xmrig | 5e83b82043ab17ab759a470454752f5d84a500e155781deab5946d91395fa827

Analysis

max time kernel
129s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 04:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
Size

1.0MB
MD5

160bdbeeee46f70535b72a0868bbe2be
SHA1

d11dee6449c462f199ab873fbc386c46a351f75b
SHA256

5e83b82043ab17ab759a470454752f5d84a500e155781deab5946d91395fa827
SHA512

79790fd47eafac6b5f6273a11d47d3eed68ba9270574ca19bbe1be39d35e509993112cb217c832bd56170e88e242775d4ff30355b4b904ade79af902e81c7396
SSDEEP

24576:JanwhSe11QSONCpGJCjETPlGC78XCejaX0:knw9oUUEEDlGUrMN

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 47 IoCs

miner

resource	yara_rule
behavioral2/memory/3344-42-0x00007FF6741D0000-0x00007FF6745C1000-memory.dmp	xmrig
behavioral2/memory/3008-399-0x00007FF70F8B0000-0x00007FF70FCA1000-memory.dmp	xmrig
behavioral2/memory/5048-400-0x00007FF623000000-0x00007FF6233F1000-memory.dmp	xmrig
behavioral2/memory/1384-402-0x00007FF7E6D10000-0x00007FF7E7101000-memory.dmp	xmrig
behavioral2/memory/3436-403-0x00007FF6B9C80000-0x00007FF6BA071000-memory.dmp	xmrig
behavioral2/memory/1648-404-0x00007FF760A90000-0x00007FF760E81000-memory.dmp	xmrig
behavioral2/memory/3628-401-0x00007FF7D4010000-0x00007FF7D4401000-memory.dmp	xmrig
behavioral2/memory/2164-48-0x00007FF7D0C30000-0x00007FF7D1021000-memory.dmp	xmrig
behavioral2/memory/4036-43-0x00007FF7FA610000-0x00007FF7FAA01000-memory.dmp	xmrig
behavioral2/memory/2252-33-0x00007FF661FF0000-0x00007FF6623E1000-memory.dmp	xmrig
behavioral2/memory/3432-491-0x00007FF66B340000-0x00007FF66B731000-memory.dmp	xmrig
behavioral2/memory/4792-466-0x00007FF6AE3B0000-0x00007FF6AE7A1000-memory.dmp	xmrig
behavioral2/memory/2224-518-0x00007FF72EB60000-0x00007FF72EF51000-memory.dmp	xmrig
behavioral2/memory/5080-490-0x00007FF6C7C70000-0x00007FF6C8061000-memory.dmp	xmrig
behavioral2/memory/3780-527-0x00007FF6B80C0000-0x00007FF6B84B1000-memory.dmp	xmrig
behavioral2/memory/4616-530-0x00007FF6890B0000-0x00007FF6894A1000-memory.dmp	xmrig
behavioral2/memory/3364-545-0x00007FF7C4A80000-0x00007FF7C4E71000-memory.dmp	xmrig
behavioral2/memory/4148-534-0x00007FF6EB6B0000-0x00007FF6EBAA1000-memory.dmp	xmrig
behavioral2/memory/4428-529-0x00007FF6CB120000-0x00007FF6CB511000-memory.dmp	xmrig
behavioral2/memory/2808-2006-0x00007FF6FD0C0000-0x00007FF6FD4B1000-memory.dmp	xmrig
behavioral2/memory/2164-2017-0x00007FF7D0C30000-0x00007FF7D1021000-memory.dmp	xmrig
behavioral2/memory/4840-2040-0x00007FF76FB40000-0x00007FF76FF31000-memory.dmp	xmrig
behavioral2/memory/3068-2043-0x00007FF7970D0000-0x00007FF7974C1000-memory.dmp	xmrig
behavioral2/memory/4384-2051-0x00007FF675F50000-0x00007FF676341000-memory.dmp	xmrig
behavioral2/memory/2252-2053-0x00007FF661FF0000-0x00007FF6623E1000-memory.dmp	xmrig
behavioral2/memory/3344-2056-0x00007FF6741D0000-0x00007FF6745C1000-memory.dmp	xmrig
behavioral2/memory/1036-2063-0x00007FF6EC7F0000-0x00007FF6ECBE1000-memory.dmp	xmrig
behavioral2/memory/2808-2060-0x00007FF6FD0C0000-0x00007FF6FD4B1000-memory.dmp	xmrig
behavioral2/memory/4036-2062-0x00007FF7FA610000-0x00007FF7FAA01000-memory.dmp	xmrig
behavioral2/memory/2164-2058-0x00007FF7D0C30000-0x00007FF7D1021000-memory.dmp	xmrig
behavioral2/memory/3008-2072-0x00007FF70F8B0000-0x00007FF70FCA1000-memory.dmp	xmrig
behavioral2/memory/4840-2091-0x00007FF76FB40000-0x00007FF76FF31000-memory.dmp	xmrig
behavioral2/memory/4148-2099-0x00007FF6EB6B0000-0x00007FF6EBAA1000-memory.dmp	xmrig
behavioral2/memory/3780-2101-0x00007FF6B80C0000-0x00007FF6B84B1000-memory.dmp	xmrig
behavioral2/memory/3364-2095-0x00007FF7C4A80000-0x00007FF7C4E71000-memory.dmp	xmrig
behavioral2/memory/3068-2087-0x00007FF7970D0000-0x00007FF7974C1000-memory.dmp	xmrig
behavioral2/memory/2224-2086-0x00007FF72EB60000-0x00007FF72EF51000-memory.dmp	xmrig
behavioral2/memory/3432-2084-0x00007FF66B340000-0x00007FF66B731000-memory.dmp	xmrig
behavioral2/memory/5080-2082-0x00007FF6C7C70000-0x00007FF6C8061000-memory.dmp	xmrig
behavioral2/memory/1648-2078-0x00007FF760A90000-0x00007FF760E81000-memory.dmp	xmrig
behavioral2/memory/4616-2074-0x00007FF6890B0000-0x00007FF6894A1000-memory.dmp	xmrig
behavioral2/memory/5048-2070-0x00007FF623000000-0x00007FF6233F1000-memory.dmp	xmrig
behavioral2/memory/4428-2089-0x00007FF6CB120000-0x00007FF6CB511000-memory.dmp	xmrig
behavioral2/memory/4792-2080-0x00007FF6AE3B0000-0x00007FF6AE7A1000-memory.dmp	xmrig
behavioral2/memory/3436-2067-0x00007FF6B9C80000-0x00007FF6BA071000-memory.dmp	xmrig
behavioral2/memory/3628-2075-0x00007FF7D4010000-0x00007FF7D4401000-memory.dmp	xmrig
behavioral2/memory/1384-2065-0x00007FF7E6D10000-0x00007FF7E7101000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4384	WSmdLJe.exe
3344	wyYesCL.exe
1036	akJuhdp.exe
2252	LKMrJip.exe
4036	STeMJSp.exe
2808	ZgvAKkL.exe
2164	KAQtyOC.exe
3068	YMGCiDR.exe
4840	FLdrDcF.exe
3364	gRMLyUe.exe
3008	aQsquDg.exe
5048	pihSlHF.exe
3628	TdfMGDC.exe
1384	ytcKwVG.exe
3436	kbnjEem.exe
1648	gyCOTXP.exe
4792	qcDVdwa.exe
5080	SiKjjYn.exe
3432	FvmjpVq.exe
2224	hSoydGT.exe
3780	aDQuoKe.exe
4428	rkhRJtR.exe
4616	mCdlPgG.exe
4148	OahANff.exe
3568	oCQCoZy.exe
3716	uLrQLEf.exe
4820	rutVDls.exe
3956	mNgLaqg.exe
1576	GepqXlu.exe
3992	XbnUXBh.exe
2264	TEIqFJR.exe
2616	kGpuzyA.exe
1052	fHUWnLi.exe
5068	MrETQki.exe
3272	fTRnlgJ.exe
4704	tFquWbV.exe
2724	LLsbEYN.exe
3644	XsSWzvz.exe
4328	euXOLRD.exe
2356	ktBlOYx.exe
1112	ZUgeJRL.exe
3552	yxvpEGl.exe
4444	ZjCNsji.exe
404	QmLXpBH.exe
3608	VmRpKgr.exe
3792	cfjYuVp.exe
3600	eeVYtWw.exe
4572	MQIICeb.exe
4356	IkRERzm.exe
1456	vwDxiWE.exe
1056	ahnysAI.exe
4816	EUrcaCR.exe
4972	qWSMpZX.exe
440	hjgNWRW.exe
1184	vFoGobf.exe
984	tkQYgrp.exe
5020	fqVfInb.exe
3732	eJhtmOL.exe
4628	YbKbqCa.exe
3524	bwkHsmG.exe
3748	npRJdtV.exe
1608	aiCfKwR.exe
2896	ZSCIpBQ.exe
3572	SoDHxqx.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4836-0-0x00007FF792420000-0x00007FF792811000-memory.dmp	upx
behavioral2/files/0x0009000000023b15-4.dat	upx
behavioral2/files/0x000a000000023b89-7.dat	upx
behavioral2/files/0x000a000000023b8a-15.dat	upx
behavioral2/files/0x000a000000023b8c-30.dat	upx
behavioral2/files/0x000a000000023b8d-36.dat	upx
behavioral2/memory/3344-42-0x00007FF6741D0000-0x00007FF6745C1000-memory.dmp	upx
behavioral2/files/0x000a000000023b8e-52.dat	upx
behavioral2/files/0x000a000000023b90-56.dat	upx
behavioral2/files/0x000a000000023b91-62.dat	upx
behavioral2/files/0x000a000000023b92-69.dat	upx
behavioral2/files/0x000a000000023b96-90.dat	upx
behavioral2/files/0x000a000000023b9b-115.dat	upx
behavioral2/files/0x000a000000023b9e-130.dat	upx
behavioral2/files/0x000a000000023ba4-159.dat	upx
behavioral2/memory/4840-391-0x00007FF76FB40000-0x00007FF76FF31000-memory.dmp	upx
behavioral2/memory/3008-399-0x00007FF70F8B0000-0x00007FF70FCA1000-memory.dmp	upx
behavioral2/memory/5048-400-0x00007FF623000000-0x00007FF6233F1000-memory.dmp	upx
behavioral2/memory/1384-402-0x00007FF7E6D10000-0x00007FF7E7101000-memory.dmp	upx
behavioral2/memory/3436-403-0x00007FF6B9C80000-0x00007FF6BA071000-memory.dmp	upx
behavioral2/memory/1648-404-0x00007FF760A90000-0x00007FF760E81000-memory.dmp	upx
behavioral2/memory/3628-401-0x00007FF7D4010000-0x00007FF7D4401000-memory.dmp	upx
behavioral2/files/0x000a000000023ba6-170.dat	upx
behavioral2/files/0x000a000000023ba5-164.dat	upx
behavioral2/files/0x000a000000023ba3-155.dat	upx
behavioral2/files/0x000a000000023ba2-149.dat	upx
behavioral2/files/0x000a000000023ba1-144.dat	upx
behavioral2/files/0x000a000000023ba0-139.dat	upx
behavioral2/files/0x000a000000023b9f-134.dat	upx
behavioral2/files/0x000a000000023b9d-124.dat	upx
behavioral2/files/0x000a000000023b9c-119.dat	upx
behavioral2/files/0x000a000000023b9a-109.dat	upx
behavioral2/files/0x000a000000023b99-105.dat	upx
behavioral2/files/0x000a000000023b98-99.dat	upx
behavioral2/files/0x000a000000023b97-95.dat	upx
behavioral2/files/0x000a000000023b95-85.dat	upx
behavioral2/files/0x000a000000023b94-79.dat	upx
behavioral2/files/0x000a000000023b93-74.dat	upx
behavioral2/files/0x000a000000023b8f-55.dat	upx
behavioral2/memory/3068-51-0x00007FF7970D0000-0x00007FF7974C1000-memory.dmp	upx
behavioral2/memory/2164-48-0x00007FF7D0C30000-0x00007FF7D1021000-memory.dmp	upx
behavioral2/memory/4036-43-0x00007FF7FA610000-0x00007FF7FAA01000-memory.dmp	upx
behavioral2/memory/2808-40-0x00007FF6FD0C0000-0x00007FF6FD4B1000-memory.dmp	upx
behavioral2/files/0x000a000000023b8b-34.dat	upx
behavioral2/memory/2252-33-0x00007FF661FF0000-0x00007FF6623E1000-memory.dmp	upx
behavioral2/memory/1036-28-0x00007FF6EC7F0000-0x00007FF6ECBE1000-memory.dmp	upx
behavioral2/memory/4384-21-0x00007FF675F50000-0x00007FF676341000-memory.dmp	upx
behavioral2/files/0x000a000000023b88-11.dat	upx
behavioral2/memory/3432-491-0x00007FF66B340000-0x00007FF66B731000-memory.dmp	upx
behavioral2/memory/4792-466-0x00007FF6AE3B0000-0x00007FF6AE7A1000-memory.dmp	upx
behavioral2/memory/2224-518-0x00007FF72EB60000-0x00007FF72EF51000-memory.dmp	upx
behavioral2/memory/5080-490-0x00007FF6C7C70000-0x00007FF6C8061000-memory.dmp	upx
behavioral2/memory/3780-527-0x00007FF6B80C0000-0x00007FF6B84B1000-memory.dmp	upx
behavioral2/memory/4616-530-0x00007FF6890B0000-0x00007FF6894A1000-memory.dmp	upx
behavioral2/memory/3364-545-0x00007FF7C4A80000-0x00007FF7C4E71000-memory.dmp	upx
behavioral2/memory/4148-534-0x00007FF6EB6B0000-0x00007FF6EBAA1000-memory.dmp	upx
behavioral2/memory/4428-529-0x00007FF6CB120000-0x00007FF6CB511000-memory.dmp	upx
behavioral2/memory/2808-2006-0x00007FF6FD0C0000-0x00007FF6FD4B1000-memory.dmp	upx
behavioral2/memory/2164-2017-0x00007FF7D0C30000-0x00007FF7D1021000-memory.dmp	upx
behavioral2/memory/4840-2040-0x00007FF76FB40000-0x00007FF76FF31000-memory.dmp	upx
behavioral2/memory/3068-2043-0x00007FF7970D0000-0x00007FF7974C1000-memory.dmp	upx
behavioral2/memory/4384-2051-0x00007FF675F50000-0x00007FF676341000-memory.dmp	upx
behavioral2/memory/2252-2053-0x00007FF661FF0000-0x00007FF6623E1000-memory.dmp	upx
behavioral2/memory/3344-2056-0x00007FF6741D0000-0x00007FF6745C1000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\ldMZopa.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\SIXqwXP.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\CpHRtWa.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\PyrSYla.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\uPKheft.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\zbxCeJA.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\RczgHRO.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\BvEvXTZ.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\aZnseds.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\dxYnNkw.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\CvTKDaM.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\IQNgxJM.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\xaRrZpT.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\iEtZRhC.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\VCxSAUJ.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\iEXiJMI.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\dyHFesN.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\CiAPOzE.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\ggSHJaH.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\mLBKKei.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\uYsDeOi.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\YMGCiDR.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\LTAVHdY.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\npkEuyI.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\fDSnRCM.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\kQOagKr.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\NzUKPgz.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\ALdmqFp.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\DiTqEJp.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\IwSEYQX.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\gpNLBrT.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\TEkHRlB.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\OfIlHft.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\uFydjSN.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\UsTkauu.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\pxUppxY.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\wjxaZdS.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\XquCXDB.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\yvvhAru.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\ASrKSnE.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\jGUHlJx.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\ppmqLWD.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\ONDqLpD.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\bkUCZtm.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\XKUtYcJ.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\JjbVJic.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\egvGdcT.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\kAIMOIr.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\iwgZYbc.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\aVLJxBm.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\IfBDFmR.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\ovomvQb.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\HkvbDlQ.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\vjbnMCV.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\hMcmtFp.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\vDosgIi.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\FvmjpVq.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\GGUhvSr.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\chUiioy.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\noiglPr.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\ytQknjL.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\NyrGuCh.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\SVRphdp.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
File created	C:\Windows\System32\BuRwQhK.exe	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 4384	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	84
PID 4836 wrote to memory of 4384	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	84
PID 4836 wrote to memory of 3344	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	85
PID 4836 wrote to memory of 3344	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	85
PID 4836 wrote to memory of 1036	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	86
PID 4836 wrote to memory of 1036	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	86
PID 4836 wrote to memory of 2252	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	87
PID 4836 wrote to memory of 2252	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	87
PID 4836 wrote to memory of 4036	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	88
PID 4836 wrote to memory of 4036	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	88
PID 4836 wrote to memory of 2808	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	89
PID 4836 wrote to memory of 2808	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	89
PID 4836 wrote to memory of 2164	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	90
PID 4836 wrote to memory of 2164	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	90
PID 4836 wrote to memory of 3068	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	91
PID 4836 wrote to memory of 3068	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	91
PID 4836 wrote to memory of 4840	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	92
PID 4836 wrote to memory of 4840	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	92
PID 4836 wrote to memory of 3364	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	93
PID 4836 wrote to memory of 3364	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	93
PID 4836 wrote to memory of 3008	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	94
PID 4836 wrote to memory of 3008	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	94
PID 4836 wrote to memory of 5048	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	95
PID 4836 wrote to memory of 5048	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	95
PID 4836 wrote to memory of 3628	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	96
PID 4836 wrote to memory of 3628	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	96
PID 4836 wrote to memory of 1384	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	97
PID 4836 wrote to memory of 1384	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	97
PID 4836 wrote to memory of 3436	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	98
PID 4836 wrote to memory of 3436	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	98
PID 4836 wrote to memory of 1648	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	99
PID 4836 wrote to memory of 1648	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	99
PID 4836 wrote to memory of 4792	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	100
PID 4836 wrote to memory of 4792	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	100
PID 4836 wrote to memory of 5080	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	101
PID 4836 wrote to memory of 5080	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	101
PID 4836 wrote to memory of 3432	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	102
PID 4836 wrote to memory of 3432	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	102
PID 4836 wrote to memory of 2224	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	103
PID 4836 wrote to memory of 2224	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	103
PID 4836 wrote to memory of 3780	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	104
PID 4836 wrote to memory of 3780	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	104
PID 4836 wrote to memory of 4428	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	105
PID 4836 wrote to memory of 4428	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	105
PID 4836 wrote to memory of 4616	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	106
PID 4836 wrote to memory of 4616	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	106
PID 4836 wrote to memory of 4148	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	107
PID 4836 wrote to memory of 4148	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	107
PID 4836 wrote to memory of 3568	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	108
PID 4836 wrote to memory of 3568	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	108
PID 4836 wrote to memory of 3716	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	109
PID 4836 wrote to memory of 3716	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	109
PID 4836 wrote to memory of 4820	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	110
PID 4836 wrote to memory of 4820	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	110
PID 4836 wrote to memory of 3956	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	111
PID 4836 wrote to memory of 3956	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	111
PID 4836 wrote to memory of 1576	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	112
PID 4836 wrote to memory of 1576	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	112
PID 4836 wrote to memory of 3992	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	113
PID 4836 wrote to memory of 3992	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	113
PID 4836 wrote to memory of 2264	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	114
PID 4836 wrote to memory of 2264	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	114
PID 4836 wrote to memory of 2616	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	115
PID 4836 wrote to memory of 2616	4836	160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\160bdbeeee46f70535b72a0868bbe2be_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\System32\WSmdLJe.exe
  C:\Windows\System32\WSmdLJe.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System32\wyYesCL.exe
  C:\Windows\System32\wyYesCL.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System32\akJuhdp.exe
  C:\Windows\System32\akJuhdp.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System32\LKMrJip.exe
  C:\Windows\System32\LKMrJip.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System32\STeMJSp.exe
  C:\Windows\System32\STeMJSp.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System32\ZgvAKkL.exe
  C:\Windows\System32\ZgvAKkL.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System32\KAQtyOC.exe
  C:\Windows\System32\KAQtyOC.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System32\YMGCiDR.exe
  C:\Windows\System32\YMGCiDR.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System32\FLdrDcF.exe
  C:\Windows\System32\FLdrDcF.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System32\gRMLyUe.exe
  C:\Windows\System32\gRMLyUe.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System32\aQsquDg.exe
  C:\Windows\System32\aQsquDg.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System32\pihSlHF.exe
  C:\Windows\System32\pihSlHF.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System32\TdfMGDC.exe
  C:\Windows\System32\TdfMGDC.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System32\ytcKwVG.exe
  C:\Windows\System32\ytcKwVG.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System32\kbnjEem.exe
  C:\Windows\System32\kbnjEem.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System32\gyCOTXP.exe
  C:\Windows\System32\gyCOTXP.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System32\qcDVdwa.exe
  C:\Windows\System32\qcDVdwa.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System32\SiKjjYn.exe
  C:\Windows\System32\SiKjjYn.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System32\FvmjpVq.exe
  C:\Windows\System32\FvmjpVq.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System32\hSoydGT.exe
  C:\Windows\System32\hSoydGT.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System32\aDQuoKe.exe
  C:\Windows\System32\aDQuoKe.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System32\rkhRJtR.exe
  C:\Windows\System32\rkhRJtR.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System32\mCdlPgG.exe
  C:\Windows\System32\mCdlPgG.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System32\OahANff.exe
  C:\Windows\System32\OahANff.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System32\oCQCoZy.exe
  C:\Windows\System32\oCQCoZy.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System32\uLrQLEf.exe
  C:\Windows\System32\uLrQLEf.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System32\rutVDls.exe
  C:\Windows\System32\rutVDls.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System32\mNgLaqg.exe
  C:\Windows\System32\mNgLaqg.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System32\GepqXlu.exe
  C:\Windows\System32\GepqXlu.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System32\XbnUXBh.exe
  C:\Windows\System32\XbnUXBh.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System32\TEIqFJR.exe
  C:\Windows\System32\TEIqFJR.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System32\kGpuzyA.exe
  C:\Windows\System32\kGpuzyA.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System32\fHUWnLi.exe
  C:\Windows\System32\fHUWnLi.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System32\MrETQki.exe
  C:\Windows\System32\MrETQki.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System32\fTRnlgJ.exe
  C:\Windows\System32\fTRnlgJ.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System32\tFquWbV.exe
  C:\Windows\System32\tFquWbV.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System32\LLsbEYN.exe
  C:\Windows\System32\LLsbEYN.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System32\XsSWzvz.exe
