1924 wrote to memory of 1132	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	87
PID 1924 wrote to memory of 3792	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	88
PID 1924 wrote to memory of 3792	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	88
PID 1924 wrote to memory of 1540	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	89
PID 1924 wrote to memory of 1540	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	89
PID 1924 wrote to memory of 4420	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	90
PID 1924 wrote to memory of 4420	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	90
PID 1924 wrote to memory of 3040	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	91
PID 1924 wrote to memory of 3040	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	91
PID 1924 wrote to memory of 3660	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	92
PID 1924 wrote to memory of 3660	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	92
PID 1924 wrote to memory of 5020	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	93
PID 1924 wrote to memory of 5020	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	93
PID 1924 wrote to memory of 3276	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	94
PID 1924 wrote to memory of 3276	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	94
PID 1924 wrote to memory of 3128	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	95
PID 1924 wrote to memory of 3128	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	95
PID 1924 wrote to memory of 3492	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	96
PID 1924 wrote to memory of 3492	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	96
PID 1924 wrote to memory of 2748	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	97
PID 1924 wrote to memory of 2748	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	97
PID 1924 wrote to memory of 3096	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	98
PID 1924 wrote to memory of 3096	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	98
PID 1924 wrote to memory of 2392	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	99
PID 1924 wrote to memory of 2392	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	99
PID 1924 wrote to memory of 2448	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	100
PID 1924 wrote to memory of 2448	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	100
PID 1924 wrote to memory of 4772	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	101
PID 1924 wrote to memory of 4772	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	101
PID 1924 wrote to memory of 4396	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	102
PID 1924 wrote to memory of 4396	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	102
PID 1924 wrote to memory of 3252	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	103
PID 1924 wrote to memory of 3252	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	103
PID 1924 wrote to memory of 2880	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	104
PID 1924 wrote to memory of 2880	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	104
PID 1924 wrote to memory of 1376	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	105
PID 1924 wrote to memory of 1376	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	105
PID 1924 wrote to memory of 2928	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	106
PID 1924 wrote to memory of 2928	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	106
PID 1924 wrote to memory of 5036	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	107
PID 1924 wrote to memory of 5036	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	107
PID 1924 wrote to memory of 1900	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	108
PID 1924 wrote to memory of 1900	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	108
PID 1924 wrote to memory of 3464	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	109
PID 1924 wrote to memory of 3464	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	109
PID 1924 wrote to memory of 3604	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	110
PID 1924 wrote to memory of 3604	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	110
PID 1924 wrote to memory of 3948	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	111
PID 1924 wrote to memory of 3948	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	111
PID 1924 wrote to memory of 5044	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	112
PID 1924 wrote to memory of 5044	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	112
PID 1924 wrote to memory of 2160	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	113
PID 1924 wrote to memory of 2160	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	113
PID 1924 wrote to memory of 1616	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	114
PID 1924 wrote to memory of 1616	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	114
PID 1924 wrote to memory of 3980	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	115
PID 1924 wrote to memory of 3980	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	115
PID 1924 wrote to memory of 5012	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	116
PID 1924 wrote to memory of 5012	1924	0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0f45cd27fc31b84a567c065f32391103_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\System32\rYNNrHj.exe
  C:\Windows\System32\rYNNrHj.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System32\flgyyqV.exe
  C:\Windows\System32\flgyyqV.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System32\qxsdHLG.exe
  C:\Windows\System32\qxsdHLG.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System32\UBBUPJi.exe
  C:\Windows\System32\UBBUPJi.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System32\xJOsBCv.exe
  C:\Windows\System32\xJOsBCv.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System32\lgoChZs.exe
  C:\Windows\System32\lgoChZs.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System32\DRkGBnS.exe
  C:\Windows\System32\DRkGBnS.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System32\DIamzCw.exe
  C:\Windows\System32\DIamzCw.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System32\SYKlcfM.exe
  C:\Windows\System32\SYKlcfM.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System32\tfauTaN.exe
  C:\Windows\System32\tfauTaN.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System32\rQXEecu.exe
  C:\Windows\System32\rQXEecu.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System32\QtqIeNw.exe
  C:\Windows\System32\QtqIeNw.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System32\BzICSYE.exe
  C:\Windows\System32\BzICSYE.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System32\bwFBcnr.exe
  C:\Windows\System32\bwFBcnr.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System32\Nrvfajz.exe
  C:\Windows\System32\Nrvfajz.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System32\OitHcwc.exe
  C:\Windows\System32\OitHcwc.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System32\hNukhPs.exe
  C:\Windows\System32\hNukhPs.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System32\UtWTmaC.exe
  C:\Windows\System32\UtWTmaC.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System32\uqMUrHC.exe
  C:\Windows\System32\uqMUrHC.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System32\nYkvSRW.exe
  C:\Windows\System32\nYkvSRW.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System32\NcBWUUm.exe
  C:\Windows\System32\NcBWUUm.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System32\vRakrSX.exe
  C:\Windows\System32\vRakrSX.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System32\uYvijdM.exe
  C:\Windows\System32\uYvijdM.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System32\iMEsWDo.exe
  C:\Windows\System32\iMEsWDo.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System32\ZYOhbQU.exe
  C:\Windows\System32\ZYOhbQU.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System32\McHOZkO.exe
  C:\Windows\System32\McHOZkO.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System32\TxSgCkV.exe
  C:\Windows\System32\TxSgCkV.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System32\etuFGCA.exe
  C:\Windows\System32\etuFGCA.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System32\RtKicDc.exe
  C:\Windows\System32\RtKicDc.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System32\fnYcXIP.exe
  C:\Windows\System32\fnYcXIP.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System32\PwxLklA.exe
  C:\Windows\System32\PwxLklA.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System32\HCDtPZT.exe
  C:\Windows\System32\HCDtPZT.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System32\YhoQubl.exe
  C:\Windows\System32\YhoQubl.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System32\BUTNFjk.exe
  C:\Windows\System32\BUTNFjk.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System32\fgKktQI.exe
  C:\Windows\System32\fgKktQI.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System32\apStTrF.exe
  C:\Windows\System32\apStTrF.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System32\ukcIouH.exe
  C:\Windows\System32\ukcIouH.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System32\CrIVyVc.exe
  C:\Windows\System32\CrIVyVc.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System32\rjXhhUQ.exe
  C:\Windows\System32\rjXhhUQ.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System32\UoFJPoD.exe
  C:\Windows\System32\UoFJPoD.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System32\sUPcIFz.exe
  C:\Windows\System32\sUPcIFz.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System32\ApbnfNs.exe
  C:\Windows\System32\ApbnfNs.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System32\usuXrFM.exe
  C:\Windows\System32\usuXrFM.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System32\FDJwkNo.exe
  C:\Windows\System32\FDJwkNo.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System32\dYEgpYE.exe
  C:\Windows\System32\dYEgpYE.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System32\MeMyDNv.exe
  C:\Windows\System32\MeMyDNv.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System32\FGhuKRB.exe
  C:\Windows\System32\FGhuKRB.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System32\jgXmgro.exe
  C:\Windows\System32\jgXmgro.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System32\vjOBdVf.exe
  C:\Windows\System32\vjOBdVf.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System32\UPVuTir.exe
  C:\Windows\System32\UPVuTir.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System32\AwUxgsj.exe
  C:\Windows\System32\AwUxgsj.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System32\oObJnnT.exe
  C:\Windows\System32\oObJnnT.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System32\dAGWYnp.exe
  C:\Windows\System32\dAGWYnp.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System32\TFfMJAZ.exe
  C:\Windows\System32\TFfMJAZ.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System32\PPxabOi.exe
  C:\Windows\System32\PPxabOi.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System32\Uuozhwx.exe
  C:\Windows\System32\Uuozhwx.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System32\eUszVrd.exe
  C:\Windows\System32\eUszVrd.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System32\MiVxoxb.exe
  C:\Windows\System32\MiVxoxb.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System32\bRMquQB.exe
  C:\Windows\System32\bRMquQB.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System32\maesaay.exe
  C:\Windows\System32\maesaay.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System32\OqvfiDN.exe
  C:\Windows\System32\OqvfiDN.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System32\xSuDpgH.exe
  C:\Windows\System32\xSuDpgH.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System32\KocDMpn.exe
  C:\Windows\System32\KocDMpn.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System32\JdoXMUu.exe
  C:\Windows\System32\JdoXMUu.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System32\WNBYocW.exe
  C:\Windows\System32\WNBYocW.exe
  2⤵
  PID:3976
- C:\Windows\System32\KNEuiIm.exe
  C:\Windows\System32\KNEuiIm.exe
  2⤵
  PID:3284
- C:\Windows\System32\pBnKQQq.exe
  C:\Windows\System32\pBnKQQq.exe
  2⤵
  PID:4328
- C:\Windows\System32\qPCMJTH.exe
  C:\Windows\System32\qPCMJTH.exe
  2⤵
  PID:3704
- C:\Windows\System32\pXvZFGG.exe
  C:\Windows\System32\pXvZFGG.exe
  2⤵
  PID:3140
- C:\Windows\System32\puefOXs.exe
  C:\Windows\System32\puefOXs.exe
  2⤵
  PID:4280
- C:\Windows\System32\FLvKzbp.exe
  C:\Windows\System32\FLvKzbp.exe
  2⤵
  PID:4520
- C:\Windows\System32\hrtTMvk.exe
  C:\Windows\System32\hrtTMvk.exe
  2⤵
  PID:4976
- C:\Windows\System32\ZVHCXOz.exe
  C:\Windows\System32\ZVHCXOz.exe
  2⤵
  PID:3576
- C:\Windows\System32\DhzGLBX.exe
  C:\Windows\System32\DhzGLBX.exe
  2⤵
  PID:4312
- C:\Windows\System32\SctnFeR.exe
  C:\Windows\System32\SctnFeR.exe
  2⤵
  PID:452
- C:\Windows\System32\fmxdgFD.exe
  C:\Windows\System32\fmxdgFD.exe
  2⤵
  PID:2044
- C:\Windows\System32\XInfvFA.exe
  C:\Windows\System32\XInfvFA.exe
  2⤵
  PID:5000
- C:\Windows\System32\TcDgClH.exe
  C:\Windows\System32\TcDgClH.exe
  2⤵
  PID:2300
- C:\Windows\System32\RiJHimh.exe
  C:\Windows\System32\RiJHimh.exe
  2⤵
  PID:3108
- C:\Windows\System32\SkhrhQF.exe
  C:\Windows\System32\SkhrhQF.exe
  2⤵
  PID:888
- C:\Windows\System32\uyqYxfn.exe
  C:\Windows\System32\uyqYxfn.exe
  2⤵
  PID:448
- C:\Windows\System32\fkWVtIh.exe
  C:\Windows\System32\fkWVtIh.exe
  2⤵
  PID:4124
- C:\Windows\System32\OOGzCTp.exe
  C:\Windows\System32\OOGzCTp.exe
  2⤵
  PID:4368
- C:\Windows\System32\mUflhst.exe
  C:\Windows\System32\mUflhst.exe
  2⤵
  PID:3392
- C:\Windows\System32\LjGVfsE.exe
  C:\Windows\System32\LjGVfsE.exe
  2⤵
  PID:5108
- C:\Windows\System32\GaAWyGc.exe
  C:\Windows\System32\GaAWyGc.exe
  2⤵
  PID:740
- C:\Windows\System32\omDXOVw.exe
  C:\Windows\System32\omDXOVw.exe
  2⤵
  PID:4504
- C:\Windows\System32\fOggPRJ.exe
  C:\Windows\System32\fOggPRJ.exe
  2⤵
  PID:5148
- C:\Windows\System32\jioTLGV.exe
  C:\Windows\System32\jioTLGV.exe
  2⤵
  PID:5168
- C:\Windows\System32\WtVyZBP.exe
  C:\Windows\System32\WtVyZBP.exe
  2⤵
  PID:5200
- C:\Windows\System32\eoKSeoy.exe
  C:\Windows\System32\eoKSeoy.exe
  2⤵
  PID:5228
- C:\Windows\System32\NzXHEYt.exe
  C:\Windows\System32\NzXHEYt.exe
  2⤵
  PID:5256
- C:\Windows\System32\iFFlpdZ.exe
  C:\Windows\System32\iFFlpdZ.exe
  2⤵
  PID:5288
- C:\Windows\System32\zUnkNFd.exe
  C:\Windows\System32\zUnkNFd.exe
  2⤵
  PID:5312
- C:\Windows\System32\jTCnGyK.exe
  C:\Windows\System32\jTCnGyK.exe
  2⤵
  PID:5340
- C:\Windows\System32\YhqjiKg.exe
  C:\Windows\System32\YhqjiKg.exe
  2⤵
  PID:5368
- C:\Windows\System32\ewSOLzG.exe
  C:\Windows\System32\ewSOLzG.exe
  2⤵
  PID:5396
- C:\Windows\System32\dEqEBVl.exe
  C:\Windows\System32\dEqEBVl.exe
  2⤵
  PID:5420
- C:\Windows\System32\SrguTxw.exe
  C:\Windows\System32\SrguTxw.exe
  2⤵
  PID:5452
- C:\Windows\System32\gkRDJtI.exe
  C:\Windows\System32\gkRDJtI.exe
  2⤵
  PID:5480
- C:\Windows\System32\QbOqXkk.exe
  C:\Windows\System32\QbOqXkk.exe
  2⤵
  PID:5508
- C:\Windows\System32\CvIBrCE.exe
  C:\Windows\System32\CvIBrCE.exe
  2⤵
  PID:5536
- C:\Windows\System32\jkpWjBg.exe
  C:\Windows\System32\jkpWjBg.exe
  2⤵
  PID:5564
- C:\Windows\System32\KGTWaEr.exe
  C:\Windows\System32\KGTWaEr.exe
  2⤵
  PID:5588
- C:\Windows\System32\otcJyBQ.exe
  C:\Windows\System32\otcJyBQ.exe
  2⤵
  PID:5620
- C:\Windows\System32\hoIVmSo.exe
  C:\Windows\System32\hoIVmSo.exe
  2⤵
  PID:5652
- C:\Windows\System32\zlJPqyN.exe
  C:\Windows\System32\zlJPqyN.exe
  2⤵
  PID:5676
- C:\Windows\System32\CfgiUlo.exe
  C:\Windows\System32\CfgiUlo.exe
  2⤵
  PID:5704
- C:\Windows\System32\ANiQsJI.exe
  C:\Windows\System32\ANiQsJI.exe
  2⤵
  PID:5736
- C:\Windows\System32\lCOBvUU.exe
  C:\Windows\System32\lCOBvUU.exe
  2⤵
  PID:5768
- C:\Windows\System32\pzhIdDS.exe
  C:\Windows\System32\pzhIdDS.exe
  2⤵
  PID:5784
- C:\Windows\System32\QHnrRuP.exe
  C:\Windows\System32\QHnrRuP.exe
  2⤵
  PID:5812
- C:\Windows\System32\MycXFwZ.exe
  C:\Windows\System32\MycXFwZ.exe
  2⤵
  PID:5840
- C:\Windows\System32\XJVAYZd.exe
  C:\Windows\System32\XJVAYZd.exe
  2⤵
  PID:5868
- C:\Windows\System32\EfpTJQK.exe
  C:\Windows\System32\EfpTJQK.exe
  2⤵
  PID:5896
- C:\Windows\System32\CDAqiRN.exe
  C:\Windows\System32\CDAqiRN.exe
  2⤵
  PID:5924
- C:\Windows\System32\NsbSmRd.exe
  C:\Windows\System32\NsbSmRd.exe
  2⤵
  PID:5952
- C:\Windows\System32\FVCoJsE.exe
  C:\Windows\System32\FVCoJsE.exe
  2⤵
  PID:5980
- C:\Windows\System32\HSVoQmn.exe
  C:\Windows\System32\HSVoQmn.exe
  2⤵
  PID:6008
- C:\Windows\System32\IHDXTyN.exe
  C:\Windows\System32\IHDXTyN.exe
  2⤵
  PID:6036
- C:\Windows\System32\NCimGOv.exe
  C:\Windows\System32\NCimGOv.exe
  2⤵
  PID:6064
- C:\Windows\System32\dIMDAFa.exe
  C:\Windows\System32\dIMDAFa.exe
  2⤵
  PID:6092
- C:\Windows\System32\MmQROKv.exe
  C:\Windows\System32\MmQROKv.exe
  2⤵
  PID:6120
- C:\Windows\System32\jYTXpqk.exe
  C:\Windows\System32\jYTXpqk.exe
  2⤵
  PID:1324
- C:\Windows\System32\sEdyIdu.exe
  C:\Windows\System32\sEdyIdu.exe
  2⤵
  PID:368
- C:\Windows\System32\mXlfGnR.exe
  C:\Windows\System32\mXlfGnR.exe
  2⤵
  PID:4432
- C:\Windows\System32\tdvifZY.exe
  C:\Windows\System32\tdvifZY.exe
  2⤵
  PID:5212
- C:\Windows\System32\NiUPvup.exe
  C:\Windows\System32\NiUPvup.exe
  2⤵
  PID:5244
- C:\Windows\System32\zayotzi.exe
  C:\Windows\System32\zayotzi.exe
  2⤵
  PID:5284
- C:\Windows\System32\mUOcABj.exe
  C:\Windows\System32\mUOcABj.exe
  2⤵
  PID:2080
- C:\Windows\System32\hmsvQJW.exe
  C:\Windows\System32\hmsvQJW.exe
  2⤵
  PID:5352
- C:\Windows\System32\fUndDEd.exe
  C:\Windows\System32\fUndDEd.exe
  2⤵
  PID:5408
- C:\Windows\System32\BjWwgqY.exe
  C:\Windows\System32\BjWwgqY.exe
  2⤵
  PID:5528
- C:\Windows\System32\drgGDSS.exe
  C:\Windows\System32\drgGDSS.exe
  2⤵
  PID:5604
- C:\Windows\System32\mQFjztB.exe
  C:\Windows\System32\mQFjztB.exe
  2⤵
  PID:4356
- C:\Windows\System32\LdGsIPM.exe
  C:\Windows\System32\LdGsIPM.exe
  2⤵
  PID:5724
- C:\Windows\System32\mZIJjaJ.exe
  C:\Windows\System32\mZIJjaJ.exe
  2⤵
  PID:5776
- C:\Windows\System32\aFKmNNa.exe
  C:\Windows\System32\aFKmNNa.exe
  2⤵
  PID:5852
- C:\Windows\System32\VuEsHlL.exe
  C:\Windows\System32\VuEsHlL.exe
  2⤵
  PID:5912
- C:\Windows\System32\CLMgmao.exe
  C:\Windows\System32\CLMgmao.exe
  2⤵
  PID:6052
- C:\Windows\System32\ybzuXeQ.exe
  C:\Windows\System32\ybzuXeQ.exe
  2⤵
  PID:3988
- C:\Windows\System32\hEYPkRJ.exe
  C:\Windows\System32\hEYPkRJ.exe
  2⤵
  PID:1124
- C:\Windows\System32\VBugBDY.exe
  C:\Windows\System32\VBugBDY.exe
  2⤵
  PID:1196
- C:\Windows\System32\OEGygEu.exe
  C:\Windows\System32\OEGygEu.exe
  2⤵
  PID:2440
- C:\Windows\System32\avmIWJQ.exe
  C:\Windows\System32\avmIWJQ.exe
  2⤵
  PID:1636
- C:\Windows\System32\LFUCDvn.exe
  C:\Windows\System32\LFUCDvn.exe
  2⤵
  PID:4412
- C:\Windows\System32\ygNUErU.exe
  C:\Windows\System32\ygNUErU.exe
  2⤵
  PID:1608
- C:\Windows\System32\nrJAwSy.exe
  C:\Windows\System32\nrJAwSy.exe
  2⤵
  PID:5272
- C:\Windows\System32\RkUnNAn.exe
  C:\Windows\System32\RkUnNAn.exe
  2⤵
  PID:1272
- C:\Windows\System32\oodFvly.exe
  C:\Windows\System32\oodFvly.exe
  2⤵
  PID:5824
- C:\Windows\System32\IReJOqG.exe
  C:\Windows\System32\IReJOqG.exe
  2⤵
  PID:5492
- C:\Windows\System32\QmZrOfi.exe
  C:\Windows\System32\QmZrOfi.exe
  2⤵
  PID:4828
- C:\Windows\System32\ocFPnWf.exe
  C:\Windows\System32\ocFPnWf.exe
  2⤵
  PID:3136
- C:\Windows\System32\lohBdDb.exe
  C:\Windows\System32\lohBdDb.exe
  2⤵
  PID:3608
- C:\Windows\System32\iifXFRG.exe
  C:\Windows\System32\iifXFRG.exe
  2⤵
  PID:3084
- C:\Windows\System32\XJKLSdz.exe
  C:\Windows\System32\XJKLSdz.exe
  2⤵
  PID:2984
- C:\Windows\System32\NPKzcrm.exe
  C:\Windows\System32\NPKzcrm.exe
  2⤵
  PID:5552
- C:\Windows\System32\lBNtTRk.exe
  C:\Windows\System32\lBNtTRk.exe
  2⤵
  PID:5836
- C:\Windows\System32\sizUxyZ.exe
  C:\Windows\System32\sizUxyZ.exe
  2⤵
  PID:2092
- C:\Windows\System32\KrLgJKN.exe
  C:\Windows\System32\KrLgJKN.exe
  2⤵
  PID:6104
- C:\Windows\System32\GWUJFpd.exe
  C:\Windows\System32\GWUJFpd.exe
  2⤵
  PID:2972
- C:\Windows\System32\eZuSNeq.exe
  C:\Windows\System32\eZuSNeq.exe
  2⤵
  PID:2840
- C:\Windows\System32\CMsKURM.exe
  C:\Windows\System32\CMsKURM.exe
  2⤵
  PID:5332
- C:\Windows\System32\YAMjrhm.exe
  C:\Windows\System32\YAMjrhm.exe
  2⤵
  PID:6152
- C:\Windows\System32\THxcKSA.exe
  C:\Windows\System32\THxcKSA.exe
  2⤵
  PID:6220
- C:\Windows\System32\ROXihVR.exe
  C:\Windows\System32\ROXihVR.exe
  2⤵
  PID:6244
- C:\Windows\System32\KqUbkRp.exe
  C:\Windows\System32\KqUbkRp.exe
  2⤵
  PID:6264
- C:\Windows\System32\wTLmPxH.exe
  C:\Windows\System32\wTLmPxH.exe
  2⤵
  PID:6292
- C:\Windows\System32\apkAQmG.exe
  C:\Windows\System32\apkAQmG.exe
  2⤵
  PID:6336
- C:\Windows\System32\qskWokg.exe
  C:\Windows\System32\qskWokg.exe
  2⤵
  PID:6352
- C:\Windows\System32\kwWufLV.exe
  C:\Windows\System32\kwWufLV.exe
  2⤵
  PID:6404
- C:\Windows\System32\qoXpcIC.exe
  C:\Windows\System32\qoXpcIC.exe
  2⤵
  PID:6420
- C:\Windows\System32\HzFPBKA.exe
  C:\Windows\System32\HzFPBKA.exe
  2⤵
  PID:6444
- C:\Windows\System32\tGDeUtb.exe
  C:\Windows\System32\tGDeUtb.exe
  2⤵
  PID:6460
- C:\Windows\System32\MYEwWLI.exe
  C:\Windows\System32\MYEwWLI.exe
  2⤵
  PID:6488
- C:\Windows\System32\aQOQIMR.exe
  C:\Windows\System32\aQOQIMR.exe
  2⤵
  PID:6520
- C:\Windows\System32\HVCnbNB.exe
  C:\Windows\System32\HVCnbNB.exe
  2⤵
  PID:6540
- C:\Windows\System32\PliwbvX.exe
  C:\Windows\System32\PliwbvX.exe
  2⤵
  PID:6560
- C:\Windows\System32\twDdXUE.exe
  C:\Windows\System32\twDdXUE.exe
  2⤵
  PID:6600
- C:\Windows\System32\XRAoOWh.exe
  C:\Windows\System32\XRAoOWh.exe
  2⤵
  PID:6656
- C:\Windows\System32\pLKyLbp.exe
  C:\Windows\System32\pLKyLbp.exe
  2⤵
  PID:6692
- C:\Windows\System32\zwKmFRm.exe
  C:\Windows\System32\zwKmFRm.exe
  2⤵
  PID:6744
- C:\Windows\System32\pQgnSRZ.exe
  C:\Windows\System32\pQgnSRZ.exe
  2⤵
  PID:6764
- C:\Windows\System32\ymLqAXi.exe
  C:\Windows\System32\ymLqAXi.exe
  2⤵
  PID:6792
- C:\Windows\System32\cnvuFXy.exe
  C:\Windows\System32\cnvuFXy.exe
  2⤵
  PID:6832
- C:\Windows\System32\GxtAfBM.exe
  C:\Windows\System32\GxtAfBM.exe
  2⤵
  PID:6856
- C:\Windows\System32\Sxisbte.exe
  C:\Windows\System32\Sxisbte.exe
  2⤵
  PID:6876
- C:\Windows\System32\OWSkqsj.exe
  C:\Windows\System32\OWSkqsj.exe
  2⤵
  PID:6896
- C:\Windows\System32\mJIoJPX.exe
  C:\Windows\System32\mJIoJPX.exe
  2⤵
  PID:6928
- C:\Windows\System32\JdLtTrq.exe
  C:\Windows\System32\JdLtTrq.exe
  2⤵
  PID:6960
- C:\Windows\System32\uiyZqYu.exe
  C:\Windows\System32\uiyZqYu.exe
  2⤵
  PID:6984
- C:\Windows\System32\BMpFNJv.exe
  C:\Windows\System32\BMpFNJv.exe
  2⤵
  PID:7004
- C:\Windows\System32\DKBlEFc.exe
  C:\Windows\System32\DKBlEFc.exe
  2⤵
  PID:7052
- C:\Windows\System32\XVtewrM.exe
  C:\Windows\System32\XVtewrM.exe
  2⤵
  PID:7088
- C:\Windows\System32\ZSDvDie.exe
  C:\Windows\System32\ZSDvDie.exe
  2⤵
  PID:7112
- C:\Windows\System32\iOsMqQy.exe
  C:\Windows\System32\iOsMqQy.exe
  2⤵
  PID:7132
- C:\Windows\System32\GpvfZaa.exe
  C:\Windows\System32\GpvfZaa.exe
  2⤵
  PID:7148
- C:\Windows\System32\jMBCNUC.exe
  C:\Windows\System32\jMBCNUC.exe
  2⤵
  PID:1136
- C:\Windows\System32\qVApDNP.exe
  C:\Windows\System32\qVApDNP.exe
  2⤵
  PID:6136
- C:\Windows\System32\dMhsusX.exe
  C:\Windows\System32\dMhsusX.exe
  2⤵
  PID:6228
- C:\Windows\System32\SCsEUJD.exe
  C:\Windows\System32\SCsEUJD.exe
  2⤵
  PID:6260
- C:\Windows\System32\VqmVLxM.exe
  C:\Windows\System32\VqmVLxM.exe
  2⤵
  PID:6400
- C:\Windows\System32\tLiZEwe.exe
  C:\Windows\System32\tLiZEwe.exe
  2⤵
  PID:6344
- C:\Windows\System32\CozIQOb.exe
  C:\Windows\System32\CozIQOb.exe
  2⤵
  PID:6552
- C:\Windows\System32\qphRZjo.exe
  C:\Windows\System32\qphRZjo.exe
  2⤵
  PID:6556
- C:\Windows\System32\eYdgfDR.exe
  C:\Windows\System32\eYdgfDR.exe
  2⤵
  PID:6640
- C:\Windows\System32\uNzKeyd.exe
  C:\Windows\System32\uNzKeyd.exe
  2⤵
  PID:6728
- C:\Windows\System32\iOVlDpa.exe
  C:\Windows\System32\iOVlDpa.exe
  2⤵
  PID:6752
- C:\Windows\System32\oQemrlr.exe
  C:\Windows\System32\oQemrlr.exe
  2⤵
  PID:6784
- C:\Windows\System32\vAIevWg.exe
  C:\Windows\System32\vAIevWg.exe
  2⤵
  PID:6888
- C:\Windows\System32\kQyJoXS.exe
  C:\Windows\System32\kQyJoXS.exe
  2⤵
  PID:6944
- C:\Windows\System32\rLYVshN.exe
  C:\Windows\System32\rLYVshN.exe
  2⤵
  PID:6996
- C:\Windows\System32\EAIXpEc.exe
  C:\Windows\System32\EAIXpEc.exe
  2⤵
  PID:7044
- C:\Windows\System32\RVrNAZe.exe
  C:\Windows\System32\RVrNAZe.exe
  2⤵
  PID:7128
- C:\Windows\System32\YHeZiOF.exe
  C:\Windows\System32\YHeZiOF.exe
  2⤵
  PID:7164
- C:\Windows\System32\ecMuYYi.exe
  C:\Windows\System32\ecMuYYi.exe
  2⤵
  PID:6216
- C:\Windows\System32\UpLXUAQ.exe
  C:\Windows\System32\UpLXUAQ.exe
  2⤵
  PID:6380
- C:\Windows\System32\UKDAqJz.exe
  C:\Windows\System32\UKDAqJz.exe
  2⤵
  PID:6628
- C:\Windows\System32\yCekOyC.exe
  C:\Windows\System32\yCekOyC.exe
  2⤵
  PID:6824
- C:\Windows\System32\IzygNdz.exe
  C:\Windows\System32\IzygNdz.exe
  2⤵
  PID:7000
- C:\Windows\System32\rrcsOBe.exe
  C:\Windows\System32\rrcsOBe.exe
  2⤵
  PID:7080
- C:\Windows\System32\GePrzqt.exe
  C:\Windows\System32\GePrzqt.exe
  2⤵
  PID:6348
- C:\Windows\System32\VFIuxcz.exe
  C:\Windows\System32\VFIuxcz.exe
  2⤵
  PID:6436
- C:\Windows\System32\xSGAmud.exe
  C:\Windows\System32\xSGAmud.exe
  2⤵
  PID:6760
- C:\Windows\System32\RhhVwOm.exe
  C:\Windows\System32\RhhVwOm.exe
  2⤵
  PID:7144
- C:\Windows\System32\XpsznkO.exe
  C:\Windows\System32\XpsznkO.exe
  2⤵
  PID:6172
- C:\Windows\System32\yvSeofP.exe
  C:\Windows\System32\yvSeofP.exe
  2⤵
  PID:7192
- C:\Windows\System32\uXqsaTh.exe
  C:\Windows\System32\uXqsaTh.exe
  2⤵
  PID:7232
- C:\Windows\System32\qjHcWZc.exe
  C:\Windows\System32\qjHcWZc.exe
  2⤵
  PID:7272
- C:\Windows\System32\SKadzKf.exe
  C:\Windows\System32\SKadzKf.exe
  2⤵
  PID:7292
- C:\Windows\System32\ffFeHib.exe
  C:\Windows\System32\ffFeHib.exe
  2⤵
  PID:7320
- C:\Windows\System32\bBUNmxS.exe
  C:\Windows\System32\bBUNmxS.exe
  2⤵
  PID:7336
- C:\Windows\System32\IKNofuS.exe
  C:\Windows\System32\IKNofuS.exe
  2⤵
  PID:7364
- C:\Windows\System32\zzRCluY.exe
  C:\Windows\System32\zzRCluY.exe
  2⤵
  PID:7384
- C:\Windows\System32\PyowPAF.exe
  C:\Windows\System32\PyowPAF.exe
  2⤵
  PID:7456
- C:\Windows\System32\QNFhhQi.exe
  C:\Windows\System32\QNFhhQi.exe
  2⤵
  PID:7472
- C:\Windows\System32\DIFdhXj.exe
  C:\Windows\System32\DIFdhXj.exe
  2⤵
  PID:7488
- C:\Windows\System32\HOMTCYT.exe
  C:\Windows\System32\HOMTCYT.exe
  2⤵
  PID:7516
- C:\Windows\System32\BieAmxX.exe
  C:\Windows\System32\BieAmxX.exe
  2⤵
  PID:7548
- C:\Windows\System32\JPiApDv.exe
  C:\Windows\System32\JPiApDv.exe
  2⤵
  PID:7588
- C:\Windows\System32\BYfHsYa.exe
  C:\Windows\System32\BYfHsYa.exe
  2⤵
  PID:7608
- C:\Windows\System32\fbkskeY.exe
  C:\Windows\System32\fbkskeY.exe
  2⤵
  PID:7624
- C:\Windows\System32\LkLdpoS.exe
  C:\Windows\System32\LkLdpoS.exe
  2⤵
  PID:7648
- C:\Windows\System32\iDAbadm.exe
  C:\Windows\System32\iDAbadm.exe
  2⤵
  PID:7664
- C:\Windows\System32\zfPQuid.exe
  C:\Windows\System32\zfPQuid.exe
  2⤵
  PID:7688
- C:\Windows\System32\vYwZDcB.exe
  C:\Windows\System32\vYwZDcB.exe
  2⤵
  PID:7712
- C:\Windows\System32\trXnpeB.exe
  C:\Windows\System32\trXnpeB.exe
  2⤵
  PID:7760
- C:\Windows\System32\ErtUjlK.exe
  C:\Windows\System32\ErtUjlK.exe
  2⤵
  PID:7800
- C:\Windows\System32\YxEPgOU.exe
  C:\Windows\System32\YxEPgOU.exe
  2⤵
  PID:7816
- C:\Windows\System32\YzXkIdV.exe
  C:\Windows\System32\YzXkIdV.exe
  2⤵
  PID:7844
- C:\Windows\System32\tqauUws.exe
  C:\Windows\System32\tqauUws.exe
  2⤵
  PID:7892
- C:\Windows\System32\kgahDAI.exe
  C:\Windows\System32\kgahDAI.exe
  2⤵
  PID:7916
- C:\Windows\System32\NBudwtb.exe
  C:\Windows\System32\NBudwtb.exe
  2⤵
  PID:7944
- C:\Windows\System32\Heobsqk.exe
  C:\Windows\System32\Heobsqk.exe
  2⤵
  PID:7984
- C:\Windows\System32\FzpSSFK.exe
  C:\Windows\System32\FzpSSFK.exe
  2⤵
  PID:8012
- C:\Windows\System32\eNQntTx.exe
  C:\Windows\System32\eNQntTx.exe
  2⤵
  PID:8028
- C:\Windows\System32\VIpADVA.exe
  C:\Windows\System32\VIpADVA.exe
  2⤵
  PID:8044
- C:\Windows\System32\VXSWLNQ.exe
  C:\Windows\System32\VXSWLNQ.exe
  2⤵
  PID:8072
- C:\Windows\System32\qEUaAvh.exe
  C:\Windows\System32\qEUaAvh.exe
  2⤵
  PID:8132
- C:\Windows\System32\cIITtxz.exe
  C:\Windows\System32\cIITtxz.exe
  2⤵
  PID:8172
- C:\Windows\System32\vVZOlWM.exe
  C:\Windows\System32\vVZOlWM.exe
  2⤵
  PID:6712
- C:\Windows\System32\DqWDzwP.exe
  C:\Windows\System32\DqWDzwP.exe
  2⤵
  PID:7172
- C:\Windows\System32\oTttMre.exe
  C:\Windows\System32\oTttMre.exe
  2⤵
  PID:7228
- C:\Windows\System32\ZixHHpm.exe
  C:\Windows\System32\ZixHHpm.exe
  2⤵
  PID:7300
- C:\Windows\System32\AfUotJU.exe
  C:\Windows\System32\AfUotJU.exe
  2⤵
  PID:7376
- C:\Windows\System32\JyAHmRF.exe
  C:\Windows\System32\JyAHmRF.exe
  2⤵
  PID:7452
- C:\Windows\System32\CBQxPTX.exe
  C:\Windows\System32\CBQxPTX.exe
  2⤵
  PID:7524
- C:\Windows\System32\mZpUwff.exe
  C:\Windows\System32\mZpUwff.exe
  2⤵
  PID:7556
- C:\Windows\System32\uoFTPQf.exe
  C:\Windows\System32\uoFTPQf.exe
  2⤵
  PID:7596
- C:\Windows\System32\uAuWvPG.exe
  C:\Windows\System32\uAuWvPG.exe
  2⤵
  PID:7720
- C:\Windows\System32\TIvtbIj.exe
  C:\Windows\System32\TIvtbIj.exe
  2⤵
  PID:7784
- C:\Windows\System32\TWaiIJt.exe
  C:\Windows\System32\TWaiIJt.exe
  2⤵
  PID:7868
- C:\Windows\System32\BNpNOHj.exe
  C:\Windows\System32\BNpNOHj.exe
  2⤵
  PID:7912
- C:\Windows\System32\TSRuSMS.exe
  C:\Windows\System32\TSRuSMS.exe
  2⤵
  PID:7956
- C:\Windows\System32\GfZFjfA.exe
  C:\Windows\System32\GfZFjfA.exe
  2⤵
  PID:7996
- C:\Windows\System32\lbSTRzZ.exe
  C:\Windows\System32\lbSTRzZ.exe
  2⤵
  PID:8096
- C:\Windows\System32\AxeXnYa.exe
  C:\Windows\System32\AxeXnYa.exe
  2⤵
  PID:8148
- C:\Windows\System32\QPbuecw.exe
  C:\Windows\System32\QPbuecw.exe
  2⤵
  PID:7328
- C:\Windows\System32\SiEVnwu.exe
  C:\Windows\System32\SiEVnwu.exe
  2⤵
  PID:8056
- C:\Windows\System32\oAlUhWG.exe
  C:\Windows\System32\oAlUhWG.exe
  2⤵
  PID:7536
- C:\Windows\System32\mvUZpEu.exe
  C:\Windows\System32\mvUZpEu.exe
  2⤵
  PID:7620
- C:\Windows\System32\YRyWPLW.exe
  C:\Windows\System32\YRyWPLW.exe
  2⤵
  PID:7792
- C:\Windows\System32\Xkivqfy.exe
  C:\Windows\System32\Xkivqfy.exe
  2⤵
  PID:7932
- C:\Windows\System32\HBZqkOd.exe
  C:\Windows\System32\HBZqkOd.exe
  2⤵
  PID:8068
- C:\Windows\System32\XlUZrni.exe
  C:\Windows\System32\XlUZrni.exe
  2⤵
  PID:8104
- C:\Windows\System32\VsQaryg.exe
  C:\Windows\System32\VsQaryg.exe
  2⤵
  PID:7840
- C:\Windows\System32\QNZmpXN.exe
  C:\Windows\System32\QNZmpXN.exe
  2⤵
  PID:7412
- C:\Windows\System32\csiDpLg.exe
  C:\Windows\System32\csiDpLg.exe
  2⤵
  PID:8120
- C:\Windows\System32\nFXiDRd.exe
  C:\Windows\System32\nFXiDRd.exe
  2⤵
  PID:8216
- C:\Windows\System32\FfczLii.exe
  C:\Windows\System32\FfczLii.exe
  2⤵
  PID:8240
- C:\Windows\System32\QsRInMy.exe
  C:\Windows\System32\QsRInMy.exe
  2⤵
  PID:8260
- C:\Windows\System32\zTEGqUF.exe
  C:\Windows\System32\zTEGqUF.exe
  2⤵
  PID:8276
- C:\Windows\System32\WcqACLz.exe
  C:\Windows\System32\WcqACLz.exe
  2⤵
  PID:8320
- C:\Windows\System32\SVRMehb.exe
  C:\Windows\System32\SVRMehb.exe
  2⤵
  PID:8356
- C:\Windows\System32\uhvqepU.exe
  C:\Windows\System32\uhvqepU.exe
  2⤵
  PID:8376
- C:\Windows\System32\iyjcAKt.exe
  C:\Windows\System32\iyjcAKt.exe
  2⤵
  PID:8400
- C:\Windows\System32\kbsdbbP.exe
  C:\Windows\System32\kbsdbbP.exe
  2⤵
  PID:8428
- C:\Windows\System32\RkoGEYX.exe
  C:\Windows\System32\RkoGEYX.exe
  2⤵
  PID:8448
- C:\Windows\System32\ilQSVFp.exe
  C:\Windows\System32\ilQSVFp.exe
  2⤵
  PID:8476
- C:\Windows\System32\RrXyXvj.exe
  C:\Windows\System32\RrXyXvj.exe
  2⤵
  PID:8516
- C:\Windows\System32\caYuTkW.exe
  C:\Windows\System32\caYuTkW.exe
  2⤵
  PID:8544
- C:\Windows\System32\EKoZYRS.exe
  C:\Windows\System32\EKoZYRS.exe
  2⤵
  PID:8568
- C:\Windows\System32\QzpCQip.exe
  C:\Windows\System32\QzpCQip.exe
  2⤵
  PID:8612
- C:\Windows\System32\UMfLeZJ.exe
  C:\Windows\System32\UMfLeZJ.exe
  2⤵
  PID:8640
- C:\Windows\System32\dnAUTCB.exe
  C:\Windows\System32\dnAUTCB.exe
  2⤵
  PID:8668
- C:\Windows\System32\oAczVVt.exe
  C:\Windows\System32\oAczVVt.exe
  2⤵
  PID:8696
- C:\Windows\System32\ZyllpMo.exe
  C:\Windows\System32\ZyllpMo.exe
  2⤵
  PID:8720
- C:\Windows\System32\EksLPJJ.exe
  C:\Windows\System32\EksLPJJ.exe
  2⤵
  PID:8744
- C:\Windows\System32\FydBAkw.exe
  C:\Windows\System32\FydBAkw.exe
  2⤵
  PID:8760
- C:\Windows\System32\lnDRlGN.exe
  C:\Windows\System32\lnDRlGN.exe
  2⤵
  PID:8812
- C:\Windows\System32\ZBBwspL.exe
  C:\Windows\System32\ZBBwspL.exe
  2⤵
  PID:8836
- C:\Windows\System32\DqExZDa.exe
  C:\Windows\System32\DqExZDa.exe
  2⤵
  PID:8864
- C:\Windows\System32\YHZxYvW.exe
  C:\Windows\System32\YHZxYvW.exe
  2⤵
  PID:8880
- C:\Windows\System32\iwPkcVC.exe
  C:\Windows\System32\iwPkcVC.exe
  2⤵
  PID:8900
- C:\Windows\System32\wZLLTfR.exe
  C:\Windows\System32\wZLLTfR.exe
  2⤵
  PID:8940
- C:\Windows\System32\cmpAduu.exe
  C:\Windows\System32\cmpAduu.exe
  2⤵
  PID:8956
- C:\Windows\System32\VCApvfv.exe
  C:\Windows\System32\VCApvfv.exe
  2⤵
  PID:8980
- C:\Windows\System32\wranjab.exe
  C:\Windows\System32\wranjab.exe
  2⤵
  PID:9100
- C:\Windows\System32\IBPQGsM.exe
  C:\Windows\System32\IBPQGsM.exe
  2⤵
  PID:9116
- C:\Windows\System32\LsNcwKS.exe
  C:\Windows\System32\LsNcwKS.exe
  2⤵
  PID:9132
- C:\Windows\System32\rJIrSSF.exe
  C:\Windows\System32\rJIrSSF.exe
  2⤵
  PID:9148
- C:\Windows\System32\rgFORWg.exe
  C:\Windows\System32\rgFORWg.exe
  2⤵
  PID:9164
- C:\Windows\System32\XoOdocT.exe
  C:\Windows\System32\XoOdocT.exe
  2⤵
  PID:9184
- C:\Windows\System32\NqzbtUP.exe
  C:\Windows\System32\NqzbtUP.exe
  2⤵
  PID:9200
- C:\Windows\System32\ZPJXIrN.exe
  C:\Windows\System32\ZPJXIrN.exe
  2⤵
  PID:7436
- C:\Windows\System32\PvadKDi.exe
  C:\Windows\System32\PvadKDi.exe
  2⤵
  PID:8208
- C:\Windows\System32\RtfBVYH.exe
  C:\Windows\System32\RtfBVYH.exe
  2⤵
  PID:8248
- C:\Windows\System32\QOTVHuh.exe
  C:\Windows\System32\QOTVHuh.exe
  2⤵
  PID:8296
- C:\Windows\System32\NAAqLEu.exe
  C:\Windows\System32\NAAqLEu.exe
  2⤵
  PID:8340
- C:\Windows\System32\tIoMVpa.exe
  C:\Windows\System32\tIoMVpa.exe
  2⤵
  PID:8388
- C:\Windows\System32\naZolGd.exe
  C:\Windows\System32\naZolGd.exe
  2⤵
  PID:8368
- C:\Windows\System32\QqvCTbN.exe
  C:\Windows\System32\QqvCTbN.exe
  2⤵
  PID:8440
- C:\Windows\System32\LumwGda.exe
  C:\Windows\System32\LumwGda.exe
  2⤵
  PID:8552
- C:\Windows\System32\hFiBkFR.exe
  C:\Windows\System32\hFiBkFR.exe
  2⤵
  PID:8608
- C:\Windows\System32\qHHFRjf.exe
  C:\Windows\System32\qHHFRjf.exe
  2⤵
  PID:8732
- C:\Windows\System32\hNMHDSV.exe
  C:\Windows\System32\hNMHDSV.exe
  2⤵
  PID:8932
- C:\Windows\System32\BiwhEzU.exe
  C:\Windows\System32\BiwhEzU.exe
  2⤵
  PID:9056
- C:\Windows\System32\BhgtAby.exe
  C:\Windows\System32\BhgtAby.exe
  2⤵
  PID:9128
- C:\Windows\System32\ocaYQsG.exe
  C:\Windows\System32\ocaYQsG.exe
  2⤵
  PID:8272
- C:\Windows\System32\KPnlmDP.exe
  C:\Windows\System32\KPnlmDP.exe
  2⤵
  PID:8488
- C:\Windows\System32\ARdOxNT.exe
  C:\Windows\System32\ARdOxNT.exe
  2⤵
  PID:8536
- C:\Windows\System32\uZQQssw.exe
  C:\Windows\System32\uZQQssw.exe
  2⤵
  PID:8824
- C:\Windows\System32\eVmbcIA.exe
  C:\Windows\System32\eVmbcIA.exe
  2⤵
  PID:9208
- C:\Windows\System32\PKLcggG.exe
  C:\Windows\System32\PKLcggG.exe
  2⤵
  PID:8460
- C:\Windows\System32\TVgQbHF.exe
  C:\Windows\System32\TVgQbHF.exe
  2⤵
  PID:8492
- C:\Windows\System32\NvfmGJl.exe
  C:\Windows\System32\NvfmGJl.exe
  2⤵
  PID:9068
- C:\Windows\System32\IAAyUYB.exe
  C:\Windows\System32\IAAyUYB.exe
  2⤵
  PID:9212
- C:\Windows\System32\BjoVQpE.exe
  C:\Windows\System32\BjoVQpE.exe
  2⤵
  PID:8596
- C:\Windows\System32\vKWZfJa.exe
  C:\Windows\System32\vKWZfJa.exe
  2⤵
  PID:9108
- C:\Windows\System32\XhZWnbg.exe
  C:\Windows\System32\XhZWnbg.exe
  2⤵
  PID:8228
- C:\Windows\System32\ZIJOOZW.exe
  C:\Windows\System32\ZIJOOZW.exe
  2⤵
  PID:8232
- C:\Windows\System32\EwfxwwI.exe
  C:\Windows\System32\EwfxwwI.exe
  2⤵
  PID:8352
- C:\Windows\System32\UgHAzqh.exe
  C:\Windows\System32\UgHAzqh.exe
  2⤵
  PID:9236
- C:\Windows\System32\nHlvCrq.exe
  C:\Windows\System32\nHlvCrq.exe
  2⤵
  PID:9264
- C:\Windows\System32\BXqKApJ.exe
  C:\Windows\System32\BXqKApJ.exe
  2⤵
  PID:9292
- C:\Windows\System32\jTVRjmn.exe
  C:\Windows\System32\jTVRjmn.exe
  2⤵
  PID:9320
- C:\Windows\System32\mLWjMle.exe
  C:\Windows\System32\mLWjMle.exe
  2⤵
  PID:9336
- C:\Windows\System32\BxDVlKV.exe
  C:\Windows\System32\BxDVlKV.exe
  2⤵
  PID:9364
- C:\Windows\System32\ArcvxDe.exe
  C:\Windows\System32\ArcvxDe.exe
  2⤵
  PID:9384
- C:\Windows\System32\LlgVFPT.exe
  C:\Windows\System32\LlgVFPT.exe
  2⤵
  PID:9408
- C:\Windows\System32\Oogjnja.exe
  C:\Windows\System32\Oogjnja.exe
  2⤵
  PID:9448
- C:\Windows\System32\sTEQyGS.exe
  C:\Windows\System32\sTEQyGS.exe
  2⤵
  PID:9488
- C:\Windows\System32\tvtWeOs.exe
  C:\Windows\System32\tvtWeOs.exe
  2⤵
  PID:9504
- C:\Windows\System32\cstptkx.exe
  C:\Windows\System32\cstptkx.exe
  2⤵
  PID:9532
- C:\Windows\System32\FTwjQlF.exe
  C:\Windows\System32\FTwjQlF.exe
  2⤵
  PID:9568
- C:\Windows\System32\kXIZTQZ.exe
  C:\Windows\System32\kXIZTQZ.exe
  2⤵
  PID:9588
- C:\Windows\System32\fRzhqwH.exe
  C:\Windows\System32\fRzhqwH.exe
  2⤵
  PID:9612
- C:\Windows\System32\ssWJhMe.exe
  C:\Windows\System32\ssWJhMe.exe
  2⤵
  PID:9636
- C:\Windows\System32\pOtHmBZ.exe
  C:\Windows\System32\pOtHmBZ.exe
  2⤵
  PID:9680
- C:\Windows\System32\aqeWPoK.exe
  C:\Windows\System32\aqeWPoK.exe
  2⤵
  PID:9700
- C:\Windows\System32\UNoPEVd.exe
  C:\Windows\System32\UNoPEVd.exe
  2⤵
  PID:9740
- C:\Windows\System32\RyvJZsq.exe
  C:\Windows\System32\RyvJZsq.exe
  2⤵
  PID:9756
- C:\Windows\System32\rTpuJHf.exe
  C:\Windows\System32\rTpuJHf.exe
  2⤵
  PID:9784
- C:\Windows\System32\LTtezuf.exe
  C:\Windows\System32\LTtezuf.exe
  2⤵
  PID:9804
- C:\Windows\System32\DAvmcWm.exe
  C:\Windows\System32\DAvmcWm.exe
  2⤵
  PID:9828
- C:\Windows\System32\aUFJCpN.exe
  C:\Windows\System32\aUFJCpN.exe
  2⤵
  PID:9864
- C:\Windows\System32\udZMcyb.exe
  C:\Windows\System32\udZMcyb.exe
  2⤵
  PID:9896
- C:\Windows\System32\pSNqetL.exe
  C:\Windows\System32\pSNqetL.exe
  2⤵
  PID:9912
- C:\Windows\System32\EOlrJee.exe
  C:\Windows\System32\EOlrJee.exe
  2⤵
  PID:9944
- C:\Windows\System32\vknzPnm.exe
  C:\Windows\System32\vknzPnm.exe
  2⤵
  PID:9964
- C:\Windows\System32\FVpsLhH.exe
  C:\Windows\System32\FVpsLhH.exe
  2⤵
  PID:10016
- C:\Windows\System32\LtnYVps.exe
  C:\Windows\System32\LtnYVps.exe
  2⤵
  PID:10036
- C:\Windows\System32\NPVfIJT.exe
  C:\Windows\System32\NPVfIJT.exe
  2⤵
  PID:10060
- C:\Windows\System32\GhkQhhg.exe
  C:\Windows\System32\GhkQhhg.exe
  2⤵
  PID:10092
- C:\Windows\System32\KmOYeSs.exe
  C:\Windows\System32\KmOYeSs.exe
  2⤵
  PID:10132
- C:\Windows\System32\aAVtCko.exe
  C:\Windows\System32\aAVtCko.exe
  2⤵
  PID:10164
- C:\Windows\System32\eXeOaKe.exe
  C:\Windows\System32\eXeOaKe.exe
  2⤵
  PID:10196
- C:\Windows\System32\wYjVKeY.exe
  C:\Windows\System32\wYjVKeY.exe
  2⤵
  PID:10232
- C:\Windows\System32\IwePlnK.exe
  C:\Windows\System32\IwePlnK.exe
  2⤵
  PID:9220
- C:\Windows\System32\hRfkuvL.exe
  C:\Windows\System32\hRfkuvL.exe
  2⤵
  PID:9276
- C:\Windows\System32\wTkLzeC.exe
  C:\Windows\System32\wTkLzeC.exe
  2⤵
  PID:9332
- C:\Windows\System32\ZsSORfH.exe
  C:\Windows\System32\ZsSORfH.exe
  2⤵
  PID:9380
- C:\Windows\System32\thfAKZS.exe
  C:\Windows\System32\thfAKZS.exe
  2⤵
  PID:9396
- C:\Windows\System32\eIpQWRD.exe
  C:\Windows\System32\eIpQWRD.exe
  2⤵
  PID:9464
- C:\Windows\System32\tVXCNpq.exe
  C:\Windows\System32\tVXCNpq.exe
  2⤵
  PID:9628
- C:\Windows\System32\RjUtAFU.exe
  C:\Windows\System32\RjUtAFU.exe
  2⤵
  PID:9688
- C:\Windows\System32\hKtYluI.exe
  C:\Windows\System32\hKtYluI.exe
  2⤵
  PID:9732
- C:\Windows\System32\SpqJphS.exe
  C:\Windows\System32\SpqJphS.exe
  2⤵
  PID:9860
- C:\Windows\System32\nTHGvBx.exe
  C:\Windows\System32\nTHGvBx.exe
  2⤵
  PID:9920
- C:\Windows\System32\btwfavg.exe
  C:\Windows\System32\btwfavg.exe
  2⤵
  PID:9984
- C:\Windows\System32\QPCaImz.exe
  C:\Windows\System32\QPCaImz.exe
  2⤵
  PID:10028
- C:\Windows\System32\TnZOQKH.exe
  C:\Windows\System32\TnZOQKH.exe
  2⤵
  PID:10084
- C:\Windows\System32\UGwioAz.exe
  C:\Windows\System32\UGwioAz.exe
  2⤵
  PID:10116
- C:\Windows\System32\iDUpwxu.exe
  C:\Windows\System32\iDUpwxu.exe
  2⤵
  PID:10228
- C:\Windows\System32\dLCVhZw.exe
  C:\Windows\System32\dLCVhZw.exe
  2⤵
  PID:9284
- C:\Windows\System32\PmYsHPx.exe
  C:\Windows\System32\PmYsHPx.exe
  2⤵
  PID:9436
- C:\Windows\System32\CoYiCmh.exe
  C:\Windows\System32\CoYiCmh.exe
  2⤵
  PID:9664
- C:\Windows\System32\fHLsaCR.exe
  C:\Windows\System32\fHLsaCR.exe
  2⤵
  PID:9780
- C:\Windows\System32\GPsMCbH.exe
  C:\Windows\System32\GPsMCbH.exe
  2⤵
  PID:9892
- C:\Windows\System32\mmhOIkQ.exe
  C:\Windows\System32\mmhOIkQ.exe
  2⤵
  PID:10048
- C:\Windows\System32\ejjQdVQ.exe
  C:\Windows\System32\ejjQdVQ.exe
  2⤵
  PID:9312
- C:\Windows\System32\BFmOxzR.exe
  C:\Windows\System32\BFmOxzR.exe
  2⤵
  PID:9516
- C:\Windows\System32\AYpsBfK.exe
  C:\Windows\System32\AYpsBfK.exe
  2⤵
  PID:9752
- C:\Windows\System32\ITqIFre.exe
  C:\Windows\System32\ITqIFre.exe
  2⤵
  PID:9376
- C:\Windows\System32\yQswXCo.exe
  C:\Windows\System32\yQswXCo.exe
  2⤵
  PID:464
- C:\Windows\System32\QmvfRpi.exe
  C:\Windows\System32\QmvfRpi.exe
  2⤵
  PID:10276
- C:\Windows\System32\jXkssYi.exe
  C:\Windows\System32\jXkssYi.exe
  2⤵
  PID:10292
- C:\Windows\System32\DhMhohF.exe
  C:\Windows\System32\DhMhohF.exe
  2⤵
  PID:10320
- C:\Windows\System32\IYJvnPP.exe
  C:\Windows\System32\IYJvnPP.exe
  2⤵
  PID:10360
- C:\Windows\System32\KPntYnf.exe
  C:\Windows\System32\KPntYnf.exe
  2⤵
  PID:10396
- C:\Windows\System32\HYgVwIR.exe
  C:\Windows\System32\HYgVwIR.exe
  2⤵
  PID:10416
- C:\Windows\System32\eBlTxBE.exe
  C:\Windows\System32\eBlTxBE.exe
  2⤵
  PID:10460
- C:\Windows\System32\xwpteGR.exe
  C:\Windows\System32\xwpteGR.exe
  2⤵
  PID:10476
- C:\Windows\System32\vieqxBR.exe
  C:\Windows\System32\vieqxBR.exe
  2⤵
  PID:10492
- C:\Windows\System32\LFrCoVL.exe
  C:\Windows\System32\LFrCoVL.exe
  2⤵
  PID:10512
- C:\Windows\System32\kQqOClJ.exe
  C:\Windows\System32\kQqOClJ.exe
  2⤵
  PID:10540
- C:\Windows\System32\evUCCvP.exe
  C:\Windows\System32\evUCCvP.exe
  2⤵
  PID:10568
- C:\Windows\System32\iFqUoDK.exe
  C:\Windows\System32\iFqUoDK.exe
  2⤵
  PID:10584
- C:\Windows\System32\HuViEPr.exe
  C:\Windows\System32\HuViEPr.exe
  2⤵
  PID:10648
- C:\Windows\System32\KgMSmRv.exe
  C:\Windows\System32\KgMSmRv.exe
  2⤵
  PID:10668
- C:\Windows\System32\kugtsFw.exe
  C:\Windows\System32\kugtsFw.exe
  2⤵
  PID:10692
- C:\Windows\System32\NFfTazv.exe
  C:\Windows\System32\NFfTazv.exe
  2⤵
  PID:10712
- C:\Windows\System32\GqtWqOv.exe
  C:\Windows\System32\GqtWqOv.exe
  2⤵
  PID:10744
- C:\Windows\System32\AzRHpTi.exe
  C:\Windows\System32\AzRHpTi.exe
  2⤵
  PID:10784
- C:\Windows\System32\znlFZZS.exe
  C:\Windows\System32\znlFZZS.exe
  2⤵
  PID:10816
- C:\Windows\System32\UZqLneA.exe
  C:\Windows\System32\UZqLneA.exe
  2⤵
  PID:10836
- C:\Windows\System32\GmTCMpt.exe
  C:\Windows\System32\GmTCMpt.exe
  2⤵
  PID:10856
- C:\Windows\System32\njrIOMT.exe
  C:\Windows\System32\njrIOMT.exe
  2⤵
  PID:10904
- C:\Windows\System32\bzpdglX.exe
  C:\Windows\System32\bzpdglX.exe
  2⤵
  PID:10928
- C:\Windows\System32\mowBRnI.exe
  C:\Windows\System32\mowBRnI.exe
  2⤵
  PID:10952
- C:\Windows\System32\LnttNQt.exe
  C:\Windows\System32\LnttNQt.exe
  2⤵
  PID:10992
- C:\Windows\System32\xbgTHlM.exe
  C:\Windows\System32\xbgTHlM.exe
  2⤵
  PID:11012
- C:\Windows\System32\IFOXBVv.exe
  C:\Windows\System32\IFOXBVv.exe
  2⤵
  PID:11028
- C:\Windows\System32\ZLhkutE.exe
  C:\Windows\System32\ZLhkutE.exe
  2⤵
  PID:11056
- C:\Windows\System32\OnHvzHm.exe
  C:\Windows\System32\OnHvzHm.exe
  2⤵
  PID:11084
- C:\Windows\System32\JnPOlGT.exe
  C:\Windows\System32\JnPOlGT.exe
  2⤵
  PID:11104
- C:\Windows\System32\sACwJQQ.exe
  C:\Windows\System32\sACwJQQ.exe
  2⤵
  PID:11120
- C:\Windows\System32\QocTyUg.exe
  C:\Windows\System32\QocTyUg.exe
  2⤵
  PID:11156
- C:\Windows\System32\FTkyDUg.exe
  C:\Windows\System32\FTkyDUg.exe
  2⤵
  PID:11216
- C:\Windows\System32\RVbrhrX.exe
  C:\Windows\System32\RVbrhrX.exe
  2⤵
  PID:11252
- C:\Windows\System32\sjfOjbk.exe
  C:\Windows\System32\sjfOjbk.exe
  2⤵
  PID:10316
- C:\Windows\System32\JytULlC.exe
  C:\Windows\System32\JytULlC.exe
  2⤵
  PID:10376
- C:\Windows\System32\DWhLdIG.exe
  C:\Windows\System32\DWhLdIG.exe
  2⤵
  PID:10456
- C:\Windows\System32\ZDSpzJB.exe
  C:\Windows\System32\ZDSpzJB.exe
  2⤵
  PID:10504
- C:\Windows\System32\jIAhmri.exe
  C:\Windows\System32\jIAhmri.exe
  2⤵
  PID:10564
- C:\Windows\System32\WUjGVct.exe
  C:\Windows\System32\WUjGVct.exe
  2⤵
  PID:10604
- C:\Windows\System32\ISaohoQ.exe
  C:\Windows\System32\ISaohoQ.exe
  2⤵
  PID:10664
- C:\Windows\System32\MbjnCFz.exe
  C:\Windows\System32\MbjnCFz.exe
  2⤵
  PID:10740
- C:\Windows\System32\DSXvtMm.exe
  C:\Windows\System32\DSXvtMm.exe
  2⤵
  PID:10828
- C:\Windows\System32\EpeVlZJ.exe
  C:\Windows\System32\EpeVlZJ.exe
  2⤵
  PID:10848
- C:\Windows\System32\nMZfOwK.exe
  C:\Windows\System32\nMZfOwK.exe
  2⤵
  PID:10912
- C:\Windows\System32\ZeVGGoE.exe
  C:\Windows\System32\ZeVGGoE.exe
  2⤵
  PID:11008
- C:\Windows\System32\oHCteAQ.exe
  C:\Windows\System32\oHCteAQ.exe
  2⤵
  PID:11080
- C:\Windows\System32\mAitqYi.exe
  C:\Windows\System32\mAitqYi.exe
  2⤵
  PID:11116
- C:\Windows\System32\NxoQguY.exe
  C:\Windows\System32\NxoQguY.exe
  2⤵
  PID:11176
- C:\Windows\System32\ZrPzXlv.exe
  C:\Windows\System32\ZrPzXlv.exe
  2⤵
  PID:11228
- C:\Windows\System32\rLYfflM.exe
  C:\Windows\System32\rLYfflM.exe
  2⤵
  PID:10468
- C:\Windows\System32\xDpemJb.exe
  C:\Windows\System32\xDpemJb.exe
  2⤵
  PID:10580
- C:\Windows\System32\LbsarGM.exe
  C:\Windows\System32\LbsarGM.exe
  2⤵
  PID:10644
- C:\Windows\System32\agftKgD.exe
  C:\Windows\System32\agftKgD.exe
  2⤵
  PID:10772
- C:\Windows\System32\rumOpiG.exe
  C:\Windows\System32\rumOpiG.exe
  2⤵
  PID:10876
- C:\Windows\System32\TegTKso.exe
  C:\Windows\System32\TegTKso.exe
  2⤵
  PID:11000
- C:\Windows\System32\IFkBpOx.exe
  C:\Windows\System32\IFkBpOx.exe
  2⤵
  PID:11184
- C:\Windows\System32\wYSVwSe.exe
  C:\Windows\System32\wYSVwSe.exe
  2⤵
  PID:10576
- C:\Windows\System32\ZjddNWT.exe
  C:\Windows\System32\ZjddNWT.exe
  2⤵
  PID:544
- C:\Windows\System32\AcIjGHP.exe
  C:\Windows\System32\AcIjGHP.exe
  2⤵
  PID:10804
- C:\Windows\System32\txqBFCB.exe
  C:\Windows\System32\txqBFCB.exe
  2⤵
  PID:4112
- C:\Windows\System32\bgGGiFm.exe
  C:\Windows\System32\bgGGiFm.exe
  2⤵
  PID:11068
- C:\Windows\System32\RUHjhgw.exe
  C:\Windows\System32\RUHjhgw.exe
  2⤵
  PID:11268
- C:\Windows\System32\xewkQWZ.exe
  C:\Windows\System32\xewkQWZ.exe
  2⤵
  PID:11288
- C:\Windows\System32\EPkMdum.exe
  C:\Windows\System32\EPkMdum.exe
  2⤵
  PID:11328
- C:\Windows\System32\mGdTxUU.exe
  C:\Windows\System32\mGdTxUU.exe
  2⤵
  PID:11356
- C:\Windows\System32\TcFXGYM.exe
  C:\Windows\System32\TcFXGYM.exe
  2⤵
  PID:11372
- C:\Windows\System32\bgDWttt.exe
  C:\Windows\System32\bgDWttt.exe
  2⤵
  PID:11412
- C:\Windows\System32\FQYisDj.exe
  C:\Windows\System32\FQYisDj.exe
  2⤵
  PID:11428
- C:\Windows\System32\eVqeOLu.exe
  C:\Windows\System32\eVqeOLu.exe
  2⤵
  PID:11456
- C:\Windows\System32\ZjNkbou.exe
  C:\Windows\System32\ZjNkbou.exe
  2⤵
  PID:11500
- C:\Windows\System32\xSumHiL.exe
  C:\Windows\System32\xSumHiL.exe
  2⤵
  PID:11524
- C:\Windows\System32\XDqrRdt.exe
  C:\Windows\System32\XDqrRdt.exe
  2⤵
  PID:11552
- C:\Windows\System32\kAlfVzT.exe
  C:\Windows\System32\kAlfVzT.exe
  2⤵
  PID:11580
- C:\Windows\System32\SBMMVUZ.exe
  C:\Windows\System32\SBMMVUZ.exe
  2⤵
  PID:11612
- C:\Windows\System32\HjXpjQP.exe
  C:\Windows\System32\HjXpjQP.exe
  2⤵
  PID:11636
- C:\Windows\System32\NThNSkx.exe
  C:\Windows\System32\NThNSkx.exe
  2⤵
  PID:11660
- C:\Windows\System32\ncrLGda.exe
  C:\Windows\System32\ncrLGda.exe
  2⤵
  PID:11708
- C:\Windows\System32\nYlWIkq.exe
  C:\Windows\System32\nYlWIkq.exe
  2⤵
  PID:11740
- C:\Windows\System32\ClRbyWj.exe
  C:\Windows\System32\ClRbyWj.exe
  2⤵
  PID:11772
- C:\Windows\System32\TtFXCmz.exe
  C:\Windows\System32\TtFXCmz.exe
  2⤵
  PID:11808
- C:\Windows\System32\TyCjFaa.exe
  C:\Windows\System32\TyCjFaa.exe
  2⤵
  PID:11872
- C:\Windows\System32\sXoChKT.exe
  C:\Windows\System32\sXoChKT.exe
  2⤵
  PID:11904
- C:\Windows\System32\ZPlbedU.exe
  C:\Windows\System32\ZPlbedU.exe
  2⤵
  PID:11920
- C:\Windows\System32\eryVmcv.exe
  C:\Windows\System32\eryVmcv.exe
  2⤵
  PID:11976
- C:\Windows\System32\FHMzuwV.exe
  C:\Windows\System32\FHMzuwV.exe
  2⤵
  PID:12016
- C:\Windows\System32\uiLipWu.exe
  C:\Windows\System32\uiLipWu.exe
  2⤵
  PID:12044
- C:\Windows\System32\PZkrnOb.exe
  C:\Windows\System32\PZkrnOb.exe
  2⤵
  PID:12084
- C:\Windows\System32\mSxDfcY.exe
  C:\Windows\System32\mSxDfcY.exe
  2⤵
  PID:12116
- C:\Windows\System32\lGhkvms.exe
  C:\Windows\System32\lGhkvms.exe
  2⤵
  PID:12152
- C:\Windows\System32\tLQpQVj.exe
  C:\Windows\System32\tLQpQVj.exe
  2⤵
  PID:12184
- C:\Windows\System32\hlfCOSj.exe
  C:\Windows\System32\hlfCOSj.exe
  2⤵
  PID:12228
- C:\Windows\System32\gumIFGt.exe
  C:\Windows\System32\gumIFGt.exe
  2⤵
  PID:12252
- C:\Windows\System32\KgLllxP.exe
  C:\Windows\System32\KgLllxP.exe
  2⤵
  PID:12284
- C:\Windows\System32\LajVEJX.exe
  C:\Windows\System32\LajVEJX.exe
  2⤵
  PID:11304
- C:\Windows\System32\YVaFArx.exe
  C:\Windows\System32\YVaFArx.exe
  2⤵
  PID:11368
- C:\Windows\System32\adidtcS.exe
  C:\Windows\System32\adidtcS.exe
  2⤵
  PID:11476
- C:\Windows\System32\pcORPRi.exe
  C:\Windows\System32\pcORPRi.exe
  2⤵
  PID:11512
- C:\Windows\System32\AOuWPxh.exe
  C:\Windows\System32\AOuWPxh.exe
  2⤵
  PID:11540
- C:\Windows\System32\ysMApHz.exe
  C:\Windows\System32\ysMApHz.exe
  2⤵
  PID:11688
- C:\Windows\System32\XPeBkxm.exe
  C:\Windows\System32\XPeBkxm.exe
  2⤵
  PID:11764
- C:\Windows\System32\IRimrqB.exe
  C:\Windows\System32\IRimrqB.exe
  2⤵
  PID:11888
- C:\Windows\System32\zjpdBmE.exe
  C:\Windows\System32\zjpdBmE.exe
  2⤵
  PID:12000
- C:\Windows\System32\QamxZJP.exe
  C:\Windows\System32\QamxZJP.exe
  2⤵
  PID:12052
- C:\Windows\System32\RvxZNVr.exe
  C:\Windows\System32\RvxZNVr.exe
  2⤵
  PID:12172
- C:\Windows\System32\efEZYmH.exe
  C:\Windows\System32\efEZYmH.exe
  2⤵
  PID:12212
- C:\Windows\System32\vBYbWHr.exe
  C:\Windows\System32\vBYbWHr.exe
  2⤵
  PID:11280
- C:\Windows\System32\eLGXPQQ.exe
  C:\Windows\System32\eLGXPQQ.exe
  2⤵
  PID:11548
- C:\Windows\System32\KETRNFE.exe
  C:\Windows\System32\KETRNFE.exe
  2⤵
  PID:11732
- C:\Windows\System32\fzUxNUQ.exe
  C:\Windows\System32\fzUxNUQ.exe
  2⤵
  PID:12032
- C:\Windows\System32\KbBRNCB.exe
  C:\Windows\System32\KbBRNCB.exe
  2⤵
  PID:12128
- C:\Windows\System32\yBRPKhB.exe
  C:\Windows\System32\yBRPKhB.exe
  2⤵
  PID:11284
- C:\Windows\System32\kvyzEpv.exe
  C:\Windows\System32\kvyzEpv.exe
  2⤵
  PID:4864
- C:\Windows\System32\ohTDApP.exe
  C:\Windows\System32\ohTDApP.exe
  2⤵
  PID:528
- C:\Windows\System32\cWlokdk.exe
  C:\Windows\System32\cWlokdk.exe
  2⤵
  PID:12204
- C:\Windows\System32\CAewpMa.exe
  C:\Windows\System32\CAewpMa.exe
  2⤵
  PID:4572
- C:\Windows\System32\JtkmJDA.exe
  C:\Windows\System32\JtkmJDA.exe
  2⤵
  PID:3740
- C:\Windows\System32\gaeWCHU.exe
  C:\Windows\System32\gaeWCHU.exe
  2⤵
  PID:12300
- C:\Windows\System32\kyHjphC.exe
  C:\Windows\System32\kyHjphC.exe
  2⤵
  PID:12328
- C:\Windows\System32\IazxlDm.exe
  C:\Windows\System32\IazxlDm.exe
  2⤵
  PID:12356
- C:\Windows\System32\dkArBOK.exe
  C:\Windows\System32\dkArBOK.exe
  2⤵
  PID:12408
- C:\Windows\System32\LcDoHcA.exe
  C:\Windows\System32\LcDoHcA.exe
  2⤵
  PID:12440
- C:\Windows\System32\gabxzAF.exe
  C:\Windows\System32\gabxzAF.exe
  2⤵
  PID:12464
- C:\Windows\System32\yySaAEL.exe
  C:\Windows\System32\yySaAEL.exe
  2⤵
  PID:12480
- C:\Windows\System32\TbUvVIH.exe
  C:\Windows\System32\TbUvVIH.exe
  2⤵
  PID:12512
- C:\Windows\System32\teWqhdX.exe
  C:\Windows\System32\teWqhdX.exe
  2⤵
  PID:12536
- C:\Windows\System32\OfqqEkB.exe
  C:\Windows\System32\OfqqEkB.exe
  2⤵
  PID:12572
- C:\Windows\System32\TZiHuXv.exe
  C:\Windows\System32\TZiHuXv.exe
  2⤵
  PID:12600
- C:\Windows\System32\tCbyDhP.exe
  C:\Windows\System32\tCbyDhP.exe
  2⤵
  PID:12624
- C:\Windows\System32\XcTYYKP.exe
  C:\Windows\System32\XcTYYKP.exe
  2⤵
  PID:12660
- C:\Windows\System32\KVSbOyW.exe
  C:\Windows\System32\KVSbOyW.exe
  2⤵
  PID:12688
- C:\Windows\System32\zAMNDOQ.exe
  C:\Windows\System32\zAMNDOQ.exe
  2⤵
  PID:12704
- C:\Windows\System32\fuiOheN.exe
  C:\Windows\System32\fuiOheN.exe
  2⤵
  PID:12752
- C:\Windows\System32\oNUGDig.exe
  C:\Windows\System32\oNUGDig.exe
  2⤵
  PID:12772
- C:\Windows\System32\zxGYgYB.exe
  C:\Windows\System32\zxGYgYB.exe
  2⤵
  PID:12800
- C:\Windows\System32\zjjhkbo.exe
  C:\Windows\System32\zjjhkbo.exe
  2⤵
  PID:12828
- C:\Windows\System32\RwQQTvR.exe
  C:\Windows\System32\RwQQTvR.exe
  2⤵
  PID:12852
- C:\Windows\System32\URDrHeZ.exe
  C:\Windows\System32\URDrHeZ.exe
  2⤵
  PID:12872
- C:\Windows\System32\slDKOuH.exe
  C:\Windows\System32\slDKOuH.exe
  2⤵
  PID:12912
- C:\Windows\System32\OAszDsP.exe
  C:\Windows\System32\OAszDsP.exe
  2⤵
  PID:12944
- C:\Windows\System32\grWfTWb.exe
  C:\Windows\System32\grWfTWb.exe
  2⤵
  PID:12972
- C:\Windows\System32\qpyuTym.exe
  C:\Windows\System32\qpyuTym.exe
  2⤵
  PID:12996
- C:\Windows\System32\ZmOIrRm.exe
  C:\Windows\System32\ZmOIrRm.exe
  2⤵
  PID:13016
- C:\Windows\System32\cvlrJpH.exe
  C:\Windows\System32\cvlrJpH.exe
  2⤵
  PID:13036
- C:\Windows\System32\eFIpLwQ.exe
  C:\Windows\System32\eFIpLwQ.exe
  2⤵
  PID:13080
- C:\Windows\System32\qTxHYZZ.exe
  C:\Windows\System32\qTxHYZZ.exe
  2⤵
  PID:13112
- C:\Windows\System32\sFoyMTn.exe
  C:\Windows\System32\sFoyMTn.exe
  2⤵
  PID:13128
- C:\Windows\System32\uljfdiF.exe
  C:\Windows\System32\uljfdiF.exe
  2⤵
  PID:13156
- C:\Windows\System32\DWnjXvp.exe
  C:\Windows\System32\DWnjXvp.exe
  2⤵
  PID:13196
- C:\Windows\System32\avFvbqk.exe
  C:\Windows\System32\avFvbqk.exe
  2⤵
  PID:13224
- C:\Windows\System32\wtjsjCW.exe
  C:\Windows\System32\wtjsjCW.exe
  2⤵
  PID:13252
- C:\Windows\System32\EZmFvkh.exe
  C:\Windows\System32\EZmFvkh.exe
  2⤵
  PID:13272
- C:\Windows\System32\MsEJltK.exe
  C:\Windows\System32\MsEJltK.exe
  2⤵
  PID:13300
- C:\Windows\System32\uzgQNeg.exe
  C:\Windows\System32\uzgQNeg.exe
  2⤵
  PID:12320
- C:\Windows\System32\fzMTGQv.exe
  C:\Windows\System32\fzMTGQv.exe
  2⤵
  PID:4116
- C:\Windows\System32\AwRxyBk.exe
  C:\Windows\System32\AwRxyBk.exe
  2⤵
  PID:12396
- C:\Windows\System32\asoZNNP.exe
  C:\Windows\System32\asoZNNP.exe
  2⤵
  PID:12476
- C:\Windows\System32\FiHZKqt.exe
  C:\Windows\System32\FiHZKqt.exe
  2⤵
  PID:12548
- C:\Windows\System32\HoobXxz.exe
  C:\Windows\System32\HoobXxz.exe
  2⤵
  PID:12612
- C:\Windows\System32\cldbKaN.exe
  C:\Windows\System32\cldbKaN.exe
  2⤵
  PID:12684
- C:\Windows\System32\lLYBTzK.exe
  C:\Windows\System32\lLYBTzK.exe
  2⤵
  PID:12768
- C:\Windows\System32\iCnNHfE.exe
  C:\Windows\System32\iCnNHfE.exe
  2⤵
  PID:12844
- C:\Windows\System32\kmWNZfG.exe
  C:\Windows\System32\kmWNZfG.exe
  2⤵
  PID:12904
- C:\Windows\System32\hbCZMLk.exe
  C:\Windows\System32\hbCZMLk.exe
  2⤵
  PID:12924
- C:\Windows\System32\oZEHJmu.exe
  C:\Windows\System32\oZEHJmu.exe
  2⤵
  PID:13008
- C:\Windows\System32\WLBhNMz.exe
  C:\Windows\System32\WLBhNMz.exe
  2⤵
  PID:13072
- C:\Windows\System32\jxkGJTE.exe
  C:\Windows\System32\jxkGJTE.exe
  2⤵
  PID:13092
- C:\Windows\System32\CLuIXjo.exe
  C:\Windows\System32\CLuIXjo.exe
  2⤵
  PID:13168
- C:\Windows\System32\wJzLZIj.exe
  C:\Windows\System32\wJzLZIj.exe
  2⤵
  PID:13264
- C:\Windows\System32\NdGzpPf.exe
  C:\Windows\System32\NdGzpPf.exe
  2⤵
  PID:12388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\BzICSYE.exe

Filesize
1.6MB

MD5
eb563b85d8f44102133d761e66d11190

SHA1
234e4a61af93a691b4780d030a8a8cc948c58155

SHA256
c53c2455d5b5211f095a4f0122d4da0f71f400183d5ebe7dadef4fc0625b019f

SHA512
2fa04201bcb73b1d7a1e6a0b13ed51aa0c8dd66869d5563c593c6f53512602a47904bfc02aeaab16595e9bb3961a0db25c96d88bd44577763f48ea5933fb34df

Download Submit
C:\Windows\System32\DIamzCw.exe

Filesize
1.6MB

MD5
93307ed9955e14688d83205f208317a5

SHA1
28f096c8baf439d265b226879d7036bb7adc9144

SHA256
36d428069ab58319afa2aeb1a42bf91050af312411c81fcd5e2740b2b4fc2402

SHA512
82157ca3b5ae3a41c2526bb3e10b13d2d62b070e8f6619828fb08f9f332c65ac4045dc334ee7044b912a9cd4e126572de9794c784dd18526302e549ab205db6c

Download Submit
C:\Windows\System32\DRkGBnS.exe

Filesize
1.6MB

MD5
58d14efdbf48b84ae17ea8c003e8b55a

SHA1
c1d982acb6e13bd51b020e89f12f7aa95c4b682a

SHA256
7a336bbc691a9ec2dcd1a31b25621ff1fc0c9475962bd44aae3602198e76c90c

SHA512
6abb51fcc8163639d2b3a93d83044d5e317b9da5352a77edc6a3bab169f3ecb33535dd325d624d9867008b80de20baeaba86bcf76c10f4dcfcb7c73f95c6307e

Download Submit
C:\Windows\System32\HCDtPZT.exe

Filesize
1.6MB

MD5
7ace9cd9756500f683e243981fd6ba39

SHA1
fc7c52351d3a54d58d1643acab5a435e8cfc6344

SHA256
d1537e48ac69b66ad59da079012ef40cc07501de3902c039887340ee36b7d8d4

SHA512
95cb6255048601b3d66b35da5db75d24f046e3a71287d5336f6e8fb0e1d096b2d288754e4893ff5b7348a7fe4e4ab8fa0ddf0523f6a50a1a900385b4efa7d580

Download Submit
C:\Windows\System32\McHOZkO.exe

Filesize
1.6MB

MD5
dc9493bb617cc66e44fc76c51d827cf0

SHA1
ef45a72069e79c4bee025179d40d9f15ff7ccc2c

SHA256
689e576509e7b39dbb60f31a3dba94df6d131541e480428a76e488576ae2d2fc

SHA512
f7f4be8e5020b2fc09771a69f6eaf081c2c9822a2024a83aea2786ffd1b5eef28599e5e147c54ba9a124e4a89b2891c535c31ad5fcdcf3e42bb0ce21c5e2255a

Download Submit
C:\Windows\System32\NcBWUUm.exe

Filesize
1.6MB

MD5
da73aa28d16eb784e6c4fe02b7cddf4a

SHA1
77bf99e4f8d3bd4b597bf75462ec957f8b3a91b0

SHA256
2605e63b613e10b45b7ce1093268e57e3ead16c0c87562acd7c5e812edd68561

SHA512
fdeb0bf8ef6bb3895129fa8084ef589027a22631664bde5b3bfeefcefd0cbf202f1c3c37f82ff76e118bbcc6280827bc202078133f2a7b49d5a53d6784e78b69

Download Submit
C:\Windows\System32\Nrvfajz.exe

Filesize
1.6MB

MD5
f46896079c6b7347ef1ed34f9ce177b7

SHA1
b66fc9c6efd3593419d16712f1ab42795fc709f6

SHA256
b16e5494792bce28bbe65eed87d3ad6381d68cdc06c85275ef7198cedb8419e3

SHA512
c6e92a9db51c9529ba6dc6b166e02fbc824bda3c4f5b8e0dcd7cc17d6e0a3ae4b58db66875a88953847491a5e36e32a7ba9768d0f32e2e3ba6e678800867b8c2

Download Submit
C:\Windows\System32\OitHcwc.exe

Filesize
1.6MB

MD5
562f9950110d34631719a6b0433b4178

SHA1
c809b9ee1fca7974845160537d906dfb0369784f

SHA256
8edd9de3a9787bb00d478235811ead58941cddb67b250702126dd3e4046fcd0c

SHA512
5e80e2ec6c678c5137c7ebd80b24db7ff5fc98edc8c976935874f13144c1d5a4b6e8ecdc5c0c4a4066181866b191d89b9831db0c7af3c4d059d4853970ef305d

Download Submit
C:\Windows\System32\PwxLklA.exe

Filesize
1.6MB

MD5
4f93b5c1f4c0ba0ce01c0ce7c4c6b478

SHA1
912c08a02d49a3aea0f9be710468ae1cfe99742a

SHA256
a2877e51e52dd11ea7b5f341f50c7290564ac340b6d320d80cf80ac145a7ad67

SHA512
ad4b1895e41703e0e9e27cc2bd2f54e4ecd8f0267452b45ba6ca5f46af93c5b69da6b145b6fd3634c0d75e5a7ecca7378478c13139506ddb73b3c7c9113c2981

Download Submit
C:\Windows\System32\QtqIeNw.exe

Filesize
1.6MB

MD5
9ff9938dadcb457b8d6aa2d993b01da3

SHA1
fdbe2d8437bf5a94e2168e4f712273825595efe7

SHA256
9992a972bfa6f39fd0c1b9234810671f04f039f90eec6bf4ea339cea0d401961

SHA512
72a51594b810c2c83c5f631758ab50cd8ba0ffc2609ebfdfbe460021e6eda59b791b385e0843b375898f85f9b26118bf241f610ebb3bd79a40e6bfcc96229a4f

Download Submit
C:\Windows\System32\RtKicDc.exe

Filesize
1.6MB

MD5
f09012370f4250e3397d8a42e19036e1

SHA1
6acb645c858ba5e25f0f0b04137767337fdce9c5

SHA256
dc1f03d9d48c3f283e42be92a046a5a6c2818affc3f316914fd050363dbcbcf0

SHA512
4778e186faab8ecddaed3b6a8c9d00b88831f0b48c7b6f182be9293e36ee9fd05f903c17cf6142382a7a692fbee1a99df7ce7e86588f2b4395b4a53fe9279c0e

Download Submit
C:\Windows\System32\SYKlcfM.exe

Filesize
1.6MB

MD5
4ac08f51a88e421c093e47186f1644e4

SHA1
72d88eee27b73790580b0af9934e7a40f656b58c

SHA256
26257137e3be813e5a6728cca63fb64da1d4599ff14744aad503a6f9431c85d3

SHA512
5a5708a28a8290341fed36b8526275418d2392f413c6a7045940d4492a435d4954061d60e8e61c6e75b87df8ae51af9cb27437fcda8e629955cc9b8f470a4043

Download Submit
C:\Windows\System32\TxSgCkV.exe

Filesize
1.6MB

MD5
ce3b8d3d2bf0160341fb19ec1c8cb51f

SHA1
4eef179fb37db0928f66aafe08346313bad3edca

SHA256
4848408da784ca179b33ffdf660b353a26822045577a8200dd14b088a9e9687c

SHA512
8e0eb6bfd05ab774a56d2593b0183975c3939d746d6e5f8da039239fcb5afd7b609715e406b03e3be7fc41eeee1851d00f4f679388780cab35d52446d043a02d

Download Submit
C:\Windows\System32\UBBUPJi.exe

Filesize
1.6MB

MD5
0f79f8c3fbbe74e953a407bd326f2040

SHA1
64179dda28b3b34fd9ab3addec9994a6bdbe5f8b

SHA256
9bfc900bac1a58fd2d8825a646509309816c5236270dba503ae4b1bc7d1703fe

SHA512
6b426d59c11c1c1ef646ca4a1a231143c8f0da3934451770ee0966fbce601fef299e59d4cd8aee599763805babd5e891486870b1ef6c083ee9ec42bfa4cc823e

Download Submit
C:\Windows\System32\UtWTmaC.exe

Filesize
1.6MB

MD5
3b3f4982e8e1fb2af6a928983fdd126f

SHA1
c8a07a972147d58c61e37b6ae8984b816ed74fd6

SHA256
b65c338df12700e2ce1f3332aa143d7fe02a518c59496945fc2528e939f1e4e4

SHA512
40f2cca048dda46a6e0c4f9835272a8b963da571867cad913a8f0a815481e9007f2f34ce94c0870b02d14de3611a8a1b32fbf12ef7bb1899f1fe6156cf79b258

Download Submit
C:\Windows\System32\ZYOhbQU.exe

Filesize
1.6MB

MD5
2bb6293abc20eaead4811aa72f47e2de

SHA1
53f905fcfb8dcbde8b008977572e9833bb60c04a

SHA256
bc76ed3d7430a72c19f64fc8cd3ff90f9184ddac071a3fac89a771c73b0daf19

SHA512
c60af11839d94a1d18913b8443a680d41688abbb228a624294e611c8eb0a8db3e32d60a00ae21b5263c5c741f06bc4b8407c9ee8eaf14c00879efca84cf266ab

Download Submit
C:\Windows\System32\bwFBcnr.exe

Filesize
1.6MB

MD5
00303f81e84cc742a64b8f0ab748da6f

SHA1
d78fb01fd53b348113929ac9742245606c661270

SHA256
81ebac4a3ce26d4c68e3aadcd9fac9ce25a539ca932627814de56e345d63b098

SHA512
9bbd516700a87820d4ee4d43c563a28ac5d3cd3d985b8584f0a67e6c46177f88cd68d1924e49070235f2f72b14306348ddacd3bbcd33b5dfa4b76ab06ef66507

Download Submit
C:\Windows\System32\etuFGCA.exe

Filesize
1.6MB

MD5
98dcf06d74853d941adfc567c18bc539

SHA1
f514f8b412a1e0863fa4df82e4f816cef71bdad8

SHA256
796ab6b2f38e5a5d4db1289df5b91166854cc5e923fecc48c1692999eff150ab

SHA512
c262ff08fe13b6dc3e1239c0c3edd98d3383d4860828a6ba4a84e8bd83dda047ab61e790334293418adb8663e6956870ae7bc7ac202f40681d0ee8fe64fc5cfe

Download Submit
C:\Windows\System32\flgyyqV.exe

Filesize
1.6MB

MD5
35583d26282a69165b8d0b63c7f5ce42

SHA1
c22f4f496a63285be157cda5930ff818001ef50b

SHA256
027d7fda88b2f286b5dc26c8c68272025a4f0668a9e0b955adf8b3dc9a549b6e

SHA512
73b876623910526324cdb80b15e59a487d3af96c45892679f4b72acb3a02835ea29b9b1b2e0b96448426cde6bded77b8bd971c49d33f0b0749def012b8768586

Download Submit
C:\Windows\System32\fnYcXIP.exe

Filesize
1.6MB

MD5
d3519806bdba606e7cc32ff775818543

SHA1
be392781651a9a79a76d84ad57a7f85d630ff51f

SHA256
52b0e6f0b7a3c1ede00297547f82c6923ecb1e5e51c613ed71be04dfaed8c9f2

SHA512
2976356ca0a6cd5f6782bdbd0f48afec6078bcb044526be0d1fcde6769222bb86cf85ab600476b331981229419dc4f829c2ce6b962727c30f939c75670ee666f

Download Submit
C:\Windows\System32\hNukhPs.exe

Filesize
1.6MB

MD5
7d02b33770fa9b9d1be88cb938176509

SHA1
e6cb7b9fef6e76f89d470935c3f92549eff2280a

SHA256
08e9f1cdfce75dad84cf9d5e70c6259f4b788b139902526b153b6ec668c0949e

SHA512
50c20e7239c091abb1af8c9c6a6d0ce5c352b0a34696bf44f809d313fe18ee1b84a228ddbeb830d05073d74a0cc32da0e9eddfee16757f951da43d823002c009

Download Submit
C:\Windows\System32\iMEsWDo.exe

Filesize
1.6MB

MD5
171937b51c0dbfc581555fcaeea5025a

SHA1
f7b2355ab59102e8eb19e67398665c6659dc0923

SHA256
d3fe458a7c37ec68344f081fd4b7f044fe43b50dc9b500a36da6968709cbb015

SHA512
06d210eef3fce19723510c413d83a89c179392e3c736bcab656a7b3d72920335e71d6a14b9cc8b556a5236f9962578a89c4f92a85df95261ad31bee5cb81de13

Download Submit
C:\Windows\System32\lgoChZs.exe

Filesize
1.6MB

MD5
6d32caf1909ef74b2e79788ad5e1e719

SHA1
915a878cd7cff9ef090105c9cad9b24390de3041

SHA256
32e0e253774e650935fa55067a315ae4e4f8eb8ed2814e5a28b690214f5b31b7

SHA512
7e531471e78844c665688de7d30fee6a5d0c3864a98eec33fab77af0ce5a9f6657c1ae4e03ced95c9ebf303c796dd587fed89e8179f9f05b073d32e6478fdb5b

Download Submit
C:\Windows\System32\nYkvSRW.exe

Filesize
1.6MB

MD5
1e18994a499ba0b9e3fae444f0142739

SHA1
4180933738343d2230b3c689ad91b8220ac66d75

SHA256
09ca5a32a600acf272392316a7c8f7371a2c9367db6c7845609255811c0f1d06

SHA512
65e7592cac0ab11f461b10880d1ddfe6e82096496c12bc5ff3383c27f1942e6919231c94826b71e594c75a1e519401c9b0017206f022446638e405235132d06a

Download Submit
C:\Windows\System32\qxsdHLG.exe

Filesize
1.6MB

MD5
da4bb0a103de367aaa82c4905aa12c6b

SHA1
c0749e15ed2b43749dc444ff5a2d405c2f4a64c0

SHA256
0373760940e537a96495e726b799ededbf654c9daf98c51c6175bb7af4e813f7

SHA512
ac5be69f5497fe48e26faf36baa5f2f49647201afe6d439dd73d9481c14b312e9cf5679ba470b06db60e62041fa011d107fc012ff87025e572cd3c33d97bd1cc

Download Submit
C:\Windows\System32\rQXEecu.exe

Filesize
1.6MB

MD5
fbc1f7f1783cefbe1c8eed845583e4fe

SHA1
f43dbcb22973abe7bf34fef5fdc3e9813a5f2ae6

SHA256
e59f684515fcaa4649bc2059d7413f8361dc70973fbc2128e6c6610555ce60f0

SHA512
2349c202fedb79795b8ec56bb8b2008900942c7b8918fdec207430d9b86e7f6f4e4550ff5d060fd70351d8a8f45164d829c0a6ff7ce3a69e724405e82b90f64a

Download Submit
C:\Windows\System32\rYNNrHj.exe

Filesize
1.6MB

MD5
fe47f45c81abf6931efa917be5ee9769

SHA1
68a80f331e71be675dbcf6d933252a971f54b3ec

SHA256
2a92a0fc51d9b2db8a578e66831fd2a0a8dfa6f806ed1b613117ee37d3b1b320

SHA512
308b9b05361b47c426b4767a7d3824490e4dcabef553c80788ae2145771ef70d38a39e931694cc2c27f6f6e610c5bc64fc3bebcb5d9f1493aeca34ffd08ba333

Download Submit
C:\Windows\System32\tfauTaN.exe

Filesize
1.6MB

MD5
6e696f0cc501c16fba9912d681684258

SHA1
29bd992007f5f02d76807e782a59427b46b0b828

SHA256
d697434dfaddeba0a2e11bc6fde4082066dfe1dd8fd2a271014e368af2217aed

SHA512
73c019a8ee007ffa04a0d58f056dac379e483bcc1f17f1bee07fb37be7411dd8f1075241af5a171cc934c7df76195ccd1387388e0aa9ecc58866d6bca7ee3c63

Download Submit
C:\Windows\System32\uYvijdM.exe

Filesize
1.6MB

MD5
9d16184bae2008fa9c40f11540bb53e6

SHA1
a0dd3967e7474ae3b3de7d61eac33bf8e37e0291

SHA256
7b0138eea362c389428d781dac22a55a7e95131be47342cef064aaa457fbc78c

SHA512
71b17664d4afdff6479b96ae14bddaadca39b6b6fbfdc27ef9b077ed691f8355452a9886ae0e12a9c82c7c060c4dd8efdd9dfdd4b8b727227d2f32d471918eb2

Download Submit
C:\Windows\System32\uqMUrHC.exe

Filesize
1.6MB

MD5
2a6b2f0908696cb39e692ba93af28b9b

SHA1
4c87a1f617ec9a9982e922cee99c39dd5420a1d2

SHA256
1cad4b7d9bc80d39009987810c0db80e793c8de7b631e2a3fc10d57d209fbdb8

SHA512
633b71940a902cdc423ad6f811c181fc9016e37bc1b3a5db88da48fb7194a24fe3265f723990530adc971f0ba336560f25ffa1822285d639d8e219dec6c10344

Download Submit
C:\Windows\System32\vRakrSX.exe

Filesize
1.6MB

MD5
e05528230a15e86797829b91684fca38

SHA1
eaddbf7db31e757da247c258329e168ca0c0b944

SHA256
526dfac6a5b77dbf670beecc4256ae86827673e3314d765b33eea8fa0752f749

SHA512
c6c3377864be5d248799c6e81884010fa4ee2ba68902c17e27743038b748c83950821fc1113bffd91c574f2facaaf89da4b6b5ed621f30095a12648d7cba282b

Download Submit
C:\Windows\System32\xJOsBCv.exe

Filesize
1.6MB

MD5
99b559d5284f99965fd48e22148d3f25

SHA1
ebd5b4b3734c34f7f16dab5f4fb3c00971fb4384

SHA256
65668275e13599701c4d1ec48c13cb07f7faa36ca329cf69b12aa6c4527e9650

SHA512
5347411900963b6cc433afb611b7ad3350e22cbc279026894864ce21902a4d2626a05fc1eee6ff2d25f210a5bc273f6446475128a1794e3eea44d83c0e08ffb5

Download Submit
memory/884-1993-0x00007FF73F6E0000-0x00007FF73FAD1000-memory.dmp

Filesize
3.9MB

Download
memory/884-8-0x00007FF73F6E0000-0x00007FF73FAD1000-memory.dmp

Filesize
3.9MB

Download
memory/1132-22-0x00007FF742660000-0x00007FF742A51000-memory.dmp

Filesize
3.9MB

Download
memory/1132-1995-0x00007FF742660000-0x00007FF742A51000-memory.dmp

Filesize
3.9MB

Download
memory/1376-2033-0x00007FF7C2000000-0x00007FF7C23F1000-memory.dmp

Filesize
3.9MB

Download
memory/1376-507-0x00007FF7C2000000-0x00007FF7C23F1000-memory.dmp

Filesize
3.9MB

Download
memory/1540-1952-0x00007FF7A7C00000-0x00007FF7A7FF1000-memory.dmp

Filesize
3.9MB

Download
memory/1540-2003-0x00007FF7A7C00000-0x00007FF7A7FF1000-memory.dmp

Filesize
3.9MB

Download
memory/1540-35-0x00007FF7A7C00000-0x00007FF7A7FF1000-memory.dmp

Filesize
3.9MB

Download
memory/1900-522-0x00007FF62FFD0000-0x00007FF6303C1000-memory.dmp

Filesize
3.9MB

Download
memory/1900-2085-0x00007FF62FFD0000-0x00007FF6303C1000-memory.dmp

Filesize
3.9MB

Download
memory/1924-1988-0x00007FF6398B0000-0x00007FF639CA1000-memory.dmp

Filesize
3.9MB

Download
memory/1924-0-0x00007FF6398B0000-0x00007FF639CA1000-memory.dmp

Filesize
3.9MB

Download
memory/1924-1-0x0000028B94E70000-0x0000028B94E80000-memory.dmp

Filesize
64KB

Download
memory/2392-2015-0x00007FF6ACE10000-0x00007FF6AD201000-memory.dmp

Filesize
3.9MB

Download
memory/2392-478-0x00007FF6ACE10000-0x00007FF6AD201000-memory.dmp

Filesize
3.9MB

Download
memory/2448-2010-0x00007FF735540000-0x00007FF735931000-memory.dmp

Filesize
3.9MB

Download
memory/2448-487-0x00007FF735540000-0x00007FF735931000-memory.dmp

Filesize
3.9MB

Download
memory/2748-2017-0x00007FF6FEF60000-0x00007FF6FF351000-memory.dmp

Filesize
3.9MB

Download
memory/2748-474-0x00007FF6FEF60000-0x00007FF6FF351000-memory.dmp

Filesize
3.9MB

Download
memory/2880-2031-0x00007FF70F880000-0x00007FF70FC71000-memory.dmp

Filesize
3.9MB

Download
memory/2880-504-0x00007FF70F880000-0x00007FF70FC71000-memory.dmp

Filesize
3.9MB

Download
memory/2928-2035-0x00007FF7ECE80000-0x00007FF7ED271000-memory.dmp

Filesize
3.9MB

Download
memory/2928-511-0x00007FF7ECE80000-0x00007FF7ED271000-memory.dmp

Filesize
3.9MB

Download
memory/3040-40-0x00007FF7303D0000-0x00007FF7307C1000-memory.dmp

Filesize
3.9MB

Download
memory/3040-1986-0x00007FF7303D0000-0x00007FF7307C1000-memory.dmp

Filesize
3.9MB

Download
memory/3040-2005-0x00007FF7303D0000-0x00007FF7307C1000-memory.dmp

Filesize
3.9MB

Download
memory/3096-2014-0x00007FF625AC0000-0x00007FF625EB1000-memory.dmp

Filesize
3.9MB

Download
memory/3096-476-0x00007FF625AC0000-0x00007FF625EB1000-memory.dmp

Filesize
3.9MB

Download
memory/3128-2019-0x00007FF6B8F90000-0x00007FF6B9381000-memory.dmp

Filesize
3.9MB

Download
memory/3128-462-0x00007FF6B8F90000-0x00007FF6B9381000-memory.dmp

Filesize
3.9MB

Download
memory/3252-499-0x00007FF7293E0000-0x00007FF7297D1000-memory.dmp

Filesize
3.9MB

Download
memory/3252-2027-0x00007FF7293E0000-0x00007FF7297D1000-memory.dmp

Filesize
3.9MB

Download
memory/3276-2021-0x00007FF775000000-0x00007FF7753F1000-memory.dmp

Filesize
3.9MB

Download
memory/3276-455-0x00007FF775000000-0x00007FF7753F1000-memory.dmp

Filesize
3.9MB

Download
memory/3492-2025-0x00007FF716D60000-0x00007FF717151000-memory.dmp

Filesize
3.9MB

Download
memory/3492-469-0x00007FF716D60000-0x00007FF717151000-memory.dmp

Filesize
3.9MB

Download
memory/3660-449-0x00007FF671400000-0x00007FF6717F1000-memory.dmp

Filesize
3.9MB

Download
memory/3660-2007-0x00007FF671400000-0x00007FF6717F1000-memory.dmp

Filesize
3.9MB

Download
memory/3792-28-0x00007FF7E2570000-0x00007FF7E2961000-memory.dmp

Filesize
3.9MB

Download
memory/3792-1999-0x00007FF7E2570000-0x00007FF7E2961000-memory.dmp

Filesize
3.9MB

Download
memory/4396-495-0x00007FF7904C0000-0x00007FF7908B1000-memory.dmp

Filesize
3.9MB

Download
memory/4396-2030-0x00007FF7904C0000-0x00007FF7908B1000-memory.dmp

Filesize
3.9MB

Download
memory/4420-1985-0x00007FF65BAD0000-0x00007FF65BEC1000-memory.dmp

Filesize
3.9MB

Download
memory/4420-39-0x00007FF65BAD0000-0x00007FF65BEC1000-memory.dmp

Filesize
3.9MB

Download
memory/4420-2002-0x00007FF65BAD0000-0x00007FF65BEC1000-memory.dmp

Filesize
3.9MB

Download
memory/4772-488-0x00007FF7EA740000-0x00007FF7EAB31000-memory.dmp

Filesize
3.9MB

Download
memory/4772-2012-0x00007FF7EA740000-0x00007FF7EAB31000-memory.dmp

Filesize
3.9MB

Download
memory/4812-1997-0x00007FF7832E0000-0x00007FF7836D1000-memory.dmp

Filesize
3.9MB

Download
memory/4812-19-0x00007FF7832E0000-0x00007FF7836D1000-memory.dmp

Filesize
3.9MB

Download
memory/4812-1951-0x00007FF7832E0000-0x00007FF7836D1000-memory.dmp

Filesize
3.9MB

Download
memory/5020-2023-0x00007FF731740000-0x00007FF731B31000-memory.dmp

Filesize
3.9MB

Download
memory/5020-450-0x00007FF731740000-0x00007FF731B31000-memory.dmp

Filesize
3.9MB

Download
memory/5036-513-0x00007FF67ECE0000-0x00007FF67F0D1000-memory.dmp

Filesize
3.9MB

Download
memory/5036-2051-0x00007FF67ECE0000-0x00007FF67F0D1000-memory.dmp

Filesize
3.9MB

Download