xmrig | faeec365975c74ab836378fe3231a55dec0ad15afbc28c56533655df472267f8

Analysis

max time kernel
93s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
Size 1.0MB
Sample240522-wt3xlabf43
SHA256 faeec365975c74ab836378fe3231a55dec0ad15afbc28c56533655df472267f8
MD5 6828e24f645a62d9a9afaec87ded78f5
SHA1 a4a1b278bc4564fdeb0d7842a7c4ca544a2e0fd8
SHA512 d26a2c44cd738ffa87c5ad911ae311ad8d2d9f8c8d5e2e2e2e45e93fafcf0c387d17aa3c4e24b71cfe5b79669d1ca3be8f9b71d32021f601048587286ab96efc
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBGC:knw9oUUEEDl37jcq4AC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 51 IoCs

miner

resource	yara_rule
behavioral2/memory/5088-281-0x00007FF6736A0000-0x00007FF673A91000-memory.dmp	xmrig
behavioral2/memory/4668-282-0x00007FF66B2C0000-0x00007FF66B6B1000-memory.dmp	xmrig
behavioral2/memory/2436-283-0x00007FF68B8C0000-0x00007FF68BCB1000-memory.dmp	xmrig
behavioral2/memory/3084-284-0x00007FF6048C0000-0x00007FF604CB1000-memory.dmp	xmrig
behavioral2/memory/4120-285-0x00007FF67A220000-0x00007FF67A611000-memory.dmp	xmrig
behavioral2/memory/3952-286-0x00007FF777DB0000-0x00007FF7781A1000-memory.dmp	xmrig
behavioral2/memory/1748-287-0x00007FF79B200000-0x00007FF79B5F1000-memory.dmp	xmrig
behavioral2/memory/4192-288-0x00007FF6D01A0000-0x00007FF6D0591000-memory.dmp	xmrig
behavioral2/memory/3516-290-0x00007FF79A750000-0x00007FF79AB41000-memory.dmp	xmrig
behavioral2/memory/896-289-0x00007FF67B800000-0x00007FF67BBF1000-memory.dmp	xmrig
behavioral2/memory/2152-292-0x00007FF6A30A0000-0x00007FF6A3491000-memory.dmp	xmrig
behavioral2/memory/3936-296-0x00007FF632E20000-0x00007FF633211000-memory.dmp	xmrig
behavioral2/memory/3044-302-0x00007FF74B830000-0x00007FF74BC21000-memory.dmp	xmrig
behavioral2/memory/2084-307-0x00007FF669EF0000-0x00007FF66A2E1000-memory.dmp	xmrig
behavioral2/memory/4832-309-0x00007FF6137D0000-0x00007FF613BC1000-memory.dmp	xmrig
behavioral2/memory/688-311-0x00007FF709860000-0x00007FF709C51000-memory.dmp	xmrig
behavioral2/memory/2052-313-0x00007FF7217E0000-0x00007FF721BD1000-memory.dmp	xmrig
behavioral2/memory/396-304-0x00007FF6DC0D0000-0x00007FF6DC4C1000-memory.dmp	xmrig
behavioral2/memory/996-45-0x00007FF62AC10000-0x00007FF62B001000-memory.dmp	xmrig
behavioral2/memory/4700-317-0x00007FF753B70000-0x00007FF753F61000-memory.dmp	xmrig
behavioral2/memory/1844-320-0x00007FF7D8900000-0x00007FF7D8CF1000-memory.dmp	xmrig
behavioral2/memory/2648-323-0x00007FF6CB7E0000-0x00007FF6CBBD1000-memory.dmp	xmrig
behavioral2/memory/3404-17-0x00007FF717DB0000-0x00007FF7181A1000-memory.dmp	xmrig
behavioral2/memory/5068-14-0x00007FF699900000-0x00007FF699CF1000-memory.dmp	xmrig
behavioral2/memory/2132-1988-0x00007FF6A2460000-0x00007FF6A2851000-memory.dmp	xmrig
behavioral2/memory/3404-1989-0x00007FF717DB0000-0x00007FF7181A1000-memory.dmp	xmrig
behavioral2/memory/996-1990-0x00007FF62AC10000-0x00007FF62B001000-memory.dmp	xmrig
behavioral2/memory/5068-2027-0x00007FF699900000-0x00007FF699CF1000-memory.dmp	xmrig
behavioral2/memory/3404-2029-0x00007FF717DB0000-0x00007FF7181A1000-memory.dmp	xmrig
behavioral2/memory/1844-2032-0x00007FF7D8900000-0x00007FF7D8CF1000-memory.dmp	xmrig
behavioral2/memory/996-2033-0x00007FF62AC10000-0x00007FF62B001000-memory.dmp	xmrig
behavioral2/memory/2648-2040-0x00007FF6CB7E0000-0x00007FF6CBBD1000-memory.dmp	xmrig
behavioral2/memory/1748-2043-0x00007FF79B200000-0x00007FF79B5F1000-memory.dmp	xmrig
behavioral2/memory/896-2056-0x00007FF67B800000-0x00007FF67BBF1000-memory.dmp	xmrig
behavioral2/memory/2152-2057-0x00007FF6A30A0000-0x00007FF6A3491000-memory.dmp	xmrig
behavioral2/memory/396-2063-0x00007FF6DC0D0000-0x00007FF6DC4C1000-memory.dmp	xmrig
behavioral2/memory/2084-2065-0x00007FF669EF0000-0x00007FF66A2E1000-memory.dmp	xmrig
behavioral2/memory/3936-2061-0x00007FF632E20000-0x00007FF633211000-memory.dmp	xmrig
behavioral2/memory/3044-2059-0x00007FF74B830000-0x00007FF74BC21000-memory.dmp	xmrig
behavioral2/memory/4192-2053-0x00007FF6D01A0000-0x00007FF6D0591000-memory.dmp	xmrig
behavioral2/memory/5088-2051-0x00007FF6736A0000-0x00007FF673A91000-memory.dmp	xmrig
behavioral2/memory/3516-2049-0x00007FF79A750000-0x00007FF79AB41000-memory.dmp	xmrig
behavioral2/memory/2436-2046-0x00007FF68B8C0000-0x00007FF68BCB1000-memory.dmp	xmrig
behavioral2/memory/4668-2041-0x00007FF66B2C0000-0x00007FF66B6B1000-memory.dmp	xmrig
behavioral2/memory/3084-2047-0x00007FF6048C0000-0x00007FF604CB1000-memory.dmp	xmrig
behavioral2/memory/2052-2077-0x00007FF7217E0000-0x00007FF721BD1000-memory.dmp	xmrig
behavioral2/memory/4700-2083-0x00007FF753B70000-0x00007FF753F61000-memory.dmp	xmrig
behavioral2/memory/4832-2082-0x00007FF6137D0000-0x00007FF613BC1000-memory.dmp	xmrig
behavioral2/memory/688-2076-0x00007FF709860000-0x00007FF709C51000-memory.dmp	xmrig
behavioral2/memory/4120-2038-0x00007FF67A220000-0x00007FF67A611000-memory.dmp	xmrig
behavioral2/memory/3952-2036-0x00007FF777DB0000-0x00007FF7781A1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
5068	tOuEmXv.exe
3404	gqaOEtw.exe
996	WeDYHDf.exe
1844	yRgEWRJ.exe
5088	YCqXQxW.exe
4668	Jtlimmb.exe
2436	CAOPxbL.exe
3084	zBSsyiq.exe
2648	HNQBhCy.exe
4120	rucWabS.exe
3952	daCsNUl.exe
1748	YOxHwzn.exe
4192	sPUShrz.exe
896	SizKWOZ.exe
3516	ztpyYGB.exe
2152	mIQpqLQ.exe
3936	TiqINRw.exe
3044	rGSguoN.exe
396	FooLlKO.exe
2084	CgDCJJQ.exe
4832	RTRwbdG.exe
688	wLqTuqE.exe
2052	sHgeyMF.exe
4700	SKYqEjU.exe
3956	IbAJdGX.exe
1500	NkvOgDJ.exe
1968	nvAAHHa.exe
3368	BqPVoWH.exe
2864	KxMsZXn.exe
2272	EgZylpr.exe
1612	wtEuCHs.exe
2612	azDJQKm.exe
864	LpAYvUl.exe
1036	PPczQSG.exe
1448	JtLiEHa.exe
5056	UdqGLJx.exe
2544	Qfpufaq.exe
4432	qSvXEVi.exe
3840	LOLtarO.exe
2056	aajqWhW.exe
4340	GLlPCGH.exe
432	LuBQrAK.exe
3452	EEbtXuY.exe
616	dejiLFY.exe
3940	RfdKMxj.exe
4108	TkkJaSi.exe
956	ekbwaXF.exe
2300	sNSxFAX.exe
2476	cccjWld.exe
4644	MvxsVje.exe
824	cndZLYi.exe
1400	gtloopM.exe
4880	ZwmFWcT.exe
2984	FnjSoNJ.exe
3928	AeFhcJW.exe
4528	hqDxJle.exe
2768	QMkyMRx.exe
4976	UUFZuAB.exe
4944	BwaiRhi.exe
1128	QpabFoo.exe
952	XwsludV.exe
4284	UXRfOXD.exe
3472	NqdDkYS.exe
1528	YRunVUV.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2132-0-0x00007FF6A2460000-0x00007FF6A2851000-memory.dmp	upx
behavioral2/files/0x000800000002343b-6.dat	upx
behavioral2/files/0x0007000000023442-8.dat	upx
behavioral2/files/0x0008000000023441-16.dat	upx
behavioral2/files/0x0007000000023443-23.dat	upx
behavioral2/files/0x0007000000023445-28.dat	upx
behavioral2/files/0x0007000000023446-33.dat	upx
behavioral2/files/0x0007000000023447-38.dat	upx
behavioral2/files/0x0007000000023449-47.dat	upx
behavioral2/files/0x000700000002344b-57.dat	upx
behavioral2/files/0x000700000002344c-64.dat	upx
behavioral2/files/0x000700000002344d-69.dat	upx
behavioral2/files/0x000700000002344e-75.dat	upx
behavioral2/files/0x0007000000023451-87.dat	upx
behavioral2/files/0x0007000000023454-102.dat	upx
behavioral2/files/0x0007000000023455-109.dat	upx
behavioral2/files/0x0007000000023458-124.dat	upx
behavioral2/files/0x000700000002345a-134.dat	upx
behavioral2/files/0x000700000002345c-145.dat	upx
behavioral2/files/0x000700000002345e-155.dat	upx
behavioral2/memory/5088-281-0x00007FF6736A0000-0x00007FF673A91000-memory.dmp	upx
behavioral2/memory/4668-282-0x00007FF66B2C0000-0x00007FF66B6B1000-memory.dmp	upx
behavioral2/memory/2436-283-0x00007FF68B8C0000-0x00007FF68BCB1000-memory.dmp	upx
behavioral2/memory/3084-284-0x00007FF6048C0000-0x00007FF604CB1000-memory.dmp	upx
behavioral2/memory/4120-285-0x00007FF67A220000-0x00007FF67A611000-memory.dmp	upx
behavioral2/memory/3952-286-0x00007FF777DB0000-0x00007FF7781A1000-memory.dmp	upx
behavioral2/files/0x0007000000023460-164.dat	upx
behavioral2/files/0x000700000002345f-159.dat	upx
behavioral2/files/0x000700000002345d-149.dat	upx
behavioral2/files/0x000700000002345b-139.dat	upx
behavioral2/files/0x0007000000023459-130.dat	upx
behavioral2/memory/1748-287-0x00007FF79B200000-0x00007FF79B5F1000-memory.dmp	upx
behavioral2/memory/4192-288-0x00007FF6D01A0000-0x00007FF6D0591000-memory.dmp	upx
behavioral2/files/0x0007000000023457-120.dat	upx
behavioral2/files/0x0007000000023456-114.dat	upx
behavioral2/memory/3516-290-0x00007FF79A750000-0x00007FF79AB41000-memory.dmp	upx
behavioral2/memory/896-289-0x00007FF67B800000-0x00007FF67BBF1000-memory.dmp	upx
behavioral2/files/0x0007000000023453-100.dat	upx
behavioral2/files/0x0007000000023452-94.dat	upx
behavioral2/files/0x0007000000023450-84.dat	upx
behavioral2/memory/2152-292-0x00007FF6A30A0000-0x00007FF6A3491000-memory.dmp	upx
behavioral2/files/0x000700000002344f-79.dat	upx
behavioral2/memory/3936-296-0x00007FF632E20000-0x00007FF633211000-memory.dmp	upx
behavioral2/memory/3044-302-0x00007FF74B830000-0x00007FF74BC21000-memory.dmp	upx
behavioral2/memory/2084-307-0x00007FF669EF0000-0x00007FF66A2E1000-memory.dmp	upx
behavioral2/memory/4832-309-0x00007FF6137D0000-0x00007FF613BC1000-memory.dmp	upx
behavioral2/memory/688-311-0x00007FF709860000-0x00007FF709C51000-memory.dmp	upx
behavioral2/memory/2052-313-0x00007FF7217E0000-0x00007FF721BD1000-memory.dmp	upx
behavioral2/memory/396-304-0x00007FF6DC0D0000-0x00007FF6DC4C1000-memory.dmp	upx
behavioral2/files/0x000700000002344a-54.dat	upx
behavioral2/memory/996-45-0x00007FF62AC10000-0x00007FF62B001000-memory.dmp	upx
behavioral2/files/0x0007000000023448-43.dat	upx
behavioral2/memory/4700-317-0x00007FF753B70000-0x00007FF753F61000-memory.dmp	upx
behavioral2/memory/1844-320-0x00007FF7D8900000-0x00007FF7D8CF1000-memory.dmp	upx
behavioral2/memory/2648-323-0x00007FF6CB7E0000-0x00007FF6CBBD1000-memory.dmp	upx
behavioral2/memory/3404-17-0x00007FF717DB0000-0x00007FF7181A1000-memory.dmp	upx
behavioral2/memory/5068-14-0x00007FF699900000-0x00007FF699CF1000-memory.dmp	upx
behavioral2/memory/2132-1988-0x00007FF6A2460000-0x00007FF6A2851000-memory.dmp	upx
behavioral2/memory/3404-1989-0x00007FF717DB0000-0x00007FF7181A1000-memory.dmp	upx
behavioral2/memory/996-1990-0x00007FF62AC10000-0x00007FF62B001000-memory.dmp	upx
behavioral2/memory/5068-2027-0x00007FF699900000-0x00007FF699CF1000-memory.dmp	upx
behavioral2/memory/3404-2029-0x00007FF717DB0000-0x00007FF7181A1000-memory.dmp	upx
behavioral2/memory/1844-2032-0x00007FF7D8900000-0x00007FF7D8CF1000-memory.dmp	upx
behavioral2/memory/996-2033-0x00007FF62AC10000-0x00007FF62B001000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\sNSxFAX.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\hBkcuoM.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\kREwVOE.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\wvnkxZH.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\xTGtnny.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\VMnLGXs.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\wLqTuqE.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\BqPVoWH.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\hIkSCaq.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\YmyZbXH.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\nlRtfCi.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\SFhXBWJ.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\NwTxxRi.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\PPIILiT.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\diwQzkj.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\CLQRxGB.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\vErhZiK.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\ftqNnbz.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\dejiLFY.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\FNAHatq.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\aLSrMNX.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\psRypLa.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\KYJOPlZ.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\gbUmJwk.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\yqFENLp.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\NvgkxgQ.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\idjFwrq.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\JtLiEHa.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\eAcsWSR.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\FWclqoa.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\HFnfRLA.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\dOsFvki.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\snVznEM.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\xqMUYpo.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\UAoQAgF.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\PPczQSG.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\TkkJaSi.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\NaWbsKi.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\DYYYIpF.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\vHBVWMF.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\YdObCgd.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\RwfMLTc.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\BuXHaXz.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\ONDwDNm.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\wwkDcDl.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\QQyzPri.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\LbmtnDm.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\tiPngNT.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\qqlRwsv.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\tFDPsuJ.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\KyuwCKM.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\Qfpufaq.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\bQHPtWA.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\WIjCdHx.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\SssSYZO.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\PZSShBB.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\NOlieul.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\owoKWiR.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\qWcsuav.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\SiGUpXG.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\HSrjHbq.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\DcFVzGn.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\mTSkRrm.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
File created	C:\Windows\System32\AFMEfbY.exe	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 5068	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	86
PID 2132 wrote to memory of 5068	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	86
PID 2132 wrote to memory of 996	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	87
PID 2132 wrote to memory of 996	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	87
PID 2132 wrote to memory of 3404	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	88
PID 2132 wrote to memory of 3404	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	88
PID 2132 wrote to memory of 1844	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	89
PID 2132 wrote to memory of 1844	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	89
PID 2132 wrote to memory of 5088	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	90
PID 2132 wrote to memory of 5088	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	90
PID 2132 wrote to memory of 4668	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	91
PID 2132 wrote to memory of 4668	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	91
PID 2132 wrote to memory of 2436	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	92
PID 2132 wrote to memory of 2436	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	92
PID 2132 wrote to memory of 3084	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	93
PID 2132 wrote to memory of 3084	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	93
PID 2132 wrote to memory of 2648	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	95
PID 2132 wrote to memory of 2648	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	95
PID 2132 wrote to memory of 4120	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	97
PID 2132 wrote to memory of 4120	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	97
PID 2132 wrote to memory of 3952	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	98
PID 2132 wrote to memory of 3952	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	98
PID 2132 wrote to memory of 1748	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	99
PID 2132 wrote to memory of 1748	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	99
PID 2132 wrote to memory of 4192	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	100
PID 2132 wrote to memory of 4192	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	100
PID 2132 wrote to memory of 896	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	101
PID 2132 wrote to memory of 896	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	101
PID 2132 wrote to memory of 3516	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	102
PID 2132 wrote to memory of 3516	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	102
PID 2132 wrote to memory of 2152	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	103
PID 2132 wrote to memory of 2152	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	103
PID 2132 wrote to memory of 3936	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	104
PID 2132 wrote to memory of 3936	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	104
PID 2132 wrote to memory of 3044	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	105
PID 2132 wrote to memory of 3044	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	105
PID 2132 wrote to memory of 396	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	106
PID 2132 wrote to memory of 396	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	106
PID 2132 wrote to memory of 2084	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	107
PID 2132 wrote to memory of 2084	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	107
PID 2132 wrote to memory of 4832	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	108
PID 2132 wrote to memory of 4832	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	108
PID 2132 wrote to memory of 688	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	109
PID 2132 wrote to memory of 688	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	109
PID 2132 wrote to memory of 2052	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	110
PID 2132 wrote to memory of 2052	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	110
PID 2132 wrote to memory of 4700	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	111
PID 2132 wrote to memory of 4700	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	111
PID 2132 wrote to memory of 3956	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	112
PID 2132 wrote to memory of 3956	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	112
PID 2132 wrote to memory of 1500	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	113
PID 2132 wrote to memory of 1500	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	113
PID 2132 wrote to memory of 1968	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	114
PID 2132 wrote to memory of 1968	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	114
PID 2132 wrote to memory of 3368	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	115
PID 2132 wrote to memory of 3368	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	115
PID 2132 wrote to memory of 2864	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	116
PID 2132 wrote to memory of 2864	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	116
PID 2132 wrote to memory of 2272	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	117
PID 2132 wrote to memory of 2272	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	117
PID 2132 wrote to memory of 1612	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	118
PID 2132 wrote to memory of 1612	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	118
PID 2132 wrote to memory of 2612	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	119
PID 2132 wrote to memory of 2612	2132	6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe	119