  C:\Windows\System32\XsSWzvz.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System32\euXOLRD.exe
  C:\Windows\System32\euXOLRD.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System32\ktBlOYx.exe
  C:\Windows\System32\ktBlOYx.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System32\ZUgeJRL.exe
  C:\Windows\System32\ZUgeJRL.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System32\yxvpEGl.exe
  C:\Windows\System32\yxvpEGl.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System32\ZjCNsji.exe
  C:\Windows\System32\ZjCNsji.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System32\QmLXpBH.exe
  C:\Windows\System32\QmLXpBH.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System32\VmRpKgr.exe
  C:\Windows\System32\VmRpKgr.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System32\cfjYuVp.exe
  C:\Windows\System32\cfjYuVp.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System32\eeVYtWw.exe
  C:\Windows\System32\eeVYtWw.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System32\MQIICeb.exe
  C:\Windows\System32\MQIICeb.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System32\IkRERzm.exe
  C:\Windows\System32\IkRERzm.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System32\vwDxiWE.exe
  C:\Windows\System32\vwDxiWE.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System32\ahnysAI.exe
  C:\Windows\System32\ahnysAI.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System32\EUrcaCR.exe
  C:\Windows\System32\EUrcaCR.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System32\qWSMpZX.exe
  C:\Windows\System32\qWSMpZX.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System32\hjgNWRW.exe
  C:\Windows\System32\hjgNWRW.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System32\vFoGobf.exe
  C:\Windows\System32\vFoGobf.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System32\tkQYgrp.exe
  C:\Windows\System32\tkQYgrp.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System32\fqVfInb.exe
  C:\Windows\System32\fqVfInb.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System32\eJhtmOL.exe
  C:\Windows\System32\eJhtmOL.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System32\YbKbqCa.exe
  C:\Windows\System32\YbKbqCa.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System32\bwkHsmG.exe
  C:\Windows\System32\bwkHsmG.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System32\npRJdtV.exe
  C:\Windows\System32\npRJdtV.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System32\aiCfKwR.exe
  C:\Windows\System32\aiCfKwR.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System32\ZSCIpBQ.exe
  C:\Windows\System32\ZSCIpBQ.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System32\SoDHxqx.exe
  C:\Windows\System32\SoDHxqx.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System32\tHnjAxM.exe
  C:\Windows\System32\tHnjAxM.exe
  2⤵
  PID:4316
- C:\Windows\System32\xcbDXZd.exe
  C:\Windows\System32\xcbDXZd.exe
  2⤵
  PID:3744
- C:\Windows\System32\EBfEXfZ.exe
  C:\Windows\System32\EBfEXfZ.exe
  2⤵
  PID:4016
- C:\Windows\System32\lCQiEIo.exe
  C:\Windows\System32\lCQiEIo.exe
  2⤵
  PID:2488
- C:\Windows\System32\vNkiFtM.exe
  C:\Windows\System32\vNkiFtM.exe
  2⤵
  PID:368
- C:\Windows\System32\zjZdpgt.exe
  C:\Windows\System32\zjZdpgt.exe
  2⤵
  PID:624
- C:\Windows\System32\uFydjSN.exe
  C:\Windows\System32\uFydjSN.exe
  2⤵
  PID:244
- C:\Windows\System32\mroKLyZ.exe
  C:\Windows\System32\mroKLyZ.exe
  2⤵
  PID:724
- C:\Windows\System32\FoonImy.exe
  C:\Windows\System32\FoonImy.exe
  2⤵
  PID:1936
- C:\Windows\System32\alCFRpR.exe
  C:\Windows\System32\alCFRpR.exe
  2⤵
  PID:4904
- C:\Windows\System32\zxZjTPQ.exe
  C:\Windows\System32\zxZjTPQ.exe
  2⤵
  PID:2856
- C:\Windows\System32\YoUbnaL.exe
  C:\Windows\System32\YoUbnaL.exe
  2⤵
  PID:948
- C:\Windows\System32\LWGTYAk.exe
  C:\Windows\System32\LWGTYAk.exe
  2⤵
  PID:4728
- C:\Windows\System32\kAIMOIr.exe
  C:\Windows\System32\kAIMOIr.exe
  2⤵
  PID:3216
- C:\Windows\System32\DGtuvSG.exe
  C:\Windows\System32\DGtuvSG.exe
  2⤵
  PID:4984
- C:\Windows\System32\IfBDFmR.exe
  C:\Windows\System32\IfBDFmR.exe
  2⤵
  PID:1532
- C:\Windows\System32\sJqYTMf.exe
  C:\Windows\System32\sJqYTMf.exe
  2⤵
  PID:4208
- C:\Windows\System32\xUgVDAj.exe
  C:\Windows\System32\xUgVDAj.exe
  2⤵
  PID:412
- C:\Windows\System32\KrMAgBW.exe
  C:\Windows\System32\KrMAgBW.exe
  2⤵
  PID:4900
- C:\Windows\System32\MzDsGjI.exe
  C:\Windows\System32\MzDsGjI.exe
  2⤵
  PID:3728
- C:\Windows\System32\gVksTNC.exe
  C:\Windows\System32\gVksTNC.exe
  2⤵
  PID:5136
- C:\Windows\System32\gvNHyOL.exe
  C:\Windows\System32\gvNHyOL.exe
  2⤵
  PID:5160
- C:\Windows\System32\mUFPehg.exe
  C:\Windows\System32\mUFPehg.exe
  2⤵
  PID:5196
- C:\Windows\System32\VZCdird.exe
  C:\Windows\System32\VZCdird.exe
  2⤵
  PID:5216
- C:\Windows\System32\IwSEYQX.exe
  C:\Windows\System32\IwSEYQX.exe
  2⤵
  PID:5248
- C:\Windows\System32\WlmdHau.exe
  C:\Windows\System32\WlmdHau.exe
  2⤵
  PID:5280
- C:\Windows\System32\DMqpVLH.exe
  C:\Windows\System32\DMqpVLH.exe
  2⤵
  PID:5304
- C:\Windows\System32\grRnLOv.exe
  C:\Windows\System32\grRnLOv.exe
  2⤵
  PID:5328
- C:\Windows\System32\XchXEaL.exe
  C:\Windows\System32\XchXEaL.exe
  2⤵
  PID:5364
- C:\Windows\System32\JCxokla.exe
  C:\Windows\System32\JCxokla.exe
  2⤵
  PID:5384
- C:\Windows\System32\dfsmBtl.exe
  C:\Windows\System32\dfsmBtl.exe
  2⤵
  PID:5416
- C:\Windows\System32\gvbHAlP.exe
  C:\Windows\System32\gvbHAlP.exe
  2⤵
  PID:5440
- C:\Windows\System32\dJmtJGs.exe
  C:\Windows\System32\dJmtJGs.exe
  2⤵
  PID:5472
- C:\Windows\System32\mXoFpey.exe
  C:\Windows\System32\mXoFpey.exe
  2⤵
  PID:5496
- C:\Windows\System32\pyruQJO.exe
  C:\Windows\System32\pyruQJO.exe
  2⤵
  PID:5528
- C:\Windows\System32\XWvtRVx.exe
  C:\Windows\System32\XWvtRVx.exe
  2⤵
  PID:5556
- C:\Windows\System32\XVxUcZE.exe
  C:\Windows\System32\XVxUcZE.exe
  2⤵
  PID:5580
- C:\Windows\System32\VABIbhe.exe
  C:\Windows\System32\VABIbhe.exe
  2⤵
  PID:5608
- C:\Windows\System32\MiEfzVM.exe
  C:\Windows\System32\MiEfzVM.exe
  2⤵
  PID:5636
- C:\Windows\System32\TiYdFRn.exe
  C:\Windows\System32\TiYdFRn.exe
  2⤵
  PID:5664
- C:\Windows\System32\nRGUMof.exe
  C:\Windows\System32\nRGUMof.exe
  2⤵
  PID:5692
- C:\Windows\System32\CKsrCwA.exe
  C:\Windows\System32\CKsrCwA.exe
  2⤵
  PID:5720
- C:\Windows\System32\ltNRkFO.exe
  C:\Windows\System32\ltNRkFO.exe
  2⤵
  PID:5772
- C:\Windows\System32\YHPLVVY.exe
  C:\Windows\System32\YHPLVVY.exe
  2⤵
  PID:5808
- C:\Windows\System32\qqulZAj.exe
  C:\Windows\System32\qqulZAj.exe
  2⤵
  PID:5832
- C:\Windows\System32\fldsTfg.exe
  C:\Windows\System32\fldsTfg.exe
  2⤵
  PID:5888
- C:\Windows\System32\tTPnxwN.exe
  C:\Windows\System32\tTPnxwN.exe
  2⤵
  PID:5908
- C:\Windows\System32\qWWrEuF.exe
  C:\Windows\System32\qWWrEuF.exe
  2⤵
  PID:5932
- C:\Windows\System32\xywXIJE.exe
  C:\Windows\System32\xywXIJE.exe
  2⤵
  PID:5948
- C:\Windows\System32\icKMHhy.exe
  C:\Windows\System32\icKMHhy.exe
  2⤵
  PID:5964
- C:\Windows\System32\IizVJIC.exe
  C:\Windows\System32\IizVJIC.exe
  2⤵
  PID:5980
- C:\Windows\System32\rTKuoGT.exe
  C:\Windows\System32\rTKuoGT.exe
  2⤵
  PID:5996
- C:\Windows\System32\XsClkdf.exe
  C:\Windows\System32\XsClkdf.exe
  2⤵
  PID:6012
- C:\Windows\System32\OXcvzIQ.exe
  C:\Windows\System32\OXcvzIQ.exe
  2⤵
  PID:6028
- C:\Windows\System32\dyHFesN.exe
  C:\Windows\System32\dyHFesN.exe
  2⤵
  PID:6044
- C:\Windows\System32\NyrGuCh.exe
  C:\Windows\System32\NyrGuCh.exe
  2⤵
  PID:6060
- C:\Windows\System32\dwtzzQg.exe
  C:\Windows\System32\dwtzzQg.exe
  2⤵
  PID:6076
- C:\Windows\System32\BDDlBdJ.exe
  C:\Windows\System32\BDDlBdJ.exe
  2⤵
  PID:6092
- C:\Windows\System32\nuGRPRJ.exe
  C:\Windows\System32\nuGRPRJ.exe
  2⤵
  PID:6108
- C:\Windows\System32\nKfojrL.exe
  C:\Windows\System32\nKfojrL.exe
  2⤵
  PID:6124
- C:\Windows\System32\mFhDstr.exe
  C:\Windows\System32\mFhDstr.exe
  2⤵
  PID:6140
- C:\Windows\System32\VYiMlQl.exe
  C:\Windows\System32\VYiMlQl.exe
  2⤵
  PID:2036
- C:\Windows\System32\Pyikewg.exe
  C:\Windows\System32\Pyikewg.exe
  2⤵
  PID:3616
- C:\Windows\System32\BhQSdOE.exe
  C:\Windows\System32\BhQSdOE.exe
  2⤵
  PID:2736
- C:\Windows\System32\LDUqytD.exe
  C:\Windows\System32\LDUqytD.exe
  2⤵
  PID:4104
- C:\Windows\System32\ASrKSnE.exe
  C:\Windows\System32\ASrKSnE.exe
  2⤵
  PID:4312
- C:\Windows\System32\rPSMUTd.exe
  C:\Windows\System32\rPSMUTd.exe
  2⤵
  PID:1524
- C:\Windows\System32\GAVVfYd.exe
  C:\Windows\System32\GAVVfYd.exe
  2⤵
  PID:2388
- C:\Windows\System32\qIIRkbs.exe
  C:\Windows\System32\qIIRkbs.exe
  2⤵
  PID:5124
- C:\Windows\System32\UwMyRaR.exe
  C:\Windows\System32\UwMyRaR.exe
  2⤵
  PID:4164
- C:\Windows\System32\GEcltWZ.exe
  C:\Windows\System32\GEcltWZ.exe
  2⤵
  PID:5168
- C:\Windows\System32\BvEvXTZ.exe
  C:\Windows\System32\BvEvXTZ.exe
  2⤵
  PID:5212
- C:\Windows\System32\sFUuqOY.exe
  C:\Windows\System32\sFUuqOY.exe
  2⤵
  PID:3152
- C:\Windows\System32\QOqOnbx.exe
  C:\Windows\System32\QOqOnbx.exe
  2⤵
  PID:5264
- C:\Windows\System32\CvTKDaM.exe
  C:\Windows\System32\CvTKDaM.exe
  2⤵
  PID:5296
- C:\Windows\System32\JkeVySH.exe
  C:\Windows\System32\JkeVySH.exe
  2⤵
  PID:2216
- C:\Windows\System32\dxUsNvj.exe
  C:\Windows\System32\dxUsNvj.exe
  2⤵
  PID:5336
- C:\Windows\System32\mZsVRHN.exe
  C:\Windows\System32\mZsVRHN.exe
  2⤵
  PID:5372
- C:\Windows\System32\iwgZYbc.exe
  C:\Windows\System32\iwgZYbc.exe
  2⤵
  PID:1336
- C:\Windows\System32\lNaxWkb.exe
  C:\Windows\System32\lNaxWkb.exe
  2⤵
  PID:5448
- C:\Windows\System32\ZAQHvEF.exe
  C:\Windows\System32\ZAQHvEF.exe
  2⤵
  PID:5492
- C:\Windows\System32\FGAWNXY.exe
  C:\Windows\System32\FGAWNXY.exe
  2⤵
  PID:5516
- C:\Windows\System32\cmiYrAW.exe
  C:\Windows\System32\cmiYrAW.exe
  2⤵
  PID:6040
- C:\Windows\System32\hnrCdhD.exe
  C:\Windows\System32\hnrCdhD.exe
  2⤵
  PID:6100
- C:\Windows\System32\XXGbYeD.exe
  C:\Windows\System32\XXGbYeD.exe
  2⤵
  PID:4160
- C:\Windows\System32\oMpdLHO.exe
  C:\Windows\System32\oMpdLHO.exe
  2⤵
  PID:2448
- C:\Windows\System32\SshtXOh.exe
  C:\Windows\System32\SshtXOh.exe
  2⤵
  PID:4052
- C:\Windows\System32\tpqnSIn.exe
  C:\Windows\System32\tpqnSIn.exe
  2⤵
  PID:5032
- C:\Windows\System32\PRTlEBi.exe
  C:\Windows\System32\PRTlEBi.exe
  2⤵
  PID:5348
- C:\Windows\System32\TzCMaOU.exe
  C:\Windows\System32\TzCMaOU.exe
  2⤵
  PID:5344
- C:\Windows\System32\wflCuEK.exe
  C:\Windows\System32\wflCuEK.exe
  2⤵
  PID:5628
- C:\Windows\System32\eseqsrn.exe
  C:\Windows\System32\eseqsrn.exe
  2⤵
  PID:5644
- C:\Windows\System32\uaetRab.exe
  C:\Windows\System32\uaetRab.exe
  2⤵
  PID:4304
- C:\Windows\System32\icbfeVh.exe
  C:\Windows\System32\icbfeVh.exe
  2⤵
  PID:5392
- C:\Windows\System32\vkHmPWm.exe
  C:\Windows\System32\vkHmPWm.exe
  2⤵
  PID:1592
- C:\Windows\System32\dkvFACe.exe
  C:\Windows\System32\dkvFACe.exe
  2⤵
  PID:5752
- C:\Windows\System32\LenrfAE.exe
  C:\Windows\System32\LenrfAE.exe
  2⤵
  PID:5864
- C:\Windows\System32\NMaVJjb.exe
  C:\Windows\System32\NMaVJjb.exe
  2⤵
  PID:5276
- C:\Windows\System32\ZOkieQs.exe
  C:\Windows\System32\ZOkieQs.exe
  2⤵
  PID:5880
- C:\Windows\System32\vVAsByX.exe
  C:\Windows\System32\vVAsByX.exe
  2⤵
  PID:5860
- C:\Windows\System32\odcOygr.exe
  C:\Windows\System32\odcOygr.exe
  2⤵
  PID:1760
- C:\Windows\System32\SLctLtL.exe
  C:\Windows\System32\SLctLtL.exe
  2⤵
  PID:6088
- C:\Windows\System32\NIYVvtA.exe
  C:\Windows\System32\NIYVvtA.exe
  2⤵
  PID:4020
- C:\Windows\System32\PpFneKV.exe
  C:\Windows\System32\PpFneKV.exe
  2⤵
  PID:6156
- C:\Windows\System32\EsTRtnZ.exe
  C:\Windows\System32\EsTRtnZ.exe
  2⤵
  PID:6172
- C:\Windows\System32\EvgCkQj.exe
  C:\Windows\System32\EvgCkQj.exe
  2⤵
  PID:6192
- C:\Windows\System32\TbjbElu.exe
  C:\Windows\System32\TbjbElu.exe
  2⤵
  PID:6212
- C:\Windows\System32\bLMWjNj.exe
  C:\Windows\System32\bLMWjNj.exe
  2⤵
  PID:6268
- C:\Windows\System32\sHlXguw.exe
  C:\Windows\System32\sHlXguw.exe
