xmrig | b8b54d62411eef2acb899b71c82ddfc6ec9395e01d108ac4a6cc5fcdecbb75de

Analysis

max time kernel
118s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 07:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
Size

1.5MB
MD5

1fe7e544dd351d7a5232dd37a3606df8
SHA1

7b9ef35f731f8ed6178e8116aa6ec2425c8e82c3
SHA256

b8b54d62411eef2acb899b71c82ddfc6ec9395e01d108ac4a6cc5fcdecbb75de
SHA512

f54c3a8260258c13d9520d2830691630a8b4d2bbb15b1c5e5e20da672ce151db859a3a60695c3f0fe119068ffa15d2fe35ab4b7e359eea785ccfb30589c598f5
SSDEEP

24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcquVoVbvVkNQeEVIuj8qBChqlkJn5RJ3v:knw9oUUEEDl37jcquVoVJ31CMr057

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/1236-297-0x00007FF6E7F60000-0x00007FF6E8351000-memory.dmp	xmrig
behavioral2/memory/3536-305-0x00007FF7C1450000-0x00007FF7C1841000-memory.dmp	xmrig
behavioral2/memory/1928-324-0x00007FF653B60000-0x00007FF653F51000-memory.dmp	xmrig
behavioral2/memory/60-335-0x00007FF72B7B0000-0x00007FF72BBA1000-memory.dmp	xmrig
behavioral2/memory/1396-349-0x00007FF69CBA0000-0x00007FF69CF91000-memory.dmp	xmrig
behavioral2/memory/3176-341-0x00007FF7F23C0000-0x00007FF7F27B1000-memory.dmp	xmrig
behavioral2/memory/3516-357-0x00007FF6D6970000-0x00007FF6D6D61000-memory.dmp	xmrig
behavioral2/memory/2284-354-0x00007FF638BC0000-0x00007FF638FB1000-memory.dmp	xmrig
behavioral2/memory/2820-325-0x00007FF64D9C0000-0x00007FF64DDB1000-memory.dmp	xmrig
behavioral2/memory/2144-316-0x00007FF789800000-0x00007FF789BF1000-memory.dmp	xmrig
behavioral2/memory/4416-291-0x00007FF645660000-0x00007FF645A51000-memory.dmp	xmrig
behavioral2/memory/5080-47-0x00007FF708B10000-0x00007FF708F01000-memory.dmp	xmrig
behavioral2/memory/3180-41-0x00007FF749540000-0x00007FF749931000-memory.dmp	xmrig
behavioral2/memory/3856-33-0x00007FF7BAA40000-0x00007FF7BAE31000-memory.dmp	xmrig
behavioral2/memory/1364-359-0x00007FF743A90000-0x00007FF743E81000-memory.dmp	xmrig
behavioral2/memory/4648-360-0x00007FF629A00000-0x00007FF629DF1000-memory.dmp	xmrig
behavioral2/memory/4872-361-0x00007FF7F4720000-0x00007FF7F4B11000-memory.dmp	xmrig
behavioral2/memory/3448-362-0x00007FF73EC30000-0x00007FF73F021000-memory.dmp	xmrig
behavioral2/memory/2212-363-0x00007FF679D90000-0x00007FF67A181000-memory.dmp	xmrig
behavioral2/memory/3260-1967-0x00007FF7C21E0000-0x00007FF7C25D1000-memory.dmp	xmrig
behavioral2/memory/4384-1968-0x00007FF694440000-0x00007FF694831000-memory.dmp	xmrig
behavioral2/memory/1264-1969-0x00007FF679200000-0x00007FF6795F1000-memory.dmp	xmrig
behavioral2/memory/5080-1971-0x00007FF708B10000-0x00007FF708F01000-memory.dmp	xmrig
behavioral2/memory/3484-2003-0x00007FF650270000-0x00007FF650661000-memory.dmp	xmrig
behavioral2/memory/4792-2010-0x00007FF6F16E0000-0x00007FF6F1AD1000-memory.dmp	xmrig
behavioral2/memory/3260-2012-0x00007FF7C21E0000-0x00007FF7C25D1000-memory.dmp	xmrig
behavioral2/memory/3856-2014-0x00007FF7BAA40000-0x00007FF7BAE31000-memory.dmp	xmrig
behavioral2/memory/3536-2032-0x00007FF7C1450000-0x00007FF7C1841000-memory.dmp	xmrig
behavioral2/memory/1928-2034-0x00007FF653B60000-0x00007FF653F51000-memory.dmp	xmrig
behavioral2/memory/2144-2031-0x00007FF789800000-0x00007FF789BF1000-memory.dmp	xmrig
behavioral2/memory/1236-2028-0x00007FF6E7F60000-0x00007FF6E8351000-memory.dmp	xmrig
behavioral2/memory/4384-2026-0x00007FF694440000-0x00007FF694831000-memory.dmp	xmrig
behavioral2/memory/1264-2023-0x00007FF679200000-0x00007FF6795F1000-memory.dmp	xmrig
behavioral2/memory/5080-2021-0x00007FF708B10000-0x00007FF708F01000-memory.dmp	xmrig
behavioral2/memory/4416-2017-0x00007FF645660000-0x00007FF645A51000-memory.dmp	xmrig
behavioral2/memory/3180-2025-0x00007FF749540000-0x00007FF749931000-memory.dmp	xmrig
behavioral2/memory/3484-2019-0x00007FF650270000-0x00007FF650661000-memory.dmp	xmrig
behavioral2/memory/2820-2038-0x00007FF64D9C0000-0x00007FF64DDB1000-memory.dmp	xmrig
behavioral2/memory/2284-2073-0x00007FF638BC0000-0x00007FF638FB1000-memory.dmp	xmrig
behavioral2/memory/3176-2067-0x00007FF7F23C0000-0x00007FF7F27B1000-memory.dmp	xmrig
behavioral2/memory/1364-2065-0x00007FF743A90000-0x00007FF743E81000-memory.dmp	xmrig
behavioral2/memory/2212-2063-0x00007FF679D90000-0x00007FF67A181000-memory.dmp	xmrig
behavioral2/memory/4872-2048-0x00007FF7F4720000-0x00007FF7F4B11000-memory.dmp	xmrig
behavioral2/memory/60-2045-0x00007FF72B7B0000-0x00007FF72BBA1000-memory.dmp	xmrig
behavioral2/memory/4648-2044-0x00007FF629A00000-0x00007FF629DF1000-memory.dmp	xmrig
behavioral2/memory/3516-2042-0x00007FF6D6970000-0x00007FF6D6D61000-memory.dmp	xmrig
behavioral2/memory/3448-2040-0x00007FF73EC30000-0x00007FF73F021000-memory.dmp	xmrig
behavioral2/memory/1396-2050-0x00007FF69CBA0000-0x00007FF69CF91000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4792	tbgCCuy.exe
3260	hWoqvgP.exe
3856	jsxHzao.exe
4384	eNjUeJB.exe
3180	YbhYwSm.exe
1264	tgfaUZO.exe
5080	PdxQUaZ.exe
3484	JyifRsy.exe
4416	vkxhLHo.exe
1236	xqPsSYV.exe
3536	FGOhkRp.exe
2144	JwiebTC.exe
1928	EOxOKhM.exe
2820	fjGhnyI.exe
60	KaAatuG.exe
3176	cDSHfuc.exe
1396	fwZmNnR.exe
2284	CmxoKXN.exe
3516	eqhMpHk.exe
1364	SusFDSS.exe
4648	xCzMHpM.exe
4872	xKhjsKZ.exe
3448	jpcGOaE.exe
2212	rnMOqpk.exe
4148	PZjvPQD.exe
2148	sDzKeSD.exe
4660	bDDluuf.exe
4908	bNmYssw.exe
4820	kXNANSI.exe
3864	BXvprBT.exe
4508	DhGwDjJ.exe
996	BUWaUmz.exe
3420	omYImos.exe
2552	WwkXNuD.exe
3240	LTHjklQ.exe
4124	NmyFbIY.exe
1664	CtQaLXD.exe
868	wcIjxXu.exe
1284	HIGLlOu.exe
2516	ZUzxbPY.exe
4776	NSvuXGz.exe
3780	iZIezDl.exe
4180	slRYOFS.exe
628	BwmwLTe.exe
4132	PuUYQnQ.exe
4996	pAdvfms.exe
4628	bGKiXWa.exe
4596	TbuFCkA.exe
4064	mTmlKIZ.exe
2960	RISoLpJ.exe
1656	ltSLyne.exe
2276	WnTlXqQ.exe
2744	sBvXcwN.exe
4388	MGENGXL.exe
2916	zOnpVhX.exe
2532	pwDLGkf.exe
220	MzCpOnK.exe
4732	ADXEUay.exe
224	yyLUdir.exe
2772	fZmDLox.exe
5056	ZCFuaFN.exe
1644	nelWRIy.exe
1460	IwKdTyy.exe
1876	hNPlRNQ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2444-0-0x00007FF690CB0000-0x00007FF6910A1000-memory.dmp	upx
behavioral2/files/0x000b000000023b79-7.dat	upx
behavioral2/memory/4792-11-0x00007FF6F16E0000-0x00007FF6F1AD1000-memory.dmp	upx
behavioral2/files/0x000a000000023b80-31.dat	upx
behavioral2/memory/1264-39-0x00007FF679200000-0x00007FF6795F1000-memory.dmp	upx
behavioral2/files/0x000a000000023b82-44.dat	upx
behavioral2/files/0x000a000000023b83-53.dat	upx
behavioral2/files/0x000a000000023b84-59.dat	upx
behavioral2/files/0x000a000000023b85-65.dat	upx
behavioral2/files/0x000a000000023b87-72.dat	upx
behavioral2/files/0x000a000000023b89-84.dat	upx
behavioral2/files/0x000a000000023b8a-89.dat	upx
behavioral2/files/0x000a000000023b8d-102.dat	upx
behavioral2/files/0x000a000000023b90-117.dat	upx
behavioral2/files/0x000a000000023b95-144.dat	upx
behavioral2/files/0x000a000000023b98-160.dat	upx
behavioral2/files/0x000a000000023b9a-170.dat	upx
behavioral2/memory/1236-297-0x00007FF6E7F60000-0x00007FF6E8351000-memory.dmp	upx
behavioral2/memory/3536-305-0x00007FF7C1450000-0x00007FF7C1841000-memory.dmp	upx
behavioral2/memory/1928-324-0x00007FF653B60000-0x00007FF653F51000-memory.dmp	upx
behavioral2/memory/60-335-0x00007FF72B7B0000-0x00007FF72BBA1000-memory.dmp	upx
behavioral2/memory/1396-349-0x00007FF69CBA0000-0x00007FF69CF91000-memory.dmp	upx
behavioral2/memory/3176-341-0x00007FF7F23C0000-0x00007FF7F27B1000-memory.dmp	upx
behavioral2/memory/3516-357-0x00007FF6D6970000-0x00007FF6D6D61000-memory.dmp	upx
behavioral2/memory/2284-354-0x00007FF638BC0000-0x00007FF638FB1000-memory.dmp	upx
behavioral2/memory/2820-325-0x00007FF64D9C0000-0x00007FF64DDB1000-memory.dmp	upx
behavioral2/memory/2144-316-0x00007FF789800000-0x00007FF789BF1000-memory.dmp	upx
behavioral2/memory/4416-291-0x00007FF645660000-0x00007FF645A51000-memory.dmp	upx
behavioral2/files/0x000a000000023b99-165.dat	upx
behavioral2/files/0x000a000000023b97-154.dat	upx
behavioral2/files/0x000a000000023b96-149.dat	upx
behavioral2/files/0x000a000000023b94-139.dat	upx
behavioral2/files/0x000a000000023b93-134.dat	upx
behavioral2/files/0x000a000000023b92-130.dat	upx
behavioral2/files/0x000a000000023b91-124.dat	upx
behavioral2/files/0x000a000000023b8f-114.dat	upx
behavioral2/files/0x000a000000023b8e-109.dat	upx
behavioral2/files/0x000a000000023b8c-99.dat	upx
behavioral2/files/0x000a000000023b8b-94.dat	upx
behavioral2/files/0x000a000000023b88-79.dat	upx
behavioral2/files/0x000a000000023b86-69.dat	upx
behavioral2/memory/3484-49-0x00007FF650270000-0x00007FF650661000-memory.dmp	upx
behavioral2/memory/5080-47-0x00007FF708B10000-0x00007FF708F01000-memory.dmp	upx
behavioral2/files/0x000a000000023b81-42.dat	upx
behavioral2/memory/3180-41-0x00007FF749540000-0x00007FF749931000-memory.dmp	upx
behavioral2/files/0x000a000000023b7f-36.dat	upx
behavioral2/memory/3856-33-0x00007FF7BAA40000-0x00007FF7BAE31000-memory.dmp	upx
behavioral2/memory/4384-27-0x00007FF694440000-0x00007FF694831000-memory.dmp	upx
behavioral2/files/0x000a000000023b7e-25.dat	upx
behavioral2/files/0x000a000000023b7d-21.dat	upx
behavioral2/memory/3260-20-0x00007FF7C21E0000-0x00007FF7C25D1000-memory.dmp	upx
behavioral2/files/0x000d000000023ae8-9.dat	upx
behavioral2/memory/1364-359-0x00007FF743A90000-0x00007FF743E81000-memory.dmp	upx
behavioral2/memory/4648-360-0x00007FF629A00000-0x00007FF629DF1000-memory.dmp	upx
behavioral2/memory/4872-361-0x00007FF7F4720000-0x00007FF7F4B11000-memory.dmp	upx
behavioral2/memory/3448-362-0x00007FF73EC30000-0x00007FF73F021000-memory.dmp	upx
behavioral2/memory/2212-363-0x00007FF679D90000-0x00007FF67A181000-memory.dmp	upx
behavioral2/memory/3260-1967-0x00007FF7C21E0000-0x00007FF7C25D1000-memory.dmp	upx
behavioral2/memory/4384-1968-0x00007FF694440000-0x00007FF694831000-memory.dmp	upx
behavioral2/memory/1264-1969-0x00007FF679200000-0x00007FF6795F1000-memory.dmp	upx
behavioral2/memory/5080-1971-0x00007FF708B10000-0x00007FF708F01000-memory.dmp	upx
behavioral2/memory/3484-2003-0x00007FF650270000-0x00007FF650661000-memory.dmp	upx
behavioral2/memory/4792-2010-0x00007FF6F16E0000-0x00007FF6F1AD1000-memory.dmp	upx
behavioral2/memory/3260-2012-0x00007FF7C21E0000-0x00007FF7C25D1000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\GtHOcgH.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\BAHJePG.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\ltSLyne.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\pwDLGkf.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\fAwFJxX.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\ClOTrHd.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\vUtoRgm.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\SSUxvch.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\nZdKqCu.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\nxrweTa.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\qEzbECp.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\poQWutQ.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\RBsiWVb.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\tmNCKnz.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\TDMMynJ.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\wVyWBig.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\qqXgUKs.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\sOvghuQ.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\RzTLMWm.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\XyKloQa.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\PhXpZKh.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\uQvGadI.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\iZIezDl.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\YqCrHsN.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\cldFDvw.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\eUAEBgI.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\UrSIYAN.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\oeNPaBS.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\ismhSCX.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\hWoqvgP.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\MGENGXL.