C:\Users\Admin\AppData\Local\Temp\6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6828e24f645a62d9a9afaec87ded78f5_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\System32\tOuEmXv.exe
  C:\Windows\System32\tOuEmXv.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System32\WeDYHDf.exe
  C:\Windows\System32\WeDYHDf.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System32\gqaOEtw.exe
  C:\Windows\System32\gqaOEtw.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System32\yRgEWRJ.exe
  C:\Windows\System32\yRgEWRJ.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System32\YCqXQxW.exe
  C:\Windows\System32\YCqXQxW.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System32\Jtlimmb.exe
  C:\Windows\System32\Jtlimmb.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System32\CAOPxbL.exe
  C:\Windows\System32\CAOPxbL.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System32\zBSsyiq.exe
  C:\Windows\System32\zBSsyiq.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System32\HNQBhCy.exe
  C:\Windows\System32\HNQBhCy.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System32\rucWabS.exe
  C:\Windows\System32\rucWabS.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System32\daCsNUl.exe
  C:\Windows\System32\daCsNUl.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System32\YOxHwzn.exe
  C:\Windows\System32\YOxHwzn.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System32\sPUShrz.exe
  C:\Windows\System32\sPUShrz.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System32\SizKWOZ.exe
  C:\Windows\System32\SizKWOZ.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System32\ztpyYGB.exe
  C:\Windows\System32\ztpyYGB.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System32\mIQpqLQ.exe
  C:\Windows\System32\mIQpqLQ.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System32\TiqINRw.exe
  C:\Windows\System32\TiqINRw.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System32\rGSguoN.exe
  C:\Windows\System32\rGSguoN.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System32\FooLlKO.exe
  C:\Windows\System32\FooLlKO.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System32\CgDCJJQ.exe
  C:\Windows\System32\CgDCJJQ.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System32\RTRwbdG.exe
  C:\Windows\System32\RTRwbdG.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System32\wLqTuqE.exe
  C:\Windows\System32\wLqTuqE.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System32\sHgeyMF.exe
  C:\Windows\System32\sHgeyMF.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System32\SKYqEjU.exe
  C:\Windows\System32\SKYqEjU.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System32\IbAJdGX.exe
  C:\Windows\System32\IbAJdGX.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System32\NkvOgDJ.exe
  C:\Windows\System32\NkvOgDJ.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System32\nvAAHHa.exe
  C:\Windows\System32\nvAAHHa.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System32\BqPVoWH.exe
  C:\Windows\System32\BqPVoWH.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System32\KxMsZXn.exe
  C:\Windows\System32\KxMsZXn.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System32\EgZylpr.exe
  C:\Windows\System32\EgZylpr.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System32\wtEuCHs.exe
  C:\Windows\System32\wtEuCHs.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System32\azDJQKm.exe
  C:\Windows\System32\azDJQKm.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System32\LpAYvUl.exe
  C:\Windows\System32\LpAYvUl.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System32\PPczQSG.exe
  C:\Windows\System32\PPczQSG.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System32\JtLiEHa.exe
  C:\Windows\System32\JtLiEHa.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System32\UdqGLJx.exe
  C:\Windows\System32\UdqGLJx.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System32\Qfpufaq.exe
  C:\Windows\System32\Qfpufaq.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System32\qSvXEVi.exe
  C:\Windows\System32\qSvXEVi.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System32\LOLtarO.exe
  C:\Windows\System32\LOLtarO.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System32\aajqWhW.exe
  C:\Windows\System32\aajqWhW.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System32\GLlPCGH.exe
  C:\Windows\System32\GLlPCGH.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System32\LuBQrAK.exe
  C:\Windows\System32\LuBQrAK.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System32\EEbtXuY.exe
  C:\Windows\System32\EEbtXuY.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System32\dejiLFY.exe
  C:\Windows\System32\dejiLFY.exe
  2⤵
  - Executes dropped EXE
  PID:616
- C:\Windows\System32\RfdKMxj.exe
  C:\Windows\System32\RfdKMxj.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System32\TkkJaSi.exe
  C:\Windows\System32\TkkJaSi.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System32\ekbwaXF.exe
  C:\Windows\System32\ekbwaXF.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System32\sNSxFAX.exe
  C:\Windows\System32\sNSxFAX.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System32\cccjWld.exe
  C:\Windows\System32\cccjWld.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System32\MvxsVje.exe
  C:\Windows\System32\MvxsVje.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System32\cndZLYi.exe
  C:\Windows\System32\cndZLYi.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System32\gtloopM.exe
  C:\Windows\System32\gtloopM.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System32\ZwmFWcT.exe
  C:\Windows\System32\ZwmFWcT.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System32\FnjSoNJ.exe
  C:\Windows\System32\FnjSoNJ.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System32\AeFhcJW.exe
  C:\Windows\System32\AeFhcJW.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System32\hqDxJle.exe
  C:\Windows\System32\hqDxJle.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System32\QMkyMRx.exe
  C:\Windows\System32\QMkyMRx.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System32\UUFZuAB.exe
  C:\Windows\System32\UUFZuAB.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System32\BwaiRhi.exe
  C:\Windows\System32\BwaiRhi.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System32\QpabFoo.exe
  C:\Windows\System32\QpabFoo.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System32\XwsludV.exe
  C:\Windows\System32\XwsludV.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System32\UXRfOXD.exe
  C:\Windows\System32\UXRfOXD.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System32\NqdDkYS.exe
  C:\Windows\System32\NqdDkYS.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System32\YRunVUV.exe
  C:\Windows\System32\YRunVUV.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System32\knGieMF.exe
  C:\Windows\System32\knGieMF.exe
  2⤵
  PID:1728
- C:\Windows\System32\GADBOeC.exe
  C:\Windows\System32\GADBOeC.exe
  2⤵
  PID:2120
- C:\Windows\System32\sLDNTIU.exe
  C:\Windows\System32\sLDNTIU.exe
  2⤵
  PID:2332
- C:\Windows\System32\hBkcuoM.exe
  C:\Windows\System32\hBkcuoM.exe
  2⤵
  PID:900
- C:\Windows\System32\pmMWYPt.exe
  C:\Windows\System32\pmMWYPt.exe
  2⤵
  PID:5064
- C:\Windows\System32\aaAGflm.exe
  C:\Windows\System32\aaAGflm.exe
  2⤵
  PID:3260
- C:\Windows\System32\tyPFjxZ.exe
  C:\Windows\System32\tyPFjxZ.exe
  2⤵
  PID:2040
- C:\Windows\System32\JFbBQtl.exe
  C:\Windows\System32\JFbBQtl.exe
  2⤵
  PID:2268
- C:\Windows\System32\kdsAxif.exe
  C:\Windows\System32\kdsAxif.exe
  2⤵
  PID:3060
- C:\Windows\System32\WHgyttQ.exe
  C:\Windows\System32\WHgyttQ.exe
  2⤵
  PID:3192
- C:\Windows\System32\cgNwvsP.exe
  C:\Windows\System32\cgNwvsP.exe
  2⤵
  PID:4796
- C:\Windows\System32\gHYdSWl.exe
  C:\Windows\System32\gHYdSWl.exe
  2⤵
  PID:816
- C:\Windows\System32\jOEEQcT.exe
  C:\Windows\System32\jOEEQcT.exe
  2⤵
  PID:1652
- C:\Windows\System32\sCJIxSS.exe
  C:\Windows\System32\sCJIxSS.exe
  2⤵
  PID:3640
- C:\Windows\System32\WHTyspB.exe
  C:\Windows\System32\WHTyspB.exe
  2⤵
  PID:3780
- C:\Windows\System32\hiOwyhC.exe
  C:\Windows\System32\hiOwyhC.exe
  2⤵
  PID:3724
- C:\Windows\System32\OveuEyx.exe
  C:\Windows\System32\OveuEyx.exe
  2⤵
  PID:3540
- C:\Windows\System32\BtQVnsB.exe
  C:\Windows\System32\BtQVnsB.exe
  2⤵
  PID:4776
- C:\Windows\System32\qbucfwB.exe
  C:\Windows\System32\qbucfwB.exe
  2⤵
  PID:3596
- C:\Windows\System32\byBnOmI.exe
  C:\Windows\System32\byBnOmI.exe
  2⤵
  PID:2636
- C:\Windows\System32\PZSyPPy.exe
  C:\Windows\System32\PZSyPPy.exe
  2⤵
  PID:3036
- C:\Windows\System32\OcVCZdd.exe
  C:\Windows\System32\OcVCZdd.exe
  2⤵
  PID:208
- C:\Windows\System32\UJGsNzv.exe
  C:\Windows\System32\UJGsNzv.exe
  2⤵
  PID:2808
- C:\Windows\System32\OigCjDQ.exe
  C:\Windows\System32\OigCjDQ.exe
  2⤵
  PID:4300
- C:\Windows\System32\mAhMwrE.exe
  C:\Windows\System32\mAhMwrE.exe
  2⤵
  PID:3984
- C:\Windows\System32\feWTift.exe
  C:\Windows\System32\feWTift.exe
  2⤵
  PID:2440
- C:\Windows\System32\diwQzkj.exe
  C:\Windows\System32\diwQzkj.exe
  2⤵
  PID:4496
- C:\Windows\System32\bQHPtWA.exe
  C:\Windows\System32\bQHPtWA.exe
  2⤵
  PID:1840
- C:\Windows\System32\vgXSxCg.exe
  C:\Windows\System32\vgXSxCg.exe
  2⤵
  PID:3232
- C:\Windows\System32\XcwRIgj.exe
  C:\Windows\System32\XcwRIgj.exe
  2⤵
  PID:1760
- C:\Windows\System32\izSmkLS.exe
  C:\Windows\System32\izSmkLS.exe
  2⤵
  PID:4648
- C:\Windows\System32\SwfaAUM.exe
  C:\Windows\System32\SwfaAUM.exe
  2⤵
  PID:2572
- C:\Windows\System32\QQyzPri.exe
  C:\Windows\System32\QQyzPri.exe
  2⤵
  PID:2288
- C:\Windows\System32\qJfOctV.exe
  C:\Windows\System32\qJfOctV.exe
  2⤵
  PID:928
- C:\Windows\System32\FNAHatq.exe
  C:\Windows\System32\FNAHatq.exe
  2⤵
  PID:3276
- C:\Windows\System32\dbczyaE.exe
  C:\Windows\System32\dbczyaE.exe
  2⤵
  PID:5180
- C:\Windows\System32\qvdEJCI.exe
  C:\Windows\System32\qvdEJCI.exe
  2⤵
  PID:5220
- C:\Windows\System32\SlBfoXE.exe
  C:\Windows\System32\SlBfoXE.exe
  2⤵
  PID:5236
- C:\Windows\System32\CLQRxGB.exe
  C:\Windows\System32\CLQRxGB.exe
  2⤵
  PID:5272
- C:\Windows\System32\HMEQoEh.exe
  C:\Windows\System32\HMEQoEh.exe
  2⤵
  PID:5312
- C:\Windows\System32\LbmtnDm.exe
  C:\Windows\System32\LbmtnDm.exe
  2⤵
  PID:5332
