xmrig | 0f12559780a9067a04ce07a9df9ac1e33ac58d47d6fc11704262e30b68e7de27

Analysis

max time kernel
124s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 02:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
Size

1.5MB
MD5

1f1424a9abd44d9c4cf60d74bc184b9c
SHA1

7586ceaf6af8098f2058c8710dd99ac94f1777ba
SHA256

0f12559780a9067a04ce07a9df9ac1e33ac58d47d6fc11704262e30b68e7de27
SHA512

93c14a9e247e011d16e36773489dbe891c8d91a277cf8e768211fdf0eeacdcee8ea871d3d1f0322730c5ed8ebdfaddc49c846ddd6901c264a3d8795e3291d688
SSDEEP

24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcquVoVbvVkNQeEVIuj8qBChqlkJn5RJr+k:knw9oUUEEDl37jcquVoVJ31CMr05J

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/1608-14-0x00007FF6B4B60000-0x00007FF6B4F51000-memory.dmp	xmrig
behavioral2/memory/2804-13-0x00007FF733CA0000-0x00007FF734091000-memory.dmp	xmrig
behavioral2/memory/1200-31-0x00007FF785C70000-0x00007FF786061000-memory.dmp	xmrig
behavioral2/memory/2240-34-0x00007FF632C10000-0x00007FF633001000-memory.dmp	xmrig
behavioral2/memory/472-396-0x00007FF720300000-0x00007FF7206F1000-memory.dmp	xmrig
behavioral2/memory/3332-397-0x00007FF625F90000-0x00007FF626381000-memory.dmp	xmrig
behavioral2/memory/5004-25-0x00007FF749A10000-0x00007FF749E01000-memory.dmp	xmrig
behavioral2/memory/4312-398-0x00007FF7E5260000-0x00007FF7E5651000-memory.dmp	xmrig
behavioral2/memory/4460-399-0x00007FF6E1A20000-0x00007FF6E1E11000-memory.dmp	xmrig
behavioral2/memory/5096-401-0x00007FF7744F0000-0x00007FF7748E1000-memory.dmp	xmrig
behavioral2/memory/3920-400-0x00007FF735AF0000-0x00007FF735EE1000-memory.dmp	xmrig
behavioral2/memory/4184-405-0x00007FF64D9D0000-0x00007FF64DDC1000-memory.dmp	xmrig
behavioral2/memory/3588-414-0x00007FF643400000-0x00007FF6437F1000-memory.dmp	xmrig
behavioral2/memory/3148-424-0x00007FF73EC00000-0x00007FF73EFF1000-memory.dmp	xmrig
behavioral2/memory/1480-421-0x00007FF6E6620000-0x00007FF6E6A11000-memory.dmp	xmrig
behavioral2/memory/1696-431-0x00007FF6BF050000-0x00007FF6BF441000-memory.dmp	xmrig
behavioral2/memory/2744-430-0x00007FF67F320000-0x00007FF67F711000-memory.dmp	xmrig
behavioral2/memory/2948-438-0x00007FF7C6870000-0x00007FF7C6C61000-memory.dmp	xmrig
behavioral2/memory/2564-442-0x00007FF652850000-0x00007FF652C41000-memory.dmp	xmrig
behavioral2/memory/4776-449-0x00007FF607C40000-0x00007FF608031000-memory.dmp	xmrig
behavioral2/memory/2368-462-0x00007FF704CE0000-0x00007FF7050D1000-memory.dmp	xmrig
behavioral2/memory/444-461-0x00007FF672200000-0x00007FF6725F1000-memory.dmp	xmrig
behavioral2/memory/3544-457-0x00007FF6A0740000-0x00007FF6A0B31000-memory.dmp	xmrig
behavioral2/memory/4880-466-0x00007FF7BDFF0000-0x00007FF7BE3E1000-memory.dmp	xmrig
behavioral2/memory/2804-1969-0x00007FF733CA0000-0x00007FF734091000-memory.dmp	xmrig
behavioral2/memory/2804-2003-0x00007FF733CA0000-0x00007FF734091000-memory.dmp	xmrig
behavioral2/memory/1608-2005-0x00007FF6B4B60000-0x00007FF6B4F51000-memory.dmp	xmrig
behavioral2/memory/5004-2007-0x00007FF749A10000-0x00007FF749E01000-memory.dmp	xmrig
behavioral2/memory/1200-2009-0x00007FF785C70000-0x00007FF786061000-memory.dmp	xmrig
behavioral2/memory/2240-2012-0x00007FF632C10000-0x00007FF633001000-memory.dmp	xmrig
behavioral2/memory/472-2013-0x00007FF720300000-0x00007FF7206F1000-memory.dmp	xmrig
behavioral2/memory/3332-2045-0x00007FF625F90000-0x00007FF626381000-memory.dmp	xmrig
behavioral2/memory/4312-2046-0x00007FF7E5260000-0x00007FF7E5651000-memory.dmp	xmrig
behavioral2/memory/4460-2048-0x00007FF6E1A20000-0x00007FF6E1E11000-memory.dmp	xmrig
behavioral2/memory/4880-2040-0x00007FF7BDFF0000-0x00007FF7BE3E1000-memory.dmp	xmrig
behavioral2/memory/444-2052-0x00007FF672200000-0x00007FF6725F1000-memory.dmp	xmrig
behavioral2/memory/1480-2079-0x00007FF6E6620000-0x00007FF6E6A11000-memory.dmp	xmrig
behavioral2/memory/3148-2078-0x00007FF73EC00000-0x00007FF73EFF1000-memory.dmp	xmrig
behavioral2/memory/2744-2076-0x00007FF67F320000-0x00007FF67F711000-memory.dmp	xmrig
behavioral2/memory/2948-2072-0x00007FF7C6870000-0x00007FF7C6C61000-memory.dmp	xmrig
behavioral2/memory/4776-2068-0x00007FF607C40000-0x00007FF608031000-memory.dmp	xmrig
behavioral2/memory/3544-2065-0x00007FF6A0740000-0x00007FF6A0B31000-memory.dmp	xmrig
behavioral2/memory/2368-2064-0x00007FF704CE0000-0x00007FF7050D1000-memory.dmp	xmrig
behavioral2/memory/3920-2060-0x00007FF735AF0000-0x00007FF735EE1000-memory.dmp	xmrig
behavioral2/memory/5096-2058-0x00007FF7744F0000-0x00007FF7748E1000-memory.dmp	xmrig
behavioral2/memory/4184-2056-0x00007FF64D9D0000-0x00007FF64DDC1000-memory.dmp	xmrig
behavioral2/memory/1696-2074-0x00007FF6BF050000-0x00007FF6BF441000-memory.dmp	xmrig
behavioral2/memory/2564-2070-0x00007FF652850000-0x00007FF652C41000-memory.dmp	xmrig
behavioral2/memory/3588-2054-0x00007FF643400000-0x00007FF6437F1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2804	eovrGbZ.exe
1608	kARLSbC.exe
5004	FIVsRjI.exe
1200	TBeXKfO.exe
2240	endioUh.exe
472	ApOBsok.exe
4880	oHSkeov.exe
3332	ysdqaVR.exe
4312	IFghIlr.exe
4460	EVRbjLw.exe
3920	ojKmNCd.exe
5096	cgICDHc.exe
4184	aXbxZdL.exe
3588	mRmjFLk.exe
1480	IbmRWBS.exe
3148	jYZYRru.exe
2744	DKYUNTw.exe
1696	fUGOsZf.exe
2948	pcDRmVm.exe
2564	PvhbrDa.exe
4776	vdGrCzh.exe
3544	SoXNQVn.exe
444	RuBvXAn.exe
2368	qEjmRVU.exe
1064	SgeDDxL.exe
3768	oWhiHHl.exe
4176	JGayaAK.exe
3964	IbYdFSR.exe
4936	JHqTQOj.exe
3480	aBMogpu.exe
2528	OdGmIgh.exe
4216	BAdicvg.exe
1592	QKXXdLE.exe
3500	PRvwTNy.exe
1088	VnFQyhs.exe
1424	NyNMvjR.exe
4908	hVLDBzh.exe
3336	VQoiodG.exe
2748	AxEIgKN.exe
2704	dYkPLzK.exe
4056	DzQZrxI.exe
2720	wrkXrsI.exe
2768	RVeppmP.exe
4448	pqfgVNq.exe
4244	OEvFcux.exe
3552	oFBfqOz.exe
5060	HbswzmY.exe
2064	ZJhhOBP.exe
4616	ITUGOEk.exe
3580	ZKNqipa.exe
3784	skBGpAO.exe
1720	qkCpWVL.exe
4464	QJxZgjE.exe
3316	yypCnqG.exe
2620	YxRRAVH.exe
632	XhkuYro.exe
3988	TNNXIHX.exe
3352	JVwpaUy.exe
1204	jluVHAi.exe
2592	CoWPciQ.exe
1400	PAMXVHD.exe
3052	kqTekTb.exe
4308	YzspUCs.exe
3348	EPfQaNH.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1496-0-0x00007FF770E50000-0x00007FF771241000-memory.dmp	upx
behavioral2/files/0x000b000000023b9d-5.dat	upx
behavioral2/files/0x000a000000023ba2-9.dat	upx
behavioral2/files/0x000a000000023ba1-11.dat	upx
behavioral2/memory/1608-14-0x00007FF6B4B60000-0x00007FF6B4F51000-memory.dmp	upx
behavioral2/memory/2804-13-0x00007FF733CA0000-0x00007FF734091000-memory.dmp	upx
behavioral2/files/0x000a000000023ba3-22.dat	upx
behavioral2/files/0x000a000000023ba4-28.dat	upx
behavioral2/memory/1200-31-0x00007FF785C70000-0x00007FF786061000-memory.dmp	upx
behavioral2/memory/2240-34-0x00007FF632C10000-0x00007FF633001000-memory.dmp	upx
behavioral2/files/0x000b000000023b9e-36.dat	upx
behavioral2/files/0x000a000000023ba5-41.dat	upx
behavioral2/files/0x000a000000023ba6-46.dat	upx
behavioral2/files/0x000a000000023ba7-51.dat	upx
behavioral2/files/0x000a000000023ba8-54.dat	upx
behavioral2/files/0x000a000000023ba9-61.dat	upx
behavioral2/files/0x000a000000023baa-64.dat	upx
behavioral2/files/0x000a000000023bac-74.dat	upx
behavioral2/files/0x000a000000023bad-81.dat	upx
behavioral2/files/0x000a000000023baf-89.dat	upx
behavioral2/files/0x0031000000023bb4-114.dat	upx
behavioral2/files/0x0031000000023bb6-126.dat	upx
behavioral2/files/0x000a000000023bb8-136.dat	upx
behavioral2/files/0x000a000000023bbe-166.dat	upx
behavioral2/files/0x000a000000023bbd-161.dat	upx
behavioral2/files/0x000a000000023bbc-156.dat	upx
behavioral2/files/0x000a000000023bbb-151.dat	upx
behavioral2/files/0x000a000000023bba-146.dat	upx
behavioral2/files/0x000a000000023bb9-141.dat	upx
behavioral2/memory/472-396-0x00007FF720300000-0x00007FF7206F1000-memory.dmp	upx
behavioral2/files/0x000a000000023bb7-131.dat	upx
behavioral2/files/0x0031000000023bb5-121.dat	upx
behavioral2/files/0x000a000000023bb3-111.dat	upx
behavioral2/files/0x000a000000023bb2-106.dat	upx
behavioral2/files/0x000a000000023bb1-101.dat	upx
behavioral2/files/0x000a000000023bb0-96.dat	upx
behavioral2/files/0x000a000000023bae-86.dat	upx
behavioral2/files/0x000a000000023bab-71.dat	upx
behavioral2/memory/3332-397-0x00007FF625F90000-0x00007FF626381000-memory.dmp	upx
behavioral2/memory/5004-25-0x00007FF749A10000-0x00007FF749E01000-memory.dmp	upx
behavioral2/memory/4312-398-0x00007FF7E5260000-0x00007FF7E5651000-memory.dmp	upx
behavioral2/memory/4460-399-0x00007FF6E1A20000-0x00007FF6E1E11000-memory.dmp	upx
behavioral2/memory/5096-401-0x00007FF7744F0000-0x00007FF7748E1000-memory.dmp	upx
behavioral2/memory/3920-400-0x00007FF735AF0000-0x00007FF735EE1000-memory.dmp	upx
behavioral2/memory/4184-405-0x00007FF64D9D0000-0x00007FF64DDC1000-memory.dmp	upx
behavioral2/memory/3588-414-0x00007FF643400000-0x00007FF6437F1000-memory.dmp	upx
behavioral2/memory/3148-424-0x00007FF73EC00000-0x00007FF73EFF1000-memory.dmp	upx
behavioral2/memory/1480-421-0x00007FF6E6620000-0x00007FF6E6A11000-memory.dmp	upx
behavioral2/memory/1696-431-0x00007FF6BF050000-0x00007FF6BF441000-memory.dmp	upx
behavioral2/memory/2744-430-0x00007FF67F320000-0x00007FF67F711000-memory.dmp	upx
behavioral2/memory/2948-438-0x00007FF7C6870000-0x00007FF7C6C61000-memory.dmp	upx
behavioral2/memory/2564-442-0x00007FF652850000-0x00007FF652C41000-memory.dmp	upx
behavioral2/memory/4776-449-0x00007FF607C40000-0x00007FF608031000-memory.dmp	upx
behavioral2/memory/2368-462-0x00007FF704CE0000-0x00007FF7050D1000-memory.dmp	upx
behavioral2/memory/444-461-0x00007FF672200000-0x00007FF6725F1000-memory.dmp	upx
behavioral2/memory/3544-457-0x00007FF6A0740000-0x00007FF6A0B31000-memory.dmp	upx
behavioral2/memory/4880-466-0x00007FF7BDFF0000-0x00007FF7BE3E1000-memory.dmp	upx
behavioral2/memory/2804-1969-0x00007FF733CA0000-0x00007FF734091000-memory.dmp	upx
behavioral2/memory/2804-2003-0x00007FF733CA0000-0x00007FF734091000-memory.dmp	upx
behavioral2/memory/1608-2005-0x00007FF6B4B60000-0x00007FF6B4F51000-memory.dmp	upx
behavioral2/memory/5004-2007-0x00007FF749A10000-0x00007FF749E01000-memory.dmp	upx
behavioral2/memory/1200-2009-0x00007FF785C70000-0x00007FF786061000-memory.dmp	upx
behavioral2/memory/2240-2012-0x00007FF632C10000-0x00007FF633001000-memory.dmp	upx
behavioral2/memory/472-2013-0x00007FF720300000-0x00007FF7206F1000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\OdERcAy.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\WyUAaWO.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\AGGBsem.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\ewKSHIf.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\xWLfgXI.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\GPxZHKW.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\NBwHVTz.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\spMqQfs.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\aQyiGAY.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\oRVzqbS.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\YxRRAVH.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\CiUvnQr.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\NByRDfB.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\UNQgBdm.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\GEjecpv.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\PEVWsUI.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\TZcLHrT.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\NSBEvGO.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\HxPCVEd.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\umDSijx.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\TflxLOb.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\sVxmsqO.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\jWRkdPr.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\pTDeWhi.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\hVhsbtd.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\HbswzmY.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\Fvojova.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\SgeDDxL.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\IbYdFSR.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\VnFQyhs.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\ZKNqipa.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\JMXLSgP.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\OBzkZMM.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\IFghIlr.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\RuBvXAn.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\yUDKCaG.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\mvaRTfI.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\NnlNkEl.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\eovrGbZ.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\AWSADPe.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\grPccds.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\XyxCUcB.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\pSCcxOv.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\NWYDIGW.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\UZbIkqF.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\AxEIgKN.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\cXLcCII.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\iztQruI.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\mRmjFLk.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\RYjWmRG.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\zPxNYqa.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\dXSbnVL.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\XbaqVvn.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\yzTvFwE.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\DIqlFaD.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\zDpagHs.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\oFBfqOz.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\WDRUFrs.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\NViUvhf.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\PopICPJ.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\jgjxFZv.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\GRSTDyE.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\BMXyIeA.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
File created	C:\Windows\System32\NcAvMOs.exe	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 2804	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	85
PID 1496 wrote to memory of 2804	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	85
PID 1496 wrote to memory of 1608	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	86
PID 1496 wrote to memory of 1608	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	86
PID 1496 wrote to memory of 5004	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	87
PID 1496 wrote to memory of 5004	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	87
PID 1496 wrote to memory of 1200	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	88
PID 1496 wrote to memory of 1200	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	88
PID 1496 wrote to memory of 2240	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	89
PID 1496 wrote to memory of 2240	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	89
PID 1496 wrote to memory of 472	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	91
PID 1496 wrote to memory of 472	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	91
PID 1496 wrote to memory of 4880	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	92
PID 1496 wrote to memory of 4880	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	92
PID 1496 wrote to memory of 3332	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	93
PID 1496 wrote to memory of 3332	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	93
PID 1496 wrote to memory of 4312	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	94
PID 1496 wrote to memory of 4312	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	94
PID 1496 wrote to memory of 4460	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	95
PID 1496 wrote to memory of 4460	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	95
PID 1496 wrote to memory of 3920	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	96
PID 1496 wrote to memory of 3920	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	96
PID 1496 wrote to memory of 5096	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	97
PID 1496 wrote to memory of 5096	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	97
PID 1496 wrote to memory of 4184	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	98
PID 1496 wrote to memory of 4184	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	98
PID 1496 wrote to memory of 3588	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	99
PID 1496 wrote to memory of 3588	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	99
PID 1496 wrote to memory of 1480	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	100
PID 1496 wrote to memory of 1480	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	100
PID 1496 wrote to memory of 3148	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	101
PID 1496 wrote to memory of 3148	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	101
PID 1496 wrote to memory of 2744	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	102
PID 1496 wrote to memory of 2744	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	102
PID 1496 wrote to memory of 1696	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	103
PID 1496 wrote to memory of 1696	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	103
PID 1496 wrote to memory of 2948	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	104
PID 1496 wrote to memory of 2948	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	104
PID 1496 wrote to memory of 2564	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	105
PID 1496 wrote to memory of 2564	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	105
PID 1496 wrote to memory of 4776	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	106
PID 1496 wrote to memory of 4776	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	106
PID 1496 wrote to memory of 3544	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	107
PID 1496 wrote to memory of 3544	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	107
PID 1496 wrote to memory of 444	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	108
PID 1496 wrote to memory of 444	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	108
PID 1496 wrote to memory of 2368	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	109
PID 1496 wrote to memory of 2368	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	109
PID 1496 wrote to memory of 1064	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	110
PID 1496 wrote to memory of 1064	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	110
PID 1496 wrote to memory of 3768	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	111
PID 1496 wrote to memory of 3768	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	111
PID 1496 wrote to memory of 4176	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	112
PID 1496 wrote to memory of 4176	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	112
PID 1496 wrote to memory of 3964	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	113
PID 1496 wrote to memory of 3964	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	113
PID 1496 wrote to memory of 4936	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	114
PID 1496 wrote to memory of 4936	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	114
PID 1496 wrote to memory of 3480	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	115
PID 1496 wrote to memory of 3480	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	115
PID 1496 wrote to memory of 2528	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	116
PID 1496 wrote to memory of 2528	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	116
PID 1496 wrote to memory of 4216	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	117
PID 1496 wrote to memory of 4216	1496	1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe	117

C:\Users\Admin\AppData\Local\Temp\1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1f1424a9abd44d9c4cf60d74bc184b9c_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\System32\eovrGbZ.exe
  C:\Windows\System32\eovrGbZ.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System32\kARLSbC.exe
  C:\Windows\System32\kARLSbC.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System32\FIVsRjI.exe
  C:\Windows\System32\FIVsRjI.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System32\TBeXKfO.exe
  C:\Windows\System32\TBeXKfO.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System32\endioUh.exe
  C:\Windows\System32\endioUh.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System32\ApOBsok.exe
  C:\Windows\System32\ApOBsok.exe
  2⤵
  - Executes dropped EXE
  PID:472
- C:\Windows\System32\oHSkeov.exe
  C:\Windows\System32\oHSkeov.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System32\ysdqaVR.exe
  C:\Windows\System32\ysdqaVR.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System32\IFghIlr.exe
  C:\Windows\System32\IFghIlr.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System32\EVRbjLw.exe
  C:\Windows\System32\EVRbjLw.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System32\ojKmNCd.exe
  C:\Windows\System32\ojKmNCd.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System32\cgICDHc.exe
  C:\Windows\System32\cgICDHc.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System32\aXbxZdL.exe
  C:\Windows\System32\aXbxZdL.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System32\mRmjFLk.exe
  C:\Windows\System32\mRmjFLk.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System32\IbmRWBS.exe
  C:\Windows\System32\IbmRWBS.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System32\jYZYRru.exe
  C:\Windows\System32\jYZYRru.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System32\DKYUNTw.exe
  C:\Windows\System32\DKYUNTw.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System32\fUGOsZf.exe
  C:\Windows\System32\fUGOsZf.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System32\pcDRmVm.exe
  C:\Windows\System32\pcDRmVm.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System32\PvhbrDa.exe
  C:\Windows\System32\PvhbrDa.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System32\vdGrCzh.exe
  C:\Windows\System32\vdGrCzh.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System32\SoXNQVn.exe
  C:\Windows\System32\SoXNQVn.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System32\RuBvXAn.exe
  C:\Windows\System32\RuBvXAn.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System32\qEjmRVU.exe
  C:\Windows\System32\qEjmRVU.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System32\SgeDDxL.exe
  C:\Windows\System32\SgeDDxL.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System32\oWhiHHl.exe
  C:\Windows\System32\oWhiHHl.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System32\JGayaAK.exe
  C:\Windows\System32\JGayaAK.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System32\IbYdFSR.exe
  C:\Windows\System32\IbYdFSR.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System32\JHqTQOj.exe
  C:\Windows\System32\JHqTQOj.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System32\aBMogpu.exe
  C:\Windows\System32\aBMogpu.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System32\OdGmIgh.exe
  C:\Windows\System32\OdGmIgh.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System32\BAdicvg.exe
  C:\Windows\System32\BAdicvg.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System32\QKXXdLE.exe
  C:\Windows\System32\QKXXdLE.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System32\PRvwTNy.exe
  C:\Windows\System32\PRvwTNy.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System32\VnFQyhs.exe
  C:\Windows\System32\VnFQyhs.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System32\NyNMvjR.exe
  C:\Windows\System32\NyNMvjR.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System32\hVLDBzh.exe
  C:\Windows\System32\hVLDBzh.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System32\VQoiodG.exe
  C:\Windows\System32\VQoiodG.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System32\AxEIgKN.exe
  C:\Windows\System32\AxEIgKN.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System32\dYkPLzK.exe
  C:\Windows\System32\dYkPLzK.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System32\DzQZrxI.exe
  C:\Windows\System32\DzQZrxI.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System32\wrkXrsI.exe
  C:\Windows\System32\wrkXrsI.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System32\RVeppmP.exe
  C:\Windows\System32\RVeppmP.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System32\pqfgVNq.exe
  C:\Windows\System32\pqfgVNq.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System32\OEvFcux.exe
  C:\Windows\System32\OEvFcux.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System32\oFBfqOz.exe
  C:\Windows\System32\oFBfqOz.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System32\HbswzmY.exe
  C:\Windows\System32\HbswzmY.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System32\ZJhhOBP.exe
  C:\Windows\System32\ZJhhOBP.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System32\ITUGOEk.exe
  C:\Windows\System32\ITUGOEk.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System32\ZKNqipa.exe
  C:\Windows\System32\ZKNqipa.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System32\skBGpAO.exe
  C:\Windows\System32\skBGpAO.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System32\qkCpWVL.exe
  C:\Windows\System32\qkCpWVL.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System32\QJxZgjE.exe
  C:\Windows\System32\QJxZgjE.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System32\yypCnqG.exe
  C:\Windows\System32\yypCnqG.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System32\YxRRAVH.exe
  C:\Windows\System32\YxRRAVH.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System32\XhkuYro.exe
  C:\Windows\System32\XhkuYro.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System32\TNNXIHX.exe
  C:\Windows\System32\TNNXIHX.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System32\JVwpaUy.exe
  C:\Windows\System32\JVwpaUy.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System32\jluVHAi.exe
  C:\Windows\System32\jluVHAi.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System32\CoWPciQ.exe
  C:\Windows\System32\CoWPciQ.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System32\PAMXVHD.exe
  C:\Windows\System32\PAMXVHD.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System32\kqTekTb.exe
  C:\Windows\System32\kqTekTb.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System32\YzspUCs.exe
  C:\Windows\System32\YzspUCs.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System32\EPfQaNH.exe
  C:\Windows\System32\EPfQaNH.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System32\JibJNaP.exe
  C:\Windows\System32\JibJNaP.exe
  2⤵
  PID:3948
- C:\Windows\System32\oRoQQVo.exe
  C:\Windows\System32\oRoQQVo.exe
  2⤵
  PID:4388
- C:\Windows\System32\OlRNTfC.exe
  C:\Windows\System32\OlRNTfC.exe
  2⤵
  PID:972
- C:\Windows\System32\PhmVNRP.exe
  C:\Windows\System32\PhmVNRP.exe
  2⤵
  PID:4424
- C:\Windows\System32\JMXLSgP.exe
  C:\Windows\System32\JMXLSgP.exe
  2⤵
  PID:2872
- C:\Windows\System32\CiUvnQr.exe
  C:\Windows\System32\CiUvnQr.exe
  2⤵
  PID:3728
- C:\Windows\System32\GEjecpv.exe
  C:\Windows\System32\GEjecpv.exe
  2⤵
  PID:4656
- C:\Windows\System32\DutGafY.exe
  C:\Windows\System32\DutGafY.exe
  2⤵
  PID:4168
- C:\Windows\System32\zMjxVax.exe
  C:\Windows\System32\zMjxVax.exe
  2⤵
  PID:2176
- C:\Windows\System32\rogbfZM.exe
  C:\Windows\System32\rogbfZM.exe
  2⤵
  PID:3584
- C:\Windows\System32\fcFvVhQ.exe
  C:\Windows\System32\fcFvVhQ.exe
  2⤵
  PID:5076
- C:\Windows\System32\UeiIMJE.exe
  C:\Windows\System32\UeiIMJE.exe
  2⤵
  PID:1152
- C:\Windows\System32\XLrdQjN.exe
  C:\Windows\System32\XLrdQjN.exe
  2⤵
  PID:5116
- C:\Windows\System32\zMOQPpK.exe
  C:\Windows\System32\zMOQPpK.exe
  2⤵
  PID:4536
- C:\Windows\System32\frhQsTw.exe
  C:\Windows\System32\frhQsTw.exe
  2⤵
  PID:4604
- C:\Windows\System32\dVbigvI.exe
  C:\Windows\System32\dVbigvI.exe
  2⤵
  PID:4420
- C:\Windows\System32\icHevVb.exe
  C:\Windows\System32\icHevVb.exe
  2⤵
  PID:2060
- C:\Windows\System32\WgGMXPp.exe
  C:\Windows\System32\WgGMXPp.exe
  2⤵
  PID:5144
- C:\Windows\System32\zKGZbwa.exe
  C:\Windows\System32\zKGZbwa.exe
  2⤵
  PID:5168
- C:\Windows\System32\uAGvObB.exe
  C:\Windows\System32\uAGvObB.exe
  2⤵
  PID:5200
- C:\Windows\System32\gUwgkDu.exe
  C:\Windows\System32\gUwgkDu.exe
  2⤵
  PID:5228
- C:\Windows\System32\IQPQKQH.exe
  C:\Windows\System32\IQPQKQH.exe
  2⤵
  PID:5260
- C:\Windows\System32\cTubQuJ.exe
  C:\Windows\System32\cTubQuJ.exe
  2⤵
  PID:5280
- C:\Windows\System32\GatPKAT.exe
  C:\Windows\System32\GatPKAT.exe
  2⤵
  PID:5316
- C:\Windows\System32\ezxqhrG.exe
  C:\Windows\System32\ezxqhrG.exe
  2⤵
  PID:5340
- C:\Windows\System32\DpWDJPB.exe
  C:\Windows\System32\DpWDJPB.exe
  2⤵
  PID:5368
- C:\Windows\System32\cvDFgYd.exe
  C:\Windows\System32\cvDFgYd.exe
  2⤵
  PID:5392
- C:\Windows\System32\pNGFmln.exe
  C:\Windows\System32\pNGFmln.exe
  2⤵
  PID:5428
- C:\Windows\System32\lCYpsoZ.exe
  C:\Windows\System32\lCYpsoZ.exe
  2⤵
  PID:5452
- C:\Windows\System32\AZXCdYr.exe
  C:\Windows\System32\AZXCdYr.exe
  2⤵
  PID:5484
- C:\Windows\System32\CcHyuKg.exe
  C:\Windows\System32\CcHyuKg.exe
  2⤵
  PID:5504
- C:\Windows\System32\grPccds.exe
  C:\Windows\System32\grPccds.exe
  2⤵
  PID:5536
- C:\Windows\System32\RtObPnh.exe
  C:\Windows\System32\RtObPnh.exe
  2⤵
  PID:5564
- C:\Windows\System32\vLqgVld.exe
  C:\Windows\System32\vLqgVld.exe
  2⤵
  PID:5596
- C:\Windows\System32\FNYJwJX.exe
  C:\Windows\System32\FNYJwJX.exe
  2⤵
  PID:5624
- C:\Windows\System32\dyYdlLF.exe
  C:\Windows\System32\dyYdlLF.exe
  2⤵
  PID:5644
- C:\Windows\System32\KBbmScj.exe
  C:\Windows\System32\KBbmScj.exe
  2⤵
  PID:5672
- C:\Windows\System32\KBtMHKB.exe
  C:\Windows\System32\KBtMHKB.exe
  2⤵
  PID:5700
- C:\Windows\System32\uMrHILH.exe
  C:\Windows\System32\uMrHILH.exe
  2⤵
  PID:5732
- C:\Windows\System32\mkFvLNa.exe
  C:\Windows\System32\mkFvLNa.exe
  2⤵
  PID:5756
- C:\Windows\System32\mQYfHqr.exe
  C:\Windows\System32\mQYfHqr.exe
  2⤵
  PID:5788
- C:\Windows\System32\VtJEFnj.exe
  C:\Windows\System32\VtJEFnj.exe
  2⤵
  PID:5816
- C:\Windows\System32\KYXwomZ.exe
  C:\Windows\System32\KYXwomZ.exe
  2⤵
  PID:5844
- C:\Windows\System32\ReuvIvB.exe
  C:\Windows\System32\ReuvIvB.exe
  2⤵
  PID:5868
- C:\Windows\System32\eFYdATF.exe
  C:\Windows\System32\eFYdATF.exe
  2⤵
  PID:5904
- C:\Windows\System32\RHSNRLX.exe
  C:\Windows\System32\RHSNRLX.exe
  2⤵
  PID:5988
- C:\Windows\System32\JWhKZVm.exe
  C:\Windows\System32\JWhKZVm.exe
  2⤵
  PID:6012
- C:\Windows\System32\cdWtQlg.exe
  C:\Windows\System32\cdWtQlg.exe
  2⤵
  PID:6032
- C:\Windows\System32\BFxTHfb.exe
  C:\Windows\System32\BFxTHfb.exe
  2⤵
  PID:6048
- C:\Windows\System32\cTRYFqF.exe
  C:\Windows\System32\cTRYFqF.exe
  2⤵
  PID:6068
- C:\Windows\System32\lYMSzSu.exe
  C:\Windows\System32\lYMSzSu.exe
  2⤵
  PID:6088
- C:\Windows\System32\jRpnpOi.exe
  C:\Windows\System32\jRpnpOi.exe
  2⤵
  PID:6108
- C:\Windows\System32\WDRUFrs.exe
  C:\Windows\System32\WDRUFrs.exe
  2⤵
  PID:6140
- C:\Windows\System32\jWRkdPr.exe
  C:\Windows\System32\jWRkdPr.exe
  2⤵
  PID:4804
- C:\Windows\System32\oFnufTX.exe
  C:\Windows\System32\oFnufTX.exe
  2⤵
  PID:5132
- C:\Windows\System32\XdmftsQ.exe
  C:\Windows\System32\XdmftsQ.exe
  2⤵
  PID:5220
- C:\Windows\System32\PKdCDYF.exe
  C:\Windows\System32\PKdCDYF.exe
  2⤵
  PID:5236
- C:\Windows\System32\ukQxTUR.exe
  C:\Windows\System32\ukQxTUR.exe
  2⤵
  PID:5300
- C:\Windows\System32\IRdWnQU.exe
  C:\Windows\System32\IRdWnQU.exe
  2⤵
  PID:4948
- C:\Windows\System32\YwZjewc.exe
  C:\Windows\System32\YwZjewc.exe
  2⤵
  PID:5384
- C:\Windows\System32\GdmIyjT.exe
  C:\Windows\System32\GdmIyjT.exe
  2⤵
  PID:5408
- C:\Windows\System32\qUkZDJe.exe
  C:\Windows\System32\qUkZDJe.exe
  2⤵
  PID:5480
- C:\Windows\System32\naELpBj.exe
  C:\Windows\System32\naELpBj.exe
  2⤵
  PID:5660
- C:\Windows\System32\VhvIlYT.exe
  C:\Windows\System32\VhvIlYT.exe
  2⤵
  PID:2852
- C:\Windows\System32\kqCNvrQ.exe
  C:\Windows\System32\kqCNvrQ.exe
  2⤵
  PID:5708
- C:\Windows\System32\cXLcCII.exe
  C:\Windows\System32\cXLcCII.exe
  2⤵
  PID:2052
- C:\Windows\System32\ywAZqVO.exe
  C:\Windows\System32\ywAZqVO.exe
  2⤵
  PID:5804
- C:\Windows\System32\NmowOKs.exe
  C:\Windows\System32\NmowOKs.exe
  2⤵
  PID:5040
- C:\Windows\System32\MoBXlNg.exe
  C:\Windows\System32\MoBXlNg.exe
  2⤵
  PID:4488
- C:\Windows\System32\ZfIodPL.exe
  C:\Windows\System32\ZfIodPL.exe
  2⤵
  PID:5936
- C:\Windows\System32\NVvSIRj.exe
  C:\Windows\System32\NVvSIRj.exe
  2⤵
  PID:4324
- C:\Windows\System32\YzKWiXd.exe
  C:\Windows\System32\YzKWiXd.exe
  2⤵
  PID:812
- C:\Windows\System32\WEcUaVX.exe
  C:\Windows\System32\WEcUaVX.exe
  2⤵
  PID:5968
- C:\Windows\System32\mpPTslN.exe
  C:\Windows\System32\mpPTslN.exe
  2⤵
  PID:5996
- C:\Windows\System32\ibIwexZ.exe
  C:\Windows\System32\ibIwexZ.exe
  2⤵
  PID:6044
- C:\Windows\System32\hEfAsOt.exe
  C:\Windows\System32\hEfAsOt.exe
  2⤵
  PID:6104
- C:\Windows\System32\riIWgqW.exe
  C:\Windows\System32\riIWgqW.exe
  2⤵
  PID:2432
- C:\Windows\System32\UtEinNd.exe
  C:\Windows\System32\UtEinNd.exe
  2⤵
  PID:5160
- C:\Windows\System32\sLxhCoS.exe
  C:\Windows\System32\sLxhCoS.exe
  2⤵
  PID:5124
- C:\Windows\System32\mQxhNGk.exe
  C:\Windows\System32\mQxhNGk.exe
  2⤵
  PID:5248
- C:\Windows\System32\GuYmXCt.exe
  C:\Windows\System32\GuYmXCt.exe
  2⤵
  PID:1008
- C:\Windows\System32\pCOVWhZ.exe
  C:\Windows\System32\pCOVWhZ.exe
  2⤵
  PID:4316
- C:\Windows\System32\TnAIpEf.exe
  C:\Windows\System32\TnAIpEf.exe
  2⤵
  PID:6076
- C:\Windows\System32\SuIVctp.exe
  C:\Windows\System32\SuIVctp.exe
  2⤵
  PID:5772
- C:\Windows\System32\AWSADPe.exe
  C:\Windows\System32\AWSADPe.exe
  2⤵
  PID:5940
- C:\Windows\System32\ncaxzTw.exe
  C:\Windows\System32\ncaxzTw.exe
  2⤵
  PID:5984
- C:\Windows\System32\kJREdvT.exe
  C:\Windows\System32\kJREdvT.exe
  2⤵
  PID:5888
- C:\Windows\System32\ZGTDQYT.exe
  C:\Windows\System32\ZGTDQYT.exe
  2⤵
  PID:6064
- C:\Windows\System32\bzCOmnG.exe
  C:\Windows\System32\bzCOmnG.exe
  2⤵
  PID:5388
- C:\Windows\System32\qsshQXL.exe
  C:\Windows\System32\qsshQXL.exe
  2⤵
  PID:2608
- C:\Windows\System32\erMoTlL.exe
  C:\Windows\System32\erMoTlL.exe
  2⤵
  PID:5524
- C:\Windows\System32\bbGaNLW.exe
  C:\Windows\System32\bbGaNLW.exe
  2⤵
  PID:5740
- C:\Windows\System32\PQaOdjl.exe
  C:\Windows\System32\PQaOdjl.exe
  2⤵
  PID:5852
- C:\Windows\System32\XddORpj.exe
  C:\Windows\System32\XddORpj.exe
  2⤵
  PID:4468
- C:\Windows\System32\bnKzeWb.exe
  C:\Windows\System32\bnKzeWb.exe
  2⤵
  PID:6132
- C:\Windows\System32\rtiXJgz.exe
  C:\Windows\System32\rtiXJgz.exe
  2⤵
  PID:540
- C:\Windows\System32\ThveMVL.exe
  C:\Windows\System32\ThveMVL.exe
  2⤵
  PID:5176
- C:\Windows\System32\GPxZHKW.exe
  C:\Windows\System32\GPxZHKW.exe
  2⤵
  PID:6148
- C:\Windows\System32\QRgpAMU.exe
  C:\Windows\System32\QRgpAMU.exe
  2⤵
  PID:6172
- C:\Windows\System32\lbZPeJO.exe
  C:\Windows\System32\lbZPeJO.exe
  2⤵
  PID:6192
- C:\Windows\System32\GUjsjRn.exe
  C:\Windows\System32\GUjsjRn.exe
  2⤵
  PID:6216
- C:\Windows\System32\XzlzxuE.exe
  C:\Windows\System32\XzlzxuE.exe
  2⤵
  PID:6272
- C:\Windows\System32\KoHYiWB.exe
  C:\Windows\System32\KoHYiWB.exe
  2⤵
  PID:6304
- C:\Windows\System32\hupTwWs.exe
  C:\Windows\System32\hupTwWs.exe
  2⤵
  PID:6324
- C:\Windows\System32\eOfaNEL.exe
  C:\Windows\System32\eOfaNEL.exe
  2⤵
  PID:6412
- C:\Windows\System32\hpaGkSs.exe
  C:\Windows\System32\hpaGkSs.exe
  2⤵
  PID:6428
- C:\Windows\System32\ePsHnOG.exe
  C:\Windows\System32\ePsHnOG.exe
  2⤵
  PID:6488
- C:\Windows\System32\DfgHJPE.exe
  C:\Windows\System32\DfgHJPE.exe
  2⤵
  PID:6528
- C:\Windows\System32\axZtYQS.exe
  C:\Windows\System32\axZtYQS.exe
  2⤵
  PID:6552
- C:\Windows\System32\MSlYjjU.exe
  C:\Windows\System32\MSlYjjU.exe
  2⤵
  PID:6572
- C:\Windows\System32\lHdyjbw.exe
  C:\Windows\System32\lHdyjbw.exe
  2⤵
  PID:6592
- C:\Windows\System32\WLmRTxP.exe
  C:\Windows\System32\WLmRTxP.exe
  2⤵
  PID:6620
- C:\Windows\System32\EQtmXhK.exe
  C:\Windows\System32\EQtmXhK.exe
  2⤵
  PID:6644
- C:\Windows\System32\eHNZavF.exe
  C:\Windows\System32\eHNZavF.exe
  2⤵
  PID:6668
- C:\Windows\System32\hyKxKsZ.exe
  C:\Windows\System32\hyKxKsZ.exe
  2⤵
  PID:6684
- C:\Windows\System32\SrzAfuu.exe
  C:\Windows\System32\SrzAfuu.exe
  2⤵
  PID:6748
- C:\Windows\System32\gBlKnIv.exe
  C:\Windows\System32\gBlKnIv.exe
  2⤵
  PID:6764
- C:\Windows\System32\QGbXFzf.exe
  C:\Windows\System32\QGbXFzf.exe
  2⤵
  PID:6788
- C:\Windows\System32\QFDIBnv.exe
  C:\Windows\System32\QFDIBnv.exe
  2⤵
  PID:6808
- C:\Windows\System32\ZPjgUet.exe
  C:\Windows\System32\ZPjgUet.exe
  2⤵
  PID:6836
- C:\Windows\System32\RdnTdkX.exe
  C:\Windows\System32\RdnTdkX.exe
  2⤵
  PID:6872
- C:\Windows\System32\yFXUYlL.exe
  C:\Windows\System32\yFXUYlL.exe
  2⤵
  PID:6892
- C:\Windows\System32\ggwbJaF.exe
  C:\Windows\System32\ggwbJaF.exe
  2⤵
  PID:6908
- C:\Windows\System32\XZeJAVF.exe
  C:\Windows\System32\XZeJAVF.exe
  2⤵
  PID:6932
- C:\Windows\System32\VowpLws.exe
  C:\Windows\System32\VowpLws.exe
  2⤵
  PID:6960
- C:\Windows\System32\SDPpYJQ.exe
  C:\Windows\System32\SDPpYJQ.exe
  2⤵
  PID:6988
- C:\Windows\System32\TaWLNLX.exe
  C:\Windows\System32\TaWLNLX.exe
  2⤵
  PID:7052
- C:\Windows\System32\hiTIoHB.exe
  C:\Windows\System32\hiTIoHB.exe
  2⤵
  PID:7076
- C:\Windows\System32\RSSGUei.exe
  C:\Windows\System32\RSSGUei.exe
  2⤵
  PID:7096
- C:\Windows\System32\vVTAtrT.exe
  C:\Windows\System32\vVTAtrT.exe
  2⤵
  PID:7116
- C:\Windows\System32\xKHpabp.exe
  C:\Windows\System32\xKHpabp.exe
  2⤵
  PID:7140
- C:\Windows\System32\ovcpjSB.exe
  C:\Windows\System32\ovcpjSB.exe
  2⤵
  PID:7160
- C:\Windows\System32\hWvTZbT.exe
  C:\Windows\System32\hWvTZbT.exe
  2⤵
  PID:5244
- C:\Windows\System32\RYjWmRG.exe
  C:\Windows\System32\RYjWmRG.exe
  2⤵
  PID:6164
- C:\Windows\System32\xMdcIkT.exe
  C:\Windows\System32\xMdcIkT.exe
  2⤵
  PID:6116
- C:\Windows\System32\fODZIvM.exe
  C:\Windows\System32\fODZIvM.exe
  2⤵
  PID:6340
- C:\Windows\System32\HIMgzXd.exe
  C:\Windows\System32\HIMgzXd.exe
  2⤵
  PID:6436
- C:\Windows\System32\EVOySoN.exe
  C:\Windows\System32\EVOySoN.exe
  2⤵
  PID:6360
- C:\Windows\System32\zwEBQFs.exe
  C:\Windows\System32\zwEBQFs.exe
  2⤵
  PID:6444
- C:\Windows\System32\zPxNYqa.exe
  C:\Windows\System32\zPxNYqa.exe
  2⤵
  PID:6640
- C:\Windows\System32\WPxdBRx.exe
  C:\Windows\System32\WPxdBRx.exe
  2⤵
  PID:6772
- C:\Windows\System32\veVWWkv.exe
  C:\Windows\System32\veVWWkv.exe
  2⤵
  PID:6732
- C:\Windows\System32\izwErzI.exe
  C:\Windows\System32\izwErzI.exe
  2⤵
  PID:6884
- C:\Windows\System32\OeoryXm.exe
  C:\Windows\System32\OeoryXm.exe
  2⤵
  PID:6976
- C:\Windows\System32\rNecXdA.exe
  C:\Windows\System32\rNecXdA.exe
  2⤵
  PID:6968
- C:\Windows\System32\OMOenZj.exe
  C:\Windows\System32\OMOenZj.exe
  2⤵
  PID:7032
- C:\Windows\System32\LSSjdwX.exe
  C:\Windows\System32\LSSjdwX.exe
  2⤵
  PID:7068
- C:\Windows\System32\PopICPJ.exe
  C:\Windows\System32\PopICPJ.exe
  2⤵
  PID:7124
- C:\Windows\System32\HHBIQAH.exe
  C:\Windows\System32\HHBIQAH.exe
  2⤵
  PID:7156
- C:\Windows\System32\LZbjzAI.exe
  C:\Windows\System32\LZbjzAI.exe
  2⤵
  PID:6232
- C:\Windows\System32\JsDPxqJ.exe
  C:\Windows\System32\JsDPxqJ.exe
  2⤵
  PID:6156
- C:\Windows\System32\LeUMDEy.exe
  C:\Windows\System32\LeUMDEy.exe
  2⤵
  PID:6332
- C:\Windows\System32\VwhrSmO.exe
  C:\Windows\System32\VwhrSmO.exe
  2⤵
  PID:6680
- C:\Windows\System32\PEVWsUI.exe
  C:\Windows\System32\PEVWsUI.exe
  2⤵
  PID:6864
- C:\Windows\System32\ghSncWL.exe
  C:\Windows\System32\ghSncWL.exe
  2⤵
  PID:5692
- C:\Windows\System32\rexBtbF.exe
  C:\Windows\System32\rexBtbF.exe
  2⤵
  PID:6388
- C:\Windows\System32\VBgWoWc.exe
  C:\Windows\System32\VBgWoWc.exe
  2⤵
  PID:6984
- C:\Windows\System32\rOxngIA.exe
  C:\Windows\System32\rOxngIA.exe
  2⤵
  PID:6940
- C:\Windows\System32\pTDeWhi.exe
  C:\Windows\System32\pTDeWhi.exe
  2⤵
  PID:6888
- C:\Windows\System32\BlIELoE.exe
  C:\Windows\System32\BlIELoE.exe
  2⤵
  PID:7192
- C:\Windows\System32\GNLSRSZ.exe
  C:\Windows\System32\GNLSRSZ.exe
  2⤵
  PID:7208
- C:\Windows\System32\BiwAcnC.exe
  C:\Windows\System32\BiwAcnC.exe
  2⤵
  PID:7232
- C:\Windows\System32\bQPRpBY.exe
  C:\Windows\System32\bQPRpBY.exe
  2⤵
  PID:7256
- C:\Windows\System32\WtsLaqr.exe
  C:\Windows\System32\WtsLaqr.exe
  2⤵
  PID:7280
- C:\Windows\System32\JNDSqTZ.exe
  C:\Windows\System32\JNDSqTZ.exe
  2⤵
  PID:7296
- C:\Windows\System32\SFScelk.exe
  C:\Windows\System32\SFScelk.exe
  2⤵
  PID:7312
- C:\Windows\System32\ewKSHIf.exe
  C:\Windows\System32\ewKSHIf.exe
  2⤵
  PID:7340
- C:\Windows\System32\krieKxh.exe
  C:\Windows\System32\krieKxh.exe
  2⤵
  PID:7392
- C:\Windows\System32\kZnTDqn.exe
  C:\Windows\System32\kZnTDqn.exe
  2⤵
  PID:7412
- C:\Windows\System32\NBwHVTz.exe
  C:\Windows\System32\NBwHVTz.exe
  2⤵
  PID:7428
- C:\Windows\System32\tAimsHQ.exe
  C:\Windows\System32\tAimsHQ.exe
  2⤵
  PID:7480
- C:\Windows\System32\yUDKCaG.exe
  C:\Windows\System32\yUDKCaG.exe
  2⤵
  PID:7496
- C:\Windows\System32\UEqxyhm.exe
  C:\Windows\System32\UEqxyhm.exe
  2⤵
  PID:7528
- C:\Windows\System32\PlXpodo.exe
  C:\Windows\System32\PlXpodo.exe
  2⤵
  PID:7596
- C:\Windows\System32\pYavAIS.exe
  C:\Windows\System32\pYavAIS.exe
  2⤵
  PID:7624
- C:\Windows\System32\gEbdzFk.exe
  C:\Windows\System32\gEbdzFk.exe
  2⤵
  PID:7644
- C:\Windows\System32\cHrHaVs.exe
  C:\Windows\System32\cHrHaVs.exe
  2⤵
  PID:7672
- C:\Windows\System32\nlpVzkk.exe
  C:\Windows\System32\nlpVzkk.exe
  2⤵
  PID:7696
- C:\Windows\System32\UnpkWWe.exe
  C:\Windows\System32\UnpkWWe.exe
  2⤵
  PID:7728
- C:\Windows\System32\hmbasoe.exe
  C:\Windows\System32\hmbasoe.exe
  2⤵
  PID:7780
- C:\Windows\System32\pRpsCNL.exe
  C:\Windows\System32\pRpsCNL.exe
  2⤵
  PID:7800
- C:\Windows\System32\jgjxFZv.exe
  C:\Windows\System32\jgjxFZv.exe
  2⤵
  PID:7824
- C:\Windows\System32\COFHnSv.exe
  C:\Windows\System32\COFHnSv.exe
  2⤵
  PID:7852
- C:\Windows\System32\TbxTnlx.exe
  C:\Windows\System32\TbxTnlx.exe
  2⤵
  PID:7872
- C:\Windows\System32\XzTeTWV.exe
  C:\Windows\System32\XzTeTWV.exe
  2⤵
  PID:7928
- C:\Windows\System32\ZtDvHuK.exe
  C:\Windows\System32\ZtDvHuK.exe
  2⤵
  PID:7968
- C:\Windows\System32\XmgQUQo.exe
  C:\Windows\System32\XmgQUQo.exe
  2⤵
  PID:7984
- C:\Windows\System32\LWxFEEO.exe
  C:\Windows\System32\LWxFEEO.exe
  2⤵
  PID:8012
- C:\Windows\System32\KLaGCew.exe
  C:\Windows\System32\KLaGCew.exe
  2⤵
  PID:8028
- C:\Windows\System32\uXIAhsP.exe
  C:\Windows\System32\uXIAhsP.exe
  2⤵
  PID:8052
- C:\Windows\System32\jquRJbK.exe
  C:\Windows\System32\jquRJbK.exe
  2⤵
  PID:8068
- C:\Windows\System32\Viosxns.exe
  C:\Windows\System32\Viosxns.exe
  2⤵
  PID:8096
- C:\Windows\System32\fCRdIJP.exe
  C:\Windows\System32\fCRdIJP.exe
  2⤵
  PID:8124
- C:\Windows\System32\gZKAKiH.exe
  C:\Windows\System32\gZKAKiH.exe
  2⤵
  PID:8188
- C:\Windows\System32\juXpkGh.exe
  C:\Windows\System32\juXpkGh.exe
  2⤵
  PID:7136
- C:\Windows\System32\kdiYbMO.exe
  C:\Windows\System32\kdiYbMO.exe
  2⤵
  PID:7176
- C:\Windows\System32\WrePeuI.exe
  C:\Windows\System32\WrePeuI.exe
  2⤵
  PID:7304
- C:\Windows\System32\KXsVLhm.exe
  C:\Windows\System32\KXsVLhm.exe
  2⤵
  PID:7400
- C:\Windows\System32\iDUjzeT.exe
  C:\Windows\System32\iDUjzeT.exe
  2⤵
  PID:7456
- C:\Windows\System32\JBXMvUh.exe
  C:\Windows\System32\JBXMvUh.exe
  2⤵
  PID:7520
- C:\Windows\System32\plhWKQH.exe
  C:\Windows\System32\plhWKQH.exe
  2⤵
  PID:7488
- C:\Windows\System32\dcGRdZL.exe
  C:\Windows\System32\dcGRdZL.exe
  2⤵
  PID:7620
- C:\Windows\System32\IhHmbSh.exe
  C:\Windows\System32\IhHmbSh.exe
  2⤵
  PID:7684
- C:\Windows\System32\aaqceIi.exe
  C:\Windows\System32\aaqceIi.exe
  2⤵
  PID:7716
- C:\Windows\System32\wjKVLYm.exe
  C:\Windows\System32\wjKVLYm.exe
  2⤵
  PID:7768
- C:\Windows\System32\XjPAlWq.exe
  C:\Windows\System32\XjPAlWq.exe
  2⤵
  PID:7812
- C:\Windows\System32\xMBUUCP.exe
  C:\Windows\System32\xMBUUCP.exe
  2⤵
  PID:7892
- C:\Windows\System32\dqaspIS.exe
  C:\Windows\System32\dqaspIS.exe
  2⤵
  PID:7952
- C:\Windows\System32\BpgDqHj.exe
  C:\Windows\System32\BpgDqHj.exe
  2⤵
  PID:8024
- C:\Windows\System32\DfWftwb.exe
  C:\Windows\System32\DfWftwb.exe
  2⤵
  PID:8060
- C:\Windows\System32\GgxqdFl.exe
  C:\Windows\System32\GgxqdFl.exe
  2⤵
  PID:7188
- C:\Windows\System32\VTotqiJ.exe
  C:\Windows\System32\VTotqiJ.exe
  2⤵
  PID:7444
- C:\Windows\System32\CSLMJOX.exe
  C:\Windows\System32\CSLMJOX.exe
  2⤵
  PID:7556
- C:\Windows\System32\YeiTWHp.exe
  C:\Windows\System32\YeiTWHp.exe
  2⤵
  PID:7656
- C:\Windows\System32\AriIDQT.exe
  C:\Windows\System32\AriIDQT.exe
  2⤵
  PID:7836
- C:\Windows\System32\dXSbnVL.exe
  C:\Windows\System32\dXSbnVL.exe
  2⤵
  PID:7740
- C:\Windows\System32\AdWOBbK.exe
  C:\Windows\System32\AdWOBbK.exe
  2⤵
  PID:8048
- C:\Windows\System32\EEzfhCa.exe
  C:\Windows\System32\EEzfhCa.exe
  2⤵
  PID:7940
- C:\Windows\System32\gizJNJQ.exe
  C:\Windows\System32\gizJNJQ.exe
  2⤵
  PID:7576
- C:\Windows\System32\jalNjao.exe
  C:\Windows\System32\jalNjao.exe
  2⤵
  PID:7960
- C:\Windows\System32\GRSTDyE.exe
  C:\Windows\System32\GRSTDyE.exe
  2⤵
  PID:6160
- C:\Windows\System32\QsDSHCt.exe
  C:\Windows\System32\QsDSHCt.exe
  2⤵
  PID:8044
- C:\Windows\System32\dvPLdTm.exe
  C:\Windows\System32\dvPLdTm.exe
  2⤵
  PID:8208
- C:\Windows\System32\BcrGSMX.exe
  C:\Windows\System32\BcrGSMX.exe
  2⤵
  PID:8244
- C:\Windows\System32\XikHpKC.exe
  C:\Windows\System32\XikHpKC.exe
  2⤵
  PID:8292
- C:\Windows\System32\uDsstRz.exe
  C:\Windows\System32\uDsstRz.exe
  2⤵
  PID:8316
- C:\Windows\System32\kqfNPGJ.exe
  C:\Windows\System32\kqfNPGJ.exe
  2⤵
  PID:8332
- C:\Windows\System32\NLGQhxV.exe
  C:\Windows\System32\NLGQhxV.exe
  2⤵
  PID:8356
- C:\Windows\System32\XpTvOep.exe
  C:\Windows\System32\XpTvOep.exe
  2⤵
  PID:8420
- C:\Windows\System32\hDWiaTH.exe
  C:\Windows\System32\hDWiaTH.exe
  2⤵
  PID:8440
- C:\Windows\System32\wmTCwJF.exe
  C:\Windows\System32\wmTCwJF.exe
  2⤵
  PID:8464
- C:\Windows\System32\ebDgKcD.exe
  C:\Windows\System32\ebDgKcD.exe
  2⤵
  PID:8488
- C:\Windows\System32\GUutgGr.exe
  C:\Windows\System32\GUutgGr.exe
  2⤵
  PID:8512
- C:\Windows\System32\zzxLSfY.exe
  C:\Windows\System32\zzxLSfY.exe
  2⤵
  PID:8532
- C:\Windows\System32\jQHwKgM.exe
  C:\Windows\System32\jQHwKgM.exe
  2⤵
  PID:8548
- C:\Windows\System32\aCFuyTx.exe
  C:\Windows\System32\aCFuyTx.exe
  2⤵
  PID:8624
- C:\Windows\System32\OhnolPF.exe
  C:\Windows\System32\OhnolPF.exe
  2⤵
  PID:8644
- C:\Windows\System32\zRDvRGt.exe
  C:\Windows\System32\zRDvRGt.exe
  2⤵
  PID:8660
- C:\Windows\System32\TtSuzgd.exe
  C:\Windows\System32\TtSuzgd.exe
  2⤵
  PID:8700
- C:\Windows\System32\IfbUgXg.exe
  C:\Windows\System32\IfbUgXg.exe
  2⤵
  PID:8728
- C:\Windows\System32\YDzRRRn.exe
  C:\Windows\System32\YDzRRRn.exe
  2⤵
  PID:8748
- C:\Windows\System32\DCKWhaS.exe
  C:\Windows\System32\DCKWhaS.exe
  2⤵
  PID:8768
- C:\Windows\System32\HuHyjdR.exe
  C:\Windows\System32\HuHyjdR.exe
  2⤵
  PID:8788
- C:\Windows\System32\uBAakhT.exe
  C:\Windows\System32\uBAakhT.exe
  2⤵
  PID:8808
- C:\Windows\System32\ZMyRKHq.exe
  C:\Windows\System32\ZMyRKHq.exe
  2⤵
  PID:8836
- C:\Windows\System32\zdpvAak.exe
  C:\Windows\System32\zdpvAak.exe
  2⤵
  PID:8860
- C:\Windows\System32\lTdVjnw.exe
  C:\Windows\System32\lTdVjnw.exe
  2⤵
  PID:8880
- C:\Windows\System32\wCfjcgj.exe
  C:\Windows\System32\wCfjcgj.exe
  2⤵
  PID:8900
- C:\Windows\System32\rbVBHPj.exe
  C:\Windows\System32\rbVBHPj.exe
  2⤵
  PID:8924
- C:\Windows\System32\fcWlfok.exe
  C:\Windows\System32\fcWlfok.exe
  2⤵
  PID:8944
- C:\Windows\System32\FWLskKl.exe
  C:\Windows\System32\FWLskKl.exe
  2⤵
  PID:9008
- C:\Windows\System32\AcvakPH.exe
  C:\Windows\System32\AcvakPH.exe
  2⤵
  PID:9064
- C:\Windows\System32\TnASfcJ.exe
  C:\Windows\System32\TnASfcJ.exe
  2⤵
  PID:9092
- C:\Windows\System32\QDrntSq.exe
  C:\Windows\System32\QDrntSq.exe
  2⤵
  PID:9108
- C:\Windows\System32\NSBEvGO.exe
  C:\Windows\System32\NSBEvGO.exe
  2⤵
  PID:9128
- C:\Windows\System32\DQtLSPS.exe
  C:\Windows\System32\DQtLSPS.exe
  2⤵
  PID:9172
- C:\Windows\System32\KAlVDGJ.exe
  C:\Windows\System32\KAlVDGJ.exe
  2⤵
  PID:9212
- C:\Windows\System32\tUtXMfe.exe
  C:\Windows\System32\tUtXMfe.exe
  2⤵
  PID:8220
- C:\Windows\System32\UNTUyRU.exe
  C:\Windows\System32\UNTUyRU.exe
  2⤵
  PID:8280
- C:\Windows\System32\dvTgmpz.exe
  C:\Windows\System32\dvTgmpz.exe
  2⤵
  PID:8328
- C:\Windows\System32\BigiBtn.exe
  C:\Windows\System32\BigiBtn.exe
  2⤵
  PID:8324
- C:\Windows\System32\AuqXTTx.exe
  C:\Windows\System32\AuqXTTx.exe
  2⤵
  PID:8460
- C:\Windows\System32\pSCcxOv.exe
  C:\Windows\System32\pSCcxOv.exe
  2⤵
  PID:8524
- C:\Windows\System32\TOgLnJF.exe
  C:\Windows\System32\TOgLnJF.exe
  2⤵
  PID:8572
- C:\Windows\System32\cDxxMYF.exe
  C:\Windows\System32\cDxxMYF.exe
  2⤵
  PID:8632
- C:\Windows\System32\NpiDRWQ.exe
  C:\Windows\System32\NpiDRWQ.exe
  2⤵
  PID:8676
- C:\Windows\System32\sQaiDcN.exe
  C:\Windows\System32\sQaiDcN.exe
  2⤵
  PID:8804
- C:\Windows\System32\PTJJgtz.exe
  C:\Windows\System32\PTJJgtz.exe
  2⤵
  PID:8852
- C:\Windows\System32\iVDojdt.exe
  C:\Windows\System32\iVDojdt.exe
  2⤵
  PID:8896
- C:\Windows\System32\smgDPSZ.exe
  C:\Windows\System32\smgDPSZ.exe
  2⤵
  PID:8968
- C:\Windows\System32\yGwtHCB.exe
  C:\Windows\System32\yGwtHCB.exe
  2⤵
  PID:9052
- C:\Windows\System32\bZBphih.exe
  C:\Windows\System32\bZBphih.exe
  2⤵
  PID:9104
- C:\Windows\System32\pWLIojW.exe
  C:\Windows\System32\pWLIojW.exe
  2⤵
  PID:9156
- C:\Windows\System32\SuvDoxx.exe
  C:\Windows\System32\SuvDoxx.exe
  2⤵
  PID:9196
- C:\Windows\System32\wkYcfDd.exe
  C:\Windows\System32\wkYcfDd.exe
  2⤵
  PID:8228
- C:\Windows\System32\szhgyxm.exe
  C:\Windows\System32\szhgyxm.exe
  2⤵
  PID:8432
- C:\Windows\System32\fZdHkso.exe
  C:\Windows\System32\fZdHkso.exe
  2⤵
  PID:8712
- C:\Windows\System32\LUQddyx.exe
  C:\Windows\System32\LUQddyx.exe
  2⤵
  PID:8892
- C:\Windows\System32\PaPKBBF.exe
  C:\Windows\System32\PaPKBBF.exe
  2⤵
  PID:8520
- C:\Windows\System32\hIAnJSi.exe
  C:\Windows\System32\hIAnJSi.exe
  2⤵
  PID:9084
- C:\Windows\System32\kGJnfwq.exe
  C:\Windows\System32\kGJnfwq.exe
  2⤵
  PID:9232
- C:\Windows\System32\ElBDwkf.exe
  C:\Windows\System32\ElBDwkf.exe
  2⤵
  PID:9248
- C:\Windows\System32\kKMrEgc.exe
  C:\Windows\System32\kKMrEgc.exe
  2⤵
  PID:9264
- C:\Windows\System32\NOvTMnv.exe
  C:\Windows\System32\NOvTMnv.exe
  2⤵
  PID:9280
- C:\Windows\System32\vXUXQDL.exe
  C:\Windows\System32\vXUXQDL.exe
  2⤵
  PID:9296
- C:\Windows\System32\qWEvIjW.exe
  C:\Windows\System32\qWEvIjW.exe
  2⤵
  PID:9312
- C:\Windows\System32\pcEhXvp.exe
  C:\Windows\System32\pcEhXvp.exe
  2⤵
  PID:9328
- C:\Windows\System32\heKnuZs.exe
  C:\Windows\System32\heKnuZs.exe
  2⤵
  PID:9344
- C:\Windows\System32\BwcjrcA.exe
  C:\Windows\System32\BwcjrcA.exe
  2⤵
  PID:9376
- C:\Windows\System32\ffLbzAr.exe
  C:\Windows\System32\ffLbzAr.exe
  2⤵
  PID:9392
- C:\Windows\System32\FiDMmUN.exe
  C:\Windows\System32\FiDMmUN.exe
  2⤵
  PID:9452
- C:\Windows\System32\cNZrAfq.exe
  C:\Windows\System32\cNZrAfq.exe
  2⤵
  PID:9476
- C:\Windows\System32\McAUTmz.exe
  C:\Windows\System32\McAUTmz.exe
  2⤵
  PID:9504
- C:\Windows\System32\eigqtef.exe
  C:\Windows\System32\eigqtef.exe
  2⤵
  PID:9528
- C:\Windows\System32\TMugwIQ.exe
  C:\Windows\System32\TMugwIQ.exe
  2⤵
  PID:9588
- C:\Windows\System32\TZcLHrT.exe
  C:\Windows\System32\TZcLHrT.exe
  2⤵
  PID:9608
- C:\Windows\System32\ycnqHhv.exe
  C:\Windows\System32\ycnqHhv.exe
  2⤵
  PID:9628
- C:\Windows\System32\dffkxZj.exe
  C:\Windows\System32\dffkxZj.exe
  2⤵
  PID:9692
- C:\Windows\System32\JKxmEaj.exe
  C:\Windows\System32\JKxmEaj.exe
  2⤵
  PID:9748
- C:\Windows\System32\bclHhEk.exe
  C:\Windows\System32\bclHhEk.exe
  2⤵
  PID:9776
- C:\Windows\System32\DkQDlWV.exe
  C:\Windows\System32\DkQDlWV.exe
  2⤵
  PID:9800
- C:\Windows\System32\NWYDIGW.exe
  C:\Windows\System32\NWYDIGW.exe
  2⤵
  PID:9824
- C:\Windows\System32\qDoySxQ.exe
  C:\Windows\System32\qDoySxQ.exe
  2⤵
  PID:9852
- C:\Windows\System32\EiMHTxV.exe
  C:\Windows\System32\EiMHTxV.exe
  2⤵
  PID:9884
- C:\Windows\System32\GsCIuim.exe
  C:\Windows\System32\GsCIuim.exe
  2⤵
  PID:9904
- C:\Windows\System32\WuGmxxx.exe
  C:\Windows\System32\WuGmxxx.exe
  2⤵
  PID:9932
- C:\Windows\System32\kYuEBtu.exe
  C:\Windows\System32\kYuEBtu.exe
  2⤵
  PID:9964
- C:\Windows\System32\olUnzpP.exe
  C:\Windows\System32\olUnzpP.exe
  2⤵
  PID:9988
- C:\Windows\System32\shmKsBz.exe
  C:\Windows\System32\shmKsBz.exe
  2⤵
  PID:10012
- C:\Windows\System32\EEqAGaJ.exe
  C:\Windows\System32\EEqAGaJ.exe
  2⤵
  PID:10044
- C:\Windows\System32\uxEoSXM.exe
  C:\Windows\System32\uxEoSXM.exe
  2⤵
  PID:10076
- C:\Windows\System32\gYNeKEL.exe
  C:\Windows\System32\gYNeKEL.exe
  2⤵
  PID:10092
- C:\Windows\System32\IHyjnat.exe
  C:\Windows\System32\IHyjnat.exe
  2⤵
  PID:10120
- C:\Windows\System32\ltCYwnw.exe
  C:\Windows\System32\ltCYwnw.exe
  2⤵
  PID:10144
- C:\Windows\System32\WlPoBhs.exe
  C:\Windows\System32\WlPoBhs.exe
  2⤵
  PID:10184
- C:\Windows\System32\mvaRTfI.exe
  C:\Windows\System32\mvaRTfI.exe
  2⤵
  PID:10224
- C:\Windows\System32\KXGCwHl.exe
  C:\Windows\System32\KXGCwHl.exe
  2⤵
  PID:3756
- C:\Windows\System32\XTxFQOJ.exe
  C:\Windows\System32\XTxFQOJ.exe
  2⤵
  PID:9088
- C:\Windows\System32\MsdttQR.exe
  C:\Windows\System32\MsdttQR.exe
  2⤵
  PID:8496
- C:\Windows\System32\xtGmhty.exe
  C:\Windows\System32\xtGmhty.exe
  2⤵
  PID:8820
- C:\Windows\System32\imwDFdH.exe
  C:\Windows\System32\imwDFdH.exe
  2⤵
  PID:9228
- C:\Windows\System32\tpJKPcv.exe
  C:\Windows\System32\tpJKPcv.exe
  2⤵
  PID:9272
- C:\Windows\System32\QaafRJI.exe
  C:\Windows\System32\QaafRJI.exe
  2⤵
  PID:9404
- C:\Windows\System32\XyxCUcB.exe
  C:\Windows\System32\XyxCUcB.exe
  2⤵
  PID:9544
- C:\Windows\System32\QILtAAR.exe
  C:\Windows\System32\QILtAAR.exe
  2⤵
  PID:9540
- C:\Windows\System32\HxPCVEd.exe
  C:\Windows\System32\HxPCVEd.exe
  2⤵
  PID:9492
- C:\Windows\System32\kquSzBI.exe
  C:\Windows\System32\kquSzBI.exe
  2⤵
  PID:9616
- C:\Windows\System32\kBGFIfm.exe
  C:\Windows\System32\kBGFIfm.exe
  2⤵
  PID:9660
- C:\Windows\System32\MhvCKiP.exe
  C:\Windows\System32\MhvCKiP.exe
  2⤵
  PID:9760
- C:\Windows\System32\gFmluwG.exe
  C:\Windows\System32\gFmluwG.exe
  2⤵
  PID:9876
- C:\Windows\System32\ryORhua.exe
  C:\Windows\System32\ryORhua.exe
  2⤵
  PID:9900
- C:\Windows\System32\Uvqjwcd.exe
  C:\Windows\System32\Uvqjwcd.exe
  2⤵
  PID:9980
- C:\Windows\System32\yadqDOz.exe
  C:\Windows\System32\yadqDOz.exe
  2⤵
  PID:10004
- C:\Windows\System32\qdLsARM.exe
  C:\Windows\System32\qdLsARM.exe
  2⤵
  PID:10084
- C:\Windows\System32\TdtRllg.exe
  C:\Windows\System32\TdtRllg.exe
  2⤵
  PID:9004
- C:\Windows\System32\cisCCQh.exe
  C:\Windows\System32\cisCCQh.exe
  2⤵
  PID:8560
- C:\Windows\System32\JLQyFet.exe
  C:\Windows\System32\JLQyFet.exe
  2⤵
  PID:9292
- C:\Windows\System32\xnfzkal.exe
  C:\Windows\System32\xnfzkal.exe
  2⤵
  PID:9320
- C:\Windows\System32\BYXaKdn.exe
  C:\Windows\System32\BYXaKdn.exe
  2⤵
  PID:9580
- C:\Windows\System32\ZvIcFSa.exe
  C:\Windows\System32\ZvIcFSa.exe
  2⤵
  PID:9732
- C:\Windows\System32\spMqQfs.exe
  C:\Windows\System32\spMqQfs.exe
  2⤵
  PID:9920
- C:\Windows\System32\yTLoKDu.exe
  C:\Windows\System32\yTLoKDu.exe
  2⤵
  PID:10040
- C:\Windows\System32\cDTqSYM.exe
  C:\Windows\System32\cDTqSYM.exe
  2⤵
  PID:10100
- C:\Windows\System32\cvOeHND.exe
  C:\Windows\System32\cvOeHND.exe
  2⤵
  PID:8980
- C:\Windows\System32\GtWigWz.exe
  C:\Windows\System32\GtWigWz.exe
  2⤵
  PID:9372
- C:\Windows\System32\XOGjzzS.exe
  C:\Windows\System32\XOGjzzS.exe
  2⤵
  PID:9808
- C:\Windows\System32\XcaVnrn.exe
  C:\Windows\System32\XcaVnrn.exe
  2⤵
  PID:9500
- C:\Windows\System32\cDEnVLK.exe
  C:\Windows\System32\cDEnVLK.exe
  2⤵
  PID:9164
- C:\Windows\System32\aQyiGAY.exe
  C:\Windows\System32\aQyiGAY.exe
  2⤵
  PID:9424
- C:\Windows\System32\OZadZvj.exe
  C:\Windows\System32\OZadZvj.exe
  2⤵
  PID:10260
- C:\Windows\System32\jiEtsiR.exe
  C:\Windows\System32\jiEtsiR.exe
  2⤵
  PID:10280
- C:\Windows\System32\kChcTKf.exe
  C:\Windows\System32\kChcTKf.exe
  2⤵
  PID:10308
- C:\Windows\System32\vmirNxq.exe
  C:\Windows\System32\vmirNxq.exe
  2⤵
  PID:10324
- C:\Windows\System32\umDSijx.exe
  C:\Windows\System32\umDSijx.exe
  2⤵
  PID:10360
- C:\Windows\System32\RBafmiy.exe
  C:\Windows\System32\RBafmiy.exe
  2⤵
  PID:10412
- C:\Windows\System32\dJjcWUj.exe
  C:\Windows\System32\dJjcWUj.exe
  2⤵
  PID:10428
- C:\Windows\System32\RNIpxSU.exe
  C:\Windows\System32\RNIpxSU.exe
  2⤵
  PID:10448
- C:\Windows\System32\cmAQfpP.exe
  C:\Windows\System32\cmAQfpP.exe
  2⤵
  PID:10496
- C:\Windows\System32\rWDHLuK.exe
  C:\Windows\System32\rWDHLuK.exe
  2⤵
  PID:10516
- C:\Windows\System32\YqhJIUS.exe
  C:\Windows\System32\YqhJIUS.exe
  2⤵
  PID:10540
- C:\Windows\System32\qRVXeGE.exe
  C:\Windows\System32\qRVXeGE.exe
  2⤵
  PID:10568
- C:\Windows\System32\CSJYNbI.exe
  C:\Windows\System32\CSJYNbI.exe
  2⤵
  PID:10632
- C:\Windows\System32\lLGEYpk.exe
  C:\Windows\System32\lLGEYpk.exe
  2⤵
  PID:10648
- C:\Windows\System32\BMXyIeA.exe
  C:\Windows\System32\BMXyIeA.exe
  2⤵
  PID:10664
- C:\Windows\System32\PTROmNL.exe
  C:\Windows\System32\PTROmNL.exe
  2⤵
  PID:10692
- C:\Windows\System32\ADkZOgf.exe
  C:\Windows\System32\ADkZOgf.exe
  2⤵
  PID:10712
- C:\Windows\System32\NSktwuC.exe
  C:\Windows\System32\NSktwuC.exe
  2⤵
  PID:10728
- C:\Windows\System32\XfFOSXd.exe
  C:\Windows\System32\XfFOSXd.exe
  2⤵
  PID:10756
- C:\Windows\System32\NByRDfB.exe
  C:\Windows\System32\NByRDfB.exe
  2⤵
  PID:10780
- C:\Windows\System32\IsnZuAe.exe
  C:\Windows\System32\IsnZuAe.exe
  2⤵
  PID:10800
- C:\Windows\System32\tspGFqB.exe
  C:\Windows\System32\tspGFqB.exe
  2⤵
  PID:10824
- C:\Windows\System32\PtjGejz.exe
  C:\Windows\System32\PtjGejz.exe
  2⤵
  PID:10880
- C:\Windows\System32\GBTnetN.exe
  C:\Windows\System32\GBTnetN.exe
  2⤵
  PID:10904
- C:\Windows\System32\yzYKTcB.exe
  C:\Windows\System32\yzYKTcB.exe
  2⤵
  PID:10960
- C:\Windows\System32\LooQJCp.exe
  C:\Windows\System32\LooQJCp.exe
  2⤵
  PID:10980
- C:\Windows\System32\rRIxFoV.exe
  C:\Windows\System32\rRIxFoV.exe
  2⤵
  PID:11000
- C:\Windows\System32\WwISWYD.exe
  C:\Windows\System32\WwISWYD.exe
  2⤵
  PID:11020
- C:\Windows\System32\JFqRGKC.exe
  C:\Windows\System32\JFqRGKC.exe
  2⤵
  PID:11044
- C:\Windows\System32\qvCzzxN.exe
  C:\Windows\System32\qvCzzxN.exe
  2⤵
  PID:11064
- C:\Windows\System32\KegmFzN.exe
  C:\Windows\System32\KegmFzN.exe
  2⤵
  PID:11080
- C:\Windows\System32\NxoRSSz.exe
  C:\Windows\System32\NxoRSSz.exe
  2⤵
  PID:11104
- C:\Windows\System32\PhYcCto.exe
  C:\Windows\System32\PhYcCto.exe
  2⤵
  PID:11148
- C:\Windows\System32\NmkwaEh.exe
  C:\Windows\System32\NmkwaEh.exe
  2⤵
  PID:11164
- C:\Windows\System32\FwrAxCJ.exe
  C:\Windows\System32\FwrAxCJ.exe
  2⤵
  PID:11192
- C:\Windows\System32\MEdPXzp.exe
  C:\Windows\System32\MEdPXzp.exe
  2⤵
  PID:9844
- C:\Windows\System32\ddQBDNG.exe
  C:\Windows\System32\ddQBDNG.exe
  2⤵
  PID:10288
- C:\Windows\System32\oPySKiz.exe
  C:\Windows\System32\oPySKiz.exe
  2⤵
  PID:10352
- C:\Windows\System32\mCyRNue.exe
  C:\Windows\System32\mCyRNue.exe
  2⤵
  PID:10396
- C:\Windows\System32\eEpsNpY.exe
  C:\Windows\System32\eEpsNpY.exe
  2⤵
  PID:10476
- C:\Windows\System32\AdmOrYd.exe
  C:\Windows\System32\AdmOrYd.exe
  2⤵
  PID:10484
- C:\Windows\System32\NnACXyo.exe
  C:\Windows\System32\NnACXyo.exe
  2⤵
  PID:10556
- C:\Windows\System32\PzHCrmO.exe
  C:\Windows\System32\PzHCrmO.exe
  2⤵
  PID:10660
- C:\Windows\System32\lwDZyyK.exe
  C:\Windows\System32\lwDZyyK.exe
  2⤵
  PID:10736
- C:\Windows\System32\aoFvcWm.exe
  C:\Windows\System32\aoFvcWm.exe
  2⤵
  PID:10792
- C:\Windows\System32\xyaFPZu.exe
  C:\Windows\System32\xyaFPZu.exe
  2⤵
  PID:10844
- C:\Windows\System32\XlVzYiq.exe
  C:\Windows\System32\XlVzYiq.exe
  2⤵
  PID:10924
- C:\Windows\System32\KSKRdkq.exe
  C:\Windows\System32\KSKRdkq.exe
  2⤵
  PID:11008
- C:\Windows\System32\yUAXYGv.exe
  C:\Windows\System32\yUAXYGv.exe
  2⤵
  PID:11056
- C:\Windows\System32\JMgejbX.exe
  C:\Windows\System32\JMgejbX.exe
  2⤵
  PID:11132
- C:\Windows\System32\xWLfgXI.exe
  C:\Windows\System32\xWLfgXI.exe
  2⤵
  PID:11172
- C:\Windows\System32\zUgOtwE.exe
  C:\Windows\System32\zUgOtwE.exe
  2⤵
  PID:11248
- C:\Windows\System32\HmoSGwU.exe
  C:\Windows\System32\HmoSGwU.exe
  2⤵
  PID:10320
- C:\Windows\System32\JJCUmov.exe
  C:\Windows\System32\JJCUmov.exe
  2⤵
  PID:10392
- C:\Windows\System32\yDliHlX.exe
  C:\Windows\System32\yDliHlX.exe
  2⤵
  PID:5032
- C:\Windows\System32\LQixdLa.exe
  C:\Windows\System32\LQixdLa.exe
  2⤵
  PID:952
- C:\Windows\System32\TflxLOb.exe
  C:\Windows\System32\TflxLOb.exe
  2⤵
  PID:10892
- C:\Windows\System32\qUxbKqq.exe
  C:\Windows\System32\qUxbKqq.exe
  2⤵
  PID:10972
- C:\Windows\System32\ztxcnvS.exe
  C:\Windows\System32\ztxcnvS.exe
  2⤵
  PID:11012
- C:\Windows\System32\swSugon.exe
  C:\Windows\System32\swSugon.exe
  2⤵
  PID:9304
- C:\Windows\System32\JhcDsLb.exe
  C:\Windows\System32\JhcDsLb.exe
  2⤵
  PID:4812
- C:\Windows\System32\tlgaoTD.exe
  C:\Windows\System32\tlgaoTD.exe
  2⤵
  PID:10764
- C:\Windows\System32\UZbIkqF.exe
  C:\Windows\System32\UZbIkqF.exe
  2⤵
  PID:11136
- C:\Windows\System32\ETZuBKj.exe
  C:\Windows\System32\ETZuBKj.exe
  2⤵
  PID:10248
- C:\Windows\System32\CJrlJpk.exe
  C:\Windows\System32\CJrlJpk.exe
  2⤵
  PID:10440
- C:\Windows\System32\qEOaZQR.exe
  C:\Windows\System32\qEOaZQR.exe
  2⤵
  PID:10900
- C:\Windows\System32\jpkQyoA.exe
  C:\Windows\System32\jpkQyoA.exe
  2⤵
  PID:11272
- C:\Windows\System32\rVmOywN.exe
  C:\Windows\System32\rVmOywN.exe
  2⤵
  PID:11308
- C:\Windows\System32\lLiUbjZ.exe
  C:\Windows\System32\lLiUbjZ.exe
  2⤵
  PID:11332
- C:\Windows\System32\cvytPxa.exe
  C:\Windows\System32\cvytPxa.exe
  2⤵
  PID:11360
- C:\Windows\System32\jVHeeLF.exe
  C:\Windows\System32\jVHeeLF.exe
  2⤵
  PID:11388
- C:\Windows\System32\sVxmsqO.exe
  C:\Windows\System32\sVxmsqO.exe
  2⤵
  PID:11404
- C:\Windows\System32\LXagpmj.exe
  C:\Windows\System32\LXagpmj.exe
  2⤵
  PID:11420
- C:\Windows\System32\UxeUInJ.exe
  C:\Windows\System32\UxeUInJ.exe
  2⤵
  PID:11440
- C:\Windows\System32\nRPGTxL.exe
  C:\Windows\System32\nRPGTxL.exe
  2⤵
  PID:11460
- C:\Windows\System32\YmujtyY.exe
  C:\Windows\System32\YmujtyY.exe
  2⤵
  PID:11508
- C:\Windows\System32\ukPjOqM.exe
  C:\Windows\System32\ukPjOqM.exe
  2⤵
  PID:11552
- C:\Windows\System32\FuEpFwi.exe
  C:\Windows\System32\FuEpFwi.exe
  2⤵
  PID:11584
- C:\Windows\System32\sjQDVIb.exe
  C:\Windows\System32\sjQDVIb.exe
  2⤵
  PID:11604
- C:\Windows\System32\uQbQgdU.exe
  C:\Windows\System32\uQbQgdU.exe
  2⤵
  PID:11628
- C:\Windows\System32\oRmMYpo.exe
  C:\Windows\System32\oRmMYpo.exe
  2⤵
  PID:11648
- C:\Windows\System32\vyXQRZR.exe
  C:\Windows\System32\vyXQRZR.exe
  2⤵
  PID:11664
- C:\Windows\System32\xeeAbLG.exe
  C:\Windows\System32\xeeAbLG.exe
  2⤵
  PID:11688
- C:\Windows\System32\iztQruI.exe
  C:\Windows\System32\iztQruI.exe
  2⤵
  PID:11716
- C:\Windows\System32\OdERcAy.exe
  C:\Windows\System32\OdERcAy.exe
  2⤵
  PID:11732
- C:\Windows\System32\FbUDdbq.exe
  C:\Windows\System32\FbUDdbq.exe
  2⤵
  PID:11796
- C:\Windows\System32\rGfXzUU.exe
  C:\Windows\System32\rGfXzUU.exe
  2⤵
  PID:11852
- C:\Windows\System32\fwnvmhT.exe
  C:\Windows\System32\fwnvmhT.exe
  2⤵
  PID:11868
- C:\Windows\System32\NuZGHpG.exe
  C:\Windows\System32\NuZGHpG.exe
  2⤵
  PID:11896
- C:\Windows\System32\JTTffLZ.exe
  C:\Windows\System32\JTTffLZ.exe
  2⤵
  PID:11920
- C:\Windows\System32\tseQVNG.exe
  C:\Windows\System32\tseQVNG.exe
  2⤵
  PID:11940
- C:\Windows\System32\JhZvkRC.exe
  C:\Windows\System32\JhZvkRC.exe
  2⤵
  PID:11960
- C:\Windows\System32\BHyTtSC.exe
  C:\Windows\System32\BHyTtSC.exe
  2⤵
  PID:11996
- C:\Windows\System32\CrqafFg.exe
  C:\Windows\System32\CrqafFg.exe
  2⤵
  PID:12012
- C:\Windows\System32\WWIwWxG.exe
  C:\Windows\System32\WWIwWxG.exe
  2⤵
  PID:12040
- C:\Windows\System32\HKbUpOn.exe
  C:\Windows\System32\HKbUpOn.exe
  2⤵
  PID:12060
- C:\Windows\System32\gHyxAuT.exe
  C:\Windows\System32\gHyxAuT.exe
  2⤵
  PID:12084
- C:\Windows\System32\CkNgGnh.exe
  C:\Windows\System32\CkNgGnh.exe
  2⤵
  PID:12124
- C:\Windows\System32\dKgHudx.exe
  C:\Windows\System32\dKgHudx.exe
  2⤵
  PID:12176
- C:\Windows\System32\WLkEQQc.exe
  C:\Windows\System32\WLkEQQc.exe
  2⤵
  PID:12204
- C:\Windows\System32\DLkXoDT.exe
  C:\Windows\System32\DLkXoDT.exe
  2⤵
  PID:12232
- C:\Windows\System32\OpGQQXw.exe
  C:\Windows\System32\OpGQQXw.exe
  2⤵
  PID:12260
- C:\Windows\System32\jmFKpzU.exe
  C:\Windows\System32\jmFKpzU.exe
  2⤵
  PID:12280
- C:\Windows\System32\LIUmTKC.exe
  C:\Windows\System32\LIUmTKC.exe
  2⤵
  PID:336
- C:\Windows\System32\tuvkgXR.exe
  C:\Windows\System32\tuvkgXR.exe
  2⤵
  PID:11280
- C:\Windows\System32\uEtMDut.exe
  C:\Windows\System32\uEtMDut.exe
  2⤵
  PID:11380
- C:\Windows\System32\qEwkKRk.exe
  C:\Windows\System32\qEwkKRk.exe
  2⤵
  PID:11412
- C:\Windows\System32\bPttiGY.exe
  C:\Windows\System32\bPttiGY.exe
  2⤵
  PID:11488
- C:\Windows\System32\AFeAYFN.exe
  C:\Windows\System32\AFeAYFN.exe
  2⤵
  PID:11548
- C:\Windows\System32\CBmIDlk.exe
  C:\Windows\System32\CBmIDlk.exe
  2⤵
  PID:11672
- C:\Windows\System32\bXXVXHb.exe
  C:\Windows\System32\bXXVXHb.exe
  2⤵
  PID:11724
- C:\Windows\System32\NcAvMOs.exe
  C:\Windows\System32\NcAvMOs.exe
  2⤵
  PID:11752
- C:\Windows\System32\mEHDXXe.exe
  C:\Windows\System32\mEHDXXe.exe
  2⤵
  PID:11840
- C:\Windows\System32\twtwTUq.exe
  C:\Windows\System32\twtwTUq.exe
  2⤵
  PID:11880
- C:\Windows\System32\Exafgeh.exe
  C:\Windows\System32\Exafgeh.exe
  2⤵
  PID:11908
- C:\Windows\System32\qrdklJb.exe
  C:\Windows\System32\qrdklJb.exe
  2⤵
  PID:11952
- C:\Windows\System32\QcplASg.exe
  C:\Windows\System32\QcplASg.exe
  2⤵
  PID:12080
- C:\Windows\System32\MWlZrze.exe
  C:\Windows\System32\MWlZrze.exe
  2⤵
  PID:12192
- C:\Windows\System32\tlQtsMD.exe
  C:\Windows\System32\tlQtsMD.exe
  2⤵
  PID:12224
- C:\Windows\System32\OWdLvPO.exe
  C:\Windows\System32\OWdLvPO.exe
  2⤵
  PID:12268
- C:\Windows\System32\lSYoLMA.exe
  C:\Windows\System32\lSYoLMA.exe
  2⤵
  PID:1664
- C:\Windows\System32\hZIWWXB.exe
  C:\Windows\System32\hZIWWXB.exe
  2⤵
  PID:1716
- C:\Windows\System32\lJnjMHP.exe
  C:\Windows\System32\lJnjMHP.exe
  2⤵
  PID:3216
- C:\Windows\System32\kXYnkwk.exe
  C:\Windows\System32\kXYnkwk.exe
  2⤵
  PID:11528
- C:\Windows\System32\CnqmuTq.exe
  C:\Windows\System32\CnqmuTq.exe
  2⤵
  PID:11612
- C:\Windows\System32\adujiAd.exe
  C:\Windows\System32\adujiAd.exe
  2⤵
  PID:11808
- C:\Windows\System32\RHonrLt.exe
  C:\Windows\System32\RHonrLt.exe
  2⤵
  PID:1060
- C:\Windows\System32\OBzkZMM.exe
  C:\Windows\System32\OBzkZMM.exe
  2⤵
  PID:2008
- C:\Windows\System32\AxRvQSp.exe
  C:\Windows\System32\AxRvQSp.exe
  2⤵
  PID:12256
- C:\Windows\System32\NnlNkEl.exe
  C:\Windows\System32\NnlNkEl.exe
  2⤵
  PID:4280
- C:\Windows\System32\MaXUlzL.exe
  C:\Windows\System32\MaXUlzL.exe
  2⤵
  PID:11760
- C:\Windows\System32\kEkiWaf.exe
  C:\Windows\System32\kEkiWaf.exe
  2⤵
  PID:11864
- C:\Windows\System32\XbaqVvn.exe
  C:\Windows\System32\XbaqVvn.exe
  2⤵
  PID:4372
- C:\Windows\System32\yzTvFwE.exe
  C:\Windows\System32\yzTvFwE.exe
  2⤵
  PID:11988
- C:\Windows\System32\yddSCBj.exe
  C:\Windows\System32\yddSCBj.exe
  2⤵
  PID:12296
- C:\Windows\System32\XkOORwr.exe
  C:\Windows\System32\XkOORwr.exe
  2⤵
  PID:12320
- C:\Windows\System32\DIqlFaD.exe
  C:\Windows\System32\DIqlFaD.exe
  2⤵
  PID:12340
- C:\Windows\System32\fZUyias.exe
  C:\Windows\System32\fZUyias.exe
  2⤵
  PID:12368
- C:\Windows\System32\ZLkTXWW.exe
  C:\Windows\System32\ZLkTXWW.exe
  2⤵
  PID:12408
- C:\Windows\System32\bMOUmtt.exe
  C:\Windows\System32\bMOUmtt.exe
  2⤵
  PID:12440
- C:\Windows\System32\FxByklZ.exe
  C:\Windows\System32\FxByklZ.exe
  2⤵
  PID:12460
- C:\Windows\System32\ohaZsoX.exe
  C:\Windows\System32\ohaZsoX.exe
  2⤵
  PID:12480
- C:\Windows\System32\cAShaku.exe
  C:\Windows\System32\cAShaku.exe
  2⤵
  PID:12520
- C:\Windows\System32\NMcOzqH.exe
  C:\Windows\System32\NMcOzqH.exe
  2⤵
  PID:12568
- C:\Windows\System32\drLdpsm.exe
  C:\Windows\System32\drLdpsm.exe
  2⤵
  PID:12588
- C:\Windows\System32\RCTuJHM.exe
  C:\Windows\System32\RCTuJHM.exe
  2⤵
  PID:12612
- C:\Windows\System32\aojetae.exe
  C:\Windows\System32\aojetae.exe
  2⤵
  PID:12632
- C:\Windows\System32\vutNegw.exe
  C:\Windows\System32\vutNegw.exe
  2⤵
  PID:12660
- C:\Windows\System32\zZADrFv.exe
  C:\Windows\System32\zZADrFv.exe
  2⤵
  PID:12688
- C:\Windows\System32\EdTAzYy.exe
  C:\Windows\System32\EdTAzYy.exe
  2⤵
  PID:12732
- C:\Windows\System32\EQBJEIZ.exe
  C:\Windows\System32\EQBJEIZ.exe
  2⤵
  PID:12748
- C:\Windows\System32\UNAnulG.exe
  C:\Windows\System32\UNAnulG.exe
  2⤵
  PID:12772
- C:\Windows\System32\WbTfygL.exe
  C:\Windows\System32\WbTfygL.exe
  2⤵
  PID:12796
- C:\Windows\System32\Fvojova.exe
  C:\Windows\System32\Fvojova.exe
  2⤵
  PID:12840
- C:\Windows\System32\yZQOKPQ.exe
  C:\Windows\System32\yZQOKPQ.exe
  2⤵
  PID:12856
- C:\Windows\System32\xrvOhEc.exe
  C:\Windows\System32\xrvOhEc.exe
  2⤵
  PID:12876
- C:\Windows\System32\MgSgyOk.exe
  C:\Windows\System32\MgSgyOk.exe
  2⤵
  PID:12892
- C:\Windows\System32\oSuVLOi.exe
  C:\Windows\System32\oSuVLOi.exe
  2⤵
  PID:12952
- C:\Windows\System32\wfqHWCc.exe
  C:\Windows\System32\wfqHWCc.exe
  2⤵
  PID:12968
- C:\Windows\System32\oRVzqbS.exe
  C:\Windows\System32\oRVzqbS.exe
  2⤵
  PID:12988
- C:\Windows\System32\ahJbAOO.exe
  C:\Windows\System32\ahJbAOO.exe
  2⤵
  PID:13004
- C:\Windows\System32\soIupsR.exe
  C:\Windows\System32\soIupsR.exe
  2⤵
  PID:13040
- C:\Windows\System32\UDZgAwf.exe
  C:\Windows\System32\UDZgAwf.exe
  2⤵
  PID:13100
- C:\Windows\System32\CvhzjXq.exe
  C:\Windows\System32\CvhzjXq.exe
  2⤵
  PID:13128
- C:\Windows\System32\otINuuG.exe
  C:\Windows\System32\otINuuG.exe
  2⤵
  PID:13156
- C:\Windows\System32\EjjGjNn.exe
  C:\Windows\System32\EjjGjNn.exe
  2⤵
  PID:13184
- C:\Windows\System32\IzetpWJ.exe
  C:\Windows\System32\IzetpWJ.exe
  2⤵
  PID:13200
- C:\Windows\System32\TujcCPJ.exe
  C:\Windows\System32\TujcCPJ.exe
  2⤵
  PID:13252
- C:\Windows\System32\EcCMkkZ.exe
  C:\Windows\System32\EcCMkkZ.exe
  2⤵
  PID:13280
- C:\Windows\System32\FGHjpou.exe
  C:\Windows\System32\FGHjpou.exe
  2⤵
  PID:12244
- C:\Windows\System32\cfepbdk.exe
  C:\Windows\System32\cfepbdk.exe
  2⤵
  PID:12308
- C:\Windows\System32\DPBvlgP.exe
  C:\Windows\System32\DPBvlgP.exe
  2⤵
  PID:12352
- C:\Windows\System32\AUKJBFh.exe
  C:\Windows\System32\AUKJBFh.exe
  2⤵
  PID:12420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\ApOBsok.exe

Filesize
1.5MB

MD5
346c41e1d757b56394a186427c95a886

SHA1
9311aa61825ee945a6ec61b3f5a28c6c0a04d1b8

SHA256
4d2854358f2b06944d0a1e14773314f98174dbd4da42b09f892dd959eba65a6f

SHA512
5119be38a75258fe63002152e31531de7748c02c990472004be934493d01254e4044db4fcc9aa4ee5e3b3f5efaf4c38ae4c50e07f9d165e0aa42ed5b7036287b

Download Submit
C:\Windows\System32\BAdicvg.exe

Filesize
1.5MB

MD5
fa75c0ae5e0a9d83017d3e6b69ee312e

SHA1
e00d610f220d4f9e95a9861d895344a1b1bdb518

SHA256
376841dca4c1f33e3bf3fcb3968e0267e454d524c6d412e4c5551513092c6a26

SHA512
cd9962539742406da28091ea63a1efd1f601ad3b8e581251734cc53e117332b5c91a9875c18bd278b5ca32ee6a1eec3a49358364f01ef2444fec95cf5c4dfcf2

Download Submit
C:\Windows\System32\DKYUNTw.exe

Filesize
1.5MB

MD5
d9a767724ce4d3c776de408e0e955237

SHA1
1b1b55ef2317cdd35eee4411a316ae62efaad117

SHA256
d4021c38f78860958d0697ce144a50c49dc6a0f014bb30a2e26dec0f6963e36c

SHA512
a7cdbd2f210b3759052a6888e27b317b938d4deeccc76194dbd82a06d77ebc0cd1663a5db847774b798f06de6b65628e3c5ccaaf94e5ceb17fcdea54535300a3

Download Submit
C:\Windows\System32\EVRbjLw.exe

Filesize
1.5MB

MD5
e34f425141f43992ec5526b1319f132d

SHA1
6406f64bad21703fc907e011fcbfd2a7236cd248

SHA256
340941711f591c86ab0adb1244af11db26ca9e1cbdeae8c841a8791798c829ec

SHA512
65764fc7f01993c6ceefd62e87e8d115877fb1d2aae5914e8f060a333a186ab7ebdbe508bb6652369eef6cf05106888d6f8743f738d3ab9b4858643540c03358

Download Submit
C:\Windows\System32\FIVsRjI.exe

Filesize
1.5MB

MD5
306c10f881ffc0c3f999b21ba3e63ce0

SHA1
e1054f24c198c46e470b27be727f1e2bc95172c1

SHA256
231ba4816e027bb8d53eb477c44f0bbfa55227dc5856ec120190bb26542e001b

SHA512
9316ab64ea1a7c063be26c5ceb75f249b8cbd5a17820a24c628b8c32898a6b222fa1838fe1806ef026cbec42c47ad6207d62522c5d4edc083d290c6065ba3429

Download Submit
C:\Windows\System32\IFghIlr.exe

Filesize
1.5MB

MD5
563a612bd4c1f88304226d01f70f479b

SHA1
741d212c02247c5c349b4830b7400c602635aa58

SHA256
dfa619f58d85f2770401388ecb6302ca4ffe34153e68753de13891b44669b8b5

SHA512
83c0fdd152d035940db96fe6e8e7e073dc5306861012ab6d995950fa1e44eb46a093e7fa5992e022284d060f8689c781cd3ef210cb6d00fc69ec36e231ea014c

Download Submit
C:\Windows\System32\IbYdFSR.exe

Filesize
1.5MB

MD5
8f2d7b2cfb803a7e4fc0ca2966ee19b0

SHA1
9060fa9e4b2c9b1ec76381a8b23f86a22ebf5a8a

SHA256
928ce33274a021999016c66205753b75a929e58d970c1c7938e782246411f868

SHA512
6a254bb4d69ea6393af416d341614a4d276955e7e03b611113e2dd0e5efb549bb2b9e47e82573e1340281af0eef54f807682839c4192593811c2ddc6e2f45763

Download Submit
C:\Windows\System32\IbmRWBS.exe

Filesize
1.5MB

MD5
f2b31a2a09f09b8728bfd3fe9753a44c

SHA1
dfc944ae7d64b59ef1e1d95df2a89c71f3362dc4

SHA256
c00b499c37b02fcca4b02152fe59f0f4343f86dc840bd84f522283447b2671bf

SHA512
22b9c22dc4c42ec11f38f7e2a5ba145a902c4e6837218b8523434abddfa27a273872a843402bf7accf750274dde8dfa3601c661335ca0b33eda0ddb082ea51e7

Download Submit
C:\Windows\System32\JGayaAK.exe

Filesize
1.5MB

MD5
fa8cfd4cfa72f8dded04a7ac1d8050b1

SHA1
c7a72b4d5386f9df8e4cbc4421ff0517fabd91c9

SHA256
b26079664ad024ddca52909a342f71e7bd7d40845eefaf0fe69324138aecaa32

SHA512
cb594b7a74559e8cf0f03a7ac347d80f682ffb696b22e197d576c0dae9eb70c35748e21e9998f10ac3ebc75ed087ecdf859c88e24c881e3955409437176e0f6b

Download Submit
C:\Windows\System32\JHqTQOj.exe

Filesize
1.5MB

MD5
ed0a39fca351cb1172855969f9b075f0

SHA1
a7c29a07d8ae82cd41bd0ec52ae2438b165b4d80

SHA256
4d12fccbbd322557edbbf1ada6e48c43c716eb143303bc8e31e674fe7f2ebc13

SHA512
71b4f13a03c579437dd41e415ae4500bf9de990a874341f61b808a461f02911389c760095837b67401171654cd87b8220884861471d91851c25eebf9f273b211

Download Submit
C:\Windows\System32\OdGmIgh.exe

Filesize
1.5MB

MD5
42b4ec3be8f984695f88c44dd52939f6

SHA1
f9c3b0c05daa0f472fc1d230096bcc7ab5eae002

SHA256
15fa7f7adb5ada3ba305bba4cbbceeaa134b1f85ca38d4f7ce5fa9d2cd81f324

SHA512
fa445d04e09d9d85e6eb774ae22dc2e60429e87dca83f7980b9d767677e4b1b050f885e202c5cc0a1ee13126db3e4fea1211b9e104c873d5a965f45d50e4b35a

Download Submit
C:\Windows\System32\PvhbrDa.exe

Filesize
1.5MB

MD5
03f2af3d434b8ed881a8fbb43b62292d

SHA1
7edf5a295d505c6fc5d2525810526f13ccf06ab2

SHA256
c6c5698583b21f69d50fdcbd5d43c750c006f098c2d11f201a0e7a63b99a217e

SHA512
ee8b85cd55d066a58057792c082a80ce252bc51594b20fd766e2d129277fd9e8a5ea577dfdfc384061af717c3be8315a837d375138d771b1d68c2102f11eccac

Download Submit
C:\Windows\System32\RuBvXAn.exe

Filesize
1.5MB

MD5
556d03062eaffb0c866ebacb0467ea8a

SHA1
ea3372febe1e8292e2a23ca68454b54bc799b683

SHA256
500cbe24aeaddbc9824ce34833b623243b11ccda475abf7839f6646cfd382300

SHA512
773619bb693feb0fe144ae6b7fac5d742619908d67d488c7c52a716531248579e20aba163a67f93ce540db9de8403dbe7c7d8e099bd3d9d5ba01b5a6b959c159

Download Submit
C:\Windows\System32\SgeDDxL.exe

Filesize
1.5MB

MD5
757e549dd9dbcb765c4a4ea6dc3df5a2

SHA1
1115cdb019e001e56c2023a92deb1e2b2593a039

SHA256
b820182073650c09573633acf1a41f87a98bbf4bdf0ec41a865e6a2f69e0377c

SHA512
ba696e085dc920541a4a1b7588f62ba973e11cabc09eeb766af50aed88cd2cf107e05eb90ce961310bb1301acaf382aff8a7dc22802702af07aa6a58c666ae82

Download Submit
C:\Windows\System32\SoXNQVn.exe

Filesize
1.5MB

MD5
ab9b88bbbeee6955254c16e6989bb192

SHA1
2daf4cf4aac770612045f729998c19193c5a64b1

SHA256
c1b1c29b9818996c430fa70ec4d1a9fd6721e158abe9f9662cf2c27070a1b52f

SHA512
52726bdca0e54aa85ec3a1da62d43a0446a49a80713072af6b96a54096add5f39bbccd03bb8dbc01b623a02efaf1f027645a3c2d25e8450be3b62c324e57f5c9

Download Submit
C:\Windows\System32\TBeXKfO.exe

Filesize
1.5MB

MD5
21de03c1d3a667bf45b4d808789a143b

SHA1
53cee590b28d3b3f4bee4268a36d1f2264e3deb4

SHA256
5c4eacb453edec34b75a71f5e1c9f2bb3ce6d70a26fa2c809473f766c10f759a

SHA512
04847f4d47dae9adecf8b21dc38cf46b60ce15bd9a02e44bce2dfc970de98b7954e476dba806b32672b78949f778e73fa9887d36d9323bbe0b12d51558e94a32

Download Submit
C:\Windows\System32\aBMogpu.exe

Filesize
1.5MB

MD5
5c68be244343a871d90513dc9cc27eae

SHA1
0f6c6e4f4559d446fce5bcd7938deb241560da71

SHA256
b4bf19dadcaab8da1c2586d022c9faf0b24bad072c8f06dc94dfa2f4beeab57d

SHA512
9ee6878f46a92bdb2eabba44dc6f1163a0b24cebb707f8a26cb10dd9bd58848b3bcd744670bf5f325276a3f0ee8500b2f7c4b01fd3e3bdaaa13331cc77f76778

Download Submit
C:\Windows\System32\aXbxZdL.exe

Filesize
1.5MB

MD5
bbabd4cf27f41eaf2c9a77b7f1441af0

SHA1
2fc66bb24886f466f80569923e4209bea5269e02

SHA256
832088fead86e486e5becd33db6b6d5116dd2b1799bade04c621c957f75924f7

SHA512
bde342785ade789e738a92d957b6389d0506bc866e1df11bb3677f17fcd3a9b677829e265d1c7cec0efc22b32410bfa7c58f6f4d1b8ced163d08c6b0f9a1b6ae

Download Submit
C:\Windows\System32\cgICDHc.exe

Filesize
1.5MB

MD5
8ccea9c3932b198a193ed74450a12e78

SHA1
d589877978dbacf658f50439a2b825ba13432b91

SHA256
05b23709dd773dbdffc5ce2a46c7e30c58b7291e62f997bdeb0d9fde68198f5f

SHA512
18fe9dcb40441a7f4da8e7a0e4852a47698e070a0f197d5fe9a1554f37dfd14d26fa5ab3813d0ec0b7253cb5a033bf7aba9c6376222dd8ed190a74d44e3d25ad

Download Submit
C:\Windows\System32\endioUh.exe

Filesize
1.5MB

MD5
c53df4dc8d08a7f3504d2bb9aa2e6e7c

SHA1
8d96688ada032d7ee3b1d62676cc4f083ceddbb9

SHA256
93938c04e2738476732f2ac353d11d94239d2d8a0c94535be35e9809ae24c9a7

SHA512
403cf08896924eb6f2a8838be356f35f217057f1acf9502bd265ad001fbee685001d9aedd98631c6719deae1f7034b77f6954c80dae2eaed80b6283e825beaba

Download Submit
C:\Windows\System32\eovrGbZ.exe

Filesize
1.5MB

MD5
5ff037c49c1872601010582f8247bb04

SHA1
dba0837909e3e0f4e857880d73d0a2a2d5a9b9e1

SHA256
19a14c629ab22b56cd59197260738848cedf0665ae06e1f43fa80d288e03ec45

SHA512
0f19fcb1b41446c7eff6db7b09bd16694493b9800ae1bee14eedb682bada241e8829bbdf2e0ac5daed6e21b98c7633051ce9761615c8d4a53835c80ccb599919

Download Submit
C:\Windows\System32\fUGOsZf.exe

Filesize
1.5MB

MD5
d996e44cded4f404ad366ae6bfebd2ac

SHA1
0852e07064fed1d7e1b5233a4d22fd3a4d822567

SHA256
54b9ad42579f8e6b3d240e1a2289971310266b04504c4dc7f6a7b80b91913d0e

SHA512
5c2346ff21c24407197b424b717810d4e077943f5d7e0bdfd7ab84d925d0cf2f903a4b48cd7ecd1f5831a9bd29b9828a66a4f9e8b1935e5294418c5f906295b5

Download Submit
C:\Windows\System32\jYZYRru.exe

Filesize
1.5MB

MD5
efa57eed511da62e206ed4eb22ba3655

SHA1
53490c6d63d474483c8779eb7de8afb47a7e47f2

SHA256
3e0b9b85ad8e09bf1b37bf88db0ca25806929d38855fef518ac5d6034f346c41

SHA512
10569be904834a66be1e9152bb9ed40a7058fd5aed8834116921e517c236f2ee1fc79c50a11719ba47393d7c18f7c44a869a7dacccd519aa6a5ba411ac2de59e

Download Submit
C:\Windows\System32\kARLSbC.exe

Filesize
1.5MB

MD5
012c66b4e75895dc99c0d1fa8819c7ac

SHA1
4fa444abf783e6bb61d0545c3e6b080f0fd6203b

SHA256
bc105734960b4be338639e105b4aadd3ffac65544a0ea069b674e343a53d87a6

SHA512
9d918e28bdeca079031f44cf55adf1ffc2226d9c9600f03b3204275c6e423cb1348a1473b81393c54812956c9ccdb8be166c5223b9a947e61e0766a3d94b3673

Download Submit
C:\Windows\System32\mRmjFLk.exe

Filesize
1.5MB

MD5
b61e1368c4d0d9be355ff0442741b53a

SHA1
58512eef98b1d394f5dbdc843ca5ad2787c1daab

SHA256
1490f4ff5fcbdf1d54e9723f803d3888f4ce0df5381f94688dea9f70f7c17515

SHA512
9e1713d46bc7bcb3dcb2b97ca9a562962c9d3d8cdf4deebfe75061ec4ded3b803b3b7518d01ed716a96b82639ed746618288df6fa103735d694303e0ace79e45

Download Submit
C:\Windows\System32\oHSkeov.exe

Filesize
1.5MB

MD5
46fe705e1fa270a9329a4c86fb7bfc12

SHA1
f10dc45d3e8a804a1e9ede3b25bbe373050ba1c5

SHA256
05ba40b5a22808ccfe17618b83e7413e5d15fb65c1d760837276c88090cfadad

SHA512
48cc8c7e2b8a10f621303970951a2d14634af6f7c1a8bb1f59d26c2b8278d4116f317356b1341a78823f979fafcfb3260f82986a987dd7b8c1022592ce0d2f0e

Download Submit
C:\Windows\System32\oWhiHHl.exe

Filesize
1.5MB

MD5
d50c91306a16c43263c0a9689d2b9260

SHA1
c1931d0ffa4052f69f3ef5c2121eb85841a7c720

SHA256
d35ea75f72303dfea8dca2b88eef0b93d8ccbf3a8a0b16834aee2f0ad1bc33c0

SHA512
230d1f5b1fca8dab607fb8863d714f7547b8471ba5b5877f727a6630ecf14a617d98ea37f5370cf6d7c8128e0df5d0b163fc2d14f488c654b83320207facc153

Download Submit
C:\Windows\System32\ojKmNCd.exe

Filesize
1.5MB

MD5
2b91ecfc5f2d7b14be86bf4b05f39798

SHA1
8af6e4db794d9f6b6ed3a37bc21fbce92e833f0e

SHA256
b73db1e41c24d5267a060ce51b10ccbf634177f0cf06ad1bbda1662dc7dc5cbe

SHA512
58d4a1a15488af7d6ab6afa21fad0a387613717cd28d857092f6979a242f67d1ccd2e4542694f5f092ddedff4430d3a4b42c294c1729b02838ec01bdbde692bf

Download Submit
C:\Windows\System32\pcDRmVm.exe

Filesize
1.5MB

MD5
3c13b5fea62e28dc6a3c69f90ec33856

SHA1
b364e94cce69004397756d1155124b477080d7de

SHA256
d12a45fdc7185fddd90b0babb0b5203fff720780a0152c79808ab2bfcf71b104

SHA512
0c6d2cea0f67d85bc4752c9ca29c5ddd20fcc8adff31383a7a9cd2811a3cb0f378569940f3b9ed0485220ab713e482070ce86bda9f3f3fc94d2fb9d499061446

Download Submit
C:\Windows\System32\qEjmRVU.exe

Filesize
1.5MB

MD5
d1a4008a727843c40c5311ba9ea7f227

SHA1
ecf441491f5ad11dd4895a31d5b7992fc12d7061

SHA256
28ceacbef8ed8f9d73d920362f0d7ef10b64cd1b1e6148a26818ab113b995385

SHA512
53d02241360c8637e7443a352118ad38c9fe48433dcf1866d52fbaca9c9be2f5dbb0b6ad2352f32e32a1a0ea57ce161bd9a8d2213457eb7dc0d88b1a923f4575

Download Submit
C:\Windows\System32\vdGrCzh.exe

Filesize
1.5MB

MD5
fd1c3a7da93f80e43745855652b7c68e

SHA1
6c71087a9274edef3f1c4476d1d28fc578418fbc

SHA256
db928466739280a5617596623f9c901ac48ecb81b94f80344ba37f47dac37c12

SHA512
875051e96cf921770f9ca6a030fa0b257759e9526cfc9bab8fc488df7ca7639d1edb2a1c4f3fbb4e6b1f7e88bf429fb013521459f1b31a892bc791fa72a2d149

Download Submit
C:\Windows\System32\ysdqaVR.exe

Filesize
1.5MB

MD5
85f5789c56c6a6cc740a0465e6c08cc7

SHA1
9b9e03662f71f5cb1606ecb6506f5fa3ff58d3bb

SHA256
aeec2be4f4a3382d0cda36945d2220409c61b455fdf0924e0eaccfc1f070e76f

SHA512
387eed357b8de9dc3bc64e8020b33f3cffbc99985351cbc5426bde9e5e7ffd2a91b8687b242cedb0189d53f4eef2cc6f799a5d41cc9923e0fd4a9192c50493ae

Download Submit
memory/444-461-0x00007FF672200000-0x00007FF6725F1000-memory.dmp

Filesize
3.9MB

Download
memory/444-2052-0x00007FF672200000-0x00007FF6725F1000-memory.dmp

Filesize
3.9MB

Download
memory/472-396-0x00007FF720300000-0x00007FF7206F1000-memory.dmp

Filesize
3.9MB

Download
memory/472-2013-0x00007FF720300000-0x00007FF7206F1000-memory.dmp

Filesize
3.9MB

Download
memory/1200-31-0x00007FF785C70000-0x00007FF786061000-memory.dmp

Filesize
3.9MB

Download
memory/1200-2009-0x00007FF785C70000-0x00007FF786061000-memory.dmp

Filesize
3.9MB

Download
memory/1480-421-0x00007FF6E6620000-0x00007FF6E6A11000-memory.dmp

Filesize
3.9MB

Download
memory/1480-2079-0x00007FF6E6620000-0x00007FF6E6A11000-memory.dmp

Filesize
3.9MB

Download
memory/1496-1-0x000001AD59D20000-0x000001AD59D30000-memory.dmp

Filesize
64KB

Download
memory/1496-0-0x00007FF770E50000-0x00007FF771241000-memory.dmp

Filesize
3.9MB

Download
memory/1608-2005-0x00007FF6B4B60000-0x00007FF6B4F51000-memory.dmp

Filesize
3.9MB

Download
memory/1608-14-0x00007FF6B4B60000-0x00007FF6B4F51000-memory.dmp

Filesize
3.9MB

Download
memory/1696-2074-0x00007FF6BF050000-0x00007FF6BF441000-memory.dmp

Filesize
3.9MB

Download
memory/1696-431-0x00007FF6BF050000-0x00007FF6BF441000-memory.dmp

Filesize
3.9MB

Download
memory/2240-2012-0x00007FF632C10000-0x00007FF633001000-memory.dmp

Filesize
3.9MB

Download
memory/2240-34-0x00007FF632C10000-0x00007FF633001000-memory.dmp

Filesize
3.9MB

Download
memory/2368-2064-0x00007FF704CE0000-0x00007FF7050D1000-memory.dmp

Filesize
3.9MB

Download
memory/2368-462-0x00007FF704CE0000-0x00007FF7050D1000-memory.dmp

Filesize
3.9MB

Download
memory/2564-2070-0x00007FF652850000-0x00007FF652C41000-memory.dmp

Filesize
3.9MB

Download
memory/2564-442-0x00007FF652850000-0x00007FF652C41000-memory.dmp

Filesize
3.9MB

Download
memory/2744-2076-0x00007FF67F320000-0x00007FF67F711000-memory.dmp

Filesize
3.9MB

Download
memory/2744-430-0x00007FF67F320000-0x00007FF67F711000-memory.dmp

Filesize
3.9MB

Download
memory/2804-2003-0x00007FF733CA0000-0x00007FF734091000-memory.dmp

Filesize
3.9MB

Download
memory/2804-1969-0x00007FF733CA0000-0x00007FF734091000-memory.dmp

Filesize
3.9MB

Download
memory/2804-13-0x00007FF733CA0000-0x00007FF734091000-memory.dmp

Filesize
3.9MB

Download
memory/2948-438-0x00007FF7C6870000-0x00007FF7C6C61000-memory.dmp

Filesize
3.9MB

Download
memory/2948-2072-0x00007FF7C6870000-0x00007FF7C6C61000-memory.dmp

Filesize
3.9MB

Download
memory/3148-424-0x00007FF73EC00000-0x00007FF73EFF1000-memory.dmp

Filesize
3.9MB

Download
memory/3148-2078-0x00007FF73EC00000-0x00007FF73EFF1000-memory.dmp

Filesize
3.9MB

Download
memory/3332-2045-0x00007FF625F90000-0x00007FF626381000-memory.dmp

Filesize
3.9MB

Download
memory/3332-397-0x00007FF625F90000-0x00007FF626381000-memory.dmp

Filesize
3.9MB

Download
memory/3544-457-0x00007FF6A0740000-0x00007FF6A0B31000-memory.dmp

Filesize
3.9MB

Download
memory/3544-2065-0x00007FF6A0740000-0x00007FF6A0B31000-memory.dmp

Filesize
3.9MB

Download
memory/3588-2054-0x00007FF643400000-0x00007FF6437F1000-memory.dmp

Filesize
3.9MB

Download
memory/3588-414-0x00007FF643400000-0x00007FF6437F1000-memory.dmp

Filesize
3.9MB

Download
memory/3920-400-0x00007FF735AF0000-0x00007FF735EE1000-memory.dmp

Filesize
3.9MB

Download
memory/3920-2060-0x00007FF735AF0000-0x00007FF735EE1000-memory.dmp

Filesize
3.9MB

Download
memory/4184-2056-0x00007FF64D9D0000-0x00007FF64DDC1000-memory.dmp

Filesize
3.9MB

Download
memory/4184-405-0x00007FF64D9D0000-0x00007FF64DDC1000-memory.dmp

Filesize
3.9MB

Download
memory/4312-398-0x00007FF7E5260000-0x00007FF7E5651000-memory.dmp

Filesize
3.9MB

Download
memory/4312-2046-0x00007FF7E5260000-0x00007FF7E5651000-memory.dmp

Filesize
3.9MB

Download
memory/4460-399-0x00007FF6E1A20000-0x00007FF6E1E11000-memory.dmp

Filesize
3.9MB

Download
memory/4460-2048-0x00007FF6E1A20000-0x00007FF6E1E11000-memory.dmp

Filesize
3.9MB

Download
memory/4776-2068-0x00007FF607C40000-0x00007FF608031000-memory.dmp

Filesize
3.9MB

Download
memory/4776-449-0x00007FF607C40000-0x00007FF608031000-memory.dmp

Filesize
3.9MB

Download
memory/4880-2040-0x00007FF7BDFF0000-0x00007FF7BE3E1000-memory.dmp

Filesize
3.9MB

Download
memory/4880-466-0x00007FF7BDFF0000-0x00007FF7BE3E1000-memory.dmp

Filesize
3.9MB

Download
memory/5004-25-0x00007FF749A10000-0x00007FF749E01000-memory.dmp

Filesize
3.9MB

Download
memory/5004-2007-0x00007FF749A10000-0x00007FF749E01000-memory.dmp

Filesize
3.9MB

Download
memory/5096-2058-0x00007FF7744F0000-0x00007FF7748E1000-memory.dmp

Filesize
3.9MB

Download
memory/5096-401-0x00007FF7744F0000-0x00007FF7748E1000-memory.dmp

Filesize
3.9MB

Download