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\smsxzEJ.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\iHSFbcO.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\iAEBErm.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\ZmMWimu.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\iXrfkUW.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\BXvprBT.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\HMnfmUt.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\SGKslHz.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\VvmvHBs.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\tCvqkqs.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\tscrTNP.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\RAjRukc.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\cBdRhqO.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\CcQpcTp.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\ZbUkVCc.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\KaAatuG.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\hNPlRNQ.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\jrPgnir.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\JXukJwX.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\NkspWSK.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\ssZLYDi.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\btZQVOR.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\cKWDOGG.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\QXmvMhF.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\CXfmlRK.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\ExbUbUO.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\iyTtmCr.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\crVqWjD.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\gLQkTMA.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\MLzQWJH.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\CFWBCNt.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\mwndePS.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
File created	C:\Windows\System32\DdupBvJ.exe	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 4792	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	84
PID 2444 wrote to memory of 4792	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	84
PID 2444 wrote to memory of 3260	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	85
PID 2444 wrote to memory of 3260	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	85
PID 2444 wrote to memory of 3856	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	86
PID 2444 wrote to memory of 3856	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	86
PID 2444 wrote to memory of 4384	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	87
PID 2444 wrote to memory of 4384	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	87
PID 2444 wrote to memory of 3180	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	88
PID 2444 wrote to memory of 3180	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	88
PID 2444 wrote to memory of 1264	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	89
PID 2444 wrote to memory of 1264	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	89
PID 2444 wrote to memory of 5080	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	90
PID 2444 wrote to memory of 5080	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	90
PID 2444 wrote to memory of 3484	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	91
PID 2444 wrote to memory of 3484	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	91
PID 2444 wrote to memory of 4416	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	92
PID 2444 wrote to memory of 4416	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	92
PID 2444 wrote to memory of 1236	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	93
PID 2444 wrote to memory of 1236	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	93
PID 2444 wrote to memory of 3536	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	94
PID 2444 wrote to memory of 3536	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	94
PID 2444 wrote to memory of 2144	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	95
PID 2444 wrote to memory of 2144	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	95
PID 2444 wrote to memory of 1928	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	96
PID 2444 wrote to memory of 1928	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	96
PID 2444 wrote to memory of 2820	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	97
PID 2444 wrote to memory of 2820	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	97
PID 2444 wrote to memory of 60	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	98
PID 2444 wrote to memory of 60	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	98
PID 2444 wrote to memory of 3176	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	99
PID 2444 wrote to memory of 3176	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	99
PID 2444 wrote to memory of 1396	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	100
PID 2444 wrote to memory of 1396	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	100
PID 2444 wrote to memory of 2284	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	101
PID 2444 wrote to memory of 2284	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	101
PID 2444 wrote to memory of 3516	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	102
PID 2444 wrote to memory of 3516	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	102
PID 2444 wrote to memory of 1364	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	103
PID 2444 wrote to memory of 1364	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	103
PID 2444 wrote to memory of 4648	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	104
PID 2444 wrote to memory of 4648	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	104
PID 2444 wrote to memory of 4872	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	105
PID 2444 wrote to memory of 4872	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	105
PID 2444 wrote to memory of 3448	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	106
PID 2444 wrote to memory of 3448	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	106
PID 2444 wrote to memory of 2212	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	107
PID 2444 wrote to memory of 2212	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	107
PID 2444 wrote to memory of 4148	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	108
PID 2444 wrote to memory of 4148	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	108
PID 2444 wrote to memory of 2148	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	109
PID 2444 wrote to memory of 2148	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	109
PID 2444 wrote to memory of 4660	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	110
PID 2444 wrote to memory of 4660	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	110
PID 2444 wrote to memory of 4908	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	111
PID 2444 wrote to memory of 4908	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	111
PID 2444 wrote to memory of 4820	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	112
PID 2444 wrote to memory of 4820	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	112
PID 2444 wrote to memory of 3864	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	113
PID 2444 wrote to memory of 3864	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	113
PID 2444 wrote to memory of 4508	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	114
PID 2444 wrote to memory of 4508	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	114
PID 2444 wrote to memory of 996	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	115
PID 2444 wrote to memory of 996	2444	1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1fe7e544dd351d7a5232dd37a3606df8_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\System32\tbgCCuy.exe
  C:\Windows\System32\tbgCCuy.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System32\hWoqvgP.exe
  C:\Windows\System32\hWoqvgP.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System32\jsxHzao.exe
  C:\Windows\System32\jsxHzao.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System32\eNjUeJB.exe
  C:\Windows\System32\eNjUeJB.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System32\YbhYwSm.exe
  C:\Windows\System32\YbhYwSm.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System32\tgfaUZO.exe
  C:\Windows\System32\tgfaUZO.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System32\PdxQUaZ.exe
  C:\Windows\System32\PdxQUaZ.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System32\JyifRsy.exe
  C:\Windows\System32\JyifRsy.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System32\vkxhLHo.exe
  C:\Windows\System32\vkxhLHo.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System32\xqPsSYV.exe
  C:\Windows\System32\xqPsSYV.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System32\FGOhkRp.exe
  C:\Windows\System32\FGOhkRp.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System32\JwiebTC.exe
  C:\Windows\System32\JwiebTC.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System32\EOxOKhM.exe
  C:\Windows\System32\EOxOKhM.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System32\fjGhnyI.exe
  C:\Windows\System32\fjGhnyI.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System32\KaAatuG.exe
  C:\Windows\System32\KaAatuG.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System32\cDSHfuc.exe
  C:\Windows\System32\cDSHfuc.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System32\fwZmNnR.exe
  C:\Windows\System32\fwZmNnR.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System32\CmxoKXN.exe
  C:\Windows\System32\CmxoKXN.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System32\eqhMpHk.exe
  C:\Windows\System32\eqhMpHk.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System32\SusFDSS.exe
  C:\Windows\System32\SusFDSS.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System32\xCzMHpM.exe
  C:\Windows\System32\xCzMHpM.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System32\xKhjsKZ.exe
  C:\Windows\System32\xKhjsKZ.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System32\jpcGOaE.exe
  C:\Windows\System32\jpcGOaE.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System32\rnMOqpk.exe
  C:\Windows\System32\rnMOqpk.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System32\PZjvPQD.exe
  C:\Windows\System32\PZjvPQD.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System32\sDzKeSD.exe
  C:\Windows\System32\sDzKeSD.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System32\bDDluuf.exe
  C:\Windows\System32\bDDluuf.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System32\bNmYssw.exe
  C:\Windows\System32\bNmYssw.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System32\kXNANSI.exe
  C:\Windows\System32\kXNANSI.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System32\BXvprBT.exe
  C:\Windows\System32\BXvprBT.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System32\DhGwDjJ.exe
  C:\Windows\System32\DhGwDjJ.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System32\BUWaUmz.exe
  C:\Windows\System32\BUWaUmz.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System32\omYImos.exe
  C:\Windows\System32\omYImos.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System32\WwkXNuD.exe
  C:\Windows\System32\WwkXNuD.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System32\LTHjklQ.exe
  C:\Windows\System32\LTHjklQ.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System32\NmyFbIY.exe
  C:\Windows\System32\NmyFbIY.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System32\CtQaLXD.exe
  C:\Windows\System32\CtQaLXD.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System32\wcIjxXu.exe