- C:\Windows\System32\jUhvZkC.exe
  C:\Windows\System32\jUhvZkC.exe
  2⤵
  PID:5348
- C:\Windows\System32\MOgAXMR.exe
  C:\Windows\System32\MOgAXMR.exe
  2⤵
  PID:5368
- C:\Windows\System32\eGOyOOn.exe
  C:\Windows\System32\eGOyOOn.exe
  2⤵
  PID:5432
- C:\Windows\System32\OxpZXzE.exe
  C:\Windows\System32\OxpZXzE.exe
  2⤵
  PID:5448
- C:\Windows\System32\NLenKvB.exe
  C:\Windows\System32\NLenKvB.exe
  2⤵
  PID:5476
- C:\Windows\System32\XIQhppA.exe
  C:\Windows\System32\XIQhppA.exe
  2⤵
  PID:5492
- C:\Windows\System32\kwOqzTT.exe
  C:\Windows\System32\kwOqzTT.exe
  2⤵
  PID:5512
- C:\Windows\System32\tIihUZp.exe
  C:\Windows\System32\tIihUZp.exe
  2⤵
  PID:5536
- C:\Windows\System32\yxsCWvv.exe
  C:\Windows\System32\yxsCWvv.exe
  2⤵
  PID:5552
- C:\Windows\System32\AxWDdGD.exe
  C:\Windows\System32\AxWDdGD.exe
  2⤵
  PID:5572
- C:\Windows\System32\vxddDdb.exe
  C:\Windows\System32\vxddDdb.exe
  2⤵
  PID:5588
- C:\Windows\System32\QfUyFfG.exe
  C:\Windows\System32\QfUyFfG.exe
  2⤵
  PID:5616
- C:\Windows\System32\QydZaPW.exe
  C:\Windows\System32\QydZaPW.exe
  2⤵
  PID:5676
- C:\Windows\System32\AcfVYmS.exe
  C:\Windows\System32\AcfVYmS.exe
  2⤵
  PID:5732
- C:\Windows\System32\JZfSRNy.exe
  C:\Windows\System32\JZfSRNy.exe
  2⤵
  PID:5748
- C:\Windows\System32\yVlAtnA.exe
  C:\Windows\System32\yVlAtnA.exe
  2⤵
  PID:5772
- C:\Windows\System32\vvJxKZQ.exe
  C:\Windows\System32\vvJxKZQ.exe
  2⤵
  PID:5800
- C:\Windows\System32\cAnevQd.exe
  C:\Windows\System32\cAnevQd.exe
  2⤵
  PID:5828
- C:\Windows\System32\tiPngNT.exe
  C:\Windows\System32\tiPngNT.exe
  2⤵
  PID:5852
- C:\Windows\System32\rBqXWsL.exe
  C:\Windows\System32\rBqXWsL.exe
  2⤵
  PID:5868
- C:\Windows\System32\oblBOGl.exe
  C:\Windows\System32\oblBOGl.exe
  2⤵
  PID:5884
- C:\Windows\System32\uyyjFaA.exe
  C:\Windows\System32\uyyjFaA.exe
  2⤵
  PID:5940
- C:\Windows\System32\tvMDLHi.exe
  C:\Windows\System32\tvMDLHi.exe
  2⤵
  PID:5968
- C:\Windows\System32\MgbyBim.exe
  C:\Windows\System32\MgbyBim.exe
  2⤵
  PID:6004
- C:\Windows\System32\cEWBKMW.exe
  C:\Windows\System32\cEWBKMW.exe
  2⤵
  PID:6024
- C:\Windows\System32\LuvHOKR.exe
  C:\Windows\System32\LuvHOKR.exe
  2⤵
  PID:6044
- C:\Windows\System32\AwoQAwG.exe
  C:\Windows\System32\AwoQAwG.exe
  2⤵
  PID:6064
- C:\Windows\System32\oHGDZAS.exe
  C:\Windows\System32\oHGDZAS.exe
  2⤵
  PID:6088
- C:\Windows\System32\oLxyypo.exe
  C:\Windows\System32\oLxyypo.exe
  2⤵
  PID:6132
- C:\Windows\System32\sLIbcBW.exe
  C:\Windows\System32\sLIbcBW.exe
  2⤵
  PID:3428
- C:\Windows\System32\JiQkyQc.exe
  C:\Windows\System32\JiQkyQc.exe
  2⤵
  PID:5188
- C:\Windows\System32\ZxxkXPn.exe
  C:\Windows\System32\ZxxkXPn.exe
  2⤵
  PID:5296
- C:\Windows\System32\PaKAVvK.exe
  C:\Windows\System32\PaKAVvK.exe
  2⤵
  PID:5356
- C:\Windows\System32\ZjcuurG.exe
  C:\Windows\System32\ZjcuurG.exe
  2⤵
  PID:4628
- C:\Windows\System32\FbXgGbi.exe
  C:\Windows\System32\FbXgGbi.exe
  2⤵
  PID:5440
- C:\Windows\System32\grzhbBA.exe
  C:\Windows\System32\grzhbBA.exe
  2⤵
  PID:5564
- C:\Windows\System32\uggYula.exe
  C:\Windows\System32\uggYula.exe
  2⤵
  PID:5580
- C:\Windows\System32\JxCXSmv.exe
  C:\Windows\System32\JxCXSmv.exe
  2⤵
  PID:5648
- C:\Windows\System32\OFItary.exe
  C:\Windows\System32\OFItary.exe
  2⤵
  PID:5740
- C:\Windows\System32\dBAglpR.exe
  C:\Windows\System32\dBAglpR.exe
  2⤵
  PID:5796
- C:\Windows\System32\OeagPIC.exe
  C:\Windows\System32\OeagPIC.exe
  2⤵
  PID:5812
- C:\Windows\System32\hhfDVxq.exe
  C:\Windows\System32\hhfDVxq.exe
  2⤵
  PID:5896
- C:\Windows\System32\wYXAwVP.exe
  C:\Windows\System32\wYXAwVP.exe
  2⤵
  PID:6000
- C:\Windows\System32\sOtanon.exe
  C:\Windows\System32\sOtanon.exe
  2⤵
  PID:2732
- C:\Windows\System32\fhaNTqu.exe
  C:\Windows\System32\fhaNTqu.exe
  2⤵
  PID:4900
- C:\Windows\System32\gbUmJwk.exe
  C:\Windows\System32\gbUmJwk.exe
  2⤵
  PID:4680
- C:\Windows\System32\lTMRmvI.exe
  C:\Windows\System32\lTMRmvI.exe
  2⤵
  PID:5344
- C:\Windows\System32\kREwVOE.exe
  C:\Windows\System32\kREwVOE.exe
  2⤵
  PID:2220
- C:\Windows\System32\vvdGYLu.exe
  C:\Windows\System32\vvdGYLu.exe
  2⤵
  PID:5544
- C:\Windows\System32\WueTwxw.exe
  C:\Windows\System32\WueTwxw.exe
  2⤵
  PID:5716
- C:\Windows\System32\IkcadtB.exe
  C:\Windows\System32\IkcadtB.exe
  2⤵
  PID:5720
- C:\Windows\System32\mxNORwz.exe
  C:\Windows\System32\mxNORwz.exe
  2⤵
  PID:5836
- C:\Windows\System32\qIpVoYX.exe
  C:\Windows\System32\qIpVoYX.exe
  2⤵
  PID:5960
- C:\Windows\System32\tsaaIwr.exe
  C:\Windows\System32\tsaaIwr.exe
  2⤵
  PID:5928
- C:\Windows\System32\IfiKEFL.exe
  C:\Windows\System32\IfiKEFL.exe
  2⤵
  PID:5768
- C:\Windows\System32\OTGrxQr.exe
  C:\Windows\System32\OTGrxQr.exe
  2⤵
  PID:5824
- C:\Windows\System32\XYSbsrq.exe
  C:\Windows\System32\XYSbsrq.exe
  2⤵
  PID:5364
- C:\Windows\System32\WqsWRHE.exe
  C:\Windows\System32\WqsWRHE.exe
  2⤵
  PID:1148
- C:\Windows\System32\ONDwDNm.exe
  C:\Windows\System32\ONDwDNm.exe
  2⤵
  PID:6148
- C:\Windows\System32\nlstDpf.exe
  C:\Windows\System32\nlstDpf.exe
  2⤵
  PID:6180
- C:\Windows\System32\JgALaCS.exe
  C:\Windows\System32\JgALaCS.exe
  2⤵
  PID:6236
- C:\Windows\System32\BkeufHY.exe
  C:\Windows\System32\BkeufHY.exe
  2⤵
  PID:6256
- C:\Windows\System32\eAcsWSR.exe
  C:\Windows\System32\eAcsWSR.exe
  2⤵
  PID:6276
- C:\Windows\System32\Irfbhtv.exe
  C:\Windows\System32\Irfbhtv.exe
  2⤵
  PID:6292
- C:\Windows\System32\VMhdzDL.exe
  C:\Windows\System32\VMhdzDL.exe
  2⤵
  PID:6308
- C:\Windows\System32\qqlRwsv.exe
  C:\Windows\System32\qqlRwsv.exe
  2⤵
  PID:6328
- C:\Windows\System32\OpnPXrh.exe
  C:\Windows\System32\OpnPXrh.exe
  2⤵
  PID:6360
- C:\Windows\System32\aMszind.exe
  C:\Windows\System32\aMszind.exe
  2⤵
  PID:6388
- C:\Windows\System32\DBKYkjK.exe
  C:\Windows\System32\DBKYkjK.exe
  2⤵
  PID:6452
- C:\Windows\System32\YfmGeIy.exe
  C:\Windows\System32\YfmGeIy.exe
  2⤵
  PID:6492
- C:\Windows\System32\SohfVfJ.exe
  C:\Windows\System32\SohfVfJ.exe
  2⤵
  PID:6508
- C:\Windows\System32\KayUNnJ.exe
  C:\Windows\System32\KayUNnJ.exe
  2⤵
  PID:6528
- C:\Windows\System32\tcJrnqN.exe
  C:\Windows\System32\tcJrnqN.exe
  2⤵
  PID:6548
- C:\Windows\System32\yFLcbvQ.exe
  C:\Windows\System32\yFLcbvQ.exe
  2⤵
  PID:6564
- C:\Windows\System32\yAOcUPK.exe
  C:\Windows\System32\yAOcUPK.exe
  2⤵
  PID:6580
- C:\Windows\System32\GUVdXGV.exe
  C:\Windows\System32\GUVdXGV.exe
  2⤵
  PID:6596
- C:\Windows\System32\oNoxzXy.exe
  C:\Windows\System32\oNoxzXy.exe
  2⤵
  PID:6612
- C:\Windows\System32\QmCWtAc.exe
  C:\Windows\System32\QmCWtAc.exe
  2⤵
  PID:6628
- C:\Windows\System32\npXSUNr.exe
  C:\Windows\System32\npXSUNr.exe
  2⤵
  PID:6648
- C:\Windows\System32\AqQCHTt.exe
  C:\Windows\System32\AqQCHTt.exe
  2⤵
  PID:6680
- C:\Windows\System32\kpJkyjf.exe
  C:\Windows\System32\kpJkyjf.exe
  2⤵
  PID:6700
- C:\Windows\System32\WxIXWLJ.exe
  C:\Windows\System32\WxIXWLJ.exe
  2⤵
  PID:6776
- C:\Windows\System32\DbkARcZ.exe
  C:\Windows\System32\DbkARcZ.exe
  2⤵
  PID:6796
- C:\Windows\System32\JtUBaZS.exe
  C:\Windows\System32\JtUBaZS.exe
  2⤵
  PID:6860
- C:\Windows\System32\HSrjHbq.exe
  C:\Windows\System32\HSrjHbq.exe
  2⤵
  PID:6912
- C:\Windows\System32\rSkLpmc.exe
  C:\Windows\System32\rSkLpmc.exe
  2⤵
  PID:6932
- C:\Windows\System32\EOpzhCQ.exe
  C:\Windows\System32\EOpzhCQ.exe
  2⤵
  PID:6960
- C:\Windows\System32\LlVKWWe.exe
  C:\Windows\System32\LlVKWWe.exe
  2⤵
  PID:6980
- C:\Windows\System32\YusnueT.exe
  C:\Windows\System32\YusnueT.exe
  2⤵
  PID:6996
- C:\Windows\System32\PKazlwI.exe
  C:\Windows\System32\PKazlwI.exe
  2⤵
  PID:7012
- C:\Windows\System32\DcFVzGn.exe
  C:\Windows\System32\DcFVzGn.exe
  2⤵
  PID:7028
- C:\Windows\System32\tlbDVdf.exe
  C:\Windows\System32\tlbDVdf.exe
  2⤵
  PID:7072
- C:\Windows\System32\OoGDbXt.exe
  C:\Windows\System32\OoGDbXt.exe
  2⤵
  PID:7140
- C:\Windows\System32\oXumPzy.exe
  C:\Windows\System32\oXumPzy.exe
  2⤵
  PID:7164
- C:\Windows\System32\LQsdJyA.exe
  C:\Windows\System32\LQsdJyA.exe
  2⤵
  PID:6156
- C:\Windows\System32\WsvECGz.exe
  C:\Windows\System32\WsvECGz.exe
  2⤵
  PID:6204
- C:\Windows\System32\CfDxhAl.exe
  C:\Windows\System32\CfDxhAl.exe
  2⤵
  PID:6356
- C:\Windows\System32\AcSPVxz.exe
  C:\Windows\System32\AcSPVxz.exe
  2⤵
  PID:1340
- C:\Windows\System32\miAjxKF.exe
  C:\Windows\System32\miAjxKF.exe
  2⤵
  PID:6384
- C:\Windows\System32\mZKICGP.exe
  C:\Windows\System32\mZKICGP.exe
  2⤵
  PID:6396
- C:\Windows\System32\UfdoNJR.exe
  C:\Windows\System32\UfdoNJR.exe
  2⤵
  PID:6488
- C:\Windows\System32\kOrNuww.exe
  C:\Windows\System32\kOrNuww.exe
  2⤵
  PID:6540
- C:\Windows\System32\FWclqoa.exe
  C:\Windows\System32\FWclqoa.exe
  2⤵
  PID:6592
- C:\Windows\System32\sVmjEyE.exe
  C:\Windows\System32\sVmjEyE.exe
  2⤵
  PID:6660
- C:\Windows\System32\wwkDcDl.exe
  C:\Windows\System32\wwkDcDl.exe
  2⤵
  PID:6708
- C:\Windows\System32\eLbazGA.exe
  C:\Windows\System32\eLbazGA.exe
  2⤵
  PID:6792
- C:\Windows\System32\tFDPsuJ.exe
  C:\Windows\System32\tFDPsuJ.exe
  2⤵
  PID:6832
- C:\Windows\System32\DYYYIpF.exe
  C:\Windows\System32\DYYYIpF.exe
  2⤵
  PID:6976
- C:\Windows\System32\VKIJmdW.exe
  C:\Windows\System32\VKIJmdW.exe
  2⤵
  PID:7044
- C:\Windows\System32\goUakHo.exe
  C:\Windows\System32\goUakHo.exe
  2⤵
  PID:7036
- C:\Windows\System32\COHyCSu.exe
  C:\Windows\System32\COHyCSu.exe
  2⤵
  PID:7088
- C:\Windows\System32\SNHRFWD.exe
  C:\Windows\System32\SNHRFWD.exe
  2⤵
  PID:232
- C:\Windows\System32\CtmcSOH.exe
  C:\Windows\System32\CtmcSOH.exe
  2⤵
  PID:6304
- C:\Windows\System32\tUAIoqf.exe
  C:\Windows\System32\tUAIoqf.exe
  2⤵
  PID:5508
- C:\Windows\System32\uNSpPZt.exe
  C:\Windows\System32\uNSpPZt.exe
  2⤵
  PID:6472
- C:\Windows\System32\wvnkxZH.exe
  C:\Windows\System32\wvnkxZH.exe
  2⤵
  PID:6728
- C:\Windows\System32\GrLxXFO.exe
  C:\Windows\System32\GrLxXFO.exe
  2⤵
  PID:6924
- C:\Windows\System32\QyGvXnr.exe
  C:\Windows\System32\QyGvXnr.exe
  2⤵
  PID:6992
- C:\Windows\System32\BMUlpSA.exe
  C:\Windows\System32\BMUlpSA.exe
  2⤵
  PID:7156
- C:\Windows\System32\XeDnwbv.exe
  C:\Windows\System32\XeDnwbv.exe
  2⤵
  PID:6212
- C:\Windows\System32\OgQPYFs.exe
  C:\Windows\System32\OgQPYFs.exe
  2⤵
  PID:6520
- C:\Windows\System32\iKvUcZX.exe
  C:\Windows\System32\iKvUcZX.exe
  2⤵
  PID:6788
- C:\Windows\System32\AyXlGWf.exe
