xmrig | 37b4336e8448c6a3f204d922baade433d31882617219aa78ad477639f539ed2f

Analysis

max time kernel
134s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 14:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
Size 1.0MB
Sample240522-r1eq5aef33
SHA256 37b4336e8448c6a3f204d922baade433d31882617219aa78ad477639f539ed2f
MD5 679a9f984f5a2e1ed566648b2b5faa1a
SHA1 92babcf4f66e50421e3bdc08d17e9c2c9dd97cd5
SHA512 fd277d0ae8a0f37d7bc3106ad94fdfa40fcc551ede896647d76d96fc854eabc96bd9fc6afa6248c4096ee888234999cabcfbc2da63e5697cd5d05da0e2452e71
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBZ:knw9oUUEEDl37jcq4/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/4728-20-0x00007FF78A630000-0x00007FF78AA21000-memory.dmp	xmrig
behavioral2/memory/4452-37-0x00007FF707230000-0x00007FF707621000-memory.dmp	xmrig
behavioral2/memory/1916-22-0x00007FF7E2470000-0x00007FF7E2861000-memory.dmp	xmrig
behavioral2/memory/5108-44-0x00007FF6B5F30000-0x00007FF6B6321000-memory.dmp	xmrig
behavioral2/memory/2976-49-0x00007FF652340000-0x00007FF652731000-memory.dmp	xmrig
behavioral2/memory/3036-379-0x00007FF7E9560000-0x00007FF7E9951000-memory.dmp	xmrig
behavioral2/memory/1040-388-0x00007FF6988C0000-0x00007FF698CB1000-memory.dmp	xmrig
behavioral2/memory/4984-399-0x00007FF75C230000-0x00007FF75C621000-memory.dmp	xmrig
behavioral2/memory/2316-409-0x00007FF68D7E0000-0x00007FF68DBD1000-memory.dmp	xmrig
behavioral2/memory/3832-412-0x00007FF7688E0000-0x00007FF768CD1000-memory.dmp	xmrig
behavioral2/memory/1524-413-0x00007FF6E23B0000-0x00007FF6E27A1000-memory.dmp	xmrig
behavioral2/memory/1036-407-0x00007FF7D3E20000-0x00007FF7D4211000-memory.dmp	xmrig
behavioral2/memory/4016-428-0x00007FF7C1830000-0x00007FF7C1C21000-memory.dmp	xmrig
behavioral2/memory/2880-439-0x00007FF730490000-0x00007FF730881000-memory.dmp	xmrig
behavioral2/memory/3044-449-0x00007FF7D9EE0000-0x00007FF7DA2D1000-memory.dmp	xmrig
behavioral2/memory/4912-454-0x00007FF7F1E90000-0x00007FF7F2281000-memory.dmp	xmrig
behavioral2/memory/2640-457-0x00007FF788F90000-0x00007FF789381000-memory.dmp	xmrig
behavioral2/memory/3160-448-0x00007FF7D7EC0000-0x00007FF7D82B1000-memory.dmp	xmrig
behavioral2/memory/4384-443-0x00007FF765870000-0x00007FF765C61000-memory.dmp	xmrig
behavioral2/memory/2800-436-0x00007FF605B80000-0x00007FF605F71000-memory.dmp	xmrig
behavioral2/memory/2908-435-0x00007FF70BF30000-0x00007FF70C321000-memory.dmp	xmrig
behavioral2/memory/2872-42-0x00007FF7C7070000-0x00007FF7C7461000-memory.dmp	xmrig
behavioral2/memory/3596-1993-0x00007FF7BDB20000-0x00007FF7BDF11000-memory.dmp	xmrig
behavioral2/memory/5108-1994-0x00007FF6B5F30000-0x00007FF6B6321000-memory.dmp	xmrig
behavioral2/memory/3892-2027-0x00007FF6522D0000-0x00007FF6526C1000-memory.dmp	xmrig
behavioral2/memory/3596-2042-0x00007FF7BDB20000-0x00007FF7BDF11000-memory.dmp	xmrig
behavioral2/memory/4728-2046-0x00007FF78A630000-0x00007FF78AA21000-memory.dmp	xmrig
behavioral2/memory/1916-2045-0x00007FF7E2470000-0x00007FF7E2861000-memory.dmp	xmrig
behavioral2/memory/4452-2050-0x00007FF707230000-0x00007FF707621000-memory.dmp	xmrig
behavioral2/memory/2976-2066-0x00007FF652340000-0x00007FF652731000-memory.dmp	xmrig
behavioral2/memory/5108-2071-0x00007FF6B5F30000-0x00007FF6B6321000-memory.dmp	xmrig
behavioral2/memory/4016-2078-0x00007FF7C1830000-0x00007FF7C1C21000-memory.dmp	xmrig
behavioral2/memory/2880-2080-0x00007FF730490000-0x00007FF730881000-memory.dmp	xmrig
behavioral2/memory/4384-2084-0x00007FF765870000-0x00007FF765C61000-memory.dmp	xmrig
behavioral2/memory/3160-2082-0x00007FF7D7EC0000-0x00007FF7D82B1000-memory.dmp	xmrig
behavioral2/memory/2800-2076-0x00007FF605B80000-0x00007FF605F71000-memory.dmp	xmrig
behavioral2/memory/2908-2074-0x00007FF70BF30000-0x00007FF70C321000-memory.dmp	xmrig
behavioral2/memory/1524-2072-0x00007FF6E23B0000-0x00007FF6E27A1000-memory.dmp	xmrig
behavioral2/memory/3832-2068-0x00007FF7688E0000-0x00007FF768CD1000-memory.dmp	xmrig
behavioral2/memory/3892-2063-0x00007FF6522D0000-0x00007FF6526C1000-memory.dmp	xmrig
behavioral2/memory/4984-2058-0x00007FF75C230000-0x00007FF75C621000-memory.dmp	xmrig
behavioral2/memory/1036-2057-0x00007FF7D3E20000-0x00007FF7D4211000-memory.dmp	xmrig
behavioral2/memory/3036-2065-0x00007FF7E9560000-0x00007FF7E9951000-memory.dmp	xmrig
behavioral2/memory/1040-2054-0x00007FF6988C0000-0x00007FF698CB1000-memory.dmp	xmrig
behavioral2/memory/2640-2061-0x00007FF788F90000-0x00007FF789381000-memory.dmp	xmrig
behavioral2/memory/2316-2053-0x00007FF68D7E0000-0x00007FF68DBD1000-memory.dmp	xmrig
behavioral2/memory/2872-2049-0x00007FF7C7070000-0x00007FF7C7461000-memory.dmp	xmrig
behavioral2/memory/4912-2114-0x00007FF7F1E90000-0x00007FF7F2281000-memory.dmp	xmrig
behavioral2/memory/3044-2091-0x00007FF7D9EE0000-0x00007FF7DA2D1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3596	GVMNOfc.exe
4728	dFLtMds.exe
1916	uGDitCV.exe
4452	BDPnqqv.exe
2872	sNQqqll.exe
5108	PqNSIkn.exe
2976	qSxmcVz.exe
3892	sLBUYDD.exe
3036	ktuCbGW.exe
2640	otkMypO.exe
1040	UlwlWMN.exe
4984	QglFCNF.exe
1036	nQEpIMq.exe
2316	jaiAboM.exe
3832	rQBChjZ.exe
1524	wDntKLK.exe
4016	qxVjfmj.exe
2908	tsFkUGI.exe
2800	PINkPJc.exe
2880	SxqWKFO.exe
4384	QxMoNHU.exe
3160	MXLMfRf.exe
3044	zqcFPnF.exe
4912	JyTVzFS.exe
3876	JwnWfcM.exe
3856	pnKeGyo.exe
2352	ylWFeHA.exe
2288	yFvtnuj.exe
4012	pvumvYk.exe
5036	fSSdqmr.exe
4428	RbDzUan.exe
2488	xRbKTsJ.exe
3468	twfFDLk.exe
508	UuSTxrv.exe
2832	awiJCPp.exe
1844	kBpqwBe.exe
1580	qZdxiiD.exe
4612	zTWvBcZ.exe
1352	WFdFHEO.exe
1664	fDGdAOn.exe
960	hpZEhgv.exe
1976	aDsxrfr.exe
4904	fVdhoiU.exe
5080	MySrzPe.exe
1812	UlTgQFE.exe
2716	jSZtkpU.exe
3916	itJnpKV.exe
4348	kkiKISH.exe
872	dfqatgC.exe
3196	ULcjyBW.exe
4236	YCVEPcb.exe
1300	ejjIloe.exe
4636	DwbWvcy.exe
1248	NPdYYEi.exe
5048	ZkJHIay.exe
3128	gumcRPg.exe
1956	uEmrZvc.exe
2492	ZzmmwtY.exe
3444	Gebsdmm.exe
1920	rZvgVAx.exe
3192	jWJVMKU.exe
4188	OSVlzSG.exe
568	AbFztLk.exe
1716	HUzTjQq.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/312-0-0x00007FF73FB50000-0x00007FF73FF41000-memory.dmp	upx
behavioral2/files/0x000b00000002339a-4.dat	upx
behavioral2/files/0x0009000000023418-10.dat	upx
behavioral2/files/0x000700000002341f-18.dat	upx
behavioral2/memory/4728-20-0x00007FF78A630000-0x00007FF78AA21000-memory.dmp	upx
behavioral2/files/0x0007000000023422-31.dat	upx
behavioral2/files/0x0007000000023423-35.dat	upx
behavioral2/memory/4452-37-0x00007FF707230000-0x00007FF707621000-memory.dmp	upx
behavioral2/files/0x0007000000023421-33.dat	upx
behavioral2/files/0x0007000000023420-27.dat	upx
behavioral2/memory/1916-22-0x00007FF7E2470000-0x00007FF7E2861000-memory.dmp	upx
behavioral2/memory/3596-8-0x00007FF7BDB20000-0x00007FF7BDF11000-memory.dmp	upx
behavioral2/memory/5108-44-0x00007FF6B5F30000-0x00007FF6B6321000-memory.dmp	upx
behavioral2/memory/2976-49-0x00007FF652340000-0x00007FF652731000-memory.dmp	upx
behavioral2/files/0x0007000000023424-50.dat	upx
behavioral2/files/0x0007000000023426-58.dat	upx
behavioral2/files/0x000700000002342a-74.dat	upx
behavioral2/files/0x000700000002342c-84.dat	upx
behavioral2/files/0x000700000002342e-91.dat	upx
behavioral2/files/0x0007000000023433-116.dat	upx
behavioral2/files/0x0007000000023438-144.dat	upx
behavioral2/memory/3036-379-0x00007FF7E9560000-0x00007FF7E9951000-memory.dmp	upx
behavioral2/memory/1040-388-0x00007FF6988C0000-0x00007FF698CB1000-memory.dmp	upx
behavioral2/memory/4984-399-0x00007FF75C230000-0x00007FF75C621000-memory.dmp	upx
behavioral2/memory/2316-409-0x00007FF68D7E0000-0x00007FF68DBD1000-memory.dmp	upx
behavioral2/memory/3832-412-0x00007FF7688E0000-0x00007FF768CD1000-memory.dmp	upx
behavioral2/memory/1524-413-0x00007FF6E23B0000-0x00007FF6E27A1000-memory.dmp	upx
behavioral2/memory/1036-407-0x00007FF7D3E20000-0x00007FF7D4211000-memory.dmp	upx
behavioral2/memory/4016-428-0x00007FF7C1830000-0x00007FF7C1C21000-memory.dmp	upx
behavioral2/memory/2880-439-0x00007FF730490000-0x00007FF730881000-memory.dmp	upx
behavioral2/memory/3044-449-0x00007FF7D9EE0000-0x00007FF7DA2D1000-memory.dmp	upx
behavioral2/memory/4912-454-0x00007FF7F1E90000-0x00007FF7F2281000-memory.dmp	upx
behavioral2/memory/2640-457-0x00007FF788F90000-0x00007FF789381000-memory.dmp	upx
behavioral2/memory/3160-448-0x00007FF7D7EC0000-0x00007FF7D82B1000-memory.dmp	upx
behavioral2/memory/4384-443-0x00007FF765870000-0x00007FF765C61000-memory.dmp	upx
behavioral2/memory/2800-436-0x00007FF605B80000-0x00007FF605F71000-memory.dmp	upx
behavioral2/memory/2908-435-0x00007FF70BF30000-0x00007FF70C321000-memory.dmp	upx
behavioral2/memory/3892-374-0x00007FF6522D0000-0x00007FF6526C1000-memory.dmp	upx
behavioral2/files/0x000700000002343d-168.dat	upx
behavioral2/files/0x000700000002343c-164.dat	upx
behavioral2/files/0x000700000002343b-158.dat	upx
behavioral2/files/0x000700000002343a-153.dat	upx
behavioral2/files/0x0007000000023439-148.dat	upx
behavioral2/files/0x0007000000023437-138.dat	upx
behavioral2/files/0x0007000000023436-134.dat	upx
behavioral2/files/0x0007000000023435-128.dat	upx
behavioral2/files/0x0007000000023434-123.dat	upx
behavioral2/files/0x0007000000023432-113.dat	upx
behavioral2/files/0x0007000000023431-108.dat	upx
behavioral2/files/0x0007000000023430-104.dat	upx
behavioral2/files/0x000700000002342f-98.dat	upx
behavioral2/files/0x000700000002342d-88.dat	upx
behavioral2/files/0x000700000002342b-78.dat	upx
behavioral2/files/0x0007000000023429-68.dat	upx
behavioral2/files/0x0007000000023427-63.dat	upx
behavioral2/files/0x0007000000023425-56.dat	upx
behavioral2/memory/2872-42-0x00007FF7C7070000-0x00007FF7C7461000-memory.dmp	upx
behavioral2/memory/3596-1993-0x00007FF7BDB20000-0x00007FF7BDF11000-memory.dmp	upx
behavioral2/memory/5108-1994-0x00007FF6B5F30000-0x00007FF6B6321000-memory.dmp	upx
behavioral2/memory/3892-2027-0x00007FF6522D0000-0x00007FF6526C1000-memory.dmp	upx
behavioral2/memory/3596-2042-0x00007FF7BDB20000-0x00007FF7BDF11000-memory.dmp	upx
behavioral2/memory/4728-2046-0x00007FF78A630000-0x00007FF78AA21000-memory.dmp	upx
behavioral2/memory/1916-2045-0x00007FF7E2470000-0x00007FF7E2861000-memory.dmp	upx
behavioral2/memory/4452-2050-0x00007FF707230000-0x00007FF707621000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\ULcjyBW.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\UQgCKbN.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\FprShxE.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\rBWTTKe.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\lcevFhb.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\Gebsdmm.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\UquFJlf.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\ygcVIeu.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\uIQHFEd.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\TuMoYhB.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\zuXLYDF.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\SJfkPzO.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\DDUCaLl.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\LPIWJvj.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\bdxpWKi.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\fRpNHWi.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\wDntKLK.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\pnKeGyo.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\MDazPaZ.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\gORZvxX.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\LWGEcNu.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\SjTxBcI.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\IdrtMRW.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\uTVCfeu.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\CcUdlYn.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\sUpPOBe.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\QmPLXwY.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\wYZZBiP.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\HVdfYxB.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\WcbEIQB.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\bOhSPfa.