  2⤵
  PID:6292
- C:\Windows\System32\GNbbhvu.exe
  C:\Windows\System32\GNbbhvu.exe
  2⤵
  PID:6308
- C:\Windows\System32\HaGxmwo.exe
  C:\Windows\System32\HaGxmwo.exe
  2⤵
  PID:6340
- C:\Windows\System32\WlqQgRb.exe
  C:\Windows\System32\WlqQgRb.exe
  2⤵
  PID:6356
- C:\Windows\System32\qjCeQQw.exe
  C:\Windows\System32\qjCeQQw.exe
  2⤵
  PID:6388
- C:\Windows\System32\uJDpjGF.exe
  C:\Windows\System32\uJDpjGF.exe
  2⤵
  PID:6412
- C:\Windows\System32\DQdZZOk.exe
  C:\Windows\System32\DQdZZOk.exe
  2⤵
  PID:6432
- C:\Windows\System32\ocWQTuz.exe
  C:\Windows\System32\ocWQTuz.exe
  2⤵
  PID:6452
- C:\Windows\System32\YCvTdYI.exe
  C:\Windows\System32\YCvTdYI.exe
  2⤵
  PID:6484
- C:\Windows\System32\ZaQddoN.exe
  C:\Windows\System32\ZaQddoN.exe
  2⤵
  PID:6500
- C:\Windows\System32\SVRphdp.exe
  C:\Windows\System32\SVRphdp.exe
  2⤵
  PID:6516
- C:\Windows\System32\KwQdcDd.exe
  C:\Windows\System32\KwQdcDd.exe
  2⤵
  PID:6592
- C:\Windows\System32\aMRKGQS.exe
  C:\Windows\System32\aMRKGQS.exe
  2⤵
  PID:6636
- C:\Windows\System32\IVXGEuj.exe
  C:\Windows\System32\IVXGEuj.exe
  2⤵
  PID:6660
- C:\Windows\System32\ahQdMjx.exe
  C:\Windows\System32\ahQdMjx.exe
  2⤵
  PID:6680
- C:\Windows\System32\ieBJPcT.exe
  C:\Windows\System32\ieBJPcT.exe
  2⤵
  PID:6704
- C:\Windows\System32\NdbOvtu.exe
  C:\Windows\System32\NdbOvtu.exe
  2⤵
  PID:6720
- C:\Windows\System32\EhHtqgL.exe
  C:\Windows\System32\EhHtqgL.exe
  2⤵
  PID:6744
- C:\Windows\System32\gpNLBrT.exe
  C:\Windows\System32\gpNLBrT.exe
  2⤵
  PID:6760
- C:\Windows\System32\VizwxZA.exe
  C:\Windows\System32\VizwxZA.exe
  2⤵
  PID:6784
- C:\Windows\System32\NFmflWs.exe
  C:\Windows\System32\NFmflWs.exe
  2⤵
  PID:6812
- C:\Windows\System32\TtuPnna.exe
  C:\Windows\System32\TtuPnna.exe
  2⤵
  PID:6888
- C:\Windows\System32\HVMRcKh.exe
  C:\Windows\System32\HVMRcKh.exe
  2⤵
  PID:6904
- C:\Windows\System32\iBmjzQU.exe
  C:\Windows\System32\iBmjzQU.exe
  2⤵
  PID:6924
- C:\Windows\System32\tPGOGDr.exe
  C:\Windows\System32\tPGOGDr.exe
  2⤵
  PID:6948
- C:\Windows\System32\dBrParn.exe
  C:\Windows\System32\dBrParn.exe
  2⤵
  PID:7008
- C:\Windows\System32\RWPMBGM.exe
  C:\Windows\System32\RWPMBGM.exe
  2⤵
  PID:7032
- C:\Windows\System32\GHPSyXh.exe
  C:\Windows\System32\GHPSyXh.exe
  2⤵
  PID:7048
- C:\Windows\System32\vngpauZ.exe
  C:\Windows\System32\vngpauZ.exe
  2⤵
  PID:7072
- C:\Windows\System32\IQNgxJM.exe
  C:\Windows\System32\IQNgxJM.exe
  2⤵
  PID:7088
- C:\Windows\System32\CiAPOzE.exe
  C:\Windows\System32\CiAPOzE.exe
  2⤵
  PID:7108
- C:\Windows\System32\iHBWrCV.exe
  C:\Windows\System32\iHBWrCV.exe
  2⤵
  PID:7124
- C:\Windows\System32\TEkHRlB.exe
  C:\Windows\System32\TEkHRlB.exe
  2⤵
  PID:6148
- C:\Windows\System32\aBsWyOG.exe
  C:\Windows\System32\aBsWyOG.exe
  2⤵
  PID:6280
- C:\Windows\System32\wVGbmxM.exe
  C:\Windows\System32\wVGbmxM.exe
  2⤵
  PID:6368
- C:\Windows\System32\Akiwqwl.exe
  C:\Windows\System32\Akiwqwl.exe
  2⤵
  PID:6380
- C:\Windows\System32\GGfGDde.exe
  C:\Windows\System32\GGfGDde.exe
  2⤵
  PID:6472
- C:\Windows\System32\KdLUiwN.exe
  C:\Windows\System32\KdLUiwN.exe
  2⤵
  PID:6532
- C:\Windows\System32\UvBplxW.exe
  C:\Windows\System32\UvBplxW.exe
  2⤵
  PID:6548
- C:\Windows\System32\qmHXgfj.exe
  C:\Windows\System32\qmHXgfj.exe
  2⤵
  PID:6608
- C:\Windows\System32\DhzhZOv.exe
  C:\Windows\System32\DhzhZOv.exe
  2⤵
  PID:6716
- C:\Windows\System32\rABDBxs.exe
  C:\Windows\System32\rABDBxs.exe
  2⤵
  PID:6776
- C:\Windows\System32\oCaiosU.exe
  C:\Windows\System32\oCaiosU.exe
  2⤵
  PID:6732
- C:\Windows\System32\jGUHlJx.exe
  C:\Windows\System32\jGUHlJx.exe
  2⤵
  PID:6840
- C:\Windows\System32\ppFuqaj.exe
  C:\Windows\System32\ppFuqaj.exe
  2⤵
  PID:7020
- C:\Windows\System32\BuRwQhK.exe
  C:\Windows\System32\BuRwQhK.exe
  2⤵
  PID:7060
- C:\Windows\System32\uPKheft.exe
  C:\Windows\System32\uPKheft.exe
  2⤵
  PID:7080
- C:\Windows\System32\mYydXBG.exe
  C:\Windows\System32\mYydXBG.exe
  2⤵
  PID:7156
- C:\Windows\System32\qqRyhhU.exe
  C:\Windows\System32\qqRyhhU.exe
  2⤵
  PID:6208
- C:\Windows\System32\rUNOFWy.exe
  C:\Windows\System32\rUNOFWy.exe
  2⤵
  PID:6284
- C:\Windows\System32\AkPteEq.exe
  C:\Windows\System32\AkPteEq.exe
  2⤵
  PID:6464
- C:\Windows\System32\ESYCTup.exe
  C:\Windows\System32\ESYCTup.exe
  2⤵
  PID:6672
- C:\Windows\System32\wmBEjMH.exe
  C:\Windows\System32\wmBEjMH.exe
  2⤵
  PID:6836
- C:\Windows\System32\tZuyVjP.exe
  C:\Windows\System32\tZuyVjP.exe
  2⤵
  PID:7024
- C:\Windows\System32\VrjhYfP.exe
  C:\Windows\System32\VrjhYfP.exe
  2⤵
  PID:6220
- C:\Windows\System32\zbxCeJA.exe
  C:\Windows\System32\zbxCeJA.exe
  2⤵
  PID:7144
- C:\Windows\System32\KgZZMaP.exe
  C:\Windows\System32\KgZZMaP.exe
  2⤵
  PID:6756
- C:\Windows\System32\aVLJxBm.exe
  C:\Windows\System32\aVLJxBm.exe
  2⤵
  PID:6792
- C:\Windows\System32\FOxGBaN.exe
  C:\Windows\System32\FOxGBaN.exe
  2⤵
  PID:7120
- C:\Windows\System32\PfFyHhL.exe
  C:\Windows\System32\PfFyHhL.exe
  2⤵
  PID:7184
- C:\Windows\System32\IuByQAJ.exe
  C:\Windows\System32\IuByQAJ.exe
  2⤵
  PID:7204
- C:\Windows\System32\ORNjJiX.exe
  C:\Windows\System32\ORNjJiX.exe
  2⤵
  PID:7220
- C:\Windows\System32\BuzWKIr.exe
  C:\Windows\System32\BuzWKIr.exe
  2⤵
  PID:7248
- C:\Windows\System32\uxJdiKx.exe
  C:\Windows\System32\uxJdiKx.exe
  2⤵
  PID:7276
- C:\Windows\System32\vMuzdkI.exe
  C:\Windows\System32\vMuzdkI.exe
  2⤵
  PID:7332
- C:\Windows\System32\VAFywSC.exe
  C:\Windows\System32\VAFywSC.exe
  2⤵
  PID:7348
- C:\Windows\System32\NwpXcXV.exe
  C:\Windows\System32\NwpXcXV.exe
  2⤵
  PID:7372
- C:\Windows\System32\jcYGcLl.exe
  C:\Windows\System32\jcYGcLl.exe
  2⤵
  PID:7388
- C:\Windows\System32\RWZodgu.exe
  C:\Windows\System32\RWZodgu.exe
  2⤵
  PID:7408
- C:\Windows\System32\nSzcSqL.exe
  C:\Windows\System32\nSzcSqL.exe
  2⤵
  PID:7452
- C:\Windows\System32\bPtDNvy.exe
  C:\Windows\System32\bPtDNvy.exe
  2⤵
  PID:7500
- C:\Windows\System32\pUvhoqQ.exe
  C:\Windows\System32\pUvhoqQ.exe
  2⤵
  PID:7528
- C:\Windows\System32\DxafRFo.exe
  C:\Windows\System32\DxafRFo.exe
  2⤵
  PID:7560
- C:\Windows\System32\kfsLMIc.exe
  C:\Windows\System32\kfsLMIc.exe
  2⤵
  PID:7588
- C:\Windows\System32\aPEfZPv.exe
  C:\Windows\System32\aPEfZPv.exe
  2⤵
  PID:7612
- C:\Windows\System32\wHiOcDZ.exe
  C:\Windows\System32\wHiOcDZ.exe
  2⤵
  PID:7628
- C:\Windows\System32\dfltqqe.exe
  C:\Windows\System32\dfltqqe.exe
  2⤵
  PID:7648
- C:\Windows\System32\JIlKxDV.exe
  C:\Windows\System32\JIlKxDV.exe
  2⤵
  PID:7668
- C:\Windows\System32\vJwznvg.exe
  C:\Windows\System32\vJwznvg.exe
  2⤵
  PID:7684
- C:\Windows\System32\FdImoax.exe
  C:\Windows\System32\FdImoax.exe
  2⤵
  PID:7712
- C:\Windows\System32\xLgvgSx.exe
  C:\Windows\System32\xLgvgSx.exe
  2⤵
  PID:7760
- C:\Windows\System32\ONDqLpD.exe
  C:\Windows\System32\ONDqLpD.exe
  2⤵
  PID:7812
- C:\Windows\System32\ZeliETn.exe
  C:\Windows\System32\ZeliETn.exe
  2⤵
  PID:7840
- C:\Windows\System32\SIYTPuT.exe
  C:\Windows\System32\SIYTPuT.exe
  2⤵
  PID:7860
- C:\Windows\System32\NCURlUg.exe
  C:\Windows\System32\NCURlUg.exe
  2⤵
  PID:7876
- C:\Windows\System32\MUflsWx.exe
  C:\Windows\System32\MUflsWx.exe
  2⤵
  PID:7912
- C:\Windows\System32\EgIhTbJ.exe
  C:\Windows\System32\EgIhTbJ.exe
  2⤵
  PID:7956
- C:\Windows\System32\GZgtJxu.exe
  C:\Windows\System32\GZgtJxu.exe
  2⤵
  PID:7984
- C:\Windows\System32\OYWgDqC.exe
  C:\Windows\System32\OYWgDqC.exe
  2⤵
  PID:8008
- C:\Windows\System32\ggSHJaH.exe
  C:\Windows\System32\ggSHJaH.exe
  2⤵
  PID:8028
- C:\Windows\System32\XDZStAk.exe
  C:\Windows\System32\XDZStAk.exe
  2⤵
  PID:8048
- C:\Windows\System32\bgfeRVF.exe
  C:\Windows\System32\bgfeRVF.exe
  2⤵
  PID:8092
- C:\Windows\System32\FRoALao.exe
  C:\Windows\System32\FRoALao.exe
  2⤵
  PID:8120
- C:\Windows\System32\xaRrZpT.exe
  C:\Windows\System32\xaRrZpT.exe
  2⤵
  PID:8140
- C:\Windows\System32\PpHBsjR.exe
  C:\Windows\System32\PpHBsjR.exe
  2⤵
  PID:8168
- C:\Windows\System32\yVwmAfa.exe
  C:\Windows\System32\yVwmAfa.exe
  2⤵
  PID:8188
- C:\Windows\System32\fDSnRCM.exe
  C:\Windows\System32\fDSnRCM.exe
  2⤵
  PID:6932
- C:\Windows\System32\anMaQzp.exe
  C:\Windows\System32\anMaQzp.exe
  2⤵
  PID:7196
- C:\Windows\System32\ZExNYna.exe
  C:\Windows\System32\ZExNYna.exe
  2⤵
  PID:7300
- C:\Windows\System32\foXKqno.exe
  C:\Windows\System32\foXKqno.exe
  2⤵
  PID:7380
- C:\Windows\System32\NTlQpnR.exe
  C:\Windows\System32\NTlQpnR.exe
  2⤵
  PID:7480
- C:\Windows\System32\zlAnnXt.exe
  C:\Windows\System32\zlAnnXt.exe
  2⤵
  PID:7544
- C:\Windows\System32\wIuDNKK.exe
  C:\Windows\System32\wIuDNKK.exe
  2⤵
  PID:7576
- C:\Windows\System32\rPkkhCm.exe
  C:\Windows\System32\rPkkhCm.exe
  2⤵
  PID:7620
- C:\Windows\System32\wVxARhU.exe
  C:\Windows\System32\wVxARhU.exe
  2⤵
  PID:7704
- C:\Windows\System32\NfxgxwU.exe
  C:\Windows\System32\NfxgxwU.exe
  2⤵
  PID:7808
- C:\Windows\System32\WMTmDnu.exe
  C:\Windows\System32\WMTmDnu.exe
  2⤵
  PID:7852
- C:\Windows\System32\mrglLEv.exe
  C:\Windows\System32\mrglLEv.exe
  2⤵
  PID:7968
- C:\Windows\System32\LHzSxzP.exe
  C:\Windows\System32\LHzSxzP.exe
  2⤵
  PID:8064
- C:\Windows\System32\kVLCVDB.exe
  C:\Windows\System32\kVLCVDB.exe
  2⤵
  PID:8100
- C:\Windows\System32\xnKiUYB.exe
  C:\Windows\System32\xnKiUYB.exe
  2⤵
  PID:8116
- C:\Windows\System32\aeDEGrX.exe
  C:\Windows\System32\aeDEGrX.exe
  2⤵
  PID:6364
- C:\Windows\System32\TpHjUKl.exe
  C:\Windows\System32\TpHjUKl.exe
  2⤵
  PID:7216
- C:\Windows\System32\mTgIdzZ.exe
  C:\Windows\System32\mTgIdzZ.exe
  2⤵
  PID:7356
- C:\Windows\System32\ozfgCSr.exe
  C:\Windows\System32\ozfgCSr.exe
  2⤵
  PID:7600
- C:\Windows\System32\XZYntld.exe
  C:\Windows\System32\XZYntld.exe
  2⤵
  PID:7788
- C:\Windows\System32\MQXJckT.exe
  C:\Windows\System32\MQXJckT.exe
  2⤵
  PID:7900
- C:\Windows\System32\LTAVHdY.exe
  C:\Windows\System32\LTAVHdY.exe
  2⤵
  PID:8040
- C:\Windows\System32\rEbdEbd.exe
  C:\Windows\System32\rEbdEbd.exe
  2⤵
  PID:8184
- C:\Windows\System32\iwKYoUO.exe
  C:\Windows\System32\iwKYoUO.exe
  2⤵
  PID:8180
- C:\Windows\System32\hBoSFqu.exe
  C:\Windows\System32\hBoSFqu.exe
  2⤵
  PID:7512
- C:\Windows\System32\xtutAir.exe
  C:\Windows\System32\xtutAir.exe
  2⤵
  PID:8132
- C:\Windows\System32\JWpeIPB.exe
  C:\Windows\System32\JWpeIPB.exe
  2⤵
  PID:7364
- C:\Windows\System32\ivGMnTZ.exe
  C:\Windows\System32\ivGMnTZ.exe
  2⤵
  PID:8208
- C:\Windows\System32\cznCnon.exe
  C:\Windows\System32\cznCnon.exe
  2⤵
  PID:8248
- C:\Windows\System32\qLJtRMe.exe
  C:\Windows\System32\qLJtRMe.exe
  2⤵
  PID:8268
- C:\Windows\System32\BSJLktb.exe
  C:\Windows\System32\BSJLktb.exe
  2⤵
  PID:8344
- C:\Windows\System32\fimPWHs.exe
  C:\Windows\System32\fimPWHs.exe
  2⤵
  PID:8372
- C:\Windows\System32\PCpoeoJ.exe
  C:\Windows\System32\PCpoeoJ.exe
  2⤵
  PID:8388
- C:\Windows\System32\ayoIRPE.exe
  C:\Windows\System32\ayoIRPE.exe
  2⤵
  PID:8416
- C:\Windows\System32\BooJzUI.exe
  C:\Windows\System32\BooJzUI.exe
  2⤵
  PID:8436
- C:\Windows\System32\RbFDfUI.exe
  C:\Windows\System32\RbFDfUI.exe
  2⤵
  PID:8460
- C:\Windows\System32\ssgujQi.exe
  C:\Windows\System32\ssgujQi.exe
  2⤵
  PID:8480
- C:\Windows\System32\iEtZRhC.exe
  C:\Windows\System32\iEtZRhC.exe
  2⤵
  PID:8512
- C:\Windows\System32\wyfurOl.exe
  C:\Windows\System32\wyfurOl.exe
  2⤵
  PID:8572
- C:\Windows\System32\cSDFNrg.exe
  C:\Windows\System32\cSDFNrg.exe
  2⤵
  PID:8596
- C:\Windows\System32\adMlBhB.exe
  C:\Windows\System32\adMlBhB.exe
  2⤵
  PID:8620
- C:\Windows\System32\OXwAAFl.exe
  C:\Windows\System32\OXwAAFl.exe
  2⤵
  PID:8636
- C:\Windows\System32\tkCOWmj.exe
  C:\Windows\System32\tkCOWmj.exe
  2⤵
  PID:8656
- C:\Windows\System32\oqzZUJu.exe
  C:\Windows\System32\oqzZUJu.exe
  2⤵
  PID:8704
- C:\Windows\System32\osJXIMd.exe
  C:\Windows\System32\osJXIMd.exe
  2⤵
  PID:8728
- C:\Windows\System32\vENfyiE.exe
  C:\Windows\System32\vENfyiE.exe
  2⤵
  PID:8744
- C:\Windows\System32\hmzGOKb.exe
  C:\Windows\System32\hmzGOKb.exe
  2⤵
  PID:8764
- C:\Windows\System32\eCniuEl.exe
  C:\Windows\System32\eCniuEl.exe
  2⤵
  PID:8796
- C:\Windows\System32\LNCSdfE.exe
  C:\Windows\System32\LNCSdfE.exe
  2⤵
  PID:8824
- C:\Windows\System32\bPPKarJ.exe
  C:\Windows\System32\bPPKarJ.exe
  2⤵
  PID:8844
- C:\Windows\System32\kvNZpQO.exe
  C:\Windows\System32\kvNZpQO.exe
  2⤵
  PID:8864
- C:\Windows\System32\ojGrZiK.exe
  C:\Windows\System32\ojGrZiK.exe
  2⤵
  PID:8896
- C:\Windows\System32\thNeXiV.exe
  C:\Windows\System32\thNeXiV.exe
  2⤵
  PID:8924
- C:\Windows\System32\aULRQrw.exe
  C:\Windows\System32\aULRQrw.exe
  2⤵
  PID:8944
- C:\Windows\System32\GkSFBrV.exe
  C:\Windows\System32\GkSFBrV.exe
  2⤵
  PID:8960
- C:\Windows\System32\MvpTwuF.exe
  C:\Windows\System32\MvpTwuF.exe
  2⤵
  PID:8996
- C:\Windows\System32\UYoAcQu.exe
  C:\Windows\System32\UYoAcQu.exe
  2⤵
  PID:9056
- C:\Windows\System32\vRNzoVO.exe
  C:\Windows\System32\vRNzoVO.exe
  2⤵
  PID:9084
- C:\Windows\System32\sWctbSr.exe
  C:\Windows\System32\sWctbSr.exe
  2⤵
  PID:9108
- C:\Windows\System32\Kaqcymt.exe
  C:\Windows\System32\Kaqcymt.exe
  2⤵
  PID:9128
- C:\Windows\System32\pJEyUrB.exe
  C:\Windows\System32\pJEyUrB.exe
  2⤵
  PID:9144
- C:\Windows\System32\cBcdtvb.exe
  C:\Windows\System32\cBcdtvb.exe
  2⤵
  PID:9180
- C:\Windows\System32\qJIltmt.exe
  C:\Windows\System32\qJIltmt.exe
  2⤵
  PID:9200
- C:\Windows\System32\JFXnjJg.exe
  C:\Windows\System32\JFXnjJg.exe
  2⤵
  PID:7824
- C:\Windows\System32\wbSFXln.exe
  C:\Windows\System32\wbSFXln.exe
  2⤵
  PID:8024
- C:\Windows\System32\ZERfrsm.exe
  C:\Windows\System32\ZERfrsm.exe
  2⤵
  PID:8324
- C:\Windows\System32\tWIvQiS.exe
  C:\Windows\System32\tWIvQiS.exe
  2⤵
  PID:8412
- C:\Windows\System32\EAWJNNK.exe
  C:\Windows\System32\EAWJNNK.exe
  2⤵
  PID:8428
- C:\Windows\System32\PekKrSH.exe
  C:\Windows\System32\PekKrSH.exe
  2⤵
  PID:8472
- C:\Windows\System32\TNyprdW.exe
  C:\Windows\System32\TNyprdW.exe
  2⤵
  PID:8644
- C:\Windows\System32\KmNgtIy.exe
  C:\Windows\System32\KmNgtIy.exe
  2⤵
  PID:8692
- C:\Windows\System32\GGUhvSr.exe
  C:\Windows\System32\GGUhvSr.exe
  2⤵
  PID:8776
- C:\Windows\System32\ipygEqo.exe
  C:\Windows\System32\ipygEqo.exe
  2⤵
  PID:8880
- C:\Windows\System32\bIhVqTy.exe
  C:\Windows\System32\bIhVqTy.exe
  2⤵
  PID:8820
- C:\Windows\System32\PAPmzGF.exe
  C:\Windows\System32\PAPmzGF.exe
  2⤵
  PID:8976
- C:\Windows\System32\elSpoSF.exe
  C:\Windows\System32\elSpoSF.exe
  2⤵
  PID:8988
- C:\Windows\System32\rkNGpmd.exe
  C:\Windows\System32\rkNGpmd.exe
  2⤵
  PID:9008
- C:\Windows\System32\ZNquBPr.exe
  C:\Windows\System32\ZNquBPr.exe
  2⤵
  PID:9164
- C:\Windows\System32\KIDwTlw.exe
  C:\Windows\System32\KIDwTlw.exe
  2⤵
  PID:9100
- C:\Windows\System32\teQOnmS.exe
  C:\Windows\System32\teQOnmS.exe
  2⤵
  PID:8256
- C:\Windows\System32\ZlvHfue.exe
  C:\Windows\System32\ZlvHfue.exe
  2⤵
  PID:8476
- C:\Windows\System32\xByKWdf.exe
  C:\Windows\System32\xByKWdf.exe
  2⤵
  PID:8400
- C:\Windows\System32\XNDWHtH.exe
  C:\Windows\System32\XNDWHtH.exe
  2⤵
  PID:8736
- C:\Windows\System32\EUWfvKw.exe
  C:\Windows\System32\EUWfvKw.exe
  2⤵
  PID:8968
- C:\Windows\System32\chUiioy.exe
  C:\Windows\System32\chUiioy.exe
  2⤵
  PID:9020
- C:\Windows\System32\VBUOwSx.exe
  C:\Windows\System32\VBUOwSx.exe
  2⤵
  PID:8368
- C:\Windows\System32\GOGiIDr.exe
  C:\Windows\System32\GOGiIDr.exe
  2⤵
  PID:8584
- C:\Windows\System32\gkINUXL.exe
  C:\Windows\System32\gkINUXL.exe
  2⤵
  PID:8876
- C:\Windows\System32\yaxpExq.exe
  C:\Windows\System32\yaxpExq.exe
  2⤵
  PID:9172
- C:\Windows\System32\LUpNcLz.exe
  C:\Windows\System32\LUpNcLz.exe
  2⤵
  PID:8652
- C:\Windows\System32\kQOagKr.exe
  C:\Windows\System32\kQOagKr.exe
  2⤵
  PID:9252
- C:\Windows\System32\ZjSjCDE.exe
  C:\Windows\System32\ZjSjCDE.exe
  2⤵
  PID:9296
- C:\Windows\System32\mzRCPmb.exe
  C:\Windows\System32\mzRCPmb.exe
  2⤵
  PID:9316
- C:\Windows\System32\bTnlgMm.exe
  C:\Windows\System32\bTnlgMm.exe
  2⤵
  PID:9332
- C:\Windows\System32\KGdaVJw.exe
  C:\Windows\System32\KGdaVJw.exe
  2⤵
  PID:9364
- C:\Windows\System32\wFnVnpW.exe
  C:\Windows\System32\wFnVnpW.exe
  2⤵
  PID:9380
- C:\Windows\System32\dsSPKeG.exe
  C:\Windows\System32\dsSPKeG.exe
  2⤵
  PID:9408
- C:\Windows\System32\KeSOaIT.exe
  C:\Windows\System32\KeSOaIT.exe
  2⤵
  PID:9424
- C:\Windows\System32\FcfCQZl.exe
  C:\Windows\System32\FcfCQZl.exe
  2⤵
  PID:9544
- C:\Windows\System32\UsTkauu.exe
  C:\Windows\System32\UsTkauu.exe
  2⤵
  PID:9568
- C:\Windows\System32\aZnseds.exe
  C:\Windows\System32\aZnseds.exe
  2⤵
  PID:9584
- C:\Windows\System32\SDpTeLF.exe
  C:\Windows\System32\SDpTeLF.exe
  2⤵
  PID:9600
- C:\Windows\System32\KWwjQgb.exe
  C:\Windows\System32\KWwjQgb.exe
  2⤵
  PID:9616
- C:\Windows\System32\vTrSIhf.exe
  C:\Windows\System32\vTrSIhf.exe
  2⤵
  PID:9632
- C:\Windows\System32\btIsbgx.exe
  C:\Windows\System32\btIsbgx.exe
  2⤵
  PID:9648
- C:\Windows\System32\npkEuyI.exe
  C:\Windows\System32\npkEuyI.exe
  2⤵
  PID:9664
- C:\Windows\System32\YPlgxRO.exe
  C:\Windows\System32\YPlgxRO.exe
  2⤵
  PID:9680
- C:\Windows\System32\MHvlvSS.exe
  C:\Windows\System32\MHvlvSS.exe
  2⤵
  PID:9696
- C:\Windows\System32\zZJRaKi.exe
  C:\Windows\System32\zZJRaKi.exe
  2⤵
  PID:9712
- C:\Windows\System32\WEwVyXz.exe
  C:\Windows\System32\WEwVyXz.exe
  2⤵
  PID:9800
- C:\Windows\System32\YjvfLMz.exe
  C:\Windows\System32\YjvfLMz.exe
  2⤵
  PID:9904
- C:\Windows\System32\qWjWekD.exe
  C:\Windows\System32\qWjWekD.exe
  2⤵
  PID:9924
- C:\Windows\System32\pHjWRmv.exe
  C:\Windows\System32\pHjWRmv.exe
  2⤵
  PID:9948
- C:\Windows\System32\bkUCZtm.exe
  C:\Windows\System32\bkUCZtm.exe
  2⤵
  PID:10000
- C:\Windows\System32\LJJHCxv.exe
  C:\Windows\System32\LJJHCxv.exe
  2⤵
  PID:10056
- C:\Windows\System32\UHMZeZm.exe
  C:\Windows\System32\UHMZeZm.exe
  2⤵
  PID:10076
- C:\Windows\System32\MQTLlhp.exe
  C:\Windows\System32\MQTLlhp.exe
  2⤵
  PID:10108
- C:\Windows\System32\FlcLTYX.exe
  C:\Windows\System32\FlcLTYX.exe
  2⤵
  PID:10148
- C:\Windows\System32\yMaseGu.exe
  C:\Windows\System32\yMaseGu.exe
  2⤵
  PID:10168
- C:\Windows\System32\iXOYsQL.exe
  C:\Windows\System32\iXOYsQL.exe
  2⤵
  PID:10192
- C:\Windows\System32\bCAaXQO.exe
  C:\Windows\System32\bCAaXQO.exe
  2⤵
  PID:10208
- C:\Windows\System32\hVdPxdu.exe
  C:\Windows\System32\hVdPxdu.exe
  2⤵
  PID:10228
- C:\Windows\System32\MQrbpUw.exe
  C:\Windows\System32\MQrbpUw.exe
  2⤵
  PID:9224
- C:\Windows\System32\KgiEPeF.exe
  C:\Windows\System32\KgiEPeF.exe
  2⤵
  PID:9012
- C:\Windows\System32\NYckDdl.exe
  C:\Windows\System32\NYckDdl.exe
  2⤵
  PID:9312
- C:\Windows\System32\XVpAoRf.exe
  C:\Windows\System32\XVpAoRf.exe
  2⤵
  PID:9376
- C:\Windows\System32\xNfeOXq.exe
  C:\Windows\System32\xNfeOXq.exe
  2⤵
  PID:9432
- C:\Windows\System32\czqDbbp.exe
  C:\Windows\System32\czqDbbp.exe
  2⤵
  PID:9396
- C:\Windows\System32\GYABJzC.exe
  C:\Windows\System32\GYABJzC.exe
  2⤵
  PID:9388
- C:\Windows\System32\zIhCfFN.exe
  C:\Windows\System32\zIhCfFN.exe
  2⤵
  PID:9464
- C:\Windows\System32\ZaDEhhB.exe
  C:\Windows\System32\ZaDEhhB.exe
  2⤵
  PID:9500
- C:\Windows\System32\tAgFSZt.exe
  C:\Windows\System32\tAgFSZt.exe
  2⤵
  PID:9536
- C:\Windows\System32\RczgHRO.exe
  C:\Windows\System32\RczgHRO.exe
  2⤵
  PID:9644
- C:\Windows\System32\HmjfOyb.exe
  C:\Windows\System32\HmjfOyb.exe
  2⤵
  PID:9784
- C:\Windows\System32\ksXhAuH.exe
  C:\Windows\System32\ksXhAuH.exe
  2⤵
  PID:9840
- C:\Windows\System32\YdgpeKK.exe
  C:\Windows\System32\YdgpeKK.exe
  2⤵
  PID:9876
- C:\Windows\System32\dpVGuCN.exe
  C:\Windows\System32\dpVGuCN.exe
  2⤵
  PID:9944
- C:\Windows\System32\bvtOELa.exe
  C:\Windows\System32\bvtOELa.exe
  2⤵
  PID:10008
- C:\Windows\System32\bOYmElq.exe
  C:\Windows\System32\bOYmElq.exe
  2⤵
  PID:10136
- C:\Windows\System32\HfeqciI.exe
  C:\Windows\System32\HfeqciI.exe
  2⤵
  PID:8856
- C:\Windows\System32\TvMODBx.exe
  C:\Windows\System32\TvMODBx.exe
  2⤵
  PID:9232
- C:\Windows\System32\WWTchqO.exe
  C:\Windows\System32\WWTchqO.exe
  2⤵
  PID:9532
- C:\Windows\System32\ciTcsQc.exe
  C:\Windows\System32\ciTcsQc.exe
  2⤵
  PID:9448
- C:\Windows\System32\vmGIBRr.exe
  C:\Windows\System32\vmGIBRr.exe
  2⤵
  PID:9580
- C:\Windows\System32\AekwAof.exe
  C:\Windows\System32\AekwAof.exe
  2⤵
  PID:9472
- C:\Windows\System32\XZdgowD.exe
  C:\Windows\System32\XZdgowD.exe
  2⤵
  PID:9552
- C:\Windows\System32\tlngiIN.exe
  C:\Windows\System32\tlngiIN.exe
  2⤵
  PID:9808
- C:\Windows\System32\yoOAfeE.exe
  C:\Windows\System32\yoOAfeE.exe
  2⤵
  PID:10024
- C:\Windows\System32\eBiHBtH.exe
  C:\Windows\System32\eBiHBtH.exe
  2⤵
  PID:10220
- C:\Windows\System32\dovAdNi.exe
  C:\Windows\System32\dovAdNi.exe
  2⤵
  PID:9196
- C:\Windows\System32\etPefVC.exe
  C:\Windows\System32\etPefVC.exe
  2⤵
  PID:9708
- C:\Windows\System32\VCxSAUJ.exe
  C:\Windows\System32\VCxSAUJ.exe
  2⤵
  PID:10092
- C:\Windows\System32\YElujSS.exe
  C:\Windows\System32\YElujSS.exe
  2⤵
  PID:9444
- C:\Windows\System32\pxUppxY.exe
  C:\Windows\System32\pxUppxY.exe
  2⤵
  PID:10268
- C:\Windows\System32\hVHuRte.exe
  C:\Windows\System32\hVHuRte.exe
  2⤵
  PID:10308
- C:\Windows\System32\VHfTIKG.exe
  C:\Windows\System32\VHfTIKG.exe
  2⤵
  PID:10340
- C:\Windows\System32\jtIiJwG.exe
  C:\Windows\System32\jtIiJwG.exe
  2⤵
  PID:10364
- C:\Windows\System32\ZbHvzWq.exe
  C:\Windows\System32\ZbHvzWq.exe
  2⤵
  PID:10380
- C:\Windows\System32\IHLqdMc.exe
  C:\Windows\System32\IHLqdMc.exe
  2⤵
  PID:10416
- C:\Windows\System32\ojcjNkp.exe
  C:\Windows\System32\ojcjNkp.exe
  2⤵
  PID:10448
- C:\Windows\System32\TbpvRHX.exe
  C:\Windows\System32\TbpvRHX.exe
  2⤵
  PID:10464
- C:\Windows\System32\CVVYpGe.exe
  C:\Windows\System32\CVVYpGe.exe
  2⤵
  PID:10516
- C:\Windows\System32\EJSzlXB.exe
  C:\Windows\System32\EJSzlXB.exe
  2⤵
  PID:10532
- C:\Windows\System32\wtAQbMF.exe
  C:\Windows\System32\wtAQbMF.exe
  2⤵
  PID:10548
- C:\Windows\System32\XcyOvKs.exe
  C:\Windows\System32\XcyOvKs.exe
  2⤵
  PID:10564
- C:\Windows\System32\yiymCPs.exe
  C:\Windows\System32\yiymCPs.exe
  2⤵
  PID:10604
- C:\Windows\System32\ZLPKltu.exe
  C:\Windows\System32\ZLPKltu.exe
  2⤵
  PID:10624
- C:\Windows\System32\NzUKPgz.exe
  C:\Windows\System32\NzUKPgz.exe
  2⤵
  PID:10652
- C:\Windows\System32\Naapdxi.exe
  C:\Windows\System32\Naapdxi.exe
  2⤵
  PID:10684
- C:\Windows\System32\XKUtYcJ.exe
  C:\Windows\System32\XKUtYcJ.exe
  2⤵
  PID:10728
- C:\Windows\System32\ldMZopa.exe
  C:\Windows\System32\ldMZopa.exe
  2⤵
  PID:10760
- C:\Windows\System32\KvYbdCC.exe
  C:\Windows\System32\KvYbdCC.exe
  2⤵
  PID:10780
- C:\Windows\System32\ALdmqFp.exe
  C:\Windows\System32\ALdmqFp.exe
  2⤵
  PID:10804
- C:\Windows\System32\KpstJom.exe
  C:\Windows\System32\KpstJom.exe
  2⤵
  PID:10844
- C:\Windows\System32\kpiSEsL.exe
  C:\Windows\System32\kpiSEsL.exe
  2⤵
  PID:10872
- C:\Windows\System32\CdyeePH.exe
  C:\Windows\System32\CdyeePH.exe
  2⤵
  PID:10896
- C:\Windows\System32\pLqgQoa.exe
  C:\Windows\System32\pLqgQoa.exe
  2⤵
  PID:10912
- C:\Windows\System32\HQgRKoF.exe
  C:\Windows\System32\HQgRKoF.exe
  2⤵
  PID:10936
- C:\Windows\System32\ZzhxpDC.exe
  C:\Windows\System32\ZzhxpDC.exe
  2⤵
  PID:10960
- C:\Windows\System32\YzrFyqq.exe
  C:\Windows\System32\YzrFyqq.exe
  2⤵
  PID:11020
- C:\Windows\System32\KsqftJb.exe
  C:\Windows\System32\KsqftJb.exe
  2⤵
  PID:11044
- C:\Windows\System32\lagSaCa.exe
  C:\Windows\System32\lagSaCa.exe
  2⤵
  PID:11080
- C:\Windows\System32\iJoUibO.exe
  C:\Windows\System32\iJoUibO.exe
  2⤵
  PID:11108
- C:\Windows\System32\zfktVTO.exe
  C:\Windows\System32\zfktVTO.exe
  2⤵
  PID:11124
- C:\Windows\System32\fwbRiPm.exe
  C:\Windows\System32\fwbRiPm.exe
  2⤵
  PID:11144
- C:\Windows\System32\mIQSmlV.exe
  C:\Windows\System32\mIQSmlV.exe
  2⤵
  PID:11184
- C:\Windows\System32\nkiMVXT.exe
  C:\Windows\System32\nkiMVXT.exe
  2⤵
  PID:11212
- C:\Windows\System32\rDFtXQa.exe
  C:\Windows\System32\rDFtXQa.exe
  2⤵
  PID:11228
- C:\Windows\System32\shwVDru.exe
  C:\Windows\System32\shwVDru.exe
  2⤵
  PID:11252
- C:\Windows\System32\XJQoGxr.exe
  C:\Windows\System32\XJQoGxr.exe
  2⤵
  PID:9976
- C:\Windows\System32\JuYhdHj.exe
  C:\Windows\System32\JuYhdHj.exe
  2⤵
  PID:10296
- C:\Windows\System32\ppmqLWD.exe
  C:\Windows\System32\ppmqLWD.exe
  2⤵
  PID:10372
- C:\Windows\System32\tNJyNPN.exe
  C:\Windows\System32\tNJyNPN.exe
  2⤵
  PID:10476
- C:\Windows\System32\cuOakvW.exe
  C:\Windows\System32\cuOakvW.exe
  2⤵
  PID:10572
- C:\Windows\System32\XRTtAxN.exe
  C:\Windows\System32\XRTtAxN.exe
  2⤵
  PID:10596
- C:\Windows\System32\MFUEzYA.exe
  C:\Windows\System32\MFUEzYA.exe
  2⤵
  PID:10696
- C:\Windows\System32\ekWpsIL.exe
  C:\Windows\System32\ekWpsIL.exe
  2⤵
  PID:10796
- C:\Windows\System32\ojiQsak.exe
  C:\Windows\System32\ojiQsak.exe
  2⤵
  PID:10824
- C:\Windows\System32\cfvJiSr.exe
  C:\Windows\System32\cfvJiSr.exe
  2⤵
  PID:10868
- C:\Windows\System32\auBYjGA.exe
  C:\Windows\System32\auBYjGA.exe
  2⤵
  PID:10948
- C:\Windows\System32\GOCmQpy.exe
  C:\Windows\System32\GOCmQpy.exe
  2⤵
  PID:11040
- C:\Windows\System32\ruyuTXQ.exe
  C:\Windows\System32\ruyuTXQ.exe
  2⤵
  PID:11068
- C:\Windows\System32\mLBKKei.exe
  C:\Windows\System32\mLBKKei.exe
  2⤵
  PID:11140
- C:\Windows\System32\xSssgdC.exe
  C:\Windows\System32\xSssgdC.exe
  2⤵
  PID:11160
- C:\Windows\System32\atGuBAS.exe
  C:\Windows\System32\atGuBAS.exe
  2⤵
  PID:11248
- C:\Windows\System32\dzzOwMx.exe
  C:\Windows\System32\dzzOwMx.exe
  2⤵
  PID:11260
- C:\Windows\System32\awdtYZo.exe
  C:\Windows\System32\awdtYZo.exe
  2⤵
  PID:10396
- C:\Windows\System32\QIXNhla.exe
  C:\Windows\System32\QIXNhla.exe
  2⤵
  PID:10620
- C:\Windows\System32\kUgfoJk.exe
  C:\Windows\System32\kUgfoJk.exe
  2⤵
  PID:10776
- C:\Windows\System32\LAbKALQ.exe
  C:\Windows\System32\LAbKALQ.exe
  2⤵
  PID:10880
- C:\Windows\System32\KwYqpVF.exe
  C:\Windows\System32\KwYqpVF.exe
  2⤵
  PID:11012
- C:\Windows\System32\BcFCLRY.exe
  C:\Windows\System32\BcFCLRY.exe
  2⤵
  PID:11168
- C:\Windows\System32\vTRPhHC.exe
  C:\Windows\System32\vTRPhHC.exe
  2⤵
  PID:11236
- C:\Windows\System32\VQrsRHH.exe
  C:\Windows\System32\VQrsRHH.exe
  2⤵
  PID:10988
- C:\Windows\System32\DYLSlhw.exe
  C:\Windows\System32\DYLSlhw.exe
  2⤵
  PID:11104
- C:\Windows\System32\eSHLFxa.exe
  C:\Windows\System32\eSHLFxa.exe
  2⤵
  PID:11028
- C:\Windows\System32\qWmIGvh.exe
  C:\Windows\System32\qWmIGvh.exe
  2⤵
  PID:11296
- C:\Windows\System32\pBkgAAs.exe
  C:\Windows\System32\pBkgAAs.exe
  2⤵
  PID:11312
- C:\Windows\System32\SxcNUop.exe
  C:\Windows\System32\SxcNUop.exe
  2⤵
  PID:11340
- C:\Windows\System32\WUHFWwJ.exe
  C:\Windows\System32\WUHFWwJ.exe
  2⤵
  PID:11392
- C:\Windows\System32\odShzvS.exe
  C:\Windows\System32\odShzvS.exe
  2⤵
  PID:11424
- C:\Windows\System32\QHxTgvS.exe
  C:\Windows\System32\QHxTgvS.exe
  2⤵
  PID:11440
- C:\Windows\System32\jgLgoJx.exe
  C:\Windows\System32\jgLgoJx.exe
  2⤵
  PID:11464
- C:\Windows\System32\noiglPr.exe
  C:\Windows\System32\noiglPr.exe
  2⤵
  PID:11484
- C:\Windows\System32\HznCUbQ.exe
  C:\Windows\System32\HznCUbQ.exe
  2⤵
  PID:11508
- C:\Windows\System32\ALcNQYi.exe
  C:\Windows\System32\ALcNQYi.exe
  2⤵
  PID:11564
- C:\Windows\System32\KuRwMtS.exe
  C:\Windows\System32\KuRwMtS.exe
  2⤵
  PID:11580
- C:\Windows\System32\ZibVTEM.exe
  C:\Windows\System32\ZibVTEM.exe
  2⤵
  PID:11600
- C:\Windows\System32\kSVzwIj.exe
  C:\Windows\System32\kSVzwIj.exe
  2⤵
  PID:11632
- C:\Windows\System32\wWXEaKf.exe
  C:\Windows\System32\wWXEaKf.exe
  2⤵
  PID:11652
- C:\Windows\System32\iEXiJMI.exe
  C:\Windows\System32\iEXiJMI.exe
  2⤵
  PID:11708
- C:\Windows\System32\GdgBADp.exe
  C:\Windows\System32\GdgBADp.exe
  2⤵
  PID:11728
- C:\Windows\System32\wnKwWxb.exe
  C:\Windows\System32\wnKwWxb.exe
  2⤵
  PID:11748
- C:\Windows\System32\zGpZcDo.exe
  C:\Windows\System32\zGpZcDo.exe
  2⤵
  PID:11764
- C:\Windows\System32\WJHXJyh.exe
  C:\Windows\System32\WJHXJyh.exe
  2⤵
  PID:11800
- C:\Windows\System32\cVHamUf.exe
  C:\Windows\System32\cVHamUf.exe
  2⤵
  PID:11852
- C:\Windows\System32\MRyIbBK.exe
  C:\Windows\System32\MRyIbBK.exe
  2⤵
  PID:11884
- C:\Windows\System32\vjbnMCV.exe
  C:\Windows\System32\vjbnMCV.exe
  2⤵
  PID:11912
- C:\Windows\System32\SIXqwXP.exe
  C:\Windows\System32\SIXqwXP.exe
  2⤵
  PID:11944
- C:\Windows\System32\heBRcEB.exe
  C:\Windows\System32\heBRcEB.exe
  2⤵
  PID:11968
- C:\Windows\System32\aqrEqYZ.exe
  C:\Windows\System32\aqrEqYZ.exe
  2⤵
  PID:11996
- C:\Windows\System32\xeZFcsR.exe
  C:\Windows\System32\xeZFcsR.exe
  2⤵
  PID:12016
- C:\Windows\System32\tPeKdZH.exe
  C:\Windows\System32\tPeKdZH.exe
  2⤵
  PID:12040
- C:\Windows\System32\uYsDeOi.exe
  C:\Windows\System32\uYsDeOi.exe
  2⤵
  PID:12080
- C:\Windows\System32\DIETuVH.exe
  C:\Windows\System32\DIETuVH.exe
  2⤵
  PID:12096
- C:\Windows\System32\CglKToB.exe
  C:\Windows\System32\CglKToB.exe
  2⤵
  PID:12116
- C:\Windows\System32\sygZWDv.exe
  C:\Windows\System32\sygZWDv.exe
  2⤵
  PID:12168
- C:\Windows\System32\jxmxTiI.exe
  C:\Windows\System32\jxmxTiI.exe
  2⤵
  PID:12184
- C:\Windows\System32\hHrSLpt.exe
  C:\Windows\System32\hHrSLpt.exe
  2⤵
  PID:12208
- C:\Windows\System32\CpHRtWa.exe
  C:\Windows\System32\CpHRtWa.exe
  2⤵
  PID:12224
- C:\Windows\System32\eEtRyXM.exe
  C:\Windows\System32\eEtRyXM.exe
  2⤵
  PID:12276
- C:\Windows\System32\ZPeMidv.exe
  C:\Windows\System32\ZPeMidv.exe
  2⤵
  PID:11052
- C:\Windows\System32\bJFKMeK.exe
  C:\Windows\System32\bJFKMeK.exe
  2⤵
  PID:11120
- C:\Windows\System32\luhGLjv.exe
  C:\Windows\System32\luhGLjv.exe
  2⤵
  PID:11308
- C:\Windows\System32\rwDqQpQ.exe
  C:\Windows\System32\rwDqQpQ.exe
  2⤵
  PID:11364
- C:\Windows\System32\dtNdRWY.exe
  C:\Windows\System32\dtNdRWY.exe
  2⤵
  PID:11408
- C:\Windows\System32\JjbVJic.exe
  C:\Windows\System32\JjbVJic.exe
  2⤵
  PID:11500
- C:\Windows\System32\IHjtqiJ.exe
  C:\Windows\System32\IHjtqiJ.exe
  2⤵
  PID:11620
- C:\Windows\System32\xHOlbeE.exe
  C:\Windows\System32\xHOlbeE.exe
  2⤵
  PID:11572
- C:\Windows\System32\QjODLBz.exe
  C:\Windows\System32\QjODLBz.exe
  2⤵
  PID:11700
- C:\Windows\System32\pQSCWZz.exe
  C:\Windows\System32\pQSCWZz.exe
  2⤵
  PID:11808
- C:\Windows\System32\nJvulMi.exe
  C:\Windows\System32\nJvulMi.exe
  2⤵
  PID:11872
- C:\Windows\System32\BCByMUM.exe
  C:\Windows\System32\BCByMUM.exe
  2⤵
  PID:11928
- C:\Windows\System32\SJiAAoX.exe
  C:\Windows\System32\SJiAAoX.exe
  2⤵
  PID:11976
- C:\Windows\System32\PQFbsKv.exe
  C:\Windows\System32\PQFbsKv.exe
  2⤵
  PID:12068
- C:\Windows\System32\yjyGnAg.exe
  C:\Windows\System32\yjyGnAg.exe
  2⤵
  PID:12124
- C:\Windows\System32\IvmdxXX.exe
  C:\Windows\System32\IvmdxXX.exe
  2⤵
  PID:12152
- C:\Windows\System32\IWlZaTV.exe
  C:\Windows\System32\IWlZaTV.exe
  2⤵
  PID:12244
- C:\Windows\System32\oighMQr.exe
  C:\Windows\System32\oighMQr.exe
  2⤵
  PID:11272
- C:\Windows\System32\dxYnNkw.exe
  C:\Windows\System32\dxYnNkw.exe
  2⤵
  PID:11352
- C:\Windows\System32\yPosjxQ.exe
  C:\Windows\System32\yPosjxQ.exe
  2⤵
  PID:11548
- C:\Windows\System32\IBdKFWE.exe
  C:\Windows\System32\IBdKFWE.exe
  2⤵
  PID:11692
- C:\Windows\System32\WCGrkFR.exe
  C:\Windows\System32\WCGrkFR.exe
  2⤵
  PID:11836
- C:\Windows\System32\DuebgDw.exe
  C:\Windows\System32\DuebgDw.exe
  2⤵
  PID:12028
- C:\Windows\System32\epsrGpP.exe
  C:\Windows\System32\epsrGpP.exe
  2⤵
  PID:12180
- C:\Windows\System32\VBhzmWk.exe
  C:\Windows\System32\VBhzmWk.exe
  2⤵
  PID:10544
- C:\Windows\System32\AErramX.exe
  C:\Windows\System32\AErramX.exe
  2⤵
  PID:11520
- C:\Windows\System32\HgixYMM.exe
  C:\Windows\System32\HgixYMM.exe
  2⤵
  PID:11384
- C:\Windows\System32\hjYBKdL.exe
  C:\Windows\System32\hjYBKdL.exe
  2⤵
  PID:11628
- C:\Windows\System32\ZpUjImt.exe
  C:\Windows\System32\ZpUjImt.exe
  2⤵
  PID:12304
- C:\Windows\System32\aRyYrNV.exe
  C:\Windows\System32\aRyYrNV.exe
  2⤵
  PID:12332
- C:\Windows\System32\BQvCjfC.exe
  C:\Windows\System32\BQvCjfC.exe
  2⤵
  PID:12356
- C:\Windows\System32\OEBIHYp.exe
  C:\Windows\System32\OEBIHYp.exe
  2⤵
  PID:12376
- C:\Windows\System32\BWpdagE.exe
  C:\Windows\System32\BWpdagE.exe
  2⤵
  PID:12392
- C:\Windows\System32\ElRojKB.exe
  C:\Windows\System32\ElRojKB.exe
  2⤵
  PID:12420
- C:\Windows\System32\kkhgpXC.exe
  C:\Windows\System32\kkhgpXC.exe
  2⤵
  PID:12448
- C:\Windows\System32\HCxPCJO.exe
  C:\Windows\System32\HCxPCJO.exe
  2⤵
  PID:12468
- C:\Windows\System32\xLTZdDT.exe
  C:\Windows\System32\xLTZdDT.exe
  2⤵
  PID:12488
- C:\Windows\System32\TbzRxZl.exe
  C:\Windows\System32\TbzRxZl.exe
  2⤵
  PID:12504
- C:\Windows\System32\OvviJDQ.exe
  C:\Windows\System32\OvviJDQ.exe
  2⤵
  PID:12524
- C:\Windows\System32\zRdIAIe.exe
  C:\Windows\System32\zRdIAIe.exe
  2⤵
  PID:12552
- C:\Windows\System32\kEIzDzn.exe
  C:\Windows\System32\kEIzDzn.exe
  2⤵
  PID:12592
- C:\Windows\System32\TCsDHDj.exe
  C:\Windows\System32\TCsDHDj.exe
  2⤵
  PID:12608
- C:\Windows\System32\XWRnhTX.exe
  C:\Windows\System32\XWRnhTX.exe
  2⤵
  PID:12688
- C:\Windows\System32\fyqUQSf.exe
  C:\Windows\System32\fyqUQSf.exe
  2⤵
  PID:12716
- C:\Windows\System32\meFoqOJ.exe
  C:\Windows\System32\meFoqOJ.exe
  2⤵
  PID:12740
- C:\Windows\System32\kpsgqQQ.exe
  C:\Windows\System32\kpsgqQQ.exe
  2⤵
  PID:12780
- C:\Windows\System32\FgBQQqB.exe
  C:\Windows\System32\FgBQQqB.exe
  2⤵
  PID:12820
- C:\Windows\System32\ygLsqTF.exe
  C:\Windows\System32\ygLsqTF.exe
  2⤵
  PID:12836
- C:\Windows\System32\IvNrWZs.exe
  C:\Windows\System32\IvNrWZs.exe
  2⤵
  PID:12856
- C:\Windows\System32\cRewtOZ.exe
  C:\Windows\System32\cRewtOZ.exe
  2⤵
  PID:12880
- C:\Windows\System32\qBkGpQE.exe
  C:\Windows\System32\qBkGpQE.exe
  2⤵
  PID:12900
- C:\Windows\System32\IbGEzcv.exe
  C:\Windows\System32\IbGEzcv.exe
  2⤵
  PID:12916
- C:\Windows\System32\jqZQfpC.exe
  C:\Windows\System32\jqZQfpC.exe
  2⤵
  PID:12940
- C:\Windows\System32\AXmBDYQ.exe
  C:\Windows\System32\AXmBDYQ.exe
  2⤵
  PID:12968
- C:\Windows\System32\vTCjzQg.exe
  C:\Windows\System32\vTCjzQg.exe
  2⤵
  PID:13024
- C:\Windows\System32\FSuousS.exe
  C:\Windows\System32\FSuousS.exe
  2⤵
  PID:13060
- C:\Windows\System32\gFEegMS.exe
  C:\Windows\System32\gFEegMS.exe
  2⤵
  PID:13088
- C:\Windows\System32\bqGiQqp.exe
  C:\Windows\System32\bqGiQqp.exe
  2⤵
  PID:13104
- C:\Windows\System32\kfpZUMx.exe
  C:\Windows\System32\kfpZUMx.exe
  2⤵
  PID:13128
- C:\Windows\System32\TwrtNOM.exe
  C:\Windows\System32\TwrtNOM.exe
  2⤵
  PID:13144
- C:\Windows\System32\ltrBueg.exe
  C:\Windows\System32\ltrBueg.exe
  2⤵
  PID:13168
- C:\Windows\System32\TaKdktG.exe
  C:\Windows\System32\TaKdktG.exe
  2⤵
  PID:13232
- C:\Windows\System32\VJLUtzZ.exe
  C:\Windows\System32\VJLUtzZ.exe
  2⤵
  PID:13248
- C:\Windows\System32\fNcWwDz.exe
  C:\Windows\System32\fNcWwDz.exe
  2⤵
  PID:13272
- C:\Windows\System32\APdwfhs.exe
  C:\Windows\System32\APdwfhs.exe
  2⤵
  PID:13300
- C:\Windows\System32\QYhnHWT.exe
  C:\Windows\System32\QYhnHWT.exe
  2⤵
  PID:12312
- C:\Windows\System32\ovomvQb.exe
  C:\Windows\System32\ovomvQb.exe
  2⤵
  PID:12388
- C:\Windows\System32\GLRoOGJ.exe
  C:\Windows\System32\GLRoOGJ.exe
  2⤵
  PID:12432
- C:\Windows\System32\pTFENSf.exe
  C:\Windows\System32\pTFENSf.exe
  2⤵
  PID:12512
- C:\Windows\System32\mmgWUYw.exe
  C:\Windows\System32\mmgWUYw.exe
  2⤵
  PID:12496
- C:\Windows\System32\Xacwptb.exe
  C:\Windows\System32\Xacwptb.exe
  2⤵
  PID:12604
- C:\Windows\System32\ufONTXl.exe
  C:\Windows\System32\ufONTXl.exe
  2⤵
  PID:12648
- C:\Windows\System32\JqSxWpK.exe
  C:\Windows\System32\JqSxWpK.exe
  2⤵
  PID:12696
- C:\Windows\System32\oBNSZaJ.exe
  C:\Windows\System32\oBNSZaJ.exe
  2⤵
  PID:12764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\FLdrDcF.exe

Filesize
1.0MB

MD5
f05e19de73a18d493885e61b80d03e64

SHA1
95943ab2b1ba259d4eb14de242d8896c43143a09

SHA256
50150589f35cabf9b3e441858e184ab725889590db9459907eb2b49452c27aef

SHA512
f2774ea407a5d01dda35ad2ae59d5eb91a839d07d591022acfd1c2348e48f17cf7321de6ca3bc6c8d682363cc2bf98756189edbe074a4a6d3141cda503671d03

Download Submit
C:\Windows\System32\FvmjpVq.exe

Filesize
1.0MB

MD5
41fbc0574b31dc358d31fbe28550b2bf

SHA1
31371ded445322712686a909bd18759c424da347

SHA256
39ce81cb699bb4a557c86163cef0ec752b4b4b0144a6f068093a5220c1107725

SHA512
27c57559d98732188d59e0b2cc86ac2e2126480e6dbba079bc4839a4bcd1109dd429aca025688f6f45ad62a9bf4e5fb21698fd9ded0a998ff8a29626c25e4190

Download Submit
C:\Windows\System32\GepqXlu.exe

Filesize
1.0MB

MD5
f7f40f81cb301800351a2e3d8e1ab3f1

SHA1
50e19b76b35342327c2d57db969f5f3487987039

SHA256
bd8713e89f67c4739795da9a348aac33417520e32cb523ae29043161e0c18cf5

SHA512
57865d38b6f677dea1a4fa316d12aa2e093b6a2ca8a9bd2f9e4ddd08db0c83f9b54637dcfcab1133b65207274b18a5e817cf7d0f3c5e9d3f3db27f083204706a

Download Submit
C:\Windows\System32\KAQtyOC.exe

Filesize
1.0MB

MD5
c468e0cb5b2755bd67822a83fd9c0301

SHA1
d1194cc42829007f1e8cf83439e043b34a074387

SHA256
a2b109a200c060f5caae99286caaef27b1f2c8849e44f93bd90908d6fab113ee

SHA512
c26678e7b4b8db8b0a9b0c990b95a48c6d8754321bf0fde57faf0800274aece4563a97fe8f238facff8921ce144d355de6abbbf1ef1b2a1d3b2556724bb57c16

Download Submit
C:\Windows\System32\LKMrJip.exe

Filesize
1.0MB

MD5
375c47e18494ba6cbdd7b1ece3d7864b

SHA1
0290dd0f1dabdb4802f2e13fd5ac14543a7a3878

SHA256
c04e4b4a0ed5b5e7889ae1015709c2c83ceee083a89e8b9d8b46b8453be2534d

SHA512
60b56da85a52b8f879f48a0c8ee4c2de97730304e55b6ccca41a8c10945fc9daa239c808bde63b8ea22be6be77f395aea9ff00fc7d0b884cdd69b2a51fec551d

Download Submit
C:\Windows\System32\OahANff.exe

Filesize
1.0MB

MD5
a255d925c0deb2089df7aa015540fe41

SHA1
4398e76dc86d18164f86b9047ba7096f1a41ac91

SHA256
e54ddd179376db57602d1194a15219c0a3937ade2e5310b7db420e0b484312ce

SHA512
c608b85b5ca18381660a96e069e3c7e43eb944ed87ed82583e6e304906f9cc2c0708db6d3dc762d3992f3caab33208e485c8e9d2f77c5caf21f40be1d9138c53

Download Submit
C:\Windows\System32\STeMJSp.exe

Filesize
1.0MB

MD5
2e1b1845f02113060a250c034253dfd0

SHA1
2a1885a09ec6cfbf137cd18193509624e59fafaf

SHA256
066d56b254bd8ea2422d4b69d9aaded5ae0404d6e3b856a432d865d3660551b8

SHA512
75ed0f9fc5388ade3a77a4075497c2fed4aa0114cd6551c86e336f36d6d58617201a85547e334fc0f360579e521d567a03e32c4180966708d30c6ea8c1992592

Download Submit
C:\Windows\System32\SiKjjYn.exe

Filesize
1.0MB

MD5
e2d3ab67d278e95fac41125ddb18248c

SHA1
9bd45372d8b48e517477279bb5a06cb10ca8c797

SHA256
6db26fdad105fd8a0e0f04e8d9444d59398bfa0a79a2d9f34c97c8b2cb3e665c

SHA512
450d12da53618c1b8836adf2421ca5e02738e8766d5d21a2724928be3f27dccacf8e5c1706a4e986ecf9b425931c9fd0d9cb63b10470da4fc9d37e14f9077751

Download Submit
C:\Windows\System32\TEIqFJR.exe

Filesize
1.0MB

MD5
ad264d31f0bf55c27f932ceed75355f8

SHA1
88a75bb495abe14fa7da9a89a8c1cfc2dafcfa80

SHA256
845c398bfda60e99245f53f67f885e8ed11b15e2e03c244205eab26a7e1d3922

SHA512
27bba80ec08dc53727c8ff9673b636198dcfa82acc8572a66aea5a5eee77667b1cec1367693e51ca1556fd5213d37b3a26947609ded66af0c9932f5a361c9665

Download Submit
C:\Windows\System32\TdfMGDC.exe

Filesize
1.0MB

MD5
a4174c3030a8a9472813e531d3acec07

SHA1
8d157139d587f12aeb5af917cfc16e308fae8cf1

SHA256
beaacbf86bb49ef7114850cc14cd9ceeb2ccee8fadcb8ece902e2cd73f9f00d0

SHA512
1f8cbace9a405dc601daa4032a2c80eed8e8ad6efa247024f4953525e1e3fe064196d76d89f42349afcfdf9391ac1ccdaf88830b690c11dd6990a089634f141a

Download Submit
C:\Windows\System32\WSmdLJe.exe

Filesize
1.0MB

MD5
77e64166f14353dfdf50acfdc5f05c88

SHA1
a8d8e4a2f13e4bdaff06f775d2cdcceb85a8c3d5

SHA256
aa5218f2264af29063290967e544310216f84c8659648abb1d26113739205550

SHA512
f74b01f48b4f5193434c9dd3412bd1b84136122f23526afccc4b8f02fe79b8a0b669b1810fd21974c4bb26b4677cb8b0205cfbbcd2ec7a4b28da05eeed62687c

Download Submit
C:\Windows\System32\XbnUXBh.exe

Filesize
1.0MB

MD5
d18854f8fdb04a941a13cad3803c3586

SHA1
44dba25195b3ed5226de4cb4abbfafcc51d723a6

SHA256
608c39279454e421078f032a0fbf8d25e5f137dd07726480020e7edc3c6b3d62

SHA512
a67852b2c5d05b24bb89e63ac6fe0a7a2fa5d7108399f858d5d2e1efb62e8ef439794d37bdb5c3523261318f1c562b65c571604b79931806e44915f821d11984

Download Submit
C:\Windows\System32\YMGCiDR.exe

Filesize
1.0MB

MD5
e4412dae51cd6b12647eb78b88cdfbbf

SHA1
8344e0a84b22d9494a96d40a3a27fc72b2484145

SHA256
408b165eee2bf249fca11c9b12f569d650a9acb3bb05539f93e7aa5c19a317a0

SHA512
e4246944c8dac47afcead396d5cb7ba59b3272930df8ff179b58085dae8e081bc4639840f563dfeb8aa991d17163350b7647d1b64bbc85de4e8da7d7cd25f7d0

Download Submit
C:\Windows\System32\ZgvAKkL.exe

Filesize
1.0MB

MD5
bdb3c6935b2b055e6365e71b52e99d5e

SHA1
ebdedaad5c3d0c37e30fadd6391de76364865ba4

SHA256
3a944231d5bda825589c26c2aac132b27dba1f2f82ed8ad6582e54db09710105

SHA512
13642727dda6ac6778e126e0a3e02068202c737bb79d5e510d7443e066a88841b250a16502529e278d22c0cecd686f7e13b165f8b5734cc951b2e9ec19e0086c

Download Submit
C:\Windows\System32\aDQuoKe.exe

Filesize
1.0MB

MD5
8f1ec9bba3e7224094e2114a94402b88

SHA1
76f1dee84bf0f6f0fd7dcc6599459e754525a72b

SHA256
deed25d281e356be18ac6cc7c96b61690257708fee463a3525af83570b9612c5

SHA512
9e6e54e0e0635e2ebccd9b3a47b240356852fc1d6e377baa4c5d905e0b06c20c4ea4a2c52ec5e0c8218a5e1ef034e2a9a85e7260eb00b7e96dff5f9c00be5700

Download Submit
C:\Windows\System32\aQsquDg.exe

Filesize
1.0MB

MD5
52368a78b59f1172e7f37c6b1c4fc41d

SHA1
ad36d2bca6790c6ed6f761214b1e99b021960d44

SHA256
fe357b21d32c5329f7cedeb1b5dbba938b9457227f7a249de5a1d4374067c570

SHA512
ee05503a1f73895369a4c05a34c0454ca241cdccb608256dd4c9538928af5c9efba127541a5268715a39b4ea1a2fb9fd93e729612b57605184f4b6a2378e1202

Download Submit
C:\Windows\System32\akJuhdp.exe

Filesize
1.0MB

MD5
98b85a08a524f5b5eb06188ad8db3c48

SHA1
54bd119958152b6d3b1ed60f28260d7a75c87dfc

SHA256
5a9f60100fc15439641bc7b8503edf50ec2546f99da88aedbb31b8bfe14ff2c9

SHA512
16c86c9d52d675d06d4615d3409a9b6fbb3c3ffa80de89802cdbdb231de366869262dcebcd8c1c7598e85995aa7403230dda0a875b1c38b3d2f41dea8e5ec85f

Download Submit
C:\Windows\System32\gRMLyUe.exe

Filesize
1.0MB

MD5
fa412f192bf616117a6f81306270a83b

SHA1
434aba0121cef6499066b0b6e791c26a1c7981ad

SHA256
f92fb31e9618c39095069dcf0a030cd64d055c3d9dc50dfd8ae0ed4a450bd239

SHA512
34d85a044021c2c5ef8f2ca54a37db5de15e129329f8031af3d407717cd1ae3958821ea2c94d4847348c165e474e4ae58c5d56c000571603b1c7ab25d36c542d

Download Submit
C:\Windows\System32\gyCOTXP.exe

Filesize
1.0MB

MD5
2f3cf5ed31a41594aa5b60ffeb72e9fb

SHA1
31e8e39829d0eb53db6d2e9b3cdd9a32b121d660

SHA256
0023e6fd709b777c89a5222293b3113fb1c2685669caafc7af3d711370bcd458

SHA512
ea17f7651a8d50827d86c00a1f8b669447d284c99e83534613bc43e14ec0340187bc854bec776fd9afe70947b041bd972594e8987cef1aba580cc07fa1aee8fe

Download Submit
C:\Windows\System32\hSoydGT.exe

Filesize
1.0MB

MD5
913e18fe772f2da4e01cc24971bd7bdb

SHA1
dd33e52e945ab141a6a02f487e21402b111f5220

SHA256
dcc20872a63eef75d1214a7e090e823fce28ba51af5521b13eaed879fa55f12d

SHA512
d038bd01e071887d60aaae150659d654838901e40751377945147c9913fd18ed908ce6367d50b4bdef03c45dca56628848cd4d43b7f5a1aab56213b48b9666ca

Download Submit
C:\Windows\System32\kGpuzyA.exe

Filesize
1.0MB

MD5
e9b9ce127be1a5ac5d128670595dd8d3

SHA1
1d074d74ebeb4db020646fd567e4491e7642207d

SHA256
e22b2785aafa0fb0cc10c35af32d7806f38670835fa3ad11b2075e1843477f9a

SHA512
87160098d88eb6e94660b7dbb8c699accabc09be966224e89a16f299a9aa84c26c830d501056e66c0e42912c67ed208156f4cb46c1d26f46b15db4dbfce2e0e4

Download Submit
C:\Windows\System32\kbnjEem.exe

Filesize
1.0MB

MD5
c2a8a9a77d9b35f80a6f87f582d679d8

SHA1
f6a76ddb98f67f3a1bcf6f07df6ed9d0f216bb36

SHA256
c2cea56edaffaf2f4f1fe8b5a859cac2fbc129c4f75d75f3c87b1c0283c6490d

SHA512
073f2545460f391d01887162c0ecc3de440c1c2bf7de0782dca4fbcda07ea75d42172389a649f16730f517585695f8d9a83e0e86f8066846c6c74ec540ee3c57

Download Submit
C:\Windows\System32\mCdlPgG.exe

Filesize
1.0MB

MD5
e1fe166b14319930534ecca8ef59bc6d

SHA1
74d5e3884218a3303f0529d22200a02cfc4a4375

SHA256
e11135e63085eead4d35c214dead2ae009b1efb4b3dbd618ca31128e0590317e

SHA512
b6e9c5d3ba5e103d4036fff7040281bda58f43807678624fcf19acdb6ca7c623bc83a24d7e7bc019b772a9f14842f86a5ef30d500b36d43ccd741e2e6ae5c001

Download Submit
C:\Windows\System32\mNgLaqg.exe

Filesize
1.0MB

MD5
074005fa3e62e89c60130dd5350bc7c2

SHA1
803c5c07b3997206006f38f5903f1610ca8d2394

SHA256
ca4794c8dda600ed7d6ce52e27bf12278904f646661795c95844108f5658cb83

SHA512
2d7ca1ad396736286950a1dd719099d8a07210f4f98fb970b18661b69c1122928717a2ae62fa60e43b0d0ed7e117671314a35def49a433e5a0426a8f5e068114

Download Submit
C:\Windows\System32\oCQCoZy.exe

Filesize
1.0MB

MD5
f1254ced5535dd72d3c143e69a7d1dcd

SHA1
65a11fad2d97786e7dcf77dcd237bffc0130f8fb

SHA256
3608beb7ae9a02a65607a264a1834ca65e7ea6e97f456914a91321c73b829b1a

SHA512
1fbd8fd1cfef99d2b5ea8bd02ce84c43f444ef38e05208f0066e32fffac6bfc2f906e55eaea0669ccf41d582db926e8eb3d603aabb837e9f2ad0bf3767329e85

Download Submit
C:\Windows\System32\pihSlHF.exe

Filesize
1.0MB

MD5
282fc579e89425df72245e46bae20d57

SHA1
98200fcc36a2a8f23f7f5526e245bdbbc17aaac4

SHA256
d61742161c48252b6f9897826586e7dfe3a1ba25570111c74cd620ff8dccecc0

SHA512
174be6ee748f426f6fef11dc65ee878f013a55fc9b73ed6e6c165388b7316eaa5402a8a948ed055c2c39bf02aa0f2bd3d8d97df700ec8cbf834a60f1ad980ab5

Download Submit
C:\Windows\System32\qcDVdwa.exe

Filesize
1.0MB

MD5
58a19b4de9f525c1df8410ae9988c302

SHA1
896606acab8597775c04f44c9b4d8ed4fa4b5566

SHA256
68ca990bea780a376b2371b2404bea2c7400b5b5469113066e1ddb21855d43e2

SHA512
723719437ffdd8425ecda3ac503d73e43977b137030cae045114e1f700509058cb6ab4585e5415a6cdc6ad38ef42adf74514c250dfe918773a506c5ad992f6c1

Download Submit
C:\Windows\System32\rkhRJtR.exe

Filesize
1.0MB

MD5
dbf60016a08f194c27796ae0d8d6ad19

SHA1
3e86cc9a9084cf787fd6a65672f1a0b9efb423a1

SHA256
e3ae5b2ad7210937b467c985e58e20be68aa9a979adee313739d860270494c62

SHA512
b14ced7fed75d8791bfbb74891cd84139aef90591a4e3f9d8e2b0f393d1766c7729036395e2afc47e8897bb57b11a864b2e65da1827c151336f07517de8b7c6e

Download Submit
C:\Windows\System32\rutVDls.exe

Filesize
1.0MB

MD5
cccd5a3fb9f0c96ee8d8624f606e902c

SHA1
6b7e464ae60a12d08a611d97b5a1f65950cc0f05

SHA256
8916f1e87588e87154c93905cf3beab84046bf10eb11c07495c84086b8467e30

SHA512
79c886dd70e0b6a759333a17d320ef58369961bb5d12bcbe600f63f77e662e0040badec26b9f268df3544240252bfa4a2edd42e986b77532e096574cf2c455d7

Download Submit
C:\Windows\System32\uLrQLEf.exe

Filesize
1.0MB

MD5
3fc34ba47b27103c6f305f1775b1b299

SHA1
84a84a347737c714480697eacc4a2a685d0ea1ac

SHA256
e624fd5320488870cf841b52b3a61aa392ddddce375b0f6ea1371871d3274724

SHA512
8530d381d09b855dc5e832b24cf669fcbfafcf5eb89f52ae8422dce29a6c27c397f7727207f80fdd0b4ee99009094a588d5261efff4daca984cba9901a9eeabb

Download Submit
C:\Windows\System32\wyYesCL.exe

Filesize
1.0MB

MD5
eccbb368e6ae13aab76bedc086394d85

SHA1
92d723f07d9e4776901e19ded5c4234489b81085

SHA256
062ce38df39ba191255f8a32f21ed0b566d57f4a53a95f0e9b853c869522aaa0

SHA512
93a9c1a7028efd6f0d9a387e4e291f95ffe2045df44ec249d497873b08924313b82657cccfa2d978701de4e2fb176e9771daa6a420fc8366fb87cac7af6d6516

Download Submit
C:\Windows\System32\ytcKwVG.exe

Filesize
1.0MB

MD5
3774625baef28152e2f1d4bf244446b8

SHA1
f58ac2583849025ce9ef5aa66257dfcecd493834

SHA256
784d29336cd23b5162f51ba8f9fd0dbc239ec1c7836b52adf16be4d247e9980d

SHA512
4dbe02d6a9ac4726c41c6689a2008453ed21f1bc65cb92c67c0d1a92639eaae9a79e2cc644e47a85860ee086a251f917c10e5edac57e6bdabc9d2f261c43c72f

Download Submit
memory/1036-2063-0x00007FF6EC7F0000-0x00007FF6ECBE1000-memory.dmp

Filesize
3.9MB

Download
memory/1036-28-0x00007FF6EC7F0000-0x00007FF6ECBE1000-memory.dmp

Filesize
3.9MB

Download
memory/1384-2065-0x00007FF7E6D10000-0x00007FF7E7101000-memory.dmp

Filesize
3.9MB

Download
memory/1384-402-0x00007FF7E6D10000-0x00007FF7E7101000-memory.dmp

Filesize
3.9MB

Download
memory/1648-404-0x00007FF760A90000-0x00007FF760E81000-memory.dmp

Filesize
3.9MB

Download
memory/1648-2078-0x00007FF760A90000-0x00007FF760E81000-memory.dmp

Filesize
3.9MB

Download
memory/2164-2058-0x00007FF7D0C30000-0x00007FF7D1021000-memory.dmp

Filesize
3.9MB

Download
memory/2164-2017-0x00007FF7D0C30000-0x00007FF7D1021000-memory.dmp

Filesize
3.9MB

Download
memory/2164-48-0x00007FF7D0C30000-0x00007FF7D1021000-memory.dmp

Filesize
3.9MB

Download
memory/2224-2086-0x00007FF72EB60000-0x00007FF72EF51000-memory.dmp

Filesize
3.9MB

Download
memory/2224-518-0x00007FF72EB60000-0x00007FF72EF51000-memory.dmp

Filesize
3.9MB

Download
memory/2252-33-0x00007FF661FF0000-0x00007FF6623E1000-memory.dmp

Filesize
3.9MB

Download
memory/2252-2053-0x00007FF661FF0000-0x00007FF6623E1000-memory.dmp

Filesize
3.9MB

Download
memory/2808-40-0x00007FF6FD0C0000-0x00007FF6FD4B1000-memory.dmp

Filesize
3.9MB

Download
memory/2808-2006-0x00007FF6FD0C0000-0x00007FF6FD4B1000-memory.dmp

Filesize
3.9MB

Download
memory/2808-2060-0x00007FF6FD0C0000-0x00007FF6FD4B1000-memory.dmp

Filesize
3.9MB

Download
memory/3008-2072-0x00007FF70F8B0000-0x00007FF70FCA1000-memory.dmp

Filesize
3.9MB

Download
memory/3008-399-0x00007FF70F8B0000-0x00007FF70FCA1000-memory.dmp

Filesize
3.9MB

Download
memory/3068-2087-0x00007FF7970D0000-0x00007FF7974C1000-memory.dmp

Filesize
3.9MB

Download
memory/3068-2043-0x00007FF7970D0000-0x00007FF7974C1000-memory.dmp

Filesize
3.9MB

Download
memory/3068-51-0x00007FF7970D0000-0x00007FF7974C1000-memory.dmp

Filesize
3.9MB

Download
memory/3344-2056-0x00007FF6741D0000-0x00007FF6745C1000-memory.dmp

Filesize
3.9MB

Download
memory/3344-42-0x00007FF6741D0000-0x00007FF6745C1000-memory.dmp

Filesize
3.9MB

Download
memory/3364-545-0x00007FF7C4A80000-0x00007FF7C4E71000-memory.dmp

Filesize
3.9MB

Download
memory/3364-2095-0x00007FF7C4A80000-0x00007FF7C4E71000-memory.dmp

Filesize
3.9MB

Download
memory/3432-491-0x00007FF66B340000-0x00007FF66B731000-memory.dmp

Filesize
3.9MB

Download
memory/3432-2084-0x00007FF66B340000-0x00007FF66B731000-memory.dmp

Filesize
3.9MB

Download
memory/3436-2067-0x00007FF6B9C80000-0x00007FF6BA071000-memory.dmp

Filesize
3.9MB

Download
memory/3436-403-0x00007FF6B9C80000-0x00007FF6BA071000-memory.dmp

Filesize
3.9MB

Download
memory/3628-2075-0x00007FF7D4010000-0x00007FF7D4401000-memory.dmp

Filesize
3.9MB

Download
memory/3628-401-0x00007FF7D4010000-0x00007FF7D4401000-memory.dmp

Filesize
3.9MB

Download
memory/3780-527-0x00007FF6B80C0000-0x00007FF6B84B1000-memory.dmp

Filesize
3.9MB

Download
memory/3780-2101-0x00007FF6B80C0000-0x00007FF6B84B1000-memory.dmp

Filesize
3.9MB

Download
memory/4036-43-0x00007FF7FA610000-0x00007FF7FAA01000-memory.dmp

Filesize
3.9MB

Download
memory/4036-2062-0x00007FF7FA610000-0x00007FF7FAA01000-memory.dmp

Filesize
3.9MB

Download
memory/4148-534-0x00007FF6EB6B0000-0x00007FF6EBAA1000-memory.dmp

Filesize
3.9MB

Download
memory/4148-2099-0x00007FF6EB6B0000-0x00007FF6EBAA1000-memory.dmp

Filesize
3.9MB

Download
memory/4384-2051-0x00007FF675F50000-0x00007FF676341000-memory.dmp

Filesize
3.9MB

Download
memory/4384-21-0x00007FF675F50000-0x00007FF676341000-memory.dmp

Filesize
3.9MB

Download
memory/4428-529-0x00007FF6CB120000-0x00007FF6CB511000-memory.dmp

Filesize
3.9MB

Download
memory/4428-2089-0x00007FF6CB120000-0x00007FF6CB511000-memory.dmp

Filesize
3.9MB

Download
memory/4616-2074-0x00007FF6890B0000-0x00007FF6894A1000-memory.dmp

Filesize
3.9MB

Download
memory/4616-530-0x00007FF6890B0000-0x00007FF6894A1000-memory.dmp

Filesize
3.9MB

Download
memory/4792-466-0x00007FF6AE3B0000-0x00007FF6AE7A1000-memory.dmp

Filesize
3.9MB

Download
memory/4792-2080-0x00007FF6AE3B0000-0x00007FF6AE7A1000-memory.dmp

Filesize
3.9MB

Download
memory/4836-0-0x00007FF792420000-0x00007FF792811000-memory.dmp

Filesize
3.9MB

Download
memory/4836-1-0x0000016338910000-0x0000016338920000-memory.dmp

Filesize
64KB

Download
memory/4840-2040-0x00007FF76FB40000-0x00007FF76FF31000-memory.dmp

Filesize
3.9MB

Download
memory/4840-2091-0x00007FF76FB40000-0x00007FF76FF31000-memory.dmp

Filesize
3.9MB

Download
memory/4840-391-0x00007FF76FB40000-0x00007FF76FF31000-memory.dmp

Filesize
3.9MB

Download
memory/5048-2070-0x00007FF623000000-0x00007FF6233F1000-memory.dmp

Filesize
3.9MB

Download
memory/5048-400-0x00007FF623000000-0x00007FF6233F1000-memory.dmp

Filesize
3.9MB

Download
memory/5080-2082-0x00007FF6C7C70000-0x00007FF6C8061000-memory.dmp

Filesize
3.9MB

Download
memory/5080-490-0x00007FF6C7C70000-0x00007FF6C8061000-memory.dmp

Filesize
3.9MB

Download