xmrig | 2124e7c1ec2cb6cbabc4dda3b4b1a9a443022bf7afc4fa6ae4cc5e90a78ef649

Analysis

max time kernel
126s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 15:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
Size

1.7MB
MD5

136001210091ccfcbd0a27d6c3154afa
SHA1

0ee2977cc9dcfa3966b97620ecda501d5cdd588c
SHA256

2124e7c1ec2cb6cbabc4dda3b4b1a9a443022bf7afc4fa6ae4cc5e90a78ef649
SHA512

d5c03dfc794d8a7cc6c866f3c184fd8e443adee0ad41573186339abacaa6ad74a4886680a124b6d4430f63df4dff5e8f824d3b8be4cc68d20b9d3dbfcf6fc05b
SSDEEP

24576:JanwhSe11QSONCpGJCjETPlGC78XIO9C1MKTbcMfHhGjw2Do+BRrCfULFbsHl:knw9oUUEEDlGUjc2HhG82DioAF

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/1576-455-0x00007FF69FFB0000-0x00007FF6A03A1000-memory.dmp	xmrig
behavioral2/memory/4888-456-0x00007FF7085D0000-0x00007FF7089C1000-memory.dmp	xmrig
behavioral2/memory/3708-457-0x00007FF7A2BF0000-0x00007FF7A2FE1000-memory.dmp	xmrig
behavioral2/memory/2236-458-0x00007FF7AADF0000-0x00007FF7AB1E1000-memory.dmp	xmrig
behavioral2/memory/3116-459-0x00007FF7CFED0000-0x00007FF7D02C1000-memory.dmp	xmrig
behavioral2/memory/2176-462-0x00007FF7303A0000-0x00007FF730791000-memory.dmp	xmrig
behavioral2/memory/3772-467-0x00007FF64C510000-0x00007FF64C901000-memory.dmp	xmrig
behavioral2/memory/2964-478-0x00007FF6C5060000-0x00007FF6C5451000-memory.dmp	xmrig
behavioral2/memory/624-482-0x00007FF6C6F30000-0x00007FF6C7321000-memory.dmp	xmrig
behavioral2/memory/2500-483-0x00007FF6FD790000-0x00007FF6FDB81000-memory.dmp	xmrig
behavioral2/memory/1976-489-0x00007FF7FB630000-0x00007FF7FBA21000-memory.dmp	xmrig
behavioral2/memory/3428-497-0x00007FF664E10000-0x00007FF665201000-memory.dmp	xmrig
behavioral2/memory/2888-499-0x00007FF7C9490000-0x00007FF7C9881000-memory.dmp	xmrig
behavioral2/memory/4164-493-0x00007FF77C930000-0x00007FF77CD21000-memory.dmp	xmrig
behavioral2/memory/1676-492-0x00007FF71D4C0000-0x00007FF71D8B1000-memory.dmp	xmrig
behavioral2/memory/2632-488-0x00007FF70F8E0000-0x00007FF70FCD1000-memory.dmp	xmrig
behavioral2/memory/2660-475-0x00007FF6C1E50000-0x00007FF6C2241000-memory.dmp	xmrig
behavioral2/memory/4932-474-0x00007FF792540000-0x00007FF792931000-memory.dmp	xmrig
behavioral2/memory/2280-470-0x00007FF77C480000-0x00007FF77C871000-memory.dmp	xmrig
behavioral2/memory/2488-1939-0x00007FF6A2460000-0x00007FF6A2851000-memory.dmp	xmrig
behavioral2/memory/2760-1940-0x00007FF678C00000-0x00007FF678FF1000-memory.dmp	xmrig
behavioral2/memory/5056-1941-0x00007FF64A990000-0x00007FF64AD81000-memory.dmp	xmrig
behavioral2/memory/2044-1970-0x00007FF69D590000-0x00007FF69D981000-memory.dmp	xmrig
behavioral2/memory/4480-1971-0x00007FF72DB20000-0x00007FF72DF11000-memory.dmp	xmrig
behavioral2/memory/2376-1976-0x00007FF77ECA0000-0x00007FF77F091000-memory.dmp	xmrig
behavioral2/memory/5056-1982-0x00007FF64A990000-0x00007FF64AD81000-memory.dmp	xmrig
behavioral2/memory/2760-1984-0x00007FF678C00000-0x00007FF678FF1000-memory.dmp	xmrig
behavioral2/memory/2044-1986-0x00007FF69D590000-0x00007FF69D981000-memory.dmp	xmrig
behavioral2/memory/4480-1988-0x00007FF72DB20000-0x00007FF72DF11000-memory.dmp	xmrig
behavioral2/memory/2376-1996-0x00007FF77ECA0000-0x00007FF77F091000-memory.dmp	xmrig
behavioral2/memory/3708-1998-0x00007FF7A2BF0000-0x00007FF7A2FE1000-memory.dmp	xmrig
behavioral2/memory/2236-2000-0x00007FF7AADF0000-0x00007FF7AB1E1000-memory.dmp	xmrig
behavioral2/memory/3116-2002-0x00007FF7CFED0000-0x00007FF7D02C1000-memory.dmp	xmrig
behavioral2/memory/2888-1995-0x00007FF7C9490000-0x00007FF7C9881000-memory.dmp	xmrig
behavioral2/memory/4888-1991-0x00007FF7085D0000-0x00007FF7089C1000-memory.dmp	xmrig
behavioral2/memory/1576-1993-0x00007FF69FFB0000-0x00007FF6A03A1000-memory.dmp	xmrig
behavioral2/memory/4932-2049-0x00007FF792540000-0x00007FF792931000-memory.dmp	xmrig
behavioral2/memory/2176-2054-0x00007FF7303A0000-0x00007FF730791000-memory.dmp	xmrig
behavioral2/memory/3772-2053-0x00007FF64C510000-0x00007FF64C901000-memory.dmp	xmrig
behavioral2/memory/2280-2051-0x00007FF77C480000-0x00007FF77C871000-memory.dmp	xmrig
behavioral2/memory/2964-2045-0x00007FF6C5060000-0x00007FF6C5451000-memory.dmp	xmrig
behavioral2/memory/4164-2023-0x00007FF77C930000-0x00007FF77CD21000-memory.dmp	xmrig
behavioral2/memory/1676-2017-0x00007FF71D4C0000-0x00007FF71D8B1000-memory.dmp	xmrig
behavioral2/memory/3428-2015-0x00007FF664E10000-0x00007FF665201000-memory.dmp	xmrig
behavioral2/memory/1976-2010-0x00007FF7FB630000-0x00007FF7FBA21000-memory.dmp	xmrig
behavioral2/memory/2500-2006-0x00007FF6FD790000-0x00007FF6FDB81000-memory.dmp	xmrig
behavioral2/memory/2660-2047-0x00007FF6C1E50000-0x00007FF6C2241000-memory.dmp	xmrig
behavioral2/memory/2632-2012-0x00007FF70F8E0000-0x00007FF70FCD1000-memory.dmp	xmrig
behavioral2/memory/624-2008-0x00007FF6C6F30000-0x00007FF6C7321000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
5056	lgpwpnc.exe
2760	cznAhwj.exe
2044	tJzPHKh.exe
4480	JNIjxXe.exe
2376	WICUWdv.exe
2888	FnvbJey.exe
1576	CNRZSSX.exe
4888	XLljgyr.exe
3708	ffZQiwZ.exe
2236	WNJJzWN.exe
3116	aTvdDpQ.exe
2176	lovgvhk.exe
3772	ObJktEH.exe
2280	lpAhOWt.exe
4932	dVKHtJb.exe
2660	dsCvlip.exe
2964	cOFquQY.exe
624	cfTlXQW.exe
2500	EnpDtmd.exe
2632	AscAegU.exe
1976	Zzwytsr.exe
1676	KjWfqZG.exe
4164	deGXxlo.exe
3428	HoUyHrJ.exe
3168	eMGVeyi.exe
2228	llvutOe.exe
2468	UaXtIKC.exe
4024	OFzwcXJ.exe
4876	DDLspcb.exe
3620	TQnvTNI.exe
1948	qMUSYUV.exe
2412	BajiqdZ.exe
4356	NXHBWYA.exe
3872	PGrIRLh.exe
1364	CAnVabk.exe
2024	IedCmQe.exe
4352	KBStKYn.exe
3980	FmnECqR.exe
4596	BLkmcZU.exe
2344	PeXCJVi.exe
4576	tGWQtto.exe
4852	vKJtWBY.exe
3576	tBxyXBE.exe
2088	gdDIUAz.exe
3704	VnsoGwV.exe
2456	ykxqiIk.exe
4648	waKaOOF.exe
4872	JSHubdz.exe
4892	wfaJiaT.exe
4748	RGeMcVz.exe
3040	ckSErKA.exe
4004	MSREHqZ.exe
736	gDURvLg.exe
1852	LxVgGYA.exe
4100	LgiArFD.exe
3560	RfNTRxb.exe
3952	hJvjUeV.exe
2784	NuynCNx.exe
1860	nbmEyKl.exe
4560	dXHWEcU.exe
2220	AcOCvyV.exe
5096	WCZgQHx.exe
1412	GwXAYkn.exe
3204	JHaIvRf.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2488-0-0x00007FF6A2460000-0x00007FF6A2851000-memory.dmp	upx
behavioral2/files/0x000b000000023b7b-5.dat	upx
behavioral2/files/0x000a000000023b80-8.dat	upx
behavioral2/files/0x000a000000023b7f-13.dat	upx
behavioral2/memory/5056-12-0x00007FF64A990000-0x00007FF64AD81000-memory.dmp	upx
behavioral2/memory/2760-16-0x00007FF678C00000-0x00007FF678FF1000-memory.dmp	upx
behavioral2/files/0x000a000000023b81-22.dat	upx
behavioral2/files/0x000a000000023b82-24.dat	upx
behavioral2/memory/4480-28-0x00007FF72DB20000-0x00007FF72DF11000-memory.dmp	upx
behavioral2/files/0x000a000000023b83-36.dat	upx
behavioral2/files/0x000a000000023b86-51.dat	upx
behavioral2/files/0x000a000000023b87-56.dat	upx
behavioral2/files/0x000a000000023b88-61.dat	upx
behavioral2/files/0x000a000000023b8f-96.dat	upx
behavioral2/files/0x000a000000023b93-116.dat	upx
behavioral2/files/0x000a000000023b97-134.dat	upx
behavioral2/files/0x000a000000023b99-146.dat	upx
behavioral2/files/0x000a000000023b9c-161.dat	upx
behavioral2/memory/1576-455-0x00007FF69FFB0000-0x00007FF6A03A1000-memory.dmp	upx
behavioral2/files/0x000a000000023b9d-166.dat	upx
behavioral2/files/0x000a000000023b9b-156.dat	upx
behavioral2/files/0x000a000000023b9a-151.dat	upx
behavioral2/files/0x000a000000023b98-141.dat	upx
behavioral2/files/0x000a000000023b96-131.dat	upx
behavioral2/files/0x000a000000023b95-126.dat	upx
behavioral2/files/0x000a000000023b94-121.dat	upx
behavioral2/files/0x000a000000023b92-111.dat	upx
behavioral2/files/0x000a000000023b91-106.dat	upx
behavioral2/files/0x000a000000023b90-101.dat	upx
behavioral2/files/0x000a000000023b8e-91.dat	upx
behavioral2/files/0x000a000000023b8d-86.dat	upx
behavioral2/files/0x000a000000023b8c-81.dat	upx
behavioral2/files/0x000a000000023b8b-76.dat	upx
behavioral2/files/0x000a000000023b8a-71.dat	upx
behavioral2/files/0x000a000000023b89-66.dat	upx
behavioral2/files/0x000a000000023b85-46.dat	upx
behavioral2/files/0x000a000000023b84-41.dat	upx
behavioral2/memory/2376-31-0x00007FF77ECA0000-0x00007FF77F091000-memory.dmp	upx
behavioral2/memory/2044-20-0x00007FF69D590000-0x00007FF69D981000-memory.dmp	upx
behavioral2/memory/4888-456-0x00007FF7085D0000-0x00007FF7089C1000-memory.dmp	upx
behavioral2/memory/3708-457-0x00007FF7A2BF0000-0x00007FF7A2FE1000-memory.dmp	upx
behavioral2/memory/2236-458-0x00007FF7AADF0000-0x00007FF7AB1E1000-memory.dmp	upx
behavioral2/memory/3116-459-0x00007FF7CFED0000-0x00007FF7D02C1000-memory.dmp	upx
behavioral2/memory/2176-462-0x00007FF7303A0000-0x00007FF730791000-memory.dmp	upx
behavioral2/memory/3772-467-0x00007FF64C510000-0x00007FF64C901000-memory.dmp	upx
behavioral2/memory/2964-478-0x00007FF6C5060000-0x00007FF6C5451000-memory.dmp	upx
behavioral2/memory/624-482-0x00007FF6C6F30000-0x00007FF6C7321000-memory.dmp	upx
behavioral2/memory/2500-483-0x00007FF6FD790000-0x00007FF6FDB81000-memory.dmp	upx
behavioral2/memory/1976-489-0x00007FF7FB630000-0x00007FF7FBA21000-memory.dmp	upx
behavioral2/memory/3428-497-0x00007FF664E10000-0x00007FF665201000-memory.dmp	upx
behavioral2/memory/2888-499-0x00007FF7C9490000-0x00007FF7C9881000-memory.dmp	upx
behavioral2/memory/4164-493-0x00007FF77C930000-0x00007FF77CD21000-memory.dmp	upx
behavioral2/memory/1676-492-0x00007FF71D4C0000-0x00007FF71D8B1000-memory.dmp	upx
behavioral2/memory/2632-488-0x00007FF70F8E0000-0x00007FF70FCD1000-memory.dmp	upx
behavioral2/memory/2660-475-0x00007FF6C1E50000-0x00007FF6C2241000-memory.dmp	upx
behavioral2/memory/4932-474-0x00007FF792540000-0x00007FF792931000-memory.dmp	upx
behavioral2/memory/2280-470-0x00007FF77C480000-0x00007FF77C871000-memory.dmp	upx
behavioral2/memory/2488-1939-0x00007FF6A2460000-0x00007FF6A2851000-memory.dmp	upx
behavioral2/memory/2760-1940-0x00007FF678C00000-0x00007FF678FF1000-memory.dmp	upx
behavioral2/memory/5056-1941-0x00007FF64A990000-0x00007FF64AD81000-memory.dmp	upx
behavioral2/memory/2044-1970-0x00007FF69D590000-0x00007FF69D981000-memory.dmp	upx
behavioral2/memory/4480-1971-0x00007FF72DB20000-0x00007FF72DF11000-memory.dmp	upx
behavioral2/memory/2376-1976-0x00007FF77ECA0000-0x00007FF77F091000-memory.dmp	upx
behavioral2/memory/5056-1982-0x00007FF64A990000-0x00007FF64AD81000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\gwzKzJZ.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\tKSxFfj.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\lSkRRno.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\amKpaCE.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\zcLHCpS.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\HBnvxys.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\NyWYxUN.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\dkTpoIv.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\SDYTGAo.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\TbYQYbU.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\PfAzBJR.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\KrUSwxv.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\fiJPhQf.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\szqiquY.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\FGzxktS.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\PABKvxX.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\hYVGHvj.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\eVcnTvC.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\DqkTsPK.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\cTtqECc.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\wfaJiaT.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\zNcykJs.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\FqPqXKi.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\qsFXSaW.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\FRFrTmK.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\OWsucMF.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\beVRWiw.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\dbXCTVG.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\EnltBvU.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\spfJVcB.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\rGpasZg.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\lXPcXfV.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\ryPvrEd.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\dQQHNnZ.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\cznAhwj.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\waKaOOF.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\vlDzFsT.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\domiwst.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\WdArLwj.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\jQrxixU.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\eTDuppJ.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\SuSdjtG.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\pdafwHn.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\juDdSuc.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\YUKicwV.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\Rbonwhz.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\KzexYmQ.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\UsaGxEZ.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\STNhPFx.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\cntXuXx.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\IFzvemd.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\iTogsiY.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\wdugpCs.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\bnkSgnA.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\ijtEwVU.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\EaangND.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\ENXGzxq.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\GvcPuDC.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\rjSvNAn.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\LtboWxz.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\fUNALlw.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\sMUChfu.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\vybbwND.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
File created	C:\Windows\System32\vdfZWTY.exe	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 5056	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	86
PID 2488 wrote to memory of 5056	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	86
PID 2488 wrote to memory of 2760	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	87
PID 2488 wrote to memory of 2760	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	87
PID 2488 wrote to memory of 2044	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	88
PID 2488 wrote to memory of 2044	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	88
PID 2488 wrote to memory of 4480	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	89
PID 2488 wrote to memory of 4480	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	89
PID 2488 wrote to memory of 2376	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	90
PID 2488 wrote to memory of 2376	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	90
PID 2488 wrote to memory of 2888	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	91
PID 2488 wrote to memory of 2888	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	91
PID 2488 wrote to memory of 1576	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	92
PID 2488 wrote to memory of 1576	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	92
PID 2488 wrote to memory of 4888	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	93
PID 2488 wrote to memory of 4888	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	93
PID 2488 wrote to memory of 3708	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	94
PID 2488 wrote to memory of 3708	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	94
PID 2488 wrote to memory of 2236	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	95
PID 2488 wrote to memory of 2236	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	95
PID 2488 wrote to memory of 3116	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	96
PID 2488 wrote to memory of 3116	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	96
PID 2488 wrote to memory of 2176	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	97
PID 2488 wrote to memory of 2176	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	97
PID 2488 wrote to memory of 3772	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	98
PID 2488 wrote to memory of 3772	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	98
PID 2488 wrote to memory of 2280	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	99
PID 2488 wrote to memory of 2280	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	99
PID 2488 wrote to memory of 4932	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	100
PID 2488 wrote to memory of 4932	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	100
PID 2488 wrote to memory of 2660	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	101
PID 2488 wrote to memory of 2660	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	101
PID 2488 wrote to memory of 2964	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	102
PID 2488 wrote to memory of 2964	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	102
PID 2488 wrote to memory of 624	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	103
PID 2488 wrote to memory of 624	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	103
PID 2488 wrote to memory of 2500	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	104
PID 2488 wrote to memory of 2500	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	104
PID 2488 wrote to memory of 2632	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	105
PID 2488 wrote to memory of 2632	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	105
PID 2488 wrote to memory of 1976	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	106
PID 2488 wrote to memory of 1976	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	106
PID 2488 wrote to memory of 1676	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	107
PID 2488 wrote to memory of 1676	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	107
PID 2488 wrote to memory of 4164	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	108
PID 2488 wrote to memory of 4164	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	108
PID 2488 wrote to memory of 3428	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	109
PID 2488 wrote to memory of 3428	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	109
PID 2488 wrote to memory of 3168	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	110
PID 2488 wrote to memory of 3168	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	110
PID 2488 wrote to memory of 2228	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	111
PID 2488 wrote to memory of 2228	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	111
PID 2488 wrote to memory of 2468	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	112
PID 2488 wrote to memory of 2468	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	112
PID 2488 wrote to memory of 4024	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	113
PID 2488 wrote to memory of 4024	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	113
PID 2488 wrote to memory of 4876	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	114
PID 2488 wrote to memory of 4876	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	114
PID 2488 wrote to memory of 3620	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	115
PID 2488 wrote to memory of 3620	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	115
PID 2488 wrote to memory of 1948	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	116
PID 2488 wrote to memory of 1948	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	116
PID 2488 wrote to memory of 2412	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	117
PID 2488 wrote to memory of 2412	2488	136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe	117