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\tLNYxpA.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\KOtzxti.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\pSXpCYu.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\nbRPRHG.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\OPdtSmJ.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\sJayaIp.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\BfVuQOp.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\mCnGXtE.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\jCLLNWh.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\zAGfLeX.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\gDScHLx.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\OmGXFRK.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\BDPnqqv.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\FCNNNyk.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\CiexddJ.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\COrykGU.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\zUevQWB.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\ktuCbGW.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\tmevIrK.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\ynvZExS.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\MWWVhob.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\utoRbWu.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\XWHWjUI.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\UxzFcjZ.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\KIkNExk.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\NUAntpw.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\ebRBmev.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\BWHjIcQ.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\owQjhQY.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\HHwWDDK.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\epxojTj.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\cEYWjXA.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
File created	C:\Windows\System32\JEtPPrP.exe	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 312 wrote to memory of 3596	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	85
PID 312 wrote to memory of 3596	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	85
PID 312 wrote to memory of 4728	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	86
PID 312 wrote to memory of 4728	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	86
PID 312 wrote to memory of 1916	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	87
PID 312 wrote to memory of 1916	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	87
PID 312 wrote to memory of 4452	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	88
PID 312 wrote to memory of 4452	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	88
PID 312 wrote to memory of 2872	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	89
PID 312 wrote to memory of 2872	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	89
PID 312 wrote to memory of 5108	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	90
PID 312 wrote to memory of 5108	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	90
PID 312 wrote to memory of 2976	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	91
PID 312 wrote to memory of 2976	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	91
PID 312 wrote to memory of 3036	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	92
PID 312 wrote to memory of 3036	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	92
PID 312 wrote to memory of 3892	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	93
PID 312 wrote to memory of 3892	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	93
PID 312 wrote to memory of 2640	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	94
PID 312 wrote to memory of 2640	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	94
PID 312 wrote to memory of 1040	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	95
PID 312 wrote to memory of 1040	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	95
PID 312 wrote to memory of 4984	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	96
PID 312 wrote to memory of 4984	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	96
PID 312 wrote to memory of 1036	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	97
PID 312 wrote to memory of 1036	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	97
PID 312 wrote to memory of 2316	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	98
PID 312 wrote to memory of 2316	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	98
PID 312 wrote to memory of 3832	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	99
PID 312 wrote to memory of 3832	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	99
PID 312 wrote to memory of 1524	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	100
PID 312 wrote to memory of 1524	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	100
PID 312 wrote to memory of 4016	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	101
PID 312 wrote to memory of 4016	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	101
PID 312 wrote to memory of 2908	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	102
PID 312 wrote to memory of 2908	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	102
PID 312 wrote to memory of 2800	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	103
PID 312 wrote to memory of 2800	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	103
PID 312 wrote to memory of 2880	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	104
PID 312 wrote to memory of 2880	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	104
PID 312 wrote to memory of 4384	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	105
PID 312 wrote to memory of 4384	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	105
PID 312 wrote to memory of 3160	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	106
PID 312 wrote to memory of 3160	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	106
PID 312 wrote to memory of 3044	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	107
PID 312 wrote to memory of 3044	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	107
PID 312 wrote to memory of 4912	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	108
PID 312 wrote to memory of 4912	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	108
PID 312 wrote to memory of 3876	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	109
PID 312 wrote to memory of 3876	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	109
PID 312 wrote to memory of 3856	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	110
PID 312 wrote to memory of 3856	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	110
PID 312 wrote to memory of 2352	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	111
PID 312 wrote to memory of 2352	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	111
PID 312 wrote to memory of 2288	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	112
PID 312 wrote to memory of 2288	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	112
PID 312 wrote to memory of 4012	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	113
PID 312 wrote to memory of 4012	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	113
PID 312 wrote to memory of 5036	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	114
PID 312 wrote to memory of 5036	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	114
PID 312 wrote to memory of 4428	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	115
PID 312 wrote to memory of 4428	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	115
PID 312 wrote to memory of 2488	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	116
PID 312 wrote to memory of 2488	312	679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\679a9f984f5a2e1ed566648b2b5faa1a_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:312
- C:\Windows\System32\GVMNOfc.exe
  C:\Windows\System32\GVMNOfc.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System32\dFLtMds.exe
  C:\Windows\System32\dFLtMds.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System32\uGDitCV.exe
  C:\Windows\System32\uGDitCV.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System32\BDPnqqv.exe
  C:\Windows\System32\BDPnqqv.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System32\sNQqqll.exe
  C:\Windows\System32\sNQqqll.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System32\PqNSIkn.exe
  C:\Windows\System32\PqNSIkn.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System32\qSxmcVz.exe
  C:\Windows\System32\qSxmcVz.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System32\ktuCbGW.exe
  C:\Windows\System32\ktuCbGW.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System32\sLBUYDD.exe
  C:\Windows\System32\sLBUYDD.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System32\otkMypO.exe
  C:\Windows\System32\otkMypO.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System32\UlwlWMN.exe
  C:\Windows\System32\UlwlWMN.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System32\QglFCNF.exe
  C:\Windows\System32\QglFCNF.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System32\nQEpIMq.exe
  C:\Windows\System32\nQEpIMq.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System32\jaiAboM.exe
  C:\Windows\System32\jaiAboM.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System32\rQBChjZ.exe
  C:\Windows\System32\rQBChjZ.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System32\wDntKLK.exe
  C:\Windows\System32\wDntKLK.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System32\qxVjfmj.exe
  C:\Windows\System32\qxVjfmj.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System32\tsFkUGI.exe
  C:\Windows\System32\tsFkUGI.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System32\PINkPJc.exe
  C:\Windows\System32\PINkPJc.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System32\SxqWKFO.exe
  C:\Windows\System32\SxqWKFO.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System32\QxMoNHU.exe
  C:\Windows\System32\QxMoNHU.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System32\MXLMfRf.exe
  C:\Windows\System32\MXLMfRf.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System32\zqcFPnF.exe
  C:\Windows\System32\zqcFPnF.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System32\JyTVzFS.exe
  C:\Windows\System32\JyTVzFS.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System32\JwnWfcM.exe
  C:\Windows\System32\JwnWfcM.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System32\pnKeGyo.exe
  C:\Windows\System32\pnKeGyo.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System32\ylWFeHA.exe
  C:\Windows\System32\ylWFeHA.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System32\yFvtnuj.exe
  C:\Windows\System32\yFvtnuj.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System32\pvumvYk.exe
  C:\Windows\System32\pvumvYk.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System32\fSSdqmr.exe
  C:\Windows\System32\fSSdqmr.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System32\RbDzUan.exe
  C:\Windows\System32\RbDzUan.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System32\xRbKTsJ.exe
  C:\Windows\System32\xRbKTsJ.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System32\twfFDLk.exe
  C:\Windows\System32\twfFDLk.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System32\UuSTxrv.exe
  C:\Windows\System32\UuSTxrv.exe
  2⤵
  - Executes dropped EXE
  PID:508
- C:\Windows\System32\awiJCPp.exe
  C:\Windows\System32\awiJCPp.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System32\kBpqwBe.exe
  C:\Windows\System32\kBpqwBe.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System32\qZdxiiD.exe
  C:\Windows\System32\qZdxiiD.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System32\zTWvBcZ.exe
  C:\Windows\System32\zTWvBcZ.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System32\WFdFHEO.exe