  C:\Windows\System32\wcIjxXu.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System32\HIGLlOu.exe
  C:\Windows\System32\HIGLlOu.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System32\ZUzxbPY.exe
  C:\Windows\System32\ZUzxbPY.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System32\NSvuXGz.exe
  C:\Windows\System32\NSvuXGz.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System32\iZIezDl.exe
  C:\Windows\System32\iZIezDl.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System32\slRYOFS.exe
  C:\Windows\System32\slRYOFS.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System32\BwmwLTe.exe
  C:\Windows\System32\BwmwLTe.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System32\PuUYQnQ.exe
  C:\Windows\System32\PuUYQnQ.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System32\pAdvfms.exe
  C:\Windows\System32\pAdvfms.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System32\bGKiXWa.exe
  C:\Windows\System32\bGKiXWa.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System32\TbuFCkA.exe
  C:\Windows\System32\TbuFCkA.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System32\mTmlKIZ.exe
  C:\Windows\System32\mTmlKIZ.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System32\RISoLpJ.exe
  C:\Windows\System32\RISoLpJ.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System32\ltSLyne.exe
  C:\Windows\System32\ltSLyne.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System32\WnTlXqQ.exe
  C:\Windows\System32\WnTlXqQ.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System32\sBvXcwN.exe
  C:\Windows\System32\sBvXcwN.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System32\MGENGXL.exe
  C:\Windows\System32\MGENGXL.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System32\zOnpVhX.exe
  C:\Windows\System32\zOnpVhX.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System32\pwDLGkf.exe
  C:\Windows\System32\pwDLGkf.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System32\MzCpOnK.exe
  C:\Windows\System32\MzCpOnK.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System32\ADXEUay.exe
  C:\Windows\System32\ADXEUay.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System32\yyLUdir.exe
  C:\Windows\System32\yyLUdir.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System32\fZmDLox.exe
  C:\Windows\System32\fZmDLox.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System32\ZCFuaFN.exe
  C:\Windows\System32\ZCFuaFN.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System32\nelWRIy.exe
  C:\Windows\System32\nelWRIy.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System32\IwKdTyy.exe
  C:\Windows\System32\IwKdTyy.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System32\hNPlRNQ.exe
  C:\Windows\System32\hNPlRNQ.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System32\NkspWSK.exe
  C:\Windows\System32\NkspWSK.exe
  2⤵
  PID:2468
- C:\Windows\System32\PiTiesB.exe
  C:\Windows\System32\PiTiesB.exe
  2⤵
  PID:3832
- C:\Windows\System32\DutqAtm.exe
  C:\Windows\System32\DutqAtm.exe
  2⤵
  PID:3524
- C:\Windows\System32\mfYhwmk.exe
  C:\Windows\System32\mfYhwmk.exe
  2⤵
  PID:4480
- C:\Windows\System32\YqCrHsN.exe
  C:\Windows\System32\YqCrHsN.exe
  2⤵
  PID:4844
- C:\Windows\System32\YMiiSMj.exe
  C:\Windows\System32\YMiiSMj.exe
  2⤵
  PID:3024
- C:\Windows\System32\wOfhdFC.exe
  C:\Windows\System32\wOfhdFC.exe
  2⤵
  PID:4912
- C:\Windows\System32\EIygIVS.exe
  C:\Windows\System32\EIygIVS.exe
  2⤵
  PID:4876
- C:\Windows\System32\WpYfbeX.exe
  C:\Windows\System32\WpYfbeX.exe
  2⤵
  PID:4716
- C:\Windows\System32\PhFpHMp.exe
  C:\Windows\System32\PhFpHMp.exe
  2⤵
  PID:4068
- C:\Windows\System32\FgsCGhl.exe
  C:\Windows\System32\FgsCGhl.exe
  2⤵
  PID:428
- C:\Windows\System32\rPiwlWu.exe
  C:\Windows\System32\rPiwlWu.exe
  2⤵
  PID:3108
- C:\Windows\System32\XRvWxTH.exe
  C:\Windows\System32\XRvWxTH.exe
  2⤵
  PID:3388
- C:\Windows\System32\UFPbMDm.exe
  C:\Windows\System32\UFPbMDm.exe
  2⤵
  PID:4260
- C:\Windows\System32\YwnUEPU.exe
  C:\Windows\System32\YwnUEPU.exe
  2⤵
  PID:2176
- C:\Windows\System32\kMjgxis.exe
  C:\Windows\System32\kMjgxis.exe
  2⤵
  PID:1092
- C:\Windows\System32\ymXoiYP.exe
  C:\Windows\System32\ymXoiYP.exe
  2⤵
  PID:3512
- C:\Windows\System32\JYRZZFD.exe
  C:\Windows\System32\JYRZZFD.exe
  2⤵
  PID:1668
- C:\Windows\System32\uGNozat.exe
  C:\Windows\System32\uGNozat.exe
  2⤵
  PID:3912
- C:\Windows\System32\uyqRpLo.exe
  C:\Windows\System32\uyqRpLo.exe
  2⤵
  PID:4956
- C:\Windows\System32\xYkXQsF.exe
  C:\Windows\System32\xYkXQsF.exe
  2⤵
  PID:324
- C:\Windows\System32\jrPgnir.exe
  C:\Windows\System32\jrPgnir.exe
  2⤵
  PID:4448
- C:\Windows\System32\PLRrRcw.exe
  C:\Windows\System32\PLRrRcw.exe
  2⤵
  PID:3708
- C:\Windows\System32\jmSPAHQ.exe
  C:\Windows\System32\jmSPAHQ.exe
  2⤵
  PID:4552
- C:\Windows\System32\aDqlppU.exe
  C:\Windows\System32\aDqlppU.exe
  2⤵
  PID:3052
- C:\Windows\System32\AtWwQts.exe
  C:\Windows\System32\AtWwQts.exe
  2⤵
  PID:544
- C:\Windows\System32\ebonQkD.exe
  C:\Windows\System32\ebonQkD.exe
  2⤵
  PID:3992
- C:\Windows\System32\BhJqsVP.exe
  C:\Windows\System32\BhJqsVP.exe
  2⤵
  PID:4392
- C:\Windows\System32\kWcVQaK.exe
  C:\Windows\System32\kWcVQaK.exe
  2⤵
  PID:2860
- C:\Windows\System32\KXocSJv.exe
  C:\Windows\System32\KXocSJv.exe
  2⤵
  PID:4704
- C:\Windows\System32\DjshjlY.exe
  C:\Windows\System32\DjshjlY.exe
  2⤵
  PID:2436
- C:\Windows\System32\JlnqMfm.exe
  C:\Windows\System32\JlnqMfm.exe
  2⤵
  PID:4980
- C:\Windows\System32\sqLhKMp.exe
  C:\Windows\System32\sqLhKMp.exe
  2⤵
  PID:3136
- C:\Windows\System32\ogPttbr.exe
  C:\Windows\System32\ogPttbr.exe
  2⤵
  PID:4892
- C:\Windows\System32\XoQorVU.exe
  C:\Windows\System32\XoQorVU.exe
  2⤵
  PID:2244
- C:\Windows\System32\MLzQWJH.exe
  C:\Windows\System32\MLzQWJH.exe
  2⤵
  PID:4084
- C:\Windows\System32\lxwCREt.exe
  C:\Windows\System32\lxwCREt.exe
  2⤵
  PID:5148
- C:\Windows\System32\OHzRfaj.exe
  C:\Windows\System32\OHzRfaj.exe
  2⤵
  PID:5172
- C:\Windows\System32\duZsoEm.exe
  C:\Windows\System32\duZsoEm.exe
  2⤵
  PID:5196
- C:\Windows\System32\UusfaRG.exe
  C:\Windows\System32\UusfaRG.exe
  2⤵
  PID:5216
- C:\Windows\System32\BAsLIfp.exe
  C:\Windows\System32\BAsLIfp.exe
  2⤵
  PID:5248
- C:\Windows\System32\GWAPHOU.exe
  C:\Windows\System32\GWAPHOU.exe
  2⤵
  PID:5268
- C:\Windows\System32\GRSivUa.exe
  C:\Windows\System32\GRSivUa.exe
  2⤵
  PID:5284
- C:\Windows\System32\FjrZXLV.exe
  C:\Windows\System32\FjrZXLV.exe
  2⤵
  PID:5300
- C:\Windows\System32\qEzbECp.exe
  C:\Windows\System32\qEzbECp.exe
  2⤵
  PID:5324
- C:\Windows\System32\XrkUqqh.exe
  C:\Windows\System32\XrkUqqh.exe
  2⤵
  PID:5360
- C:\Windows\System32\UzEpHrc.exe
  C:\Windows\System32\UzEpHrc.exe
  2⤵
  PID:5376
- C:\Windows\System32\xWdWbOv.exe
  C:\Windows\System32\xWdWbOv.exe
  2⤵
  PID:5424
- C:\Windows\System32\oHAtrBM.exe
  C:\Windows\System32\oHAtrBM.exe
  2⤵
  PID:5448
- C:\Windows\System32\HFPLPYl.exe
  C:\Windows\System32\HFPLPYl.exe
  2⤵
  PID:5468
- C:\Windows\System32\wVyWBig.exe
  C:\Windows\System32\wVyWBig.exe
  2⤵
  PID:5496
- C:\Windows\System32\qboNdiG.exe
  C:\Windows\System32\qboNdiG.exe
  2⤵
  PID:5512
- C:\Windows\System32\ihXiIpl.exe
  C:\Windows\System32\ihXiIpl.exe
  2⤵
  PID:5528
- C:\Windows\System32\llpvZMK.exe
  C:\Windows\System32\llpvZMK.exe
  2⤵
  PID:5556
- C:\Windows\System32\AhSOeQV.exe
  C:\Windows\System32\AhSOeQV.exe
  2⤵
  PID:5612
- C:\Windows\System32\BIBiNjc.exe
  C:\Windows\System32\BIBiNjc.exe
  2⤵
  PID:5660
- C:\Windows\System32\cKWDOGG.exe
  C:\Windows\System32\cKWDOGG.exe
  2⤵
  PID:5676
- C:\Windows\System32\WOteQrT.exe
  C:\Windows\System32\WOteQrT.exe
  2⤵
  PID:5696
- C:\Windows\System32\SEeCHwn.exe
  C:\Windows\System32\SEeCHwn.exe
  2⤵
  PID:5720
- C:\Windows\System32\yiXFKOS.exe
  C:\Windows\System32\yiXFKOS.exe
  2⤵
  PID:5756
- C:\Windows\System32\plRRWZd.exe
  C:\Windows\System32\plRRWZd.exe
  2⤵
  PID:5780
- C:\Windows\System32\hajQbhZ.exe
  C:\Windows\System32\hajQbhZ.exe
  2⤵
  PID:5848
- C:\Windows\System32\ExbUbUO.exe
  C:\Windows\System32\ExbUbUO.exe
  2⤵
  PID:5868
- C:\Windows\System32\DcetRAN.exe
  C:\Windows\System32\DcetRAN.exe
  2⤵
  PID:5888
- C:\Windows\System32\AMLfqFo.exe
  C:\Windows\System32\AMLfqFo.exe
  2⤵
  PID:5920
- C:\Windows\System32\xScfnev.exe
  C:\Windows\System32\xScfnev.exe
  2⤵
  PID:5944
- C:\Windows\System32\AHupHOE.exe
  C:\Windows\System32\AHupHOE.exe
  2⤵
  PID:5996
- C:\Windows\System32\XvEyTMj.exe
  C:\Windows\System32\XvEyTMj.exe
  2⤵
  PID:6012
- C:\Windows\System32\ssZLYDi.exe
  C:\Windows\System32\ssZLYDi.exe
  2⤵
  PID:6044
- C:\Windows\System32\hGtyEoR.exe
  C:\Windows\System32\hGtyEoR.exe
  2⤵
  PID:6076
- C:\Windows\System32\vwsFCNw.exe
  C:\Windows\System32\vwsFCNw.exe
  2⤵
  PID:6092
- C:\Windows\System32\aOPIhYa.exe
  C:\Windows\System32\aOPIhYa.exe
  2⤵
  PID:6132
- C:\Windows\System32\rXmvjRv.exe
  C:\Windows\System32\rXmvjRv.exe
  2⤵
  PID:5156
- C:\Windows\System32\poQWutQ.exe
  C:\Windows\System32\poQWutQ.exe
  2⤵
  PID:5224
- C:\Windows\System32\yKbnmLE.exe
  C:\Windows\System32\yKbnmLE.exe
  2⤵
  PID:5260
- C:\Windows\System32\DfBMAHk.exe
  C:\Windows\System32\DfBMAHk.exe
  2⤵
  PID:5344
- C:\Windows\System32\qGWTiCt.exe
  C:\Windows\System32\qGWTiCt.exe
  2⤵
  PID:5384
- C:\Windows\System32\MFModxB.exe
  C:\Windows\System32\MFModxB.exe
  2⤵
  PID:5440
- C:\Windows\System32\AHhEXEq.exe
  C:\Windows\System32\AHhEXEq.exe
  2⤵
  PID:5484
- C:\Windows\System32\cVExZUm.exe
  C:\Windows\System32\cVExZUm.exe
  2⤵
  PID:5548
- C:\Windows\System32\baNtaAm.exe
  C:\Windows\System32\baNtaAm.exe
  2⤵
  PID:5524
- C:\Windows\System32\UwnmtkM.exe
  C:\Windows\System32\UwnmtkM.exe
  2⤵
  PID:5604
- C:\Windows\System32\tGZNUWs.exe
  C:\Windows\System32\tGZNUWs.exe
  2⤵
  PID:5736
- C:\Windows\System32\pIfvjvD.exe
  C:\Windows\System32\pIfvjvD.exe
  2⤵
  PID:5708
- C:\Windows\System32\VSfWAom.exe
  C:\Windows\System32\VSfWAom.exe
  2⤵
  PID:5876
- C:\Windows\System32\GpXKuLy.exe
  C:\Windows\System32\GpXKuLy.exe
  2⤵
  PID:5936
- C:\Windows\System32\lrOcgpk.exe
  C:\Windows\System32\lrOcgpk.exe
  2⤵
  PID:6008
- C:\Windows\System32\WtNQdjr.exe
  C:\Windows\System32\WtNQdjr.exe
  2⤵
  PID:6084
- C:\Windows\System32\bHIuraO.exe
  C:\Windows\System32\bHIuraO.exe
  2⤵
  PID:1304
- C:\Windows\System32\MNzqPIP.exe
  C:\Windows\System32\MNzqPIP.exe
  2⤵
  PID:5296
- C:\Windows\System32\wrVahkn.exe
  C:\Windows\System32\wrVahkn.exe
  2⤵
  PID:5392
- C:\Windows\System32\BbkjpFq.exe
  C:\Windows\System32\BbkjpFq.exe
  2⤵
  PID:5432
- C:\Windows\System32\YBVCIvs.exe
  C:\Windows\System32\YBVCIvs.exe
  2⤵
  PID:5688
- C:\Windows\System32\NwMhKEd.exe
  C:\Windows\System32\NwMhKEd.exe
  2⤵
  PID:5544
- C:\Windows\System32\pvcZMvk.exe
  C:\Windows\System32\pvcZMvk.exe
  2⤵
  PID:6088
- C:\Windows\System32\pSwKDhH.exe
  C:\Windows\System32\pSwKDhH.exe
  2⤵
  PID:5164
- C:\Windows\System32\twhrdvT.exe
  C:\Windows\System32\twhrdvT.exe
  2⤵
  PID:4984
- C:\Windows\System32\mjUQzaG.exe
  C:\Windows\System32\mjUQzaG.exe
  2⤵
  PID:5508
- C:\Windows\System32\cldFDvw.exe
  C:\Windows\System32\cldFDvw.exe
  2⤵
  PID:6028
- C:\Windows\System32\tCvqkqs.exe
  C:\Windows\System32\tCvqkqs.exe
  2⤵
  PID:5084
- C:\Windows\System32\bFVOtKO.exe
  C:\Windows\System32\bFVOtKO.exe
  2⤵
  PID:6004
- C:\Windows\System32\aocNBtC.exe
  C:\Windows\System32\aocNBtC.exe
  2⤵
  PID:6164
- C:\Windows\System32\FJHffFe.exe
  C:\Windows\System32\FJHffFe.exe
  2⤵
  PID:6208
- C:\Windows\System32\rIazYJb.exe
  C:\Windows\System32\rIazYJb.exe
  2⤵
  PID:6256
- C:\Windows\System32\sTbGuQL.exe
  C:\Windows\System32\sTbGuQL.exe
  2⤵
  PID:6272
- C:\Windows\System32\uzxVAWT.exe
  C:\Windows\System32\uzxVAWT.exe
  2⤵
  PID:6296
- C:\Windows\System32\wRfDvFA.exe
  C:\Windows\System32\wRfDvFA.exe
  2⤵
  PID:6316
- C:\Windows\System32\CcQpcTp.exe
  C:\Windows\System32\CcQpcTp.exe
  2⤵
  PID:6332
- C:\Windows\System32\NROTWTY.exe
  C:\Windows\System32\NROTWTY.exe
  2⤵
  PID:6396
- C:\Windows\System32\rwusWND.exe
  C:\Windows\System32\rwusWND.exe
  2⤵
  PID:6436
- C:\Windows\System32\fxizOfr.exe
  C:\Windows\System32\fxizOfr.exe
  2⤵
  PID:6460
- C:\Windows\System32\whNIqbp.exe
  C:\Windows\System32\whNIqbp.exe
  2⤵
  PID:6476
- C:\Windows\System32\UKBPkFr.exe
  C:\Windows\System32\UKBPkFr.exe
  2⤵
  PID:6496
- C:\Windows\System32\OtxCNQg.exe
  C:\Windows\System32\OtxCNQg.exe
  2⤵
  PID:6524
- C:\Windows\System32\MlfCDQp.exe
  C:\Windows\System32\MlfCDQp.exe
  2⤵
  PID:6540
- C:\Windows\System32\LwhMjKa.exe
  C:\Windows\System32\LwhMjKa.exe
  2⤵
  PID:6600
- C:\Windows\System32\MdUBXEh.exe
  C:\Windows\System32\MdUBXEh.exe
  2⤵
  PID:6636
- C:\Windows\System32\AKyztjd.exe
  C:\Windows\System32\AKyztjd.exe
  2⤵
  PID:6656
- C:\Windows\System32\wOpqgfd.exe
  C:\Windows\System32\wOpqgfd.exe
  2⤵
  PID:6672
- C:\Windows\System32\smsxzEJ.exe
  C:\Windows\System32\smsxzEJ.exe
  2⤵
  PID:6712
- C:\Windows\System32\iiqXOxj.exe
  C:\Windows\System32\iiqXOxj.exe
  2⤵
  PID:6740
- C:\Windows\System32\xANJryW.exe
  C:\Windows\System32\xANJryW.exe
  2⤵
  PID:6756
- C:\Windows\System32\eOJtXnj.exe
  C:\Windows\System32\eOJtXnj.exe
  2⤵
  PID:6780
- C:\Windows\System32\HwQFgAU.exe
  C:\Windows\System32\HwQFgAU.exe
  2⤵
  PID:6804
- C:\Windows\System32\FbmtrPY.exe
  C:\Windows\System32\FbmtrPY.exe
  2⤵
  PID:6828
- C:\Windows\System32\tUNZkut.exe
  C:\Windows\System32\tUNZkut.exe
  2⤵
  PID:6848
- C:\Windows\System32\lEQZkJe.exe
  C:\Windows\System32\lEQZkJe.exe
  2⤵
  PID:6892
- C:\Windows\System32\ueSamle.exe
  C:\Windows\System32\ueSamle.exe
  2⤵
  PID:6944
- C:\Windows\System32\kUtDpJj.exe
  C:\Windows\System32\kUtDpJj.exe
  2⤵
  PID:6964
- C:\Windows\System32\bVNdqOL.exe
  C:\Windows\System32\bVNdqOL.exe
  2⤵
  PID:6988
- C:\Windows\System32\ofhBhlp.exe
  C:\Windows\System32\ofhBhlp.exe
  2⤵
  PID:7008
- C:\Windows\System32\ocMYChA.exe
  C:\Windows\System32\ocMYChA.exe
  2⤵
  PID:7028
- C:\Windows\System32\gBwLTVf.exe
  C:\Windows\System32\gBwLTVf.exe
  2⤵
  PID:7044
- C:\Windows\System32\hRiDeaM.exe
  C:\Windows\System32\hRiDeaM.exe
  2⤵
  PID:7088
- C:\Windows\System32\DcQnfgs.exe
  C:\Windows\System32\DcQnfgs.exe
  2⤵
  PID:7152
- C:\Windows\System32\xUGmsck.exe
  C:\Windows\System32\xUGmsck.exe
  2⤵
  PID:5912
- C:\Windows\System32\rnrqfTB.exe
  C:\Windows\System32\rnrqfTB.exe
  2⤵
  PID:6176
- C:\Windows\System32\obTcihu.exe
  C:\Windows\System32\obTcihu.exe
  2⤵
  PID:6236
- C:\Windows\System32\yDfxZay.exe
  C:\Windows\System32\yDfxZay.exe
  2⤵
  PID:6292
- C:\Windows\System32\icDLOJS.exe
  C:\Windows\System32\icDLOJS.exe
  2⤵
  PID:6380
- C:\Windows\System32\JQjBNjO.exe
  C:\Windows\System32\JQjBNjO.exe
  2⤵
  PID:6372
- C:\Windows\System32\tmTYXCm.exe
  C:\Windows\System32\tmTYXCm.exe
  2⤵
  PID:6444
- C:\Windows\System32\hMjjrMm.exe
  C:\Windows\System32\hMjjrMm.exe
  2⤵
  PID:3252
- C:\Windows\System32\cJzTDbE.exe
  C:\Windows\System32\cJzTDbE.exe
  2⤵
  PID:6580
- C:\Windows\System32\iHSFbcO.exe
  C:\Windows\System32\iHSFbcO.exe
  2⤵
  PID:5968
- C:\Windows\System32\ngpbwOU.exe
  C:\Windows\System32\ngpbwOU.exe
  2⤵
  PID:6668
- C:\Windows\System32\pOTnrov.exe
  C:\Windows\System32\pOTnrov.exe
  2⤵
  PID:6704
- C:\Windows\System32\ZMvPlTf.exe
  C:\Windows\System32\ZMvPlTf.exe
  2⤵
  PID:6748
- C:\Windows\System32\hMbllBF.exe
  C:\Windows\System32\hMbllBF.exe
  2⤵
  PID:6872
- C:\Windows\System32\ghgABKH.exe
  C:\Windows\System32\ghgABKH.exe
  2⤵
  PID:6956
- C:\Windows\System32\hpWfIWW.exe
  C:\Windows\System32\hpWfIWW.exe
  2⤵
  PID:7036
- C:\Windows\System32\ivYpXdS.exe
  C:\Windows\System32\ivYpXdS.exe
  2⤵
  PID:7072
- C:\Windows\System32\qgNNJyO.exe
  C:\Windows\System32\qgNNJyO.exe
  2⤵
  PID:7160
- C:\Windows\System32\QSZSguy.exe
  C:\Windows\System32\QSZSguy.exe
  2⤵
  PID:6284
- C:\Windows\System32\aiTdUeS.exe
  C:\Windows\System32\aiTdUeS.exe
  2⤵
  PID:6324
- C:\Windows\System32\DeCLBoX.exe
  C:\Windows\System32\DeCLBoX.exe
  2⤵
  PID:6468
- C:\Windows\System32\UTiYbZc.exe
  C:\Windows\System32\UTiYbZc.exe
  2⤵
  PID:6612
- C:\Windows\System32\GvbtdTQ.exe
  C:\Windows\System32\GvbtdTQ.exe
  2⤵
  PID:6860
- C:\Windows\System32\SlcsQYV.exe
  C:\Windows\System32\SlcsQYV.exe
  2⤵
  PID:7132
- C:\Windows\System32\RSTHnBP.exe
  C:\Windows\System32\RSTHnBP.exe
  2⤵
  PID:6156
- C:\Windows\System32\VcLJhWn.exe
  C:\Windows\System32\VcLJhWn.exe
  2⤵
  PID:6448
- C:\Windows\System32\gKGkvyg.exe
  C:\Windows\System32\gKGkvyg.exe
  2⤵
  PID:6764
- C:\Windows\System32\laQXxOW.exe
  C:\Windows\System32\laQXxOW.exe
  2⤵
  PID:7060
- C:\Windows\System32\AGaeHzx.exe
  C:\Windows\System32\AGaeHzx.exe
  2⤵
  PID:6428
- C:\Windows\System32\dxKPzuG.exe
  C:\Windows\System32\dxKPzuG.exe
  2⤵
  PID:7184
- C:\Windows\System32\FepwssG.exe
  C:\Windows\System32\FepwssG.exe
  2⤵
  PID:7212
- C:\Windows\System32\bulViGl.exe
  C:\Windows\System32\bulViGl.exe
  2⤵
  PID:7252
- C:\Windows\System32\hlFKNef.exe
  C:\Windows\System32\hlFKNef.exe
  2⤵
  PID:7300
- C:\Windows\System32\tPulYMn.exe
  C:\Windows\System32\tPulYMn.exe
  2⤵
  PID:7320
- C:\Windows\System32\eAPIgwR.exe
  C:\Windows\System32\eAPIgwR.exe
  2⤵
  PID:7348
- C:\Windows\System32\fYyGczm.exe
  C:\Windows\System32\fYyGczm.exe
  2⤵
  PID:7372
- C:\Windows\System32\qHgbwOn.exe
  C:\Windows\System32\qHgbwOn.exe
  2⤵
  PID:7420
- C:\Windows\System32\gWzfKFi.exe
  C:\Windows\System32\gWzfKFi.exe
  2⤵
  PID:7452
- C:\Windows\System32\aKXfpgS.exe
  C:\Windows\System32\aKXfpgS.exe
  2⤵
  PID:7476
- C:\Windows\System32\MJXMhvc.exe
  C:\Windows\System32\MJXMhvc.exe
  2⤵
  PID:7512
- C:\Windows\System32\KfGOfJa.exe
  C:\Windows\System32\KfGOfJa.exe
  2⤵
  PID:7536
- C:\Windows\System32\beioZBY.exe
  C:\Windows\System32\beioZBY.exe
  2⤵
  PID:7556
- C:\Windows\System32\CdkWgeu.exe
  C:\Windows\System32\CdkWgeu.exe
  2⤵
  PID:7580
- C:\Windows\System32\osBeLCm.exe
  C:\Windows\System32\osBeLCm.exe
  2⤵
  PID:7600
- C:\Windows\System32\bWdSxyi.exe
  C:\Windows\System32\bWdSxyi.exe
  2⤵
  PID:7652
- C:\Windows\System32\rcutLAU.exe
  C:\Windows\System32\rcutLAU.exe
  2⤵
  PID:7668
- C:\Windows\System32\VtpZoLu.exe
  C:\Windows\System32\VtpZoLu.exe
  2⤵
  PID:7692
- C:\Windows\System32\ZYqkRGN.exe
  C:\Windows\System32\ZYqkRGN.exe
  2⤵
  PID:7708
- C:\Windows\System32\IhhVKeZ.exe
  C:\Windows\System32\IhhVKeZ.exe
  2⤵
  PID:7736
- C:\Windows\System32\TwkGeXR.exe
  C:\Windows\System32\TwkGeXR.exe
  2⤵
  PID:7756
- C:\Windows\System32\XnNVDWh.exe
  C:\Windows\System32\XnNVDWh.exe
  2⤵
  PID:7800
- C:\Windows\System32\fPqNFPJ.exe
  C:\Windows\System32\fPqNFPJ.exe
  2⤵
  PID:7824
- C:\Windows\System32\qoXUPBg.exe
  C:\Windows\System32\qoXUPBg.exe
  2⤵
  PID:7852
- C:\Windows\System32\ZpEVLqC.exe
  C:\Windows\System32\ZpEVLqC.exe
  2⤵
  PID:7876
- C:\Windows\System32\jEqUafS.exe
  C:\Windows\System32\jEqUafS.exe
  2⤵
  PID:7932
- C:\Windows\System32\sYvFcmw.exe
  C:\Windows\System32\sYvFcmw.exe
  2⤵
  PID:7968
- C:\Windows\System32\IMQjysC.exe
  C:\Windows\System32\IMQjysC.exe
  2⤵
  PID:7988
- C:\Windows\System32\fbbGFwf.exe
  C:\Windows\System32\fbbGFwf.exe
  2⤵
  PID:8008
- C:\Windows\System32\lEQHLPb.exe
  C:\Windows\System32\lEQHLPb.exe
  2⤵
  PID:8028
- C:\Windows\System32\lwgFIFG.exe
  C:\Windows\System32\lwgFIFG.exe
  2⤵
  PID:8048
- C:\Windows\System32\CXfmlRK.exe
  C:\Windows\System32\CXfmlRK.exe
  2⤵
  PID:8064
- C:\Windows\System32\xDslALn.exe
  C:\Windows\System32\xDslALn.exe
  2⤵
  PID:8116
- C:\Windows\System32\WGKwNtU.exe
  C:\Windows\System32\WGKwNtU.exe
  2⤵
  PID:8172
- C:\Windows\System32\qqXgUKs.exe
  C:\Windows\System32\qqXgUKs.exe
  2⤵
  PID:8188
- C:\Windows\System32\cBqsNKS.exe
  C:\Windows\System32\cBqsNKS.exe
  2⤵
  PID:7196
- C:\Windows\System32\tscrTNP.exe
  C:\Windows\System32\tscrTNP.exe
  2⤵
  PID:7180
- C:\Windows\System32\GNQzlRj.exe
  C:\Windows\System32\GNQzlRj.exe
  2⤵
  PID:7268
- C:\Windows\System32\eUAEBgI.exe
  C:\Windows\System32\eUAEBgI.exe
  2⤵
  PID:7288
- C:\Windows\System32\zcpdtCi.exe
  C:\Windows\System32\zcpdtCi.exe
  2⤵
  PID:7332
- C:\Windows\System32\MpsrKeO.exe
  C:\Windows\System32\MpsrKeO.exe
  2⤵
  PID:7440
- C:\Windows\System32\hFipFGP.exe
  C:\Windows\System32\hFipFGP.exe
  2⤵
  PID:7504
- C:\Windows\System32\RXXZugH.exe
  C:\Windows\System32\RXXZugH.exe
  2⤵
  PID:7588
- C:\Windows\System32\txqpjIx.exe
  C:\Windows\System32\txqpjIx.exe
  2⤵
  PID:7632
- C:\Windows\System32\zyaokIo.exe
  C:\Windows\System32\zyaokIo.exe
  2⤵
  PID:7732
- C:\Windows\System32\yERtZck.exe
  C:\Windows\System32\yERtZck.exe
  2⤵
  PID:7700
- C:\Windows\System32\AFtigvh.exe
  C:\Windows\System32\AFtigvh.exe
  2⤵
  PID:7808
- C:\Windows\System32\EKXCLuY.exe
  C:\Windows\System32\EKXCLuY.exe
  2⤵
  PID:7888
- C:\Windows\System32\ZxfpRBs.exe
  C:\Windows\System32\ZxfpRBs.exe
  2⤵
  PID:8020
- C:\Windows\System32\sOvghuQ.exe
  C:\Windows\System32\sOvghuQ.exe
  2⤵
  PID:8076
- C:\Windows\System32\YUBJPzt.exe
  C:\Windows\System32\YUBJPzt.exe
  2⤵
  PID:8104
- C:\Windows\System32\CqywMkz.exe
  C:\Windows\System32\CqywMkz.exe
  2⤵
  PID:7576
- C:\Windows\System32\PjZzbyL.exe
  C:\Windows\System32\PjZzbyL.exe
  2⤵
  PID:7660
- C:\Windows\System32\FSAiklp.exe
  C:\Windows\System32\FSAiklp.exe
  2⤵
  PID:7788
- C:\Windows\System32\VZHpFWc.exe
  C:\Windows\System32\VZHpFWc.exe
  2⤵
  PID:7836
- C:\Windows\System32\PvjtKTx.exe
  C:\Windows\System32\PvjtKTx.exe
  2⤵
  PID:8004
- C:\Windows\System32\UxhPnps.exe
  C:\Windows\System32\UxhPnps.exe
  2⤵
  PID:7920
- C:\Windows\System32\pntEhio.exe
  C:\Windows\System32\pntEhio.exe
  2⤵
  PID:8112
- C:\Windows\System32\kAXNNwX.exe
  C:\Windows\System32\kAXNNwX.exe
  2⤵
  PID:8208
- C:\Windows\System32\iyTtmCr.exe
  C:\Windows\System32\iyTtmCr.exe
  2⤵
  PID:8224
- C:\Windows\System32\TRspVpH.exe
  C:\Windows\System32\TRspVpH.exe
  2⤵
  PID:8244
- C:\Windows\System32\KJRIqcl.exe
  C:\Windows\System32\KJRIqcl.exe
  2⤵
  PID:8260
- C:\Windows\System32\pakmSPs.exe
  C:\Windows\System32\pakmSPs.exe
  2⤵
  PID:8276
- C:\Windows\System32\xvNhirP.exe
  C:\Windows\System32\xvNhirP.exe
  2⤵
  PID:8292
- C:\Windows\System32\vUGsjAR.exe
  C:\Windows\System32\vUGsjAR.exe
  2⤵
  PID:8308
- C:\Windows\System32\tudmuGS.exe
  C:\Windows\System32\tudmuGS.exe
  2⤵
  PID:8324
- C:\Windows\System32\rdqZiuw.exe
  C:\Windows\System32\rdqZiuw.exe
  2⤵
  PID:8340
- C:\Windows\System32\IGVrbBK.exe
  C:\Windows\System32\IGVrbBK.exe
  2⤵
  PID:8356
- C:\Windows\System32\zlspzgs.exe
  C:\Windows\System32\zlspzgs.exe
  2⤵
  PID:8372
- C:\Windows\System32\HMnfmUt.exe
  C:\Windows\System32\HMnfmUt.exe
  2⤵
  PID:8388
- C:\Windows\System32\lPCdwfD.exe
  C:\Windows\System32\lPCdwfD.exe
  2⤵
  PID:8404
- C:\Windows\System32\kfXAJBp.exe
  C:\Windows\System32\kfXAJBp.exe
  2⤵
  PID:8420
- C:\Windows\System32\XftjhYg.exe
  C:\Windows\System32\XftjhYg.exe
  2⤵
  PID:8440
- C:\Windows\System32\amncdOK.exe
  C:\Windows\System32\amncdOK.exe
  2⤵
  PID:8468
- C:\Windows\System32\DqPGNPx.exe
  C:\Windows\System32\DqPGNPx.exe
  2⤵
  PID:8500
- C:\Windows\System32\RRERXZb.exe
  C:\Windows\System32\RRERXZb.exe
  2⤵
  PID:8560
- C:\Windows\System32\HPVUyhG.exe
  C:\Windows\System32\HPVUyhG.exe
  2⤵
  PID:8580
- C:\Windows\System32\RBsiWVb.exe
  C:\Windows\System32\RBsiWVb.exe
  2⤵
  PID:8648
- C:\Windows\System32\XkszxrB.exe
  C:\Windows\System32\XkszxrB.exe
  2⤵
  PID:8668
- C:\Windows\System32\heQLXtk.exe
  C:\Windows\System32\heQLXtk.exe
  2⤵
  PID:8864
- C:\Windows\System32\RjmmKar.exe
  C:\Windows\System32\RjmmKar.exe
  2⤵
  PID:8888
- C:\Windows\System32\slIbzSI.exe
  C:\Windows\System32\slIbzSI.exe
  2⤵
  PID:8908
- C:\Windows\System32\VMGxawa.exe
  C:\Windows\System32\VMGxawa.exe
  2⤵
  PID:8976
- C:\Windows\System32\QLTtUnY.exe
  C:\Windows\System32\QLTtUnY.exe
  2⤵
  PID:9016
- C:\Windows\System32\ZwSLXFs.exe
  C:\Windows\System32\ZwSLXFs.exe
  2⤵
  PID:9040
- C:\Windows\System32\yUrJiEa.exe
  C:\Windows\System32\yUrJiEa.exe
  2⤵
  PID:9080
- C:\Windows\System32\fAwFJxX.exe
  C:\Windows\System32\fAwFJxX.exe
  2⤵
  PID:9132
- C:\Windows\System32\nCiuuWs.exe
  C:\Windows\System32\nCiuuWs.exe
  2⤵
  PID:9148
- C:\Windows\System32\BPcmJjP.exe
  C:\Windows\System32\BPcmJjP.exe
  2⤵
  PID:9192
- C:\Windows\System32\zplOLIg.exe
  C:\Windows\System32\zplOLIg.exe
  2⤵
  PID:9212
- C:\Windows\System32\SGKslHz.exe
  C:\Windows\System32\SGKslHz.exe
  2⤵
  PID:7764
- C:\Windows\System32\XyKloQa.exe
  C:\Windows\System32\XyKloQa.exe
  2⤵
  PID:8460
- C:\Windows\System32\szbjBGw.exe
  C:\Windows\System32\szbjBGw.exe
  2⤵
  PID:8184
- C:\Windows\System32\LHXhXOm.exe
  C:\Windows\System32\LHXhXOm.exe
  2⤵
  PID:7248
- C:\Windows\System32\eoNquGh.exe
  C:\Windows\System32\eoNquGh.exe
  2⤵
  PID:7524
- C:\Windows\System32\qXkqwNx.exe
  C:\Windows\System32\qXkqwNx.exe
  2⤵
  PID:8544
- C:\Windows\System32\xEGCMcW.exe
  C:\Windows\System32\xEGCMcW.exe
  2⤵
  PID:8412
- C:\Windows\System32\ClOTrHd.exe
  C:\Windows\System32\ClOTrHd.exe
  2⤵
  PID:8448
- C:\Windows\System32\DdRgidW.exe
  C:\Windows\System32\DdRgidW.exe
  2⤵
  PID:8508
- C:\Windows\System32\GCrvxGn.exe
  C:\Windows\System32\GCrvxGn.exe
  2⤵
  PID:8220
- C:\Windows\System32\ZnXjnvG.exe
  C:\Windows\System32\ZnXjnvG.exe
  2⤵
  PID:8368
- C:\Windows\System32\FHKvmww.exe
  C:\Windows\System32\FHKvmww.exe
  2⤵
  PID:8644
- C:\Windows\System32\vdjzcaQ.exe
  C:\Windows\System32\vdjzcaQ.exe
  2⤵
  PID:8588
- C:\Windows\System32\pRttcrT.exe
  C:\Windows\System32\pRttcrT.exe
  2⤵
  PID:8700
- C:\Windows\System32\TyyjqTV.exe
  C:\Windows\System32\TyyjqTV.exe
  2⤵
  PID:8664
- C:\Windows\System32\KOzeyji.exe
  C:\Windows\System32\KOzeyji.exe
  2⤵
  PID:8764
- C:\Windows\System32\LjCVGLh.exe
  C:\Windows\System32\LjCVGLh.exe
  2⤵
  PID:8680
- C:\Windows\System32\iFrMerh.exe
  C:\Windows\System32\iFrMerh.exe
  2⤵
  PID:8928
- C:\Windows\System32\CGZtFfS.exe
  C:\Windows\System32\CGZtFfS.exe
  2⤵
  PID:8992
- C:\Windows\System32\mQCEUxC.exe
  C:\Windows\System32\mQCEUxC.exe
  2⤵
  PID:9036
- C:\Windows\System32\cEZBTsC.exe
  C:\Windows\System32\cEZBTsC.exe
  2⤵
  PID:9200
- C:\Windows\System32\lkdUtJm.exe
  C:\Windows\System32\lkdUtJm.exe
  2⤵
  PID:8016
- C:\Windows\System32\GiNGLph.exe
  C:\Windows\System32\GiNGLph.exe
  2⤵
  PID:7428
- C:\Windows\System32\fFVmEpj.exe
  C:\Windows\System32\fFVmEpj.exe
  2⤵
  PID:6564
- C:\Windows\System32\opnRGHF.exe
  C:\Windows\System32\opnRGHF.exe
  2⤵
  PID:8364
- C:\Windows\System32\GLwCvtk.exe
  C:\Windows\System32\GLwCvtk.exe
  2⤵
  PID:8252
- C:\Windows\System32\PzwUZiA.exe
  C:\Windows\System32\PzwUZiA.exe
  2⤵
  PID:8496
- C:\Windows\System32\FuZnRGS.exe
  C:\Windows\System32\FuZnRGS.exe
  2⤵
  PID:8900
- C:\Windows\System32\PcjJwvy.exe
  C:\Windows\System32\PcjJwvy.exe
  2⤵
  PID:9008
- C:\Windows\System32\GNnmDKx.exe
  C:\Windows\System32\GNnmDKx.exe
  2⤵
  PID:9140
- C:\Windows\System32\crVqWjD.exe
  C:\Windows\System32\crVqWjD.exe
  2⤵
  PID:6532
- C:\Windows\System32\GBPtlEl.exe
  C:\Windows\System32\GBPtlEl.exe
  2⤵
  PID:7204
- C:\Windows\System32\tsSpVdy.exe
  C:\Windows\System32\tsSpVdy.exe
  2⤵
  PID:7620
- C:\Windows\System32\LtknDpi.exe
  C:\Windows\System32\LtknDpi.exe
  2⤵
  PID:8724
- C:\Windows\System32\XcAAxjV.exe
  C:\Windows\System32\XcAAxjV.exe
  2⤵
  PID:7496
- C:\Windows\System32\UcVhPMB.exe
  C:\Windows\System32\UcVhPMB.exe
  2⤵
  PID:9224
- C:\Windows\System32\aelNkuh.exe
  C:\Windows\System32\aelNkuh.exe
  2⤵
  PID:9252
- C:\Windows\System32\MPuulfX.exe
  C:\Windows\System32\MPuulfX.exe
  2⤵
  PID:9276
- C:\Windows\System32\azOqObw.exe
  C:\Windows\System32\azOqObw.exe
  2⤵
  PID:9320
- C:\Windows\System32\cjcqlUU.exe
  C:\Windows\System32\cjcqlUU.exe
  2⤵
  PID:9340
- C:\Windows\System32\VtxIpCM.exe
  C:\Windows\System32\VtxIpCM.exe
  2⤵
  PID:9364
- C:\Windows\System32\LbHgzlw.exe
  C:\Windows\System32\LbHgzlw.exe
  2⤵
  PID:9388
- C:\Windows\System32\UVtVNny.exe
  C:\Windows\System32\UVtVNny.exe
  2⤵
  PID:9436
- C:\Windows\System32\EbDrGlR.exe
  C:\Windows\System32\EbDrGlR.exe
  2⤵
  PID:9472
- C:\Windows\System32\kWXYxVP.exe
  C:\Windows\System32\kWXYxVP.exe
  2⤵
  PID:9488
- C:\Windows\System32\YBhbekp.exe
  C:\Windows\System32\YBhbekp.exe
  2⤵
  PID:9512
- C:\Windows\System32\PEQBNxJ.exe
  C:\Windows\System32\PEQBNxJ.exe
  2⤵
  PID:9548
- C:\Windows\System32\JXukJwX.exe
  C:\Windows\System32\JXukJwX.exe
  2⤵
  PID:9572
- C:\Windows\System32\MmSEZeI.exe
  C:\Windows\System32\MmSEZeI.exe
  2⤵
  PID:9588
- C:\Windows\System32\LmbwAyK.exe
  C:\Windows\System32\LmbwAyK.exe
  2⤵
  PID:9640
- C:\Windows\System32\RnsbrYx.exe
  C:\Windows\System32\RnsbrYx.exe
  2⤵
  PID:9656
- C:\Windows\System32\wduXzmP.exe
  C:\Windows\System32\wduXzmP.exe
  2⤵
  PID:9680
- C:\Windows\System32\LOQQJsM.exe
  C:\Windows\System32\LOQQJsM.exe
  2⤵
  PID:9716
- C:\Windows\System32\FoCOBUj.exe
  C:\Windows\System32\FoCOBUj.exe
  2⤵
  PID:9732
- C:\Windows\System32\kSeDfWY.exe
  C:\Windows\System32\kSeDfWY.exe
  2⤵
  PID:9764
- C:\Windows\System32\VvmvHBs.exe
  C:\Windows\System32\VvmvHBs.exe
  2⤵
  PID:9784
- C:\Windows\System32\KuWtEKZ.exe
  C:\Windows\System32\KuWtEKZ.exe
  2⤵
  PID:9804
- C:\Windows\System32\kIFPQAy.exe
  C:\Windows\System32\kIFPQAy.exe
  2⤵
  PID:9820
- C:\Windows\System32\RxbTjuM.exe
  C:\Windows\System32\RxbTjuM.exe
  2⤵
  PID:9848
- C:\Windows\System32\YqWWizP.exe
  C:\Windows\System32\YqWWizP.exe
  2⤵
  PID:9868
- C:\Windows\System32\YQMKnBA.exe
  C:\Windows\System32\YQMKnBA.exe
  2⤵
  PID:9916
- C:\Windows\System32\jFEitLi.exe
  C:\Windows\System32\jFEitLi.exe
  2⤵
  PID:9964
- C:\Windows\System32\xFkblGA.exe
  C:\Windows\System32\xFkblGA.exe
  2⤵
  PID:9996
- C:\Windows\System32\FEIOVos.exe
  C:\Windows\System32\FEIOVos.exe
  2⤵
  PID:10020
- C:\Windows\System32\VCXxiDT.exe
  C:\Windows\System32\VCXxiDT.exe
  2⤵
  PID:10040
- C:\Windows\System32\ajWHTBc.exe
  C:\Windows\System32\ajWHTBc.exe
  2⤵
  PID:10064
- C:\Windows\System32\bleXpwC.exe
  C:\Windows\System32\bleXpwC.exe
  2⤵
  PID:10084
- C:\Windows\System32\KxUdVGY.exe
  C:\Windows\System32\KxUdVGY.exe
  2⤵
  PID:10108
- C:\Windows\System32\XXigNeb.exe
  C:\Windows\System32\XXigNeb.exe
  2⤵
  PID:10164
- C:\Windows\System32\QWxdfdh.exe
  C:\Windows\System32\QWxdfdh.exe
  2⤵
  PID:10196
- C:\Windows\System32\KkttJSs.exe
  C:\Windows\System32\KkttJSs.exe
  2⤵
  PID:10216
- C:\Windows\System32\EtwASdc.exe
  C:\Windows\System32\EtwASdc.exe
  2⤵
  PID:10236
- C:\Windows\System32\yKSWXTV.exe
  C:\Windows\System32\yKSWXTV.exe
  2⤵
  PID:9232
- C:\Windows\System32\tmNCKnz.exe
  C:\Windows\System32\tmNCKnz.exe
  2⤵
  PID:9316
- C:\Windows\System32\rUaqsYv.exe
  C:\Windows\System32\rUaqsYv.exe
  2⤵
  PID:9352
- C:\Windows\System32\LcpXCEj.exe
  C:\Windows\System32\LcpXCEj.exe
  2⤵
  PID:9448
- C:\Windows\System32\IVebRGA.exe
  C:\Windows\System32\IVebRGA.exe
  2⤵
  PID:9496
- C:\Windows\System32\KDRoPIp.exe
  C:\Windows\System32\KDRoPIp.exe
  2⤵
  PID:9568
- C:\Windows\System32\OiGuTdH.exe
  C:\Windows\System32\OiGuTdH.exe
  2⤵
  PID:9580
- C:\Windows\System32\iAEBErm.exe
  C:\Windows\System32\iAEBErm.exe
  2⤵
  PID:9676
- C:\Windows\System32\zBtoifY.exe
  C:\Windows\System32\zBtoifY.exe
  2⤵
  PID:9748
- C:\Windows\System32\CwRUOvY.exe
  C:\Windows\System32\CwRUOvY.exe
  2⤵
  PID:9792
- C:\Windows\System32\sUfRCmC.exe
  C:\Windows\System32\sUfRCmC.exe
  2⤵
  PID:9812
- C:\Windows\System32\ZbUkVCc.exe
  C:\Windows\System32\ZbUkVCc.exe
  2⤵
  PID:9896
- C:\Windows\System32\cGyxITj.exe
  C:\Windows\System32\cGyxITj.exe
  2⤵
  PID:10012
- C:\Windows\System32\odjIrIK.exe
  C:\Windows\System32\odjIrIK.exe
  2⤵
  PID:10056
- C:\Windows\System32\LGgwnkG.exe
  C:\Windows\System32\LGgwnkG.exe
  2⤵
  PID:10144
- C:\Windows\System32\XmCcYzj.exe
  C:\Windows\System32\XmCcYzj.exe
  2⤵
  PID:10172
- C:\Windows\System32\frYESXi.exe
  C:\Windows\System32\frYESXi.exe
  2⤵
  PID:10232
- C:\Windows\System32\GtHOcgH.exe
  C:\Windows\System32\GtHOcgH.exe
  2⤵
  PID:9400
- C:\Windows\System32\sZaUgdT.exe
  C:\Windows\System32\sZaUgdT.exe
  2⤵
  PID:9484
- C:\Windows\System32\qBmoloC.exe
  C:\Windows\System32\qBmoloC.exe
  2⤵
  PID:9700
- C:\Windows\System32\COdeRZC.exe
  C:\Windows\System32\COdeRZC.exe
  2⤵
  PID:9828
- C:\Windows\System32\KZnuwUB.exe
  C:\Windows\System32\KZnuwUB.exe
  2⤵
  PID:9972
- C:\Windows\System32\xEVenfV.exe
  C:\Windows\System32\xEVenfV.exe
  2⤵
  PID:10160
- C:\Windows\System32\lpfxlyT.exe
  C:\Windows\System32\lpfxlyT.exe
  2⤵
  PID:8620
- C:\Windows\System32\fDnIKVf.exe
  C:\Windows\System32\fDnIKVf.exe
  2⤵
  PID:9508
- C:\Windows\System32\rEbqShw.exe
  C:\Windows\System32\rEbqShw.exe
  2⤵
  PID:9832
- C:\Windows\System32\xhzlqlo.exe
  C:\Windows\System32\xhzlqlo.exe
  2⤵
  PID:9952
- C:\Windows\System32\fGrzlhl.exe
  C:\Windows\System32\fGrzlhl.exe
  2⤵
  PID:9408
- C:\Windows\System32\PhXpZKh.exe
  C:\Windows\System32\PhXpZKh.exe
  2⤵
  PID:9596
- C:\Windows\System32\CoWGFbg.exe
  C:\Windows\System32\CoWGFbg.exe
  2⤵
  PID:10296
- C:\Windows\System32\FFflOEa.exe
  C:\Windows\System32\FFflOEa.exe
  2⤵
  PID:10312
- C:\Windows\System32\ViCNDRX.exe
  C:\Windows\System32\ViCNDRX.exe
  2⤵
  PID:10328
- C:\Windows\System32\JTkadCN.exe
  C:\Windows\System32\JTkadCN.exe
  2⤵
  PID:10348
- C:\Windows\System32\qTBeCLS.exe
  C:\Windows\System32\qTBeCLS.exe
  2⤵
  PID:10368
- C:\Windows\System32\TvdzvqV.exe
  C:\Windows\System32\TvdzvqV.exe
  2⤵
  PID:10392
- C:\Windows\System32\MDlnIUV.exe
  C:\Windows\System32\MDlnIUV.exe
  2⤵
  PID:10440
- C:\Windows\System32\vUtoRgm.exe
  C:\Windows\System32\vUtoRgm.exe
  2⤵
  PID:10484
- C:\Windows\System32\qYuKjWF.exe
  C:\Windows\System32\qYuKjWF.exe
  2⤵
  PID:10524
- C:\Windows\System32\SAobIck.exe
  C:\Windows\System32\SAobIck.exe
  2⤵
  PID:10540
- C:\Windows\System32\SGkyJSe.exe
  C:\Windows\System32\SGkyJSe.exe
  2⤵
  PID:10560
- C:\Windows\System32\ruEcFZM.exe
  C:\Windows\System32\ruEcFZM.exe
  2⤵
  PID:10580
- C:\Windows\System32\qDUcUZd.exe
  C:\Windows\System32\qDUcUZd.exe
  2⤵
  PID:10608
- C:\Windows\System32\aASIMPh.exe
  C:\Windows\System32\aASIMPh.exe
  2⤵
  PID:10624
- C:\Windows\System32\kzsZtdi.exe
  C:\Windows\System32\kzsZtdi.exe
  2⤵
  PID:10684
- C:\Windows\System32\XtqaIYW.exe
  C:\Windows\System32\XtqaIYW.exe
  2⤵
  PID:10708
- C:\Windows\System32\LgLoXKD.exe
  C:\Windows\System32\LgLoXKD.exe
  2⤵
  PID:10736
- C:\Windows\System32\jUEZyvs.exe
  C:\Windows\System32\jUEZyvs.exe
  2⤵
  PID:10760
- C:\Windows\System32\oGHlffk.exe
  C:\Windows\System32\oGHlffk.exe
  2⤵
  PID:10780
- C:\Windows\System32\aNBzVko.exe
  C:\Windows\System32\aNBzVko.exe
  2⤵
  PID:10820
- C:\Windows\System32\sZdUesr.exe
  C:\Windows\System32\sZdUesr.exe
  2⤵
  PID:10848
- C:\Windows\System32\gkfiTvy.exe
  C:\Windows\System32\gkfiTvy.exe
  2⤵
  PID:10868
- C:\Windows\System32\PnWMZBP.exe
  C:\Windows\System32\PnWMZBP.exe
  2⤵
  PID:10892
- C:\Windows\System32\RggfTXg.exe
  C:\Windows\System32\RggfTXg.exe
  2⤵
  PID:10920
- C:\Windows\System32\ketFEvN.exe
  C:\Windows\System32\ketFEvN.exe
  2⤵
  PID:10940
- C:\Windows\System32\mWxSPSr.exe
  C:\Windows\System32\mWxSPSr.exe
  2⤵
  PID:10968
- C:\Windows\System32\WsPSHjJ.exe
  C:\Windows\System32\WsPSHjJ.exe
  2⤵
  PID:10992
- C:\Windows\System32\HvQVnHk.exe
  C:\Windows\System32\HvQVnHk.exe
  2⤵
  PID:11024
- C:\Windows\System32\MoHKVlV.exe
  C:\Windows\System32\MoHKVlV.exe
  2⤵
  PID:11076
- C:\Windows\System32\gsxWmCh.exe
  C:\Windows\System32\gsxWmCh.exe
  2⤵
  PID:11092
- C:\Windows\System32\UrSIYAN.exe
  C:\Windows\System32\UrSIYAN.exe
  2⤵
  PID:11116
- C:\Windows\System32\IjByDrt.exe
  C:\Windows\System32\IjByDrt.exe
  2⤵
  PID:11136
- C:\Windows\System32\xFlWGgT.exe
  C:\Windows\System32\xFlWGgT.exe
  2⤵
  PID:11156
- C:\Windows\System32\btZQVOR.exe
  C:\Windows\System32\btZQVOR.exe
  2⤵
  PID:11180
- C:\Windows\System32\IbmVRyr.exe
  C:\Windows\System32\IbmVRyr.exe
  2⤵
  PID:11248
- C:\Windows\System32\wFTjpsB.exe
  C:\Windows\System32\wFTjpsB.exe
  2⤵
  PID:9244
- C:\Windows\System32\ZmMWimu.exe
  C:\Windows\System32\ZmMWimu.exe
  2⤵
  PID:10284
- C:\Windows\System32\HSkroZt.exe
  C:\Windows\System32\HSkroZt.exe
  2⤵
  PID:10400
- C:\Windows\System32\iCOQvNW.exe
  C:\Windows\System32\iCOQvNW.exe
  2⤵
  PID:10380
- C:\Windows\System32\JlHUHQi.exe
  C:\Windows\System32\JlHUHQi.exe
  2⤵
  PID:10416
- C:\Windows\System32\RAjRukc.exe
  C:\Windows\System32\RAjRukc.exe
  2⤵
  PID:10536
- C:\Windows\System32\KerzLcs.exe
  C:\Windows\System32\KerzLcs.exe
  2⤵
  PID:10548
- C:\Windows\System32\YwofamL.exe
  C:\Windows\System32\YwofamL.exe
  2⤵
  PID:10692
- C:\Windows\System32\CFWBCNt.exe
  C:\Windows\System32\CFWBCNt.exe
  2⤵
  PID:10720
- C:\Windows\System32\vPMABle.exe
  C:\Windows\System32\vPMABle.exe
  2⤵
  PID:10804
- C:\Windows\System32\nkADINa.exe
  C:\Windows\System32\nkADINa.exe
  2⤵
  PID:10836
- C:\Windows\System32\teTUJyB.exe
  C:\Windows\System32\teTUJyB.exe
  2⤵
  PID:10856
- C:\Windows\System32\olsBUHy.exe
  C:\Windows\System32\olsBUHy.exe
  2⤵
  PID:11004
- C:\Windows\System32\pvIzSOe.exe
  C:\Windows\System32\pvIzSOe.exe
  2⤵
  PID:11032
- C:\Windows\System32\XHoWRUa.exe
  C:\Windows\System32\XHoWRUa.exe
  2⤵
  PID:11084
- C:\Windows\System32\FMjUwVT.exe
  C:\Windows\System32\FMjUwVT.exe
  2⤵
  PID:11148
- C:\Windows\System32\IjoSyWM.exe
  C:\Windows\System32\IjoSyWM.exe
  2⤵
  PID:11256
- C:\Windows\System32\OKcWzgG.exe
  C:\Windows\System32\OKcWzgG.exe
  2⤵
  PID:10504
- C:\Windows\System32\kZYCKoL.exe
  C:\Windows\System32\kZYCKoL.exe
  2⤵
  PID:10480
- C:\Windows\System32\jUJOfkW.exe
  C:\Windows\System32\jUJOfkW.exe
  2⤵
  PID:10724
- C:\Windows\System32\pYckFmC.exe
  C:\Windows\System32\pYckFmC.exe
  2⤵
  PID:10864
- C:\Windows\System32\prhQlCa.exe
  C:\Windows\System32\prhQlCa.exe
  2⤵
  PID:11064
- C:\Windows\System32\JVXaqAC.exe
  C:\Windows\System32\JVXaqAC.exe
  2⤵
  PID:11112
- C:\Windows\System32\vOXoNXO.exe
  C:\Windows\System32\vOXoNXO.exe
  2⤵
  PID:10320
- C:\Windows\System32\UTbhXkV.exe
  C:\Windows\System32\UTbhXkV.exe
  2⤵
  PID:10788
- C:\Windows\System32\MDOBjQV.exe
  C:\Windows\System32\MDOBjQV.exe
  2⤵
  PID:11228
- C:\Windows\System32\VXNueTY.exe
  C:\Windows\System32\VXNueTY.exe
  2⤵
  PID:10496
- C:\Windows\System32\hbdZaQH.exe
  C:\Windows\System32\hbdZaQH.exe
  2⤵
  PID:10132
- C:\Windows\System32\wkbKoQg.exe
  C:\Windows\System32\wkbKoQg.exe
  2⤵
  PID:11284
- C:\Windows\System32\ebKtwWK.exe
  C:\Windows\System32\ebKtwWK.exe
  2⤵
  PID:11300
- C:\Windows\System32\QLpQVHm.exe
  C:\Windows\System32\QLpQVHm.exe
  2⤵
  PID:11320
- C:\Windows\System32\wrsvGSD.exe
  C:\Windows\System32\wrsvGSD.exe
  2⤵
  PID:11360
- C:\Windows\System32\POCigJw.exe
  C:\Windows\System32\POCigJw.exe
  2⤵
  PID:11400
- C:\Windows\System32\ZfZMCTm.exe
  C:\Windows\System32\ZfZMCTm.exe
  2⤵
  PID:11424
- C:\Windows\System32\oeNPaBS.exe
  C:\Windows\System32\oeNPaBS.exe
  2⤵
  PID:11444
- C:\Windows\System32\phcQNQr.exe
  C:\Windows\System32\phcQNQr.exe
  2⤵
  PID:11472
- C:\Windows\System32\SSUxvch.exe
  C:\Windows\System32\SSUxvch.exe
  2⤵
  PID:11508
- C:\Windows\System32\SGuKQYH.exe
  C:\Windows\System32\SGuKQYH.exe
  2⤵
  PID:11532
- C:\Windows\System32\CUSZUBf.exe
  C:\Windows\System32\CUSZUBf.exe
  2⤵
  PID:11556
- C:\Windows\System32\xLKoZvJ.exe
  C:\Windows\System32\xLKoZvJ.exe
  2⤵
  PID:11572
- C:\Windows\System32\wlVvNcc.exe
  C:\Windows\System32\wlVvNcc.exe
  2⤵
  PID:11592
- C:\Windows\System32\BkCdFSH.exe
  C:\Windows\System32\BkCdFSH.exe
  2⤵
  PID:11616
- C:\Windows\System32\UCPXdpC.exe
  C:\Windows\System32\UCPXdpC.exe
  2⤵
  PID:11644
- C:\Windows\System32\PikfRhR.exe
  C:\Windows\System32\PikfRhR.exe
  2⤵
  PID:11676
- C:\Windows\System32\HTZhUBD.exe
  C:\Windows\System32\HTZhUBD.exe
  2⤵
  PID:11724
- C:\Windows\System32\bxAEOUw.exe
  C:\Windows\System32\bxAEOUw.exe
  2⤵
  PID:11756
- C:\Windows\System32\tGWTLyw.exe
  C:\Windows\System32\tGWTLyw.exe
  2⤵
  PID:11780
- C:\Windows\System32\iMPTOtp.exe
  C:\Windows\System32\iMPTOtp.exe
  2⤵
  PID:11800
- C:\Windows\System32\YCbQDlR.exe
  C:\Windows\System32\YCbQDlR.exe
  2⤵
  PID:11824
- C:\Windows\System32\kaivKRY.exe
  C:\Windows\System32\kaivKRY.exe
  2⤵
  PID:11844
- C:\Windows\System32\hMSXUEA.exe
  C:\Windows\System32\hMSXUEA.exe
  2⤵
  PID:11884
- C:\Windows\System32\KwLSqvK.exe
  C:\Windows\System32\KwLSqvK.exe
  2⤵
  PID:11936
- C:\Windows\System32\ismhSCX.exe
  C:\Windows\System32\ismhSCX.exe
  2⤵
  PID:11964
- C:\Windows\System32\URBKjXR.exe
  C:\Windows\System32\URBKjXR.exe
  2⤵
  PID:11980
- C:\Windows\System32\OewYnUO.exe
  C:\Windows\System32\OewYnUO.exe
  2⤵
  PID:12008
- C:\Windows\System32\IiAXdGa.exe
  C:\Windows\System32\IiAXdGa.exe
  2⤵
  PID:12048
- C:\Windows\System32\TekHUWS.exe
  C:\Windows\System32\TekHUWS.exe
  2⤵
  PID:12068
- C:\Windows\System32\nZdKqCu.exe
  C:\Windows\System32\nZdKqCu.exe
  2⤵
  PID:12104
- C:\Windows\System32\nxrweTa.exe
  C:\Windows\System32\nxrweTa.exe
  2⤵
  PID:12124
- C:\Windows\System32\fcNZCIJ.exe
  C:\Windows\System32\fcNZCIJ.exe
  2⤵
  PID:12148
- C:\Windows\System32\NdVBTZu.exe
  C:\Windows\System32\NdVBTZu.exe
  2⤵
  PID:12188
- C:\Windows\System32\Yjweqjh.exe
  C:\Windows\System32\Yjweqjh.exe
  2⤵
  PID:12208
- C:\Windows\System32\YgFnvbh.exe
  C:\Windows\System32\YgFnvbh.exe
  2⤵
  PID:12256
- C:\Windows\System32\yOjsjnI.exe
  C:\Windows\System32\yOjsjnI.exe
  2⤵
  PID:12276
- C:\Windows\System32\zZjnTVm.exe
  C:\Windows\System32\zZjnTVm.exe
  2⤵
  PID:11296
- C:\Windows\System32\gGczfGU.exe
  C:\Windows\System32\gGczfGU.exe
  2⤵
  PID:11292
- C:\Windows\System32\dagbZKo.exe
  C:\Windows\System32\dagbZKo.exe
  2⤵
  PID:11392
- C:\Windows\System32\tqzROAc.exe
  C:\Windows\System32\tqzROAc.exe
  2⤵
  PID:11480
- C:\Windows\System32\qRFVwkg.exe
  C:\Windows\System32\qRFVwkg.exe
  2⤵
  PID:11548
- C:\Windows\System32\PKZxlsp.exe
  C:\Windows\System32\PKZxlsp.exe
  2⤵
  PID:11608
- C:\Windows\System32\KZBDIKB.exe
  C:\Windows\System32\KZBDIKB.exe
  2⤵
  PID:11664
- C:\Windows\System32\QibEAdx.exe
  C:\Windows\System32\QibEAdx.exe
  2⤵
  PID:11688
- C:\Windows\System32\aaDKKga.exe
  C:\Windows\System32\aaDKKga.exe
  2⤵
  PID:11768
- C:\Windows\System32\wNUdBcH.exe
  C:\Windows\System32\wNUdBcH.exe
  2⤵
  PID:11836
- C:\Windows\System32\ptJYFfY.exe
  C:\Windows\System32\ptJYFfY.exe
  2⤵
  PID:11908
- C:\Windows\System32\wUrsSHB.exe
  C:\Windows\System32\wUrsSHB.exe
  2⤵
  PID:11972
- C:\Windows\System32\JeDStFE.exe
  C:\Windows\System32\JeDStFE.exe
  2⤵
  PID:12076
- C:\Windows\System32\knEJcUk.exe
  C:\Windows\System32\knEJcUk.exe
  2⤵
  PID:12144
- C:\Windows\System32\UKWptyx.exe
  C:\Windows\System32\UKWptyx.exe
  2⤵
  PID:12176
- C:\Windows\System32\aEHOPHB.exe
  C:\Windows\System32\aEHOPHB.exe
  2⤵
  PID:11272
- C:\Windows\System32\TlYadJA.exe
  C:\Windows\System32\TlYadJA.exe
  2⤵
  PID:11316
- C:\Windows\System32\yiVTQCA.exe
  C:\Windows\System32\yiVTQCA.exe
  2⤵
  PID:11528
- C:\Windows\System32\mqVKRWg.exe
  C:\Windows\System32\mqVKRWg.exe
  2⤵
  PID:11696
- C:\Windows\System32\oncMnOg.exe
  C:\Windows\System32\oncMnOg.exe
  2⤵
  PID:11776
- C:\Windows\System32\gFYKeMs.exe
  C:\Windows\System32\gFYKeMs.exe
  2⤵
  PID:12040
- C:\Windows\System32\WCPBGol.exe
  C:\Windows\System32\WCPBGol.exe
  2⤵
  PID:12156
- C:\Windows\System32\CFbDczv.exe
  C:\Windows\System32\CFbDczv.exe
  2⤵
  PID:11340
- C:\Windows\System32\aludhke.exe
  C:\Windows\System32\aludhke.exe
  2⤵
  PID:1868
- C:\Windows\System32\LNjxIEf.exe
  C:\Windows\System32\LNjxIEf.exe
  2⤵
  PID:11752
- C:\Windows\System32\dViZanF.exe
  C:\Windows\System32\dViZanF.exe
  2⤵
  PID:11860
- C:\Windows\System32\rSqIqIl.exe
  C:\Windows\System32\rSqIqIl.exe
  2⤵
  PID:11636
- C:\Windows\System32\kZtQRVx.exe
  C:\Windows\System32\kZtQRVx.exe
  2⤵
  PID:12132
- C:\Windows\System32\aTnLFDK.exe
  C:\Windows\System32\aTnLFDK.exe
  2⤵
  PID:12304
- C:\Windows\System32\jjRiARF.exe
  C:\Windows\System32\jjRiARF.exe
  2⤵
  PID:12336
- C:\Windows\System32\fZhgiDG.exe
  C:\Windows\System32\fZhgiDG.exe
  2⤵
  PID:12376
- C:\Windows\System32\JlIjdrN.exe
  C:\Windows\System32\JlIjdrN.exe
  2⤵
  PID:12396
- C:\Windows\System32\gjIVcoY.exe
  C:\Windows\System32\gjIVcoY.exe
  2⤵
  PID:12420
- C:\Windows\System32\FPqjVIa.exe
  C:\Windows\System32\FPqjVIa.exe
  2⤵
  PID:12436
- C:\Windows\System32\EvLfhAX.exe
  C:\Windows\System32\EvLfhAX.exe
  2⤵
  PID:12476
- C:\Windows\System32\SQgqrSE.exe
  C:\Windows\System32\SQgqrSE.exe
  2⤵
  PID:12512
- C:\Windows\System32\JbYnHPm.exe
  C:\Windows\System32\JbYnHPm.exe
  2⤵
  PID:12540
- C:\Windows\System32\YIBWmKy.exe
  C:\Windows\System32\YIBWmKy.exe
  2⤵
  PID:12560
- C:\Windows\System32\WHIhLfp.exe
  C:\Windows\System32\WHIhLfp.exe
  2⤵
  PID:12604
- C:\Windows\System32\mZzjVkS.exe
  C:\Windows\System32\mZzjVkS.exe
  2⤵
  PID:12628
- C:\Windows\System32\cBdRhqO.exe
  C:\Windows\System32\cBdRhqO.exe
  2⤵
  PID:12644
- C:\Windows\System32\gYoCFQg.exe
  C:\Windows\System32\gYoCFQg.exe
  2⤵
  PID:12664
- C:\Windows\System32\NmXKHzk.exe
  C:\Windows\System32\NmXKHzk.exe
  2⤵
  PID:12688
- C:\Windows\System32\vodKoTa.exe
  C:\Windows\System32\vodKoTa.exe
  2⤵
  PID:12704
- C:\Windows\System32\QsQAvMz.exe
  C:\Windows\System32\QsQAvMz.exe
  2⤵
  PID:12732
- C:\Windows\System32\RzTLMWm.exe
  C:\Windows\System32\RzTLMWm.exe
  2⤵
  PID:12748
- C:\Windows\System32\gsWqnrb.exe
  C:\Windows\System32\gsWqnrb.exe
  2⤵
  PID:12776
- C:\Windows\System32\ZmyWqnk.exe
  C:\Windows\System32\ZmyWqnk.exe
  2⤵
  PID:12836
- C:\Windows\System32\QEkMZWb.exe
  C:\Windows\System32\QEkMZWb.exe
  2⤵
  PID:12892
- C:\Windows\System32\gPwKojj.exe
  C:\Windows\System32\gPwKojj.exe
  2⤵
  PID:12908
- C:\Windows\System32\XuUfJEU.exe
  C:\Windows\System32\XuUfJEU.exe
  2⤵
  PID:12936
- C:\Windows\System32\VoFNpUU.exe
  C:\Windows\System32\VoFNpUU.exe
  2⤵
  PID:12964
- C:\Windows\System32\TDMMynJ.exe
  C:\Windows\System32\TDMMynJ.exe
  2⤵
  PID:12980
- C:\Windows\System32\ulkGvyq.exe
  C:\Windows\System32\ulkGvyq.exe
  2⤵
  PID:13000
- C:\Windows\System32\LWAEFUs.exe
  C:\Windows\System32\LWAEFUs.exe
  2⤵
  PID:13024
- C:\Windows\System32\hGEULtx.exe
  C:\Windows\System32\hGEULtx.exe
  2⤵
  PID:13072
- C:\Windows\System32\pOzRltl.exe
  C:\Windows\System32\pOzRltl.exe
  2⤵
  PID:13100
- C:\Windows\System32\TFszAYl.exe
  C:\Windows\System32\TFszAYl.exe
  2⤵
  PID:13132
- C:\Windows\System32\gLQkTMA.exe
  C:\Windows\System32\gLQkTMA.exe
  2⤵
  PID:13148
- C:\Windows\System32\KdxaeGk.exe
  C:\Windows\System32\KdxaeGk.exe
  2⤵
  PID:13168
- C:\Windows\System32\SEewBqO.exe
  C:\Windows\System32\SEewBqO.exe
  2⤵
  PID:13184
- C:\Windows\System32\NGjNuCM.exe
  C:\Windows\System32\NGjNuCM.exe
  2⤵
  PID:13212
- C:\Windows\System32\VsAzuSx.exe
  C:\Windows\System32\VsAzuSx.exe
  2⤵
  PID:13228
- C:\Windows\System32\mwndePS.exe
  C:\Windows\System32\mwndePS.exe
  2⤵
  PID:13264
- C:\Windows\System32\ZflxxOk.exe
  C:\Windows\System32\ZflxxOk.exe
  2⤵
  PID:13308
- C:\Windows\System32\jNCgDYJ.exe
  C:\Windows\System32\jNCgDYJ.exe
  2⤵
  PID:12324
- C:\Windows\System32\lLYeyms.exe
  C:\Windows\System32\lLYeyms.exe
  2⤵
  PID:12416
- C:\Windows\System32\QXmvMhF.exe
  C:\Windows\System32\QXmvMhF.exe
  2⤵
  PID:12488
- C:\Windows\System32\jsfrThN.exe
  C:\Windows\System32\jsfrThN.exe
  2⤵
  PID:12548
- C:\Windows\System32\ChyoVLq.exe
  C:\Windows\System32\ChyoVLq.exe
  2⤵
  PID:12568
- C:\Windows\System32\ZAEVEpd.exe
  C:\Windows\System32\ZAEVEpd.exe
  2⤵
  PID:12672
- C:\Windows\System32\eppffAE.exe
  C:\Windows\System32\eppffAE.exe
  2⤵
  PID:12720
- C:\Windows\System32\NtDkOud.exe
  C:\Windows\System32\NtDkOud.exe
  2⤵
  PID:12820
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 12820 -s 244
    3⤵
    PID:1016
- C:\Windows\System32\pnmXUZA.exe
  C:\Windows\System32\pnmXUZA.exe
  2⤵
  PID:12880
- C:\Windows\System32\dAFUiNX.exe
  C:\Windows\System32\dAFUiNX.exe
  2⤵
  PID:12924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\BUWaUmz.exe

Filesize
1.5MB

MD5
80d84c318267728a9593bbb18bebf252

SHA1
9ee74c97d4681e6a07cecea5097fc5079fba755f

SHA256
fb51eaf97f41400a1a59f3ea2aaafee2e7e2113c8b2c3d335307e2c0855264fb

SHA512
a1d91a84cec5602858c58195667609cb2ee0ffd8dddc0d74cf81eab7197c643e67eedaf50a32f951d1e8aa104cfe26d5cf1c1da82c51894e15be2086662f022a

Download Submit
C:\Windows\System32\BXvprBT.exe

Filesize
1.5MB

MD5
5bc3dfe5e88f0d477c1745c1ecd897f0

SHA1
248b3466c5cf7eb86ebd7840fd78e5836b3b20b5

SHA256
fbed57b979a03c4e8d18245ea38bc64ece5dc47e335c103d53a3dfb6be3b7e80

SHA512
70dec24c3873f44fad120382caae421952c7328e63aaf39d7c13c3a27e7420457ebbefd33cde0683c1ea9c6e58d9113b1ccdb2717eabe29e7a303e4bf10f5a5d

Download Submit
C:\Windows\System32\CmxoKXN.exe

Filesize
1.5MB

MD5
79a3988054e71caa922ebef1cf837840

SHA1
12efc0f1252aa50164575d099b070b815fec5582

SHA256
b895a7c79d65194fb77917e87e00a2068606a818370dfe4cc82f94219a99848f

SHA512
f2a01ba51ae46d3f5bd2c0cd3658c4d366771c67a1df6364373cf2bc341dad6033564b7d8f3f2776bffd32d3b6048e82c0f811f83fc80b89c358cd4fc9fb2e5c

Download Submit
C:\Windows\System32\DhGwDjJ.exe

Filesize
1.5MB

MD5
bb34b88adeff1e84672faf73267ef94d

SHA1
7a7f65de90cb51af897a882cf92b5d20d78a1120

SHA256
bdc1f001097ab5ab7a524b8a9adbbcbf2a76441ac99e775ffdfe1564992482ef

SHA512
ee4b8595519d7c1dce1cee7fab44b6a350d856c4741cbd69f9658dab312b42e7f490764f351f58295b7bb240e4fa08a9d79b046c2cab0d2a866f4f428b36d3fb

Download Submit
C:\Windows\System32\EOxOKhM.exe

Filesize
1.5MB

MD5
60303e9686b58935a395978d13a36a2a

SHA1
7078eb4a29e84338be5f8c3018b3cb283989004f

SHA256
34588917fa4ca101bc447c0b63e4fcd6cfbcf7fc4431399a7a5736c26c3b4e0a

SHA512
c2e19f4288867bb97f426bd3764dda5ca3597e3559714d2a089d1bc7b5a0c08b88a979b65c770f1cd2f6e41e17450d1ac177a13991f2fc85aa588357f09eb7d7

Download Submit
C:\Windows\System32\FGOhkRp.exe

Filesize
1.5MB

MD5
7c7bf32bfb57d2688ea63fdf5064c7f8

SHA1
5464a4bc5c88e17dfd5e17dec47cf2436256947c

SHA256
900bbbdc647190b8d3b293304eba28a86ca8cf663a8e8b838534fa11a6e0882e

SHA512
fe918efdccbaf51b1c1c010d1717cede50526a6567a29646bb240ce8ad280e6e54e2398c167c218e51f4de1467935b9ecb224ec50eda681511986910fdb4ef72

Download Submit
C:\Windows\System32\JwiebTC.exe

Filesize
1.5MB

MD5
ac582f30f12f450f23b4a83331edcd7d

SHA1
6289f106d0328a8e7367e82e15a144b81bf7ac0b

SHA256
6002886d36491ad3a557432d091ac5a5c1fa8987dc0dbdcea1c493c6fa946576

SHA512
b703f9e3b9ad4663a47f16c2fb85484ff472ac88215484986449bde6babefa18810ba0db83002dedd1751d796aa32003daafa86702319ebdf3de92158e46c1d3

Download Submit
C:\Windows\System32\JyifRsy.exe

Filesize
1.5MB

MD5
3d13b2d0cd41ff901fbd02b9803abe10

SHA1
23675adcd7b32c038731d1be00f723451ba4d6bc

SHA256
80753ccb6d5dcac1c78f46cb301cd3e8a50aa75b6724f63b01409b2c1692d3cd

SHA512
a14ced759822f16ee29e3b13da56bd16f62f5031215db6cb81db5c63d1b26e803d6f4a3dc4bf9fbafca3451f0fe81be617defedb2fde29e4c134034cd96d2346

Download Submit
C:\Windows\System32\KaAatuG.exe

Filesize
1.5MB

MD5
e26edbc6a0f8b7e3cc008844975505a0

SHA1
b5671b4e38db258a23ea93a9de4ef2d04eeb4fad

SHA256
2afdbbe0316c0fb754173495eab624642b45e21dee885f02f1426dfe7c6beeea

SHA512
1c6372593de2aeefcebc06b6ea4dc84b81f001f98d82cc388bc627f03fb5f02637ec5ce162b5e3bebdf349f846968886e1f872dfd05b665119cf30e9805e1969

Download Submit
C:\Windows\System32\PZjvPQD.exe

Filesize
1.5MB

MD5
c8f10f80c0f30e7c6e150ffea0430cf3

SHA1
e54633fa649890d2b653fae148aca7cc9ee9f7c2

SHA256
680a4500e1061c1028d2a7aa4d8efa02af20f9c8b27e96c94c0b4154cfe6334f

SHA512
88c77ed9d1abdfaec5b7f30bc8900b5546add601440c578701618c2850731f3c8236ada45a180de00d0c5f79285c5a6881b24ba433657655f5eea5a0d7a30f61

Download Submit
C:\Windows\System32\PdxQUaZ.exe

Filesize
1.5MB

MD5
9fda02910a4229742efae2f439d4bf38

SHA1
67e129d5444aab5fede7793a80dbf3c0aecfdd1a

SHA256
2b4ff8b375b4e05a0d64acc069a40c02d5d5daa27e28958ecb4ac4372124c478

SHA512
72375ae04d2b52d316adad0837b863fa02aeea119664e5038247a21c7a9f5a74c5a3baad462dbdc3d7885eda19164711a476f29946134250d0f5458ea565e292

Download Submit
C:\Windows\System32\SusFDSS.exe

Filesize
1.5MB

MD5
87d4394165971e6845ede78fc7dfcdd1

SHA1
6e545cef0b4d7993f281a849edf00c83bf8fe144

SHA256
8f6def72fd7ceb21b5b3a6abb0f4d278b45d0414f0a65bfaff28b794b56face8

SHA512
23fa561ebc3df8cc113f1601b88f9b81d3a8c88ae3dd3b89c5dda8da04866a9849a1f73c805bf43c934f6ec1c1674bfa8b3d545393e355d3dc08eed5816a015f

Download Submit
C:\Windows\System32\YbhYwSm.exe

Filesize
1.5MB

MD5
a8de7a8d496c26acbbfe8827c124ef4b

SHA1
3a29756024ac33b42007a8335b72aa69b178be22

SHA256
ae4910f1c2a3752e293d88df1d3fd033bdc417683c2720af14b1288f7b852dee

SHA512
ed9c71749ee667627db8dff672e3d4fd8b368594dca3cc0d3050faa8074a78fb37ad8af18ef9505431b61d8bdc9bda5864c068bbdbb75d2dbea1dde5a4728db8

Download Submit
C:\Windows\System32\bDDluuf.exe

Filesize
1.5MB

MD5
0af6e0303b86e3705ba1e0be26bf0307

SHA1
6ecd2bc1b35c0442d24f15915f0043b2a7251f7e

SHA256
c0a72a32ec6cdffc402beb258dece5fbbb251323f65c415d07fade27e8b3e487

SHA512
7da1aad2b2555e48796ba31d00a41b584c9116a4a6621b06200b1647ebdede90db5dafa614b068124a26bd0e769db2e4967c545ee50aca49a13c0bed83b1d5ed

Download Submit
C:\Windows\System32\bNmYssw.exe

Filesize
1.5MB

MD5
e425fe70f402c83deab2658bdfa36765

SHA1
76f2633a1bca34e294267080cc47a46e27581439

SHA256
72a469722f057ffb30295c03c5a6ac40f9e4b58fc6a507ab7fe7470a0446249c

SHA512
b1d2c0daa8a1a12094c69dc1f495174e2572992b754c6b4a2d446467cbf24c11192d2aa8a256f9c11d85e21cd57f6ffab47445c7f38f4b185e7ded85611153bc

Download Submit
C:\Windows\System32\cDSHfuc.exe

Filesize
1.5MB

MD5
a29a03c777e95b911404f2b5e75cfcf1

SHA1
32c2706db4692a59a0a5a64489b26a9d8c345a30

SHA256
a5c510001aded3a265df333b9070245d1aa9998df0ffdbd02b74f800f7947e95

SHA512
31eccf5791da104433b7567b3c7d15840769cf7dc139e81f3338a82074d6885cbf709f39218a63713c794f549549ee57ac9ba7365f75d6db7933c40e5ebb20ae

Download Submit
C:\Windows\System32\eNjUeJB.exe

Filesize
1.5MB

MD5
e5f2284af165862468e1616c452e07d1

SHA1
58af3438721739deb805c63c678617317b42d1c5

SHA256
cfb82d6fbb2e0369081f290d4198214b667dbd429b3d31356ac6f49b2918b1a3

SHA512
4b5a5ccbe5ff04ab0d452212e4f50c40ea98f87ad1e4efb5bbd4722862e3afb8450764aa49505981dd3855bbeabcd380fba3d5fd9ed436dd6ecbdb71376e2929

Download Submit
C:\Windows\System32\eqhMpHk.exe

Filesize
1.5MB

MD5
b908856cf86a3c7fe69d0846506032bc

SHA1
a6dddde7fc2ad638ef6682bd13d68a110bbfb214

SHA256
27883a7f4546d63bb15950bc435d4c1e30309841c0434a53d392ea3b9a3013df

SHA512
5e28b22a6b3e5a2557906e93b6280cee87d56368105a2f6b94ead06c86e02acc56d935a626e60edf416d5b573b1cd82c50d29d9fb09cc27fc3ec7e8613f93544

Download Submit
C:\Windows\System32\fjGhnyI.exe

Filesize
1.5MB

MD5
b0f517690aff44d0faaaacbed33c4e5e

SHA1
5bb9c5286b9be196a431c0506d6f15b5267f4893

SHA256
9dcebb8b5d20ae5b9b0e5809c3cc65557b4cf396976d97913316f5df3c8c126d

SHA512
b534ce78059df56037794dd2c1079eda6276950fd53263214fc14e784b64560ef8eab2f1fe726a94f96ead34013218632f49cffbe8089b16b5dad3aedd405eef

Download Submit
C:\Windows\System32\fwZmNnR.exe

Filesize
1.5MB

MD5
6e89a87afa48531916436e15aa6fca27

SHA1
3cd844a660dea52ace76361edb7d53455f71c08b

SHA256
fbfd3316738911363058ad8342d671626b597df4852adb11b36c2d487eadbda2

SHA512
15dfd2c969af6c1c4839f67dfadd0bd815352b410da859b5507087ad7833062a3753eaa9158b51b71d86e0bba163607afde584edd42a5b8477083044ab9902a2

Download Submit
C:\Windows\System32\hWoqvgP.exe

Filesize
1.5MB

MD5
b6376ef8a644c41b1903bd3dad337636

SHA1
dce0dbb5ed5942e6bbaba46aea3693ca48288e61

SHA256
fa11bfd9a573cf180e8ace686793e85f26a3e435ff865787c832c6f58101a61c

SHA512
c00dc6afb499fe0b1f5c35b5fec2f4e37428bb7dcadc1cf467d687fc99bc9d03c821ba4e620c47c28a272ee35a0982eb6ef422fc23a65f325dab9f0eb8e6b726

Download Submit
C:\Windows\System32\jpcGOaE.exe

Filesize
1.5MB

MD5
b8330c7c958ecdef3d5a2a8f843bf6f0

SHA1
9707609aa22066dc304c2f6895d64199d882b9ae

SHA256
63e200cb95d341e1dcab8c526beb055568b99ef19f2b8f0444033c798a6431c3

SHA512
5c16350cc9f9ad7b374efc7a35ab189593b3fff72d22f421cb863b5669f59c32bae3cae8b10f0f500438e3dac0621a982c908395dc247a5daab90f40f63d4a65

Download Submit
C:\Windows\System32\jsxHzao.exe

Filesize
1.5MB

MD5
8cbeb07b1300aa2e23b1bab671fa75dc

SHA1
f360dbe18f9024aeb5772de9c42446b471eb7702

SHA256
da88b5841974de5fb9f26da9613243630d7439d0e0ad5cbc3780194dbee3e713

SHA512
4f51f1278cdd97367e515684cbe2624824b1d79c09c9d2a58b979849069584f3afd8821066ed46e5fbfc2dc89f436d2483390bfe1380d7f2b4e252bf6a96e434

Download Submit
C:\Windows\System32\kXNANSI.exe

Filesize
1.5MB

MD5
39e363421711b36de8b6f1b9f696b505

SHA1
21d51501cd1fd18d845ee42334a8dc8d9522ad55

SHA256
f9ccc3c2c27bfd0100e72fc6d063c55b1f47deb8f120330e496a96797e7b8cfd

SHA512
abb78197922be561cea436b7539c880cea1a0a8d9d4340642dea68dc4e76df9678706c09d8c89e0cf4da9f7f8fdb600748a8e05f9992c5a248398d3478ddb80d

Download Submit
C:\Windows\System32\rnMOqpk.exe

Filesize
1.5MB

MD5
5192940dd9174bda8e6e9bf6fbd20a06

SHA1
381f6370a8a0da1522ff9efb11f60f955793d4f9

SHA256
28f8dba174e66a60fe1d2a9e5cd70b8b78c7bc684e39b52b535829681c88f295

SHA512
a98cdcb0690212cd04cfd5f7fdab384ed76f66e325da1d46139850c405ae24fa2f91e9ea74c707fdaed7d0d974d9e9dee1d07096b8b16399334646b39cd653ee

Download Submit
C:\Windows\System32\sDzKeSD.exe

Filesize
1.5MB

MD5
2696f52c6bca130edac85391324ff0c3

SHA1
9cc8eb3c4d445c6f679d5a207c634af9464ae854

SHA256
0d3123e4c7971e129f81284eb0de8880e8b0e8abe4b3f018d18cc446ef1380dc

SHA512
4fbd161f98f1a1d2595757cc0882b060be4ba0c1e29b0165065218ad1acaf0f0b3567f813bf95688695d9905b43b7ea9f2a069d82fa71ed9fc17ce02a4198bc8

Download Submit
C:\Windows\System32\tbgCCuy.exe

Filesize
1.5MB

MD5
3ab862c1d9ffcf72109e00633e2a8640

SHA1
06457d400cc8c45dab5cd9ecafb3192d63674aea

SHA256
bd012d50101d4fe53afb88854c5c2ce1a903566b243485893882c7784aa69680

SHA512
7ec7eeb2a38353e1fec40979fad9795b2d72eb3a2d3b64ea305df632571d7d7d5ebd5d8138ffdcd1f042bcf1520868fe7e8c8c669f6d4e3f75fc1c3a6d708947

Download Submit
C:\Windows\System32\tgfaUZO.exe

Filesize
1.5MB

MD5
2439aa456f30cfa32f6fda8ca1409b5e

SHA1
e74527e17dcf48c6805055e3b73a9717a74c09f4

SHA256
bb93f9ad42b5034a8df3456c89f524c4b8c1c07d1b9a92f072f32a48ee654283

SHA512
58ac8a3366e80d3d6dbcbaff30063e6580f50ab2488580b4ed1d6882a242bf97c13724b653441a150a35b3471320ec6e7075e01b8dc7b5761043a09db7506654

Download Submit
C:\Windows\System32\vkxhLHo.exe

Filesize
1.5MB

MD5
8b314b9f5f7afc63e68407305bfc42a9

SHA1
1a8519a7930e4138b1f3a02006e451f3c6cd302a

SHA256
d242a9409280c93975ea5825173d6ad431d1992cb2d1ce9de9a7e33d4c9126e1

SHA512
20beec9f79ce9d8343c1a26ccd163fb2b1929554c2734743e96b052243417e8cccec3e13c22a89db2051e694fa5de1d93307e8a540eeb734be694b55c42710ad

Download Submit
C:\Windows\System32\xCzMHpM.exe

Filesize
1.5MB

MD5
5f3f3a8ece7cfebe90302810dacceff5

SHA1
d65c4e0dc7e4f271f805657cc4b00453726df579

SHA256
9f8184a6643d9b6f0768efaaa8a75e2d99f00004e4155b014412b5e2472b8033

SHA512
e398031b6761a019202efe61cb9b775c336032ac2c7076009538e5cf84e318e5dcae023c96a53e3f0aaf0d0a7af02bcdef83a711465be13ef2713cab13c2077d

Download Submit
C:\Windows\System32\xKhjsKZ.exe

Filesize
1.5MB

MD5
a9542896463c6a31456e751133c7a906

SHA1
a109ed841c94ac4aaff577844784fc93d8051c31

SHA256
bdc7ffceafb408c868df2dc18c44c2dcaa6b128e52b5a4be6aff1e1a08659615

SHA512
f80ca7a68fc29e1d4a84f3a66a28ee08119541b9ea702f8df89f9e3b7b327ea3d235e5d721780efb3f42d1ee9e54e3fdf83651f66f6563a5d7d593698a1168ed

Download Submit
C:\Windows\System32\xqPsSYV.exe

Filesize
1.5MB

MD5
2c31b9d386fd1132639224219a687e8d

SHA1
b0f038720acffdc13ca1fad055904e97da017332

SHA256
f825b1ac486e51886c21fbca5b60d4b3ef53d150a03c8bc17e9fb451ee3c045d

SHA512
74577e7ba4a4addbf7ac1058ec8e76aec3ae914c283cfa566f44276c17437171fae02971ec158497557f50ebc9a76e8c0fabc01de1cab18d9db502969917368c

Download Submit
memory/60-2045-0x00007FF72B7B0000-0x00007FF72BBA1000-memory.dmp

Filesize
3.9MB

Download
memory/60-335-0x00007FF72B7B0000-0x00007FF72BBA1000-memory.dmp

Filesize
3.9MB

Download
memory/1236-2028-0x00007FF6E7F60000-0x00007FF6E8351000-memory.dmp

Filesize
3.9MB

Download
memory/1236-297-0x00007FF6E7F60000-0x00007FF6E8351000-memory.dmp

Filesize
3.9MB

Download
memory/1264-2023-0x00007FF679200000-0x00007FF6795F1000-memory.dmp

Filesize
3.9MB

Download
memory/1264-1969-0x00007FF679200000-0x00007FF6795F1000-memory.dmp

Filesize
3.9MB

Download
memory/1264-39-0x00007FF679200000-0x00007FF6795F1000-memory.dmp

Filesize
3.9MB

Download
memory/1364-2065-0x00007FF743A90000-0x00007FF743E81000-memory.dmp

Filesize
3.9MB

Download
memory/1364-359-0x00007FF743A90000-0x00007FF743E81000-memory.dmp

Filesize
3.9MB

Download
memory/1396-349-0x00007FF69CBA0000-0x00007FF69CF91000-memory.dmp

Filesize
3.9MB

Download
memory/1396-2050-0x00007FF69CBA0000-0x00007FF69CF91000-memory.dmp

Filesize
3.9MB

Download
memory/1928-2034-0x00007FF653B60000-0x00007FF653F51000-memory.dmp

Filesize
3.9MB

Download
memory/1928-324-0x00007FF653B60000-0x00007FF653F51000-memory.dmp

Filesize
3.9MB

Download
memory/2144-316-0x00007FF789800000-0x00007FF789BF1000-memory.dmp

Filesize
3.9MB

Download
memory/2144-2031-0x00007FF789800000-0x00007FF789BF1000-memory.dmp

Filesize
3.9MB

Download
memory/2212-2063-0x00007FF679D90000-0x00007FF67A181000-memory.dmp

Filesize
3.9MB

Download
memory/2212-363-0x00007FF679D90000-0x00007FF67A181000-memory.dmp

Filesize
3.9MB

Download
memory/2284-2073-0x00007FF638BC0000-0x00007FF638FB1000-memory.dmp

Filesize
3.9MB

Download
memory/2284-354-0x00007FF638BC0000-0x00007FF638FB1000-memory.dmp

Filesize
3.9MB

Download
memory/2444-0-0x00007FF690CB0000-0x00007FF6910A1000-memory.dmp

Filesize
3.9MB

Download
memory/2444-1-0x000002683FD20000-0x000002683FD30000-memory.dmp

Filesize
64KB

Download
memory/2820-2038-0x00007FF64D9C0000-0x00007FF64DDB1000-memory.dmp

Filesize
3.9MB

Download
memory/2820-325-0x00007FF64D9C0000-0x00007FF64DDB1000-memory.dmp

Filesize
3.9MB

Download
memory/3176-341-0x00007FF7F23C0000-0x00007FF7F27B1000-memory.dmp

Filesize
3.9MB

Download
memory/3176-2067-0x00007FF7F23C0000-0x00007FF7F27B1000-memory.dmp

Filesize
3.9MB

Download
memory/3180-2025-0x00007FF749540000-0x00007FF749931000-memory.dmp

Filesize
3.9MB

Download
memory/3180-41-0x00007FF749540000-0x00007FF749931000-memory.dmp

Filesize
3.9MB

Download
memory/3260-2012-0x00007FF7C21E0000-0x00007FF7C25D1000-memory.dmp

Filesize
3.9MB

Download
memory/3260-20-0x00007FF7C21E0000-0x00007FF7C25D1000-memory.dmp

Filesize
3.9MB

Download
memory/3260-1967-0x00007FF7C21E0000-0x00007FF7C25D1000-memory.dmp

Filesize
3.9MB

Download
memory/3448-362-0x00007FF73EC30000-0x00007FF73F021000-memory.dmp

Filesize
3.9MB

Download
memory/3448-2040-0x00007FF73EC30000-0x00007FF73F021000-memory.dmp

Filesize
3.9MB

Download
memory/3484-49-0x00007FF650270000-0x00007FF650661000-memory.dmp

Filesize
3.9MB

Download
memory/3484-2019-0x00007FF650270000-0x00007FF650661000-memory.dmp

Filesize
3.9MB

Download
memory/3484-2003-0x00007FF650270000-0x00007FF650661000-memory.dmp

Filesize
3.9MB

Download
memory/3516-2042-0x00007FF6D6970000-0x00007FF6D6D61000-memory.dmp

Filesize
3.9MB

Download
memory/3516-357-0x00007FF6D6970000-0x00007FF6D6D61000-memory.dmp

Filesize
3.9MB

Download
memory/3536-2032-0x00007FF7C1450000-0x00007FF7C1841000-memory.dmp

Filesize
3.9MB

Download
memory/3536-305-0x00007FF7C1450000-0x00007FF7C1841000-memory.dmp

Filesize
3.9MB

Download
memory/3856-2014-0x00007FF7BAA40000-0x00007FF7BAE31000-memory.dmp

Filesize
3.9MB

Download
memory/3856-33-0x00007FF7BAA40000-0x00007FF7BAE31000-memory.dmp

Filesize
3.9MB

Download
memory/4384-2026-0x00007FF694440000-0x00007FF694831000-memory.dmp

Filesize
3.9MB

Download
memory/4384-27-0x00007FF694440000-0x00007FF694831000-memory.dmp

Filesize
3.9MB

Download
memory/4384-1968-0x00007FF694440000-0x00007FF694831000-memory.dmp

Filesize
3.9MB

Download
memory/4416-291-0x00007FF645660000-0x00007FF645A51000-memory.dmp

Filesize
3.9MB

Download
memory/4416-2017-0x00007FF645660000-0x00007FF645A51000-memory.dmp

Filesize
3.9MB

Download
memory/4648-360-0x00007FF629A00000-0x00007FF629DF1000-memory.dmp

Filesize
3.9MB

Download
memory/4648-2044-0x00007FF629A00000-0x00007FF629DF1000-memory.dmp

Filesize
3.9MB

Download
memory/4792-2010-0x00007FF6F16E0000-0x00007FF6F1AD1000-memory.dmp

Filesize
3.9MB

Download
memory/4792-11-0x00007FF6F16E0000-0x00007FF6F1AD1000-memory.dmp

Filesize
3.9MB

Download
memory/4872-361-0x00007FF7F4720000-0x00007FF7F4B11000-memory.dmp

Filesize
3.9MB

Download
memory/4872-2048-0x00007FF7F4720000-0x00007FF7F4B11000-memory.dmp

Filesize
3.9MB

Download
memory/5080-2021-0x00007FF708B10000-0x00007FF708F01000-memory.dmp

Filesize
3.9MB

Download
memory/5080-47-0x00007FF708B10000-0x00007FF708F01000-memory.dmp

Filesize
3.9MB

Download
memory/5080-1971-0x00007FF708B10000-0x00007FF708F01000-memory.dmp

Filesize
3.9MB

Download