  C:\Windows\System32\AyXlGWf.exe
  2⤵
  PID:6928
- C:\Windows\System32\dQmgGYj.exe
  C:\Windows\System32\dQmgGYj.exe
  2⤵
  PID:7048
- C:\Windows\System32\VzwkiXW.exe
  C:\Windows\System32\VzwkiXW.exe
  2⤵
  PID:7192
- C:\Windows\System32\otFIQhy.exe
  C:\Windows\System32\otFIQhy.exe
  2⤵
  PID:7220
- C:\Windows\System32\khkDhYO.exe
  C:\Windows\System32\khkDhYO.exe
  2⤵
  PID:7276
- C:\Windows\System32\VOKtiJs.exe
  C:\Windows\System32\VOKtiJs.exe
  2⤵
  PID:7300
- C:\Windows\System32\FKUpJmx.exe
  C:\Windows\System32\FKUpJmx.exe
  2⤵
  PID:7348
- C:\Windows\System32\rAkVExy.exe
  C:\Windows\System32\rAkVExy.exe
  2⤵
  PID:7368
- C:\Windows\System32\DdoUvLb.exe
  C:\Windows\System32\DdoUvLb.exe
  2⤵
  PID:7384
- C:\Windows\System32\oVGvSso.exe
  C:\Windows\System32\oVGvSso.exe
  2⤵
  PID:7412
- C:\Windows\System32\OErbYgv.exe
  C:\Windows\System32\OErbYgv.exe
  2⤵
  PID:7428
- C:\Windows\System32\RDxEZaf.exe
  C:\Windows\System32\RDxEZaf.exe
  2⤵
  PID:7452
- C:\Windows\System32\elzuTCg.exe
  C:\Windows\System32\elzuTCg.exe
  2⤵
  PID:7468
- C:\Windows\System32\XJHLHuX.exe
  C:\Windows\System32\XJHLHuX.exe
  2⤵
  PID:7524
- C:\Windows\System32\bhKfoVE.exe
  C:\Windows\System32\bhKfoVE.exe
  2⤵
  PID:7544
- C:\Windows\System32\mTSkRrm.exe
  C:\Windows\System32\mTSkRrm.exe
  2⤵
  PID:7596
- C:\Windows\System32\mzdmcSo.exe
  C:\Windows\System32\mzdmcSo.exe
  2⤵
  PID:7632
- C:\Windows\System32\GDBLShZ.exe
  C:\Windows\System32\GDBLShZ.exe
  2⤵
  PID:7664
- C:\Windows\System32\vHBVWMF.exe
  C:\Windows\System32\vHBVWMF.exe
  2⤵
  PID:7688
- C:\Windows\System32\tjnERTu.exe
  C:\Windows\System32\tjnERTu.exe
  2⤵
  PID:7712
- C:\Windows\System32\LOlBzkZ.exe
  C:\Windows\System32\LOlBzkZ.exe
  2⤵
  PID:7728
- C:\Windows\System32\qCMwnYu.exe
  C:\Windows\System32\qCMwnYu.exe
  2⤵
  PID:7756
- C:\Windows\System32\UUIVSQL.exe
  C:\Windows\System32\UUIVSQL.exe
  2⤵
  PID:7776
- C:\Windows\System32\mkHAsZa.exe
  C:\Windows\System32\mkHAsZa.exe
  2⤵
  PID:7792
- C:\Windows\System32\RnbxAtb.exe
  C:\Windows\System32\RnbxAtb.exe
  2⤵
  PID:7832
- C:\Windows\System32\yaxVGDa.exe
  C:\Windows\System32\yaxVGDa.exe
  2⤵
  PID:7852
- C:\Windows\System32\OpJFbVj.exe
  C:\Windows\System32\OpJFbVj.exe
  2⤵
  PID:7888
- C:\Windows\System32\AFMEfbY.exe
  C:\Windows\System32\AFMEfbY.exe
  2⤵
  PID:7936
- C:\Windows\System32\SzdgPZH.exe
  C:\Windows\System32\SzdgPZH.exe
  2⤵
  PID:7952
- C:\Windows\System32\SVMGNwe.exe
  C:\Windows\System32\SVMGNwe.exe
  2⤵
  PID:7972
- C:\Windows\System32\GlWtyUJ.exe
  C:\Windows\System32\GlWtyUJ.exe
  2⤵
  PID:7992
- C:\Windows\System32\mQdnECn.exe
  C:\Windows\System32\mQdnECn.exe
  2⤵
  PID:8008
- C:\Windows\System32\XbwntCg.exe
  C:\Windows\System32\XbwntCg.exe
  2⤵
  PID:8068
- C:\Windows\System32\tpDSSmS.exe
  C:\Windows\System32\tpDSSmS.exe
  2⤵
  PID:8124
- C:\Windows\System32\jUpQrrN.exe
  C:\Windows\System32\jUpQrrN.exe
  2⤵
  PID:8140
- C:\Windows\System32\DwqqUOy.exe
  C:\Windows\System32\DwqqUOy.exe
  2⤵
  PID:8164
- C:\Windows\System32\MITmzgW.exe
  C:\Windows\System32\MITmzgW.exe
  2⤵
  PID:6736
- C:\Windows\System32\jPqJQLN.exe
  C:\Windows\System32\jPqJQLN.exe
  2⤵
  PID:7248
- C:\Windows\System32\fhcJWZa.exe
  C:\Windows\System32\fhcJWZa.exe
  2⤵
  PID:7312
- C:\Windows\System32\JGvazQQ.exe
  C:\Windows\System32\JGvazQQ.exe
  2⤵
  PID:7436
- C:\Windows\System32\qtmudet.exe
  C:\Windows\System32\qtmudet.exe
  2⤵
  PID:7420
- C:\Windows\System32\vErhZiK.exe
  C:\Windows\System32\vErhZiK.exe
  2⤵
  PID:7424
- C:\Windows\System32\DNyROvj.exe
  C:\Windows\System32\DNyROvj.exe
  2⤵
  PID:7576
- C:\Windows\System32\HHQzIkh.exe
  C:\Windows\System32\HHQzIkh.exe
  2⤵
  PID:7620
- C:\Windows\System32\WNUnOgD.exe
  C:\Windows\System32\WNUnOgD.exe
  2⤵
  PID:7684
- C:\Windows\System32\UNqzWsm.exe
  C:\Windows\System32\UNqzWsm.exe
  2⤵
  PID:7784
- C:\Windows\System32\tcgzFtw.exe
  C:\Windows\System32\tcgzFtw.exe
  2⤵
  PID:7768
- C:\Windows\System32\qsaqFvD.exe
  C:\Windows\System32\qsaqFvD.exe
  2⤵
  PID:7816
- C:\Windows\System32\LWUGDEe.exe
  C:\Windows\System32\LWUGDEe.exe
  2⤵
  PID:8016
- C:\Windows\System32\kHlKVGU.exe
  C:\Windows\System32\kHlKVGU.exe
  2⤵
  PID:7988
- C:\Windows\System32\neLBENd.exe
  C:\Windows\System32\neLBENd.exe
  2⤵
  PID:8024
- C:\Windows\System32\BqZqEIP.exe
  C:\Windows\System32\BqZqEIP.exe
  2⤵
  PID:8136
- C:\Windows\System32\BOxyZNB.exe
  C:\Windows\System32\BOxyZNB.exe
  2⤵
  PID:8180
- C:\Windows\System32\wxcqWMS.exe
  C:\Windows\System32\wxcqWMS.exe
  2⤵
  PID:6896
- C:\Windows\System32\qRWQgly.exe
  C:\Windows\System32\qRWQgly.exe
  2⤵
  PID:7292
- C:\Windows\System32\JkVsdaT.exe
  C:\Windows\System32\JkVsdaT.exe
  2⤵
  PID:7404
- C:\Windows\System32\MtNxPeo.exe
  C:\Windows\System32\MtNxPeo.exe
  2⤵
  PID:7556
- C:\Windows\System32\zLfeiGY.exe
  C:\Windows\System32\zLfeiGY.exe
  2⤵
  PID:7736
- C:\Windows\System32\pSOaMkY.exe
  C:\Windows\System32\pSOaMkY.exe
  2⤵
  PID:7964
- C:\Windows\System32\kfQIorn.exe
  C:\Windows\System32\kfQIorn.exe
  2⤵
  PID:8132
- C:\Windows\System32\baiWZXi.exe
  C:\Windows\System32\baiWZXi.exe
  2⤵
  PID:7208
- C:\Windows\System32\kwpgyEe.exe
  C:\Windows\System32\kwpgyEe.exe
  2⤵
  PID:7616
- C:\Windows\System32\bqdpwDy.exe
  C:\Windows\System32\bqdpwDy.exe
  2⤵
  PID:7948
- C:\Windows\System32\kvVsnvQ.exe
  C:\Windows\System32\kvVsnvQ.exe
  2⤵
  PID:8196
- C:\Windows\System32\xjgzjdT.exe
  C:\Windows\System32\xjgzjdT.exe
  2⤵
  PID:8228
- C:\Windows\System32\tZwqRCU.exe
  C:\Windows\System32\tZwqRCU.exe
  2⤵
  PID:8264
- C:\Windows\System32\RltaRCy.exe
  C:\Windows\System32\RltaRCy.exe
  2⤵
  PID:8288
- C:\Windows\System32\ItVyGdT.exe
  C:\Windows\System32\ItVyGdT.exe
  2⤵
  PID:8308
- C:\Windows\System32\XICRfSg.exe
  C:\Windows\System32\XICRfSg.exe
  2⤵
  PID:8348
- C:\Windows\System32\iNKgxGN.exe
  C:\Windows\System32\iNKgxGN.exe
  2⤵
  PID:8376
- C:\Windows\System32\DFisvds.exe
  C:\Windows\System32\DFisvds.exe
  2⤵
  PID:8396
- C:\Windows\System32\NDnYpxK.exe
  C:\Windows\System32\NDnYpxK.exe
  2⤵
  PID:8412
- C:\Windows\System32\ocDScoH.exe
  C:\Windows\System32\ocDScoH.exe
  2⤵
  PID:8436
- C:\Windows\System32\MTDWVcV.exe
  C:\Windows\System32\MTDWVcV.exe
  2⤵
  PID:8464
- C:\Windows\System32\cVdebuH.exe
  C:\Windows\System32\cVdebuH.exe
  2⤵
  PID:8480
- C:\Windows\System32\aRdKnQb.exe
  C:\Windows\System32\aRdKnQb.exe
  2⤵
  PID:8496
- C:\Windows\System32\UBEcKgk.exe
  C:\Windows\System32\UBEcKgk.exe
  2⤵
  PID:8512
- C:\Windows\System32\RvmbsPN.exe
  C:\Windows\System32\RvmbsPN.exe
  2⤵
  PID:8532
- C:\Windows\System32\CEuBRXE.exe
  C:\Windows\System32\CEuBRXE.exe
  2⤵
  PID:8596
- C:\Windows\System32\ZKdWjsO.exe
  C:\Windows\System32\ZKdWjsO.exe
  2⤵
  PID:8656
- C:\Windows\System32\JmomJjw.exe
  C:\Windows\System32\JmomJjw.exe
  2⤵
  PID:8684
- C:\Windows\System32\EAFMEPv.exe
  C:\Windows\System32\EAFMEPv.exe
  2⤵
  PID:8724
- C:\Windows\System32\DBGSyfY.exe
  C:\Windows\System32\DBGSyfY.exe
  2⤵
  PID:8740
- C:\Windows\System32\xQAiuxz.exe
  C:\Windows\System32\xQAiuxz.exe
  2⤵
  PID:8768
- C:\Windows\System32\leiivut.exe
  C:\Windows\System32\leiivut.exe
  2⤵
  PID:8804
- C:\Windows\System32\gyhYSLK.exe
  C:\Windows\System32\gyhYSLK.exe
  2⤵
  PID:8824
- C:\Windows\System32\JYBxGVZ.exe
  C:\Windows\System32\JYBxGVZ.exe
  2⤵
  PID:8840
- C:\Windows\System32\sVtTjvx.exe
  C:\Windows\System32\sVtTjvx.exe
  2⤵
  PID:8856
- C:\Windows\System32\vbbXZQz.exe
  C:\Windows\System32\vbbXZQz.exe
  2⤵
  PID:8896
- C:\Windows\System32\QBprfEo.exe
  C:\Windows\System32\QBprfEo.exe
  2⤵
  PID:8916
- C:\Windows\System32\CAoQFNe.exe
  C:\Windows\System32\CAoQFNe.exe
  2⤵
  PID:8940
- C:\Windows\System32\KbEmWjj.exe
  C:\Windows\System32\KbEmWjj.exe
  2⤵
  PID:8960
- C:\Windows\System32\FWYxCjk.exe
  C:\Windows\System32\FWYxCjk.exe
  2⤵
  PID:8988
- C:\Windows\System32\qBlnWPA.exe
  C:\Windows\System32\qBlnWPA.exe
  2⤵
  PID:9020
- C:\Windows\System32\KyuwCKM.exe
  C:\Windows\System32\KyuwCKM.exe
  2⤵
  PID:9036
- C:\Windows\System32\PIGILPA.exe
  C:\Windows\System32\PIGILPA.exe
  2⤵
  PID:9060
- C:\Windows\System32\zhIGVnP.exe
  C:\Windows\System32\zhIGVnP.exe
  2⤵
  PID:9076
- C:\Windows\System32\mXqTLeC.exe
  C:\Windows\System32\mXqTLeC.exe
  2⤵
  PID:9100
- C:\Windows\System32\xkJeIEw.exe
  C:\Windows\System32\xkJeIEw.exe
  2⤵
  PID:9164
- C:\Windows\System32\HcbDsic.exe
  C:\Windows\System32\HcbDsic.exe
  2⤵
  PID:9188
- C:\Windows\System32\yOVJauA.exe
  C:\Windows\System32\yOVJauA.exe
  2⤵
  PID:9208
- C:\Windows\System32\ISqfVhX.exe
  C:\Windows\System32\ISqfVhX.exe
  2⤵
  PID:7788
- C:\Windows\System32\KpInCeI.exe
  C:\Windows\System32\KpInCeI.exe
  2⤵
  PID:8220
- C:\Windows\System32\VzHEiKj.exe
  C:\Windows\System32\VzHEiKj.exe
  2⤵
  PID:8304
- C:\Windows\System32\vsNHEcr.exe
  C:\Windows\System32\vsNHEcr.exe
  2⤵
  PID:8392
- C:\Windows\System32\uGsCZqr.exe
  C:\Windows\System32\uGsCZqr.exe
  2⤵
  PID:8432
- C:\Windows\System32\NOlieul.exe
  C:\Windows\System32\NOlieul.exe
  2⤵
  PID:8492
- C:\Windows\System32\vwPKcus.exe
  C:\Windows\System32\vwPKcus.exe
  2⤵
  PID:8580
- C:\Windows\System32\dxzUqtG.exe
  C:\Windows\System32\dxzUqtG.exe
  2⤵
  PID:8640
- C:\Windows\System32\HFnfRLA.exe
  C:\Windows\System32\HFnfRLA.exe
  2⤵
  PID:8692
- C:\Windows\System32\TZHvusJ.exe
  C:\Windows\System32\TZHvusJ.exe
  2⤵
  PID:8796
- C:\Windows\System32\DiUmbTz.exe
  C:\Windows\System32\DiUmbTz.exe
  2⤵
  PID:8912
- C:\Windows\System32\xTGtnny.exe
  C:\Windows\System32\xTGtnny.exe
  2⤵
  PID:8928
- C:\Windows\System32\rAKZdyw.exe
  C:\Windows\System32\rAKZdyw.exe
  2⤵
  PID:9072
- C:\Windows\System32\tCbjcvH.exe
  C:\Windows\System32\tCbjcvH.exe
  2⤵
  PID:9124
- C:\Windows\System32\xDTmvmt.exe
  C:\Windows\System32\xDTmvmt.exe
  2⤵
  PID:9136
- C:\Windows\System32\mFSFNEB.exe
  C:\Windows\System32\mFSFNEB.exe
  2⤵
  PID:7364
- C:\Windows\System32\nFZnioD.exe
  C:\Windows\System32\nFZnioD.exe
  2⤵
  PID:8404
- C:\Windows\System32\lCmPTnK.exe
  C:\Windows\System32\lCmPTnK.exe
  2⤵
  PID:8476
- C:\Windows\System32\kOdyKaA.exe
  C:\Windows\System32\kOdyKaA.exe
  2⤵
  PID:8716
- C:\Windows\System32\FdhRddO.exe
  C:\Windows\System32\FdhRddO.exe
  2⤵
  PID:8836
- C:\Windows\System32\JpneerG.exe
  C:\Windows\System32\JpneerG.exe
  2⤵
  PID:8908
- C:\Windows\System32\Nwuknth.exe
  C:\Windows\System32\Nwuknth.exe
  2⤵
  PID:9056
- C:\Windows\System32\TDPquBt.exe
  C:\Windows\System32\TDPquBt.exe
  2⤵
  PID:9176
- C:\Windows\System32\YFeVNzB.exe
  C:\Windows\System32\YFeVNzB.exe
  2⤵
  PID:8504
- C:\Windows\System32\GqgpjGM.exe
  C:\Windows\System32\GqgpjGM.exe
  2⤵
  PID:8448
- C:\Windows\System32\KSxeUUq.exe
  C:\Windows\System32\KSxeUUq.exe
  2⤵
  PID:8368
- C:\Windows\System32\YdObCgd.exe
  C:\Windows\System32\YdObCgd.exe
  2⤵
  PID:8316
- C:\Windows\System32\zDiGKVW.exe
  C:\Windows\System32\zDiGKVW.exe
  2⤵
  PID:9240
- C:\Windows\System32\kQBersr.exe
  C:\Windows\System32\kQBersr.exe
  2⤵
  PID:9264
- C:\Windows\System32\peUkhmt.exe
  C:\Windows\System32\peUkhmt.exe
  2⤵
  PID:9304
- C:\Windows\System32\bAKgaar.exe
  C:\Windows\System32\bAKgaar.exe
  2⤵
  PID:9324
- C:\Windows\System32\lJElGDz.exe
  C:\Windows\System32\lJElGDz.exe
  2⤵
  PID:9340
- C:\Windows\System32\LjjQGFo.exe
  C:\Windows\System32\LjjQGFo.exe
  2⤵
  PID:9364
- C:\Windows\System32\XWwGqPp.exe
  C:\Windows\System32\XWwGqPp.exe
  2⤵
  PID:9392
- C:\Windows\System32\BQdBKdH.exe
  C:\Windows\System32\BQdBKdH.exe
  2⤵
  PID:9452
- C:\Windows\System32\JqGVUqP.exe
  C:\Windows\System32\JqGVUqP.exe
  2⤵
  PID:9476
- C:\Windows\System32\CzTkJIu.exe
  C:\Windows\System32\CzTkJIu.exe
  2⤵
  PID:9500
- C:\Windows\System32\rzhqLSS.exe
  C:\Windows\System32\rzhqLSS.exe
  2⤵
  PID:9520
- C:\Windows\System32\QsitmNy.exe
  C:\Windows\System32\QsitmNy.exe
  2⤵
  PID:9548
- C:\Windows\System32\EugEAaJ.exe
  C:\Windows\System32\EugEAaJ.exe
  2⤵
  PID:9572
- C:\Windows\System32\etVMSVC.exe
  C:\Windows\System32\etVMSVC.exe
  2⤵
  PID:9592
- C:\Windows\System32\owoKWiR.exe
  C:\Windows\System32\owoKWiR.exe
  2⤵
  PID:9620
- C:\Windows\System32\FPvLloi.exe
  C:\Windows\System32\FPvLloi.exe
  2⤵
  PID:9640
- C:\Windows\System32\NwRJNVw.exe
  C:\Windows\System32\NwRJNVw.exe
  2⤵
  PID:9672
- C:\Windows\System32\ourrLVW.exe
  C:\Windows\System32\ourrLVW.exe
  2⤵
  PID:9692
- C:\Windows\System32\vHFQRgF.exe
  C:\Windows\System32\vHFQRgF.exe
  2⤵
  PID:9736
- C:\Windows\System32\OludenX.exe
  C:\Windows\System32\OludenX.exe
  2⤵
  PID:9752
- C:\Windows\System32\xHXWPZF.exe
  C:\Windows\System32\xHXWPZF.exe
  2⤵
  PID:9784
- C:\Windows\System32\bZHEebF.exe
  C:\Windows\System32\bZHEebF.exe
  2⤵
  PID:9800
- C:\Windows\System32\hOrzLJX.exe
  C:\Windows\System32\hOrzLJX.exe
  2⤵
  PID:9820
- C:\Windows\System32\QjnxSZM.exe
  C:\Windows\System32\QjnxSZM.exe
  2⤵
  PID:9844
- C:\Windows\System32\hiAOMsH.exe
  C:\Windows\System32\hiAOMsH.exe
  2⤵
  PID:9864
- C:\Windows\System32\dOsFvki.exe
  C:\Windows\System32\dOsFvki.exe
  2⤵
  PID:9884
- C:\Windows\System32\yqFENLp.exe
  C:\Windows\System32\yqFENLp.exe
  2⤵
  PID:9988
- C:\Windows\System32\TqhUgDd.exe
  C:\Windows\System32\TqhUgDd.exe
  2⤵
  PID:10032
- C:\Windows\System32\HvasIiV.exe
  C:\Windows\System32\HvasIiV.exe
  2⤵
  PID:10052
- C:\Windows\System32\FBOxNka.exe
  C:\Windows\System32\FBOxNka.exe
  2⤵
  PID:10072
- C:\Windows\System32\kZyziPZ.exe
  C:\Windows\System32\kZyziPZ.exe
  2⤵
  PID:10092
- C:\Windows\System32\aVblOMW.exe
  C:\Windows\System32\aVblOMW.exe
  2⤵
  PID:10108
- C:\Windows\System32\OccBoCO.exe
  C:\Windows\System32\OccBoCO.exe
  2⤵
  PID:10152
- C:\Windows\System32\yvobniT.exe
  C:\Windows\System32\yvobniT.exe
  2⤵
  PID:10168
- C:\Windows\System32\boyZrDn.exe
  C:\Windows\System32\boyZrDn.exe
  2⤵
  PID:10200
- C:\Windows\System32\CLNUdpC.exe
  C:\Windows\System32\CLNUdpC.exe
  2⤵
  PID:8216
- C:\Windows\System32\TpLmhHE.exe
  C:\Windows\System32\TpLmhHE.exe
  2⤵
  PID:9300
- C:\Windows\System32\uZcNzNw.exe
  C:\Windows\System32\uZcNzNw.exe
  2⤵
  PID:9384
- C:\Windows\System32\THrEGeL.exe
  C:\Windows\System32\THrEGeL.exe
  2⤵
  PID:9436
- C:\Windows\System32\jsTwlTG.exe
  C:\Windows\System32\jsTwlTG.exe
  2⤵
  PID:9484
- C:\Windows\System32\QHBAxHo.exe
  C:\Windows\System32\QHBAxHo.exe
  2⤵
  PID:9532
- C:\Windows\System32\EQExRaJ.exe
  C:\Windows\System32\EQExRaJ.exe
  2⤵
  PID:9512
- C:\Windows\System32\wrNcHzt.exe
  C:\Windows\System32\wrNcHzt.exe
  2⤵
  PID:9660
- C:\Windows\System32\uYiRrZL.exe
  C:\Windows\System32\uYiRrZL.exe
  2⤵
  PID:9716
- C:\Windows\System32\aLNkjdm.exe
  C:\Windows\System32\aLNkjdm.exe
  2⤵
  PID:9780
- C:\Windows\System32\TtoMvVE.exe
  C:\Windows\System32\TtoMvVE.exe
  2⤵
  PID:9916
- C:\Windows\System32\oUaxIFH.exe
  C:\Windows\System32\oUaxIFH.exe
  2⤵
  PID:9956
- C:\Windows\System32\PdiwZGA.exe
  C:\Windows\System32\PdiwZGA.exe
  2⤵
  PID:10088
- C:\Windows\System32\WvRmyhq.exe
  C:\Windows\System32\WvRmyhq.exe
  2⤵
  PID:10100
- C:\Windows\System32\EnKQWuh.exe
  C:\Windows\System32\EnKQWuh.exe
  2⤵
  PID:10164
- C:\Windows\System32\vxUJKSQ.exe
  C:\Windows\System32\vxUJKSQ.exe
  2⤵
  PID:10212
- C:\Windows\System32\aLSrMNX.exe
  C:\Windows\System32\aLSrMNX.exe
  2⤵
  PID:9248
- C:\Windows\System32\hUqWpuW.exe
  C:\Windows\System32\hUqWpuW.exe
  2⤵
  PID:9468
- C:\Windows\System32\tIUJYdU.exe
  C:\Windows\System32\tIUJYdU.exe
  2⤵
  PID:9588
- C:\Windows\System32\aBkBZlX.exe
  C:\Windows\System32\aBkBZlX.exe
  2⤵
  PID:9632
- C:\Windows\System32\iJgUHtG.exe
  C:\Windows\System32\iJgUHtG.exe
  2⤵
  PID:9812
- C:\Windows\System32\wsLaZSf.exe
  C:\Windows\System32\wsLaZSf.exe
  2⤵
  PID:9792
- C:\Windows\System32\NwVMnoZ.exe
  C:\Windows\System32\NwVMnoZ.exe
  2⤵
  PID:10144
- C:\Windows\System32\tKnusDJ.exe
  C:\Windows\System32\tKnusDJ.exe
  2⤵
  PID:10176
- C:\Windows\System32\yLLgrRb.exe
  C:\Windows\System32\yLLgrRb.exe
  2⤵
  PID:9556
- C:\Windows\System32\WLWACDJ.exe
  C:\Windows\System32\WLWACDJ.exe
  2⤵
  PID:10128
- C:\Windows\System32\MjEndKW.exe
  C:\Windows\System32\MjEndKW.exe
  2⤵
  PID:9516
- C:\Windows\System32\QvQmIJn.exe
  C:\Windows\System32\QvQmIJn.exe
  2⤵
  PID:10244
- C:\Windows\System32\qFixiYL.exe
  C:\Windows\System32\qFixiYL.exe
  2⤵
  PID:10280
- C:\Windows\System32\RbaanXA.exe
  C:\Windows\System32\RbaanXA.exe
  2⤵
  PID:10296
- C:\Windows\System32\hIkSCaq.exe
  C:\Windows\System32\hIkSCaq.exe
  2⤵
  PID:10320
- C:\Windows\System32\lcXXgQT.exe
  C:\Windows\System32\lcXXgQT.exe
  2⤵
  PID:10360
- C:\Windows\System32\TApkZhG.exe
  C:\Windows\System32\TApkZhG.exe
  2⤵
  PID:10384
- C:\Windows\System32\JndcNJw.exe
  C:\Windows\System32\JndcNJw.exe
  2⤵
  PID:10436
- C:\Windows\System32\RmRwKCq.exe
  C:\Windows\System32\RmRwKCq.exe
  2⤵
  PID:10452
- C:\Windows\System32\SssSYZO.exe
  C:\Windows\System32\SssSYZO.exe
  2⤵
  PID:10468
- C:\Windows\System32\wbuBvwV.exe
  C:\Windows\System32\wbuBvwV.exe
  2⤵
  PID:10496
- C:\Windows\System32\yhbMCuu.exe
  C:\Windows\System32\yhbMCuu.exe
  2⤵
  PID:10524
- C:\Windows\System32\LpCgEng.exe
  C:\Windows\System32\LpCgEng.exe
  2⤵
  PID:10556
- C:\Windows\System32\eklGakA.exe
  C:\Windows\System32\eklGakA.exe
  2⤵
  PID:10580
- C:\Windows\System32\FeohfDY.exe
  C:\Windows\System32\FeohfDY.exe
  2⤵
  PID:10616
- C:\Windows\System32\iREHrcf.exe
  C:\Windows\System32\iREHrcf.exe
  2⤵
  PID:10656
- C:\Windows\System32\gmdZPFG.exe
  C:\Windows\System32\gmdZPFG.exe
  2⤵
  PID:10672
- C:\Windows\System32\YmyZbXH.exe
  C:\Windows\System32\YmyZbXH.exe
  2⤵
  PID:10700
- C:\Windows\System32\sVAinDw.exe
  C:\Windows\System32\sVAinDw.exe
  2⤵
  PID:10716
- C:\Windows\System32\ZSmOrGP.exe
  C:\Windows\System32\ZSmOrGP.exe
  2⤵
  PID:10736
- C:\Windows\System32\rtZpenl.exe
  C:\Windows\System32\rtZpenl.exe
  2⤵
  PID:10796
- C:\Windows\System32\LkVeWKO.exe
  C:\Windows\System32\LkVeWKO.exe
  2⤵
  PID:10824
- C:\Windows\System32\npihUoq.exe
  C:\Windows\System32\npihUoq.exe
  2⤵
  PID:10848
- C:\Windows\System32\ftqNnbz.exe
  C:\Windows\System32\ftqNnbz.exe
  2⤵
  PID:10872
- C:\Windows\System32\VcDQFZX.exe
  C:\Windows\System32\VcDQFZX.exe
  2⤵
  PID:10896
- C:\Windows\System32\nqDEzJv.exe
  C:\Windows\System32\nqDEzJv.exe
  2⤵
  PID:10928
- C:\Windows\System32\ebkmNaV.exe
  C:\Windows\System32\ebkmNaV.exe
  2⤵
  PID:10964
- C:\Windows\System32\neeCxJB.exe
  C:\Windows\System32\neeCxJB.exe
  2⤵
  PID:10992
- C:\Windows\System32\cEGBoVq.exe
  C:\Windows\System32\cEGBoVq.exe
  2⤵
  PID:11008
- C:\Windows\System32\iEnVfmT.exe
  C:\Windows\System32\iEnVfmT.exe
  2⤵
  PID:11024
- C:\Windows\System32\howvsqa.exe
  C:\Windows\System32\howvsqa.exe
  2⤵
  PID:11060
- C:\Windows\System32\vlzRbTj.exe
  C:\Windows\System32\vlzRbTj.exe
  2⤵
  PID:11104
- C:\Windows\System32\dQhHaDb.exe
  C:\Windows\System32\dQhHaDb.exe
  2⤵
  PID:11132
- C:\Windows\System32\xRBICnC.exe
  C:\Windows\System32\xRBICnC.exe
  2⤵
  PID:11156
- C:\Windows\System32\DAvAlBx.exe
  C:\Windows\System32\DAvAlBx.exe
  2⤵
  PID:11172
- C:\Windows\System32\WluJcnk.exe
  C:\Windows\System32\WluJcnk.exe
  2⤵
  PID:11204
- C:\Windows\System32\kAJKwxR.exe
  C:\Windows\System32\kAJKwxR.exe
  2⤵
  PID:11224
- C:\Windows\System32\NvgkxgQ.exe
  C:\Windows\System32\NvgkxgQ.exe
  2⤵
  PID:11260
- C:\Windows\System32\OKDZJxD.exe
  C:\Windows\System32\OKDZJxD.exe
  2⤵
  PID:10288
- C:\Windows\System32\CezjPMl.exe
  C:\Windows\System32\CezjPMl.exe
  2⤵
  PID:10352
- C:\Windows\System32\HjyTvvM.exe
  C:\Windows\System32\HjyTvvM.exe
  2⤵
  PID:10380
- C:\Windows\System32\XSswfOf.exe
  C:\Windows\System32\XSswfOf.exe
  2⤵
  PID:10492
- C:\Windows\System32\yINfwkH.exe
  C:\Windows\System32\yINfwkH.exe
  2⤵
  PID:10536
- C:\Windows\System32\FtTdTsQ.exe
  C:\Windows\System32\FtTdTsQ.exe
  2⤵
  PID:10576
- C:\Windows\System32\TpPSghA.exe
  C:\Windows\System32\TpPSghA.exe
  2⤵
  PID:10636
- C:\Windows\System32\vYabjmF.exe
  C:\Windows\System32\vYabjmF.exe
  2⤵
  PID:10724
- C:\Windows\System32\GIXpHKJ.exe
  C:\Windows\System32\GIXpHKJ.exe
  2⤵
  PID:10748
- C:\Windows\System32\VDKGgwm.exe
  C:\Windows\System32\VDKGgwm.exe
  2⤵
  PID:10856
- C:\Windows\System32\DkXuXok.exe
  C:\Windows\System32\DkXuXok.exe
  2⤵
  PID:10892
- C:\Windows\System32\PBPOdXC.exe
  C:\Windows\System32\PBPOdXC.exe
  2⤵
  PID:10952
- C:\Windows\System32\kneZjyC.exe
  C:\Windows\System32\kneZjyC.exe
  2⤵
  PID:10984
- C:\Windows\System32\snVznEM.exe
  C:\Windows\System32\snVznEM.exe
  2⤵
  PID:11016
- C:\Windows\System32\wspFftz.exe
  C:\Windows\System32\wspFftz.exe
  2⤵
  PID:11120
- C:\Windows\System32\VMnLGXs.exe
  C:\Windows\System32\VMnLGXs.exe
  2⤵
  PID:11148
- C:\Windows\System32\nHedTTj.exe
  C:\Windows\System32\nHedTTj.exe
  2⤵