  C:\Windows\System32\WFdFHEO.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System32\fDGdAOn.exe
  C:\Windows\System32\fDGdAOn.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System32\hpZEhgv.exe
  C:\Windows\System32\hpZEhgv.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System32\aDsxrfr.exe
  C:\Windows\System32\aDsxrfr.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System32\fVdhoiU.exe
  C:\Windows\System32\fVdhoiU.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System32\MySrzPe.exe
  C:\Windows\System32\MySrzPe.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System32\UlTgQFE.exe
  C:\Windows\System32\UlTgQFE.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System32\jSZtkpU.exe
  C:\Windows\System32\jSZtkpU.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System32\itJnpKV.exe
  C:\Windows\System32\itJnpKV.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System32\kkiKISH.exe
  C:\Windows\System32\kkiKISH.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System32\dfqatgC.exe
  C:\Windows\System32\dfqatgC.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System32\ULcjyBW.exe
  C:\Windows\System32\ULcjyBW.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System32\YCVEPcb.exe
  C:\Windows\System32\YCVEPcb.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System32\ejjIloe.exe
  C:\Windows\System32\ejjIloe.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System32\DwbWvcy.exe
  C:\Windows\System32\DwbWvcy.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System32\NPdYYEi.exe
  C:\Windows\System32\NPdYYEi.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System32\ZkJHIay.exe
  C:\Windows\System32\ZkJHIay.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System32\gumcRPg.exe
  C:\Windows\System32\gumcRPg.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System32\uEmrZvc.exe
  C:\Windows\System32\uEmrZvc.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System32\ZzmmwtY.exe
  C:\Windows\System32\ZzmmwtY.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System32\Gebsdmm.exe
  C:\Windows\System32\Gebsdmm.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System32\rZvgVAx.exe
  C:\Windows\System32\rZvgVAx.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System32\jWJVMKU.exe
  C:\Windows\System32\jWJVMKU.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System32\OSVlzSG.exe
  C:\Windows\System32\OSVlzSG.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System32\AbFztLk.exe
  C:\Windows\System32\AbFztLk.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System32\HUzTjQq.exe
  C:\Windows\System32\HUzTjQq.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System32\mCnGXtE.exe
  C:\Windows\System32\mCnGXtE.exe
  2⤵
  PID:2152
- C:\Windows\System32\RpmKxxX.exe
  C:\Windows\System32\RpmKxxX.exe
  2⤵
  PID:4496
- C:\Windows\System32\skyxbgO.exe
  C:\Windows\System32\skyxbgO.exe
  2⤵
  PID:2980
- C:\Windows\System32\dvgfnDG.exe
  C:\Windows\System32\dvgfnDG.exe
  2⤵
  PID:4084
- C:\Windows\System32\MDazPaZ.exe
  C:\Windows\System32\MDazPaZ.exe
  2⤵
  PID:4624
- C:\Windows\System32\VnHzzad.exe
  C:\Windows\System32\VnHzzad.exe
  2⤵
  PID:3644
- C:\Windows\System32\OSaFCNQ.exe
  C:\Windows\System32\OSaFCNQ.exe
  2⤵
  PID:4888
- C:\Windows\System32\nBMjhpq.exe
  C:\Windows\System32\nBMjhpq.exe
  2⤵
  PID:3396
- C:\Windows\System32\owQjhQY.exe
  C:\Windows\System32\owQjhQY.exe
  2⤵
  PID:2244
- C:\Windows\System32\XRaEEbW.exe
  C:\Windows\System32\XRaEEbW.exe
  2⤵
  PID:2632
- C:\Windows\System32\kXiNisg.exe
  C:\Windows\System32\kXiNisg.exe
  2⤵
  PID:1540
- C:\Windows\System32\pQjylhA.exe
  C:\Windows\System32\pQjylhA.exe
  2⤵
  PID:1856
- C:\Windows\System32\LxQkPGL.exe
  C:\Windows\System32\LxQkPGL.exe
  2⤵
  PID:4700
- C:\Windows\System32\UquFJlf.exe
  C:\Windows\System32\UquFJlf.exe
  2⤵
  PID:4964
- C:\Windows\System32\RDjwoVV.exe
  C:\Windows\System32\RDjwoVV.exe
  2⤵
  PID:2420
- C:\Windows\System32\ugbehfq.exe
  C:\Windows\System32\ugbehfq.exe
  2⤵
  PID:1796
- C:\Windows\System32\gDScHLx.exe
  C:\Windows\System32\gDScHLx.exe
  2⤵
  PID:376
- C:\Windows\System32\TInHtzG.exe
  C:\Windows\System32\TInHtzG.exe
  2⤵
  PID:4368
- C:\Windows\System32\GgBqvWi.exe
  C:\Windows\System32\GgBqvWi.exe
  2⤵
  PID:4136
- C:\Windows\System32\Ooebort.exe
  C:\Windows\System32\Ooebort.exe
  2⤵
  PID:3460
- C:\Windows\System32\dKAulMa.exe
  C:\Windows\System32\dKAulMa.exe
  2⤵
  PID:4512
- C:\Windows\System32\pJPwxfA.exe
  C:\Windows\System32\pJPwxfA.exe
  2⤵
  PID:4688
- C:\Windows\System32\WcbEIQB.exe
  C:\Windows\System32\WcbEIQB.exe
  2⤵
  PID:4448
- C:\Windows\System32\CdPAZiU.exe
  C:\Windows\System32\CdPAZiU.exe
  2⤵
  PID:3868
- C:\Windows\System32\kTNBMex.exe
  C:\Windows\System32\kTNBMex.exe
  2⤵
  PID:3928
- C:\Windows\System32\lTqFErk.exe
  C:\Windows\System32\lTqFErk.exe
  2⤵
  PID:728
- C:\Windows\System32\tjXtTWr.exe
  C:\Windows\System32\tjXtTWr.exe
  2⤵
  PID:3172
- C:\Windows\System32\fSYatSs.exe
  C:\Windows\System32\fSYatSs.exe
  2⤵
  PID:5136
- C:\Windows\System32\Mjsexnb.exe
  C:\Windows\System32\Mjsexnb.exe
  2⤵
  PID:5168
- C:\Windows\System32\IsByQPu.exe
  C:\Windows\System32\IsByQPu.exe
  2⤵
  PID:5192
- C:\Windows\System32\NXLIzvK.exe
  C:\Windows\System32\NXLIzvK.exe
  2⤵
  PID:5220
- C:\Windows\System32\SQoIRYb.exe
  C:\Windows\System32\SQoIRYb.exe
  2⤵
  PID:5248
- C:\Windows\System32\wIYrYuO.exe
  C:\Windows\System32\wIYrYuO.exe
  2⤵
  PID:5276
- C:\Windows\System32\HHwWDDK.exe
  C:\Windows\System32\HHwWDDK.exe
  2⤵
  PID:5308
- C:\Windows\System32\ULLFuGl.exe
  C:\Windows\System32\ULLFuGl.exe
  2⤵
  PID:5332
- C:\Windows\System32\nRAyEPI.exe
  C:\Windows\System32\nRAyEPI.exe
  2⤵
  PID:5360
- C:\Windows\System32\nDUSyOF.exe
  C:\Windows\System32\nDUSyOF.exe
  2⤵
  PID:5388
- C:\Windows\System32\YYRYsLW.exe
  C:\Windows\System32\YYRYsLW.exe
  2⤵
  PID:5448
- C:\Windows\System32\CbhKCMj.exe
  C:\Windows\System32\CbhKCMj.exe
  2⤵
  PID:5496
- C:\Windows\System32\ariXznW.exe
  C:\Windows\System32\ariXznW.exe
  2⤵
  PID:5512
- C:\Windows\System32\GsYtcYw.exe
  C:\Windows\System32\GsYtcYw.exe
  2⤵
  PID:5528
- C:\Windows\System32\MChYwlz.exe
  C:\Windows\System32\MChYwlz.exe
  2⤵
  PID:5544
- C:\Windows\System32\RZcZjtQ.exe
  C:\Windows\System32\RZcZjtQ.exe
  2⤵
  PID:5564
- C:\Windows\System32\SggCAdp.exe
  C:\Windows\System32\SggCAdp.exe
  2⤵
  PID:5580
- C:\Windows\System32\HKGEHoU.exe
  C:\Windows\System32\HKGEHoU.exe
  2⤵
  PID:5596
- C:\Windows\System32\tLNYxpA.exe
  C:\Windows\System32\tLNYxpA.exe
  2⤵
  PID:5612
- C:\Windows\System32\HbwpYFk.exe
  C:\Windows\System32\HbwpYFk.exe
  2⤵
  PID:5628
- C:\Windows\System32\IrCWhBk.exe
  C:\Windows\System32\IrCWhBk.exe
  2⤵
  PID:5684
- C:\Windows\System32\aMYHIKa.exe
  C:\Windows\System32\aMYHIKa.exe
  2⤵
  PID:5808
- C:\Windows\System32\nwIfYfv.exe
  C:\Windows\System32\nwIfYfv.exe
  2⤵
  PID:5824
- C:\Windows\System32\zuXLYDF.exe
  C:\Windows\System32\zuXLYDF.exe
  2⤵
  PID:5840
- C:\Windows\System32\RuhiCev.exe
  C:\Windows\System32\RuhiCev.exe
  2⤵
  PID:5856
- C:\Windows\System32\iUSAiNl.exe
  C:\Windows\System32\iUSAiNl.exe
  2⤵
  PID:5872
- C:\Windows\System32\strMuCh.exe
  C:\Windows\System32\strMuCh.exe
  2⤵
  PID:5900
- C:\Windows\System32\SEfJrNa.exe
  C:\Windows\System32\SEfJrNa.exe
  2⤵
  PID:5932
- C:\Windows\System32\WqZoIRK.exe
  C:\Windows\System32\WqZoIRK.exe
  2⤵
  PID:5948
- C:\Windows\System32\SJfkPzO.exe
  C:\Windows\System32\SJfkPzO.exe
  2⤵
  PID:5976
- C:\Windows\System32\ulOztxw.exe
  C:\Windows\System32\ulOztxw.exe
  2⤵
  PID:6056
- C:\Windows\System32\AWVfcQq.exe
  C:\Windows\System32\AWVfcQq.exe
  2⤵
  PID:6124
- C:\Windows\System32\hkXzdnq.exe
  C:\Windows\System32\hkXzdnq.exe
  2⤵
  PID:2208
- C:\Windows\System32\pHGKKDL.exe
  C:\Windows\System32\pHGKKDL.exe
  2⤵
  PID:3168
- C:\Windows\System32\LmsYTpd.exe
  C:\Windows\System32\LmsYTpd.exe
  2⤵
  PID:1312
- C:\Windows\System32\LWesPNx.exe
  C:\Windows\System32\LWesPNx.exe
  2⤵
  PID:2308
- C:\Windows\System32\BCwITcw.exe
  C:\Windows\System32\BCwITcw.exe
  2⤵
  PID:4280
- C:\Windows\System32\PeppXhh.exe
  C:\Windows\System32\PeppXhh.exe
  2⤵
  PID:4068
- C:\Windows\System32\YbGusnl.exe
  C:\Windows\System32\YbGusnl.exe
  2⤵
  PID:5208
- C:\Windows\System32\OMqeDNW.exe
  C:\Windows\System32\OMqeDNW.exe
  2⤵
  PID:532
- C:\Windows\System32\OGIUoJi.exe
  C:\Windows\System32\OGIUoJi.exe
  2⤵
  PID:5292
- C:\Windows\System32\WLFHimt.exe
  C:\Windows\System32\WLFHimt.exe
  2⤵
  PID:1256
- C:\Windows\System32\RgYUGio.exe
  C:\Windows\System32\RgYUGio.exe
  2⤵
  PID:4600
- C:\Windows\System32\nGFNDLp.exe
  C:\Windows\System32\nGFNDLp.exe
  2⤵
  PID:2660
- C:\Windows\System32\BqruCTR.exe
  C:\Windows\System32\BqruCTR.exe
  2⤵
  PID:5380
- C:\Windows\System32\SslKhPL.exe
  C:\Windows\System32\SslKhPL.exe
  2⤵
  PID:5524
- C:\Windows\System32\XWHWjUI.exe
  C:\Windows\System32\XWHWjUI.exe
  2⤵
  PID:5624
- C:\Windows\System32\LhBoMTR.exe
  C:\Windows\System32\LhBoMTR.exe
  2⤵
  PID:5536
- C:\Windows\System32\gzIbrSK.exe
  C:\Windows\System32\gzIbrSK.exe
  2⤵
  PID:5712
- C:\Windows\System32\CipdiXb.exe
  C:\Windows\System32\CipdiXb.exe
  2⤵
  PID:5848
- C:\Windows\System32\zJeLbjL.exe
  C:\Windows\System32\zJeLbjL.exe
  2⤵
  PID:5832
- C:\Windows\System32\gBIvfpG.exe
  C:\Windows\System32\gBIvfpG.exe
  2⤵
  PID:5888
- C:\Windows\System32\UBnVxtQ.exe
  C:\Windows\System32\UBnVxtQ.exe
  2⤵
  PID:5944
- C:\Windows\System32\ooiBaaz.exe
  C:\Windows\System32\ooiBaaz.exe
  2⤵
  PID:6020
- C:\Windows\System32\epxojTj.exe
  C:\Windows\System32\epxojTj.exe
  2⤵
  PID:3920
- C:\Windows\System32\MhJzoDf.exe
  C:\Windows\System32\MhJzoDf.exe
  2⤵
  PID:1384
- C:\Windows\System32\YCeEtKh.exe
  C:\Windows\System32\YCeEtKh.exe
  2⤵
  PID:1368
- C:\Windows\System32\yAkzuFj.exe
  C:\Windows\System32\yAkzuFj.exe
  2⤵
  PID:6132
- C:\Windows\System32\rqdgnJh.exe
  C:\Windows\System32\rqdgnJh.exe
  2⤵
  PID:6044
- C:\Windows\System32\nGlYxeR.exe
  C:\Windows\System32\nGlYxeR.exe
  2⤵
  PID:1044
- C:\Windows\System32\TlkYxCO.exe
  C:\Windows\System32\TlkYxCO.exe
  2⤵
  PID:5352
- C:\Windows\System32\JhxQUZy.exe
  C:\Windows\System32\JhxQUZy.exe
  2⤵
  PID:5556
- C:\Windows\System32\UxzFcjZ.exe
  C:\Windows\System32\UxzFcjZ.exe
  2⤵
  PID:5716
- C:\Windows\System32\BhKiFsQ.exe
  C:\Windows\System32\BhKiFsQ.exe
  2⤵
  PID:3896
- C:\Windows\System32\FLErLvO.exe
  C:\Windows\System32\FLErLvO.exe
  2⤵
  PID:5592
- C:\Windows\System32\ygcVIeu.exe
  C:\Windows\System32\ygcVIeu.exe
  2⤵
  PID:5748
- C:\Windows\System32\yyvLKhN.exe
  C:\Windows\System32\yyvLKhN.exe
  2⤵
  PID:5852
- C:\Windows\System32\HeZaFJp.exe
  C:\Windows\System32\HeZaFJp.exe
  2⤵
  PID:6112
- C:\Windows\System32\JEtPPrP.exe
  C:\Windows\System32\JEtPPrP.exe
  2⤵
  PID:832
- C:\Windows\System32\UsExIKh.exe
  C:\Windows\System32\UsExIKh.exe
  2⤵
  PID:6100
- C:\Windows\System32\WluSjoT.exe
  C:\Windows\System32\WluSjoT.exe
  2⤵
  PID:5464
- C:\Windows\System32\pntPuYo.exe
  C:\Windows\System32\pntPuYo.exe
  2⤵
  PID:5576
- C:\Windows\System32\vQFLZxd.exe
  C:\Windows\System32\vQFLZxd.exe
  2⤵
  PID:5284
- C:\Windows\System32\zBjxkJx.exe
  C:\Windows\System32\zBjxkJx.exe
  2⤵
  PID:5316
- C:\Windows\System32\zzjdmHb.exe
  C:\Windows\System32\zzjdmHb.exe
  2⤵
  PID:6084
- C:\Windows\System32\VcwIYMs.exe
  C:\Windows\System32\VcwIYMs.exe
  2⤵
  PID:752
- C:\Windows\System32\sJXrtSo.exe
  C:\Windows\System32\sJXrtSo.exe
  2⤵
  PID:6160
- C:\Windows\System32\cFBWWqD.exe
  C:\Windows\System32\cFBWWqD.exe
  2⤵
  PID:6196
- C:\Windows\System32\hWIJWVf.exe
  C:\Windows\System32\hWIJWVf.exe
  2⤵
  PID:6232
- C:\Windows\System32\embnzcP.exe
  C:\Windows\System32\embnzcP.exe
  2⤵
  PID:6260
- C:\Windows\System32\KIkNExk.exe
  C:\Windows\System32\KIkNExk.exe
  2⤵
  PID:6276
- C:\Windows\System32\XBaWwHc.exe
  C:\Windows\System32\XBaWwHc.exe
  2⤵
  PID:6296
- C:\Windows\System32\QMYwEBU.exe
  C:\Windows\System32\QMYwEBU.exe
  2⤵
  PID:6312
- C:\Windows\System32\hpOcrAU.exe
  C:\Windows\System32\hpOcrAU.exe
  2⤵
  PID:6340
- C:\Windows\System32\UXyMdDP.exe
  C:\Windows\System32\UXyMdDP.exe
  2⤵
  PID:6368
- C:\Windows\System32\hNGEzNH.exe
  C:\Windows\System32\hNGEzNH.exe
  2⤵
  PID:6404
- C:\Windows\System32\gORZvxX.exe
  C:\Windows\System32\gORZvxX.exe
  2⤵
  PID:6460
- C:\Windows\System32\uDRtiVt.exe
  C:\Windows\System32\uDRtiVt.exe
  2⤵
  PID:6484
- C:\Windows\System32\qXyDIGV.exe
  C:\Windows\System32\qXyDIGV.exe
  2⤵
  PID:6500
- C:\Windows\System32\YoXrGqc.exe
  C:\Windows\System32\YoXrGqc.exe
  2⤵
  PID:6520
- C:\Windows\System32\dlqocRg.exe
  C:\Windows\System32\dlqocRg.exe
  2⤵
  PID:6536
- C:\Windows\System32\nowmtOu.exe
  C:\Windows\System32\nowmtOu.exe
  2⤵
  PID:6552
- C:\Windows\System32\LfYZkHX.exe
  C:\Windows\System32\LfYZkHX.exe
  2⤵
  PID:6580
- C:\Windows\System32\IxnZCJb.exe
  C:\Windows\System32\IxnZCJb.exe
  2⤵
  PID:6596
- C:\Windows\System32\resfcUL.exe
  C:\Windows\System32\resfcUL.exe
  2⤵
  PID:6636
- C:\Windows\System32\NUAntpw.exe
  C:\Windows\System32\NUAntpw.exe
  2⤵
  PID:6656
- C:\Windows\System32\EyGmpaF.exe
  C:\Windows\System32\EyGmpaF.exe
  2⤵
  PID:6672
- C:\Windows\System32\UQgCKbN.exe
  C:\Windows\System32\UQgCKbN.exe
  2⤵
  PID:6712
- C:\Windows\System32\SkmHqmI.exe
  C:\Windows\System32\SkmHqmI.exe
  2⤵
  PID:6756
- C:\Windows\System32\ARZCNwG.exe
  C:\Windows\System32\ARZCNwG.exe
  2⤵
  PID:6808
- C:\Windows\System32\TcmaxuO.exe
  C:\Windows\System32\TcmaxuO.exe
  2⤵
  PID:6828
- C:\Windows\System32\iyizbxq.exe
  C:\Windows\System32\iyizbxq.exe
  2⤵
  PID:6864
- C:\Windows\System32\rKjvJtu.exe
  C:\Windows\System32\rKjvJtu.exe
  2⤵
  PID:6884
- C:\Windows\System32\LZiRsdJ.exe
  C:\Windows\System32\LZiRsdJ.exe
  2⤵
  PID:6900
- C:\Windows\System32\pJyooQO.exe
  C:\Windows\System32\pJyooQO.exe
  2⤵
  PID:6936
- C:\Windows\System32\RIhVeoT.exe
  C:\Windows\System32\RIhVeoT.exe
  2⤵
  PID:6956
- C:\Windows\System32\mHfVIuj.exe
  C:\Windows\System32\mHfVIuj.exe
  2⤵
  PID:6976
- C:\Windows\System32\DNiIDeb.exe
  C:\Windows\System32\DNiIDeb.exe
  2⤵
  PID:7040
- C:\Windows\System32\DATzMYW.exe
  C:\Windows\System32\DATzMYW.exe
  2⤵
  PID:7064
- C:\Windows\System32\RDOyazF.exe
  C:\Windows\System32\RDOyazF.exe
  2⤵
  PID:7084
- C:\Windows\System32\upuukgw.exe
  C:\Windows\System32\upuukgw.exe
  2⤵
  PID:7112
- C:\Windows\System32\KdVpoVp.exe
  C:\Windows\System32\KdVpoVp.exe
  2⤵
  PID:7148
- C:\Windows\System32\EhnxtQu.exe
  C:\Windows\System32\EhnxtQu.exe
  2⤵
  PID:5984
- C:\Windows\System32\NhDoULS.exe
  C:\Windows\System32\NhDoULS.exe
  2⤵
  PID:6188
- C:\Windows\System32\EgEwcqL.exe
  C:\Windows\System32\EgEwcqL.exe
  2⤵
  PID:6224
- C:\Windows\System32\aWPNytk.exe
  C:\Windows\System32\aWPNytk.exe
  2⤵
  PID:6292
- C:\Windows\System32\mwoSPXl.exe
  C:\Windows\System32\mwoSPXl.exe
  2⤵
  PID:6308
- C:\Windows\System32\OUkqRNm.exe
  C:\Windows\System32\OUkqRNm.exe
  2⤵
  PID:6324
- C:\Windows\System32\HvAzXyy.exe
  C:\Windows\System32\HvAzXyy.exe
  2⤵
  PID:6420
- C:\Windows\System32\jGNVPvq.exe
  C:\Windows\System32\jGNVPvq.exe
  2⤵
  PID:6480
- C:\Windows\System32\DDUCaLl.exe
  C:\Windows\System32\DDUCaLl.exe
  2⤵
  PID:6604
- C:\Windows\System32\CcUdlYn.exe
  C:\Windows\System32\CcUdlYn.exe
  2⤵
  PID:6732
- C:\Windows\System32\LWGEcNu.exe
  C:\Windows\System32\LWGEcNu.exe
  2⤵
  PID:6784
- C:\Windows\System32\KOtzxti.exe
  C:\Windows\System32\KOtzxti.exe
  2⤵
  PID:6816
- C:\Windows\System32\MeCvWZy.exe
  C:\Windows\System32\MeCvWZy.exe
  2⤵
  PID:6928
- C:\Windows\System32\MnQoYlg.exe
  C:\Windows\System32\MnQoYlg.exe
  2⤵
  PID:6988
- C:\Windows\System32\znNEyau.exe
  C:\Windows\System32\znNEyau.exe
  2⤵
  PID:7092
- C:\Windows\System32\MttipFk.exe
  C:\Windows\System32\MttipFk.exe
  2⤵
  PID:7124
- C:\Windows\System32\RjqIZtd.exe
  C:\Windows\System32\RjqIZtd.exe
  2⤵
  PID:7160
- C:\Windows\System32\dyYxlEj.exe
  C:\Windows\System32\dyYxlEj.exe
  2⤵
  PID:6400
- C:\Windows\System32\yeMYPoE.exe
  C:\Windows\System32\yeMYPoE.exe
  2⤵
  PID:6544
- C:\Windows\System32\CPuwypl.exe
  C:\Windows\System32\CPuwypl.exe
  2⤵
  PID:6392
- C:\Windows\System32\NNvdQdx.exe
  C:\Windows\System32\NNvdQdx.exe
  2⤵
  PID:6800
- C:\Windows\System32\aXGzsLU.exe
  C:\Windows\System32\aXGzsLU.exe
  2⤵
  PID:7012
- C:\Windows\System32\dZBRkPv.exe
  C:\Windows\System32\dZBRkPv.exe
  2⤵
  PID:6176
- C:\Windows\System32\GEcrdSa.exe
  C:\Windows\System32\GEcrdSa.exe
  2⤵
  PID:6256
- C:\Windows\System32\ZqEjxhE.exe
  C:\Windows\System32\ZqEjxhE.exe
  2⤵
  PID:6912
- C:\Windows\System32\oZLurQA.exe
  C:\Windows\System32\oZLurQA.exe
  2⤵
  PID:7060
- C:\Windows\System32\zyQiIEB.exe
  C:\Windows\System32\zyQiIEB.exe
  2⤵
  PID:6560
- C:\Windows\System32\VpVZHxC.exe
  C:\Windows\System32\VpVZHxC.exe
  2⤵
  PID:6352
- C:\Windows\System32\aLtiTBd.exe
  C:\Windows\System32\aLtiTBd.exe
  2⤵
  PID:7184
- C:\Windows\System32\YqYQAcK.exe
  C:\Windows\System32\YqYQAcK.exe
  2⤵
  PID:7220
- C:\Windows\System32\WHiRmVF.exe
  C:\Windows\System32\WHiRmVF.exe
  2⤵
  PID:7260
- C:\Windows\System32\PcrjiRs.exe
  C:\Windows\System32\PcrjiRs.exe
  2⤵
  PID:7284
- C:\Windows\System32\jgTljpk.exe
  C:\Windows\System32\jgTljpk.exe
  2⤵
  PID:7300
- C:\Windows\System32\GkeGWgJ.exe
  C:\Windows\System32\GkeGWgJ.exe
  2⤵
  PID:7316
- C:\Windows\System32\ZcVjLfA.exe
  C:\Windows\System32\ZcVjLfA.exe
  2⤵
  PID:7336
- C:\Windows\System32\BxreNRE.exe
  C:\Windows\System32\BxreNRE.exe
  2⤵
  PID:7400
- C:\Windows\System32\TpDhJEq.exe
  C:\Windows\System32\TpDhJEq.exe
  2⤵
  PID:7416
- C:\Windows\System32\xAtZmqB.exe
  C:\Windows\System32\xAtZmqB.exe
  2⤵
  PID:7444
- C:\Windows\System32\eJStIux.exe
  C:\Windows\System32\eJStIux.exe
  2⤵
  PID:7496
- C:\Windows\System32\IGwAxPL.exe
  C:\Windows\System32\IGwAxPL.exe
  2⤵
  PID:7512
- C:\Windows\System32\EgZFpLk.exe
  C:\Windows\System32\EgZFpLk.exe
  2⤵
  PID:7528
- C:\Windows\System32\OCYZcBw.exe
  C:\Windows\System32\OCYZcBw.exe
  2⤵
  PID:7556
- C:\Windows\System32\ItpYNeU.exe
  C:\Windows\System32\ItpYNeU.exe
  2⤵
  PID:7572
- C:\Windows\System32\jiQXAwk.exe
  C:\Windows\System32\jiQXAwk.exe
  2⤵
  PID:7612
- C:\Windows\System32\TYkBzkO.exe
  C:\Windows\System32\TYkBzkO.exe
  2⤵
  PID:7636
- C:\Windows\System32\zTNDYrl.exe
  C:\Windows\System32\zTNDYrl.exe
  2⤵
  PID:7652
- C:\Windows\System32\YjeVAjJ.exe
  C:\Windows\System32\YjeVAjJ.exe
  2⤵
  PID:7676
- C:\Windows\System32\xCPWsKd.exe
  C:\Windows\System32\xCPWsKd.exe
  2⤵
  PID:7700
- C:\Windows\System32\hYPdgbQ.exe
  C:\Windows\System32\hYPdgbQ.exe
  2⤵
  PID:7768
- C:\Windows\System32\FnKYwTt.exe
  C:\Windows\System32\FnKYwTt.exe
  2⤵
  PID:7796
- C:\Windows\System32\mCqXNcc.exe
  C:\Windows\System32\mCqXNcc.exe
  2⤵
  PID:7812
- C:\Windows\System32\KqITyAo.exe
  C:\Windows\System32\KqITyAo.exe
  2⤵
  PID:7828
- C:\Windows\System32\Asgrkcq.exe
  C:\Windows\System32\Asgrkcq.exe
  2⤵
  PID:7844
- C:\Windows\System32\fUylrLD.exe
  C:\Windows\System32\fUylrLD.exe
  2⤵
  PID:7864
- C:\Windows\System32\lWInbKt.exe
  C:\Windows\System32\lWInbKt.exe
  2⤵
  PID:7880
- C:\Windows\System32\cufefMy.exe
  C:\Windows\System32\cufefMy.exe
  2⤵
  PID:7900
- C:\Windows\System32\ySHVbEn.exe
  C:\Windows\System32\ySHVbEn.exe
  2⤵
  PID:7952
- C:\Windows\System32\vWpxhGf.exe
  C:\Windows\System32\vWpxhGf.exe
  2⤵
  PID:8020
- C:\Windows\System32\RVtWOIg.exe
  C:\Windows\System32\RVtWOIg.exe
  2⤵
  PID:8048
- C:\Windows\System32\XTnvjOa.exe
  C:\Windows\System32\XTnvjOa.exe
  2⤵
  PID:8068
- C:\Windows\System32\IzTijZS.exe
  C:\Windows\System32\IzTijZS.exe
  2⤵
  PID:8096
- C:\Windows\System32\BydllMh.exe
  C:\Windows\System32\BydllMh.exe
  2⤵
  PID:8112
- C:\Windows\System32\RspEzkU.exe
  C:\Windows\System32\RspEzkU.exe
  2⤵
  PID:8128
- C:\Windows\System32\NVCwRWc.exe
  C:\Windows\System32\NVCwRWc.exe
  2⤵
  PID:8168
- C:\Windows\System32\Pydqijy.exe
  C:\Windows\System32\Pydqijy.exe
  2⤵
  PID:6880
- C:\Windows\System32\Qxmlfur.exe
  C:\Windows\System32\Qxmlfur.exe
  2⤵
  PID:7256
- C:\Windows\System32\FCNNNyk.exe
  C:\Windows\System32\FCNNNyk.exe
  2⤵
  PID:7308
- C:\Windows\System32\AyJUMCy.exe
  C:\Windows\System32\AyJUMCy.exe
  2⤵
  PID:7332
- C:\Windows\System32\rsxVPnl.exe
  C:\Windows\System32\rsxVPnl.exe
  2⤵
  PID:7472
- C:\Windows\System32\RnRcvuW.exe
  C:\Windows\System32\RnRcvuW.exe
  2⤵
  PID:7552
- C:\Windows\System32\xunFlRI.exe
  C:\Windows\System32\xunFlRI.exe
  2⤵
  PID:7564
- C:\Windows\System32\kOTWwJY.exe
  C:\Windows\System32\kOTWwJY.exe
  2⤵
  PID:7628
- C:\Windows\System32\IzczDUC.exe
  C:\Windows\System32\IzczDUC.exe
  2⤵
  PID:7664
- C:\Windows\System32\GIGSmnh.exe
  C:\Windows\System32\GIGSmnh.exe
  2⤵
  PID:7660
- C:\Windows\System32\QWyQRWh.exe
  C:\Windows\System32\QWyQRWh.exe
  2⤵
  PID:7808
- C:\Windows\System32\imIfxyc.exe
  C:\Windows\System32\imIfxyc.exe
  2⤵
  PID:7840
- C:\Windows\System32\YpsEtXI.exe
  C:\Windows\System32\YpsEtXI.exe
  2⤵
  PID:7984
- C:\Windows\System32\sDOXErv.exe
  C:\Windows\System32\sDOXErv.exe
  2⤵
  PID:8004
- C:\Windows\System32\SjTxBcI.exe
  C:\Windows\System32\SjTxBcI.exe
  2⤵
  PID:8044
- C:\Windows\System32\GakHSFu.exe
  C:\Windows\System32\GakHSFu.exe
  2⤵
  PID:8152
- C:\Windows\System32\bCjWnlQ.exe
  C:\Windows\System32\bCjWnlQ.exe
  2⤵
  PID:8160
- C:\Windows\System32\yJIMkxf.exe
  C:\Windows\System32\yJIMkxf.exe
  2⤵
  PID:7292
- C:\Windows\System32\LxPGgJA.exe
  C:\Windows\System32\LxPGgJA.exe
  2⤵
  PID:7272
- C:\Windows\System32\XImdUht.exe
  C:\Windows\System32\XImdUht.exe
  2⤵
  PID:7440
- C:\Windows\System32\QEmZavK.exe
  C:\Windows\System32\QEmZavK.exe
  2⤵
  PID:7648
- C:\Windows\System32\JpOVXBY.exe
  C:\Windows\System32\JpOVXBY.exe
  2⤵
  PID:8076
- C:\Windows\System32\XagOAFZ.exe
  C:\Windows\System32\XagOAFZ.exe
  2⤵
  PID:7016
- C:\Windows\System32\bPIFcXH.exe
  C:\Windows\System32\bPIFcXH.exe
  2⤵
  PID:7428
- C:\Windows\System32\tfXQAKv.exe
  C:\Windows\System32\tfXQAKv.exe
  2⤵
  PID:7684
- C:\Windows\System32\IdrtMRW.exe
  C:\Windows\System32\IdrtMRW.exe
  2⤵
  PID:8144
- C:\Windows\System32\FkzwOWE.exe
  C:\Windows\System32\FkzwOWE.exe
  2⤵
  PID:7888
- C:\Windows\System32\uIQHFEd.exe
  C:\Windows\System32\uIQHFEd.exe
  2⤵
  PID:7324
- C:\Windows\System32\vvQywfM.exe
  C:\Windows\System32\vvQywfM.exe
  2⤵
  PID:8212
- C:\Windows\System32\pSXpCYu.exe
  C:\Windows\System32\pSXpCYu.exe
  2⤵
  PID:8240
- C:\Windows\System32\KtuCAMp.exe
  C:\Windows\System32\KtuCAMp.exe
  2⤵
  PID:8264
- C:\Windows\System32\HUoRZuN.exe
  C:\Windows\System32\HUoRZuN.exe
  2⤵
  PID:8288
- C:\Windows\System32\qLIcKbw.exe
  C:\Windows\System32\qLIcKbw.exe
  2⤵
  PID:8328
- C:\Windows\System32\otrYWBy.exe
  C:\Windows\System32\otrYWBy.exe
  2⤵
  PID:8348
- C:\Windows\System32\sUpPOBe.exe
  C:\Windows\System32\sUpPOBe.exe
  2⤵
  PID:8384
- C:\Windows\System32\zNiNXfA.exe
  C:\Windows\System32\zNiNXfA.exe
  2⤵
  PID:8412
- C:\Windows\System32\irhPgwO.exe
  C:\Windows\System32\irhPgwO.exe
  2⤵
  PID:8432
- C:\Windows\System32\LPIWJvj.exe
  C:\Windows\System32\LPIWJvj.exe
  2⤵
  PID:8452
- C:\Windows\System32\TYvbWaj.exe
  C:\Windows\System32\TYvbWaj.exe
  2⤵
  PID:8496
- C:\Windows\System32\tyQinXU.exe
  C:\Windows\System32\tyQinXU.exe
  2⤵
  PID:8512
- C:\Windows\System32\UgrSFNb.exe
  C:\Windows\System32\UgrSFNb.exe
  2⤵
  PID:8540
- C:\Windows\System32\gtBRPXU.exe
  C:\Windows\System32\gtBRPXU.exe
  2⤵
  PID:8556
- C:\Windows\System32\woSwlTB.exe
  C:\Windows\System32\woSwlTB.exe
  2⤵
  PID:8604
- C:\Windows\System32\sfOhGDe.exe
  C:\Windows\System32\sfOhGDe.exe
  2⤵
  PID:8644
- C:\Windows\System32\vfdDeXk.exe
  C:\Windows\System32\vfdDeXk.exe
  2⤵
  PID:8672
- C:\Windows\System32\gBCBBfM.exe
  C:\Windows\System32\gBCBBfM.exe
  2⤵
  PID:8692
- C:\Windows\System32\VNgMyFp.exe
  C:\Windows\System32\VNgMyFp.exe
  2⤵
  PID:8716
- C:\Windows\System32\GenOQix.exe
  C:\Windows\System32\GenOQix.exe
  2⤵
  PID:8736
- C:\Windows\System32\XQzpsZX.exe
  C:\Windows\System32\XQzpsZX.exe
  2⤵
  PID:8756
- C:\Windows\System32\PPpjLVk.exe
  C:\Windows\System32\PPpjLVk.exe
  2⤵
  PID:8792
- C:\Windows\System32\RXoegXx.exe
  C:\Windows\System32\RXoegXx.exe
  2⤵
  PID:8808
- C:\Windows\System32\iHZpTdT.exe
  C:\Windows\System32\iHZpTdT.exe
  2⤵
  PID:8836
- C:\Windows\System32\FprShxE.exe
  C:\Windows\System32\FprShxE.exe
  2⤵
  PID:8852
- C:\Windows\System32\lqwvCCx.exe
  C:\Windows\System32\lqwvCCx.exe
  2⤵
  PID:8872
- C:\Windows\System32\jLuZztn.exe
  C:\Windows\System32\jLuZztn.exe
  2⤵
  PID:8904
- C:\Windows\System32\IJNJciy.exe
  C:\Windows\System32\IJNJciy.exe
  2⤵
  PID:8924
- C:\Windows\System32\ArLJnao.exe
  C:\Windows\System32\ArLJnao.exe
  2⤵
  PID:8944
- C:\Windows\System32\xiBoUsC.exe
  C:\Windows\System32\xiBoUsC.exe
  2⤵
  PID:8964
- C:\Windows\System32\SHKvozU.exe
  C:\Windows\System32\SHKvozU.exe
  2⤵
  PID:8992
- C:\Windows\System32\GAiHDLR.exe
  C:\Windows\System32\GAiHDLR.exe
  2⤵
  PID:9064
- C:\Windows\System32\xLYwllR.exe
  C:\Windows\System32\xLYwllR.exe
  2⤵
  PID:9084
- C:\Windows\System32\PgCZhuF.exe
  C:\Windows\System32\PgCZhuF.exe
  2⤵
  PID:9124
- C:\Windows\System32\fRpNHWi.exe
  C:\Windows\System32\fRpNHWi.exe
  2⤵
  PID:9140
- C:\Windows\System32\XbHiMiq.exe
  C:\Windows\System32\XbHiMiq.exe
  2⤵
  PID:9156
- C:\Windows\System32\WKObPoj.exe
  C:\Windows\System32\WKObPoj.exe
  2⤵
  PID:9208
- C:\Windows\System32\reNoIAK.exe
  C:\Windows\System32\reNoIAK.exe
  2⤵
  PID:8220
- C:\Windows\System32\dKAnaEq.exe
  C:\Windows\System32\dKAnaEq.exe
  2⤵
  PID:8248
- C:\Windows\System32\hqRDyBt.exe
  C:\Windows\System32\hqRDyBt.exe
  2⤵
  PID:8372
- C:\Windows\System32\wWvrAfv.exe
  C:\Windows\System32\wWvrAfv.exe
  2⤵
  PID:8424
- C:\Windows\System32\dtldiEv.exe
  C:\Windows\System32\dtldiEv.exe
  2⤵
  PID:8576
- C:\Windows\System32\SLvcEDN.exe
  C:\Windows\System32\SLvcEDN.exe
  2⤵
  PID:8564
- C:\Windows\System32\KeAJeck.exe
  C:\Windows\System32\KeAJeck.exe
  2⤵
  PID:8656
- C:\Windows\System32\TzYlPXb.exe
  C:\Windows\System32\TzYlPXb.exe
  2⤵
  PID:8700
- C:\Windows\System32\yCTdolG.exe
  C:\Windows\System32\yCTdolG.exe
  2⤵
  PID:8776
- C:\Windows\System32\bYsshwg.exe
  C:\Windows\System32\bYsshwg.exe
  2⤵
  PID:8820
- C:\Windows\System32\gBCGxLe.exe
  C:\Windows\System32\gBCGxLe.exe
  2⤵
  PID:8860
- C:\Windows\System32\MsLDOla.exe
  C:\Windows\System32\MsLDOla.exe
  2⤵
  PID:8972
- C:\Windows\System32\dWaLThm.exe
  C:\Windows\System32\dWaLThm.exe
  2⤵
  PID:9024
- C:\Windows\System32\gYWoBlm.exe
  C:\Windows\System32\gYWoBlm.exe
  2⤵
  PID:9060
- C:\Windows\System32\EwwvpQT.exe
  C:\Windows\System32\EwwvpQT.exe
  2⤵
  PID:9176
- C:\Windows\System32\WIiHolE.exe
  C:\Windows\System32\WIiHolE.exe
  2⤵
  PID:8344
- C:\Windows\System32\MRGtIJB.exe
  C:\Windows\System32\MRGtIJB.exe
  2⤵
  PID:8256
- C:\Windows\System32\agBftWJ.exe
  C:\Windows\System32\agBftWJ.exe
  2⤵
  PID:8464
- C:\Windows\System32\yokXdXW.exe
  C:\Windows\System32\yokXdXW.exe
  2⤵
  PID:8636
- C:\Windows\System32\nbRPRHG.exe
  C:\Windows\System32\nbRPRHG.exe
  2⤵
  PID:8844
- C:\Windows\System32\OuCQOUE.exe
  C:\Windows\System32\OuCQOUE.exe
  2⤵
  PID:9092
- C:\Windows\System32\xbJxsbG.exe
  C:\Windows\System32\xbJxsbG.exe
  2⤵
  PID:8504
- C:\Windows\System32\TqQFCim.exe
  C:\Windows\System32\TqQFCim.exe
  2⤵
  PID:9304
- C:\Windows\System32\GvvpHEX.exe
  C:\Windows\System32\GvvpHEX.exe
  2⤵
  PID:9336
- C:\Windows\System32\zDEuaKL.exe
  C:\Windows\System32\zDEuaKL.exe
  2⤵
  PID:9372
- C:\Windows\System32\gNNVLev.exe
  C:\Windows\System32\gNNVLev.exe
  2⤵
  PID:9416
- C:\Windows\System32\aDTEmwx.exe
  C:\Windows\System32\aDTEmwx.exe
  2⤵
  PID:9432
- C:\Windows\System32\sUvMaJS.exe
  C:\Windows\System32\sUvMaJS.exe
  2⤵
  PID:9452
- C:\Windows\System32\sacHPYi.exe
  C:\Windows\System32\sacHPYi.exe
  2⤵
  PID:9488
- C:\Windows\System32\aIyZXKB.exe
  C:\Windows\System32\aIyZXKB.exe
  2⤵
  PID:9508
- C:\Windows\System32\DMSCzqr.exe
  C:\Windows\System32\DMSCzqr.exe
  2⤵
  PID:9524
- C:\Windows\System32\HgYsdSd.exe
  C:\Windows\System32\HgYsdSd.exe
  2⤵
  PID:9552
- C:\Windows\System32\TuMoYhB.exe
  C:\Windows\System32\TuMoYhB.exe
  2⤵
  PID:9568
- C:\Windows\System32\cqoqtts.exe
  C:\Windows\System32\cqoqtts.exe
  2⤵
  PID:9592
- C:\Windows\System32\CgwwpiS.exe
  C:\Windows\System32\CgwwpiS.exe
  2⤵
  PID:9652
- C:\Windows\System32\BTnooEC.exe
  C:\Windows\System32\BTnooEC.exe
  2⤵
  PID:9684
- C:\Windows\System32\vJBwfGN.exe
  C:\Windows\System32\vJBwfGN.exe
  2⤵
  PID:9704
- C:\Windows\System32\cluwWOK.exe
  C:\Windows\System32\cluwWOK.exe
  2⤵
  PID:9752
- C:\Windows\System32\umcOyLY.exe
  C:\Windows\System32\umcOyLY.exe
  2⤵
  PID:9776
- C:\Windows\System32\uTnUZEH.exe
  C:\Windows\System32\uTnUZEH.exe
  2⤵
  PID:9796
- C:\Windows\System32\SlQusZa.exe
  C:\Windows\System32\SlQusZa.exe
  2⤵
  PID:9816
- C:\Windows\System32\KamQZGy.exe
  C:\Windows\System32\KamQZGy.exe
  2⤵
  PID:9852
- C:\Windows\System32\CgjqfXo.exe
  C:\Windows\System32\CgjqfXo.exe
  2⤵
  PID:9880
- C:\Windows\System32\PEqPIyV.exe
  C:\Windows\System32\PEqPIyV.exe
  2⤵
  PID:9904
- C:\Windows\System32\DOieeUo.exe
  C:\Windows\System32\DOieeUo.exe
  2⤵
  PID:9928
- C:\Windows\System32\ZEjeiuo.exe
  C:\Windows\System32\ZEjeiuo.exe
  2⤵
  PID:9952
- C:\Windows\System32\qCMBGwc.exe
  C:\Windows\System32\qCMBGwc.exe
  2⤵
  PID:10000
- C:\Windows\System32\nUaYuQz.exe
  C:\Windows\System32\nUaYuQz.exe
  2⤵
  PID:10024
- C:\Windows\System32\MUtxkXm.exe
  C:\Windows\System32\MUtxkXm.exe
  2⤵
  PID:10048
- C:\Windows\System32\cnGubXa.exe
  C:\Windows\System32\cnGubXa.exe
  2⤵
  PID:10068
- C:\Windows\System32\oSQfEIX.exe
  C:\Windows\System32\oSQfEIX.exe
  2⤵
  PID:10084
- C:\Windows\System32\xrTPrFB.exe
  C:\Windows\System32\xrTPrFB.exe
  2⤵
  PID:10128
- C:\Windows\System32\dOwqNRk.exe
  C:\Windows\System32\dOwqNRk.exe
  2⤵
  PID:10184
- C:\Windows\System32\BitZkwP.exe
  C:\Windows\System32\BitZkwP.exe
  2⤵
  PID:10200
- C:\Windows\System32\YlLyKYI.exe
  C:\Windows\System32\YlLyKYI.exe
  2⤵
  PID:10224
- C:\Windows\System32\kfBmycK.exe
  C:\Windows\System32\kfBmycK.exe
  2⤵
  PID:8664
- C:\Windows\System32\CCjUKUw.exe
  C:\Windows\System32\CCjUKUw.exe
  2⤵
  PID:8744
- C:\Windows\System32\IYlBZTa.exe
  C:\Windows\System32\IYlBZTa.exe
  2⤵
  PID:2416
- C:\Windows\System32\KVDjbxt.exe
  C:\Windows\System32\KVDjbxt.exe
  2⤵
  PID:2200
- C:\Windows\System32\CNpPUbq.exe
  C:\Windows\System32\CNpPUbq.exe
  2⤵
  PID:8584
- C:\Windows\System32\noztsie.exe
  C:\Windows\System32\noztsie.exe
  2⤵
  PID:9248
- C:\Windows\System32\xOhXBMK.exe
  C:\Windows\System32\xOhXBMK.exe
  2⤵
  PID:9296
- C:\Windows\System32\FOZtUKi.exe
  C:\Windows\System32\FOZtUKi.exe
  2⤵
  PID:9240
- C:\Windows\System32\UmdtktE.exe
  C:\Windows\System32\UmdtktE.exe
  2⤵
  PID:9364
- C:\Windows\System32\lJJBqud.exe
  C:\Windows\System32\lJJBqud.exe
  2⤵
  PID:9404
- C:\Windows\System32\eyKtzKg.exe
  C:\Windows\System32\eyKtzKg.exe
  2⤵
  PID:9540
- C:\Windows\System32\rcNmUEh.exe
  C:\Windows\System32\rcNmUEh.exe
  2⤵
  PID:9500
- C:\Windows\System32\Ukqejyg.exe
  C:\Windows\System32\Ukqejyg.exe
  2⤵
  PID:9584
- C:\Windows\System32\QmPLXwY.exe
  C:\Windows\System32\QmPLXwY.exe
  2⤵
  PID:9672
- C:\Windows\System32\KQQWpPo.exe
  C:\Windows\System32\KQQWpPo.exe
  2⤵
  PID:9716
- C:\Windows\System32\HzzGOFj.exe
  C:\Windows\System32\HzzGOFj.exe
  2⤵
  PID:9792
- C:\Windows\System32\rBWTTKe.exe
  C:\Windows\System32\rBWTTKe.exe
  2⤵
  PID:9936
- C:\Windows\System32\ZEyeAet.exe
  C:\Windows\System32\ZEyeAet.exe
  2⤵
  PID:9960
- C:\Windows\System32\UWhRBIb.exe
  C:\Windows\System32\UWhRBIb.exe
  2⤵
  PID:10016
- C:\Windows\System32\rPCiEBJ.exe
  C:\Windows\System32\rPCiEBJ.exe
  2⤵
  PID:5020
- C:\Windows\System32\AdmIgNW.exe
  C:\Windows\System32\AdmIgNW.exe
  2⤵
  PID:10136
- C:\Windows\System32\RNNzuBC.exe
  C:\Windows\System32\RNNzuBC.exe
  2⤵
  PID:10236
- C:\Windows\System32\ueJxUKe.exe
  C:\Windows\System32\ueJxUKe.exe
  2⤵
  PID:9056
- C:\Windows\System32\ebRBmev.exe
  C:\Windows\System32\ebRBmev.exe
  2⤵
  PID:9228
- C:\Windows\System32\CtENcDV.exe
  C:\Windows\System32\CtENcDV.exe
  2⤵
  PID:7744
- C:\Windows\System32\NXPsGAm.exe
  C:\Windows\System32\NXPsGAm.exe
  2⤵
  PID:4640
- C:\Windows\System32\PteVlhv.exe
  C:\Windows\System32\PteVlhv.exe
  2⤵
  PID:9600
- C:\Windows\System32\TYxZFeQ.exe
  C:\Windows\System32\TYxZFeQ.exe
  2⤵
  PID:9504
- C:\Windows\System32\FkgnvjR.exe
  C:\Windows\System32\FkgnvjR.exe
  2⤵
  PID:9700
- C:\Windows\System32\RWAqJNO.exe
  C:\Windows\System32\RWAqJNO.exe
  2⤵
  PID:9760
- C:\Windows\System32\bOhSPfa.exe
  C:\Windows\System32\bOhSPfa.exe
  2⤵
  PID:10064
- C:\Windows\System32\jbgIVZM.exe
  C:\Windows\System32\jbgIVZM.exe
  2⤵
  PID:4792
- C:\Windows\System32\ciXuSPz.exe
  C:\Windows\System32\ciXuSPz.exe
  2⤵
  PID:10232
- C:\Windows\System32\WieqPWm.exe
  C:\Windows\System32\WieqPWm.exe
  2⤵
  PID:9288
- C:\Windows\System32\tmevIrK.exe
  C:\Windows\System32\tmevIrK.exe
  2⤵
  PID:9720
- C:\Windows\System32\CJgKIEt.exe
  C:\Windows\System32\CJgKIEt.exe
  2⤵
  PID:10140
- C:\Windows\System32\UyiVyFG.exe
  C:\Windows\System32\UyiVyFG.exe
  2⤵
  PID:9412
- C:\Windows\System32\JQXZYKr.exe
  C:\Windows\System32\JQXZYKr.exe
  2⤵
  PID:5000
- C:\Windows\System32\ygmXwQu.exe
  C:\Windows\System32\ygmXwQu.exe
  2⤵
  PID:9924
- C:\Windows\System32\PacYaZd.exe
  C:\Windows\System32\PacYaZd.exe
  2⤵
  PID:10164
- C:\Windows\System32\dFXPMSL.exe
  C:\Windows\System32\dFXPMSL.exe
  2⤵
  PID:10272
- C:\Windows\System32\NpCDLwu.exe
  C:\Windows\System32\NpCDLwu.exe
  2⤵
  PID:10300
- C:\Windows\System32\uTVCfeu.exe
  C:\Windows\System32\uTVCfeu.exe
  2⤵
  PID:10316
- C:\Windows\System32\nukjLzH.exe
  C:\Windows\System32\nukjLzH.exe
  2⤵
  PID:10356
- C:\Windows\System32\DEimKmM.exe
  C:\Windows\System32\DEimKmM.exe
  2⤵
  PID:10372
- C:\Windows\System32\cGQdkiF.exe
  C:\Windows\System32\cGQdkiF.exe
  2⤵
  PID:10400
- C:\Windows\System32\VkpOwcR.exe
  C:\Windows\System32\VkpOwcR.exe
  2⤵
  PID:10428
- C:\Windows\System32\zIBoqVa.exe
  C:\Windows\System32\zIBoqVa.exe
  2⤵
  PID:10460
- C:\Windows\System32\VFbatFL.exe
  C:\Windows\System32\VFbatFL.exe
  2⤵
  PID:10508
- C:\Windows\System32\fOOOLZb.exe
  C:\Windows\System32\fOOOLZb.exe
  2⤵
  PID:10524
- C:\Windows\System32\dPMRFaQ.exe
  C:\Windows\System32\dPMRFaQ.exe
  2⤵
  PID:10540
- C:\Windows\System32\njnEkcA.exe
  C:\Windows\System32\njnEkcA.exe
  2⤵
  PID:10560
- C:\Windows\System32\ztgNvdI.exe
  C:\Windows\System32\ztgNvdI.exe
  2⤵
  PID:10596
- C:\Windows\System32\zaEMTaw.exe
  C:\Windows\System32\zaEMTaw.exe
  2⤵
  PID:10628
- C:\Windows\System32\QJfLfyZ.exe
  C:\Windows\System32\QJfLfyZ.exe
  2⤵
  PID:10660
- C:\Windows\System32\VUlyqiF.exe
  C:\Windows\System32\VUlyqiF.exe
  2⤵
  PID:10692
- C:\Windows\System32\QTPERNc.exe
  C:\Windows\System32\QTPERNc.exe
  2⤵
  PID:10716
- C:\Windows\System32\tWhRHsK.exe
  C:\Windows\System32\tWhRHsK.exe
  2⤵
  PID:10732
- C:\Windows\System32\aGJKVAf.exe
  C:\Windows\System32\aGJKVAf.exe
  2⤵
  PID:10752
- C:\Windows\System32\DRWhIfH.exe
  C:\Windows\System32\DRWhIfH.exe
  2⤵
  PID:10768
- C:\Windows\System32\hSDOThp.exe
  C:\Windows\System32\hSDOThp.exe
  2⤵
  PID:10784
- C:\Windows\System32\LGkRvuQ.exe
  C:\Windows\System32\LGkRvuQ.exe
  2⤵
  PID:10860
- C:\Windows\System32\iRcPXPO.exe
  C:\Windows\System32\iRcPXPO.exe
  2⤵
  PID:10880
- C:\Windows\System32\MjOeSoV.exe
  C:\Windows\System32\MjOeSoV.exe
  2⤵
  PID:10900
- C:\Windows\System32\KauzoUJ.exe
  C:\Windows\System32\KauzoUJ.exe
  2⤵
  PID:10928
- C:\Windows\System32\fwpjFjI.exe
  C:\Windows\System32\fwpjFjI.exe
  2⤵
  PID:10964
- C:\Windows\System32\IkTqeQI.exe
  C:\Windows\System32\IkTqeQI.exe
  2⤵
  PID:11004
- C:\Windows\System32\AksuuJN.exe
  C:\Windows\System32\AksuuJN.exe
  2⤵
  PID:11024
- C:\Windows\System32\ynvZExS.exe
  C:\Windows\System32\ynvZExS.exe
  2⤵
  PID:11064
- C:\Windows\System32\JctFXCX.exe
  C:\Windows\System32\JctFXCX.exe
  2⤵
  PID:11080
- C:\Windows\System32\CJOApll.exe
  C:\Windows\System32\CJOApll.exe
  2⤵
  PID:11100
- C:\Windows\System32\quHziYQ.exe
  C:\Windows\System32\quHziYQ.exe
  2⤵
  PID:11128
- C:\Windows\System32\zEnDlza.exe
  C:\Windows\System32\zEnDlza.exe
  2⤵
  PID:11152
- C:\Windows\System32\acddSuu.exe
  C:\Windows\System32\acddSuu.exe
  2⤵
  PID:11188
- C:\Windows\System32\BlOCvWz.exe
  C:\Windows\System32\BlOCvWz.exe
  2⤵
  PID:11216
- C:\Windows\System32\CiexddJ.exe
  C:\Windows\System32\CiexddJ.exe
  2⤵
  PID:11232
- C:\Windows\System32\UrRoIoT.exe
  C:\Windows\System32\UrRoIoT.exe
  2⤵
  PID:11256
- C:\Windows\System32\gvIAhgN.exe
  C:\Windows\System32\gvIAhgN.exe
  2⤵
  PID:10008
- C:\Windows\System32\PPZprPe.exe
  C:\Windows\System32\PPZprPe.exe
  2⤵
  PID:10312
- C:\Windows\System32\EyihDxF.exe
  C:\Windows\System32\EyihDxF.exe
  2⤵
  PID:10388
- C:\Windows\System32\pHmdjfs.exe
  C:\Windows\System32\pHmdjfs.exe
  2⤵
  PID:10532
- C:\Windows\System32\wYZZBiP.exe
  C:\Windows\System32\wYZZBiP.exe
  2⤵
  PID:10608
- C:\Windows\System32\qKpJBoz.exe
  C:\Windows\System32\qKpJBoz.exe
  2⤵
  PID:10676
- C:\Windows\System32\wIpybNQ.exe
  C:\Windows\System32\wIpybNQ.exe
  2⤵
  PID:10780
- C:\Windows\System32\jzyPEBQ.exe
  C:\Windows\System32\jzyPEBQ.exe
  2⤵
  PID:10820
- C:\Windows\System32\OmGXFRK.exe
  C:\Windows\System32\OmGXFRK.exe
  2⤵
  PID:10876
- C:\Windows\System32\XtVoUJF.exe
  C:\Windows\System32\XtVoUJF.exe
  2⤵
  PID:10944
- C:\Windows\System32\bQztkAF.exe
  C:\Windows\System32\bQztkAF.exe
  2⤵
  PID:11016
- C:\Windows\System32\xtkHIeG.exe
  C:\Windows\System32\xtkHIeG.exe
  2⤵
  PID:11072
- C:\Windows\System32\xOyBNWW.exe
  C:\Windows\System32\xOyBNWW.exe
  2⤵
  PID:11108
- C:\Windows\System32\ZmdndRJ.exe
  C:\Windows\System32\ZmdndRJ.exe
  2⤵
  PID:11212
- C:\Windows\System32\hGkzZKC.exe
  C:\Windows\System32\hGkzZKC.exe
  2⤵
  PID:11224
- C:\Windows\System32\bdxpWKi.exe
  C:\Windows\System32\bdxpWKi.exe
  2⤵
  PID:10244
- C:\Windows\System32\yFEtTur.exe
  C:\Windows\System32\yFEtTur.exe
  2⤵
  PID:10392
- C:\Windows\System32\AODtOXZ.exe
  C:\Windows\System32\AODtOXZ.exe
  2⤵
  PID:10416
- C:\Windows\System32\TZWkaPc.exe
  C:\Windows\System32\TZWkaPc.exe
  2⤵
  PID:10620
- C:\Windows\System32\txlHJTk.exe
  C:\Windows\System32\txlHJTk.exe
  2⤵
  PID:10744
- C:\Windows\System32\pGYHxZP.exe
  C:\Windows\System32\pGYHxZP.exe
  2⤵
  PID:11176
- C:\Windows\System32\IZJchQv.exe
  C:\Windows\System32\IZJchQv.exe
  2⤵
  PID:10348
- C:\Windows\System32\lqfcUqV.exe
  C:\Windows\System32\lqfcUqV.exe
  2⤵
  PID:10828
- C:\Windows\System32\ohaovsC.exe
  C:\Windows\System32\ohaovsC.exe
  2⤵
  PID:3588
- C:\Windows\System32\HVdfYxB.exe
  C:\Windows\System32\HVdfYxB.exe
  2⤵
  PID:10504
- C:\Windows\System32\iWgrawX.exe
  C:\Windows\System32\iWgrawX.exe
  2⤵
  PID:11276
- C:\Windows\System32\WwCdTzg.exe
  C:\Windows\System32\WwCdTzg.exe
  2⤵
  PID:11300
- C:\Windows\System32\NtczefF.exe
  C:\Windows\System32\NtczefF.exe
  2⤵
  PID:11320
- C:\Windows\System32\qxJPcub.exe
  C:\Windows\System32\qxJPcub.exe
  2⤵
  PID:11352
- C:\Windows\System32\uMBSxgR.exe
  C:\Windows\System32\uMBSxgR.exe
  2⤵
  PID:11380
- C:\Windows\System32\RDzqEIO.exe
  C:\Windows\System32\RDzqEIO.exe
  2⤵
  PID:11420
- C:\Windows\System32\teSXtUx.exe
  C:\Windows\System32\teSXtUx.exe
  2⤵
  PID:11436
- C:\Windows\System32\jCLLNWh.exe
  C:\Windows\System32\jCLLNWh.exe
  2⤵
  PID:11456
- C:\Windows\System32\ZTQznly.exe
  C:\Windows\System32\ZTQznly.exe
  2⤵
  PID:11472
- C:\Windows\System32\sPKUhHH.exe
  C:\Windows\System32\sPKUhHH.exe
  2⤵
  PID:11500
- C:\Windows\System32\tOgEMio.exe
  C:\Windows\System32\tOgEMio.exe
  2⤵
  PID:11516
- C:\Windows\System32\AtekXli.exe
  C:\Windows\System32\AtekXli.exe
  2⤵
  PID:11540
- C:\Windows\System32\mrpmxTu.exe
  C:\Windows\System32\mrpmxTu.exe
  2⤵
  PID:11612
- C:\Windows\System32\duRmRWr.exe
  C:\Windows\System32\duRmRWr.exe
  2⤵
  PID:11636
- C:\Windows\System32\KvahcWO.exe
  C:\Windows\System32\KvahcWO.exe
  2⤵
  PID:11652
- C:\Windows\System32\JFZCcWB.exe
  C:\Windows\System32\JFZCcWB.exe
  2⤵
  PID:11672
- C:\Windows\System32\XLwBWRh.exe
  C:\Windows\System32\XLwBWRh.exe
  2⤵
  PID:11696
- C:\Windows\System32\AfvtLro.exe
  C:\Windows\System32\AfvtLro.exe
  2⤵
  PID:11760
- C:\Windows\System32\QEXMLKh.exe
  C:\Windows\System32\QEXMLKh.exe
  2⤵
  PID:11788
- C:\Windows\System32\VtifnMt.exe
  C:\Windows\System32\VtifnMt.exe
  2⤵
  PID:11816
- C:\Windows\System32\JBQmufO.exe
  C:\Windows\System32\JBQmufO.exe
  2⤵
  PID:11848
- C:\Windows\System32\oTbzwUj.exe
  C:\Windows\System32\oTbzwUj.exe
  2⤵
  PID:11872
- C:\Windows\System32\NqzThvv.exe
  C:\Windows\System32\NqzThvv.exe
  2⤵
  PID:11900
- C:\Windows\System32\GNhjlRM.exe
  C:\Windows\System32\GNhjlRM.exe
  2⤵
  PID:11932
- C:\Windows\System32\fWfDUUI.exe
  C:\Windows\System32\fWfDUUI.exe
  2⤵
  PID:11964
- C:\Windows\System32\kBWfcsd.exe
  C:\Windows\System32\kBWfcsd.exe
  2⤵
  PID:11984
- C:\Windows\System32\dUlETdI.exe
  C:\Windows\System32\dUlETdI.exe
  2⤵
  PID:12008
- C:\Windows\System32\ICfHaeT.exe
  C:\Windows\System32\ICfHaeT.exe
  2⤵
  PID:12036
- C:\Windows\System32\VXsMmXb.exe
  C:\Windows\System32\VXsMmXb.exe
  2⤵
  PID:12068
- C:\Windows\System32\DvSWQJK.exe
  C:\Windows\System32\DvSWQJK.exe
  2⤵
  PID:12104
- C:\Windows\System32\OPdtSmJ.exe
  C:\Windows\System32\OPdtSmJ.exe
  2⤵
  PID:12132
- C:\Windows\System32\ETXpZXV.exe
  C:\Windows\System32\ETXpZXV.exe
  2⤵
  PID:12148
- C:\Windows\System32\cdIvqBT.exe
  C:\Windows\System32\cdIvqBT.exe
  2⤵
  PID:12184
- C:\Windows\System32\vrmypCd.exe
  C:\Windows\System32\vrmypCd.exe
  2⤵
  PID:12200
- C:\Windows\System32\HSIVcrE.exe
  C:\Windows\System32\HSIVcrE.exe
  2⤵
  PID:12220
- C:\Windows\System32\EJeOAKB.exe
  C:\Windows\System32\EJeOAKB.exe
  2⤵
  PID:12260
- C:\Windows\System32\CvisymS.exe
  C:\Windows\System32\CvisymS.exe
  2⤵
  PID:11284
- C:\Windows\System32\gijgebe.exe
  C:\Windows\System32\gijgebe.exe
  2⤵
  PID:11348
- C:\Windows\System32\MwNwWlx.exe
  C:\Windows\System32\MwNwWlx.exe
  2⤵
  PID:11376
- C:\Windows\System32\dvUyuNc.exe
  C:\Windows\System32\dvUyuNc.exe
  2⤵
  PID:11388
- C:\Windows\System32\WTrbfGK.exe
  C:\Windows\System32\WTrbfGK.exe
  2⤵
  PID:11448
- C:\Windows\System32\sJayaIp.exe
  C:\Windows\System32\sJayaIp.exe
  2⤵
  PID:11560
- C:\Windows\System32\JstPWRs.exe
  C:\Windows\System32\JstPWRs.exe
  2⤵
  PID:11628
- C:\Windows\System32\OhZKwBs.exe
  C:\Windows\System32\OhZKwBs.exe
  2⤵
  PID:11668
- C:\Windows\System32\COrykGU.exe
  C:\Windows\System32\COrykGU.exe
  2⤵
  PID:11752
- C:\Windows\System32\DdbKGaV.exe
  C:\Windows\System32\DdbKGaV.exe
  2⤵
  PID:11836
- C:\Windows\System32\SmXYeUN.exe
  C:\Windows\System32\SmXYeUN.exe
  2⤵
  PID:11868
- C:\Windows\System32\EzHTfrM.exe
  C:\Windows\System32\EzHTfrM.exe
  2⤵
  PID:11920
- C:\Windows\System32\MWWVhob.exe
  C:\Windows\System32\MWWVhob.exe
  2⤵
  PID:12016
- C:\Windows\System32\MVZPYQO.exe
  C:\Windows\System32\MVZPYQO.exe
  2⤵
  PID:12032
- C:\Windows\System32\lBwUcOb.exe
  C:\Windows\System32\lBwUcOb.exe
  2⤵
  PID:12096
- C:\Windows\System32\uptcuMw.exe
  C:\Windows\System32\uptcuMw.exe
  2⤵
  PID:12208
- C:\Windows\System32\FGrlFaz.exe
  C:\Windows\System32\FGrlFaz.exe
  2⤵
  PID:12232
- C:\Windows\System32\EIqFZvN.exe
  C:\Windows\System32\EIqFZvN.exe
  2⤵
  PID:11316
- C:\Windows\System32\YgqRewa.exe
  C:\Windows\System32\YgqRewa.exe
  2⤵
  PID:11400
- C:\Windows\System32\YYjQBNW.exe
  C:\Windows\System32\YYjQBNW.exe
  2⤵
  PID:11660
- C:\Windows\System32\dzdyUKO.exe
  C:\Windows\System32\dzdyUKO.exe
  2⤵
  PID:11780
- C:\Windows\System32\OPQrcZP.exe
  C:\Windows\System32\OPQrcZP.exe
  2⤵
  PID:11856
- C:\Windows\System32\PCWsDYZ.exe
  C:\Windows\System32\PCWsDYZ.exe
  2⤵
  PID:12120
- C:\Windows\System32\ArXPsnE.exe
  C:\Windows\System32\ArXPsnE.exe
  2⤵
  PID:2300
- C:\Windows\System32\QkTehHk.exe
  C:\Windows\System32\QkTehHk.exe
  2⤵
  PID:11364
- C:\Windows\System32\BOxONBf.exe
  C:\Windows\System32\BOxONBf.exe
  2⤵
  PID:11524
- C:\Windows\System32\IlLoOzv.exe
  C:\Windows\System32\IlLoOzv.exe
  2⤵
  PID:11908
- C:\Windows\System32\DeCZNJz.exe
  C:\Windows\System32\DeCZNJz.exe
  2⤵
  PID:228
- C:\Windows\System32\lEOIuja.exe
  C:\Windows\System32\lEOIuja.exe
  2⤵
  PID:4992
- C:\Windows\System32\lcevFhb.exe
  C:\Windows\System32\lcevFhb.exe
  2⤵
  PID:11580
- C:\Windows\System32\CBcPsBg.exe
  C:\Windows\System32\CBcPsBg.exe
  2⤵
  PID:1320
- C:\Windows\System32\LKYSSHB.exe
  C:\Windows\System32\LKYSSHB.exe
  2⤵
  PID:368
- C:\Windows\System32\LbMWSDx.exe
  C:\Windows\System32\LbMWSDx.exe
  2⤵
  PID:12304
- C:\Windows\System32\BfVuQOp.exe
  C:\Windows\System32\BfVuQOp.exe
  2⤵
  PID:12328
- C:\Windows\System32\ydSyGwo.exe
  C:\Windows\System32\ydSyGwo.exe
  2⤵
  PID:12348
- C:\Windows\System32\PNHRekF.exe
  C:\Windows\System32\PNHRekF.exe
  2⤵
  PID:12376
- C:\Windows\System32\gfkmEWG.exe
  C:\Windows\System32\gfkmEWG.exe
  2⤵
  PID:12392
- C:\Windows\System32\EfRagcH.exe
  C:\Windows\System32\EfRagcH.exe
  2⤵
  PID:12416
- C:\Windows\System32\ojFGfBG.exe
  C:\Windows\System32\ojFGfBG.exe
  2⤵
  PID:12488
- C:\Windows\System32\YcapZww.exe
  C:\Windows\System32\YcapZww.exe
  2⤵
  PID:12508
- C:\Windows\System32\tyMqEJp.exe
  C:\Windows\System32\tyMqEJp.exe
  2⤵
  PID:12524
- C:\Windows\System32\YAKYFhs.exe
  C:\Windows\System32\YAKYFhs.exe
  2⤵
  PID:12564
- C:\Windows\System32\InVcCuW.exe
  C:\Windows\System32\InVcCuW.exe
  2⤵
  PID:12580
- C:\Windows\System32\EIoAUmG.exe
  C:\Windows\System32\EIoAUmG.exe
  2⤵
  PID:12612
- C:\Windows\System32\aiJtirg.exe
  C:\Windows\System32\aiJtirg.exe
  2⤵
  PID:12648
- C:\Windows\System32\rDhjOTC.exe
  C:\Windows\System32\rDhjOTC.exe
  2⤵
  PID:12676
- C:\Windows\System32\NFSEtwb.exe
  C:\Windows\System32\NFSEtwb.exe
  2⤵
  PID:12692
- C:\Windows\System32\NqnrFjC.exe
  C:\Windows\System32\NqnrFjC.exe
  2⤵
  PID:12712
- C:\Windows\System32\JalyQWx.exe
  C:\Windows\System32\JalyQWx.exe
  2⤵
  PID:12736
- C:\Windows\System32\youOAxN.exe
  C:\Windows\System32\youOAxN.exe
  2⤵
  PID:12788
- C:\Windows\System32\ZQhTYMQ.exe
  C:\Windows\System32\ZQhTYMQ.exe
  2⤵
  PID:12804
- C:\Windows\System32\PHGKDwF.exe
  C:\Windows\System32\PHGKDwF.exe
  2⤵
  PID:12820
- C:\Windows\System32\wPMGyMd.exe
  C:\Windows\System32\wPMGyMd.exe
  2⤵
  PID:12872
- C:\Windows\System32\zAGfLeX.exe
  C:\Windows\System32\zAGfLeX.exe
  2⤵
  PID:12904
- C:\Windows\System32\mpHixCM.exe
  C:\Windows\System32\mpHixCM.exe
  2⤵
  PID:12920
- C:\Windows\System32\AezCEzx.exe
  C:\Windows\System32\AezCEzx.exe
  2⤵
  PID:12944
- C:\Windows\System32\kpfWiqy.exe
  C:\Windows\System32\kpfWiqy.exe
  2⤵
  PID:12984
- C:\Windows\System32\cEYWjXA.exe
  C:\Windows\System32\cEYWjXA.exe
  2⤵
  PID:13008
- C:\Windows\System32\ycFjSCu.exe
  C:\Windows\System32\ycFjSCu.exe
  2⤵
  PID:13028
- C:\Windows\System32\lJHJHOY.exe
  C:\Windows\System32\lJHJHOY.exe
  2⤵
  PID:13056
- C:\Windows\System32\MqmoVMA.exe
  C:\Windows\System32\MqmoVMA.exe
  2⤵
  PID:13080
- C:\Windows\System32\kqtcjHJ.exe
  C:\Windows\System32\kqtcjHJ.exe
  2⤵
  PID:13112
- C:\Windows\System32\BWHjIcQ.exe
  C:\Windows\System32\BWHjIcQ.exe
  2⤵
  PID:13140
- C:\Windows\System32\dWDyflf.exe
  C:\Windows\System32\dWDyflf.exe
  2⤵
  PID:13160
- C:\Windows\System32\QsvvVIe.exe
  C:\Windows\System32\QsvvVIe.exe
  2⤵
  PID:13184
- C:\Windows\System32\TGmDTuH.exe
  C:\Windows\System32\TGmDTuH.exe
  2⤵
  PID:13216
- C:\Windows\System32\TptFFFq.exe
  C:\Windows\System32\TptFFFq.exe
  2⤵
  PID:13236
- C:\Windows\System32\RNysGga.exe
  C:\Windows\System32\RNysGga.exe
  2⤵
  PID:13264
- C:\Windows\System32\GctPppt.exe
  C:\Windows\System32\GctPppt.exe
  2⤵
  PID:13280
- C:\Windows\System32\ceepLfY.exe
  C:\Windows\System32\ceepLfY.exe
  2⤵
  PID:13296
- C:\Windows\System32\yATlgRA.exe
  C:\Windows\System32\yATlgRA.exe
  2⤵
  PID:12320
- C:\Windows\System32\ckbecEN.exe
  C:\Windows\System32\ckbecEN.exe
  2⤵
  PID:12516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BDPnqqv.exe

Path C:\Windows\System32\BDPnqqv.exe
Size 1.0MB
SHA256 748ee8825466262e96a1af22dd8164532518797f71a0ca172ca9304708710636
MD5 4f8705ec02c898049031ba2b8561c256
SHA1 c2e098ec21c1cb0a0407634f776a375eeca16d20
SHA512 bcc2d0a0c6420d85d4ae94feecb41fcde9c0d7d3f6f2f1b7b92b6577a8a68cd86b5bff43b5f7bfc491e0a1025853f88771b388a2ba22fc26e639f22065db8f34
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBo:knw9oUUEEDl37jcq4+
MD5 SHA1 SHA512 SSDEEP

Submit Download

GVMNOfc.exe

Path C:\Windows\System32\GVMNOfc.exe
Size 1.0MB
SHA256 69d3f917066726f6fd5942022ddf33f5503ea01727416ef1a778af9d919e6364
MD5 3568453d79182db4576a393ed8a3ef50
SHA1 0f6e7ed1c656bfd79ce585206785437ffbb49216
SHA512 2f86ec41bab1356c93ee265da39079c346f1a47e91aa914b68fe73d0c091cc9d1a8f91f1977e90abbea5ab8a79b94196eea92d62a36eaceb9b268b95b1f78a88
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBt:knw9oUUEEDl37jcq4j
MD5 SHA1 SHA512 SSDEEP

Submit Download

JwnWfcM.exe

Path C:\Windows\System32\JwnWfcM.exe
Size 1.0MB
SHA256 ef5917d2092c85618ead0f3b44d2dc580754f855ecc5f59aad29a5d6cea9cf76
MD5 cd3aa052de5496ae2573c0bb2f535bd1
SHA1 1ce0927d5e7c8deab8e94a45a1076c3546a5fead
SHA512 2b20476f9f874693169f5984735b29aeb5c6784dacb6fe1f770e6ee45186b670b7589955ae81fd8877df4b528254a42c6c88636d1aec2fbcb7f5018d53e5476c
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBu:knw9oUUEEDl37jcq4A
MD5 SHA1 SHA512 SSDEEP

Submit Download

JyTVzFS.exe

Path C:\Windows\System32\JyTVzFS.exe
Size 1.0MB
SHA256 862e4d5b869b7f61d5356c28599d5046a41298ee0f5d900330b63c803d853c4f
MD5 5d2d777e7fda99d93094efd307a873f7
SHA1 1711c8ccf458fa45df72bacfa1f3a9a63214055f
SHA512 5845153a662d85b7eb3644c12e5cb3630baebc675856bd9ba20ca0cb1170db9bd456cafb75db31f4cc451a7e7caa3de6e1f1b765ec25ea02933eb46df9972864
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBcJ:knw9oUUEEDl37jcq4i
MD5 SHA1 SHA512 SSDEEP

Submit Download

MXLMfRf.exe

Path C:\Windows\System32\MXLMfRf.exe
Size 1.0MB
SHA256 60546579e58f79979aed9e7e4ae229514d0018a632d4a89df44754da40cf0ad4
MD5 5cd12bdfcf10715afd668e1941c99ea5
SHA1 6a13fa4d0d81b33be00b5cb24fa7a62ea35e5a1c
SHA512 90b87430b62cff9fdc3e35230feb22846f58115500ea38e9aeabaa554b34cd60e895bfda46f04f0a833798b95ba1600f6fcf7350a222fc6dd35d15d7f7b9ce60
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBGG:knw9oUUEEDl37jcq4R
MD5 SHA1 SHA512 SSDEEP

Submit Download

PINkPJc.exe

Path C:\Windows\System32\PINkPJc.exe
Size 1.0MB
SHA256 1d1ff2ace629520196598e7f6186180b78e6368b1632201f8c2f288b89382202
MD5 996012a8065d96d7cc4927099f88804a
SHA1 74b80c50d815170c6fcda2c94396150b50aa28ce
SHA512 c451b3f95ac679502896c4ca81b21e15b5a48ed793cb5d18dec8605c54368df3586bb6ff089926f7071400c0961c8f4516a925fe69b82895364aca6e0082a3e5
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeB6:knw9oUUEEDl37jcq4A
MD5 SHA1 SHA512 SSDEEP

Submit Download

PqNSIkn.exe

Path C:\Windows\System32\PqNSIkn.exe
Size 1.0MB
SHA256 1bf61ceaf398364d4c74d1d656932266395196492d514ba61637f2c73f8ca09f
MD5 f95e5be57d0ae4e2ba44febad2e3efc0
SHA1 69fce607a613a66ca4659a00683e72b208a0946f
SHA512 76757f02687d68bcb407261fca76b046a7f159dab7c92e767a63408ac54155b8bcd04be31734405a608607ddf1a165f0c72efc9bb7855f3130c3f1a3103d2f19
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBR:knw9oUUEEDl37jcq4z
MD5 SHA1 SHA512 SSDEEP

Submit Download

QglFCNF.exe

Path C:\Windows\System32\QglFCNF.exe
Size 1.0MB
SHA256 b6effe6cdf0168b371c79b83f54e6e267ed3c848707cb59679d183bfe7c70628
MD5 6872baede926fd296d6616a2a8f33202
SHA1 54ad35488c1ee6892dfe029eae0dd3f19f3d32b1
SHA512 30aaa2572d0fc8368c42c5e93b2a9213188c98d58b5bdc3039e3ed8bff0bbf10469ed1c5a133d19b60b1513fd609e25e5aa59115704b1950d5a5b20cb24dd55f
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBA:knw9oUUEEDl37jcq4m
MD5 SHA1 SHA512 SSDEEP

Submit Download

QxMoNHU.exe

Path C:\Windows\System32\QxMoNHU.exe
Size 1.0MB
SHA256 fc40dde334a5c9cc5230e6cb84f09d8d57e0ae93d090325419e62b15e7b43df6
MD5 7ec9326da92f23b05ea76b17cbb1c586
SHA1 4b91e894af4f76a168b1c522f74c083f53fa532c
SHA512 4dc60ef0593bf294e5723d61317740b031278b36beda1a40d0abb0187a4469ecac850847a24376fc12b5ae8eb07d51af7712b491a01b2fadf61b08e21d833dab
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeB4:knw9oUUEEDl37jcq4W
MD5 SHA1 SHA512 SSDEEP

Submit Download

RbDzUan.exe

Path C:\Windows\System32\RbDzUan.exe
Size 1.0MB
SHA256 4e560ef8871dcaab98dc928843d3307a8ba56574fc850551e184a459810c00d4
MD5 506b00365eebb57135ee623837d5ea52
SHA1 d744e47205f3c057fa9af5ac93cae9da560b7596
SHA512 b0d3f333eaede0567ffdd87ad5dbdd78c22ab90a260c3186714f9afd9d5d257f9285f2f4ef5cbbf07c6689be9abdecee484597150f23d7ca538988ef045485c9
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeB3:knw9oUUEEDl37jcq4B
MD5 SHA1 SHA512 SSDEEP

Submit Download

SxqWKFO.exe

Path C:\Windows\System32\SxqWKFO.exe
Size 1.0MB
SHA256 ee96b0b602e5bc74745d0760dd63f922e63197dd018f2d10e0091b1b15eb1e42
MD5 abe0ae49123a1d93a66c185a4d08db3e
SHA1 1ae832084f3114261d6b1f8827de4cc9fa2e9b1e
SHA512 51451b4d1cbeafcd48fcd630004ccd00d44e32616a80b37cdb3c371c5e29a965fc873ac58d652f78bff78e4f2b29e837fd58145820dc81fb1bdb4bd8a68dcdcd
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBS:knw9oUUEEDl37jcq4g
MD5 SHA1 SHA512 SSDEEP

Submit Download

UlwlWMN.exe

Path C:\Windows\System32\UlwlWMN.exe
Size 1.0MB
SHA256 703b60cca705930a52ddfbe92d63bcc7ffc2dce5d84a1da29e7a03e0fce7e393
MD5 b4e4fbc401193f84e2a4747ee85c86f8
SHA1 a51006214781c4e91df00fdb00cf1f56ddf95c93
SHA512 c4266f18cf4ef66cb1def5ccd471677b48499d70c8daaca07cfdaebcb4e0dc4eb6676ebe087ff0880f2cb6b2de8c9b8618d7a70ba9c1ef26eea589e7129bdbfd
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeB5:knw9oUUEEDl37jcq43
MD5 SHA1 SHA512 SSDEEP

Submit Download

dFLtMds.exe

Path C:\Windows\System32\dFLtMds.exe
Size 1.0MB
SHA256 39d706d1ce6752c678648f22c8c6de0e4b2ff65ccb6662b7504a770b4302899a
MD5 a6710dd8a094abb65836ce0be270c25a
SHA1 1dac8b139b27417964415116b276d0810b728496
SHA512 37c9f30304b95953e34fa8676014cc22c14df4d43de0e85d5ed755567b803fd17d5ca2315df411ea8b518edec307d4691d02abcb3bc8500656a931511e426d1a
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeB7:knw9oUUEEDl37jcq4d
MD5 SHA1 SHA512 SSDEEP

Submit Download

fSSdqmr.exe

Path C:\Windows\System32\fSSdqmr.exe
Size 1.0MB
SHA256 c9b3a9349403e490dff0cb4eed41e559bd75fcb3ab52416e374d128734d71afd
MD5 d934048018ed37b2e43af0e4e5d77adb
SHA1 e3b6a01bb9c909c2a99e8ed5cd3c1167133c230b
SHA512 85dde5a38621ca3440359cf9f150101c7e4691a6f3a39ea7dd828f6dc1c0905aff808eab21584a51f35596f16f69a775965e7d12b8cbe982d6e47aaa4ba6b1f8
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBu:knw9oUUEEDl37jcq4k
MD5 SHA1 SHA512 SSDEEP

Submit Download

jaiAboM.exe

Path C:\Windows\System32\jaiAboM.exe
Size 1.0MB
SHA256 2df2cccf4583ec862420b9ca9bd26a53a29edc115f83a5cac341dd530a427626
MD5 9410ac3ead09d648435a0427cf848009
SHA1 dd1ce171acec4b75f49437c17845d145025cbb2a
SHA512 a4055b5f6141198c29e9d39b2c670bb833d2d5349f77fccec4c5e3965a9a13143253af778dcc3f75bfe881bddf1670e65dcbc6a30f9aae921fa874cbb891024f
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBd:knw9oUUEEDl37jcq4f
MD5 SHA1 SHA512 SSDEEP

Submit Download

ktuCbGW.exe

Path C:\Windows\System32\ktuCbGW.exe
Size 1.0MB
SHA256 10261f512032140069ac5bb8e2b566b04644acb8999764a9f5c83b3fc6f34c7d
MD5 f4970ef12523c44188c79be4de2c637e
SHA1 ba5eae38e51e6a0c788cd0e89d52998d7b01ecc3
SHA512 332e4ce3274258c470ce1a733ad754ef054c1472a4a39ec2fb6e503d2c01f6aeb586d614d4226e4233f49afd65939c733574133e8d7b111e27ef0948a4444c54
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBk:knw9oUUEEDl37jcq4+
MD5 SHA1 SHA512 SSDEEP

Submit Download

nQEpIMq.exe

Path C:\Windows\System32\nQEpIMq.exe
Size 1.0MB
SHA256 7ea481c0fb75bb2f58cbeae88717350cbc4017282a35e4c08077aa8db2c45d01
MD5 d4e290e44677387991ef40ba5c98c211
SHA1 98e870de018fe36cf0ec43fdc4efbae75aafced5
SHA512 403d09edde26c417c6999e2574aa42f5eb1574d2dee7b906d954584532e425efde6d7ac02b906edf5f4c52074bce917917f34bf06c23d5c1b00868cdc1ecf553
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBg:knw9oUUEEDl37jcq46
MD5 SHA1 SHA512 SSDEEP

Submit Download

otkMypO.exe

Path C:\Windows\System32\otkMypO.exe
Size 1.0MB
SHA256 5f91cbd35a1866adba917e731c7ab591dba0b199b3d7d2c18d44a6027c1b8b4a
MD5 a3858abd5c06a798b7c047c5b514d26a
SHA1 0a0ec0d306d22a73cba0a00a9401377c58e89f59
SHA512 5e7bd2519e804c3e06c1db755d67bc096dd8c6f8483d8ce1e8a2dffe7e41dd9d09709ee6babfeb635a443d93a2cc922e972992a8d2d98c00cbcc03b1b770f27e
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBQ:knw9oUUEEDl37jcq4W
MD5 SHA1 SHA512 SSDEEP

Submit Download

pnKeGyo.exe

Path C:\Windows\System32\pnKeGyo.exe
Size 1.0MB
SHA256 3e86109d15bf611511e6077298c32295804c2f0e7b92e3b018648521ea367cc5
MD5 ef3ab05c93285af648e24f3f7ec50e02
SHA1 ab4e5e7efc1fd3acb398f9850c54c64864b2ec0c
SHA512 c4a50b90a93378fd143e1098fe8f34f40384e258c447292456c931d00ba61758b7b72e13c0e2db9c2eace3b286b101b4eed708bf70e4376779c9c0083279d54d
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBB:knw9oUUEEDl37jcq4z
MD5 SHA1 SHA512 SSDEEP

Submit Download

pvumvYk.exe

Path C:\Windows\System32\pvumvYk.exe
Size 1.0MB
SHA256 a6dcdb7a7c796c24860f140e280520c509e4467c45303e7049d4912b66c8bf12
MD5 b2d9eaea7731d0e979f3c1de5dfec081
SHA1 8de125b27d6a0e11add95a1201aa9c237b3656dd
SHA512 1a05b5b15ad05c66246c1e14b5c0795d70ef4632dbaec6bf8b6b93a767e85059aad446550ee2c131f4ad20b3b7499315131dc162abbaf9285ee9257e4977198c
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeB6:knw9oUUEEDl37jcq4I
MD5 SHA1 SHA512 SSDEEP

Submit Download

qSxmcVz.exe

Path C:\Windows\System32\qSxmcVz.exe
Size 1.0MB
SHA256 645d6dcf0d71611defda4860ad3de5b2f8fdb9eed3a4a8387dd043cb21a93ef5
MD5 af59d436455dac8fc27cb30219f896a1
SHA1 396b264db73e251ff7e7c84e90231f52299e792f
SHA512 0deb225e042671460d4a90ee55efab00844c99258ba5da88993722a4ae34070621c696d5cd61d2085aa4c9b23bbfafb48121b96f2efaf21e6280718dcb440625
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBa:knw9oUUEEDl37jcq4s
MD5 SHA1 SHA512 SSDEEP

Submit Download

qxVjfmj.exe

Path C:\Windows\System32\qxVjfmj.exe
Size 1.0MB
SHA256 b762092af66cbdef14319d2359979a86e46bcd138a1760851b336893124d36c1
MD5 b7394591be7d2747cc89f3ab58c4611e
SHA1 9f2eeff86c7d184f9ac9bd2f58ce681706500d35
SHA512 511447da3a4d932312a24ac5f485d557683aaa7a2375c6f043c07d4f054975a7763c7828378679255638ff46eb6712ec476c280ea9315cf9e2581f86e2bfb675
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBS:knw9oUUEEDl37jcq4s
MD5 SHA1 SHA512 SSDEEP

Submit Download

rQBChjZ.exe

Path C:\Windows\System32\rQBChjZ.exe
Size 1.0MB
SHA256 da823aac689723ff688047bb4f7177317f5e6a5cf7cda4dc8207fe6b6292886d
MD5 ed5633d742d40b8f6d889a7b4c6af944
SHA1 5d4cb192e8f71bffe7be8320eb2f57740e7d5d88
SHA512 219541d56657b979ef390fbf1dfb252600c7321365e8a824153ffae02d129b5076c8af035664ed1e3206e23ac33ac8a95e2fc40ed2a174891754cee6d6699b53
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBc:knw9oUUEEDl37jcq42
MD5 SHA1 SHA512 SSDEEP

Submit Download

sLBUYDD.exe

Path C:\Windows\System32\sLBUYDD.exe
Size 1.0MB
SHA256 fb1cab45da95fd4b561536a1ffab9501047f6c439b4a46a8e699327aea990d51
MD5 effbfccb3bc9bc58f37e0fe4c5814b57
SHA1 d0cd7ecde1a179f0043a1155942fb1af6505530b
SHA512 05437548aa2d7dff64efd877fb13c99f97b3a44304c6de7f8cb7209dbe99a3b621d276be9a87ba1d768ef61ef766e2bdc7fff654c17c91489989398e2c4f6ade
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBH:knw9oUUEEDl37jcq41
MD5 SHA1 SHA512 SSDEEP

Submit Download

sNQqqll.exe

Path C:\Windows\System32\sNQqqll.exe
Size 1.0MB
SHA256 fab72fda103ddb1230424b00f52eb9bdd372218384b948b16f27fd419abddfbf
MD5 1085aff5cd28c49ec9ac78d54de62e3b
SHA1 b19931e5b00c1efb04779fd7973b3592b69a982d
SHA512 df220c469ddacd8d5fb1bbef991d832429e046b2d20331ca3a3cdf645a73a454295c575b22be223a54a6395802b5bf78945a2b25cf45f6bfa5e3430e8b155441
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBN:knw9oUUEEDl37jcq4b
MD5 SHA1 SHA512 SSDEEP

Submit Download

tsFkUGI.exe

Path C:\Windows\System32\tsFkUGI.exe
Size 1.0MB
SHA256 08083bbf7a6a55a81dac69c7b0bc13ebda08718c92868f3f197614bbfcfda522
MD5 ff44a16e45f7e32a0a3af6291422b59c
SHA1 8f7b002d796c96bcf5aa911de4a78c3b3d29c8d8
SHA512 d2d7e52df328ae5c7b7f27a982bb5e207ab1afda3544ff10e5a22475ea198a1d25a69b17f4bc51129e56883d0aa8ca0a1ee2fc74bacc1b9367a89d598477112e
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBg:knw9oUUEEDl37jcq4G
MD5 SHA1 SHA512 SSDEEP

Submit Download

uGDitCV.exe

Path C:\Windows\System32\uGDitCV.exe
Size 1.0MB
SHA256 fc2a1c4021043ceaeaf99e5b80245e3b89ca4d18662afccff23d8382a8886399
MD5 4754ca0a43c3163281642ef50e27f97d
SHA1 18c6205b09598b804681c7057222ccb4f6f730f6
SHA512 2933ecb6451b72d12b3d96129322f5578beb64a86f73af56c8ca00b80942200ed2c2911cdb22046951cd94c2e29a582d4e180115497f4ca9e0f39a837ae28766
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBP:knw9oUUEEDl37jcq4h
MD5 SHA1 SHA512 SSDEEP

Submit Download

wDntKLK.exe

Path C:\Windows\System32\wDntKLK.exe
Size 1.0MB
SHA256 4df4d2850885ecad902a26a52e202aa2c2498d65c10306b5ea7bb279055a7cd3
MD5 7e18860e81210f50a161f661b2ace93b
SHA1 515b81d1cdf0fc651faefe150417eff5aa8e48b0
SHA512 3e04866fe9fe9bfbf6767343977e8919b0a2de38abe56073c864801b0b199958a8dfe1f193708f3688700e5cd220b13606f84d21fc30bdd7b384f1d097566955
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeB5R:knw9oUUEEDl37jcq4h
MD5 SHA1 SHA512 SSDEEP

Submit Download

xRbKTsJ.exe

Path C:\Windows\System32\xRbKTsJ.exe
Size 1.0MB
SHA256 5132549d315a11fd9694a94ce6cbbeb0800db682ec5960265d0a7fe923d50c69
MD5 0a8562a9a19854fb77177e1fb0ae2a38
SHA1 51ee4b6c76b3631cfc85683c42c81abdbc6d9e4f
SHA512 e14e5cebc212157946915bd450ecb246d7669776ab17187ba04624ae31b7c204868e6c99796caae368c188e3bbae9f662d515546130662330aa0cc133c9b4540
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBT:knw9oUUEEDl37jcq4B
MD5 SHA1 SHA512 SSDEEP

Submit Download

yFvtnuj.exe

Path C:\Windows\System32\yFvtnuj.exe
Size 1.0MB
SHA256 4d7ff8ef81de7a43e84fef804bc517687c7b45b2388bd74f25b78a3ea5e58eef
MD5 9de03467c92c94c265602cb7980466a0
SHA1 f558a9b108e2a203f328352ba37a17eb71cb3671
SHA512 ac9f498d7e2b1f12c5d137ea9ae9f1db6c9285594b1ce3ebddcbc94c2481a4b10b81b85c94b64ae1b08c59d3081a26414dea8c420b7cb07fcab8f7e0bfb40dfa
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBb:knw9oUUEEDl37jcq4N
MD5 SHA1 SHA512 SSDEEP

Submit Download

ylWFeHA.exe

Path C:\Windows\System32\ylWFeHA.exe
Size 1.0MB
SHA256 e7a7273c589af301f68a0f317650bd427902e11eba9ed66b86aca9be7c38ded8
MD5 43e33fb654f7e696a0bb103c2118950e
SHA1 6d6853bfc111a88190108210ddd37dd7632ff0c0
SHA512 5bc04a8fbe8da20d160ef86d348605ea934f8236f9a2ab4aff3175586ba55ce6b4cba52cc465ba7dd83601e4a1136d2ca6f5d5ac10c0b5e4dc0b5b00702a4949
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBK:knw9oUUEEDl37jcq4o
MD5 SHA1 SHA512 SSDEEP

Submit Download

zqcFPnF.exe

Path C:\Windows\System32\zqcFPnF.exe
Size 1.0MB
SHA256 ac3124f1c86e9ab64340b9c5db6a19088911fc84a18f8a777afebcdbd2c409df
MD5 3a29f41b83b43386bc8679c11427bab6
SHA1 6eab04c846fff1c1a87a8529388fa5d2d7e2ad9a
SHA512 ccf60bdadb6c480d327b699411ea22acbdeea619084f7dff78851b6f3e725743336ef5e5c9bdaa358d667db434c5fe56f794496653ff96c5b048007139d73eda
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBE:knw9oUUEEDl37jcq4m
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/312-0-0x00007FF73FB50000-0x00007FF73FF41000-memory.dmp

Download

memory/312-1-0x000001FC16310000-0x000001FC16320000-memory.dmp

Download

memory/1036-2057-0x00007FF7D3E20000-0x00007FF7D4211000-memory.dmp

Download

memory/1036-407-0x00007FF7D3E20000-0x00007FF7D4211000-memory.dmp

Download

memory/1040-2054-0x00007FF6988C0000-0x00007FF698CB1000-memory.dmp

Download

memory/1040-388-0x00007FF6988C0000-0x00007FF698CB1000-memory.dmp

Download

memory/1524-2072-0x00007FF6E23B0000-0x00007FF6E27A1000-memory.dmp

Download

memory/1524-413-0x00007FF6E23B0000-0x00007FF6E27A1000-memory.dmp

Download

memory/1916-2045-0x00007FF7E2470000-0x00007FF7E2861000-memory.dmp

Download

memory/1916-22-0x00007FF7E2470000-0x00007FF7E2861000-memory.dmp

Download

memory/2316-2053-0x00007FF68D7E0000-0x00007FF68DBD1000-memory.dmp

Download

memory/2316-409-0x00007FF68D7E0000-0x00007FF68DBD1000-memory.dmp

Download

memory/2640-2061-0x00007FF788F90000-0x00007FF789381000-memory.dmp

Download

memory/2640-457-0x00007FF788F90000-0x00007FF789381000-memory.dmp

Download

memory/2800-436-0x00007FF605B80000-0x00007FF605F71000-memory.dmp

Download

memory/2800-2076-0x00007FF605B80000-0x00007FF605F71000-memory.dmp

Download

memory/2872-2049-0x00007FF7C7070000-0x00007FF7C7461000-memory.dmp

Download

memory/2872-42-0x00007FF7C7070000-0x00007FF7C7461000-memory.dmp

Download

memory/2880-439-0x00007FF730490000-0x00007FF730881000-memory.dmp

Download

memory/2880-2080-0x00007FF730490000-0x00007FF730881000-memory.dmp

Download

memory/2908-2074-0x00007FF70BF30000-0x00007FF70C321000-memory.dmp

Download

memory/2908-435-0x00007FF70BF30000-0x00007FF70C321000-memory.dmp

Download

memory/2976-49-0x00007FF652340000-0x00007FF652731000-memory.dmp

Download

memory/2976-2066-0x00007FF652340000-0x00007FF652731000-memory.dmp

Download

memory/3036-379-0x00007FF7E9560000-0x00007FF7E9951000-memory.dmp

Download

memory/3036-2065-0x00007FF7E9560000-0x00007FF7E9951000-memory.dmp

Download

memory/3044-449-0x00007FF7D9EE0000-0x00007FF7DA2D1000-memory.dmp

Download

memory/3044-2091-0x00007FF7D9EE0000-0x00007FF7DA2D1000-memory.dmp

Download

memory/3160-2082-0x00007FF7D7EC0000-0x00007FF7D82B1000-memory.dmp

Download

memory/3160-448-0x00007FF7D7EC0000-0x00007FF7D82B1000-memory.dmp

Download

memory/3596-8-0x00007FF7BDB20000-0x00007FF7BDF11000-memory.dmp

Download

memory/3596-2042-0x00007FF7BDB20000-0x00007FF7BDF11000-memory.dmp

Download

memory/3596-1993-0x00007FF7BDB20000-0x00007FF7BDF11000-memory.dmp

Download

memory/3832-412-0x00007FF7688E0000-0x00007FF768CD1000-memory.dmp

Download

memory/3832-2068-0x00007FF7688E0000-0x00007FF768CD1000-memory.dmp

Download

memory/3892-2027-0x00007FF6522D0000-0x00007FF6526C1000-memory.dmp

Download

memory/3892-374-0x00007FF6522D0000-0x00007FF6526C1000-memory.dmp

Download

memory/3892-2063-0x00007FF6522D0000-0x00007FF6526C1000-memory.dmp

Download

memory/4016-428-0x00007FF7C1830000-0x00007FF7C1C21000-memory.dmp

Download

memory/4016-2078-0x00007FF7C1830000-0x00007FF7C1C21000-memory.dmp

Download

memory/4384-2084-0x00007FF765870000-0x00007FF765C61000-memory.dmp

Download

memory/4384-443-0x00007FF765870000-0x00007FF765C61000-memory.dmp

Download

memory/4452-2050-0x00007FF707230000-0x00007FF707621000-memory.dmp

Download

memory/4452-37-0x00007FF707230000-0x00007FF707621000-memory.dmp

Download

memory/4728-20-0x00007FF78A630000-0x00007FF78AA21000-memory.dmp

Download

memory/4728-2046-0x00007FF78A630000-0x00007FF78AA21000-memory.dmp

Download

memory/4912-2114-0x00007FF7F1E90000-0x00007FF7F2281000-memory.dmp

Download

memory/4912-454-0x00007FF7F1E90000-0x00007FF7F2281000-memory.dmp

Download

memory/4984-2058-0x00007FF75C230000-0x00007FF75C621000-memory.dmp

Download

memory/4984-399-0x00007FF75C230000-0x00007FF75C621000-memory.dmp

Download

memory/5108-44-0x00007FF6B5F30000-0x00007FF6B6321000-memory.dmp

Download

memory/5108-2071-0x00007FF6B5F30000-0x00007FF6B6321000-memory.dmp

Download

memory/5108-1994-0x00007FF6B5F30000-0x00007FF6B6321000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads