xmrig | 43e6fd536307f02fdb213e26d4978c930a7fe21100a28889b77da89005316b40

Analysis

max time kernel
144s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 02:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
Size

983KB
MD5

0f7157ad395c5529876fa2533572c596
SHA1

86c77a232a43d2ba9e0b34dde8316581ede595db
SHA256

43e6fd536307f02fdb213e26d4978c930a7fe21100a28889b77da89005316b40
SHA512

11e7e33ba795a5107d7f58297ebc6008aee77749c1d97b073dd5724f95fbdb52829aae26e821ede5089e7e861af41f79d2d5c1c9b16a1ee1b8bc79380e348299
SSDEEP

24576:JanwhSe11QSONCpGJCjETPl+Me7bPMS8YkgcWByK:knw9oUUEEDl+xTMS8Tgv/

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 50 IoCs

miner

resource	yara_rule
behavioral2/memory/2564-386-0x00007FF661FA0000-0x00007FF662391000-memory.dmp	xmrig
behavioral2/memory/4336-389-0x00007FF6EEA80000-0x00007FF6EEE71000-memory.dmp	xmrig
behavioral2/memory/2508-395-0x00007FF7C52A0000-0x00007FF7C5691000-memory.dmp	xmrig
behavioral2/memory/2800-394-0x00007FF698A90000-0x00007FF698E81000-memory.dmp	xmrig
behavioral2/memory/4028-404-0x00007FF793C00000-0x00007FF793FF1000-memory.dmp	xmrig
behavioral2/memory/1676-382-0x00007FF6652C0000-0x00007FF6656B1000-memory.dmp	xmrig
behavioral2/memory/4788-380-0x00007FF6FCCA0000-0x00007FF6FD091000-memory.dmp	xmrig
behavioral2/memory/4204-378-0x00007FF7B9B70000-0x00007FF7B9F61000-memory.dmp	xmrig
behavioral2/memory/3716-376-0x00007FF7E00C0000-0x00007FF7E04B1000-memory.dmp	xmrig
behavioral2/memory/4360-48-0x00007FF7F6E80000-0x00007FF7F7271000-memory.dmp	xmrig
behavioral2/memory/2212-45-0x00007FF734A80000-0x00007FF734E71000-memory.dmp	xmrig
behavioral2/memory/1528-17-0x00007FF63F290000-0x00007FF63F681000-memory.dmp	xmrig
behavioral2/memory/3296-410-0x00007FF74A9D0000-0x00007FF74ADC1000-memory.dmp	xmrig
behavioral2/memory/4416-409-0x00007FF68A780000-0x00007FF68AB71000-memory.dmp	xmrig
behavioral2/memory/5080-408-0x00007FF6BDD40000-0x00007FF6BE131000-memory.dmp	xmrig
behavioral2/memory/1444-426-0x00007FF7CB1A0000-0x00007FF7CB591000-memory.dmp	xmrig
behavioral2/memory/2240-436-0x00007FF69D8D0000-0x00007FF69DCC1000-memory.dmp	xmrig
behavioral2/memory/2376-443-0x00007FF616060000-0x00007FF616451000-memory.dmp	xmrig
behavioral2/memory/1176-415-0x00007FF72EF80000-0x00007FF72F371000-memory.dmp	xmrig
behavioral2/memory/2812-1559-0x00007FF7E4720000-0x00007FF7E4B11000-memory.dmp	xmrig
behavioral2/memory/1736-1966-0x00007FF7EE8C0000-0x00007FF7EECB1000-memory.dmp	xmrig
behavioral2/memory/4672-1967-0x00007FF746770000-0x00007FF746B61000-memory.dmp	xmrig
behavioral2/memory/2300-1968-0x00007FF7E41E0000-0x00007FF7E45D1000-memory.dmp	xmrig
behavioral2/memory/2212-1977-0x00007FF734A80000-0x00007FF734E71000-memory.dmp	xmrig
behavioral2/memory/2812-2003-0x00007FF7E4720000-0x00007FF7E4B11000-memory.dmp	xmrig
behavioral2/memory/2936-2005-0x00007FF78C4E0000-0x00007FF78C8D1000-memory.dmp	xmrig
behavioral2/memory/888-2015-0x00007FF613FC0000-0x00007FF6143B1000-memory.dmp	xmrig
behavioral2/memory/1528-2018-0x00007FF63F290000-0x00007FF63F681000-memory.dmp	xmrig
behavioral2/memory/1736-2019-0x00007FF7EE8C0000-0x00007FF7EECB1000-memory.dmp	xmrig
behavioral2/memory/2300-2023-0x00007FF7E41E0000-0x00007FF7E45D1000-memory.dmp	xmrig
behavioral2/memory/4672-2022-0x00007FF746770000-0x00007FF746B61000-memory.dmp	xmrig
behavioral2/memory/2212-2027-0x00007FF734A80000-0x00007FF734E71000-memory.dmp	xmrig
behavioral2/memory/4360-2026-0x00007FF7F6E80000-0x00007FF7F7271000-memory.dmp	xmrig
behavioral2/memory/4788-2040-0x00007FF6FCCA0000-0x00007FF6FD091000-memory.dmp	xmrig
behavioral2/memory/2800-2036-0x00007FF698A90000-0x00007FF698E81000-memory.dmp	xmrig
behavioral2/memory/4028-2033-0x00007FF793C00000-0x00007FF793FF1000-memory.dmp	xmrig
behavioral2/memory/3716-2029-0x00007FF7E00C0000-0x00007FF7E04B1000-memory.dmp	xmrig
behavioral2/memory/4416-2043-0x00007FF68A780000-0x00007FF68AB71000-memory.dmp	xmrig
behavioral2/memory/2240-2061-0x00007FF69D8D0000-0x00007FF69DCC1000-memory.dmp	xmrig
behavioral2/memory/2376-2057-0x00007FF616060000-0x00007FF616451000-memory.dmp	xmrig
behavioral2/memory/1444-2055-0x00007FF7CB1A0000-0x00007FF7CB591000-memory.dmp	xmrig
behavioral2/memory/1676-2053-0x00007FF6652C0000-0x00007FF6656B1000-memory.dmp	xmrig
behavioral2/memory/2564-2052-0x00007FF661FA0000-0x00007FF662391000-memory.dmp	xmrig
behavioral2/memory/4336-2050-0x00007FF6EEA80000-0x00007FF6EEE71000-memory.dmp	xmrig
behavioral2/memory/5080-2045-0x00007FF6BDD40000-0x00007FF6BE131000-memory.dmp	xmrig
behavioral2/memory/1176-2041-0x00007FF72EF80000-0x00007FF72F371000-memory.dmp	xmrig
behavioral2/memory/4204-2038-0x00007FF7B9B70000-0x00007FF7B9F61000-memory.dmp	xmrig
behavioral2/memory/2508-2048-0x00007FF7C52A0000-0x00007FF7C5691000-memory.dmp	xmrig
behavioral2/memory/3296-2032-0x00007FF74A9D0000-0x00007FF74ADC1000-memory.dmp	xmrig
behavioral2/memory/2936-2137-0x00007FF78C4E0000-0x00007FF78C8D1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
888	bFwwCtH.exe
1528	YKkLQMi.exe
1736	MzheBSv.exe
4672	nekjwyR.exe
2300	nDLoCQJ.exe
4360	KATNZGp.exe
2212	odhxmHi.exe
2936	NcIVFmD.exe
3716	XmgGmin.exe
4204	vXegtnJ.exe
4788	zfsWbLj.exe
1676	wkrGIVd.exe
2564	nEjxemg.exe
4336	YkUEOvX.exe
2800	YKFIHri.exe
2508	pfCvcnF.exe
4028	cTxzMgt.exe
5080	ZdWAnLc.exe
4416	FHovvFT.exe
3296	NEIkdFw.exe
1176	qMvlrzt.exe
1444	VFSveTl.exe
2240	sorRJHp.exe
2376	SvUhyXi.exe
3136	RFrFBZb.exe
2724	ByKcbAL.exe
3488	GMHWqqL.exe
4340	XaBqypM.exe
3008	HfWKjui.exe
3988	OfdZDSI.exe
2416	lfKKyow.exe
4804	MTyqStY.exe
1728	vNGYpUy.exe
988	uYvaTOF.exe
396	tXciJju.exe
2732	VsvNQQM.exe
3100	eeYBsze.exe
3916	khPJrjC.exe
2648	NDtnqHD.exe
4140	RcmydyM.exe
3836	lfoqUVr.exe
4528	jdgwdQO.exe
1336	KkDqmHF.exe
3724	wgNHRkk.exe
2684	McAFljZ.exe
4392	itjwEgn.exe
4848	ejUtTSX.exe
5020	ARldebm.exe
3632	uyhaRlo.exe
3960	RjZouit.exe
4048	FNrsarq.exe
4988	ytlVLhI.exe
2160	doRulvl.exe
540	Gcsyudd.exe
552	Gtsrhxs.exe
2096	YoGqQEZ.exe
3448	unxzxtM.exe
2168	QEQPywl.exe
936	EpuJhdU.exe
3380	JWdguok.exe
3320	bIrigkx.exe
1812	xLoQCAL.exe
1928	lSjOgwG.exe
3148	TSGsHFQ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2812-0-0x00007FF7E4720000-0x00007FF7E4B11000-memory.dmp	upx
behavioral2/files/0x0032000000023bb5-5.dat	upx
behavioral2/files/0x000a000000023bba-16.dat	upx
behavioral2/files/0x000a000000023bbb-22.dat	upx
behavioral2/files/0x000a000000023bbd-33.dat	upx
behavioral2/memory/2300-41-0x00007FF7E41E0000-0x00007FF7E45D1000-memory.dmp	upx
behavioral2/files/0x000a000000023bbf-47.dat	upx
behavioral2/files/0x000a000000023bc0-51.dat	upx
behavioral2/files/0x000a000000023bc1-56.dat	upx
behavioral2/files/0x000a000000023bc4-73.dat	upx
behavioral2/files/0x000a000000023bc7-88.dat	upx
behavioral2/files/0x000a000000023bc9-98.dat	upx
behavioral2/files/0x000a000000023bce-123.dat	upx
behavioral2/files/0x000a000000023bd1-136.dat	upx
behavioral2/files/0x000a000000023bd3-148.dat	upx
behavioral2/memory/2564-386-0x00007FF661FA0000-0x00007FF662391000-memory.dmp	upx
behavioral2/memory/4336-389-0x00007FF6EEA80000-0x00007FF6EEE71000-memory.dmp	upx
behavioral2/memory/2508-395-0x00007FF7C52A0000-0x00007FF7C5691000-memory.dmp	upx
behavioral2/memory/2800-394-0x00007FF698A90000-0x00007FF698E81000-memory.dmp	upx
behavioral2/memory/4028-404-0x00007FF793C00000-0x00007FF793FF1000-memory.dmp	upx
behavioral2/memory/1676-382-0x00007FF6652C0000-0x00007FF6656B1000-memory.dmp	upx
behavioral2/memory/4788-380-0x00007FF6FCCA0000-0x00007FF6FD091000-memory.dmp	upx
behavioral2/memory/4204-378-0x00007FF7B9B70000-0x00007FF7B9F61000-memory.dmp	upx
behavioral2/memory/3716-376-0x00007FF7E00C0000-0x00007FF7E04B1000-memory.dmp	upx
behavioral2/files/0x000a000000023bd7-168.dat	upx
behavioral2/files/0x000a000000023bd6-163.dat	upx
behavioral2/files/0x000a000000023bd5-158.dat	upx
behavioral2/files/0x000a000000023bd4-153.dat	upx
behavioral2/files/0x000a000000023bd2-143.dat	upx
behavioral2/files/0x000a000000023bd0-133.dat	upx
behavioral2/files/0x000a000000023bcf-128.dat	upx
behavioral2/files/0x000a000000023bcd-118.dat	upx
behavioral2/files/0x000a000000023bcc-113.dat	upx
behavioral2/files/0x000a000000023bcb-108.dat	upx
behavioral2/files/0x000a000000023bca-103.dat	upx
behavioral2/files/0x000a000000023bc8-93.dat	upx
behavioral2/files/0x000a000000023bc6-83.dat	upx
behavioral2/files/0x000a000000023bc5-78.dat	upx
behavioral2/files/0x000a000000023bc3-68.dat	upx
behavioral2/files/0x000a000000023bc2-63.dat	upx
behavioral2/memory/2936-50-0x00007FF78C4E0000-0x00007FF78C8D1000-memory.dmp	upx
behavioral2/memory/4360-48-0x00007FF7F6E80000-0x00007FF7F7271000-memory.dmp	upx
behavioral2/memory/2212-45-0x00007FF734A80000-0x00007FF734E71000-memory.dmp	upx
behavioral2/files/0x000a000000023bbe-40.dat	upx
behavioral2/files/0x000a000000023bbc-36.dat	upx
behavioral2/memory/4672-28-0x00007FF746770000-0x00007FF746B61000-memory.dmp	upx
behavioral2/memory/1736-23-0x00007FF7EE8C0000-0x00007FF7EECB1000-memory.dmp	upx
behavioral2/memory/1528-17-0x00007FF63F290000-0x00007FF63F681000-memory.dmp	upx
behavioral2/files/0x000a000000023bb9-13.dat	upx
behavioral2/memory/888-9-0x00007FF613FC0000-0x00007FF6143B1000-memory.dmp	upx
behavioral2/memory/3296-410-0x00007FF74A9D0000-0x00007FF74ADC1000-memory.dmp	upx
behavioral2/memory/4416-409-0x00007FF68A780000-0x00007FF68AB71000-memory.dmp	upx
behavioral2/memory/5080-408-0x00007FF6BDD40000-0x00007FF6BE131000-memory.dmp	upx
behavioral2/memory/1444-426-0x00007FF7CB1A0000-0x00007FF7CB591000-memory.dmp	upx
behavioral2/memory/2240-436-0x00007FF69D8D0000-0x00007FF69DCC1000-memory.dmp	upx
behavioral2/memory/2376-443-0x00007FF616060000-0x00007FF616451000-memory.dmp	upx
behavioral2/memory/1176-415-0x00007FF72EF80000-0x00007FF72F371000-memory.dmp	upx
behavioral2/memory/2812-1559-0x00007FF7E4720000-0x00007FF7E4B11000-memory.dmp	upx
behavioral2/memory/1736-1966-0x00007FF7EE8C0000-0x00007FF7EECB1000-memory.dmp	upx
behavioral2/memory/4672-1967-0x00007FF746770000-0x00007FF746B61000-memory.dmp	upx
behavioral2/memory/2300-1968-0x00007FF7E41E0000-0x00007FF7E45D1000-memory.dmp	upx
behavioral2/memory/2212-1977-0x00007FF734A80000-0x00007FF734E71000-memory.dmp	upx
behavioral2/memory/2812-2003-0x00007FF7E4720000-0x00007FF7E4B11000-memory.dmp	upx
behavioral2/memory/2936-2005-0x00007FF78C4E0000-0x00007FF78C8D1000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\YcVrTQU.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\ppaqSXr.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\caQdLff.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\UidUlIa.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\JGsqZjQ.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\ejUtTSX.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\GYHrfRc.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\DueUdZM.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\tQIRCSt.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\Tjpmjdy.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\dNRVonz.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\ndNaSFB.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\DHOFgqO.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\mySIKil.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\uyhaRlo.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\EpuJhdU.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\gtkmAUF.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\VmJuKoY.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\NHMGGtV.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\xORSYKD.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\XMhQLgO.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\XaBqypM.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\gEiGBVO.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\YPdfnSp.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\ibYSCWl.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\WTNiPwp.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\yyqqhDG.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\vXegtnJ.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\uKwlIBz.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\CQuyXOQ.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\DUdZffx.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\OurLOEa.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\WHTgint.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\zfsWbLj.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\InWwrFa.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\Souxiab.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\SCfYOkM.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\itjwEgn.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\sbZZAbF.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\NqHFdVp.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\doRulvl.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\zyVDbqg.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\xBZsLsJ.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\qwTttJD.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\emYLFPs.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\BpsBSan.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\AHgvyLd.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\VafzGiB.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\jLQFEII.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\HSACmTC.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\eeYBsze.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\YiLLSfL.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\jJqzvzs.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\PwSRnWG.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\vOorKZA.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\tZkAKLr.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\SLyPkoe.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\nfmwFex.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\AFLgkIt.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\MTHlnjn.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\EYMaXZe.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\QNrZDuh.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\vCUGgeM.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
File created	C:\Windows\System32\bCmCYIp.exe	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 888	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	85
PID 2812 wrote to memory of 888	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	85
PID 2812 wrote to memory of 1528	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	86
PID 2812 wrote to memory of 1528	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	86
PID 2812 wrote to memory of 1736	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	87
PID 2812 wrote to memory of 1736	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	87
PID 2812 wrote to memory of 4672	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	88
PID 2812 wrote to memory of 4672	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	88
PID 2812 wrote to memory of 2300	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	89
PID 2812 wrote to memory of 2300	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	89
PID 2812 wrote to memory of 4360	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	90
PID 2812 wrote to memory of 4360	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	90
PID 2812 wrote to memory of 2212	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	91
PID 2812 wrote to memory of 2212	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	91
PID 2812 wrote to memory of 2936	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	92
PID 2812 wrote to memory of 2936	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	92
PID 2812 wrote to memory of 3716	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	93
PID 2812 wrote to memory of 3716	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	93
PID 2812 wrote to memory of 4204	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	94
PID 2812 wrote to memory of 4204	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	94
PID 2812 wrote to memory of 4788	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	95
PID 2812 wrote to memory of 4788	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	95
PID 2812 wrote to memory of 1676	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	96
PID 2812 wrote to memory of 1676	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	96
PID 2812 wrote to memory of 2564	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	97
PID 2812 wrote to memory of 2564	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	97
PID 2812 wrote to memory of 4336	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	98
PID 2812 wrote to memory of 4336	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	98
PID 2812 wrote to memory of 2800	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	99
PID 2812 wrote to memory of 2800	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	99
PID 2812 wrote to memory of 2508	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	100
PID 2812 wrote to memory of 2508	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	100
PID 2812 wrote to memory of 4028	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	101
PID 2812 wrote to memory of 4028	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	101
PID 2812 wrote to memory of 5080	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	102
PID 2812 wrote to memory of 5080	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	102
PID 2812 wrote to memory of 4416	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	103
PID 2812 wrote to memory of 4416	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	103
PID 2812 wrote to memory of 3296	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	104
PID 2812 wrote to memory of 3296	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	104
PID 2812 wrote to memory of 1176	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	105
PID 2812 wrote to memory of 1176	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	105
PID 2812 wrote to memory of 1444	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	106
PID 2812 wrote to memory of 1444	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	106
PID 2812 wrote to memory of 2240	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	107
PID 2812 wrote to memory of 2240	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	107
PID 2812 wrote to memory of 2376	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	108
PID 2812 wrote to memory of 2376	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	108
PID 2812 wrote to memory of 3136	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	109
PID 2812 wrote to memory of 3136	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	109
PID 2812 wrote to memory of 2724	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	110
PID 2812 wrote to memory of 2724	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	110
PID 2812 wrote to memory of 3488	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	111
PID 2812 wrote to memory of 3488	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	111
PID 2812 wrote to memory of 4340	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	112
PID 2812 wrote to memory of 4340	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	112
PID 2812 wrote to memory of 3008	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	113
PID 2812 wrote to memory of 3008	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	113
PID 2812 wrote to memory of 3988	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	114
PID 2812 wrote to memory of 3988	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	114
PID 2812 wrote to memory of 2416	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	115
PID 2812 wrote to memory of 2416	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	115
PID 2812 wrote to memory of 4804	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	116
PID 2812 wrote to memory of 4804	2812	0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0f7157ad395c5529876fa2533572c596_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\System32\bFwwCtH.exe
  C:\Windows\System32\bFwwCtH.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System32\YKkLQMi.exe
  C:\Windows\System32\YKkLQMi.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System32\MzheBSv.exe
  C:\Windows\System32\MzheBSv.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System32\nekjwyR.exe
  C:\Windows\System32\nekjwyR.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System32\nDLoCQJ.exe
  C:\Windows\System32\nDLoCQJ.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System32\KATNZGp.exe
  C:\Windows\System32\KATNZGp.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System32\odhxmHi.exe
  C:\Windows\System32\odhxmHi.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System32\NcIVFmD.exe
  C:\Windows\System32\NcIVFmD.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System32\XmgGmin.exe
  C:\Windows\System32\XmgGmin.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System32\vXegtnJ.exe
  C:\Windows\System32\vXegtnJ.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System32\zfsWbLj.exe
  C:\Windows\System32\zfsWbLj.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System32\wkrGIVd.exe
  C:\Windows\System32\wkrGIVd.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System32\nEjxemg.exe
  C:\Windows\System32\nEjxemg.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System32\YkUEOvX.exe
  C:\Windows\System32\YkUEOvX.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System32\YKFIHri.exe
  C:\Windows\System32\YKFIHri.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System32\pfCvcnF.exe
  C:\Windows\System32\pfCvcnF.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System32\cTxzMgt.exe
  C:\Windows\System32\cTxzMgt.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System32\ZdWAnLc.exe
  C:\Windows\System32\ZdWAnLc.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System32\FHovvFT.exe
  C:\Windows\System32\FHovvFT.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System32\NEIkdFw.exe
  C:\Windows\System32\NEIkdFw.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System32\qMvlrzt.exe
  C:\Windows\System32\qMvlrzt.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System32\VFSveTl.exe
  C:\Windows\System32\VFSveTl.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System32\sorRJHp.exe
  C:\Windows\System32\sorRJHp.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System32\SvUhyXi.exe
  C:\Windows\System32\SvUhyXi.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System32\RFrFBZb.exe
  C:\Windows\System32\RFrFBZb.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System32\ByKcbAL.exe
  C:\Windows\System32\ByKcbAL.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System32\GMHWqqL.exe
  C:\Windows\System32\GMHWqqL.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System32\XaBqypM.exe
  C:\Windows\System32\XaBqypM.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System32\HfWKjui.exe
  C:\Windows\System32\HfWKjui.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System32\OfdZDSI.exe
  C:\Windows\System32\OfdZDSI.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System32\lfKKyow.exe
  C:\Windows\System32\lfKKyow.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System32\MTyqStY.exe
  C:\Windows\System32\MTyqStY.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System32\vNGYpUy.exe
  C:\Windows\System32\vNGYpUy.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System32\uYvaTOF.exe
  C:\Windows\System32\uYvaTOF.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System32\tXciJju.exe
  C:\Windows\System32\tXciJju.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System32\VsvNQQM.exe
  C:\Windows\System32\VsvNQQM.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System32\eeYBsze.exe
  C:\Windows\System32\eeYBsze.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System32\khPJrjC.exe
  C:\Windows\System32\khPJrjC.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System32\NDtnqHD.exe
  C:\Windows\System32\NDtnqHD.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System32\RcmydyM.exe
  C:\Windows\System32\RcmydyM.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System32\lfoqUVr.exe
  C:\Windows\System32\lfoqUVr.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System32\jdgwdQO.exe
  C:\Windows\System32\jdgwdQO.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System32\KkDqmHF.exe
  C:\Windows\System32\KkDqmHF.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System32\wgNHRkk.exe
  C:\Windows\System32\wgNHRkk.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System32\McAFljZ.exe
  C:\Windows\System32\McAFljZ.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System32\itjwEgn.exe
  C:\Windows\System32\itjwEgn.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System32\ejUtTSX.exe
  C:\Windows\System32\ejUtTSX.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System32\ARldebm.exe
  C:\Windows\System32\ARldebm.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System32\uyhaRlo.exe
  C:\Windows\System32\uyhaRlo.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System32\RjZouit.exe
  C:\Windows\System32\RjZouit.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System32\FNrsarq.exe
  C:\Windows\System32\FNrsarq.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System32\ytlVLhI.exe
  C:\Windows\System32\ytlVLhI.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System32\doRulvl.exe
  C:\Windows\System32\doRulvl.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System32\Gcsyudd.exe
  C:\Windows\System32\Gcsyudd.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System32\Gtsrhxs.exe
  C:\Windows\System32\Gtsrhxs.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System32\YoGqQEZ.exe
  C:\Windows\System32\YoGqQEZ.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System32\unxzxtM.exe
  C:\Windows\System32\unxzxtM.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System32\QEQPywl.exe
  C:\Windows\System32\QEQPywl.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System32\EpuJhdU.exe
  C:\Windows\System32\EpuJhdU.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System32\JWdguok.exe
  C:\Windows\System32\JWdguok.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System32\bIrigkx.exe
  C:\Windows\System32\bIrigkx.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System32\xLoQCAL.exe
  C:\Windows\System32\xLoQCAL.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System32\lSjOgwG.exe
  C:\Windows\System32\lSjOgwG.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System32\TSGsHFQ.exe
  C:\Windows\System32\TSGsHFQ.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System32\AHgvyLd.exe
  C:\Windows\System32\AHgvyLd.exe
  2⤵
  PID:2580
- C:\Windows\System32\xNePlPh.exe
  C:\Windows\System32\xNePlPh.exe
  2⤵
  PID:4976
- C:\Windows\System32\zafQCdv.exe
  C:\Windows\System32\zafQCdv.exe
  2⤵
  PID:2740
- C:\Windows\System32\nDqZEFk.exe
  C:\Windows\System32\nDqZEFk.exe
  2⤵
  PID:4796
- C:\Windows\System32\hdwricv.exe
  C:\Windows\System32\hdwricv.exe
  2⤵
  PID:4412
- C:\Windows\System32\QTYEGPb.exe
  C:\Windows\System32\QTYEGPb.exe
  2⤵
  PID:4136
- C:\Windows\System32\vwVFeCs.exe
  C:\Windows\System32\vwVFeCs.exe
  2⤵
  PID:1312
- C:\Windows\System32\tNizRWQ.exe
  C:\Windows\System32\tNizRWQ.exe
  2⤵
  PID:3820
- C:\Windows\System32\ROQLEBi.exe
  C:\Windows\System32\ROQLEBi.exe
  2⤵
  PID:1684
- C:\Windows\System32\RnqstoQ.exe
  C:\Windows\System32\RnqstoQ.exe
  2⤵
  PID:400
- C:\Windows\System32\tXufPgI.exe
  C:\Windows\System32\tXufPgI.exe
  2⤵
  PID:3300
- C:\Windows\System32\MkKKben.exe
  C:\Windows\System32\MkKKben.exe
  2⤵
  PID:1920
- C:\Windows\System32\nvWaFqK.exe
  C:\Windows\System32\nvWaFqK.exe
  2⤵
  PID:1232
- C:\Windows\System32\rNrkIxi.exe
  C:\Windows\System32\rNrkIxi.exe
  2⤵
  PID:3996
- C:\Windows\System32\SfGECyj.exe
  C:\Windows\System32\SfGECyj.exe
  2⤵
  PID:5008
- C:\Windows\System32\eoNCmup.exe
  C:\Windows\System32\eoNCmup.exe
  2⤵
  PID:656
- C:\Windows\System32\nUPOWXl.exe
  C:\Windows\System32\nUPOWXl.exe
  2⤵
  PID:4756
- C:\Windows\System32\QoOIwKZ.exe
  C:\Windows\System32\QoOIwKZ.exe
  2⤵
  PID:5132
- C:\Windows\System32\xViSNGI.exe
  C:\Windows\System32\xViSNGI.exe
  2⤵
  PID:5164
- C:\Windows\System32\WJRopDr.exe
  C:\Windows\System32\WJRopDr.exe
  2⤵
  PID:5188
- C:\Windows\System32\OOwbNOz.exe
  C:\Windows\System32\OOwbNOz.exe
  2⤵
  PID:5220
- C:\Windows\System32\NHMGGtV.exe
  C:\Windows\System32\NHMGGtV.exe
  2⤵
  PID:5248
- C:\Windows\System32\KTJmDPy.exe
  C:\Windows\System32\KTJmDPy.exe
  2⤵
  PID:5272
- C:\Windows\System32\npIukXJ.exe
  C:\Windows\System32\npIukXJ.exe
  2⤵
  PID:5304
- C:\Windows\System32\OBZHqXh.exe
  C:\Windows\System32\OBZHqXh.exe
  2⤵
  PID:5328
- C:\Windows\System32\DMRvqCY.exe
  C:\Windows\System32\DMRvqCY.exe
  2⤵
  PID:5360
- C:\Windows\System32\YiLLSfL.exe
  C:\Windows\System32\YiLLSfL.exe
  2⤵
  PID:5388
- C:\Windows\System32\mtaPxUh.exe
  C:\Windows\System32\mtaPxUh.exe
  2⤵
  PID:5420
- C:\Windows\System32\GHCPNpW.exe
  C:\Windows\System32\GHCPNpW.exe
  2⤵
  PID:5444
- C:\Windows\System32\tkOWQmC.exe
  C:\Windows\System32\tkOWQmC.exe
  2⤵
  PID:5468
- C:\Windows\System32\CelygMs.exe
  C:\Windows\System32\CelygMs.exe
  2⤵
  PID:5500
- C:\Windows\System32\GgljVSV.exe
  C:\Windows\System32\GgljVSV.exe
  2⤵
  PID:5532
- C:\Windows\System32\eRrpUJF.exe
  C:\Windows\System32\eRrpUJF.exe
  2⤵
  PID:5556
- C:\Windows\System32\xCWeQSq.exe
  C:\Windows\System32\xCWeQSq.exe
  2⤵
  PID:5580
- C:\Windows\System32\jFkINrl.exe
  C:\Windows\System32\jFkINrl.exe
  2⤵
  PID:5612
- C:\Windows\System32\DUdZffx.exe
  C:\Windows\System32\DUdZffx.exe
  2⤵
  PID:5640
- C:\Windows\System32\JuPzWCo.exe
  C:\Windows\System32\JuPzWCo.exe
  2⤵
  PID:5664
- C:\Windows\System32\tiIzKki.exe
  C:\Windows\System32\tiIzKki.exe
  2⤵
  PID:5728
- C:\Windows\System32\wvwMaLR.exe
  C:\Windows\System32\wvwMaLR.exe
  2⤵
  PID:5760
- C:\Windows\System32\bwZABvn.exe
  C:\Windows\System32\bwZABvn.exe
  2⤵
  PID:5776
- C:\Windows\System32\PEGwqay.exe
  C:\Windows\System32\PEGwqay.exe
  2⤵
  PID:5796
- C:\Windows\System32\GHXenkU.exe
  C:\Windows\System32\GHXenkU.exe
  2⤵
  PID:5844
- C:\Windows\System32\JiwNgKP.exe
  C:\Windows\System32\JiwNgKP.exe
  2⤵
  PID:5900
- C:\Windows\System32\MIuTNDu.exe
  C:\Windows\System32\MIuTNDu.exe
  2⤵
  PID:5916
- C:\Windows\System32\YWsKbYN.exe
  C:\Windows\System32\YWsKbYN.exe
  2⤵
  PID:5948
- C:\Windows\System32\SrodTAm.exe
  C:\Windows\System32\SrodTAm.exe
  2⤵
  PID:6000
- C:\Windows\System32\CSCsZUW.exe
  C:\Windows\System32\CSCsZUW.exe
  2⤵
  PID:6016
- C:\Windows\System32\yQfBhhn.exe
  C:\Windows\System32\yQfBhhn.exe
  2⤵
  PID:6036
- C:\Windows\System32\zFLoCyw.exe
  C:\Windows\System32\zFLoCyw.exe
  2⤵
  PID:6052
- C:\Windows\System32\OiefWOM.exe
  C:\Windows\System32\OiefWOM.exe
  2⤵
  PID:6068
- C:\Windows\System32\TSLQXYU.exe
  C:\Windows\System32\TSLQXYU.exe
  2⤵
  PID:6084
- C:\Windows\System32\ldLNKDw.exe
  C:\Windows\System32\ldLNKDw.exe
  2⤵
  PID:6104
- C:\Windows\System32\dkZqcUY.exe
  C:\Windows\System32\dkZqcUY.exe
  2⤵
  PID:6124
- C:\Windows\System32\MYREciz.exe
  C:\Windows\System32\MYREciz.exe
  2⤵
  PID:6140
- C:\Windows\System32\AcoJQvt.exe
  C:\Windows\System32\AcoJQvt.exe
  2⤵
  PID:892
- C:\Windows\System32\AymDHoq.exe
  C:\Windows\System32\AymDHoq.exe
  2⤵
  PID:5128
- C:\Windows\System32\XkptvcB.exe
  C:\Windows\System32\XkptvcB.exe
  2⤵
  PID:5232
- C:\Windows\System32\WXOEMEP.exe
  C:\Windows\System32\WXOEMEP.exe
  2⤵
  PID:5264
- C:\Windows\System32\nxdoTMh.exe
  C:\Windows\System32\nxdoTMh.exe
  2⤵
  PID:5316
- C:\Windows\System32\otomitr.exe
  C:\Windows\System32\otomitr.exe
  2⤵
  PID:5344
- C:\Windows\System32\FboHFMP.exe
  C:\Windows\System32\FboHFMP.exe
  2⤵
  PID:1140
- C:\Windows\System32\AEXXEiM.exe
  C:\Windows\System32\AEXXEiM.exe
  2⤵
  PID:5456
- C:\Windows\System32\jfqapQj.exe
  C:\Windows\System32\jfqapQj.exe
  2⤵
  PID:5492
- C:\Windows\System32\qIlbMty.exe
  C:\Windows\System32\qIlbMty.exe
  2⤵
  PID:5512
- C:\Windows\System32\EOKnXrG.exe
  C:\Windows\System32\EOKnXrG.exe
  2⤵
  PID:3664
- C:\Windows\System32\bGrbyoo.exe
  C:\Windows\System32\bGrbyoo.exe
  2⤵
  PID:2136
- C:\Windows\System32\kgQvWWM.exe
  C:\Windows\System32\kgQvWWM.exe
  2⤵
  PID:5628
- C:\Windows\System32\IJkFagq.exe
  C:\Windows\System32\IJkFagq.exe
  2⤵
  PID:5660
- C:\Windows\System32\VafzGiB.exe
  C:\Windows\System32\VafzGiB.exe
  2⤵
  PID:5704
- C:\Windows\System32\jLQFEII.exe
  C:\Windows\System32\jLQFEII.exe
  2⤵
  PID:5824
- C:\Windows\System32\VpuiWTd.exe
  C:\Windows\System32\VpuiWTd.exe
  2⤵
  PID:5864
- C:\Windows\System32\iqTBZXC.exe
  C:\Windows\System32\iqTBZXC.exe
  2⤵
  PID:5908
- C:\Windows\System32\gUtNbIA.exe
  C:\Windows\System32\gUtNbIA.exe
  2⤵
  PID:2156
- C:\Windows\System32\hTdjgzf.exe
  C:\Windows\System32\hTdjgzf.exe
  2⤵
  PID:5860
- C:\Windows\System32\ifJUzBO.exe
  C:\Windows\System32\ifJUzBO.exe
  2⤵
  PID:6060
- C:\Windows\System32\LIFfIic.exe
  C:\Windows\System32\LIFfIic.exe
  2⤵
  PID:4316
- C:\Windows\System32\hJzQPfN.exe
  C:\Windows\System32\hJzQPfN.exe
  2⤵
  PID:6012
- C:\Windows\System32\mniyMDX.exe
  C:\Windows\System32\mniyMDX.exe
  2⤵
  PID:428
- C:\Windows\System32\xckpTAk.exe
  C:\Windows\System32\xckpTAk.exe
  2⤵
  PID:4552
- C:\Windows\System32\ZgGgLbq.exe
  C:\Windows\System32\ZgGgLbq.exe
  2⤵
  PID:5156
- C:\Windows\System32\xBhjFAf.exe
  C:\Windows\System32\xBhjFAf.exe
  2⤵
  PID:4868
- C:\Windows\System32\MKVTHKu.exe
  C:\Windows\System32\MKVTHKu.exe
  2⤵
  PID:4680
- C:\Windows\System32\eSONWnI.exe
  C:\Windows\System32\eSONWnI.exe
  2⤵
  PID:2816
- C:\Windows\System32\GYHrfRc.exe
  C:\Windows\System32\GYHrfRc.exe
  2⤵
  PID:4564
- C:\Windows\System32\HPsErVT.exe
  C:\Windows\System32\HPsErVT.exe
  2⤵
  PID:5624
- C:\Windows\System32\qZxIGqn.exe
  C:\Windows\System32\qZxIGqn.exe
  2⤵
  PID:5816
- C:\Windows\System32\sbZZAbF.exe
  C:\Windows\System32\sbZZAbF.exe
  2⤵
  PID:2192
- C:\Windows\System32\fWSDXrJ.exe
  C:\Windows\System32\fWSDXrJ.exe
  2⤵
  PID:5912
- C:\Windows\System32\QjcTxTt.exe
  C:\Windows\System32\QjcTxTt.exe
  2⤵
  PID:6048
- C:\Windows\System32\eCzGREO.exe
  C:\Windows\System32\eCzGREO.exe
  2⤵
  PID:4516
- C:\Windows\System32\AsRIykV.exe
  C:\Windows\System32\AsRIykV.exe
  2⤵
  PID:748
- C:\Windows\System32\oFzaZmU.exe
  C:\Windows\System32\oFzaZmU.exe
  2⤵
  PID:5460
- C:\Windows\System32\zRZvGqT.exe
  C:\Windows\System32\zRZvGqT.exe
  2⤵
  PID:5960
- C:\Windows\System32\zhvizJi.exe
  C:\Windows\System32\zhvizJi.exe
  2⤵
  PID:5744
- C:\Windows\System32\eaURTjK.exe
  C:\Windows\System32\eaURTjK.exe
  2⤵
  PID:2244
- C:\Windows\System32\SoIMcon.exe
  C:\Windows\System32\SoIMcon.exe
  2⤵
  PID:5048
- C:\Windows\System32\YnhkItH.exe
  C:\Windows\System32\YnhkItH.exe
  2⤵
  PID:1948
- C:\Windows\System32\OvdeBEv.exe
  C:\Windows\System32\OvdeBEv.exe
  2⤵
  PID:6152
- C:\Windows\System32\iHibRII.exe
  C:\Windows\System32\iHibRII.exe
  2⤵
  PID:6172
- C:\Windows\System32\RFQlnpT.exe
  C:\Windows\System32\RFQlnpT.exe
  2⤵
  PID:6188
- C:\Windows\System32\pFKQHiS.exe
  C:\Windows\System32\pFKQHiS.exe
  2⤵
  PID:6216
- C:\Windows\System32\VptTrTM.exe
  C:\Windows\System32\VptTrTM.exe
  2⤵
  PID:6236
- C:\Windows\System32\iYvPzDN.exe
  C:\Windows\System32\iYvPzDN.exe
  2⤵
  PID:6284
- C:\Windows\System32\bsPWssv.exe
  C:\Windows\System32\bsPWssv.exe
  2⤵
  PID:6332
- C:\Windows\System32\pHpjCLf.exe
  C:\Windows\System32\pHpjCLf.exe
  2⤵
  PID:6364
- C:\Windows\System32\DIpnIBs.exe
  C:\Windows\System32\DIpnIBs.exe
  2⤵
  PID:6380
- C:\Windows\System32\rHHYaOK.exe
  C:\Windows\System32\rHHYaOK.exe
  2⤵
  PID:6420
- C:\Windows\System32\PxAiPNh.exe
  C:\Windows\System32\PxAiPNh.exe
  2⤵
  PID:6448
- C:\Windows\System32\FLqXpme.exe
  C:\Windows\System32\FLqXpme.exe
  2⤵
  PID:6464
- C:\Windows\System32\RtlMzuy.exe
  C:\Windows\System32\RtlMzuy.exe
  2⤵
  PID:6508
- C:\Windows\System32\CqhNNOM.exe
  C:\Windows\System32\CqhNNOM.exe
  2⤵
  PID:6528
- C:\Windows\System32\ZBICkUw.exe
  C:\Windows\System32\ZBICkUw.exe
  2⤵
  PID:6548
- C:\Windows\System32\TdOckrA.exe
  C:\Windows\System32\TdOckrA.exe
  2⤵
  PID:6568
- C:\Windows\System32\xomqBqX.exe
  C:\Windows\System32\xomqBqX.exe
  2⤵
  PID:6592
- C:\Windows\System32\wTUTkng.exe
  C:\Windows\System32\wTUTkng.exe
  2⤵
  PID:6616
- C:\Windows\System32\nqNmfEe.exe
  C:\Windows\System32\nqNmfEe.exe
  2⤵
  PID:6672
- C:\Windows\System32\vCUGgeM.exe
  C:\Windows\System32\vCUGgeM.exe
  2⤵
  PID:6704
- C:\Windows\System32\yJcVsnT.exe
  C:\Windows\System32\yJcVsnT.exe
  2⤵
  PID:6728
- C:\Windows\System32\NMqGZAk.exe
  C:\Windows\System32\NMqGZAk.exe
  2⤵
  PID:6768
- C:\Windows\System32\DueUdZM.exe
  C:\Windows\System32\DueUdZM.exe
  2⤵
  PID:6796
- C:\Windows\System32\QWGmWup.exe
  C:\Windows\System32\QWGmWup.exe
  2⤵
  PID:6812
- C:\Windows\System32\uuXOINK.exe
  C:\Windows\System32\uuXOINK.exe
  2⤵
  PID:6856
- C:\Windows\System32\zgTXgQW.exe
  C:\Windows\System32\zgTXgQW.exe
  2⤵
  PID:6896
- C:\Windows\System32\mmASLRG.exe
  C:\Windows\System32\mmASLRG.exe
  2⤵
  PID:6912
- C:\Windows\System32\cZQHGNy.exe
  C:\Windows\System32\cZQHGNy.exe
  2⤵
  PID:6952
- C:\Windows\System32\tmOfTeE.exe
  C:\Windows\System32\tmOfTeE.exe
  2⤵
  PID:6968
- C:\Windows\System32\htGDzWK.exe
  C:\Windows\System32\htGDzWK.exe
  2⤵
  PID:6988
- C:\Windows\System32\ySKeluM.exe
  C:\Windows\System32\ySKeluM.exe
  2⤵
  PID:7016
- C:\Windows\System32\NqMVybt.exe
  C:\Windows\System32\NqMVybt.exe
  2⤵
  PID:7040
- C:\Windows\System32\KjXQqWY.exe
  C:\Windows\System32\KjXQqWY.exe
  2⤵
  PID:7084
- C:\Windows\System32\qhIJpYl.exe
  C:\Windows\System32\qhIJpYl.exe
  2⤵
  PID:7104
- C:\Windows\System32\YBPjtOS.exe
  C:\Windows\System32\YBPjtOS.exe
  2⤵
  PID:7128
- C:\Windows\System32\WuEHhAw.exe
  C:\Windows\System32\WuEHhAw.exe
  2⤵
  PID:7144
- C:\Windows\System32\NYOsgDo.exe
  C:\Windows\System32\NYOsgDo.exe
  2⤵
  PID:6092
- C:\Windows\System32\MHYyxAV.exe
  C:\Windows\System32\MHYyxAV.exe
  2⤵
  PID:6200
- C:\Windows\System32\UZWPUGM.exe
  C:\Windows\System32\UZWPUGM.exe
  2⤵
  PID:6340
- C:\Windows\System32\FvmCoyl.exe
  C:\Windows\System32\FvmCoyl.exe
  2⤵
  PID:6404
- C:\Windows\System32\rWijKqv.exe
  C:\Windows\System32\rWijKqv.exe
  2⤵
  PID:6460
- C:\Windows\System32\EGkBSQh.exe
  C:\Windows\System32\EGkBSQh.exe
  2⤵
  PID:6496
- C:\Windows\System32\fyRvXSD.exe
  C:\Windows\System32\fyRvXSD.exe
  2⤵
  PID:6560
- C:\Windows\System32\xyDBlCs.exe
  C:\Windows\System32\xyDBlCs.exe
  2⤵
  PID:6636
- C:\Windows\System32\ZOqSpfv.exe
  C:\Windows\System32\ZOqSpfv.exe
  2⤵
  PID:6712
- C:\Windows\System32\reTNuNr.exe
  C:\Windows\System32\reTNuNr.exe
  2⤵
  PID:6748
- C:\Windows\System32\tPnboQQ.exe
  C:\Windows\System32\tPnboQQ.exe
  2⤵
  PID:6804
- C:\Windows\System32\TPIuDhA.exe
  C:\Windows\System32\TPIuDhA.exe
  2⤵
  PID:6908
- C:\Windows\System32\WMqCXvM.exe
  C:\Windows\System32\WMqCXvM.exe
  2⤵
  PID:6984
- C:\Windows\System32\dNxkKGC.exe
  C:\Windows\System32\dNxkKGC.exe
  2⤵
  PID:7036
- C:\Windows\System32\CoZzbZj.exe
  C:\Windows\System32\CoZzbZj.exe
  2⤵
  PID:7092
- C:\Windows\System32\OXOKESP.exe
  C:\Windows\System32\OXOKESP.exe
  2⤵
  PID:7120
- C:\Windows\System32\aRsotul.exe
  C:\Windows\System32\aRsotul.exe
  2⤵
  PID:6168
- C:\Windows\System32\FYsfCOY.exe
  C:\Windows\System32\FYsfCOY.exe
  2⤵
  PID:6268
- C:\Windows\System32\YGDIttx.exe
  C:\Windows\System32\YGDIttx.exe
  2⤵
  PID:6432
- C:\Windows\System32\shMRFrh.exe
  C:\Windows\System32\shMRFrh.exe
  2⤵
  PID:6544
- C:\Windows\System32\bCmCYIp.exe
  C:\Windows\System32\bCmCYIp.exe
  2⤵
  PID:6652
- C:\Windows\System32\ZkLFNTC.exe
  C:\Windows\System32\ZkLFNTC.exe
  2⤵
  PID:6792
- C:\Windows\System32\eyKnUQO.exe
  C:\Windows\System32\eyKnUQO.exe
  2⤵
  PID:6884
- C:\Windows\System32\lzmHjoA.exe
  C:\Windows\System32\lzmHjoA.exe
  2⤵
  PID:6928
- C:\Windows\System32\QPZfsLF.exe
  C:\Windows\System32\QPZfsLF.exe
  2⤵
  PID:7140
- C:\Windows\System32\uKwlIBz.exe
  C:\Windows\System32\uKwlIBz.exe
  2⤵
  PID:5756
- C:\Windows\System32\njMJTUC.exe
  C:\Windows\System32\njMJTUC.exe
  2⤵
  PID:7180
- C:\Windows\System32\iyPKdZT.exe
  C:\Windows\System32\iyPKdZT.exe
  2⤵
  PID:7212
- C:\Windows\System32\UfiHxGq.exe
  C:\Windows\System32\UfiHxGq.exe
  2⤵
  PID:7240
- C:\Windows\System32\ALWxQib.exe
  C:\Windows\System32\ALWxQib.exe
  2⤵
  PID:7260
- C:\Windows\System32\TDLmBex.exe
  C:\Windows\System32\TDLmBex.exe
  2⤵
  PID:7276
- C:\Windows\System32\zuTmgjp.exe
  C:\Windows\System32\zuTmgjp.exe
  2⤵
  PID:7300
- C:\Windows\System32\ZFPduSR.exe
  C:\Windows\System32\ZFPduSR.exe
  2⤵
  PID:7328
- C:\Windows\System32\pGTkDhA.exe
  C:\Windows\System32\pGTkDhA.exe
  2⤵
  PID:7372
- C:\Windows\System32\BDLsLbT.exe
  C:\Windows\System32\BDLsLbT.exe
  2⤵
  PID:7408
- C:\Windows\System32\vqJZMeT.exe
  C:\Windows\System32\vqJZMeT.exe
  2⤵
  PID:7432
- C:\Windows\System32\VciBcmc.exe
  C:\Windows\System32\VciBcmc.exe
  2⤵
  PID:7448
- C:\Windows\System32\trRbbnY.exe
  C:\Windows\System32\trRbbnY.exe
  2⤵
  PID:7468
- C:\Windows\System32\CQuyXOQ.exe
  C:\Windows\System32\CQuyXOQ.exe
  2⤵
  PID:7484
- C:\Windows\System32\DQvNLZT.exe
  C:\Windows\System32\DQvNLZT.exe
  2⤵
  PID:7540
- C:\Windows\System32\HZERVsy.exe
  C:\Windows\System32\HZERVsy.exe
  2⤵
  PID:7568
- C:\Windows\System32\SfMciah.exe
  C:\Windows\System32\SfMciah.exe
  2⤵
  PID:7588
- C:\Windows\System32\OurLOEa.exe
  C:\Windows\System32\OurLOEa.exe
  2⤵
  PID:7616
- C:\Windows\System32\DCFugUS.exe
  C:\Windows\System32\DCFugUS.exe
  2⤵
  PID:7632
- C:\Windows\System32\SpJuIwI.exe
  C:\Windows\System32\SpJuIwI.exe
  2⤵
  PID:7680
- C:\Windows\System32\xORSYKD.exe
  C:\Windows\System32\xORSYKD.exe
  2⤵
  PID:7700
- C:\Windows\System32\EJLeKwT.exe
  C:\Windows\System32\EJLeKwT.exe
  2⤵
  PID:7720
- C:\Windows\System32\fMqZbCU.exe
  C:\Windows\System32\fMqZbCU.exe
  2⤵
  PID:7740
- C:\Windows\System32\osHcdmx.exe
  C:\Windows\System32\osHcdmx.exe
  2⤵
  PID:7776
- C:\Windows\System32\iOwkUkp.exe
  C:\Windows\System32\iOwkUkp.exe
  2⤵
  PID:7792
- C:\Windows\System32\PSoqerD.exe
  C:\Windows\System32\PSoqerD.exe
  2⤵
  PID:7816
- C:\Windows\System32\ogsOkPw.exe
  C:\Windows\System32\ogsOkPw.exe
  2⤵
  PID:7836
- C:\Windows\System32\wAerNPZ.exe
  C:\Windows\System32\wAerNPZ.exe
  2⤵
  PID:7852
- C:\Windows\System32\KSUutuR.exe
  C:\Windows\System32\KSUutuR.exe
  2⤵
  PID:7916
- C:\Windows\System32\QsYoeff.exe
  C:\Windows\System32\QsYoeff.exe
  2⤵
  PID:7992
- C:\Windows\System32\NyjYvfm.exe
  C:\Windows\System32\NyjYvfm.exe
  2⤵
  PID:8008
- C:\Windows\System32\flnSliS.exe
  C:\Windows\System32\flnSliS.exe
  2⤵
  PID:8024
- C:\Windows\System32\jJqzvzs.exe
  C:\Windows\System32\jJqzvzs.exe
  2⤵
  PID:8052
- C:\Windows\System32\BOyZFgj.exe
  C:\Windows\System32\BOyZFgj.exe
  2⤵
  PID:8072
- C:\Windows\System32\YTSGKCS.exe
  C:\Windows\System32\YTSGKCS.exe
  2⤵
  PID:8116
- C:\Windows\System32\vHtIKlE.exe
  C:\Windows\System32\vHtIKlE.exe
  2⤵
  PID:8132
- C:\Windows\System32\nFSXwHr.exe
  C:\Windows\System32\nFSXwHr.exe
  2⤵
  PID:8156
- C:\Windows\System32\vZbQWTo.exe
  C:\Windows\System32\vZbQWTo.exe
  2⤵
  PID:8176
- C:\Windows\System32\daYvMwH.exe
  C:\Windows\System32\daYvMwH.exe
  2⤵
  PID:5812
- C:\Windows\System32\aHEWGJi.exe
  C:\Windows\System32\aHEWGJi.exe
  2⤵
  PID:7172
- C:\Windows\System32\ltGBtpb.exe
  C:\Windows\System32\ltGBtpb.exe
  2⤵
  PID:7232
- C:\Windows\System32\lskNaJW.exe
  C:\Windows\System32\lskNaJW.exe
  2⤵
  PID:7284
- C:\Windows\System32\TkcwmTs.exe
  C:\Windows\System32\TkcwmTs.exe
  2⤵
  PID:7380
- C:\Windows\System32\izWyheD.exe
  C:\Windows\System32\izWyheD.exe
  2⤵
  PID:7892
- C:\Windows\System32\vHJuxbs.exe
  C:\Windows\System32\vHJuxbs.exe
  2⤵
  PID:7844
- C:\Windows\System32\GZGcrgh.exe
  C:\Windows\System32\GZGcrgh.exe
  2⤵
  PID:8040
- C:\Windows\System32\zyVDbqg.exe
  C:\Windows\System32\zyVDbqg.exe
  2⤵
  PID:8092
- C:\Windows\System32\LCWdHju.exe
  C:\Windows\System32\LCWdHju.exe
  2⤵
  PID:7056
- C:\Windows\System32\oengyxJ.exe
  C:\Windows\System32\oengyxJ.exe
  2⤵
  PID:8184
- C:\Windows\System32\OFpGYCG.exe
  C:\Windows\System32\OFpGYCG.exe
  2⤵
  PID:7424
- C:\Windows\System32\hLQTOAL.exe
  C:\Windows\System32\hLQTOAL.exe
  2⤵
  PID:7480
- C:\Windows\System32\OgimuFm.exe
  C:\Windows\System32\OgimuFm.exe
  2⤵
  PID:7248
- C:\Windows\System32\pArMmjU.exe
  C:\Windows\System32\pArMmjU.exe
  2⤵
  PID:7564
- C:\Windows\System32\yREakJW.exe
  C:\Windows\System32\yREakJW.exe
  2⤵
  PID:8004
- C:\Windows\System32\qGzgRMf.exe
  C:\Windows\System32\qGzgRMf.exe
  2⤵
  PID:8068
- C:\Windows\System32\NqHFdVp.exe
  C:\Windows\System32\NqHFdVp.exe
  2⤵
  PID:7708
- C:\Windows\System32\yCoCNIs.exe
  C:\Windows\System32\yCoCNIs.exe
  2⤵
  PID:7756
- C:\Windows\System32\PqKZyUa.exe
  C:\Windows\System32\PqKZyUa.exe
  2⤵
  PID:7404
- C:\Windows\System32\pscZDCn.exe
  C:\Windows\System32\pscZDCn.exe
  2⤵
  PID:7220
- C:\Windows\System32\WaFOSgk.exe
  C:\Windows\System32\WaFOSgk.exe
  2⤵
  PID:7352
- C:\Windows\System32\EUCuUDp.exe
  C:\Windows\System32\EUCuUDp.exe
  2⤵
  PID:7612
- C:\Windows\System32\MocObMK.exe
  C:\Windows\System32\MocObMK.exe
  2⤵
  PID:7596
- C:\Windows\System32\RQqofne.exe
  C:\Windows\System32\RQqofne.exe
  2⤵
  PID:7460
- C:\Windows\System32\pHPriIT.exe
  C:\Windows\System32\pHPriIT.exe
  2⤵
  PID:8080
- C:\Windows\System32\tYFkDCG.exe
  C:\Windows\System32\tYFkDCG.exe
  2⤵
  PID:7664
- C:\Windows\System32\jFUCNxV.exe
  C:\Windows\System32\jFUCNxV.exe
  2⤵
  PID:8212
- C:\Windows\System32\oyeCljO.exe
  C:\Windows\System32\oyeCljO.exe
  2⤵
  PID:8240
- C:\Windows\System32\YSizFOk.exe
  C:\Windows\System32\YSizFOk.exe
  2⤵
  PID:8268
- C:\Windows\System32\XvasfmA.exe
  C:\Windows\System32\XvasfmA.exe
  2⤵
  PID:8296
- C:\Windows\System32\BKLdRbB.exe
  C:\Windows\System32\BKLdRbB.exe
  2⤵
  PID:8320
- C:\Windows\System32\nfmwFex.exe
  C:\Windows\System32\nfmwFex.exe
  2⤵
  PID:8336
- C:\Windows\System32\FmtCzsV.exe
  C:\Windows\System32\FmtCzsV.exe
  2⤵
  PID:8368
- C:\Windows\System32\GtnLQHx.exe
  C:\Windows\System32\GtnLQHx.exe
  2⤵
  PID:8384
- C:\Windows\System32\sWDndwV.exe
  C:\Windows\System32\sWDndwV.exe
  2⤵
  PID:8412
- C:\Windows\System32\snVILdy.exe
  C:\Windows\System32\snVILdy.exe
  2⤵
  PID:8428
- C:\Windows\System32\FQtjYdU.exe
  C:\Windows\System32\FQtjYdU.exe
  2⤵
  PID:8468
- C:\Windows\System32\uqdWgdc.exe
  C:\Windows\System32\uqdWgdc.exe
  2⤵
  PID:8488
- C:\Windows\System32\xHlxUqJ.exe
  C:\Windows\System32\xHlxUqJ.exe
  2⤵
  PID:8536
- C:\Windows\System32\gbrrFNx.exe
  C:\Windows\System32\gbrrFNx.exe
  2⤵
  PID:8704
- C:\Windows\System32\lqGYYVg.exe
  C:\Windows\System32\lqGYYVg.exe
  2⤵
  PID:8768
- C:\Windows\System32\etAlteI.exe
  C:\Windows\System32\etAlteI.exe
  2⤵
  PID:8784
- C:\Windows\System32\JmhYAFY.exe
  C:\Windows\System32\JmhYAFY.exe
  2⤵
  PID:8800
- C:\Windows\System32\ecZGiLz.exe
  C:\Windows\System32\ecZGiLz.exe
  2⤵
  PID:8816
- C:\Windows\System32\pJqtDPE.exe
  C:\Windows\System32\pJqtDPE.exe
  2⤵
  PID:8832
- C:\Windows\System32\hEMmEDM.exe
  C:\Windows\System32\hEMmEDM.exe
  2⤵
  PID:8848
- C:\Windows\System32\WArcGQz.exe
  C:\Windows\System32\WArcGQz.exe
  2⤵
  PID:8892
- C:\Windows\System32\wBCphSl.exe
  C:\Windows\System32\wBCphSl.exe
  2⤵
  PID:8920
- C:\Windows\System32\FvCRkBv.exe
  C:\Windows\System32\FvCRkBv.exe
  2⤵
  PID:8952
- C:\Windows\System32\fcaNwEl.exe
  C:\Windows\System32\fcaNwEl.exe
  2⤵
  PID:8988
- C:\Windows\System32\sldHUby.exe
  C:\Windows\System32\sldHUby.exe
  2⤵
  PID:9028
- C:\Windows\System32\FJDbSQN.exe
  C:\Windows\System32\FJDbSQN.exe
  2⤵
  PID:9064
- C:\Windows\System32\kiItZOg.exe
  C:\Windows\System32\kiItZOg.exe
  2⤵
  PID:9084
- C:\Windows\System32\hDzWKEj.exe
  C:\Windows\System32\hDzWKEj.exe
  2⤵
  PID:9128
- C:\Windows\System32\mWdBrtD.exe
  C:\Windows\System32\mWdBrtD.exe
  2⤵
  PID:9160
- C:\Windows\System32\QjAIfei.exe
  C:\Windows\System32\QjAIfei.exe
  2⤵
  PID:9176
- C:\Windows\System32\YNvrrJP.exe
  C:\Windows\System32\YNvrrJP.exe
  2⤵
  PID:9200
- C:\Windows\System32\AFLgkIt.exe
  C:\Windows\System32\AFLgkIt.exe
  2⤵
  PID:7768
- C:\Windows\System32\VWVIujj.exe
  C:\Windows\System32\VWVIujj.exe
  2⤵
  PID:7512
- C:\Windows\System32\kqxJEYP.exe
  C:\Windows\System32\kqxJEYP.exe
  2⤵
  PID:8376
- C:\Windows\System32\aVyxOJl.exe
  C:\Windows\System32\aVyxOJl.exe
  2⤵
  PID:8392
- C:\Windows\System32\EwySHXW.exe
  C:\Windows\System32\EwySHXW.exe
  2⤵
  PID:8524
- C:\Windows\System32\jjfipTK.exe
  C:\Windows\System32\jjfipTK.exe
  2⤵
  PID:8568
- C:\Windows\System32\qQLCDhj.exe
  C:\Windows\System32\qQLCDhj.exe
  2⤵
  PID:8596
- C:\Windows\System32\ICvpxrX.exe
  C:\Windows\System32\ICvpxrX.exe
  2⤵
  PID:8648
- C:\Windows\System32\jxolrQk.exe
  C:\Windows\System32\jxolrQk.exe
  2⤵
  PID:8552
- C:\Windows\System32\zBcUhCu.exe
  C:\Windows\System32\zBcUhCu.exe
  2⤵
  PID:8620
- C:\Windows\System32\QNbtmPq.exe
  C:\Windows\System32\QNbtmPq.exe
  2⤵
  PID:8728
- C:\Windows\System32\HsdujUo.exe
  C:\Windows\System32\HsdujUo.exe
  2⤵
  PID:8740
- C:\Windows\System32\YcVrTQU.exe
  C:\Windows\System32\YcVrTQU.exe
  2⤵
  PID:8712
- C:\Windows\System32\oVHohat.exe
  C:\Windows\System32\oVHohat.exe
  2⤵
  PID:8812
- C:\Windows\System32\KZKQAqc.exe
  C:\Windows\System32\KZKQAqc.exe
  2⤵
  PID:8868
- C:\Windows\System32\FEfFINk.exe
  C:\Windows\System32\FEfFINk.exe
  2⤵
  PID:9004
- C:\Windows\System32\ebLkTJd.exe
  C:\Windows\System32\ebLkTJd.exe
  2⤵
  PID:9036
- C:\Windows\System32\KfHGceA.exe
  C:\Windows\System32\KfHGceA.exe
  2⤵
  PID:9072
- C:\Windows\System32\uQBrGrJ.exe
  C:\Windows\System32\uQBrGrJ.exe
  2⤵
  PID:9148
- C:\Windows\System32\XExdJde.exe
  C:\Windows\System32\XExdJde.exe
  2⤵
  PID:8228
- C:\Windows\System32\zOvMaMr.exe
  C:\Windows\System32\zOvMaMr.exe
  2⤵
  PID:8280
- C:\Windows\System32\JbDbHsr.exe
  C:\Windows\System32\JbDbHsr.exe
  2⤵
  PID:8580
- C:\Windows\System32\cIjydrt.exe
  C:\Windows\System32\cIjydrt.exe
  2⤵
  PID:8584
- C:\Windows\System32\MTHlnjn.exe
  C:\Windows\System32\MTHlnjn.exe
  2⤵
  PID:8764
- C:\Windows\System32\WNNYmxc.exe
  C:\Windows\System32\WNNYmxc.exe
  2⤵
  PID:8792
- C:\Windows\System32\XoonvYL.exe
  C:\Windows\System32\XoonvYL.exe
  2⤵
  PID:8912
- C:\Windows\System32\BppvGUL.exe
  C:\Windows\System32\BppvGUL.exe
  2⤵
  PID:9000
- C:\Windows\System32\usaKEWk.exe
  C:\Windows\System32\usaKEWk.exe
  2⤵
  PID:9208
- C:\Windows\System32\VPxIqpw.exe
  C:\Windows\System32\VPxIqpw.exe
  2⤵
  PID:8312
- C:\Windows\System32\JPcwprV.exe
  C:\Windows\System32\JPcwprV.exe
  2⤵
  PID:8824
- C:\Windows\System32\WwpVvnF.exe
  C:\Windows\System32\WwpVvnF.exe
  2⤵
  PID:9056
- C:\Windows\System32\qwTttJD.exe
  C:\Windows\System32\qwTttJD.exe
  2⤵
  PID:9096
- C:\Windows\System32\gnmZrWA.exe
  C:\Windows\System32\gnmZrWA.exe
  2⤵
  PID:8932
- C:\Windows\System32\zuabfrt.exe
  C:\Windows\System32\zuabfrt.exe
  2⤵
  PID:9248
- C:\Windows\System32\hTBwSJE.exe
  C:\Windows\System32\hTBwSJE.exe
  2⤵
  PID:9268
- C:\Windows\System32\CQYMpHc.exe
  C:\Windows\System32\CQYMpHc.exe
  2⤵
  PID:9296
- C:\Windows\System32\zisKayV.exe
  C:\Windows\System32\zisKayV.exe
  2⤵
  PID:9320
- C:\Windows\System32\KOImqif.exe
  C:\Windows\System32\KOImqif.exe
  2⤵
  PID:9352
- C:\Windows\System32\NYgOpRl.exe
  C:\Windows\System32\NYgOpRl.exe
  2⤵
  PID:9376
- C:\Windows\System32\wsswxdj.exe
  C:\Windows\System32\wsswxdj.exe
  2⤵
  PID:9400
- C:\Windows\System32\kuZlCIF.exe
  C:\Windows\System32\kuZlCIF.exe
  2⤵
  PID:9432
- C:\Windows\System32\hbQVANu.exe
  C:\Windows\System32\hbQVANu.exe
  2⤵
  PID:9448
- C:\Windows\System32\xVqqEnn.exe
  C:\Windows\System32\xVqqEnn.exe
  2⤵
  PID:9480
- C:\Windows\System32\fiXRwWl.exe
  C:\Windows\System32\fiXRwWl.exe
  2⤵
  PID:9504
- C:\Windows\System32\YlIuoBg.exe
  C:\Windows\System32\YlIuoBg.exe
  2⤵
  PID:9528
- C:\Windows\System32\zoVmfVJ.exe
  C:\Windows\System32\zoVmfVJ.exe
  2⤵
  PID:9568
- C:\Windows\System32\VGRUKCs.exe
  C:\Windows\System32\VGRUKCs.exe
  2⤵
  PID:9604
- C:\Windows\System32\HEOaRWN.exe
  C:\Windows\System32\HEOaRWN.exe
  2⤵
  PID:9632
- C:\Windows\System32\RokIVpF.exe
  C:\Windows\System32\RokIVpF.exe
  2⤵
  PID:9668
- C:\Windows\System32\ppaqSXr.exe
  C:\Windows\System32\ppaqSXr.exe
  2⤵
  PID:9696
- C:\Windows\System32\lfSBCFe.exe
  C:\Windows\System32\lfSBCFe.exe
  2⤵
  PID:9724
- C:\Windows\System32\hYeBKHm.exe
  C:\Windows\System32\hYeBKHm.exe
  2⤵
  PID:9752
- C:\Windows\System32\ueRlopl.exe
  C:\Windows\System32\ueRlopl.exe
  2⤵
  PID:9792
- C:\Windows\System32\TlSADWl.exe
  C:\Windows\System32\TlSADWl.exe
  2⤵
  PID:9820
- C:\Windows\System32\zpRVcgu.exe
  C:\Windows\System32\zpRVcgu.exe
  2⤵
  PID:9836
- C:\Windows\System32\eHiANHW.exe
  C:\Windows\System32\eHiANHW.exe
  2⤵
  PID:9852
- C:\Windows\System32\rgmYSCo.exe
  C:\Windows\System32\rgmYSCo.exe
  2⤵
  PID:9868
- C:\Windows\System32\TfsUdju.exe
  C:\Windows\System32\TfsUdju.exe
  2⤵
  PID:9908
- C:\Windows\System32\IOGCDHN.exe
  C:\Windows\System32\IOGCDHN.exe
  2⤵
  PID:9944
- C:\Windows\System32\xCIfBbd.exe
  C:\Windows\System32\xCIfBbd.exe
  2⤵
  PID:9964
- C:\Windows\System32\fvMpCQD.exe
  C:\Windows\System32\fvMpCQD.exe
  2⤵
  PID:9984
- C:\Windows\System32\rKzLdeJ.exe
  C:\Windows\System32\rKzLdeJ.exe
  2⤵
  PID:10004
- C:\Windows\System32\caQdLff.exe
  C:\Windows\System32\caQdLff.exe
  2⤵
  PID:10036
- C:\Windows\System32\ZrpCwfa.exe
  C:\Windows\System32\ZrpCwfa.exe
  2⤵
  PID:10088
- C:\Windows\System32\tnNgDsc.exe
  C:\Windows\System32\tnNgDsc.exe
  2⤵
  PID:10116
- C:\Windows\System32\Ktzfxwj.exe
  C:\Windows\System32\Ktzfxwj.exe
  2⤵
  PID:10132
- C:\Windows\System32\rlVqUNy.exe
  C:\Windows\System32\rlVqUNy.exe
  2⤵
  PID:10152
- C:\Windows\System32\fLeFOuP.exe
  C:\Windows\System32\fLeFOuP.exe
  2⤵
  PID:10168
- C:\Windows\System32\oXGpCwR.exe
  C:\Windows\System32\oXGpCwR.exe
  2⤵
  PID:10192
- C:\Windows\System32\eKcSpma.exe
  C:\Windows\System32\eKcSpma.exe
  2⤵
  PID:10212
- C:\Windows\System32\YyJntHc.exe
  C:\Windows\System32\YyJntHc.exe
  2⤵
  PID:9236
- C:\Windows\System32\BjSjunz.exe
  C:\Windows\System32\BjSjunz.exe
  2⤵
  PID:9288
- C:\Windows\System32\ImYrySH.exe
  C:\Windows\System32\ImYrySH.exe
  2⤵
  PID:9308
- C:\Windows\System32\uOXqyYm.exe
  C:\Windows\System32\uOXqyYm.exe
  2⤵
  PID:9512
- C:\Windows\System32\xzSwobm.exe
  C:\Windows\System32\xzSwobm.exe
  2⤵
  PID:9524
- C:\Windows\System32\mJmSIXl.exe
  C:\Windows\System32\mJmSIXl.exe
  2⤵
  PID:9596
- C:\Windows\System32\bcrRliF.exe
  C:\Windows\System32\bcrRliF.exe
  2⤵
  PID:9640
- C:\Windows\System32\OzxuFLs.exe
  C:\Windows\System32\OzxuFLs.exe
  2⤵
  PID:9800
- C:\Windows\System32\bLVuNYB.exe
  C:\Windows\System32\bLVuNYB.exe
  2⤵
  PID:9864
- C:\Windows\System32\HClnFbA.exe
  C:\Windows\System32\HClnFbA.exe
  2⤵
  PID:9876
- C:\Windows\System32\aBLenvE.exe
  C:\Windows\System32\aBLenvE.exe
  2⤵
  PID:9932
- C:\Windows\System32\vTbtHLo.exe
  C:\Windows\System32\vTbtHLo.exe
  2⤵
  PID:10028
- C:\Windows\System32\bVKckhW.exe
  C:\Windows\System32\bVKckhW.exe
  2⤵
  PID:10064
- C:\Windows\System32\COitLFS.exe
  C:\Windows\System32\COitLFS.exe
  2⤵
  PID:10072
- C:\Windows\System32\HUSHRCa.exe
  C:\Windows\System32\HUSHRCa.exe
  2⤵
  PID:10164
- C:\Windows\System32\wegqDay.exe
  C:\Windows\System32\wegqDay.exe
  2⤵
  PID:8676
- C:\Windows\System32\UidUlIa.exe
  C:\Windows\System32\UidUlIa.exe
  2⤵
  PID:9392
- C:\Windows\System32\vOorKZA.exe
  C:\Windows\System32\vOorKZA.exe
  2⤵
  PID:9660
- C:\Windows\System32\SmnYVRS.exe
  C:\Windows\System32\SmnYVRS.exe
  2⤵
  PID:9848
- C:\Windows\System32\paBgohu.exe
  C:\Windows\System32\paBgohu.exe
  2⤵
  PID:9980
- C:\Windows\System32\InWwrFa.exe
  C:\Windows\System32\InWwrFa.exe
  2⤵
  PID:10140
- C:\Windows\System32\AOymaVJ.exe
  C:\Windows\System32\AOymaVJ.exe
  2⤵
  PID:10184
- C:\Windows\System32\PoGhUno.exe
  C:\Windows\System32\PoGhUno.exe
  2⤵
  PID:9560
- C:\Windows\System32\GsMfUOf.exe
  C:\Windows\System32\GsMfUOf.exe
  2⤵
  PID:10108
- C:\Windows\System32\Fnyavcc.exe
  C:\Windows\System32\Fnyavcc.exe
  2⤵
  PID:9440
- C:\Windows\System32\zuytrAK.exe
  C:\Windows\System32\zuytrAK.exe
  2⤵
  PID:10252
- C:\Windows\System32\TQIMUtV.exe
  C:\Windows\System32\TQIMUtV.exe
  2⤵
  PID:10280
- C:\Windows\System32\qifAMCh.exe
  C:\Windows\System32\qifAMCh.exe
  2⤵
  PID:10308
- C:\Windows\System32\ptagwRA.exe
  C:\Windows\System32\ptagwRA.exe
  2⤵
  PID:10332
- C:\Windows\System32\pKBNkwM.exe
  C:\Windows\System32\pKBNkwM.exe
  2⤵
  PID:10352
- C:\Windows\System32\FgQBkUe.exe
  C:\Windows\System32\FgQBkUe.exe
  2⤵
  PID:10380
- C:\Windows\System32\SDtORVQ.exe
  C:\Windows\System32\SDtORVQ.exe
  2⤵
  PID:10408
- C:\Windows\System32\EnNQtFm.exe
  C:\Windows\System32\EnNQtFm.exe
  2⤵
  PID:10428
- C:\Windows\System32\GvcZxRQ.exe
  C:\Windows\System32\GvcZxRQ.exe
  2⤵
  PID:10456
- C:\Windows\System32\RnqEugs.exe
  C:\Windows\System32\RnqEugs.exe
  2⤵
  PID:10484
- C:\Windows\System32\HDcAtbt.exe
  C:\Windows\System32\HDcAtbt.exe
  2⤵
  PID:10504
- C:\Windows\System32\KMHOPDD.exe
  C:\Windows\System32\KMHOPDD.exe
  2⤵
  PID:10520
- C:\Windows\System32\ycDvPLX.exe
  C:\Windows\System32\ycDvPLX.exe
  2⤵
  PID:10552
- C:\Windows\System32\rLCZohx.exe
  C:\Windows\System32\rLCZohx.exe
  2⤵
  PID:10572
- C:\Windows\System32\NSthTvr.exe
  C:\Windows\System32\NSthTvr.exe
  2⤵
  PID:10592
- C:\Windows\System32\hoCmewP.exe
  C:\Windows\System32\hoCmewP.exe
  2⤵
  PID:10612
- C:\Windows\System32\ZTyqsRg.exe
  C:\Windows\System32\ZTyqsRg.exe
  2⤵
  PID:10632
- C:\Windows\System32\vVBqHLm.exe
  C:\Windows\System32\vVBqHLm.exe
  2⤵
  PID:10680
- C:\Windows\System32\nnBzMCT.exe
  C:\Windows\System32\nnBzMCT.exe
  2⤵
  PID:10748
- C:\Windows\System32\YnDdvbw.exe
  C:\Windows\System32\YnDdvbw.exe
  2⤵
  PID:10772
- C:\Windows\System32\bmVlowU.exe
  C:\Windows\System32\bmVlowU.exe
  2⤵
  PID:10808
- C:\Windows\System32\kDOVTca.exe
  C:\Windows\System32\kDOVTca.exe
  2⤵
  PID:10832
- C:\Windows\System32\bKPOrUm.exe
  C:\Windows\System32\bKPOrUm.exe
  2⤵
  PID:10852
- C:\Windows\System32\rIeeCPR.exe
  C:\Windows\System32\rIeeCPR.exe
  2⤵
  PID:10872
- C:\Windows\System32\TpXRbMN.exe
  C:\Windows\System32\TpXRbMN.exe
  2⤵
  PID:10908
- C:\Windows\System32\HtZVOQZ.exe
  C:\Windows\System32\HtZVOQZ.exe
  2⤵
  PID:10948
- C:\Windows\System32\gEiGBVO.exe
  C:\Windows\System32\gEiGBVO.exe
  2⤵
  PID:10968
- C:\Windows\System32\IgtYNuT.exe
  C:\Windows\System32\IgtYNuT.exe
  2⤵
  PID:10996
- C:\Windows\System32\TxwNUIW.exe
  C:\Windows\System32\TxwNUIW.exe
  2⤵
  PID:11032
- C:\Windows\System32\KmNoKpL.exe
  C:\Windows\System32\KmNoKpL.exe
  2⤵
  PID:11052
- C:\Windows\System32\YLJopXi.exe
  C:\Windows\System32\YLJopXi.exe
  2⤵
  PID:11080
- C:\Windows\System32\yBrObpw.exe
  C:\Windows\System32\yBrObpw.exe
  2⤵
  PID:11104
- C:\Windows\System32\RNPLmsp.exe
  C:\Windows\System32\RNPLmsp.exe
  2⤵
  PID:11140
- C:\Windows\System32\uaDOjrq.exe
  C:\Windows\System32\uaDOjrq.exe
  2⤵
  PID:11184
- C:\Windows\System32\iWbXNNk.exe
  C:\Windows\System32\iWbXNNk.exe
  2⤵
  PID:11204
- C:\Windows\System32\tqCJqmz.exe
  C:\Windows\System32\tqCJqmz.exe
  2⤵
  PID:11220
- C:\Windows\System32\lMUWtBd.exe
  C:\Windows\System32\lMUWtBd.exe
  2⤵
  PID:11236
- C:\Windows\System32\xYjXgCd.exe
  C:\Windows\System32\xYjXgCd.exe
  2⤵
  PID:9828
- C:\Windows\System32\siKFaYU.exe
  C:\Windows\System32\siKFaYU.exe
  2⤵
  PID:9712
- C:\Windows\System32\YPdfnSp.exe
  C:\Windows\System32\YPdfnSp.exe
  2⤵
  PID:10404
- C:\Windows\System32\FhOOJLt.exe
  C:\Windows\System32\FhOOJLt.exe
  2⤵
  PID:10492
- C:\Windows\System32\hFgEfsh.exe
  C:\Windows\System32\hFgEfsh.exe
  2⤵
  PID:10536
- C:\Windows\System32\HeNtwrq.exe
  C:\Windows\System32\HeNtwrq.exe
  2⤵
  PID:10548
- C:\Windows\System32\pPmloRi.exe
  C:\Windows\System32\pPmloRi.exe
  2⤵
  PID:10608
- C:\Windows\System32\yYiGmWP.exe
  C:\Windows\System32\yYiGmWP.exe
  2⤵
  PID:10676
- C:\Windows\System32\EYMaXZe.exe
  C:\Windows\System32\EYMaXZe.exe
  2⤵
  PID:10788
- C:\Windows\System32\UVPqOfG.exe
  C:\Windows\System32\UVPqOfG.exe
  2⤵
  PID:10840
- C:\Windows\System32\tZkAKLr.exe
  C:\Windows\System32\tZkAKLr.exe
  2⤵
  PID:10944
- C:\Windows\System32\ImrUVwH.exe
  C:\Windows\System32\ImrUVwH.exe
  2⤵
  PID:10992
- C:\Windows\System32\LAtnABO.exe
  C:\Windows\System32\LAtnABO.exe
  2⤵
  PID:11044
- C:\Windows\System32\hTGgHZo.exe
  C:\Windows\System32\hTGgHZo.exe
  2⤵
  PID:11096
- C:\Windows\System32\gobosyR.exe
  C:\Windows\System32\gobosyR.exe
  2⤵
  PID:11196
- C:\Windows\System32\fkalVrS.exe
  C:\Windows\System32\fkalVrS.exe
  2⤵
  PID:11248
- C:\Windows\System32\xYkPUeu.exe
  C:\Windows\System32\xYkPUeu.exe
  2⤵
  PID:10364
- C:\Windows\System32\emYLFPs.exe
  C:\Windows\System32\emYLFPs.exe
  2⤵
  PID:10532
- C:\Windows\System32\lONatht.exe
  C:\Windows\System32\lONatht.exe
  2⤵
  PID:10580
- C:\Windows\System32\WnlorJs.exe
  C:\Windows\System32\WnlorJs.exe
  2⤵
  PID:10740
- C:\Windows\System32\OLhmtsf.exe
  C:\Windows\System32\OLhmtsf.exe
  2⤵
  PID:10960
- C:\Windows\System32\JGsqZjQ.exe
  C:\Windows\System32\JGsqZjQ.exe
  2⤵
  PID:11016
- C:\Windows\System32\LScWONc.exe
  C:\Windows\System32\LScWONc.exe
  2⤵
  PID:11192
- C:\Windows\System32\Tjpmjdy.exe
  C:\Windows\System32\Tjpmjdy.exe
  2⤵
  PID:10420
- C:\Windows\System32\LBRXWWY.exe
  C:\Windows\System32\LBRXWWY.exe
  2⤵
  PID:10656
- C:\Windows\System32\nNQRwUv.exe
  C:\Windows\System32\nNQRwUv.exe
  2⤵
  PID:10444
- C:\Windows\System32\WpabTqk.exe
  C:\Windows\System32\WpabTqk.exe
  2⤵
  PID:11068
- C:\Windows\System32\LVjzGnD.exe
  C:\Windows\System32\LVjzGnD.exe
  2⤵
  PID:11276
- C:\Windows\System32\mpmpMcs.exe
  C:\Windows\System32\mpmpMcs.exe
  2⤵
  PID:11304
- C:\Windows\System32\ahaWqyS.exe
  C:\Windows\System32\ahaWqyS.exe
  2⤵
  PID:11320
- C:\Windows\System32\mgGSktD.exe
  C:\Windows\System32\mgGSktD.exe
  2⤵
  PID:11372
- C:\Windows\System32\yLEKrLk.exe
  C:\Windows\System32\yLEKrLk.exe
  2⤵
  PID:11416
- C:\Windows\System32\ZJfECjU.exe
  C:\Windows\System32\ZJfECjU.exe
  2⤵
  PID:11432
- C:\Windows\System32\TCbMZjg.exe
  C:\Windows\System32\TCbMZjg.exe
  2⤵
  PID:11468
- C:\Windows\System32\INkGJfs.exe
  C:\Windows\System32\INkGJfs.exe
  2⤵
  PID:11492
- C:\Windows\System32\NAAXqZb.exe
  C:\Windows\System32\NAAXqZb.exe
  2⤵
  PID:11536
- C:\Windows\System32\lOtOsvu.exe
  C:\Windows\System32\lOtOsvu.exe
  2⤵
  PID:11568
- C:\Windows\System32\fjLinTc.exe
  C:\Windows\System32\fjLinTc.exe
  2⤵
  PID:11588
- C:\Windows\System32\qkaQbzK.exe
  C:\Windows\System32\qkaQbzK.exe
  2⤵
  PID:11604
- C:\Windows\System32\vFGpfRe.exe
  C:\Windows\System32\vFGpfRe.exe
  2⤵
  PID:11620
- C:\Windows\System32\ZTKBQTf.exe
  C:\Windows\System32\ZTKBQTf.exe
  2⤵
  PID:11692
- C:\Windows\System32\bAxSNlc.exe
  C:\Windows\System32\bAxSNlc.exe
  2⤵
  PID:11712
- C:\Windows\System32\WdSoTgn.exe
  C:\Windows\System32\WdSoTgn.exe
  2⤵
  PID:11752
- C:\Windows\System32\SLyPkoe.exe
  C:\Windows\System32\SLyPkoe.exe
  2⤵
  PID:11772
- C:\Windows\System32\ianhfER.exe
  C:\Windows\System32\ianhfER.exe
  2⤵
  PID:11792
- C:\Windows\System32\GMTtJur.exe
  C:\Windows\System32\GMTtJur.exe
  2⤵
  PID:11816
- C:\Windows\System32\aVRcdno.exe
  C:\Windows\System32\aVRcdno.exe
  2⤵
  PID:11832
- C:\Windows\System32\Souxiab.exe
  C:\Windows\System32\Souxiab.exe
  2⤵
  PID:11872
- C:\Windows\System32\sbwZGMF.exe
  C:\Windows\System32\sbwZGMF.exe
  2⤵
  PID:11892
- C:\Windows\System32\gtkmAUF.exe
  C:\Windows\System32\gtkmAUF.exe
  2⤵
  PID:11928
- C:\Windows\System32\CCOqXPv.exe
  C:\Windows\System32\CCOqXPv.exe
  2⤵
  PID:11956
- C:\Windows\System32\XMhQLgO.exe
  C:\Windows\System32\XMhQLgO.exe
  2⤵
  PID:11976
- C:\Windows\System32\HfqkPBl.exe
  C:\Windows\System32\HfqkPBl.exe
  2⤵
  PID:12012
- C:\Windows\System32\GYTACAA.exe
  C:\Windows\System32\GYTACAA.exe
  2⤵
  PID:12048
- C:\Windows\System32\nPaPgYt.exe
  C:\Windows\System32\nPaPgYt.exe
  2⤵
  PID:12076
- C:\Windows\System32\wEdrvHz.exe
  C:\Windows\System32\wEdrvHz.exe
  2⤵
  PID:12092
- C:\Windows\System32\aZowhbb.exe
  C:\Windows\System32\aZowhbb.exe
  2⤵
  PID:12124
- C:\Windows\System32\Uegyuey.exe
  C:\Windows\System32\Uegyuey.exe
  2⤵
  PID:12164
- C:\Windows\System32\SjsXOTW.exe
  C:\Windows\System32\SjsXOTW.exe
  2⤵
  PID:12184
- C:\Windows\System32\BpOqGYV.exe
  C:\Windows\System32\BpOqGYV.exe
  2⤵
  PID:12200
- C:\Windows\System32\quWyyYb.exe
  C:\Windows\System32\quWyyYb.exe
  2⤵
  PID:12232
- C:\Windows\System32\WTNiPwp.exe
  C:\Windows\System32\WTNiPwp.exe
  2⤵
  PID:12264
- C:\Windows\System32\DwHudRH.exe
  C:\Windows\System32\DwHudRH.exe
  2⤵
  PID:11288
- C:\Windows\System32\JFVrrcY.exe
  C:\Windows\System32\JFVrrcY.exe
  2⤵
  PID:11380
- C:\Windows\System32\jxIuSFZ.exe
  C:\Windows\System32\jxIuSFZ.exe
  2⤵
  PID:11480
- C:\Windows\System32\ibYSCWl.exe
  C:\Windows\System32\ibYSCWl.exe
  2⤵
  PID:11524
- C:\Windows\System32\tXAfEOL.exe
  C:\Windows\System32\tXAfEOL.exe
  2⤵
  PID:11564
- C:\Windows\System32\xYzoVei.exe
  C:\Windows\System32\xYzoVei.exe
  2⤵
  PID:11600
- C:\Windows\System32\BAwqCge.exe
  C:\Windows\System32\BAwqCge.exe
  2⤵
  PID:11700
- C:\Windows\System32\StZUZXE.exe
  C:\Windows\System32\StZUZXE.exe
  2⤵
  PID:11740
- C:\Windows\System32\xcyIQbP.exe
  C:\Windows\System32\xcyIQbP.exe
  2⤵
  PID:10320
- C:\Windows\System32\HSACmTC.exe
  C:\Windows\System32\HSACmTC.exe
  2⤵
  PID:11888
- C:\Windows\System32\uWogpuc.exe
  C:\Windows\System32\uWogpuc.exe
  2⤵
  PID:11920
- C:\Windows\System32\dojdJui.exe
  C:\Windows\System32\dojdJui.exe
  2⤵
  PID:11968
- C:\Windows\System32\FRgGaHF.exe
  C:\Windows\System32\FRgGaHF.exe
  2⤵
  PID:12112
- C:\Windows\System32\tnCbCcQ.exe
  C:\Windows\System32\tnCbCcQ.exe
  2⤵
  PID:12180
- C:\Windows\System32\bAPBOGm.exe
  C:\Windows\System32\bAPBOGm.exe
  2⤵
  PID:12244
- C:\Windows\System32\SCfYOkM.exe
  C:\Windows\System32\SCfYOkM.exe
  2⤵
  PID:12284
- C:\Windows\System32\AxCpOCL.exe
  C:\Windows\System32\AxCpOCL.exe
  2⤵
  PID:11424
- C:\Windows\System32\BpsBSan.exe
  C:\Windows\System32\BpsBSan.exe
  2⤵
  PID:11336
- C:\Windows\System32\cDEfTyr.exe
  C:\Windows\System32\cDEfTyr.exe
  2⤵
  PID:11720
- C:\Windows\System32\QnuSNTJ.exe
  C:\Windows\System32\QnuSNTJ.exe
  2⤵
  PID:11804
- C:\Windows\System32\cqZJczA.exe
  C:\Windows\System32\cqZJczA.exe
  2⤵
  PID:11852
- C:\Windows\System32\wYDCmRj.exe
  C:\Windows\System32\wYDCmRj.exe
  2⤵
  PID:11952
- C:\Windows\System32\ByEavqO.exe
  C:\Windows\System32\ByEavqO.exe
  2⤵
  PID:12248
- C:\Windows\System32\KqeAVOE.exe
  C:\Windows\System32\KqeAVOE.exe
  2⤵
  PID:11632
- C:\Windows\System32\OlaXmpV.exe
  C:\Windows\System32\OlaXmpV.exe
  2⤵
  PID:640
- C:\Windows\System32\pHqSISA.exe
  C:\Windows\System32\pHqSISA.exe
  2⤵
  PID:11924
- C:\Windows\System32\clkEPzl.exe
  C:\Windows\System32\clkEPzl.exe
  2⤵
  PID:12272
- C:\Windows\System32\TAKceJi.exe
  C:\Windows\System32\TAKceJi.exe
  2⤵
  PID:3108
- C:\Windows\System32\MGYoatQ.exe
  C:\Windows\System32\MGYoatQ.exe
  2⤵
  PID:10928
- C:\Windows\System32\PhYQWNL.exe
  C:\Windows\System32\PhYQWNL.exe
  2⤵
  PID:12316
- C:\Windows\System32\QwxcpBS.exe
  C:\Windows\System32\QwxcpBS.exe
  2⤵
  PID:12332
- C:\Windows\System32\MYIPeXA.exe
  C:\Windows\System32\MYIPeXA.exe
  2⤵
  PID:12356
- C:\Windows\System32\eYUumAF.exe
  C:\Windows\System32\eYUumAF.exe
  2⤵
  PID:12388
- C:\Windows\System32\NiyLlHW.exe
  C:\Windows\System32\NiyLlHW.exe
  2⤵
  PID:12424
- C:\Windows\System32\XFlPnOL.exe
  C:\Windows\System32\XFlPnOL.exe
  2⤵
  PID:12452
- C:\Windows\System32\XpKPwkn.exe
  C:\Windows\System32\XpKPwkn.exe
  2⤵
  PID:12500
- C:\Windows\System32\DHOFgqO.exe
  C:\Windows\System32\DHOFgqO.exe
  2⤵
  PID:12516
- C:\Windows\System32\rRNkVnJ.exe
  C:\Windows\System32\rRNkVnJ.exe
  2⤵
  PID:12544
- C:\Windows\System32\VqnFEty.exe
  C:\Windows\System32\VqnFEty.exe
  2⤵
  PID:12560
- C:\Windows\System32\dNRVonz.exe
  C:\Windows\System32\dNRVonz.exe
  2⤵
  PID:12596
- C:\Windows\System32\OpERBrv.exe
  C:\Windows\System32\OpERBrv.exe
  2⤵
  PID:12624
- C:\Windows\System32\akIblRl.exe
  C:\Windows\System32\akIblRl.exe
  2⤵
  PID:12656
- C:\Windows\System32\XHNVziZ.exe
  C:\Windows\System32\XHNVziZ.exe
  2⤵
  PID:12672
- C:\Windows\System32\oFDKBCX.exe
  C:\Windows\System32\oFDKBCX.exe
  2⤵
  PID:12700
- C:\Windows\System32\ltgXbtw.exe
  C:\Windows\System32\ltgXbtw.exe
  2⤵
  PID:12716
- C:\Windows\System32\bxXzmxn.exe
  C:\Windows\System32\bxXzmxn.exe
  2⤵
  PID:12740
- C:\Windows\System32\rxNTJxq.exe
  C:\Windows\System32\rxNTJxq.exe
  2⤵
  PID:12756
- C:\Windows\System32\XwYuBgw.exe
  C:\Windows\System32\XwYuBgw.exe
  2⤵
  PID:12780
- C:\Windows\System32\gDYIxHU.exe
  C:\Windows\System32\gDYIxHU.exe
  2⤵
  PID:12804
- C:\Windows\System32\PwSRnWG.exe
  C:\Windows\System32\PwSRnWG.exe
  2⤵
  PID:12828
- C:\Windows\System32\mmyNcpY.exe
  C:\Windows\System32\mmyNcpY.exe
  2⤵
  PID:12924
- C:\Windows\System32\MRiMyMo.exe
  C:\Windows\System32\MRiMyMo.exe
  2⤵
  PID:12940
- C:\Windows\System32\dvxucob.exe
  C:\Windows\System32\dvxucob.exe
  2⤵
  PID:12972
- C:\Windows\System32\HfjZALK.exe
  C:\Windows\System32\HfjZALK.exe
  2⤵
  PID:13000
- C:\Windows\System32\OGHlKJc.exe
  C:\Windows\System32\OGHlKJc.exe
  2⤵
  PID:13024
- C:\Windows\System32\GsuWVMx.exe
  C:\Windows\System32\GsuWVMx.exe
  2⤵
  PID:13040
- C:\Windows\System32\tcXlNpo.exe
  C:\Windows\System32\tcXlNpo.exe
  2⤵
  PID:13072
- C:\Windows\System32\yyqqhDG.exe
  C:\Windows\System32\yyqqhDG.exe
  2⤵
  PID:13096
- C:\Windows\System32\NflEIag.exe
  C:\Windows\System32\NflEIag.exe
  2⤵
  PID:13128
- C:\Windows\System32\wRUnhsk.exe
  C:\Windows\System32\wRUnhsk.exe
  2⤵
  PID:13156
- C:\Windows\System32\XAbdBDN.exe
  C:\Windows\System32\XAbdBDN.exe
  2⤵
  PID:13172
- C:\Windows\System32\xBZsLsJ.exe
  C:\Windows\System32\xBZsLsJ.exe
  2⤵
  PID:13216
- C:\Windows\System32\eLBhdiW.exe
  C:\Windows\System32\eLBhdiW.exe
  2⤵
  PID:13252
- C:\Windows\System32\lLzWykD.exe
  C:\Windows\System32\lLzWykD.exe
  2⤵
  PID:13280
- C:\Windows\System32\JCJFFLy.exe
  C:\Windows\System32\JCJFFLy.exe
  2⤵
  PID:13296
- C:\Windows\System32\SElsulY.exe
  C:\Windows\System32\SElsulY.exe
  2⤵
  PID:12324
- C:\Windows\System32\rZPVviq.exe
  C:\Windows\System32\rZPVviq.exe
  2⤵
  PID:12380
- C:\Windows\System32\QNrZDuh.exe
  C:\Windows\System32\QNrZDuh.exe
  2⤵
  PID:12464
- C:\Windows\System32\NqZwVTi.exe
  C:\Windows\System32\NqZwVTi.exe
  2⤵
  PID:12556
- C:\Windows\System32\xMIAbkh.exe
  C:\Windows\System32\xMIAbkh.exe
  2⤵
  PID:12612
- C:\Windows\System32\pEmrOcx.exe
  C:\Windows\System32\pEmrOcx.exe
  2⤵
  PID:12708
- C:\Windows\System32\ProbqcO.exe
  C:\Windows\System32\ProbqcO.exe
  2⤵
  PID:12692
- C:\Windows\System32\cprNPLo.exe
  C:\Windows\System32\cprNPLo.exe
  2⤵
  PID:12800
- C:\Windows\System32\rQtzbtt.exe
  C:\Windows\System32\rQtzbtt.exe
  2⤵
  PID:12892
- C:\Windows\System32\SbeCWrq.exe
  C:\Windows\System32\SbeCWrq.exe
  2⤵
  PID:12888
- C:\Windows\System32\SJGBhQR.exe
  C:\Windows\System32\SJGBhQR.exe
  2⤵
  PID:12964
- C:\Windows\System32\CxEJKsE.exe
  C:\Windows\System32\CxEJKsE.exe
  2⤵
  PID:13016
- C:\Windows\System32\yRGwdXk.exe
  C:\Windows\System32\yRGwdXk.exe
  2⤵
  PID:13080
- C:\Windows\System32\ndNaSFB.exe
  C:\Windows\System32\ndNaSFB.exe
  2⤵
  PID:13164
- C:\Windows\System32\sHvgYEx.exe
  C:\Windows\System32\sHvgYEx.exe
  2⤵
  PID:13240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\ByKcbAL.exe

Filesize
989KB

MD5
ddce59b63bcf44b713bd4529e8249d1b

SHA1
e552837ec61e9cc61d348319b991d926071aff78

SHA256
1f2d7792271e998e57637052f2b69e224018dd752b80ca5a6b8632892cb24c66

SHA512
a052271041a8bac13c2f83003fec747d8d516ac23aa3e38d9def526cbf27376f3ae9c2ee9db2b543510032d7180a1a6d7624db885055837d7c57a2d9668a62df

Download Submit
C:\Windows\System32\FHovvFT.exe

Filesize
987KB

MD5
7d4354c580026528081d0795c5c29f76

SHA1
6db9321b2bc6bfe29035cc678a49361f0a29a306

SHA256
e02306c2a02641889895506dc6410afaf7d0c0863957ac52e35616a6739c140f

SHA512
03ee28c7c90d8cabffeb3244e9e5772d41de460860956fadee447057ee3b332672eb8e8ff6d853ab77bc1ac771d527934cdf3fc7617610165abc79ceaf2df2a6

Download Submit
C:\Windows\System32\GMHWqqL.exe

Filesize
989KB

MD5
fdc5f5e0e082a22b728f84249069918a

SHA1
e0472094029fa51b077acd3580c86be960f41135

SHA256
cd3a2ebbd2acd66ba507cd8b577cd9c6ce1e8f1f1636ee9ba80981163f908827

SHA512
c26ac63cd8f59e89d63516ca083a4c79e02cfe247bb994bf5c4db5f1b52ee5fd31cf0e011aac7c535210444ad62e541d66cb51f1f09844e25ff0bae326710731

Download Submit
C:\Windows\System32\HfWKjui.exe

Filesize
989KB

MD5
5ec0657c01592adfc623ee8ace2cba46

SHA1
f2901a4b1fb6232568df1ef98243bec12fce8c53

SHA256
d422c88517b6715f6effd2af0f36cb4ae3b5a702ace1520bd4bc57816645b8da

SHA512
dc20de8e8ac804d607e4c996136699a64ed15fec7a9228f5d4ac1aaf183b564334f8939b36abb961b1b5781186f3fe87a7840566e4667fef938fc2ca2f5838a3

Download Submit
C:\Windows\System32\KATNZGp.exe

Filesize
984KB

MD5
9814d5fae68a8cda59f5365ba0336707

SHA1
1d382d52af3a5eaca738e4d08e2a7598c0ab8e6d

SHA256
147d4e0b5cb36c386c286a217bc7cd3c2061f94a45a99364ffde360f58e156f7

SHA512
3498e74217b43895e2482fc150c11aae829f523501d957e675fa3046d6ddf68d78f7ca60d66db4748a0372413f792acc56d50ca3689e0e0a3c6c793528087ac3

Download Submit
C:\Windows\System32\MTyqStY.exe

Filesize
990KB

MD5
a07c71e8c5d9618331c82a693a23eff4

SHA1
4350e27e2bfccf0b9211e43cd1accd35e99c00cb

SHA256
2a8f61890068a5a1d4b23e48444ad18fe2db5a5bc5336620313c2b03e8a409b2

SHA512
b2075a76e3b22651bccb19c5f594c94ebf5519e5af076f30a2d307864847fe70851c429351236e6f51aee203a7b26469b6fe2f26ef1ed1dbabc88bf629e2a708

Download Submit
C:\Windows\System32\MzheBSv.exe

Filesize
983KB

MD5
fc8e2b1839b8f15967162b704a7cd5a5

SHA1
dd9d5c820944cc0e82f7cff1974fd63e4fc24874

SHA256
59c835496eb9f2a264a44cf930a1b4aa57dab9ad7811c01c4e9c8a6570321d25

SHA512
169a1ca846db02488bfffa1f37f65c5382584200f9e6e250798d28215c09f994c130dbd2df4775092e1148821d8fbed9317c4d8bf6c024357a1acb878d9181f1

Download Submit
C:\Windows\System32\NEIkdFw.exe

Filesize
987KB

MD5
9a9054103337e5cb01c805661e3a3f2a

SHA1
91973b672fb095123203e0c28f5b58fa6503898f

SHA256
8e20d742c26f9683ae3cae37a1b8cfc7309bfb726cd33e1ec97ab814543bfb47

SHA512
0083efb910e5868492e25a3a82e8e2a2fb9f9d1585707a38628da2519836e9a105b3c118c0b8069c31c340fd907117020c249f70195f323906ff405f565afd19

Download Submit
C:\Windows\System32\NcIVFmD.exe

Filesize
984KB

MD5
125820010cbc12b7b4c74adf6aa2e9d2

SHA1
fcf3e8a03d9216f3c42b351ec459a76b67402eac

SHA256
b14d394bfd44cfa98ad777f5886357eb5da8d64035a339d5cf52d1f695f67c69

SHA512
dc8dc8c4743e0bb9bc679ebbbcb0ffb2808eab7a3eda147134e025cbdc34aa46b8d07307eef26afd4f0fdff39b288f5c6b1c3d44b5f52ef737d121dc93ac5a64

Download Submit
C:\Windows\System32\OfdZDSI.exe

Filesize
990KB

MD5
119798dce29feb7ab5144a7cb0fa96b4

SHA1
515fc086f65c1faeacfb4a598ea187e42d5d7b68

SHA256
56dd635462648f173cc2cdee8cf61da9dcb4db221fbe3b2b74d328cdaf89011d

SHA512
f34b33dd2eb9219edc2831d9bb869bea81d0d6ce17b8f8d4633dcef50755daeab08e5a7e85b9f440d2645171dfda6d015acee743f16d07596d7362b118e4bbfb

Download Submit
C:\Windows\System32\RFrFBZb.exe

Filesize
988KB

MD5
ebcd079131c619091d0f5a23c89868e2

SHA1
f3ac8b6cc316f7fac86489f0abe38af10f3bce51

SHA256
aae1ef9bbbdcb026305e8c5c2778a15a3a4940a12a05793e394d0ca569aa2dcf

SHA512
939f41243ca892c126f798277c08dd7cca7a8cb85911c8b548ab1700f7f02a62080d62a00965b5d203d6a9ac94c517e7600e4ce7fd36968971d496552ceeb63a

Download Submit
C:\Windows\System32\SvUhyXi.exe

Filesize
988KB

MD5
c295522c67b4c51125cc9e31afee85f9

SHA1
5ffd7ba9355ed4f4a2506ec2fce30ed683cb700d

SHA256
f50a329801896995de4b7e8413a34e41c950325b576870f54cd22bf499d48e8a

SHA512
20e87bbd9d5e4f9bde452a1c1cd6af8b57b49b520510ed528ead23d803b9c0ec729965370dad8afa76a8d84cb1a4f7f6fe05adf4474f65c7a154cbcc445faf1d

Download Submit
C:\Windows\System32\VFSveTl.exe

Filesize
988KB

MD5
8cf6b8371a54b54cbf3db77756ec60c6

SHA1
6b45f040c87c892be82b10bb1aad497c05675b1b

SHA256
f53a4a4f0a435895e13b1422727017c1ccd0a7ce3e1432d660792e4a12df92d3

SHA512
889ac7223b7a880a5f5a3c90d7969f1e1365d045cbab60a96a4d70d1abee6b83075d39fa70bd7aaa8ce3fbb1ef3fd4333ad1bc4ec80d90f789fa1f80f8898172

Download Submit
C:\Windows\System32\XaBqypM.exe

Filesize
989KB

MD5
a4849b913950fc5af56d3467bae872bf

SHA1
64a02873e45d00888db64142abcad9cff0d50c27

SHA256
4235339b0dfd33af2d7e250e3975c2bb6e58b5336a9f89fa6d47c44d8ae9c96f

SHA512
d90a3628f5e8ccfea9b8e2474566d875f7f9a1e4232d9e96fc65052eba7591df5b6f1d0658322a1b9c7ea1f852f741501c975e8aaa04590a7ed40cc4f16ca109

Download Submit
C:\Windows\System32\XmgGmin.exe

Filesize
984KB

MD5
20d08f081a9ac9287a133fa9d13c954c

SHA1
81e98c130c4a9cfb9e6bf3fe3ea7919548811d7c

SHA256
994e1c9f40169d77c9f7b801a1a12af47b32ff2f313500e64c2d393985d137c7

SHA512
5d9b39bfa8d228900543dd516a85d915e65b15f9e7ce08bcc24f9b373f27fb9d455c019affdeb32b09f08a546701f370cb2e5555a68e9849f8c42b165c610d65

Download Submit
C:\Windows\System32\YKFIHri.exe

Filesize
986KB

MD5
ef77f0792f19a30b4801356a041d4739

SHA1
f969a4972af39254c9a5c4de62f15a9b72352efa

SHA256
6d7d677ebfb82ac4a4db2bd3b26f70235358725ab23339923bce65bf86ae64b5

SHA512
cefe25c2ba818f45d75e66246979cc60cfdc49941f57e3ff0b1d92d3cedba49b865f10981604707738db2b616d8b02076da61a5fca3e05039d8511f8bcff2383

Download Submit
C:\Windows\System32\YKkLQMi.exe

Filesize
983KB

MD5
5939996c6571e07466aadba1a8eda1ce

SHA1
64332ae7d0a2f530caba18a95a3bef9bf7f9dfbc

SHA256
6cd4f79041d60ab5a301c7f5d6c524ca1396a80eff71aa9e8ae408309e72314d

SHA512
34aded6618a8a8f8b4900b876d3908222576a41f38c4773eab7fd6a92678f62d5e0fe43c0ae3b3c1706874ac93b0d98587da08324f2aff9c7fd7dca8cc1cd035

Download Submit
C:\Windows\System32\YkUEOvX.exe

Filesize
986KB

MD5
02b61f2d94a06ef40bcdffaa3473ce75

SHA1
9942112e7254f3a6b53acd4e71ed9e5721188417

SHA256
25cb0a1b9f4960fa66b5c09ae43dfd61cbf8b68f6525878b7ec722bce5de4efa

SHA512
3675d2574b006331707d32d3a466b4566e7d5c2ba09b503afae5c70e2f92e833137fe0594da0b55067408de5bcf530d522dffa163a94404351d490ba58fc804c

Download Submit
C:\Windows\System32\ZdWAnLc.exe

Filesize
987KB

MD5
b58630566744c5b3b625a2869ea7f3de

SHA1
2c025e85858e4ccd31fa1e736678af464821901f

SHA256
6f5e587ab26e78fed6c3b891a18da0f42d45a43f2b7cadab09cef874312aaf11

SHA512
73a2b7909221da5abff0ca253bcfe3dc3d99248826359b8f88ded72fba36b60f84832c19b1e93eba78ecec7a8a84788fa971f9fd682cfe66a823b4896580d662

Download Submit
C:\Windows\System32\bFwwCtH.exe

Filesize
983KB

MD5
be27fec1be699886a1767a4dab493eb7

SHA1
7bdd8310253aaa90b59ca05b542c729f8d663ad7

SHA256
ba25a891aa2d0b7060a8d1bb65670559c4849698beae39579f754539f8b1613e

SHA512
363410cab4cf3e1131589278765c42b71f584b8b9090c96e09d2cb01e4fa4c09a70b2c25c147819d34c3d13cad2965d8066d403ca2a863adda9c77dd61ceb6be

Download Submit
C:\Windows\System32\cTxzMgt.exe

Filesize
986KB

MD5
24de53262d955ac35289d9daee3a1525

SHA1
1da79cf720f7bcbd555e31a96270ed48cd3345c6

SHA256
4516b250c44b90cc8895199b94d0a9c4d5a811dc2939d42334ab3079a431f4ff

SHA512
f1f8fd746db9c201da771deb1a16ad50884eb66d3a3b29cbae679bc883a9bd4063daf4aa6d654d7899b88de288e0ccee3c5fb35a8f841f85daf25390a362642a

Download Submit
C:\Windows\System32\lfKKyow.exe

Filesize
990KB

MD5
32d9dfe49f9d0c519037dc5881013285

SHA1
f95f2249ff65aa3aa2dfda8de37c289be46a6a66

SHA256
ddf07ebc45e0b3f57b9082677810a2f093ce3c3c5adccfef3fa48e99f145c87e

SHA512
5d50213531e737169b3b3fd7569c5783297c0f7a0fa3d7bd128381c5d701982dd0f783196803026046bfbec206df89c555e439112d712c3f1e0365504de66a07

Download Submit
C:\Windows\System32\nDLoCQJ.exe

Filesize
984KB

MD5
d704237f7ff2d1f047543ed0722f2d5c

SHA1
fd5725a51dad6d3c926791ee85b4128f6167f225

SHA256
1f7b35ce38bb352cf98036bccfa9064c482beb7c9a4f30e4a5f57b666ccdd582

SHA512
5b9930b8af99673003ed1fc331e21e4c0422483fbbb16bd94e90076d8854c70b2f8317a62f89693df6ec2331588eb2e3fd9b5c67d60193610957e9316efc17ac

Download Submit
C:\Windows\System32\nEjxemg.exe

Filesize
985KB

MD5
f5538249fb4d11c02d58179fb337b9e7

SHA1
f893c88840176eff2ae1afa8ab87676d74727058

SHA256
0dc06b2045a0ce6d9b6ac61edeab1c999bc05a84f08abb053458b6f3659065f6

SHA512
20a4751948adcd86147fc9f08cc3a0f4a9038dfd0569ce4f16256089f8c8b8c3f6b31e2eeef2dfff3cfdabc0a14c6dfd81ab44566dfea43de5b843e67aed03e1

Download Submit
C:\Windows\System32\nekjwyR.exe

Filesize
983KB

MD5
5e7ec8f9d4d698b47fa40f9d7aedb2c7

SHA1
79d53d2b19b522fd9760307850c5b69e31b25b6e

SHA256
0d1ff344c96784bf4814146106eb4ac997dae961dd53fa09a1c41a0a178d74b7

SHA512
32282930f9dd2fcdc47747586d888b14e7493cde38e810ac30d3b50d26d4625183229a6c390b97de882a74eafb905623f30661e4157723a339392fc525b5ffa3

Download Submit
C:\Windows\System32\odhxmHi.exe

Filesize
984KB

MD5
44963e52e924bbb30a161526104c5c17

SHA1
5eba657eca19dcad35726f1c07d61896ee89560c

SHA256
2ae12814eecd074f731569fb95999dfd7ccdf89359ed9c26a44e44ac25cd9dc8

SHA512
1cc85c3d6c3df9e263bc94c6ae0c3cba76badd88a1497e25da91291b7494ae3d3aa97f8a0113546e077c642b58105c2a541411c8a6560e298d1e20f0ba7228b5

Download Submit
C:\Windows\System32\pfCvcnF.exe

Filesize
986KB

MD5
0ba66aacb257ca0bc7a53f3fd607a0c6

SHA1
fd67dc085d62ffbfb199b47d01a6c62c29d37d0e

SHA256
5bca1fcd41cca06c6c98fe28f8ebbf266194aa48cb61f905224042235fa553c9

SHA512
31ede02770a50349104d16dd0181b169716a0859b9d50338ab88705d61404f2db56f09f0d29b56bd008115774a6376986aa0b6791078fb65c8ccd9732b3f2322

Download Submit
C:\Windows\System32\qMvlrzt.exe

Filesize
987KB

MD5
7e3b428d6c6a5af3416cfd7ec18bc672

SHA1
56fbdd2d663f747c9c70ed5c3fc5e4dd1b065132

SHA256
7f5b44b1687cc532ab6d2ccfff8ee57544db0bc0408f520f0405f0a96cf02c91

SHA512
15d160cc9925a8a515d849571a26e763f7c007c6f9951466d26406e951eaa475d9b0428b4e2dbad3f21808f442d72b31dac865af9f94732d16300a869fe77ae6

Download Submit
C:\Windows\System32\sorRJHp.exe

Filesize
988KB

MD5
6e605515dd00196904e51a6eedfb6924

SHA1
f2a144e51bb0c48c2c617c14d035d905f3b15d4c

SHA256
2c85c772424a3470b845b6b38cb55ae3b5d26842dfc3632c33771e403cf72e6c

SHA512
84e75adca6a99687a6fcb88b3837e899abf16f9ec302b2c4c28bb60576a7cdd44ea2208a8a44bffdc0d75ca516f3c686d2ece9faf30eca9e2e535b7015244a55

Download Submit
C:\Windows\System32\vXegtnJ.exe

Filesize
985KB

MD5
a8f06711a7833e5c407dea3bde93cc9f

SHA1
02e0f53c7ca67f59cc5d346ba8d69e47de6b0047

SHA256
526d53826e9b0485ef78a052ef76a444d8e0fe1c49a173f6b4222d9b3f88ce1d

SHA512
b01f6c190b2a2349d073db4b596ff443ca6f83f7f94bc7b9d5a8f4afc1e59ec39f14dbe48f2bf7a3db985247ee088d725056fc29dbe4d31bceb6c7b8320abaa0

Download Submit
C:\Windows\System32\wkrGIVd.exe

Filesize
985KB

MD5
f87be5689b120e42b8d185c90537ee3b

SHA1
5e698e544268c00750788ad6e752d59bad4db6b0

SHA256
bf37b1a35db327267d0829c71b41511069317c11a0d5cc2498de1457a4f22bff

SHA512
c42825e6361c18fed7916eec6d804e1f4fa4988f5e17b359d31eee60a19181c139578208f0091767b666a43e4035a69e0c726ed2b2720989954d4c62645a80a4

Download Submit
C:\Windows\System32\zfsWbLj.exe

Filesize
985KB

MD5
d7f9daaa4ae6f868a1c568611ee59f2a

SHA1
b29193652ee4de7047e25729d270d6c308859c68

SHA256
80c2c92e0c31f8f9533416fe3515e9260ff85d56666a31aa488cd94435be5ae4

SHA512
22506c8d89ba3c32f088053be5a1486e4e26f5ade79f896f73b2ab1e7336265698062688186c1b10509a6a728a2b4bb8fea5858076cf501e8940ac0f9a6a3ed8

Download Submit
memory/888-9-0x00007FF613FC0000-0x00007FF6143B1000-memory.dmp

Filesize
3.9MB

Download
memory/888-2015-0x00007FF613FC0000-0x00007FF6143B1000-memory.dmp

Filesize
3.9MB

Download
memory/1176-415-0x00007FF72EF80000-0x00007FF72F371000-memory.dmp

Filesize
3.9MB

Download
memory/1176-2041-0x00007FF72EF80000-0x00007FF72F371000-memory.dmp

Filesize
3.9MB

Download
memory/1444-426-0x00007FF7CB1A0000-0x00007FF7CB591000-memory.dmp

Filesize
3.9MB

Download
memory/1444-2055-0x00007FF7CB1A0000-0x00007FF7CB591000-memory.dmp

Filesize
3.9MB

Download
memory/1528-2018-0x00007FF63F290000-0x00007FF63F681000-memory.dmp

Filesize
3.9MB

Download
memory/1528-17-0x00007FF63F290000-0x00007FF63F681000-memory.dmp

Filesize
3.9MB

Download
memory/1676-382-0x00007FF6652C0000-0x00007FF6656B1000-memory.dmp

Filesize
3.9MB

Download
memory/1676-2053-0x00007FF6652C0000-0x00007FF6656B1000-memory.dmp

Filesize
3.9MB

Download
memory/1736-2019-0x00007FF7EE8C0000-0x00007FF7EECB1000-memory.dmp

Filesize
3.9MB

Download
memory/1736-1966-0x00007FF7EE8C0000-0x00007FF7EECB1000-memory.dmp

Filesize
3.9MB

Download
memory/1736-23-0x00007FF7EE8C0000-0x00007FF7EECB1000-memory.dmp

Filesize
3.9MB

Download
memory/2212-1977-0x00007FF734A80000-0x00007FF734E71000-memory.dmp

Filesize
3.9MB

Download
memory/2212-2027-0x00007FF734A80000-0x00007FF734E71000-memory.dmp

Filesize
3.9MB

Download
memory/2212-45-0x00007FF734A80000-0x00007FF734E71000-memory.dmp

Filesize
3.9MB

Download
memory/2240-2061-0x00007FF69D8D0000-0x00007FF69DCC1000-memory.dmp

Filesize
3.9MB

Download
memory/2240-436-0x00007FF69D8D0000-0x00007FF69DCC1000-memory.dmp

Filesize
3.9MB

Download
memory/2300-1968-0x00007FF7E41E0000-0x00007FF7E45D1000-memory.dmp

Filesize
3.9MB

Download
memory/2300-2023-0x00007FF7E41E0000-0x00007FF7E45D1000-memory.dmp

Filesize
3.9MB

Download
memory/2300-41-0x00007FF7E41E0000-0x00007FF7E45D1000-memory.dmp

Filesize
3.9MB

Download
memory/2376-2057-0x00007FF616060000-0x00007FF616451000-memory.dmp

Filesize
3.9MB

Download
memory/2376-443-0x00007FF616060000-0x00007FF616451000-memory.dmp

Filesize
3.9MB

Download
memory/2508-2048-0x00007FF7C52A0000-0x00007FF7C5691000-memory.dmp

Filesize
3.9MB

Download
memory/2508-395-0x00007FF7C52A0000-0x00007FF7C5691000-memory.dmp

Filesize
3.9MB

Download
memory/2564-386-0x00007FF661FA0000-0x00007FF662391000-memory.dmp

Filesize
3.9MB

Download
memory/2564-2052-0x00007FF661FA0000-0x00007FF662391000-memory.dmp

Filesize
3.9MB

Download
memory/2800-394-0x00007FF698A90000-0x00007FF698E81000-memory.dmp

Filesize
3.9MB

Download
memory/2800-2036-0x00007FF698A90000-0x00007FF698E81000-memory.dmp

Filesize
3.9MB

Download
memory/2812-1-0x000002C797970000-0x000002C797980000-memory.dmp

Filesize
64KB

Download
memory/2812-2003-0x00007FF7E4720000-0x00007FF7E4B11000-memory.dmp

Filesize
3.9MB

Download
memory/2812-1559-0x00007FF7E4720000-0x00007FF7E4B11000-memory.dmp

Filesize
3.9MB

Download
memory/2812-0-0x00007FF7E4720000-0x00007FF7E4B11000-memory.dmp

Filesize
3.9MB

Download
memory/2936-50-0x00007FF78C4E0000-0x00007FF78C8D1000-memory.dmp

Filesize
3.9MB

Download
memory/2936-2005-0x00007FF78C4E0000-0x00007FF78C8D1000-memory.dmp

Filesize
3.9MB

Download
memory/2936-2137-0x00007FF78C4E0000-0x00007FF78C8D1000-memory.dmp

Filesize
3.9MB

Download
memory/3296-410-0x00007FF74A9D0000-0x00007FF74ADC1000-memory.dmp

Filesize
3.9MB

Download
memory/3296-2032-0x00007FF74A9D0000-0x00007FF74ADC1000-memory.dmp

Filesize
3.9MB

Download
memory/3716-2029-0x00007FF7E00C0000-0x00007FF7E04B1000-memory.dmp

Filesize
3.9MB

Download
memory/3716-376-0x00007FF7E00C0000-0x00007FF7E04B1000-memory.dmp

Filesize
3.9MB

Download
memory/4028-2033-0x00007FF793C00000-0x00007FF793FF1000-memory.dmp

Filesize
3.9MB

Download
memory/4028-404-0x00007FF793C00000-0x00007FF793FF1000-memory.dmp

Filesize
3.9MB

Download
memory/4204-378-0x00007FF7B9B70000-0x00007FF7B9F61000-memory.dmp

Filesize
3.9MB

Download
memory/4204-2038-0x00007FF7B9B70000-0x00007FF7B9F61000-memory.dmp

Filesize
3.9MB

Download
memory/4336-2050-0x00007FF6EEA80000-0x00007FF6EEE71000-memory.dmp

Filesize
3.9MB

Download
memory/4336-389-0x00007FF6EEA80000-0x00007FF6EEE71000-memory.dmp

Filesize
3.9MB

Download
memory/4360-48-0x00007FF7F6E80000-0x00007FF7F7271000-memory.dmp

Filesize
3.9MB

Download
memory/4360-2026-0x00007FF7F6E80000-0x00007FF7F7271000-memory.dmp

Filesize
3.9MB

Download
memory/4416-2043-0x00007FF68A780000-0x00007FF68AB71000-memory.dmp

Filesize
3.9MB

Download
memory/4416-409-0x00007FF68A780000-0x00007FF68AB71000-memory.dmp

Filesize
3.9MB

Download
memory/4672-28-0x00007FF746770000-0x00007FF746B61000-memory.dmp

Filesize
3.9MB

Download
memory/4672-1967-0x00007FF746770000-0x00007FF746B61000-memory.dmp

Filesize
3.9MB

Download
memory/4672-2022-0x00007FF746770000-0x00007FF746B61000-memory.dmp

Filesize
3.9MB

Download
memory/4788-380-0x00007FF6FCCA0000-0x00007FF6FD091000-memory.dmp

Filesize
3.9MB

Download
memory/4788-2040-0x00007FF6FCCA0000-0x00007FF6FD091000-memory.dmp

Filesize
3.9MB

Download
memory/5080-2045-0x00007FF6BDD40000-0x00007FF6BE131000-memory.dmp

Filesize
3.9MB

Download
memory/5080-408-0x00007FF6BDD40000-0x00007FF6BE131000-memory.dmp

Filesize
3.9MB

Download