  PID:11164
- C:\Windows\System32\bSlSVwM.exe
  C:\Windows\System32\bSlSVwM.exe
  2⤵
  PID:11256
- C:\Windows\System32\HngkvQA.exe
  C:\Windows\System32\HngkvQA.exe
  2⤵
  PID:10520
- C:\Windows\System32\NeSBkzS.exe
  C:\Windows\System32\NeSBkzS.exe
  2⤵
  PID:10836
- C:\Windows\System32\xuGfEoV.exe
  C:\Windows\System32\xuGfEoV.exe
  2⤵
  PID:11040
- C:\Windows\System32\yjBggVj.exe
  C:\Windows\System32\yjBggVj.exe
  2⤵
  PID:11196
- C:\Windows\System32\PJTSAkd.exe
  C:\Windows\System32\PJTSAkd.exe
  2⤵
  PID:11124
- C:\Windows\System32\xEdFvHZ.exe
  C:\Windows\System32\xEdFvHZ.exe
  2⤵
  PID:10256
- C:\Windows\System32\aTozyOf.exe
  C:\Windows\System32\aTozyOf.exe
  2⤵
  PID:10448
- C:\Windows\System32\nlRtfCi.exe
  C:\Windows\System32\nlRtfCi.exe
  2⤵
  PID:10916
- C:\Windows\System32\psRypLa.exe
  C:\Windows\System32\psRypLa.exe
  2⤵
  PID:11272
- C:\Windows\System32\fbXRApm.exe
  C:\Windows\System32\fbXRApm.exe
  2⤵
  PID:11296
- C:\Windows\System32\WryZdVz.exe
  C:\Windows\System32\WryZdVz.exe
  2⤵
  PID:11316
- C:\Windows\System32\rLWGiuZ.exe
  C:\Windows\System32\rLWGiuZ.exe
  2⤵
  PID:11360
- C:\Windows\System32\MCHryLz.exe
  C:\Windows\System32\MCHryLz.exe
  2⤵
  PID:11380
- C:\Windows\System32\tlUrIkY.exe
  C:\Windows\System32\tlUrIkY.exe
  2⤵
  PID:11400
- C:\Windows\System32\zjYQxeI.exe
  C:\Windows\System32\zjYQxeI.exe
  2⤵
  PID:11416
- C:\Windows\System32\THFqgRB.exe
  C:\Windows\System32\THFqgRB.exe
  2⤵
  PID:11444
- C:\Windows\System32\yDENfMw.exe
  C:\Windows\System32\yDENfMw.exe
  2⤵
  PID:11464
- C:\Windows\System32\qUUpPXF.exe
  C:\Windows\System32\qUUpPXF.exe
  2⤵
  PID:11500
- C:\Windows\System32\ZrSbknR.exe
  C:\Windows\System32\ZrSbknR.exe
  2⤵
  PID:11540
- C:\Windows\System32\vHRACMU.exe
  C:\Windows\System32\vHRACMU.exe
  2⤵
  PID:11584
- C:\Windows\System32\dURzYeo.exe
  C:\Windows\System32\dURzYeo.exe
  2⤵
  PID:11612
- C:\Windows\System32\ZtjbKgZ.exe
  C:\Windows\System32\ZtjbKgZ.exe
  2⤵
  PID:11648
- C:\Windows\System32\rYQVTqu.exe
  C:\Windows\System32\rYQVTqu.exe
  2⤵
  PID:11784
- C:\Windows\System32\zRalZZX.exe
  C:\Windows\System32\zRalZZX.exe
  2⤵
  PID:11824
- C:\Windows\System32\mHXPSfF.exe
  C:\Windows\System32\mHXPSfF.exe
  2⤵
  PID:11840
- C:\Windows\System32\SFgjdNL.exe
  C:\Windows\System32\SFgjdNL.exe
  2⤵
  PID:11856
- C:\Windows\System32\FacMueX.exe
  C:\Windows\System32\FacMueX.exe
  2⤵
  PID:11872
- C:\Windows\System32\hgxfSjx.exe
  C:\Windows\System32\hgxfSjx.exe
  2⤵
  PID:11888
- C:\Windows\System32\rPFFtkO.exe
  C:\Windows\System32\rPFFtkO.exe
  2⤵
  PID:11904
- C:\Windows\System32\YpOMuyy.exe
  C:\Windows\System32\YpOMuyy.exe
  2⤵
  PID:11920
- C:\Windows\System32\rZzFMuQ.exe
  C:\Windows\System32\rZzFMuQ.exe
  2⤵
  PID:11936
- C:\Windows\System32\EahCXcC.exe
  C:\Windows\System32\EahCXcC.exe
  2⤵
  PID:11952
- C:\Windows\System32\UzbVqxF.exe
  C:\Windows\System32\UzbVqxF.exe
  2⤵
  PID:11968
- C:\Windows\System32\rIigYAA.exe
  C:\Windows\System32\rIigYAA.exe
  2⤵
  PID:11984
- C:\Windows\System32\idjFwrq.exe
  C:\Windows\System32\idjFwrq.exe
  2⤵
  PID:12000
- C:\Windows\System32\pkVGhUv.exe
  C:\Windows\System32\pkVGhUv.exe
  2⤵
  PID:12016
- C:\Windows\System32\NvbXtxf.exe
  C:\Windows\System32\NvbXtxf.exe
  2⤵
  PID:12032
- C:\Windows\System32\OSpmrrI.exe
  C:\Windows\System32\OSpmrrI.exe
  2⤵
  PID:12048
- C:\Windows\System32\CdUaSKi.exe
  C:\Windows\System32\CdUaSKi.exe
  2⤵
  PID:12088
- C:\Windows\System32\twoqxob.exe
  C:\Windows\System32\twoqxob.exe
  2⤵
  PID:12284
- C:\Windows\System32\FrZqCzD.exe
  C:\Windows\System32\FrZqCzD.exe
  2⤵
  PID:10416
- C:\Windows\System32\jDrgavp.exe
  C:\Windows\System32\jDrgavp.exe
  2⤵
  PID:11288
- C:\Windows\System32\PZSShBB.exe
  C:\Windows\System32\PZSShBB.exe
  2⤵
  PID:11344
- C:\Windows\System32\CfxlGFl.exe
  C:\Windows\System32\CfxlGFl.exe
  2⤵
  PID:11412
- C:\Windows\System32\geurKgQ.exe
  C:\Windows\System32\geurKgQ.exe
  2⤵
  PID:11484
- C:\Windows\System32\LmXUleV.exe
  C:\Windows\System32\LmXUleV.exe
  2⤵
  PID:11512
- C:\Windows\System32\axsIaWH.exe
  C:\Windows\System32\axsIaWH.exe
  2⤵
  PID:11548
- C:\Windows\System32\PFbNqsn.exe
  C:\Windows\System32\PFbNqsn.exe
  2⤵
  PID:11628
- C:\Windows\System32\pIejVKf.exe
  C:\Windows\System32\pIejVKf.exe
  2⤵
  PID:11656
- C:\Windows\System32\cLGSshw.exe
  C:\Windows\System32\cLGSshw.exe
  2⤵
  PID:11712
- C:\Windows\System32\wRndTFV.exe
  C:\Windows\System32\wRndTFV.exe
  2⤵
  PID:11740
- C:\Windows\System32\XKlDcTw.exe
  C:\Windows\System32\XKlDcTw.exe
  2⤵
  PID:11756
- C:\Windows\System32\cDtaMnA.exe
  C:\Windows\System32\cDtaMnA.exe
  2⤵
  PID:11772
- C:\Windows\System32\ulkuoqw.exe
  C:\Windows\System32\ulkuoqw.exe
  2⤵
  PID:11792
- C:\Windows\System32\FcJemkq.exe
  C:\Windows\System32\FcJemkq.exe
  2⤵
  PID:12044
- C:\Windows\System32\zweTcjU.exe
  C:\Windows\System32\zweTcjU.exe
  2⤵
  PID:11816
- C:\Windows\System32\qHAktMf.exe
  C:\Windows\System32\qHAktMf.exe
  2⤵
  PID:11912
- C:\Windows\System32\IjctWAC.exe
  C:\Windows\System32\IjctWAC.exe
  2⤵
  PID:12008
- C:\Windows\System32\IquMGtO.exe
  C:\Windows\System32\IquMGtO.exe
  2⤵
  PID:12172
- C:\Windows\System32\OqOUqkO.exe
  C:\Windows\System32\OqOUqkO.exe
  2⤵
  PID:2012
- C:\Windows\System32\pmAldUX.exe
  C:\Windows\System32\pmAldUX.exe
  2⤵
  PID:10980
- C:\Windows\System32\XrqOImT.exe
  C:\Windows\System32\XrqOImT.exe
  2⤵
  PID:848
- C:\Windows\System32\crQQQqz.exe
  C:\Windows\System32\crQQQqz.exe
  2⤵
  PID:11620
- C:\Windows\System32\qlTcNdz.exe
  C:\Windows\System32\qlTcNdz.exe
  2⤵
  PID:11696
- C:\Windows\System32\KdxotZn.exe
  C:\Windows\System32\KdxotZn.exe
  2⤵
  PID:11692
- C:\Windows\System32\icLcHcl.exe
  C:\Windows\System32\icLcHcl.exe
  2⤵
  PID:11760
- C:\Windows\System32\WIjCdHx.exe
  C:\Windows\System32\WIjCdHx.exe
  2⤵
  PID:12072
- C:\Windows\System32\YShqANm.exe
  C:\Windows\System32\YShqANm.exe
  2⤵
  PID:11896
- C:\Windows\System32\LDctkbH.exe
  C:\Windows\System32\LDctkbH.exe
  2⤵
  PID:12124
- C:\Windows\System32\RuwkcVb.exe
  C:\Windows\System32\RuwkcVb.exe
  2⤵
  PID:2976
- C:\Windows\System32\aCubMdL.exe
  C:\Windows\System32\aCubMdL.exe
  2⤵
  PID:11432
- C:\Windows\System32\CeLMrpU.exe
  C:\Windows\System32\CeLMrpU.exe
  2⤵
  PID:11644
- C:\Windows\System32\blwJwaV.exe
  C:\Windows\System32\blwJwaV.exe
  2⤵
  PID:11748
- C:\Windows\System32\ljwWJBB.exe
  C:\Windows\System32\ljwWJBB.exe
  2⤵
  PID:12188
- C:\Windows\System32\xqMUYpo.exe
  C:\Windows\System32\xqMUYpo.exe
  2⤵
  PID:12300
- C:\Windows\System32\FyUWAry.exe
  C:\Windows\System32\FyUWAry.exe
  2⤵
  PID:12328
- C:\Windows\System32\pNlMpMJ.exe
  C:\Windows\System32\pNlMpMJ.exe
  2⤵
  PID:12356
- C:\Windows\System32\ptFbfRs.exe
  C:\Windows\System32\ptFbfRs.exe
  2⤵
  PID:12380
- C:\Windows\System32\vthksQS.exe
  C:\Windows\System32\vthksQS.exe
  2⤵
  PID:12396
- C:\Windows\System32\jAIWruU.exe
  C:\Windows\System32\jAIWruU.exe
  2⤵
  PID:12424
- C:\Windows\System32\cpAnvwR.exe
  C:\Windows\System32\cpAnvwR.exe
  2⤵
  PID:12460
- C:\Windows\System32\dWqDpcM.exe
  C:\Windows\System32\dWqDpcM.exe
  2⤵
  PID:12488
- C:\Windows\System32\UlRgquF.exe
  C:\Windows\System32\UlRgquF.exe
  2⤵
  PID:12504
- C:\Windows\System32\UAoQAgF.exe
  C:\Windows\System32\UAoQAgF.exe
  2⤵
  PID:12524
- C:\Windows\System32\xVLpQJV.exe
  C:\Windows\System32\xVLpQJV.exe
  2⤵
  PID:12552
- C:\Windows\System32\oVFwBhB.exe
  C:\Windows\System32\oVFwBhB.exe
  2⤵
  PID:12616
- C:\Windows\System32\hJcuxki.exe
  C:\Windows\System32\hJcuxki.exe
  2⤵
  PID:12652
- C:\Windows\System32\BrMBcyv.exe
  C:\Windows\System32\BrMBcyv.exe
  2⤵
  PID:12672
- C:\Windows\System32\QcFFzjk.exe
  C:\Windows\System32\QcFFzjk.exe
  2⤵
  PID:12696
- C:\Windows\System32\qWcsuav.exe
  C:\Windows\System32\qWcsuav.exe
  2⤵
  PID:12736
- C:\Windows\System32\AHwFAhH.exe
  C:\Windows\System32\AHwFAhH.exe
  2⤵
  PID:12756
- C:\Windows\System32\FFBFMXP.exe
  C:\Windows\System32\FFBFMXP.exe
  2⤵
  PID:12792
- C:\Windows\System32\yJFYZpY.exe
  C:\Windows\System32\yJFYZpY.exe
  2⤵
  PID:12812
- C:\Windows\System32\QJwYLbJ.exe
  C:\Windows\System32\QJwYLbJ.exe
  2⤵
  PID:12832
- C:\Windows\System32\UNBifeN.exe
  C:\Windows\System32\UNBifeN.exe
  2⤵
  PID:12848
- C:\Windows\System32\ubbZLGC.exe
  C:\Windows\System32\ubbZLGC.exe
  2⤵
  PID:12876
- C:\Windows\System32\vBVbJOl.exe
  C:\Windows\System32\vBVbJOl.exe
  2⤵
  PID:12900
- C:\Windows\System32\hPwigMG.exe
  C:\Windows\System32\hPwigMG.exe
  2⤵
  PID:12916
- C:\Windows\System32\pAOOwgN.exe
  C:\Windows\System32\pAOOwgN.exe
  2⤵
  PID:12968
- C:\Windows\System32\bDhCixc.exe
  C:\Windows\System32\bDhCixc.exe
  2⤵
  PID:13020
- C:\Windows\System32\MdwkusZ.exe
  C:\Windows\System32\MdwkusZ.exe
  2⤵
  PID:13040
- C:\Windows\System32\KzpwaZI.exe
  C:\Windows\System32\KzpwaZI.exe
  2⤵
  PID:13068
- C:\Windows\System32\QvYCfIS.exe
  C:\Windows\System32\QvYCfIS.exe
  2⤵
  PID:13092
- C:\Windows\System32\JSzsAhI.exe
  C:\Windows\System32\JSzsAhI.exe
  2⤵
  PID:13108
- C:\Windows\System32\dmaSXhW.exe
  C:\Windows\System32\dmaSXhW.exe
  2⤵
  PID:13152
- C:\Windows\System32\AXMKDrZ.exe
  C:\Windows\System32\AXMKDrZ.exe
  2⤵
  PID:13172
- C:\Windows\System32\YPQCEUu.exe
  C:\Windows\System32\YPQCEUu.exe
  2⤵
  PID:13196
- C:\Windows\System32\KYJOPlZ.exe
  C:\Windows\System32\KYJOPlZ.exe
  2⤵
  PID:13228
- C:\Windows\System32\uHRHrXY.exe
  C:\Windows\System32\uHRHrXY.exe
  2⤵
  PID:13244
- C:\Windows\System32\KcTxraV.exe
  C:\Windows\System32\KcTxraV.exe
  2⤵
  PID:13268
- C:\Windows\System32\qEluyNi.exe
  C:\Windows\System32\qEluyNi.exe
  2⤵
  PID:11600
- C:\Windows\System32\mVBLyhG.exe
  C:\Windows\System32\mVBLyhG.exe
  2⤵
  PID:12392
- C:\Windows\System32\PlvHKXV.exe
  C:\Windows\System32\PlvHKXV.exe
  2⤵
  PID:12416
- C:\Windows\System32\odizkQC.exe
  C:\Windows\System32\odizkQC.exe
  2⤵
  PID:12440
- C:\Windows\System32\YPQBXyJ.exe
  C:\Windows\System32\YPQBXyJ.exe
  2⤵
  PID:12520
- C:\Windows\System32\wUxKDLL.exe
  C:\Windows\System32\wUxKDLL.exe
  2⤵
  PID:12536
- C:\Windows\System32\UjWBYeh.exe
  C:\Windows\System32\UjWBYeh.exe
  2⤵
  PID:12564
- C:\Windows\System32\ZNLCooe.exe
  C:\Windows\System32\ZNLCooe.exe
  2⤵
  PID:12716
- C:\Windows\System32\xbYvjdq.exe
  C:\Windows\System32\xbYvjdq.exe
  2⤵
  PID:12780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BqPVoWH.exe