C:\Users\Admin\AppData\Local\Temp\136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\136001210091ccfcbd0a27d6c3154afa_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\System32\lgpwpnc.exe
  C:\Windows\System32\lgpwpnc.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System32\cznAhwj.exe
  C:\Windows\System32\cznAhwj.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System32\tJzPHKh.exe
  C:\Windows\System32\tJzPHKh.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System32\JNIjxXe.exe
  C:\Windows\System32\JNIjxXe.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System32\WICUWdv.exe
  C:\Windows\System32\WICUWdv.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System32\FnvbJey.exe
  C:\Windows\System32\FnvbJey.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System32\CNRZSSX.exe
  C:\Windows\System32\CNRZSSX.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System32\XLljgyr.exe
  C:\Windows\System32\XLljgyr.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System32\ffZQiwZ.exe
  C:\Windows\System32\ffZQiwZ.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System32\WNJJzWN.exe
  C:\Windows\System32\WNJJzWN.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System32\aTvdDpQ.exe
  C:\Windows\System32\aTvdDpQ.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System32\lovgvhk.exe
  C:\Windows\System32\lovgvhk.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System32\ObJktEH.exe
  C:\Windows\System32\ObJktEH.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System32\lpAhOWt.exe
  C:\Windows\System32\lpAhOWt.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System32\dVKHtJb.exe
  C:\Windows\System32\dVKHtJb.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System32\dsCvlip.exe
  C:\Windows\System32\dsCvlip.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System32\cOFquQY.exe
  C:\Windows\System32\cOFquQY.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System32\cfTlXQW.exe
  C:\Windows\System32\cfTlXQW.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System32\EnpDtmd.exe
  C:\Windows\System32\EnpDtmd.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System32\AscAegU.exe
  C:\Windows\System32\AscAegU.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System32\Zzwytsr.exe
  C:\Windows\System32\Zzwytsr.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System32\KjWfqZG.exe
  C:\Windows\System32\KjWfqZG.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System32\deGXxlo.exe
  C:\Windows\System32\deGXxlo.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System32\HoUyHrJ.exe
  C:\Windows\System32\HoUyHrJ.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System32\eMGVeyi.exe
  C:\Windows\System32\eMGVeyi.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System32\llvutOe.exe
  C:\Windows\System32\llvutOe.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System32\UaXtIKC.exe
  C:\Windows\System32\UaXtIKC.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System32\OFzwcXJ.exe
  C:\Windows\System32\OFzwcXJ.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System32\DDLspcb.exe
  C:\Windows\System32\DDLspcb.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System32\TQnvTNI.exe
  C:\Windows\System32\TQnvTNI.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System32\qMUSYUV.exe
  C:\Windows\System32\qMUSYUV.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System32\BajiqdZ.exe
  C:\Windows\System32\BajiqdZ.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System32\NXHBWYA.exe
  C:\Windows\System32\NXHBWYA.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System32\PGrIRLh.exe
  C:\Windows\System32\PGrIRLh.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System32\CAnVabk.exe
  C:\Windows\System32\CAnVabk.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System32\IedCmQe.exe
  C:\Windows\System32\IedCmQe.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System32\KBStKYn.exe
  C:\Windows\System32\KBStKYn.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System32\FmnECqR.exe
  C:\Windows\System32\FmnECqR.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System32\BLkmcZU.exe
  C:\Windows\System32\BLkmcZU.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System32\PeXCJVi.exe
  C:\Windows\System32\PeXCJVi.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System32\tGWQtto.exe
  C:\Windows\System32\tGWQtto.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System32\vKJtWBY.exe
  C:\Windows\System32\vKJtWBY.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System32\tBxyXBE.exe
  C:\Windows\System32\tBxyXBE.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System32\gdDIUAz.exe
  C:\Windows\System32\gdDIUAz.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System32\VnsoGwV.exe
  C:\Windows\System32\VnsoGwV.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System32\ykxqiIk.exe
  C:\Windows\System32\ykxqiIk.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System32\waKaOOF.exe
  C:\Windows\System32\waKaOOF.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System32\JSHubdz.exe
  C:\Windows\System32\JSHubdz.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System32\wfaJiaT.exe
  C:\Windows\System32\wfaJiaT.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System32\RGeMcVz.exe
  C:\Windows\System32\RGeMcVz.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System32\ckSErKA.exe
  C:\Windows\System32\ckSErKA.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System32\MSREHqZ.exe
  C:\Windows\System32\MSREHqZ.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System32\gDURvLg.exe
  C:\Windows\System32\gDURvLg.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System32\LxVgGYA.exe
  C:\Windows\System32\LxVgGYA.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System32\LgiArFD.exe
  C:\Windows\System32\LgiArFD.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System32\RfNTRxb.exe
  C:\Windows\System32\RfNTRxb.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System32\hJvjUeV.exe
  C:\Windows\System32\hJvjUeV.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System32\NuynCNx.exe
  C:\Windows\System32\NuynCNx.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System32\nbmEyKl.exe
  C:\Windows\System32\nbmEyKl.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System32\dXHWEcU.exe
  C:\Windows\System32\dXHWEcU.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System32\AcOCvyV.exe
  C:\Windows\System32\AcOCvyV.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System32\WCZgQHx.exe
  C:\Windows\System32\WCZgQHx.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System32\GwXAYkn.exe
  C:\Windows\System32\GwXAYkn.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System32\JHaIvRf.exe
  C:\Windows\System32\JHaIvRf.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System32\XYZkeUX.exe
  C:\Windows\System32\XYZkeUX.exe
  2⤵
  PID:2068
- C:\Windows\System32\lzXHjDr.exe
  C:\Windows\System32\lzXHjDr.exe
  2⤵
  PID:4436
- C:\Windows\System32\ISHscVH.exe
  C:\Windows\System32\ISHscVH.exe
  2⤵
  PID:376
- C:\Windows\System32\onhBSau.exe
  C:\Windows\System32\onhBSau.exe
  2⤵
  PID:2884
- C:\Windows\System32\iuYzvWf.exe
  C:\Windows\System32\iuYzvWf.exe
  2⤵
  PID:5124
- C:\Windows\System32\bAKBmfj.exe
  C:\Windows\System32\bAKBmfj.exe
  2⤵
  PID:5152
- C:\Windows\System32\ZcFqLRE.exe
  C:\Windows\System32\ZcFqLRE.exe
  2⤵
  PID:5176
- C:\Windows\System32\KZuwiLk.exe
  C:\Windows\System32\KZuwiLk.exe
  2⤵
  PID:5212
- C:\Windows\System32\zNQovkD.exe
  C:\Windows\System32\zNQovkD.exe
  2⤵
  PID:5236
- C:\Windows\System32\iTogsiY.exe
  C:\Windows\System32\iTogsiY.exe
  2⤵
  PID:5264
- C:\Windows\System32\mXrxRYS.exe
  C:\Windows\System32\mXrxRYS.exe
  2⤵
  PID:5288
- C:\Windows\System32\MwRKmDR.exe
  C:\Windows\System32\MwRKmDR.exe
  2⤵
  PID:5324
- C:\Windows\System32\aCCRVwf.exe
  C:\Windows\System32\aCCRVwf.exe
  2⤵
  PID:5348
- C:\Windows\System32\hTZHCEn.exe
  C:\Windows\System32\hTZHCEn.exe
  2⤵
  PID:5380
- C:\Windows\System32\gwzKzJZ.exe
  C:\Windows\System32\gwzKzJZ.exe
  2⤵
  PID:5408
- C:\Windows\System32\YThkZSJ.exe
  C:\Windows\System32\YThkZSJ.exe
  2⤵
  PID:5436
- C:\Windows\System32\MhZSmfP.exe
  C:\Windows\System32\MhZSmfP.exe
  2⤵
  PID:5460
- C:\Windows\System32\vlDzFsT.exe
  C:\Windows\System32\vlDzFsT.exe
  2⤵
  PID:5488
- C:\Windows\System32\spfJVcB.exe
  C:\Windows\System32\spfJVcB.exe
  2⤵
  PID:5512
- C:\Windows\System32\XFvBNYn.exe
  C:\Windows\System32\XFvBNYn.exe
  2⤵
  PID:5544
- C:\Windows\System32\fiJPhQf.exe
  C:\Windows\System32\fiJPhQf.exe
  2⤵
  PID:5576
- C:\Windows\System32\XolCmPL.exe
  C:\Windows\System32\XolCmPL.exe
  2⤵
  PID:5604
- C:\Windows\System32\AKWJhIO.exe
  C:\Windows\System32\AKWJhIO.exe
  2⤵
  PID:5628
- C:\Windows\System32\eYFmFqe.exe
  C:\Windows\System32\eYFmFqe.exe
  2⤵
  PID:5656
- C:\Windows\System32\pTmnYmm.exe
  C:\Windows\System32\pTmnYmm.exe
  2⤵
  PID:5680
- C:\Windows\System32\GTbhgvs.exe
  C:\Windows\System32\GTbhgvs.exe
  2⤵
  PID:5716
- C:\Windows\System32\hFFlrft.exe
  C:\Windows\System32\hFFlrft.exe
  2⤵
  PID:5744
- C:\Windows\System32\gqScUMX.exe
  C:\Windows\System32\gqScUMX.exe
  2⤵
  PID:5768
- C:\Windows\System32\OgBbtVw.exe
  C:\Windows\System32\OgBbtVw.exe
  2⤵
  PID:5796
- C:\Windows\System32\ObZmPuU.exe
  C:\Windows\System32\ObZmPuU.exe
  2⤵
  PID:5824
- C:\Windows\System32\wXMVaej.exe
  C:\Windows\System32\wXMVaej.exe
  2⤵
  PID:5856
- C:\Windows\System32\CxmKpgM.exe
  C:\Windows\System32\CxmKpgM.exe
  2⤵
  PID:5884
- C:\Windows\System32\mABgEtC.exe
  C:\Windows\System32\mABgEtC.exe
  2⤵
  PID:5908
- C:\Windows\System32\QIyglTt.exe
  C:\Windows\System32\QIyglTt.exe
  2⤵
  PID:5940
- C:\Windows\System32\AouyVSV.exe
  C:\Windows\System32\AouyVSV.exe
  2⤵
  PID:5964
- C:\Windows\System32\CnRksOZ.exe
  C:\Windows\System32\CnRksOZ.exe
  2⤵
  PID:5992
- C:\Windows\System32\knsdWWt.exe
  C:\Windows\System32\knsdWWt.exe
  2⤵
  PID:6016
- C:\Windows\System32\zNcykJs.exe
  C:\Windows\System32\zNcykJs.exe
  2⤵
  PID:6048
- C:\Windows\System32\pXXgXem.exe
  C:\Windows\System32\pXXgXem.exe
  2⤵
  PID:6080
- C:\Windows\System32\mrqvMfv.exe
  C:\Windows\System32\mrqvMfv.exe
  2⤵
  PID:6104
- C:\Windows\System32\jzdZlqr.exe
  C:\Windows\System32\jzdZlqr.exe
  2⤵
  PID:6132
- C:\Windows\System32\VqAeWrO.exe
  C:\Windows\System32\VqAeWrO.exe
  2⤵
  PID:2264
- C:\Windows\System32\wdugpCs.exe
  C:\Windows\System32\wdugpCs.exe
  2⤵
  PID:408
- C:\Windows\System32\sFECeSN.exe
  C:\Windows\System32\sFECeSN.exe
  2⤵
  PID:1620
- C:\Windows\System32\SCosEoF.exe
  C:\Windows\System32\SCosEoF.exe
  2⤵
  PID:924
- C:\Windows\System32\iZtUlfD.exe
  C:\Windows\System32\iZtUlfD.exe
  2⤵
  PID:5164
- C:\Windows\System32\HzovBhC.exe
  C:\Windows\System32\HzovBhC.exe
  2⤵
  PID:5228
- C:\Windows\System32\LVEKOXU.exe
  C:\Windows\System32\LVEKOXU.exe
  2⤵
  PID:5284
- C:\Windows\System32\olItWAN.exe
  C:\Windows\System32\olItWAN.exe
  2⤵
  PID:5340
- C:\Windows\System32\drhSsex.exe
  C:\Windows\System32\drhSsex.exe
  2⤵
  PID:5404
- C:\Windows\System32\YVTmjEU.exe
  C:\Windows\System32\YVTmjEU.exe
  2⤵
  PID:5480
- C:\Windows\System32\LtboWxz.exe
  C:\Windows\System32\LtboWxz.exe
  2⤵
  PID:5536
- C:\Windows\System32\wDSsvCq.exe
  C:\Windows\System32\wDSsvCq.exe
  2⤵
  PID:5600
- C:\Windows\System32\PwKanuj.exe
  C:\Windows\System32\PwKanuj.exe
  2⤵
  PID:5668
- C:\Windows\System32\zcLHCpS.exe
  C:\Windows\System32\zcLHCpS.exe
  2⤵
  PID:5696
- C:\Windows\System32\UqJPQvt.exe
  C:\Windows\System32\UqJPQvt.exe
  2⤵
  PID:5760
- C:\Windows\System32\WDzZACN.exe
  C:\Windows\System32\WDzZACN.exe
  2⤵
  PID:5812
- C:\Windows\System32\cIzXHRJ.exe
  C:\Windows\System32\cIzXHRJ.exe
  2⤵
  PID:5880
- C:\Windows\System32\iPspYZn.exe
  C:\Windows\System32\iPspYZn.exe
  2⤵
  PID:2664
- C:\Windows\System32\xMBKyKX.exe
  C:\Windows\System32\xMBKyKX.exe
  2⤵
  PID:5984
- C:\Windows\System32\sQKBwyx.exe
  C:\Windows\System32\sQKBwyx.exe
  2⤵
  PID:6040
- C:\Windows\System32\KtSbrmt.exe
  C:\Windows\System32\KtSbrmt.exe
  2⤵
  PID:6092
- C:\Windows\System32\XNVljSw.exe
  C:\Windows\System32\XNVljSw.exe
  2⤵
  PID:2764
- C:\Windows\System32\JAhFdDI.exe
  C:\Windows\System32\JAhFdDI.exe
  2⤵
  PID:920
- C:\Windows\System32\bnkSgnA.exe
  C:\Windows\System32\bnkSgnA.exe
  2⤵
  PID:5364
- C:\Windows\System32\RkQiRKr.exe
  C:\Windows\System32\RkQiRKr.exe
  2⤵
  PID:2388
- C:\Windows\System32\XxstJQT.exe
  C:\Windows\System32\XxstJQT.exe
  2⤵
  PID:5588
- C:\Windows\System32\mmjFYEg.exe
  C:\Windows\System32\mmjFYEg.exe
  2⤵
  PID:5108
- C:\Windows\System32\WZDxjmr.exe
  C:\Windows\System32\WZDxjmr.exe
  2⤵
  PID:4208
- C:\Windows\System32\wtYhstd.exe
  C:\Windows\System32\wtYhstd.exe
  2⤵
  PID:5868
- C:\Windows\System32\aAowwji.exe
  C:\Windows\System32\aAowwji.exe
  2⤵
  PID:4452
- C:\Windows\System32\aEERLVs.exe
  C:\Windows\System32\aEERLVs.exe
  2⤵
  PID:1824
- C:\Windows\System32\tKSxFfj.exe
  C:\Windows\System32\tKSxFfj.exe
  2⤵
  PID:6124
- C:\Windows\System32\UbRKEJw.exe
  C:\Windows\System32\UbRKEJw.exe
  2⤵
  PID:3396
- C:\Windows\System32\bksoqDM.exe
  C:\Windows\System32\bksoqDM.exe
  2⤵
  PID:1084
- C:\Windows\System32\pMmJmKv.exe
  C:\Windows\System32\pMmJmKv.exe
  2⤵
  PID:5448
- C:\Windows\System32\TXVFsov.exe
  C:\Windows\System32\TXVFsov.exe
  2⤵
  PID:5808
- C:\Windows\System32\PABKvxX.exe
  C:\Windows\System32\PABKvxX.exe
  2⤵
  PID:3500
- C:\Windows\System32\BfHNbsE.exe
  C:\Windows\System32\BfHNbsE.exe
  2⤵
  PID:6096
- C:\Windows\System32\gXGNQhM.exe
  C:\Windows\System32\gXGNQhM.exe
  2⤵
  PID:1572
- C:\Windows\System32\fdEYTVt.exe
  C:\Windows\System32\fdEYTVt.exe
  2⤵
  PID:5504
- C:\Windows\System32\fUNALlw.exe
  C:\Windows\System32\fUNALlw.exe
  2⤵
  PID:1416
- C:\Windows\System32\gUDDnGV.exe
  C:\Windows\System32\gUDDnGV.exe
  2⤵
  PID:3616
- C:\Windows\System32\eaDbAaj.exe
  C:\Windows\System32\eaDbAaj.exe
  2⤵
  PID:1772
- C:\Windows\System32\Rbonwhz.exe
  C:\Windows\System32\Rbonwhz.exe
  2⤵
  PID:1344
- C:\Windows\System32\XNczDsF.exe
  C:\Windows\System32\XNczDsF.exe
  2⤵
  PID:4588
- C:\Windows\System32\drzwOwW.exe
  C:\Windows\System32\drzwOwW.exe
  2⤵
  PID:1432
- C:\Windows\System32\hyMpVpX.exe
  C:\Windows\System32\hyMpVpX.exe
  2⤵
  PID:6152
- C:\Windows\System32\XZdmuwv.exe
  C:\Windows\System32\XZdmuwv.exe
  2⤵
  PID:6184
- C:\Windows\System32\vXxyUBF.exe
  C:\Windows\System32\vXxyUBF.exe
  2⤵
  PID:6244
- C:\Windows\System32\qOIsIAJ.exe
  C:\Windows\System32\qOIsIAJ.exe
  2⤵
  PID:6260
- C:\Windows\System32\VHUwcPv.exe
  C:\Windows\System32\VHUwcPv.exe
  2⤵
  PID:6288
- C:\Windows\System32\PoMWIuF.exe
  C:\Windows\System32\PoMWIuF.exe
  2⤵
  PID:6316
- C:\Windows\System32\caWjcut.exe
  C:\Windows\System32\caWjcut.exe
  2⤵
  PID:6344
- C:\Windows\System32\EDBllfv.exe
  C:\Windows\System32\EDBllfv.exe
  2⤵
  PID:6376
- C:\Windows\System32\AjuFqof.exe
  C:\Windows\System32\AjuFqof.exe
  2⤵
  PID:6400
- C:\Windows\System32\SOjASnC.exe
  C:\Windows\System32\SOjASnC.exe
  2⤵
  PID:6424
- C:\Windows\System32\JVWiAuZ.exe
  C:\Windows\System32\JVWiAuZ.exe
  2⤵
  PID:6440
- C:\Windows\System32\UvGiTee.exe
  C:\Windows\System32\UvGiTee.exe
  2⤵
  PID:6460
- C:\Windows\System32\rIweajm.exe
  C:\Windows\System32\rIweajm.exe
  2⤵
  PID:6504
- C:\Windows\System32\KEMxhFX.exe
  C:\Windows\System32\KEMxhFX.exe
  2⤵
  PID:6528
- C:\Windows\System32\zksUCfx.exe
  C:\Windows\System32\zksUCfx.exe
  2⤵
  PID:6572
- C:\Windows\System32\EfHSCIJ.exe
  C:\Windows\System32\EfHSCIJ.exe
  2⤵
  PID:6600
- C:\Windows\System32\LRrWGFX.exe
  C:\Windows\System32\LRrWGFX.exe
  2⤵
  PID:6616
- C:\Windows\System32\WJnDZic.exe
  C:\Windows\System32\WJnDZic.exe
  2⤵
  PID:6644
- C:\Windows\System32\pTyBWkD.exe
  C:\Windows\System32\pTyBWkD.exe
  2⤵
  PID:6660
- C:\Windows\System32\jsVVkDH.exe
  C:\Windows\System32\jsVVkDH.exe
  2⤵
  PID:6688
- C:\Windows\System32\SdyacPA.exe
  C:\Windows\System32\SdyacPA.exe
  2⤵
  PID:6724
- C:\Windows\System32\HuhXMrM.exe
  C:\Windows\System32\HuhXMrM.exe
  2⤵
  PID:6744
- C:\Windows\System32\ijtEwVU.exe
  C:\Windows\System32\ijtEwVU.exe
  2⤵
  PID:6812
- C:\Windows\System32\wBGxtGY.exe
  C:\Windows\System32\wBGxtGY.exe
  2⤵
  PID:6828
- C:\Windows\System32\hLJkwlY.exe
  C:\Windows\System32\hLJkwlY.exe
  2⤵
  PID:6860
- C:\Windows\System32\SuSdjtG.exe
  C:\Windows\System32\SuSdjtG.exe
  2⤵
  PID:6880
- C:\Windows\System32\ZKebSCJ.exe
  C:\Windows\System32\ZKebSCJ.exe
  2⤵
  PID:6912
- C:\Windows\System32\oPJzHaQ.exe
  C:\Windows\System32\oPJzHaQ.exe
  2⤵
  PID:6928
- C:\Windows\System32\UITUiay.exe
  C:\Windows\System32\UITUiay.exe
  2⤵
  PID:6960
- C:\Windows\System32\ZuCVcZE.exe
  C:\Windows\System32\ZuCVcZE.exe
  2⤵
  PID:6988
- C:\Windows\System32\KzexYmQ.exe
  C:\Windows\System32\KzexYmQ.exe
  2⤵
  PID:7032
- C:\Windows\System32\mRraenK.exe
  C:\Windows\System32\mRraenK.exe
  2⤵
  PID:7056
- C:\Windows\System32\QAaNFOe.exe
  C:\Windows\System32\QAaNFOe.exe
  2⤵
  PID:7076
- C:\Windows\System32\NtCoJVX.exe
  C:\Windows\System32\NtCoJVX.exe
  2⤵
  PID:7108
- C:\Windows\System32\fxqyzQo.exe
  C:\Windows\System32\fxqyzQo.exe
  2⤵
  PID:7128
- C:\Windows\System32\NRkGosk.exe
  C:\Windows\System32\NRkGosk.exe
  2⤵
  PID:7148
- C:\Windows\System32\HBnvxys.exe
  C:\Windows\System32\HBnvxys.exe
  2⤵
  PID:6160
- C:\Windows\System32\dXUPYPO.exe
  C:\Windows\System32\dXUPYPO.exe
  2⤵
  PID:6256
- C:\Windows\System32\xkPwPXk.exe
  C:\Windows\System32\xkPwPXk.exe
  2⤵
  PID:6284
- C:\Windows\System32\HXbMxaS.exe
  C:\Windows\System32\HXbMxaS.exe
  2⤵
  PID:6340
- C:\Windows\System32\dDCZNAI.exe
  C:\Windows\System32\dDCZNAI.exe
  2⤵
  PID:6412
- C:\Windows\System32\yHIBiEL.exe
  C:\Windows\System32\yHIBiEL.exe
  2⤵
  PID:6396
- C:\Windows\System32\jvMEBhb.exe
  C:\Windows\System32\jvMEBhb.exe
  2⤵
  PID:6476
- C:\Windows\System32\LyDREPI.exe
  C:\Windows\System32\LyDREPI.exe
  2⤵
  PID:6540
- C:\Windows\System32\mtcyHbc.exe
  C:\Windows\System32\mtcyHbc.exe
  2⤵
  PID:6652
- C:\Windows\System32\rXsiFfC.exe
  C:\Windows\System32\rXsiFfC.exe
  2⤵
  PID:6684
- C:\Windows\System32\YaqOieE.exe
  C:\Windows\System32\YaqOieE.exe
  2⤵
  PID:6852
- C:\Windows\System32\KMnrNOO.exe
  C:\Windows\System32\KMnrNOO.exe
  2⤵
  PID:6876
- C:\Windows\System32\jyEsaDw.exe
  C:\Windows\System32\jyEsaDw.exe
  2⤵
  PID:6948
- C:\Windows\System32\ikogETt.exe
  C:\Windows\System32\ikogETt.exe
  2⤵
  PID:6972
- C:\Windows\System32\pSPjDdz.exe
  C:\Windows\System32\pSPjDdz.exe
  2⤵
  PID:7068
- C:\Windows\System32\BoIDRqV.exe
  C:\Windows\System32\BoIDRqV.exe
  2⤵
  PID:7140
- C:\Windows\System32\hcTZfYD.exe
  C:\Windows\System32\hcTZfYD.exe
  2⤵
  PID:5928
- C:\Windows\System32\RWpMaDe.exe
  C:\Windows\System32\RWpMaDe.exe
  2⤵
  PID:6312
- C:\Windows\System32\jKFKJsF.exe
  C:\Windows\System32\jKFKJsF.exe
  2⤵
  PID:6368
- C:\Windows\System32\abTizwZ.exe
  C:\Windows\System32\abTizwZ.exe
  2⤵
  PID:6608
- C:\Windows\System32\kNNlppS.exe
  C:\Windows\System32\kNNlppS.exe
  2⤵
  PID:6788
- C:\Windows\System32\RZAHERI.exe
  C:\Windows\System32\RZAHERI.exe
  2⤵
  PID:6952
- C:\Windows\System32\QChVuJh.exe
  C:\Windows\System32\QChVuJh.exe
  2⤵
  PID:7048
- C:\Windows\System32\VmgnwZE.exe
  C:\Windows\System32\VmgnwZE.exe
  2⤵
  PID:6308
- C:\Windows\System32\qrxLoFt.exe
  C:\Windows\System32\qrxLoFt.exe
  2⤵
  PID:6388
- C:\Windows\System32\grYChCO.exe
  C:\Windows\System32\grYChCO.exe
  2⤵
  PID:6836
- C:\Windows\System32\NyWYxUN.exe
  C:\Windows\System32\NyWYxUN.exe
  2⤵
  PID:6956
- C:\Windows\System32\dkTpoIv.exe
  C:\Windows\System32\dkTpoIv.exe
  2⤵
  PID:7180
- C:\Windows\System32\QKczMUo.exe
  C:\Windows\System32\QKczMUo.exe
  2⤵
  PID:7208
- C:\Windows\System32\sMUChfu.exe
  C:\Windows\System32\sMUChfu.exe
  2⤵
  PID:7232
- C:\Windows\System32\FRFrTmK.exe
  C:\Windows\System32\FRFrTmK.exe
  2⤵
  PID:7264
- C:\Windows\System32\gCNXQdc.exe
  C:\Windows\System32\gCNXQdc.exe
  2⤵
  PID:7288
- C:\Windows\System32\UsaGxEZ.exe
  C:\Windows\System32\UsaGxEZ.exe
  2⤵
  PID:7332
- C:\Windows\System32\YuVYlPN.exe
  C:\Windows\System32\YuVYlPN.exe
  2⤵
  PID:7348
- C:\Windows\System32\MYbIuNE.exe
  C:\Windows\System32\MYbIuNE.exe
  2⤵
  PID:7368
- C:\Windows\System32\DKQKwWE.exe
  C:\Windows\System32\DKQKwWE.exe
  2⤵
  PID:7400
- C:\Windows\System32\PfUGCEl.exe
  C:\Windows\System32\PfUGCEl.exe
  2⤵
  PID:7420
- C:\Windows\System32\sQkhRvr.exe
  C:\Windows\System32\sQkhRvr.exe
  2⤵
  PID:7460
- C:\Windows\System32\PfAzBJR.exe
  C:\Windows\System32\PfAzBJR.exe
  2⤵
  PID:7488
- C:\Windows\System32\QzLSLpe.exe
  C:\Windows\System32\QzLSLpe.exe
  2⤵
  PID:7520
- C:\Windows\System32\zFepRxR.exe
  C:\Windows\System32\zFepRxR.exe
  2⤵
  PID:7540
- C:\Windows\System32\VfaELgI.exe
  C:\Windows\System32\VfaELgI.exe
  2⤵
  PID:7576
- C:\Windows\System32\uPwIoeH.exe
  C:\Windows\System32\uPwIoeH.exe
  2⤵
  PID:7592
- C:\Windows\System32\CPCCyxa.exe
  C:\Windows\System32\CPCCyxa.exe
  2⤵
  PID:7620
- C:\Windows\System32\zqCFPzO.exe
  C:\Windows\System32\zqCFPzO.exe
  2⤵
  PID:7640
- C:\Windows\System32\dyleOXa.exe
  C:\Windows\System32\dyleOXa.exe
  2⤵
  PID:7656
- C:\Windows\System32\RnFwESv.exe
  C:\Windows\System32\RnFwESv.exe
  2⤵
  PID:7696
- C:\Windows\System32\rlpNngG.exe
  C:\Windows\System32\rlpNngG.exe
  2⤵
  PID:7740
- C:\Windows\System32\vlGbvaF.exe
  C:\Windows\System32\vlGbvaF.exe
  2⤵
  PID:7760
- C:\Windows\System32\hYVGHvj.exe
  C:\Windows\System32\hYVGHvj.exe
  2⤵
  PID:7784
- C:\Windows\System32\PlJIgZq.exe
  C:\Windows\System32\PlJIgZq.exe
  2⤵
  PID:7824
- C:\Windows\System32\fqEwdCg.exe
  C:\Windows\System32\fqEwdCg.exe
  2⤵
  PID:7860
- C:\Windows\System32\vCEqNiJ.exe
  C:\Windows\System32\vCEqNiJ.exe
  2⤵
  PID:7884
- C:\Windows\System32\fEWPBMf.exe
  C:\Windows\System32\fEWPBMf.exe
  2⤵
  PID:7904
- C:\Windows\System32\anpjnuW.exe
  C:\Windows\System32\anpjnuW.exe
  2⤵
  PID:7932
- C:\Windows\System32\qURrFln.exe
  C:\Windows\System32\qURrFln.exe
  2⤵
  PID:7960
- C:\Windows\System32\QPcaCdz.exe
  C:\Windows\System32\QPcaCdz.exe
  2⤵
  PID:7984
- C:\Windows\System32\PeTGJkx.exe
  C:\Windows\System32\PeTGJkx.exe
  2⤵
  PID:8032
- C:\Windows\System32\XDWRxor.exe
  C:\Windows\System32\XDWRxor.exe
  2⤵
  PID:8052
- C:\Windows\System32\HeDXibt.exe
  C:\Windows\System32\HeDXibt.exe
  2⤵
  PID:8072
- C:\Windows\System32\QPGfpZi.exe
  C:\Windows\System32\QPGfpZi.exe
  2⤵
  PID:8112
- C:\Windows\System32\ngEBuSX.exe
  C:\Windows\System32\ngEBuSX.exe
  2⤵
  PID:8136
- C:\Windows\System32\LsitOcG.exe
  C:\Windows\System32\LsitOcG.exe
  2⤵
  PID:8152
- C:\Windows\System32\tVCyvPl.exe
  C:\Windows\System32\tVCyvPl.exe
  2⤵
  PID:8176
- C:\Windows\System32\oPlZkZG.exe
  C:\Windows\System32\oPlZkZG.exe
  2⤵
  PID:7260
- C:\Windows\System32\icoobEm.exe
  C:\Windows\System32\icoobEm.exe
  2⤵
  PID:7296
- C:\Windows\System32\HHQSDuX.exe
  C:\Windows\System32\HHQSDuX.exe
  2⤵
  PID:7376
- C:\Windows\System32\xUNHJcG.exe
  C:\Windows\System32\xUNHJcG.exe
  2⤵
  PID:7392
- C:\Windows\System32\qMpRBql.exe
  C:\Windows\System32\qMpRBql.exe
  2⤵
  PID:7472
- C:\Windows\System32\ozTBFkz.exe
  C:\Windows\System32\ozTBFkz.exe
  2⤵
  PID:7532
- C:\Windows\System32\RtQhUla.exe
  C:\Windows\System32\RtQhUla.exe
  2⤵
  PID:7568
- C:\Windows\System32\vRDMCfQ.exe
  C:\Windows\System32\vRDMCfQ.exe
  2⤵
  PID:7616
- C:\Windows\System32\JEokWsJ.exe
  C:\Windows\System32\JEokWsJ.exe
  2⤵
  PID:7652
- C:\Windows\System32\RTnnPxB.exe
  C:\Windows\System32\RTnnPxB.exe
  2⤵
  PID:7780
- C:\Windows\System32\qnQlxoO.exe
  C:\Windows\System32\qnQlxoO.exe
  2⤵
  PID:7876
- C:\Windows\System32\dkOjAYk.exe
  C:\Windows\System32\dkOjAYk.exe
  2⤵
  PID:7968
- C:\Windows\System32\EaangND.exe
  C:\Windows\System32\EaangND.exe
  2⤵
  PID:8028
- C:\Windows\System32\OBeMrVY.exe
  C:\Windows\System32\OBeMrVY.exe
  2⤵
  PID:8128
- C:\Windows\System32\IevbQgN.exe
  C:\Windows\System32\IevbQgN.exe
  2⤵
  PID:8168
- C:\Windows\System32\rmRYGFy.exe
  C:\Windows\System32\rmRYGFy.exe
  2⤵
  PID:7272
- C:\Windows\System32\bQUnsod.exe
  C:\Windows\System32\bQUnsod.exe
  2⤵
  PID:7356
- C:\Windows\System32\fETeKnh.exe
  C:\Windows\System32\fETeKnh.exe
  2⤵
  PID:7444
- C:\Windows\System32\WEcjfIs.exe
  C:\Windows\System32\WEcjfIs.exe
  2⤵
  PID:7588
- C:\Windows\System32\pKikPPz.exe
  C:\Windows\System32\pKikPPz.exe
  2⤵
  PID:7872
- C:\Windows\System32\xWZhVBI.exe
  C:\Windows\System32\xWZhVBI.exe
  2⤵
  PID:7940
- C:\Windows\System32\lpuvynk.exe
  C:\Windows\System32\lpuvynk.exe
  2⤵
  PID:8060
- C:\Windows\System32\NaqFFlZ.exe
  C:\Windows\System32\NaqFFlZ.exe
  2⤵
  PID:7220
- C:\Windows\System32\KyrzXDr.exe
  C:\Windows\System32\KyrzXDr.exe
  2⤵
  PID:7508
- C:\Windows\System32\OIQvwfd.exe
  C:\Windows\System32\OIQvwfd.exe
  2⤵
  PID:8068
- C:\Windows\System32\oQigFYd.exe
  C:\Windows\System32\oQigFYd.exe
  2⤵
  PID:8000
- C:\Windows\System32\SYnbfZr.exe
  C:\Windows\System32\SYnbfZr.exe
  2⤵
  PID:8200
- C:\Windows\System32\ENXGzxq.exe
  C:\Windows\System32\ENXGzxq.exe
  2⤵
  PID:8232
- C:\Windows\System32\VFyFeTc.exe
  C:\Windows\System32\VFyFeTc.exe
  2⤵
  PID:8252
- C:\Windows\System32\vybbwND.exe
  C:\Windows\System32\vybbwND.exe
  2⤵
  PID:8296
- C:\Windows\System32\rRyDNce.exe
  C:\Windows\System32\rRyDNce.exe
  2⤵
  PID:8320
- C:\Windows\System32\GLnkGOb.exe
  C:\Windows\System32\GLnkGOb.exe
  2⤵
  PID:8340
- C:\Windows\System32\KhgYKsA.exe
  C:\Windows\System32\KhgYKsA.exe
  2⤵
  PID:8388
- C:\Windows\System32\lSkRRno.exe
  C:\Windows\System32\lSkRRno.exe
  2⤵
  PID:8412
- C:\Windows\System32\LYHytBx.exe
  C:\Windows\System32\LYHytBx.exe
  2⤵
  PID:8428
- C:\Windows\System32\FKIoMQb.exe
  C:\Windows\System32\FKIoMQb.exe
  2⤵
  PID:8456
- C:\Windows\System32\yZgrBDn.exe
  C:\Windows\System32\yZgrBDn.exe
  2⤵
  PID:8484
- C:\Windows\System32\pGwjMCu.exe
  C:\Windows\System32\pGwjMCu.exe
  2⤵
  PID:8516
- C:\Windows\System32\FYcUBhg.exe
  C:\Windows\System32\FYcUBhg.exe
  2⤵
  PID:8532
- C:\Windows\System32\dpfUiRm.exe
  C:\Windows\System32\dpfUiRm.exe
  2⤵
  PID:8572
- C:\Windows\System32\diZexpx.exe
  C:\Windows\System32\diZexpx.exe
  2⤵
  PID:8604
- C:\Windows\System32\domiwst.exe
  C:\Windows\System32\domiwst.exe
  2⤵
  PID:8624
- C:\Windows\System32\bCURvwL.exe
  C:\Windows\System32\bCURvwL.exe
  2⤵
  PID:8664
- C:\Windows\System32\SbISvHQ.exe
  C:\Windows\System32\SbISvHQ.exe
  2⤵
  PID:8680
- C:\Windows\System32\JlnYWRS.exe
  C:\Windows\System32\JlnYWRS.exe
  2⤵
  PID:8720
- C:\Windows\System32\VEOmQDu.exe
  C:\Windows\System32\VEOmQDu.exe
  2⤵
  PID:8748
- C:\Windows\System32\tEpRYgc.exe
  C:\Windows\System32\tEpRYgc.exe
  2⤵
  PID:8772
- C:\Windows\System32\YQXYYNF.exe
  C:\Windows\System32\YQXYYNF.exe
  2⤵
  PID:8800
- C:\Windows\System32\vdfZWTY.exe
  C:\Windows\System32\vdfZWTY.exe
  2⤵
  PID:8852
- C:\Windows\System32\MVGnofe.exe
  C:\Windows\System32\MVGnofe.exe
  2⤵
  PID:8988
- C:\Windows\System32\gzceZTK.exe
  C:\Windows\System32\gzceZTK.exe
  2⤵
  PID:9004
- C:\Windows\System32\GIRZewd.exe
  C:\Windows\System32\GIRZewd.exe
  2⤵
  PID:9020
- C:\Windows\System32\DUBeoot.exe
  C:\Windows\System32\DUBeoot.exe
  2⤵
  PID:9036
- C:\Windows\System32\DGTdUJr.exe
  C:\Windows\System32\DGTdUJr.exe
  2⤵
  PID:9052
- C:\Windows\System32\AixyXPe.exe
  C:\Windows\System32\AixyXPe.exe
  2⤵
  PID:9068
- C:\Windows\System32\DznHKLq.exe
  C:\Windows\System32\DznHKLq.exe
  2⤵
  PID:9084
- C:\Windows\System32\HWQhHah.exe
  C:\Windows\System32\HWQhHah.exe
  2⤵
  PID:9100
- C:\Windows\System32\FxuOEsm.exe
  C:\Windows\System32\FxuOEsm.exe
  2⤵
  PID:9144
- C:\Windows\System32\rGpasZg.exe
  C:\Windows\System32\rGpasZg.exe
  2⤵
  PID:9180
- C:\Windows\System32\jvqNDtU.exe
  C:\Windows\System32\jvqNDtU.exe
  2⤵
  PID:7440
- C:\Windows\System32\sUekkYW.exe
  C:\Windows\System32\sUekkYW.exe
  2⤵
  PID:8248
- C:\Windows\System32\ADHiohF.exe
  C:\Windows\System32\ADHiohF.exe
  2⤵
  PID:8404
- C:\Windows\System32\oNImroM.exe
  C:\Windows\System32\oNImroM.exe
  2⤵
  PID:8448
- C:\Windows\System32\aEJJlGd.exe
  C:\Windows\System32\aEJJlGd.exe
  2⤵
  PID:8508
- C:\Windows\System32\nMKULVK.exe
  C:\Windows\System32\nMKULVK.exe
  2⤵
  PID:8600
- C:\Windows\System32\gvtxYZJ.exe
  C:\Windows\System32\gvtxYZJ.exe
  2⤵
  PID:8660
- C:\Windows\System32\PCcxHwJ.exe
  C:\Windows\System32\PCcxHwJ.exe
  2⤵
  PID:8716
- C:\Windows\System32\CKmsRlY.exe
  C:\Windows\System32\CKmsRlY.exe
  2⤵
  PID:8780
- C:\Windows\System32\XHlbDYJ.exe
  C:\Windows\System32\XHlbDYJ.exe
  2⤵
  PID:8836
- C:\Windows\System32\UDpRRph.exe
  C:\Windows\System32\UDpRRph.exe
  2⤵
  PID:8916
- C:\Windows\System32\LNjFlQR.exe
  C:\Windows\System32\LNjFlQR.exe
  2⤵
  PID:8948
- C:\Windows\System32\szqiquY.exe
  C:\Windows\System32\szqiquY.exe
  2⤵
  PID:8876
- C:\Windows\System32\SDYTGAo.exe
  C:\Windows\System32\SDYTGAo.exe
  2⤵
  PID:8928
- C:\Windows\System32\DlLOayk.exe
  C:\Windows\System32\DlLOayk.exe
  2⤵
  PID:8980
- C:\Windows\System32\OVugcFV.exe
  C:\Windows\System32\OVugcFV.exe
  2⤵
  PID:9120
- C:\Windows\System32\ToVEXEb.exe
  C:\Windows\System32\ToVEXEb.exe
  2⤵
  PID:9188
- C:\Windows\System32\yQBkAva.exe
  C:\Windows\System32\yQBkAva.exe
  2⤵
  PID:9160
- C:\Windows\System32\crrVzKx.exe
  C:\Windows\System32\crrVzKx.exe
  2⤵
  PID:8272
- C:\Windows\System32\KhYGEcr.exe
  C:\Windows\System32\KhYGEcr.exe
  2⤵
  PID:8408
- C:\Windows\System32\yGLhfNC.exe
  C:\Windows\System32\yGLhfNC.exe
  2⤵
  PID:8656
- C:\Windows\System32\IxgeqSo.exe
  C:\Windows\System32\IxgeqSo.exe
  2⤵
  PID:8700
- C:\Windows\System32\OvXTJXL.exe
  C:\Windows\System32\OvXTJXL.exe
  2⤵
  PID:8880
- C:\Windows\System32\wuTFCTd.exe
  C:\Windows\System32\wuTFCTd.exe
  2⤵
  PID:8984
- C:\Windows\System32\OalPBYY.exe
  C:\Windows\System32\OalPBYY.exe
  2⤵
  PID:8968
- C:\Windows\System32\HMarjlG.exe
  C:\Windows\System32\HMarjlG.exe
  2⤵
  PID:7304
- C:\Windows\System32\UZZpFHX.exe
  C:\Windows\System32\UZZpFHX.exe
  2⤵
  PID:8620
- C:\Windows\System32\qptfqeA.exe
  C:\Windows\System32\qptfqeA.exe
  2⤵
  PID:8696
- C:\Windows\System32\lckWZqm.exe
  C:\Windows\System32\lckWZqm.exe
  2⤵
  PID:8376
- C:\Windows\System32\kNmktEC.exe
  C:\Windows\System32\kNmktEC.exe
  2⤵
  PID:8352
- C:\Windows\System32\YEeCzpE.exe
  C:\Windows\System32\YEeCzpE.exe
  2⤵
  PID:8952
- C:\Windows\System32\hxpqtAi.exe
  C:\Windows\System32\hxpqtAi.exe
  2⤵
  PID:9224
- C:\Windows\System32\NiaYqsL.exe
  C:\Windows\System32\NiaYqsL.exe
  2⤵
  PID:9244
- C:\Windows\System32\amKpaCE.exe
  C:\Windows\System32\amKpaCE.exe
  2⤵
  PID:9296
- C:\Windows\System32\BlJNJqB.exe
  C:\Windows\System32\BlJNJqB.exe
  2⤵
  PID:9332
- C:\Windows\System32\qfhSmKy.exe
  C:\Windows\System32\qfhSmKy.exe
  2⤵
  PID:9356
- C:\Windows\System32\lXPcXfV.exe
  C:\Windows\System32\lXPcXfV.exe
  2⤵
  PID:9376
- C:\Windows\System32\nPlsstQ.exe
  C:\Windows\System32\nPlsstQ.exe
  2⤵
  PID:9416
- C:\Windows\System32\bMcpsZs.exe
  C:\Windows\System32\bMcpsZs.exe
  2⤵
  PID:9444
- C:\Windows\System32\MXLCEjf.exe
  C:\Windows\System32\MXLCEjf.exe
  2⤵
  PID:9468
- C:\Windows\System32\ZqHrYzM.exe
  C:\Windows\System32\ZqHrYzM.exe
  2⤵
  PID:9496
- C:\Windows\System32\ixVUijR.exe
  C:\Windows\System32\ixVUijR.exe
  2⤵
  PID:9524
- C:\Windows\System32\lYpPEmb.exe
  C:\Windows\System32\lYpPEmb.exe
  2⤵
  PID:9556
- C:\Windows\System32\cjZzcUS.exe
  C:\Windows\System32\cjZzcUS.exe
  2⤵
  PID:9580
- C:\Windows\System32\OWsucMF.exe
  C:\Windows\System32\OWsucMF.exe
  2⤵
  PID:9608
- C:\Windows\System32\qPPslUS.exe
  C:\Windows\System32\qPPslUS.exe
  2⤵
  PID:9648
- C:\Windows\System32\GvrPXDu.exe
  C:\Windows\System32\GvrPXDu.exe
  2⤵
  PID:9676
- C:\Windows\System32\ryPvrEd.exe
  C:\Windows\System32\ryPvrEd.exe
  2⤵
  PID:9696
- C:\Windows\System32\tbjAYMU.exe
  C:\Windows\System32\tbjAYMU.exe
  2⤵
  PID:9724
- C:\Windows\System32\jWlhQTd.exe
  C:\Windows\System32\jWlhQTd.exe
  2⤵
  PID:9756
- C:\Windows\System32\tyLnWcM.exe
  C:\Windows\System32\tyLnWcM.exe
  2⤵
  PID:9776
- C:\Windows\System32\PckGzGj.exe
  C:\Windows\System32\PckGzGj.exe
  2⤵
  PID:9804
- C:\Windows\System32\pdafwHn.exe
  C:\Windows\System32\pdafwHn.exe
  2⤵
  PID:9840
- C:\Windows\System32\tKLMjWc.exe
  C:\Windows\System32\tKLMjWc.exe
  2⤵
  PID:9872
- C:\Windows\System32\TbYQYbU.exe
  C:\Windows\System32\TbYQYbU.exe
  2⤵
  PID:9896
- C:\Windows\System32\juDdSuc.exe
  C:\Windows\System32\juDdSuc.exe
  2⤵
  PID:9920
- C:\Windows\System32\XKmbrAM.exe
  C:\Windows\System32\XKmbrAM.exe
  2⤵
  PID:9952
- C:\Windows\System32\XTUOKCU.exe
  C:\Windows\System32\XTUOKCU.exe
  2⤵
  PID:9972
- C:\Windows\System32\dYHxPEM.exe
  C:\Windows\System32\dYHxPEM.exe
  2⤵
  PID:9992
- C:\Windows\System32\KTrxhDJ.exe
  C:\Windows\System32\KTrxhDJ.exe
  2⤵
  PID:10016
- C:\Windows\System32\WAyFBSA.exe
  C:\Windows\System32\WAyFBSA.exe
  2⤵
  PID:10048
- C:\Windows\System32\JJMRQNF.exe
  C:\Windows\System32\JJMRQNF.exe
  2⤵
  PID:10064
- C:\Windows\System32\LtGZaXe.exe
  C:\Windows\System32\LtGZaXe.exe
  2⤵
  PID:10092
- C:\Windows\System32\mBFobbW.exe
  C:\Windows\System32\mBFobbW.exe
  2⤵
  PID:10120
- C:\Windows\System32\tkaAcVK.exe
  C:\Windows\System32\tkaAcVK.exe
  2⤵
  PID:10156
- C:\Windows\System32\VQNUyUa.exe
  C:\Windows\System32\VQNUyUa.exe
  2⤵
  PID:10184
- C:\Windows\System32\beVRWiw.exe
  C:\Windows\System32\beVRWiw.exe
  2⤵
  PID:9232
- C:\Windows\System32\eVcnTvC.exe
  C:\Windows\System32\eVcnTvC.exe
  2⤵
  PID:9284
- C:\Windows\System32\PAmPtGy.exe
  C:\Windows\System32\PAmPtGy.exe
  2⤵
  PID:9328
- C:\Windows\System32\RlwNAUL.exe
  C:\Windows\System32\RlwNAUL.exe
  2⤵
  PID:9392
- C:\Windows\System32\OUwkoig.exe
  C:\Windows\System32\OUwkoig.exe
  2⤵
  PID:9460
- C:\Windows\System32\WxktZfY.exe
  C:\Windows\System32\WxktZfY.exe
  2⤵
  PID:9504
- C:\Windows\System32\mUHCqPH.exe
  C:\Windows\System32\mUHCqPH.exe
  2⤵
  PID:9572
- C:\Windows\System32\tkrxHyc.exe
  C:\Windows\System32\tkrxHyc.exe
  2⤵
  PID:9660
- C:\Windows\System32\vffQZVQ.exe
  C:\Windows\System32\vffQZVQ.exe
  2⤵
  PID:9716
- C:\Windows\System32\GuPARkY.exe
  C:\Windows\System32\GuPARkY.exe
  2⤵
  PID:9772
- C:\Windows\System32\aOFvBaz.exe
  C:\Windows\System32\aOFvBaz.exe
  2⤵
  PID:9828
- C:\Windows\System32\mGwwfqo.exe
  C:\Windows\System32\mGwwfqo.exe
  2⤵
  PID:9964
- C:\Windows\System32\yZxNhXu.exe
  C:\Windows\System32\yZxNhXu.exe
  2⤵
  PID:9988
- C:\Windows\System32\yCHUMkR.exe
  C:\Windows\System32\yCHUMkR.exe
  2⤵
  PID:10028
- C:\Windows\System32\XcDOiJE.exe
  C:\Windows\System32\XcDOiJE.exe
  2⤵
  PID:10084
- C:\Windows\System32\oIKhLNJ.exe
  C:\Windows\System32\oIKhLNJ.exe
  2⤵
  PID:8828
- C:\Windows\System32\ZNIXQFX.exe
  C:\Windows\System32\ZNIXQFX.exe
  2⤵
  PID:10204
- C:\Windows\System32\mKvcWEt.exe
  C:\Windows\System32\mKvcWEt.exe
  2⤵
  PID:9324
- C:\Windows\System32\VgQBGUe.exe
  C:\Windows\System32\VgQBGUe.exe
  2⤵
  PID:9484
- C:\Windows\System32\UlYdESp.exe
  C:\Windows\System32\UlYdESp.exe
  2⤵
  PID:9600
- C:\Windows\System32\ilhHuPN.exe
  C:\Windows\System32\ilhHuPN.exe
  2⤵
  PID:9788
- C:\Windows\System32\pVWYxwL.exe
  C:\Windows\System32\pVWYxwL.exe
  2⤵
  PID:9888
- C:\Windows\System32\WCETWnl.exe
  C:\Windows\System32\WCETWnl.exe
  2⤵
  PID:10060
- C:\Windows\System32\FduUchA.exe
  C:\Windows\System32\FduUchA.exe
  2⤵
  PID:10076
- C:\Windows\System32\VpbrtlS.exe
  C:\Windows\System32\VpbrtlS.exe
  2⤵
  PID:9604
- C:\Windows\System32\FpNZZjE.exe
  C:\Windows\System32\FpNZZjE.exe
  2⤵
  PID:9800
- C:\Windows\System32\fcGkNEM.exe
  C:\Windows\System32\fcGkNEM.exe
  2⤵
  PID:9768
- C:\Windows\System32\FSbPniR.exe
  C:\Windows\System32\FSbPniR.exe
  2⤵
  PID:10148
- C:\Windows\System32\xdTecyK.exe
  C:\Windows\System32\xdTecyK.exe
  2⤵
  PID:10256
- C:\Windows\System32\zPtrtaD.exe
  C:\Windows\System32\zPtrtaD.exe
  2⤵
  PID:10276
- C:\Windows\System32\tPdIxFJ.exe
  C:\Windows\System32\tPdIxFJ.exe
  2⤵
  PID:10296
- C:\Windows\System32\HcvVYBg.exe
  C:\Windows\System32\HcvVYBg.exe
  2⤵
  PID:10324
- C:\Windows\System32\lcWwpMh.exe
  C:\Windows\System32\lcWwpMh.exe
  2⤵
  PID:10344
- C:\Windows\System32\CDhQRwS.exe
  C:\Windows\System32\CDhQRwS.exe
  2⤵
  PID:10388
- C:\Windows\System32\JoFszhP.exe
  C:\Windows\System32\JoFszhP.exe
  2⤵
  PID:10404
- C:\Windows\System32\uIKZOFT.exe
  C:\Windows\System32\uIKZOFT.exe
  2⤵
  PID:10448
- C:\Windows\System32\OgmMpGX.exe
  C:\Windows\System32\OgmMpGX.exe
  2⤵
  PID:10484
- C:\Windows\System32\sKLSnMT.exe
  C:\Windows\System32\sKLSnMT.exe
  2⤵
  PID:10500
- C:\Windows\System32\IGyExYC.exe
  C:\Windows\System32\IGyExYC.exe
  2⤵
  PID:10524
- C:\Windows\System32\CnMzOri.exe
  C:\Windows\System32\CnMzOri.exe
  2⤵
  PID:10556
- C:\Windows\System32\nSBIslN.exe
  C:\Windows\System32\nSBIslN.exe
  2⤵
  PID:10612
- C:\Windows\System32\LMUSZwJ.exe
  C:\Windows\System32\LMUSZwJ.exe
  2⤵
  PID:10632
- C:\Windows\System32\YUKicwV.exe
  C:\Windows\System32\YUKicwV.exe
  2⤵
  PID:10660
- C:\Windows\System32\NoMDKNt.exe
  C:\Windows\System32\NoMDKNt.exe
  2⤵
  PID:10688
- C:\Windows\System32\LIKjYiy.exe
  C:\Windows\System32\LIKjYiy.exe
  2⤵
  PID:10720
- C:\Windows\System32\KFOWkmp.exe
  C:\Windows\System32\KFOWkmp.exe
  2⤵
  PID:10752
- C:\Windows\System32\GvcPuDC.exe
  C:\Windows\System32\GvcPuDC.exe
  2⤵
  PID:10776
- C:\Windows\System32\aqdBUlf.exe
  C:\Windows\System32\aqdBUlf.exe
  2⤵
  PID:10808
- C:\Windows\System32\LkkKpgP.exe
  C:\Windows\System32\LkkKpgP.exe
  2⤵
  PID:10824
- C:\Windows\System32\VSPWdgD.exe
  C:\Windows\System32\VSPWdgD.exe
  2⤵
  PID:10848
- C:\Windows\System32\nMnUSsV.exe
  C:\Windows\System32\nMnUSsV.exe
  2⤵
  PID:10884
- C:\Windows\System32\OGfsXfB.exe
  C:\Windows\System32\OGfsXfB.exe
  2⤵
  PID:10916
- C:\Windows\System32\LAAUzsC.exe
  C:\Windows\System32\LAAUzsC.exe
  2⤵
  PID:10932
- C:\Windows\System32\RUZpYVb.exe
  C:\Windows\System32\RUZpYVb.exe
  2⤵
  PID:10952
- C:\Windows\System32\aYrdCec.exe
  C:\Windows\System32\aYrdCec.exe
  2⤵
  PID:10980
- C:\Windows\System32\btsZzIw.exe
  C:\Windows\System32\btsZzIw.exe
  2⤵
  PID:11004
- C:\Windows\System32\FqPqXKi.exe
  C:\Windows\System32\FqPqXKi.exe
  2⤵
  PID:11024
- C:\Windows\System32\AaOiWks.exe
  C:\Windows\System32\AaOiWks.exe
  2⤵
  PID:11068
- C:\Windows\System32\dbXCTVG.exe
  C:\Windows\System32\dbXCTVG.exe
  2⤵
  PID:11092
- C:\Windows\System32\BMEqKCL.exe
  C:\Windows\System32\BMEqKCL.exe
  2⤵
  PID:11120
- C:\Windows\System32\qsFXSaW.exe
  C:\Windows\System32\qsFXSaW.exe
  2⤵
  PID:11152
- C:\Windows\System32\XdbfXsS.exe
  C:\Windows\System32\XdbfXsS.exe
  2⤵
  PID:11176
- C:\Windows\System32\CBcEekt.exe
  C:\Windows\System32\CBcEekt.exe
  2⤵
  PID:11216
- C:\Windows\System32\LeRfajq.exe
  C:\Windows\System32\LeRfajq.exe
  2⤵
  PID:11244
- C:\Windows\System32\RxaBFKc.exe
  C:\Windows\System32\RxaBFKc.exe
  2⤵
  PID:10248
- C:\Windows\System32\kexWNbM.exe
  C:\Windows\System32\kexWNbM.exe
  2⤵
  PID:10244
- C:\Windows\System32\VLcwwRh.exe
  C:\Windows\System32\VLcwwRh.exe
  2⤵
  PID:10380
- C:\Windows\System32\KrUSwxv.exe
  C:\Windows\System32\KrUSwxv.exe
  2⤵
  PID:10480
- C:\Windows\System32\KHFTeHb.exe
  C:\Windows\System32\KHFTeHb.exe
  2⤵
  PID:10516
- C:\Windows\System32\fZfCvdZ.exe
  C:\Windows\System32\fZfCvdZ.exe
  2⤵
  PID:10608
- C:\Windows\System32\kafNfrE.exe
  C:\Windows\System32\kafNfrE.exe
  2⤵
  PID:10628
- C:\Windows\System32\ULfCGQz.exe
  C:\Windows\System32\ULfCGQz.exe
  2⤵
  PID:10736
- C:\Windows\System32\cntXuXx.exe
  C:\Windows\System32\cntXuXx.exe
  2⤵
  PID:10840
- C:\Windows\System32\aWNuTMq.exe
  C:\Windows\System32\aWNuTMq.exe
  2⤵
  PID:10816
- C:\Windows\System32\kwnrGCa.exe
  C:\Windows\System32\kwnrGCa.exe
  2⤵
  PID:10928
- C:\Windows\System32\FGzxktS.exe
  C:\Windows\System32\FGzxktS.exe
  2⤵
  PID:10964
- C:\Windows\System32\psZnetY.exe
  C:\Windows\System32\psZnetY.exe
  2⤵
  PID:10960
- C:\Windows\System32\AUjiNxv.exe
  C:\Windows\System32\AUjiNxv.exe
  2⤵
  PID:11088
- C:\Windows\System32\ygQSCdG.exe
  C:\Windows\System32\ygQSCdG.exe
  2⤵
  PID:11108
- C:\Windows\System32\LjINRgD.exe
  C:\Windows\System32\LjINRgD.exe
  2⤵
  PID:11212
- C:\Windows\System32\kfUqRGj.exe
  C:\Windows\System32\kfUqRGj.exe
  2⤵
  PID:10360
- C:\Windows\System32\SNEGQAO.exe
  C:\Windows\System32\SNEGQAO.exe
  2⤵
  PID:10468
- C:\Windows\System32\RUFIgIe.exe
  C:\Windows\System32\RUFIgIe.exe
  2⤵
  PID:10544
- C:\Windows\System32\imMCfRM.exe
  C:\Windows\System32\imMCfRM.exe
  2⤵
  PID:10668
- C:\Windows\System32\WdArLwj.exe
  C:\Windows\System32\WdArLwj.exe
  2⤵
  PID:10948
- C:\Windows\System32\EnltBvU.exe
  C:\Windows\System32\EnltBvU.exe
  2⤵
  PID:11076
- C:\Windows\System32\hyOpxgp.exe
  C:\Windows\System32\hyOpxgp.exe
  2⤵
  PID:11240
- C:\Windows\System32\EcfRYtR.exe
  C:\Windows\System32\EcfRYtR.exe
  2⤵
  PID:10312
- C:\Windows\System32\tVQedpA.exe
  C:\Windows\System32\tVQedpA.exe
  2⤵
  PID:11016
- C:\Windows\System32\AHETHsv.exe
  C:\Windows\System32\AHETHsv.exe
  2⤵
  PID:11236
- C:\Windows\System32\fKONZXO.exe
  C:\Windows\System32\fKONZXO.exe
  2⤵
  PID:10624
- C:\Windows\System32\IQNftGi.exe
  C:\Windows\System32\IQNftGi.exe
  2⤵
  PID:11272
- C:\Windows\System32\bVCawgM.exe
  C:\Windows\System32\bVCawgM.exe
  2⤵
  PID:11316
- C:\Windows\System32\QQyRFdW.exe
  C:\Windows\System32\QQyRFdW.exe
  2⤵
  PID:11332
- C:\Windows\System32\noQhmtZ.exe
  C:\Windows\System32\noQhmtZ.exe
  2⤵
  PID:11352
- C:\Windows\System32\WRWYaRD.exe
  C:\Windows\System32\WRWYaRD.exe
  2⤵
  PID:11404
- C:\Windows\System32\JXYgroW.exe
  C:\Windows\System32\JXYgroW.exe
  2⤵
  PID:11420
- C:\Windows\System32\CifNneF.exe
  C:\Windows\System32\CifNneF.exe
  2⤵
  PID:11436
- C:\Windows\System32\dQQHNnZ.exe
  C:\Windows\System32\dQQHNnZ.exe
  2⤵
  PID:11456
- C:\Windows\System32\QeOvqTP.exe
  C:\Windows\System32\QeOvqTP.exe
  2⤵
  PID:11480
- C:\Windows\System32\BeROojZ.exe
  C:\Windows\System32\BeROojZ.exe
  2⤵
  PID:11524
- C:\Windows\System32\zRKYEuV.exe
  C:\Windows\System32\zRKYEuV.exe
  2⤵
  PID:11560
- C:\Windows\System32\WyoqbIa.exe
  C:\Windows\System32\WyoqbIa.exe
  2⤵
  PID:11576
- C:\Windows\System32\TUcpkgz.exe
  C:\Windows\System32\TUcpkgz.exe
  2⤵
  PID:11596
- C:\Windows\System32\TUYVKGt.exe
  C:\Windows\System32\TUYVKGt.exe
  2⤵
  PID:11624
- C:\Windows\System32\nDVcNsv.exe
  C:\Windows\System32\nDVcNsv.exe
  2⤵
  PID:11644
- C:\Windows\System32\OtiWnMb.exe
  C:\Windows\System32\OtiWnMb.exe
  2⤵
  PID:11696
- C:\Windows\System32\DqZPMUu.exe
  C:\Windows\System32\DqZPMUu.exe
  2⤵
  PID:11712
- C:\Windows\System32\EcyzpSK.exe
  C:\Windows\System32\EcyzpSK.exe
  2⤵
  PID:11752
- C:\Windows\System32\Tpoadyy.exe
  C:\Windows\System32\Tpoadyy.exe
  2⤵
  PID:11768
- C:\Windows\System32\iHabQkl.exe
  C:\Windows\System32\iHabQkl.exe
  2⤵
  PID:11792
- C:\Windows\System32\BTiZTIB.exe
  C:\Windows\System32\BTiZTIB.exe
  2⤵
  PID:11808
- C:\Windows\System32\EWMGleE.exe
  C:\Windows\System32\EWMGleE.exe
  2⤵
  PID:11860
- C:\Windows\System32\fWxtOSq.exe
  C:\Windows\System32\fWxtOSq.exe
  2⤵
  PID:11884
- C:\Windows\System32\NdSZrSe.exe
  C:\Windows\System32\NdSZrSe.exe
  2⤵
  PID:11924
- C:\Windows\System32\OzCmpXJ.exe
  C:\Windows\System32\OzCmpXJ.exe
  2⤵
  PID:11944
- C:\Windows\System32\rjSvNAn.exe
  C:\Windows\System32\rjSvNAn.exe
  2⤵
  PID:11976
- C:\Windows\System32\RaYWyRs.exe
  C:\Windows\System32\RaYWyRs.exe
  2⤵
  PID:11996
- C:\Windows\System32\ImrJESy.exe
  C:\Windows\System32\ImrJESy.exe
  2⤵
  PID:12016
- C:\Windows\System32\QBCfOWn.exe
  C:\Windows\System32\QBCfOWn.exe
  2⤵
  PID:12044
- C:\Windows\System32\RZnUzlb.exe
  C:\Windows\System32\RZnUzlb.exe
  2⤵
  PID:12068
- C:\Windows\System32\cQfPKFz.exe
  C:\Windows\System32\cQfPKFz.exe
  2⤵
  PID:12084
- C:\Windows\System32\tNmHbQs.exe
  C:\Windows\System32\tNmHbQs.exe
  2⤵
  PID:12148
- C:\Windows\System32\DMHIxae.exe
  C:\Windows\System32\DMHIxae.exe
  2⤵
  PID:12188
- C:\Windows\System32\iZUwZeS.exe
  C:\Windows\System32\iZUwZeS.exe
  2⤵
  PID:12212
- C:\Windows\System32\TJuobuz.exe
  C:\Windows\System32\TJuobuz.exe
  2⤵
  PID:12232
- C:\Windows\System32\eTDuppJ.exe
  C:\Windows\System32\eTDuppJ.exe
  2⤵
  PID:12272
- C:\Windows\System32\CmDSESB.exe
  C:\Windows\System32\CmDSESB.exe
  2⤵
  PID:11280
- C:\Windows\System32\NMPCZPq.exe
  C:\Windows\System32\NMPCZPq.exe
  2⤵
  PID:11328
- C:\Windows\System32\eqglKQV.exe
  C:\Windows\System32\eqglKQV.exe
  2⤵
  PID:11428
- C:\Windows\System32\cIMUeRJ.exe
  C:\Windows\System32\cIMUeRJ.exe
  2⤵
  PID:11504
- C:\Windows\System32\ZNoJOUH.exe
  C:\Windows\System32\ZNoJOUH.exe
  2⤵
  PID:11548
- C:\Windows\System32\pJrVXxp.exe
  C:\Windows\System32\pJrVXxp.exe
  2⤵
  PID:11588
- C:\Windows\System32\zoyUtpT.exe
  C:\Windows\System32\zoyUtpT.exe
  2⤵
  PID:11640
- C:\Windows\System32\dIzNpen.exe
  C:\Windows\System32\dIzNpen.exe
  2⤵
  PID:11704
- C:\Windows\System32\rJEhcSy.exe
  C:\Windows\System32\rJEhcSy.exe
  2⤵
  PID:11764
- C:\Windows\System32\kginPnY.exe
  C:\Windows\System32\kginPnY.exe
  2⤵
  PID:11828
- C:\Windows\System32\rQEUtMr.exe
  C:\Windows\System32\rQEUtMr.exe
  2⤵
  PID:11856
- C:\Windows\System32\PEOrfOF.exe
  C:\Windows\System32\PEOrfOF.exe
  2⤵
  PID:11932
- C:\Windows\System32\qtmMevW.exe
  C:\Windows\System32\qtmMevW.exe
  2⤵
  PID:12052
- C:\Windows\System32\dwigpye.exe
  C:\Windows\System32\dwigpye.exe
  2⤵
  PID:12116
- C:\Windows\System32\YpAdTZr.exe
  C:\Windows\System32\YpAdTZr.exe
  2⤵
  PID:12176
- C:\Windows\System32\fUiOrwq.exe
  C:\Windows\System32\fUiOrwq.exe
  2⤵
  PID:12268
- C:\Windows\System32\bXdsxCB.exe
  C:\Windows\System32\bXdsxCB.exe
  2⤵
  PID:11392
- C:\Windows\System32\qlwSfRV.exe
  C:\Windows\System32\qlwSfRV.exe
  2⤵
  PID:11492
- C:\Windows\System32\jGmTfAv.exe
  C:\Windows\System32\jGmTfAv.exe
  2⤵
  PID:11728
- C:\Windows\System32\WDxGAvi.exe
  C:\Windows\System32\WDxGAvi.exe
  2⤵
  PID:11736
- C:\Windows\System32\XzvAfFw.exe
  C:\Windows\System32\XzvAfFw.exe
  2⤵
  PID:11984
- C:\Windows\System32\bTExZQs.exe
  C:\Windows\System32\bTExZQs.exe
  2⤵
  PID:1396
- C:\Windows\System32\NSWbmNd.exe
  C:\Windows\System32\NSWbmNd.exe
  2⤵
  PID:12256
- C:\Windows\System32\DqkTsPK.exe
  C:\Windows\System32\DqkTsPK.exe
  2⤵
  PID:11472
- C:\Windows\System32\sBFNHJp.exe
  C:\Windows\System32\sBFNHJp.exe
  2⤵
  PID:11660
- C:\Windows\System32\oWWHRIP.exe
  C:\Windows\System32\oWWHRIP.exe
  2⤵
  PID:12172
- C:\Windows\System32\gUPvgMK.exe
  C:\Windows\System32\gUPvgMK.exe
  2⤵
  PID:11388
- C:\Windows\System32\naDRKus.exe
  C:\Windows\System32\naDRKus.exe
  2⤵
  PID:12308
- C:\Windows\System32\SZyAAZg.exe
  C:\Windows\System32\SZyAAZg.exe
  2⤵
  PID:12360
- C:\Windows\System32\JDbpyJR.exe
  C:\Windows\System32\JDbpyJR.exe
  2⤵
  PID:12384
- C:\Windows\System32\HGOURLm.exe
  C:\Windows\System32\HGOURLm.exe
  2⤵
  PID:12408
- C:\Windows\System32\cGejrHu.exe
  C:\Windows\System32\cGejrHu.exe
  2⤵
  PID:12428
- C:\Windows\System32\EULFqMG.exe
  C:\Windows\System32\EULFqMG.exe
  2⤵
  PID:12472
- C:\Windows\System32\iCFOBrB.exe
  C:\Windows\System32\iCFOBrB.exe
  2⤵
  PID:12496
- C:\Windows\System32\LCDeLsU.exe
  C:\Windows\System32\LCDeLsU.exe
  2⤵
  PID:12520
- C:\Windows\System32\imBZqYm.exe
  C:\Windows\System32\imBZqYm.exe
  2⤵
  PID:12540
- C:\Windows\System32\REyLdXo.exe
  C:\Windows\System32\REyLdXo.exe
  2⤵
  PID:12568
- C:\Windows\System32\VnCHzkE.exe
  C:\Windows\System32\VnCHzkE.exe
  2⤵
  PID:12588
- C:\Windows\System32\cdhjUXs.exe
  C:\Windows\System32\cdhjUXs.exe
  2⤵
  PID:12612
- C:\Windows\System32\umOYZyP.exe
  C:\Windows\System32\umOYZyP.exe
  2⤵
  PID:12652
- C:\Windows\System32\NyenBgQ.exe
  C:\Windows\System32\NyenBgQ.exe
  2⤵
  PID:12672
- C:\Windows\System32\bzjYHRi.exe
  C:\Windows\System32\bzjYHRi.exe
  2⤵
  PID:12688
- C:\Windows\System32\IoDBncI.exe
  C:\Windows\System32\IoDBncI.exe
  2⤵
  PID:12712
- C:\Windows\System32\eIYxdAS.exe
  C:\Windows\System32\eIYxdAS.exe
  2⤵
  PID:12740
- C:\Windows\System32\kXCAOth.exe
  C:\Windows\System32\kXCAOth.exe
  2⤵
  PID:12796
- C:\Windows\System32\TBIlUqF.exe
  C:\Windows\System32\TBIlUqF.exe
  2⤵
  PID:12824
- C:\Windows\System32\nJWnzNU.exe
  C:\Windows\System32\nJWnzNU.exe
  2⤵
  PID:12860
- C:\Windows\System32\lILwPne.exe
  C:\Windows\System32\lILwPne.exe
  2⤵
  PID:12876
- C:\Windows\System32\RjlLhWP.exe
  C:\Windows\System32\RjlLhWP.exe
  2⤵
  PID:12904
- C:\Windows\System32\bMEeFOW.exe
  C:\Windows\System32\bMEeFOW.exe
  2⤵
  PID:12936
- C:\Windows\System32\WgsDlkR.exe
  C:\Windows\System32\WgsDlkR.exe
  2⤵
  PID:12960
- C:\Windows\System32\EdCMOsQ.exe
  C:\Windows\System32\EdCMOsQ.exe
  2⤵
  PID:12976
- C:\Windows\System32\wIFMHcW.exe
  C:\Windows\System32\wIFMHcW.exe
  2⤵
  PID:12996
- C:\Windows\System32\RcGtxAN.exe
  C:\Windows\System32\RcGtxAN.exe
  2⤵
  PID:13032
- C:\Windows\System32\MZdgRDD.exe
  C:\Windows\System32\MZdgRDD.exe
  2⤵
  PID:13084
- C:\Windows\System32\lIHakcO.exe
  C:\Windows\System32\lIHakcO.exe
  2⤵
  PID:13104
- C:\Windows\System32\STNhPFx.exe
  C:\Windows\System32\STNhPFx.exe
  2⤵
  PID:13148
- C:\Windows\System32\HbqDUOV.exe
  C:\Windows\System32\HbqDUOV.exe
  2⤵
  PID:13164
- C:\Windows\System32\cQhbUim.exe
  C:\Windows\System32\cQhbUim.exe
  2⤵
  PID:13196
- C:\Windows\System32\lsyPaHR.exe
  C:\Windows\System32\lsyPaHR.exe
  2⤵
  PID:13228
- C:\Windows\System32\tcNQojr.exe
  C:\Windows\System32\tcNQojr.exe
  2⤵
  PID:13252
- C:\Windows\System32\jEyYnCB.exe
  C:\Windows\System32\jEyYnCB.exe
  2⤵
  PID:13268
- C:\Windows\System32\aUUxEby.exe
  C:\Windows\System32\aUUxEby.exe
  2⤵
  PID:13288
- C:\Windows\System32\JUhkYHM.exe
  C:\Windows\System32\JUhkYHM.exe
  2⤵
  PID:13308
- C:\Windows\System32\JIWvems.exe
  C:\Windows\System32\JIWvems.exe
  2⤵
  PID:12344
- C:\Windows\System32\MnIcNHW.exe
  C:\Windows\System32\MnIcNHW.exe
  2⤵
  PID:12396
- C:\Windows\System32\ezMfOcF.exe
  C:\Windows\System32\ezMfOcF.exe
  2⤵
  PID:12484
- C:\Windows\System32\bnKMCxs.exe
  C:\Windows\System32\bnKMCxs.exe
  2⤵
  PID:12532
- C:\Windows\System32\bvUdUxW.exe
  C:\Windows\System32\bvUdUxW.exe
  2⤵
  PID:12596
- C:\Windows\System32\WAvqHOb.exe
  C:\Windows\System32\WAvqHOb.exe
  2⤵
  PID:3584
- C:\Windows\System32\KcRgNqH.exe
  C:\Windows\System32\KcRgNqH.exe
  2⤵
  PID:4492
- C:\Windows\System32\UazjDzv.exe
  C:\Windows\System32\UazjDzv.exe
  2⤵
  PID:12664
- C:\Windows\System32\fkDpIhl.exe
  C:\Windows\System32\fkDpIhl.exe
  2⤵
  PID:12684
- C:\Windows\System32\jQrxixU.exe
  C:\Windows\System32\jQrxixU.exe
  2⤵
  PID:12748
- C:\Windows\System32\UwlQgkR.exe
  C:\Windows\System32\UwlQgkR.exe
  2⤵
  PID:12848
- C:\Windows\System32\WSGRVev.exe
  C:\Windows\System32\WSGRVev.exe
  2⤵
  PID:12948
- C:\Windows\System32\OphLkTv.exe
  C:\Windows\System32\OphLkTv.exe
  2⤵
  PID:13020
- C:\Windows\System32\iXNgXUr.exe
  C:\Windows\System32\iXNgXUr.exe
  2⤵
  PID:13072
- C:\Windows\System32\wfbJhep.exe
  C:\Windows\System32\wfbJhep.exe
  2⤵
  PID:644
- C:\Windows\System32\jNyMEgI.exe
  C:\Windows\System32\jNyMEgI.exe
  2⤵
  PID:13160
- C:\Windows\System32\HqGygtT.exe
  C:\Windows\System32\HqGygtT.exe
  2⤵
  PID:13296
- C:\Windows\System32\vDUDOmw.exe
  C:\Windows\System32\vDUDOmw.exe
  2⤵
  PID:13304
- C:\Windows\System32\IleaGpc.exe
  C:\Windows\System32\IleaGpc.exe
  2⤵
  PID:12348
- C:\Windows\System32\TjCTTng.exe
  C:\Windows\System32\TjCTTng.exe
  2⤵
  PID:12512
- C:\Windows\System32\ybuvvgy.exe
  C:\Windows\System32\ybuvvgy.exe
  2⤵
  PID:12560
- C:\Windows\System32\knuzThp.exe
  C:\Windows\System32\knuzThp.exe
  2⤵
  PID:12696
- C:\Windows\System32\OwIpHMR.exe
  C:\Windows\System32\OwIpHMR.exe
  2⤵
  PID:12868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\AscAegU.exe

Filesize
1.7MB

MD5
1b1b4ae9efd9acccd79ac86b046e4710

SHA1
bc597634830f45c1084320e62fc0788411db8c6c

SHA256
828a4a8e322b4cc292d79015e7522afbf8e78b2585e9af0b282b891d2ee2b805

SHA512
6eda9b7513b5e881bf57decb13d0bd709fd946c8f2f8b4ffb7655a90e07bc4a60603a5b057b14a31191d82578e41a6a1e158feee9680133598dec73f08fa8cee

Download Submit
C:\Windows\System32\BajiqdZ.exe

Filesize
1.7MB

MD5
4f75f06ba9f63a9e12c3048f168d3590

SHA1
fc13bbcacc2a399675d16c78d55650e74c3aa25c

SHA256
169bce88398abd1c59a1ea7122cdd785340183bea2ca7d7810bdb0d03beef355

SHA512
e3abc32a890e8b4c799c5e78c24cf09d1aab8226863d515c3f7c8152dc21079603732ac0f41c3a99501a2f8b6fe6fb42f27bd408aa26f0fb1e849a51446f83a7

Download Submit
C:\Windows\System32\CNRZSSX.exe

Filesize
1.7MB

MD5
21c7625a49365c039ff17cbee25c3579

SHA1
366279562e5461e295be215aea448115949a6bdb

SHA256
a286a08968d8376ce4c94958d8b43dbe2c473f8e450a5cd0ccbd8124079206a0

SHA512
195067f72b54d444d4f2434a22f0abacfa9ccde6a6092f016b12274f5648e9546bb14193d4981badc8842b8789f7c2b90117f56225e23b5c0248660723d7b3a5

Download Submit
C:\Windows\System32\DDLspcb.exe

Filesize
1.7MB

MD5
37514f08cf0590f8bab43a4b65d5ed5e

SHA1
aaf373fa7f47d72e9065b239387b3f23c4b7d02e

SHA256
027c4b4d97508c27f9faac05195857342f6fe18efa4eca46e3011682f42a86ce

SHA512
6a58e5ce938ff3275b8cada369371803e9ff4c5c8dbc81fde633e1ee5299d47e12f72cefd19c4223dfda104e39aefdb970188b03ae74ec9ebaec3c1d6f467eb1

Download Submit
C:\Windows\System32\EnpDtmd.exe

Filesize
1.7MB

MD5
f6d4bca79c60410d9a81dabe80a50d4a

SHA1
44c7993c62cd188f0e5cff03d172318973fe537f

SHA256
2d966eaee6cd9ba6f547dbcb0152e0b22cb601a115067baf54b324dd36697193

SHA512
bd32a8f6a1cf4f1079f7f346b5059d19d0d5ef2dec9450fb43ed547ff507ff759d586db30fe5cbca3f5fc0d96a5bb2cefa535506c47d954f17a1db5bd3de0011

Download Submit
C:\Windows\System32\FnvbJey.exe

Filesize
1.7MB

MD5
52b9617fb4ed5b76f50c3b5da2212eaa

SHA1
dd8e76d14e188dc64543c7953d6141b7554ffbb7

SHA256
693c7a3154d772276287bce7ee2944b0e95c431693a6e8c138c961843ded6c88

SHA512
ac1356d8bacd13ba7eb9d35691779d3c47ce1d97198168dae2a588e2ce1c25aa0d49c79166d865d3d5e867a2311fd73bac48c14ea5e44ae26be09c7f42637135

Download Submit
C:\Windows\System32\HoUyHrJ.exe

Filesize
1.7MB

MD5
7acdf34d32f6974fb31af6e429e67e9b

SHA1
976d5c3484d785fd87ea69cd1502ed0a3ac938e6

SHA256
b57ed9a2f64f8b46c923b0620875b52c35e1bfa99377bca981f950a5c634a990

SHA512
26befa4cd42257660db0b01360596194a3fd2e6940afdb5497d3e33a45912a4afa76c56cee1cc843ecd58eb2066efc30b16bbc2f58c41c65a844457399eee0f7

Download Submit
C:\Windows\System32\JNIjxXe.exe

Filesize
1.7MB

MD5
80a04e8a8336a97a58be452b3ad3e4c3

SHA1
3642e63b322c90edd5bc444194a00999f10d0d75

SHA256
36526a70df5b9655cfdc2eafc27c3122c978e0cf129f51e82f7f7ab599112a2b

SHA512
644dc8c2bfce4d4c0ff35dc67c1186a2dc0db8e68cdfbe9043defa3fc44cb8096826c14ee9fac13418014efb1888ef8eaef9c525955f0aac8d85035de95db33c

Download Submit
C:\Windows\System32\KjWfqZG.exe

Filesize
1.7MB

MD5
8f7c6bfa561d4d6fd6b4b95023609a96

SHA1
59f74c09081ce81461b304d29686adc5fedcfd20

SHA256
87c6e4524cc5ec3ca2c7cae1e4ed93df7624493e84e2e64f5460cd3a3995706f

SHA512
519f6dc1903353e78c059640a8ac6210d70689499b57d4d8d67ab68d5984ac36190d95617afc162e8849aee13a5fc9106519c3f028cb3feb9f4d1b17dbe18b6a

Download Submit
C:\Windows\System32\OFzwcXJ.exe

Filesize
1.7MB

MD5
26ef62c322c64aa3252bdf50c5cd1e3c

SHA1
1babcd5b81870577c40bd65c1ec40f8640212162

SHA256
9b9deb05d6e8e43bd006b3df58b3f0b69bac014cf16eeb211a4071f6c9c4e663

SHA512
057226f03105db71ee1e545d5854b4bd43ecb3c168df93c823722874cef73929b8a5ea4d681de8b09be3e8af1f18cda0b7b7aac15d5c68543955958bb046fd4d

Download Submit
C:\Windows\System32\ObJktEH.exe

Filesize
1.7MB

MD5
6d078382ad03bdec40754bebf5563c02

SHA1
3754c9376574683dd53fdb0b1d8f98c5eeedb6c9

SHA256
2bb68cb42e55c8804c244309d6d87d4fcc9b2a154d3475b9f01a63b31de37371

SHA512
4c067a637d23c3cde54961232351a921599fd0817dcd336b818ac99d57fba13dc4f18f4e5f9f355d41cc2951c6c73c1484ac26b9651cc13dd36acae953125829

Download Submit
C:\Windows\System32\TQnvTNI.exe

Filesize
1.7MB

MD5
5cc129aa4f773502cd0f9d62d0ede187

SHA1
74e2648a34dcd6de21fb3b33168c88986f973911

SHA256
9656fb442e3b11d0256ef190256fee4a23301b15f45359a59e78d7baa23fde93

SHA512
c3a5d1cfb86a6989fe04451f28d1a6b691d2bc59722c34f910bcbf1c2b24d1f4a0c49b6bc869887ca186966133a1249a3b51f72d8a69c39a726a54b3c77a6163

Download Submit
C:\Windows\System32\UaXtIKC.exe

Filesize
1.7MB

MD5
0db4ea1453fef3be1605ba43cd3daa7f

SHA1
716145ae7e5b3130b923fd568f82c8af95a9c696

SHA256
4b99581ec320e51fe830cf30324e566fe9ee9bc9558ab52a8ee5cc94271857a9

SHA512
2941f39ada19ca5a468544730bd0b97218114daf99d3a7d6a70cbb796d451ba39e6b97988348365ef1443aef57da66482cd3b2a88d33e7b0989c669d637c3805

Download Submit
C:\Windows\System32\WICUWdv.exe

Filesize
1.7MB

MD5
db46b74ceb8082d2f70aa85fe762f432

SHA1
9679e3bec34bbefd9373a3467994c3734d59f590

SHA256
948247bd91aec3c160b1ee8e1678a0a8bf4c504528ba4e4c12dfd348abfedb9b

SHA512
3ef0526b6aa9e6c8342c985341644156deda8df6c206be59795b0942228f564f921059b245a01d87d077c9646425766046865dbb29ac387cfdba0204bac6785f

Download Submit
C:\Windows\System32\WNJJzWN.exe

Filesize
1.7MB

MD5
8d65f452960539e9b0588c750ac4cd6d

SHA1
e90cf18ce71dfbde1b787b5cfba3dfd30c62d44f

SHA256
a4e458a9f2c30c35cb1b007cba424dc9bf107311c4545d8551e6630e0db3a016

SHA512
0daf41fd62a854d0c8fc13fac78b561dec2dfc7284d1521eb45389cbd754d1b2833b0b644e83271bef0926269aa07290ae9eb4b003ba9977f799479c351c2028

Download Submit
C:\Windows\System32\XLljgyr.exe

Filesize
1.7MB

MD5
87c54a22b3af095e025a3fa0ee98810e

SHA1
a5d10e8ce366466071f93601ff3db5ebd637891f

SHA256
a3825341a821990b6dde6b98bb069947a0cdaad0bf32ac65525bc204ecc43efa

SHA512
3991fa224bce3c899d8323c5950796d21e0fa4a4f27803bdaafd87fe0b31a99db202940c6d9e0ddfe22483521ef0332b848842a5ab9e10ba22399e5652100ea3

Download Submit
C:\Windows\System32\Zzwytsr.exe

Filesize
1.7MB

MD5
c6a5e5fb72749f20f6ec9617b02e4201

SHA1
77de60053a242edb501b83d5ee4d25fe70d0f4d2

SHA256
17bdb9b724cde1f9a67e04c4e9745c554a0d849ab13f8cb8ca170bc2e81c51ed

SHA512
e48116792609b903a9b97df8cf3e4b21c471f724c6aa6c2c61beaa3c14778b87f7bf3af8e4429d8a849fc1c967daaf696639accafa1adc888b93d8f4abe433db

Download Submit
C:\Windows\System32\aTvdDpQ.exe

Filesize
1.7MB

MD5
99e39163477ccf987e9cc92cb82e24f5

SHA1
108509c82a5c883f151f4190752fba74242c385c

SHA256
c502b9a25c44603ecd01793d5f859804f8b2009b94732df8fae6ff77c2d20154

SHA512
7ab80614e0a725bea08d5b38d8db2cb42be21afd35d8db54735bd869c67484d83dc166e38115603447150cfe3e13fd280113977f0af251fb10893228b7f6126f

Download Submit
C:\Windows\System32\cOFquQY.exe

Filesize
1.7MB

MD5
7c6a13f7e6ecf2ae0206ed0ae6508b3e

SHA1
3c1140d5c972d6960a5c536a6cedf0a92c5c6986

SHA256
37cbe63c31edcd6f50c033b902c37fd0b328a0624e4450b772cf668b8c6f0db4

SHA512
e752c4ebdf1787e2610bd7f4a06bd40af9c6650f00f895c5a5d87b93e37e32555afd50ea9ede7c86013ee14bacbe2da8133a69c899254351c199fd9246eecbe2

Download Submit
C:\Windows\System32\cfTlXQW.exe

Filesize
1.7MB

MD5
cd23c880bab60d64a58f82a182a7c7ae

SHA1
ce6eca62167d73ba1e3e65abb5d475ccb080cbd2

SHA256
9ed5273f2f7e89f6ac706c835cad3319aef69048af076c1b3d9ea85debf6797a

SHA512
50889b0f5a80e4494e1e30624bd0e63e73c2c9e825bbd734061732e12c315d7eddc799ef692a5d52771885ef44fab05b1e6846e1f08b390fc93df5505fd991e7

Download Submit
C:\Windows\System32\cznAhwj.exe

Filesize
1.7MB

MD5
041586fdd7dbb219b1945f160150865d

SHA1
d402e1883e0787a4a3ec1bbe606bd02d8724e965

SHA256
32c102eb8a8599f18f1c4b416a896511164e7eae58249b89d8cfb271c7c8c3c0

SHA512
f8f12996aac2446b9e67d388bb8800fc672d219e946a7784fef6e6307c8dcec95de25d3f7dcd2bab4d31af8a859850dabc4a8bd9d94e97f0c8ebb0c348ce44f7

Download Submit
C:\Windows\System32\dVKHtJb.exe

Filesize
1.7MB

MD5
8f4e36cca07da9a04a0628fb2301a8bb

SHA1
fa60257bf58576974c96d3d71a1b9e6b41a8d546

SHA256
94529e9595a3650fa31b4369cb76b687c6428185c071b1739e593579ae12d83b

SHA512
6a32b28a8ae2617e662e06bf83c2dc6fea7b5e6a4a2549cd056901145b34c243b796eee2bac8f1df3bedbf8e7fd6a8d9e348bacff15da776eb2dc0a80cbc1755

Download Submit
C:\Windows\System32\deGXxlo.exe

Filesize
1.7MB

MD5
5f80998bef11053bc4422d44ad6989d2

SHA1
d019a864e82c7be144a5f33654978d5f68601bce

SHA256
b91cbae66bef3bb4e5669907a25f3feb5b0e407f8ccc44bf99d83f2b830f34f8

SHA512
74c5e3e910a14004b0be120770998d0137ec4781539509a154ab85356d6d18dd23e23283f088ca8c516087726f802017d2d787078f5e9183af0eeeed6a588853

Download Submit
C:\Windows\System32\dsCvlip.exe

Filesize
1.7MB

MD5
7c38ecec73882f13d6ba8f433d5d45ca

SHA1
35e9433395c31b6f12ff737627a5b622dee09412

SHA256
ef136c509eea63b2e2c7e4d322ed16546bbc52a8c525679b315fec85c7da1747

SHA512
d1cb906e3f452ac31b01e9129a7f94b01c32c7866ce31b01ea1ad1c505c6f75a42cef3c5584ac1cf896786548c9834092409281be86f99d5328ae03fe53fda30

Download Submit
C:\Windows\System32\eMGVeyi.exe

Filesize
1.7MB

MD5
97f03bbcf70a7fc188c19bd50ccfd368

SHA1
b75aa1b588d5f49298b9dc57b6e8310f7fffb28e

SHA256
c9a0eb5a7ebb0418e806535ead3d3840255ae08589d10c047dd0df3789a77e8c

SHA512
44420ac170a93c7b00c72c183310eda2e955fd13725c779ffee8bb8e1cecda3baf9e447f49cdd61bf05b72513d304f6f0cf7b3e3a19f14b268b36570b84e2775

Download Submit
C:\Windows\System32\ffZQiwZ.exe

Filesize
1.7MB

MD5
fc68406ca1c72cfd3fd71bfbae57aa0f

SHA1
ab83031a868de3a3dc89dacf5469648331a11070

SHA256
52677ee192f0bba2bf95477420c2ec6bb656b035d4aaa658b3be6f66d9350210

SHA512
a99564e82bf8f485c9e86a5338479da53becec6d03fb50e2c6f1600571ccb45a27172932b10b8919c34b796e0d0eba5b484ac9de898ee06338e1a9530445a3da

Download Submit
C:\Windows\System32\lgpwpnc.exe

Filesize
1.7MB

MD5
b9b73edf6e656004061b97d3714b3788

SHA1
7500466ab039effc5860ec5ba4a4b651a0f2140b

SHA256
65f4527ed1065ad1b6e77213b2f863d7d53985af5520c893674666af667c8e65

SHA512
8d076e29b1e34cf1a232ed4693b01ce810b9d176510bf3dce3adf40d5bb65abcf0368966766c7330d98d69611254b89c2c3404ec38a80e7f0a2bbdb17d902f71

Download Submit
C:\Windows\System32\llvutOe.exe

Filesize
1.7MB

MD5
d3af4108cedf4531c27ead62e0a37653

SHA1
3a154ff39968fa5b5d89ba15db03a99a1a9697b2

SHA256
af2de43051e9d6454778829036de4991eb65ea3a0fe6dd9d71cc49e8dc2c2d7e

SHA512
a116b775b36a7c141df7d832842a372c5b32e8e7c6e47caa212c127eee2a47307820a140511aefa895e3e89b562a121536dfb05ae3520239368b51ae10b36280

Download Submit
C:\Windows\System32\lovgvhk.exe

Filesize
1.7MB

MD5
f83a0907f0c0887565e7e8830705c05b

SHA1
88ef25607783451eaacbc282c508fb425f76518e

SHA256
9a15c159beeee45dce7d6d090e83adcf388f9eeccf00c8b84281ee0e3de812fa

SHA512
8aa241ce07f6f1e88575e99a6ee760bac4606044a1ab910b971fd9d636a71f8e8faf3ed3ee68e92dee959a36c6e5cc22e4ed78fd768d0aef2282c7fa48b23fab

Download Submit
C:\Windows\System32\lpAhOWt.exe

Filesize
1.7MB

MD5
6bbb97fc674480ab1f5d8c1749d0a121

SHA1
53c2ae3540991c8ac2dd4a88ea769dcfa8df9277

SHA256
4a387ee9f9cbe9049bfa0a8e71de441a0d07120a40299c76412085d9dfca3433

SHA512
d010a0aecb8b724c06d2f54332179f99b9eac797a0224d070cd59262370a9f88c5fea8f3df8d204649da6c7fab21c23c94cf2e6c4cd2b7f3dfe5cc8a88c9651a

Download Submit
C:\Windows\System32\qMUSYUV.exe

Filesize
1.7MB

MD5
6b9dae0ec43c9388334f6e7c3795850a

SHA1
b3b52ab0a01bc58341f07b216ba352d0713eab4e

SHA256
3d9b2dc3e61a5ffd1f50ff572218f502d3e3e760a31378d79641764884df499e

SHA512
431ee875579549177f4b3858fdadb7d94cbc5f187e69a57c2af7ccc71e7565c9f2894e3db83f0e4342fa701d00bca41ec663d0c6abc8037f13144f52579f561f

Download Submit
C:\Windows\System32\tJzPHKh.exe

Filesize
1.7MB

MD5
f803c08b8979ae1fd2975870fd1fc232

SHA1
fddf65cae67e19f9056b99156b6fa706d1db9010

SHA256
8c43cebbf16076cf94f1c82ec1a4df9651299f8d0c6580914fa178febcc8bdf2

SHA512
bb7a8ef49551de3950117491c74885aaffe3f9bf3db9bec05dd268a8570734796529cb3dd79eddd953cbc239f2c1fd341b792c0eee1956d8ccb079f9241c4f72

Download Submit
memory/624-482-0x00007FF6C6F30000-0x00007FF6C7321000-memory.dmp

Filesize
3.9MB

Download
memory/624-2008-0x00007FF6C6F30000-0x00007FF6C7321000-memory.dmp

Filesize
3.9MB

Download
memory/1576-1993-0x00007FF69FFB0000-0x00007FF6A03A1000-memory.dmp

Filesize
3.9MB

Download
memory/1576-455-0x00007FF69FFB0000-0x00007FF6A03A1000-memory.dmp

Filesize
3.9MB

Download
memory/1676-2017-0x00007FF71D4C0000-0x00007FF71D8B1000-memory.dmp

Filesize
3.9MB

Download
memory/1676-492-0x00007FF71D4C0000-0x00007FF71D8B1000-memory.dmp

Filesize
3.9MB

Download
memory/1976-2010-0x00007FF7FB630000-0x00007FF7FBA21000-memory.dmp

Filesize
3.9MB

Download
memory/1976-489-0x00007FF7FB630000-0x00007FF7FBA21000-memory.dmp

Filesize
3.9MB

Download
memory/2044-20-0x00007FF69D590000-0x00007FF69D981000-memory.dmp

Filesize
3.9MB

Download
memory/2044-1986-0x00007FF69D590000-0x00007FF69D981000-memory.dmp

Filesize
3.9MB

Download
memory/2044-1970-0x00007FF69D590000-0x00007FF69D981000-memory.dmp

Filesize
3.9MB

Download
memory/2176-462-0x00007FF7303A0000-0x00007FF730791000-memory.dmp

Filesize
3.9MB

Download
memory/2176-2054-0x00007FF7303A0000-0x00007FF730791000-memory.dmp

Filesize
3.9MB

Download
memory/2236-458-0x00007FF7AADF0000-0x00007FF7AB1E1000-memory.dmp

Filesize
3.9MB

Download
memory/2236-2000-0x00007FF7AADF0000-0x00007FF7AB1E1000-memory.dmp

Filesize
3.9MB

Download
memory/2280-470-0x00007FF77C480000-0x00007FF77C871000-memory.dmp

Filesize
3.9MB

Download
memory/2280-2051-0x00007FF77C480000-0x00007FF77C871000-memory.dmp

Filesize
3.9MB

Download
memory/2376-31-0x00007FF77ECA0000-0x00007FF77F091000-memory.dmp

Filesize
3.9MB

Download
memory/2376-1976-0x00007FF77ECA0000-0x00007FF77F091000-memory.dmp

Filesize
3.9MB

Download
memory/2376-1996-0x00007FF77ECA0000-0x00007FF77F091000-memory.dmp

Filesize
3.9MB

Download
memory/2488-1-0x00000245FB820000-0x00000245FB830000-memory.dmp

Filesize
64KB

Download
memory/2488-0-0x00007FF6A2460000-0x00007FF6A2851000-memory.dmp

Filesize
3.9MB

Download
memory/2488-1939-0x00007FF6A2460000-0x00007FF6A2851000-memory.dmp

Filesize
3.9MB

Download
memory/2500-483-0x00007FF6FD790000-0x00007FF6FDB81000-memory.dmp

Filesize
3.9MB

Download
memory/2500-2006-0x00007FF6FD790000-0x00007FF6FDB81000-memory.dmp

Filesize
3.9MB

Download
memory/2632-488-0x00007FF70F8E0000-0x00007FF70FCD1000-memory.dmp

Filesize
3.9MB

Download
memory/2632-2012-0x00007FF70F8E0000-0x00007FF70FCD1000-memory.dmp

Filesize
3.9MB

Download
memory/2660-475-0x00007FF6C1E50000-0x00007FF6C2241000-memory.dmp

Filesize
3.9MB

Download
memory/2660-2047-0x00007FF6C1E50000-0x00007FF6C2241000-memory.dmp

Filesize
3.9MB

Download
memory/2760-1984-0x00007FF678C00000-0x00007FF678FF1000-memory.dmp

Filesize
3.9MB

Download
memory/2760-16-0x00007FF678C00000-0x00007FF678FF1000-memory.dmp

Filesize
3.9MB

Download
memory/2760-1940-0x00007FF678C00000-0x00007FF678FF1000-memory.dmp

Filesize
3.9MB

Download
memory/2888-499-0x00007FF7C9490000-0x00007FF7C9881000-memory.dmp

Filesize
3.9MB

Download
memory/2888-1995-0x00007FF7C9490000-0x00007FF7C9881000-memory.dmp

Filesize
3.9MB

Download
memory/2964-2045-0x00007FF6C5060000-0x00007FF6C5451000-memory.dmp

Filesize
3.9MB

Download
memory/2964-478-0x00007FF6C5060000-0x00007FF6C5451000-memory.dmp

Filesize
3.9MB

Download
memory/3116-459-0x00007FF7CFED0000-0x00007FF7D02C1000-memory.dmp

Filesize
3.9MB

Download
memory/3116-2002-0x00007FF7CFED0000-0x00007FF7D02C1000-memory.dmp

Filesize
3.9MB

Download
memory/3428-2015-0x00007FF664E10000-0x00007FF665201000-memory.dmp

Filesize
3.9MB

Download
memory/3428-497-0x00007FF664E10000-0x00007FF665201000-memory.dmp

Filesize
3.9MB

Download
memory/3708-1998-0x00007FF7A2BF0000-0x00007FF7A2FE1000-memory.dmp

Filesize
3.9MB

Download
memory/3708-457-0x00007FF7A2BF0000-0x00007FF7A2FE1000-memory.dmp

Filesize
3.9MB

Download
memory/3772-467-0x00007FF64C510000-0x00007FF64C901000-memory.dmp

Filesize
3.9MB

Download
memory/3772-2053-0x00007FF64C510000-0x00007FF64C901000-memory.dmp

Filesize
3.9MB

Download
memory/4164-493-0x00007FF77C930000-0x00007FF77CD21000-memory.dmp

Filesize
3.9MB

Download
memory/4164-2023-0x00007FF77C930000-0x00007FF77CD21000-memory.dmp

Filesize
3.9MB

Download
memory/4480-1971-0x00007FF72DB20000-0x00007FF72DF11000-memory.dmp

Filesize
3.9MB

Download
memory/4480-1988-0x00007FF72DB20000-0x00007FF72DF11000-memory.dmp

Filesize
3.9MB

Download
memory/4480-28-0x00007FF72DB20000-0x00007FF72DF11000-memory.dmp

Filesize
3.9MB

Download
memory/4888-1991-0x00007FF7085D0000-0x00007FF7089C1000-memory.dmp

Filesize
3.9MB

Download
memory/4888-456-0x00007FF7085D0000-0x00007FF7089C1000-memory.dmp

Filesize
3.9MB

Download
memory/4932-2049-0x00007FF792540000-0x00007FF792931000-memory.dmp

Filesize
3.9MB

Download
memory/4932-474-0x00007FF792540000-0x00007FF792931000-memory.dmp

Filesize
3.9MB

Download
memory/5056-1982-0x00007FF64A990000-0x00007FF64AD81000-memory.dmp

Filesize
3.9MB

Download
memory/5056-1941-0x00007FF64A990000-0x00007FF64AD81000-memory.dmp

Filesize
3.9MB

Download
memory/5056-12-0x00007FF64A990000-0x00007FF64AD81000-memory.dmp

Filesize
3.9MB

Download