Path C:\Windows\System32\BqPVoWH.exe
Size 1.0MB
SHA256 5b6ceef9864a46b2b2237a00fb82d5b3009a44de103d08a4261e92b82be6a4ab
MD5 51729323516ae6980ea07bded45d5798
SHA1 6dc3b4350e60d73873f29a995587a59f311fe91c
SHA512 37bdaf5c5e9b1b52c362e24fa76a70ad56b6a346a9097613cb35fa3689804420890b0a203d98bdd0d08badef8ba469cfd4a3beff93602fc1ab9ce408a9bfab8d
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBGM:knw9oUUEEDl37jcq4AM
MD5 SHA1 SHA512 SSDEEP

Submit Download

CAOPxbL.exe

Path C:\Windows\System32\CAOPxbL.exe
Size 1.0MB
SHA256 3a76656a10c15e040aad2c2cf2c24879a3028e99a6f249d3ba32a6f1531b68aa
MD5 282b78803a98292c06c219e275247f98
SHA1 95260befe1f6ded7e55a81782de61c5a0c69fab8
SHA512 e1c3ea38f015d98356096ed02b1b866ed95728818f62bf2d117844dbdff6e6875b164b129654a22f13ae33e8af414331d6b2a87222dfecc0355b411b1c00d768
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBGu:knw9oUUEEDl37jcq4Au
MD5 SHA1 SHA512 SSDEEP

Submit Download

CgDCJJQ.exe

Path C:\Windows\System32\CgDCJJQ.exe
Size 1.0MB
SHA256 ddf0e439620ca7d018cf0186eb65bc9dc2256dc06c59bba173941939cc760749
MD5 3e98307cd5b2778a788bd30763b2f50d
SHA1 b3d8185bf9e01273247e7d7819037e4cca6d4490
SHA512 223785bd96d0e645f7c646269686c117aa1e9649b74103c8f5e45b2e1e0cbf62327ce34aa0d9cd84b82e30b4fd48a4e3157ec8350d43c9deda506be33c8a9ba0
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBGL:knw9oUUEEDl37jcq4AL
MD5 SHA1 SHA512 SSDEEP

Submit Download

EgZylpr.exe

Path C:\Windows\System32\EgZylpr.exe
Size 1.0MB
SHA256 054518e6dfea9698a54ac8b595e40db15c90ab4ff9fcbb9edce106bbbb0d5fbb
MD5 6d7944988393fd3649a2d3caf7d19a17
SHA1 58e09545ef39ebe3e26b5bc75ab8f7b6dc7d53ca
SHA512 a005e90a406aa81428cf04f9e722b6f8a903398c09941f3934ecdd996ed645a1ee68b64007c51a753694503af023912d7cf812095b7766eeaa543e3f45bb5096
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBGG:knw9oUUEEDl37jcq4AG
MD5 SHA1 SHA512 SSDEEP

Submit Download

FooLlKO.exe

Path C:\Windows\System32\FooLlKO.exe
Size 1.0MB
SHA256 aadd8297a3010925986b8770808af38c60e5706103273be2d09855e7cf16dc61
MD5 2cbed1ef3df21dbb477a8e1db211b323
SHA1 9f5669801e681601c80f9cb5472c45fefc64c13b
SHA512 fa4a962aad05cf8ca6b2aa62cc272d4bd8fac9456956ed151b26da07a3b839ea35a302c713c403c1b692b2a0ea942944462b6b956f90c0eb7af9272642934541
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBGU:knw9oUUEEDl37jcq4AU
MD5 SHA1 SHA512 SSDEEP

Submit Download

HNQBhCy.exe

Path C:\Windows\System32\HNQBhCy.exe
Size 1.0MB
SHA256 f7d4d3f99db5b67c863e16cd768182086df2443f8e46e7e2ba491f6e0ad7bd36
MD5 6a4365b8a77bdfebc2bf043f3ed93c31
SHA1 8442ac19f000e133f796450ad0df4260dce44375
SHA512 f0c7b1dbaa5c3885232aaa4d631877b85004a1c414f234ffceb7ceb25bc17ffe8912818291edf86bd28d274975c5ca18c3fbdddf9228eb6b1524c43aad82aec1
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBGDa:knw9oUUEEDl37jcq4AW
MD5 SHA1 SHA512 SSDEEP

Submit Download

IbAJdGX.exe

Path C:\Windows\System32\IbAJdGX.exe
Size 1.0MB
SHA256 8f016083c42c5dd77b1244c3c6339a4fd87b54f5f50c9fb0d043c94efe55b3fe
MD5 57ee7e463b31d066ac9572f2b823c186
SHA1 f0f51cd06526982e75762161ec3edd9d79539b92
SHA512 deab318d6f1a83bee70f8da1959af6c0ded9a0d2cf2367b32b21f9f98e0de5f263687330daf77bf0c227b01cb882476c7313bff6d5cf7d9f4b381e3d6b147628
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBGr:knw9oUUEEDl37jcq4Ar
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jtlimmb.exe

Path C:\Windows\System32\Jtlimmb.exe
Size 1.0MB
SHA256 d211c339dddc2c92e63c84ed471e0cef89cb90ad6b5eddbc807da98fb2b842e4
MD5 1c55bd81c2cf78585f982f45a1168ad0
SHA1 db79e85e8267714a0c02008c8f4604a13b87f71d
SHA512 038ae30a9a74299a97e2529e2267803802d0ea0da76ef90c01304213494c83e5e30d367f594a7ed0101c88fd02bacac4cad6e28aa13e24fde020750383924a01
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBGB:knw9oUUEEDl37jcq4AB
MD5 SHA1 SHA512 SSDEEP

Submit Download

KxMsZXn.exe

Path C:\Windows\System32\KxMsZXn.exe
Size 1.0MB
SHA256 3a34dac554cbed80465c2d8b87d366aa2d721ece81ab363ba3b56333af5424f3
MD5 713bd575b01b9075edb6e238cb64c39e
SHA1 8dad1c8b46dd64c34b57b1d1bf0b62082bfbbf12
SHA512 72c024f9d8258b54737ee4a15afe51cd7bdc96c8e329ea882f9cdc308b0528293e72df51c9a5827c59f2f62037ded21d5a2e5e2d09cc178fde414ddb3a0c546a
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBGA:knw9oUUEEDl37jcq4AA
MD5 SHA1 SHA512 SSDEEP

Submit Download

NkvOgDJ.exe

Path C:\Windows\System32\NkvOgDJ.exe
Size 1.0MB
SHA256 64da13a1a3f491df5a9fbae1e66f54ceead86d96f53c4b1483cd5dc0b321f787
MD5 b5fd6e39a8ba383b55268c184662485e
SHA1 3ad6ed1edabcfde968302ac2f1ce1c61ee8e534e
SHA512 3d0e204682ae81cc70feb504efc9e7de6d01041e600668950874629fbcdd712127ee64b32b5f4571bba49859a3c4d40a4314d2780e31f747ae9d88ffa41a4b7b
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBGa:knw9oUUEEDl37jcq4Aa
MD5 SHA1 SHA512 SSDEEP

Submit Download

RTRwbdG.exe

Path C:\Windows\System32\RTRwbdG.exe
Size 1.0MB
SHA256 6f539e8de0d298c2800b9a3215f21b1d165655a1ee0e8e4aef9326427cbe34e1
MD5 2b0381d60f89b93c16f6d2f30287297f
SHA1 e578706ae0599aa0440ba99cdeab06b6d3559065
SHA512 c91a518fb4c0c6f02a51043611922f408e08080033711ae7acac4181e992573e462b757cc3ab01502bfe4e1b671a15dc9c9ba5628c6aa4411e87942a86bbe1d9
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBGd:knw9oUUEEDl37jcq4Ad
MD5 SHA1 SHA512 SSDEEP

Submit Download

SKYqEjU.exe

Path C:\Windows\System32\SKYqEjU.exe
Size 1.0MB
SHA256 d6247291e32ff6ee54a0c281a86ad41efd6c6ea04025327a8950652f590b5a43
MD5 24ac1c0fe3cf6897e202022713dfd9e0
SHA1 fda8057eae7292b5e5d1dc8d10b990ac233732a6
SHA512 f2abf51256cab4f0b7aa6a78751862cf81bb3a613c7c3766286614b3e2432950d47d315ee2582a50c4b6a2adceba274839c84ccd145647f5f3b4aa7e5df2cde4
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBGj:knw9oUUEEDl37jcq4Aj
MD5 SHA1 SHA512 SSDEEP

Submit Download

SizKWOZ.exe

Path C:\Windows\System32\SizKWOZ.exe
Size 1.0MB
SHA256 77569ad45a8d45e2d58ba0ad8c42ccb6378b2f7ad45cbddbfe2a9674bb72771b
MD5 0b47f14c80806173dd23ec259660b7d2
SHA1 bb41904d7ee02b0ddf2775eac4b36ad876259211
SHA512 a39c3f5622f6fdf7dc37039d396f7bfbd4557e6690dbd4cb56faabf86facba4dabc5431caeaa157bf7f8c3cd219191320e112f45b4ab6671a31096f6ab5fc3fc
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBGL:knw9oUUEEDl37jcq4AL
MD5 SHA1 SHA512 SSDEEP

Submit Download

TiqINRw.exe

Path C:\Windows\System32\TiqINRw.exe
Size 1.0MB
SHA256 a2963721c9523d3c86c0709363d60508ebe1846eeb5d8c31d1dcf417dddcfed2
MD5 e607047b3e3cfe2562d3fbbeb78f4fd4
SHA1 da2ab5e68907670124d75b04ee3b7891f5f0beef
SHA512 6a2731a5771d5bc4a7c6d16cb7030d05657ad7cfcb231d150bcc4760bee7f0914939644099a701ca479f191cb6100a94b6876e43598488a5ca16cd6a753d4860
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBGC:knw9oUUEEDl37jcq4AC
MD5 SHA1 SHA512 SSDEEP

Submit Download

WeDYHDf.exe

Path C:\Windows\System32\WeDYHDf.exe
Size 1.0MB
SHA256 cb9ae050e97fd609fb2ba79346ecf40dd3695ec9abfa9749129170029ed759a5
MD5 18ec1266ec6c84bc2e70d05e5aeb7f52
SHA1 13c408f4cc3d2c73c3e2fd72c41fa97376e31e20
SHA512 7f22d6e7f38015f3b0e72ebe6a2c3b35b9f540a54fffda13bd9e3e4cc13f540aa00d56645130f66754581318eb43c8ff5bb57425dfa42a5308b32928bac38dfb
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBG7:knw9oUUEEDl37jcq4A7
MD5 SHA1 SHA512 SSDEEP

Submit Download

YCqXQxW.exe

Path C:\Windows\System32\YCqXQxW.exe
Size 1.0MB
SHA256 6842e89e9562620a59b31ac2167f714d975b2205bc8cf2955dc3539c9a8b3122
MD5 a0b38e81faf126d58800b9c23f474dca
SHA1 4027aee7a0fc0a1ad3436a1e23cd2f3dc24c9281
SHA512 ff1c88b9f1193ae1dd7581bd0af6036910c116325e47b8fdd2c1d20967e1577c38d3e2ce59507942beac022ffebf80b9484415f17461ff692ab958c2ffa47e0d
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBGtT:knw9oUUEEDl37jcq4AB
MD5 SHA1 SHA512 SSDEEP

Submit Download

YOxHwzn.exe

Path C:\Windows\System32\YOxHwzn.exe
Size 1.0MB
SHA256 ada9b83264d73d9442b2eec5e091cf76dec839cd01c90f7399eae1385c3da0f4
MD5 30cbcc8c7a0d3c21adebad1bc4d50d29
SHA1 024c93b862fd014e120c196855273f65dfcb846e
SHA512 d6c3eb4edb6ee7d60b292ef5820a6a9cd57162eb1e01bec8951016fce9e3fd9f5e3b1f8d4414094649232993526e9a2b8de5ee755d8e1c22e3cbefe8b59cd2a3
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBGG1:knw9oUUEEDl37jcq4AY
MD5 SHA1 SHA512 SSDEEP

Submit Download

azDJQKm.exe

Path C:\Windows\System32\azDJQKm.exe
Size 1.0MB
SHA256 90396510a7ebc41413b79ec16028c013ce4f8067e7ddbd6191c60ebafa94c946
MD5 1aa56c59f41945e7ebc94edb234fca21
SHA1 3ed120e93cf5005591acc674139d732fb62a774d
SHA512 bc4f9b20b96c19233f949ff56abfd8cace6c2ee96ec09c1acec2628ffec36694992f36138894a4e5eb461545b79796755a88618acb1608b6eebd3c4dee2b8b3f
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBGE:knw9oUUEEDl37jcq4AE
MD5 SHA1 SHA512 SSDEEP

Submit Download

daCsNUl.exe

Path C:\Windows\System32\daCsNUl.exe
Size 1.0MB
SHA256 5307e99ab94323925e2e3d5bd4b1c9e1638d6b702c0f2492f7d68a72c2be7e15
MD5 ddc311484b1a6ddc96adc5ba3605a7dc
SHA1 60e6d4a9309ffc87ee90fe4716e9c5bfdb3d56bb
SHA512 61517ffe64e582f1c3e4abb9375bdd167dc325d8bce93bb2c84f88a55984ec754edb0b97f181753519a52a47056422a4324b89f1721a11a076fe13334b7d833e
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBG97:knw9oUUEEDl37jcq4A97
MD5 SHA1 SHA512 SSDEEP

Submit Download

gqaOEtw.exe

Path C:\Windows\System32\gqaOEtw.exe
Size 1.0MB
SHA256 b35bb68a37d96de041dcee0d95cc6322b63fd461e9ebe8a57d64fd4bfb7a3308
MD5 6b44883ddc4b4f8ecd980c7d41ad1d7f
SHA1 a7ec06d3af97de424c85f6507b3640258739dba0
SHA512 a6659f8df66d7e8bc9c8e845fe43a7b9a0c09cff737ab9d2ef18c5380c8e8fad73396767841f95d6837a0177ab86450931f1833b1b4c53f0a5ab7401024ac029
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBGm:knw9oUUEEDl37jcq4Am
MD5 SHA1 SHA512 SSDEEP

Submit Download

mIQpqLQ.exe

Path C:\Windows\System32\mIQpqLQ.exe
Size 1.0MB
SHA256 38576f97268c96d7683df7b97d4b44959de996bda881ae51ab6b308160e8cd45
MD5 f8a2790ce83e30443987f8b6fa610a1b
SHA1 0f175ea78ab86809fe8bacbdb6b8bc8c80b5dcd0
SHA512 233b24ecf77234f433444e53014bed5f43889d7c3af6f98f071b8bcf3a82d269f8727c74c8321cd95fc166573beec2f9b392bf0b3040a38cd1ebfc128fb32767
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBGE:knw9oUUEEDl37jcq4AE
MD5 SHA1 SHA512 SSDEEP

Submit Download

nvAAHHa.exe

Path C:\Windows\System32\nvAAHHa.exe
Size 1.0MB
SHA256 4d25bf923451ef3a7bf66251911e62e29b63efff79db37834d24a8544179eeec
MD5 b5f5b9f1500d4d09599996c548e32032
SHA1 36e760d79f70382ec492b2825a9e67b7e0092da7
SHA512 96a84d9c539085e4061a239108c4eed4a65ad63b49e0132a2f699b4a16b0eb271197849e9f35a66f04c6ba1baf064e6bef830029791752222e3721ba831cbced
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBGr:knw9oUUEEDl37jcq4Ar
MD5 SHA1 SHA512 SSDEEP

Submit Download

rGSguoN.exe

Path C:\Windows\System32\rGSguoN.exe
Size 1.0MB
SHA256 24950150aefc92854aae7c0ca613386ace99cf0003243c97f153b3745a5f69da
MD5 63bcdac789ee04e6b5660054dc65d21e
SHA1 9be2ac2f5399fe890b5daf98066d7e4f2f8dd440
SHA512 983196240f231f145337cb08eb68c2fe265b51520a4e33fa4264b3c0f623533e4e703586235df8c0ef50b9a1c0c9b67b786f7a232935e7d263d448fce3fbbfaa
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBGN:knw9oUUEEDl37jcq4AN
MD5 SHA1 SHA512 SSDEEP

Submit Download

rucWabS.exe

Path C:\Windows\System32\rucWabS.exe
Size 1.0MB
SHA256 088688b2bdfd61944db38d54ed87a5d2371fb98aa420d539b2272c302335b729
MD5 e86782e7308e2ea4da5e069bbd75f3cd
SHA1 bf02455f0aa03116751ff2c39a3c5ecf487ca484
SHA512 0e353d569fef30c10fe7a8be5a08f16a2653b29013b1f5bb6615392bd225c7d69ae9445996d772943a3fedfea4577ad4699151163423fe7460991b99188d1d49
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBGx:knw9oUUEEDl37jcq4Ax
MD5 SHA1 SHA512 SSDEEP

Submit Download

sHgeyMF.exe

Path C:\Windows\System32\sHgeyMF.exe
Size 1.0MB
SHA256 43c1085cc08f79e2ac8665a9cb6d7bddbed5d4a12c28f37a9237c387ebcca4d6
MD5 e859894e19ebc93e07283fc82b1994d5
SHA1 6e5aaa6cfc48742934f6c271b360be787b3238f8
SHA512 bd2340caca89caa07583caa4398084aaeed904ddd1a666d86c224cfa49a49532aeeac1814b2f34dde77d69b822bb9be264ef942d941a8d134efa8825bd9efaa7
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBGEJ:knw9oUUEEDl37jcq4AEJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

sPUShrz.exe

Path C:\Windows\System32\sPUShrz.exe
Size 1.0MB
SHA256 cc5eab4292d262a5dc3a8f10222ec73ae4aa04b5f42b0523f187bb83f85eac10
MD5 d5de5196330c5a2f2be9fc0030fcbefb
SHA1 d5535e4f9c611319c072d7f7a84396c6ffe81758
SHA512 f48d2e49d4dd7264ce2dd8f0b85212e2f33f12f6f492dcebc1fa99e273ff242df01eb56864d5ab006855ba7f1db1c70ab27b84405951309818cbf2eb6325102f
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBGj7:knw9oUUEEDl37jcq4AX
MD5 SHA1 SHA512 SSDEEP

Submit Download

tOuEmXv.exe

Path C:\Windows\System32\tOuEmXv.exe
Size 1.0MB
SHA256 f70b20335055fe97afe7dbdea0ec7315afe5f915507bad56ce9983b481f5071e
MD5 ca60047de22a27e57b6d922cc7ac184c
SHA1 f00012786f0780cd46685857e29072480fff4c9d
SHA512 5a940c86650eaa87ab2ac84d82c68720a9024e10a454a6250bfab343d67acf81fd12cc565c2f61f75efa1ee2b913e3829e07b78e83e3e786dac49d2cc34fa4da
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBGF:knw9oUUEEDl37jcq4AF
MD5 SHA1 SHA512 SSDEEP

Submit Download

wLqTuqE.exe

Path C:\Windows\System32\wLqTuqE.exe
Size 1.0MB
SHA256 9d63ad42ff3b9b7cf394c147550d5e5ffd1eb98d218ef20577e8e788e4d3b9dd
MD5 96a1856b0116cc2e156b9e1c54d4ef85
SHA1 1489d3068bb6846dd66ab0468130cf111f16c81f
SHA512 bf79bc1f6d8c18e1f36a31de4c0508c3767831ec3c377aa0a5da071b46bf40a9ec30dd7cec0b4b188dcfdbde366b73467b64c2a48ba1e329c40a46207f4dd607
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBG13p:knw9oUUEEDl37jcq4Alp
MD5 SHA1 SHA512 SSDEEP

Submit Download

wtEuCHs.exe

Path C:\Windows\System32\wtEuCHs.exe
Size 1.0MB
SHA256 b7aa5cdc645f54c6f7be3089a627884ffe16e5306c7a2cba8ac21cdc2e846a3a
MD5 2d3f8fed116c62875efb9014ad8ba2d1
SHA1 d30a3737194b129b3e0e2029978c9d1c897824d3
SHA512 2e4d0df6562cfe17156de2402428e0f032137d7c52f50a3a1b462f49c571d1112599abb9ccab3a02c48cefb3033b26d8989980ad745dd2ab871c96ec8ba1e2de
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBGg:knw9oUUEEDl37jcq4Ag
MD5 SHA1 SHA512 SSDEEP

Submit Download

yRgEWRJ.exe

Path C:\Windows\System32\yRgEWRJ.exe
Size 1.0MB
SHA256 f002a94b1e8128c819b0d702afd7db345658de73dcbefd4e1fc57b85760b20ac
MD5 4e5b3f2b49bd8c815d535dbeba0ab123
SHA1 064d7080a1d86c3fbf2107ccd965a8540e1e8b2f
SHA512 c0519c6e3ffd8213915b73b8e70c285c355eb66fc0a29ef0e9d908d42e95bd5ca086960a2336554ffbb82f6810b147a9076504f1e99ca90da00e9d9a5ac70de2
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBGc:knw9oUUEEDl37jcq4Ac
MD5 SHA1 SHA512 SSDEEP

Submit Download

zBSsyiq.exe

Path C:\Windows\System32\zBSsyiq.exe
Size 1.0MB
SHA256 7407a219f9b10b3ba48134f587ed436c2a8e8a2226d6a8f83089b1af0f67fe0e
MD5 5977b08dcb9fdda36fe6a3c4a40977c6
SHA1 f5073f15bf9e1d6957185eebfeb77a536628bf47
SHA512 a0aea830736d53f3a7a3a404aef1c755174fa5e3883e60b4c5b043aa78e8278033e4a7e965b86834b27a0d37ac0327a5f2de7f69d68664136f5fc3cf76750f96
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBGL:knw9oUUEEDl37jcq4AL
MD5 SHA1 SHA512 SSDEEP

Submit Download

ztpyYGB.exe

Path C:\Windows\System32\ztpyYGB.exe
Size 1.0MB
SHA256 b7bd3f5fc60c0056e0052ec1d72138fb5f3d9560c3f6c1b1e3fe062e886b3eac
MD5 ce2b8185a051b635ea451fcaf218cb02
SHA1 211efdc9de5ce89e0194abd0187183d63827c1d7
SHA512 fcc24ff445234a77fd0b90f744b5881a4a7ccb1a80145505fe7c81443134f7dbbd103e3da198b16ee51bf3bf81f713ca5b8950d8d64c61f6a0c340c37294662a
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBGj:knw9oUUEEDl37jcq4Aj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/396-304-0x00007FF6DC0D0000-0x00007FF6DC4C1000-memory.dmp

Download

memory/396-2063-0x00007FF6DC0D0000-0x00007FF6DC4C1000-memory.dmp

Download

memory/688-2076-0x00007FF709860000-0x00007FF709C51000-memory.dmp

Download

memory/688-311-0x00007FF709860000-0x00007FF709C51000-memory.dmp

Download

memory/896-2056-0x00007FF67B800000-0x00007FF67BBF1000-memory.dmp

Download

memory/896-289-0x00007FF67B800000-0x00007FF67BBF1000-memory.dmp

Download

memory/996-2033-0x00007FF62AC10000-0x00007FF62B001000-memory.dmp

Download

memory/996-45-0x00007FF62AC10000-0x00007FF62B001000-memory.dmp

Download

memory/996-1990-0x00007FF62AC10000-0x00007FF62B001000-memory.dmp

Download

memory/1748-287-0x00007FF79B200000-0x00007FF79B5F1000-memory.dmp

Download

memory/1748-2043-0x00007FF79B200000-0x00007FF79B5F1000-memory.dmp

Download

memory/1844-2032-0x00007FF7D8900000-0x00007FF7D8CF1000-memory.dmp

Download

memory/1844-320-0x00007FF7D8900000-0x00007FF7D8CF1000-memory.dmp

Download

memory/2052-2077-0x00007FF7217E0000-0x00007FF721BD1000-memory.dmp

Download

memory/2052-313-0x00007FF7217E0000-0x00007FF721BD1000-memory.dmp

Download

memory/2084-2065-0x00007FF669EF0000-0x00007FF66A2E1000-memory.dmp

Download

memory/2084-307-0x00007FF669EF0000-0x00007FF66A2E1000-memory.dmp

Download

memory/2132-1988-0x00007FF6A2460000-0x00007FF6A2851000-memory.dmp

Download

memory/2132-0-0x00007FF6A2460000-0x00007FF6A2851000-memory.dmp

Download

memory/2132-1-0x000001FB04840000-0x000001FB04850000-memory.dmp

Download

memory/2152-292-0x00007FF6A30A0000-0x00007FF6A3491000-memory.dmp

Download

memory/2152-2057-0x00007FF6A30A0000-0x00007FF6A3491000-memory.dmp

Download

memory/2436-2046-0x00007FF68B8C0000-0x00007FF68BCB1000-memory.dmp

Download

memory/2436-283-0x00007FF68B8C0000-0x00007FF68BCB1000-memory.dmp

Download

memory/2648-2040-0x00007FF6CB7E0000-0x00007FF6CBBD1000-memory.dmp

Download

memory/2648-323-0x00007FF6CB7E0000-0x00007FF6CBBD1000-memory.dmp

Download

memory/3044-302-0x00007FF74B830000-0x00007FF74BC21000-memory.dmp

Download

memory/3044-2059-0x00007FF74B830000-0x00007FF74BC21000-memory.dmp

Download

memory/3084-284-0x00007FF6048C0000-0x00007FF604CB1000-memory.dmp

Download

memory/3084-2047-0x00007FF6048C0000-0x00007FF604CB1000-memory.dmp

Download

memory/3404-2029-0x00007FF717DB0000-0x00007FF7181A1000-memory.dmp

Download

memory/3404-1989-0x00007FF717DB0000-0x00007FF7181A1000-memory.dmp

Download

memory/3404-17-0x00007FF717DB0000-0x00007FF7181A1000-memory.dmp

Download

memory/3516-290-0x00007FF79A750000-0x00007FF79AB41000-memory.dmp

Download

memory/3516-2049-0x00007FF79A750000-0x00007FF79AB41000-memory.dmp

Download

memory/3936-2061-0x00007FF632E20000-0x00007FF633211000-memory.dmp

Download

memory/3936-296-0x00007FF632E20000-0x00007FF633211000-memory.dmp

Download

memory/3952-286-0x00007FF777DB0000-0x00007FF7781A1000-memory.dmp

Download

memory/3952-2036-0x00007FF777DB0000-0x00007FF7781A1000-memory.dmp

Download

memory/4120-2038-0x00007FF67A220000-0x00007FF67A611000-memory.dmp

Download

memory/4120-285-0x00007FF67A220000-0x00007FF67A611000-memory.dmp

Download

memory/4192-288-0x00007FF6D01A0000-0x00007FF6D0591000-memory.dmp

Download

memory/4192-2053-0x00007FF6D01A0000-0x00007FF6D0591000-memory.dmp

Download

memory/4668-2041-0x00007FF66B2C0000-0x00007FF66B6B1000-memory.dmp

Download

memory/4668-282-0x00007FF66B2C0000-0x00007FF66B6B1000-memory.dmp

Download

memory/4700-317-0x00007FF753B70000-0x00007FF753F61000-memory.dmp

Download

memory/4700-2083-0x00007FF753B70000-0x00007FF753F61000-memory.dmp

Download

memory/4832-2082-0x00007FF6137D0000-0x00007FF613BC1000-memory.dmp

Download

memory/4832-309-0x00007FF6137D0000-0x00007FF613BC1000-memory.dmp

Download

memory/5068-2027-0x00007FF699900000-0x00007FF699CF1000-memory.dmp

Download

memory/5068-14-0x00007FF699900000-0x00007FF699CF1000-memory.dmp

Download

memory/5088-2051-0x00007FF6736A0000-0x00007FF673A91000-memory.dmp

Download

memory/5088-281-0x00007FF6736A0000-0x00007FF673A91000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads