xmrig | fadb607f40134c93afc189df0c52b006de484e22b21c74f018d24116180ec05c

Analysis

max time kernel
125s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 00:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
Size 1.1MB
Sample240524-ay9eaafa85
SHA256 fadb607f40134c93afc189df0c52b006de484e22b21c74f018d24116180ec05c
MD5 6cce7937c2dc5ffb5a0b6384a2b3f1b9
SHA1 114bb134ee973d3222ad9278b4381c3a96e19a2e
SHA512 53051e95d2d83b0638fdf3801da0f7a6cf5d6bd62ff80660621213c38b71e5c9ba770e7ecec14f7b05d38c4c4f14c5eb5ea26a9d4dae1216927368334584e632
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlGC78XCejIODosTigQytOF2:knw9oUUEEDlGUrMNP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/4384-16-0x00007FF7DF650000-0x00007FF7DFA41000-memory.dmp	xmrig
behavioral2/memory/4292-25-0x00007FF7502F0000-0x00007FF7506E1000-memory.dmp	xmrig
behavioral2/memory/4204-395-0x00007FF7FB9B0000-0x00007FF7FBDA1000-memory.dmp	xmrig
behavioral2/memory/2852-396-0x00007FF694B00000-0x00007FF694EF1000-memory.dmp	xmrig
behavioral2/memory/2684-397-0x00007FF608D40000-0x00007FF609131000-memory.dmp	xmrig
behavioral2/memory/2712-57-0x00007FF7CE0C0000-0x00007FF7CE4B1000-memory.dmp	xmrig
behavioral2/memory/3776-55-0x00007FF7663C0000-0x00007FF7667B1000-memory.dmp	xmrig
behavioral2/memory/3360-37-0x00007FF7B6C30000-0x00007FF7B7021000-memory.dmp	xmrig
behavioral2/memory/4208-398-0x00007FF75FBB0000-0x00007FF75FFA1000-memory.dmp	xmrig
behavioral2/memory/4800-399-0x00007FF6D2710000-0x00007FF6D2B01000-memory.dmp	xmrig
behavioral2/memory/2484-400-0x00007FF6C2AD0000-0x00007FF6C2EC1000-memory.dmp	xmrig
behavioral2/memory/3060-401-0x00007FF700E50000-0x00007FF701241000-memory.dmp	xmrig
behavioral2/memory/756-402-0x00007FF788A50000-0x00007FF788E41000-memory.dmp	xmrig
behavioral2/memory/1020-404-0x00007FF6FE190000-0x00007FF6FE581000-memory.dmp	xmrig
behavioral2/memory/652-403-0x00007FF6B73B0000-0x00007FF6B77A1000-memory.dmp	xmrig
behavioral2/memory/2520-405-0x00007FF756790000-0x00007FF756B81000-memory.dmp	xmrig
behavioral2/memory/2476-406-0x00007FF73B8A0000-0x00007FF73BC91000-memory.dmp	xmrig
behavioral2/memory/3448-410-0x00007FF78E790000-0x00007FF78EB81000-memory.dmp	xmrig
behavioral2/memory/1692-418-0x00007FF674460000-0x00007FF674851000-memory.dmp	xmrig
behavioral2/memory/212-414-0x00007FF611120000-0x00007FF611511000-memory.dmp	xmrig
behavioral2/memory/2260-1941-0x00007FF7C4BA0000-0x00007FF7C4F91000-memory.dmp	xmrig
behavioral2/memory/1792-1963-0x00007FF6BE180000-0x00007FF6BE571000-memory.dmp	xmrig
behavioral2/memory/3224-1964-0x00007FF683550000-0x00007FF683941000-memory.dmp	xmrig
behavioral2/memory/2468-1965-0x00007FF6A9950000-0x00007FF6A9D41000-memory.dmp	xmrig
behavioral2/memory/4384-1978-0x00007FF7DF650000-0x00007FF7DFA41000-memory.dmp	xmrig
behavioral2/memory/4292-1980-0x00007FF7502F0000-0x00007FF7506E1000-memory.dmp	xmrig
behavioral2/memory/3360-1982-0x00007FF7B6C30000-0x00007FF7B7021000-memory.dmp	xmrig
behavioral2/memory/3776-1984-0x00007FF7663C0000-0x00007FF7667B1000-memory.dmp	xmrig
behavioral2/memory/2260-1986-0x00007FF7C4BA0000-0x00007FF7C4F91000-memory.dmp	xmrig
behavioral2/memory/1792-1988-0x00007FF6BE180000-0x00007FF6BE571000-memory.dmp	xmrig
behavioral2/memory/1692-1995-0x00007FF674460000-0x00007FF674851000-memory.dmp	xmrig
behavioral2/memory/2468-1996-0x00007FF6A9950000-0x00007FF6A9D41000-memory.dmp	xmrig
behavioral2/memory/3448-2000-0x00007FF78E790000-0x00007FF78EB81000-memory.dmp	xmrig
behavioral2/memory/4204-2004-0x00007FF7FB9B0000-0x00007FF7FBDA1000-memory.dmp	xmrig
behavioral2/memory/2684-2006-0x00007FF608D40000-0x00007FF609131000-memory.dmp	xmrig
behavioral2/memory/4208-2008-0x00007FF75FBB0000-0x00007FF75FFA1000-memory.dmp	xmrig
behavioral2/memory/2852-2002-0x00007FF694B00000-0x00007FF694EF1000-memory.dmp	xmrig
behavioral2/memory/3224-1998-0x00007FF683550000-0x00007FF683941000-memory.dmp	xmrig
behavioral2/memory/2712-1992-0x00007FF7CE0C0000-0x00007FF7CE4B1000-memory.dmp	xmrig
behavioral2/memory/212-1991-0x00007FF611120000-0x00007FF611511000-memory.dmp	xmrig
behavioral2/memory/652-2020-0x00007FF6B73B0000-0x00007FF6B77A1000-memory.dmp	xmrig
behavioral2/memory/2484-2033-0x00007FF6C2AD0000-0x00007FF6C2EC1000-memory.dmp	xmrig
behavioral2/memory/3060-2029-0x00007FF700E50000-0x00007FF701241000-memory.dmp	xmrig
behavioral2/memory/4800-2038-0x00007FF6D2710000-0x00007FF6D2B01000-memory.dmp	xmrig
behavioral2/memory/2476-2017-0x00007FF73B8A0000-0x00007FF73BC91000-memory.dmp	xmrig
behavioral2/memory/756-2025-0x00007FF788A50000-0x00007FF788E41000-memory.dmp	xmrig
behavioral2/memory/2520-2011-0x00007FF756790000-0x00007FF756B81000-memory.dmp	xmrig
behavioral2/memory/1020-2015-0x00007FF6FE190000-0x00007FF6FE581000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4384	gKGKmrL.exe
4292	xpjasNu.exe
3360	ASsHUWq.exe
1792	AcTPSDz.exe
2260	bGjhVWA.exe
3776	lfltuDj.exe
3448	IrkToHD.exe
2712	DFSabLW.exe
3224	ezzaJHZ.exe
2468	pGDovGJ.exe
212	wnsVlMs.exe
1692	uFAAdDx.exe
4204	WHkIRgF.exe
2852	aAuYiKL.exe
2684	vuFQjlQ.exe
4208	QfdiLrZ.exe
4800	qgjpNwY.exe
2484	lnAUeJp.exe
3060	MvzDDLc.exe
756	vFDoWAu.exe
652	pwqPUHe.exe
1020	GCzQJId.exe
2520	gbdFCwg.exe
2476	qsmpWtW.exe
4548	kugLAuQ.exe
2024	sqjSUZm.exe
1076	gpnMqVI.exe
3252	IaTvuxo.exe
2612	cBYdaSL.exe
3052	AFAQFlS.exe
1092	cpWYVGr.exe
1432	XLlLxcq.exe
4308	tJPfvET.exe
3212	rbDpAIp.exe
4660	BuKRaLm.exe
884	qfNEnId.exe
1352	RbxuQMX.exe
1888	jIvOEGH.exe
1896	FXfhdIQ.exe
3204	kpxGwVR.exe
540	miOdoSn.exe
3048	oHpoWWi.exe
1948	cojzaQV.exe
336	kEqtmpM.exe
3236	BKaLyID.exe
2936	WkOAOYQ.exe
2268	ExRpRKf.exe
2184	OQvalkF.exe
4804	dPnYPYL.exe
4768	XJTFFtB.exe
4828	fEtLxSC.exe
4152	cXolJnR.exe
5132	PXjxlmi.exe
5160	ZhMWwZL.exe
5192	GjzeAiO.exe
5216	LEpaTIe.exe
5256	vjccFQU.exe
5276	WuCLiGd.exe
5300	LpYbaXk.exe
5328	tGyFSrB.exe
5356	DHBTbPV.exe
5396	CUesSon.exe
5416	BMnvXBd.exe
5440	EUiGSAj.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2908-0-0x00007FF7CB860000-0x00007FF7CBC51000-memory.dmp	upx
behavioral2/files/0x0008000000023549-6.dat	upx
behavioral2/memory/4384-16-0x00007FF7DF650000-0x00007FF7DFA41000-memory.dmp	upx
behavioral2/files/0x000700000002354d-11.dat	upx
behavioral2/files/0x000700000002354f-23.dat	upx
behavioral2/memory/4292-25-0x00007FF7502F0000-0x00007FF7506E1000-memory.dmp	upx
behavioral2/files/0x0007000000023551-28.dat	upx
behavioral2/files/0x0007000000023552-49.dat	upx
behavioral2/files/0x0007000000023556-61.dat	upx
behavioral2/files/0x0007000000023559-77.dat	upx
behavioral2/files/0x0007000000023560-111.dat	upx
behavioral2/files/0x0007000000023564-138.dat	upx
behavioral2/files/0x0007000000023569-156.dat	upx
behavioral2/memory/4204-395-0x00007FF7FB9B0000-0x00007FF7FBDA1000-memory.dmp	upx
behavioral2/memory/2852-396-0x00007FF694B00000-0x00007FF694EF1000-memory.dmp	upx
behavioral2/memory/2684-397-0x00007FF608D40000-0x00007FF609131000-memory.dmp	upx
behavioral2/files/0x000700000002356c-171.dat	upx
behavioral2/files/0x000700000002356a-168.dat	upx
behavioral2/files/0x000700000002356b-166.dat	upx
behavioral2/files/0x0007000000023568-158.dat	upx
behavioral2/files/0x0007000000023567-153.dat	upx
behavioral2/files/0x0007000000023566-145.dat	upx
behavioral2/files/0x0007000000023565-143.dat	upx
behavioral2/files/0x0007000000023563-133.dat	upx
behavioral2/files/0x0007000000023562-128.dat	upx
behavioral2/files/0x0007000000023561-120.dat	upx
behavioral2/files/0x000700000002355f-113.dat	upx
behavioral2/files/0x000700000002355e-108.dat	upx
behavioral2/files/0x000700000002355d-103.dat	upx
behavioral2/files/0x000700000002355c-98.dat	upx
behavioral2/files/0x000700000002355b-90.dat	upx
behavioral2/files/0x000700000002355a-88.dat	upx
behavioral2/files/0x0007000000023558-75.dat	upx
behavioral2/files/0x0007000000023557-70.dat	upx
behavioral2/files/0x0007000000023555-66.dat	upx
behavioral2/memory/2468-63-0x00007FF6A9950000-0x00007FF6A9D41000-memory.dmp	upx
behavioral2/files/0x0007000000023554-59.dat	upx
behavioral2/memory/3224-58-0x00007FF683550000-0x00007FF683941000-memory.dmp	upx
behavioral2/memory/2712-57-0x00007FF7CE0C0000-0x00007FF7CE4B1000-memory.dmp	upx
behavioral2/memory/3776-55-0x00007FF7663C0000-0x00007FF7667B1000-memory.dmp	upx
behavioral2/files/0x0007000000023553-44.dat	upx
behavioral2/memory/3360-37-0x00007FF7B6C30000-0x00007FF7B7021000-memory.dmp	upx
behavioral2/files/0x0007000000023550-32.dat	upx
behavioral2/memory/2260-30-0x00007FF7C4BA0000-0x00007FF7C4F91000-memory.dmp	upx
behavioral2/memory/1792-27-0x00007FF6BE180000-0x00007FF6BE571000-memory.dmp	upx
behavioral2/files/0x000700000002354e-22.dat	upx
behavioral2/memory/4208-398-0x00007FF75FBB0000-0x00007FF75FFA1000-memory.dmp	upx
behavioral2/memory/4800-399-0x00007FF6D2710000-0x00007FF6D2B01000-memory.dmp	upx
behavioral2/memory/2484-400-0x00007FF6C2AD0000-0x00007FF6C2EC1000-memory.dmp	upx
behavioral2/memory/3060-401-0x00007FF700E50000-0x00007FF701241000-memory.dmp	upx
behavioral2/memory/756-402-0x00007FF788A50000-0x00007FF788E41000-memory.dmp	upx
behavioral2/memory/1020-404-0x00007FF6FE190000-0x00007FF6FE581000-memory.dmp	upx
behavioral2/memory/652-403-0x00007FF6B73B0000-0x00007FF6B77A1000-memory.dmp	upx
behavioral2/memory/2520-405-0x00007FF756790000-0x00007FF756B81000-memory.dmp	upx
behavioral2/memory/2476-406-0x00007FF73B8A0000-0x00007FF73BC91000-memory.dmp	upx
behavioral2/memory/3448-410-0x00007FF78E790000-0x00007FF78EB81000-memory.dmp	upx
behavioral2/memory/1692-418-0x00007FF674460000-0x00007FF674851000-memory.dmp	upx
behavioral2/memory/212-414-0x00007FF611120000-0x00007FF611511000-memory.dmp	upx
behavioral2/memory/2260-1941-0x00007FF7C4BA0000-0x00007FF7C4F91000-memory.dmp	upx
behavioral2/memory/1792-1963-0x00007FF6BE180000-0x00007FF6BE571000-memory.dmp	upx
behavioral2/memory/3224-1964-0x00007FF683550000-0x00007FF683941000-memory.dmp	upx
behavioral2/memory/2468-1965-0x00007FF6A9950000-0x00007FF6A9D41000-memory.dmp	upx
behavioral2/memory/4384-1978-0x00007FF7DF650000-0x00007FF7DFA41000-memory.dmp	upx
behavioral2/memory/4292-1980-0x00007FF7502F0000-0x00007FF7506E1000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\UMlnkPZ.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\AFAQFlS.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\TBztjLd.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\afgMXih.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\ddrFXSQ.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\sTChTWN.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\GiVtWse.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\SqnAdFv.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\jRosqcp.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\BKaLyID.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\XHgTdaM.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\TgwPFqT.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\tEMHscK.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\UxNpaGO.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\LmXiNwN.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\ExRpRKf.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\VnUbPss.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\RYmKrvs.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\qAPgXJj.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\qhOzLQF.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\ntVMkGC.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\vSGrKpd.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\xZZGsIH.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\FiYJjso.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\pjHZnQM.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\gHhjhAK.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\XOOWTxm.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\qHktbPf.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\SBrsUWl.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\CDcAWai.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\flLKYqT.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\iMVUpqM.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\GZYHzqb.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\BhzhyNz.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\kugLAuQ.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\xefawqA.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\NourjPl.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\fZebvqC.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\xJjZqtv.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\MqDVMpq.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\KiIavqe.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\xckLiQb.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\SqWpRJy.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\clQaLDf.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\RBmqzwC.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\fEtLxSC.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\ULMnTOV.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\XDYPUIj.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\uOsBHgl.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\NkyLLth.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\QVcuIgV.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\DOJxrNP.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\NPuVhDu.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\MhgHuli.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\VrTDnhJ.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\zQlJKAN.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\JgIYgiD.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\SRCRWcT.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\HYaoytm.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\NQYTZcv.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\LKEoOzD.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\xGqMfRe.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\CBrfAvc.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
File created	C:\Windows\System32\sqjSUZm.exe	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 4384	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	91
PID 2908 wrote to memory of 4384	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	91
PID 2908 wrote to memory of 4292	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	92
PID 2908 wrote to memory of 4292	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	92
PID 2908 wrote to memory of 3360	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	93
PID 2908 wrote to memory of 3360	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	93
PID 2908 wrote to memory of 2260	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	94
PID 2908 wrote to memory of 2260	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	94
PID 2908 wrote to memory of 1792	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	95
PID 2908 wrote to memory of 1792	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	95
PID 2908 wrote to memory of 3776	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	96
PID 2908 wrote to memory of 3776	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	96
PID 2908 wrote to memory of 3448	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	97
PID 2908 wrote to memory of 3448	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	97
PID 2908 wrote to memory of 2712	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	98
PID 2908 wrote to memory of 2712	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	98
PID 2908 wrote to memory of 3224	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	99
PID 2908 wrote to memory of 3224	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	99
PID 2908 wrote to memory of 2468	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	100
PID 2908 wrote to memory of 2468	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	100
PID 2908 wrote to memory of 212	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	101
PID 2908 wrote to memory of 212	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	101
PID 2908 wrote to memory of 1692	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	102
PID 2908 wrote to memory of 1692	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	102
PID 2908 wrote to memory of 4204	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	103
PID 2908 wrote to memory of 4204	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	103
PID 2908 wrote to memory of 2852	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	104
PID 2908 wrote to memory of 2852	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	104
PID 2908 wrote to memory of 2684	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	105
PID 2908 wrote to memory of 2684	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	105
PID 2908 wrote to memory of 4208	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	106
PID 2908 wrote to memory of 4208	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	106
PID 2908 wrote to memory of 4800	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	107
PID 2908 wrote to memory of 4800	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	107
PID 2908 wrote to memory of 2484	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	108
PID 2908 wrote to memory of 2484	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	108
PID 2908 wrote to memory of 3060	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	109
PID 2908 wrote to memory of 3060	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	109
PID 2908 wrote to memory of 756	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	110
PID 2908 wrote to memory of 756	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	110
PID 2908 wrote to memory of 652	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	111
PID 2908 wrote to memory of 652	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	111
PID 2908 wrote to memory of 1020	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	112
PID 2908 wrote to memory of 1020	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	112
PID 2908 wrote to memory of 2520	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	113
PID 2908 wrote to memory of 2520	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	113
PID 2908 wrote to memory of 2476	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	114
PID 2908 wrote to memory of 2476	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	114
PID 2908 wrote to memory of 4548	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	115
PID 2908 wrote to memory of 4548	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	115
PID 2908 wrote to memory of 2024	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	116
PID 2908 wrote to memory of 2024	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	116
PID 2908 wrote to memory of 1076	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	117
PID 2908 wrote to memory of 1076	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	117
PID 2908 wrote to memory of 3252	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	118
PID 2908 wrote to memory of 3252	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	118
PID 2908 wrote to memory of 2612	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	119
PID 2908 wrote to memory of 2612	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	119
PID 2908 wrote to memory of 3052	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	120
PID 2908 wrote to memory of 3052	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	120
PID 2908 wrote to memory of 1092	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	121
PID 2908 wrote to memory of 1092	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	121
PID 2908 wrote to memory of 1432	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	122
PID 2908 wrote to memory of 1432	2908	6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe	122

C:\Users\Admin\AppData\Local\Temp\6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6cce7937c2dc5ffb5a0b6384a2b3f1b9_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\System32\gKGKmrL.exe
  C:\Windows\System32\gKGKmrL.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System32\xpjasNu.exe
  C:\Windows\System32\xpjasNu.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System32\ASsHUWq.exe
  C:\Windows\System32\ASsHUWq.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System32\bGjhVWA.exe
  C:\Windows\System32\bGjhVWA.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System32\AcTPSDz.exe
  C:\Windows\System32\AcTPSDz.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System32\lfltuDj.exe
  C:\Windows\System32\lfltuDj.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System32\IrkToHD.exe
  C:\Windows\System32\IrkToHD.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System32\DFSabLW.exe
  C:\Windows\System32\DFSabLW.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System32\ezzaJHZ.exe
  C:\Windows\System32\ezzaJHZ.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System32\pGDovGJ.exe
  C:\Windows\System32\pGDovGJ.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System32\wnsVlMs.exe
  C:\Windows\System32\wnsVlMs.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System32\uFAAdDx.exe
  C:\Windows\System32\uFAAdDx.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System32\WHkIRgF.exe
  C:\Windows\System32\WHkIRgF.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System32\aAuYiKL.exe
  C:\Windows\System32\aAuYiKL.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System32\vuFQjlQ.exe
  C:\Windows\System32\vuFQjlQ.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System32\QfdiLrZ.exe
  C:\Windows\System32\QfdiLrZ.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System32\qgjpNwY.exe
  C:\Windows\System32\qgjpNwY.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System32\lnAUeJp.exe
  C:\Windows\System32\lnAUeJp.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System32\MvzDDLc.exe
  C:\Windows\System32\MvzDDLc.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System32\vFDoWAu.exe
  C:\Windows\System32\vFDoWAu.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System32\pwqPUHe.exe
  C:\Windows\System32\pwqPUHe.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System32\GCzQJId.exe
  C:\Windows\System32\GCzQJId.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System32\gbdFCwg.exe
  C:\Windows\System32\gbdFCwg.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System32\qsmpWtW.exe
  C:\Windows\System32\qsmpWtW.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System32\kugLAuQ.exe
  C:\Windows\System32\kugLAuQ.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System32\sqjSUZm.exe
  C:\Windows\System32\sqjSUZm.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System32\gpnMqVI.exe
  C:\Windows\System32\gpnMqVI.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System32\IaTvuxo.exe
  C:\Windows\System32\IaTvuxo.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System32\cBYdaSL.exe
  C:\Windows\System32\cBYdaSL.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System32\AFAQFlS.exe
  C:\Windows\System32\AFAQFlS.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System32\cpWYVGr.exe
  C:\Windows\System32\cpWYVGr.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System32\XLlLxcq.exe
  C:\Windows\System32\XLlLxcq.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System32\tJPfvET.exe
  C:\Windows\System32\tJPfvET.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System32\rbDpAIp.exe
  C:\Windows\System32\rbDpAIp.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System32\BuKRaLm.exe
  C:\Windows\System32\BuKRaLm.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System32\qfNEnId.exe
  C:\Windows\System32\qfNEnId.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System32\RbxuQMX.exe
  C:\Windows\System32\RbxuQMX.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System32\jIvOEGH.exe
  C:\Windows\System32\jIvOEGH.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System32\FXfhdIQ.exe
  C:\Windows\System32\FXfhdIQ.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System32\kpxGwVR.exe
  C:\Windows\System32\kpxGwVR.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System32\miOdoSn.exe
  C:\Windows\System32\miOdoSn.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System32\oHpoWWi.exe
  C:\Windows\System32\oHpoWWi.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System32\cojzaQV.exe
  C:\Windows\System32\cojzaQV.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System32\kEqtmpM.exe
  C:\Windows\System32\kEqtmpM.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System32\BKaLyID.exe
  C:\Windows\System32\BKaLyID.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System32\WkOAOYQ.exe
  C:\Windows\System32\WkOAOYQ.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System32\ExRpRKf.exe
  C:\Windows\System32\ExRpRKf.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System32\OQvalkF.exe
  C:\Windows\System32\OQvalkF.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System32\dPnYPYL.exe
  C:\Windows\System32\dPnYPYL.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System32\XJTFFtB.exe
  C:\Windows\System32\XJTFFtB.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System32\fEtLxSC.exe
  C:\Windows\System32\fEtLxSC.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System32\cXolJnR.exe
  C:\Windows\System32\cXolJnR.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System32\PXjxlmi.exe
  C:\Windows\System32\PXjxlmi.exe
  2⤵
  - Executes dropped EXE
  PID:5132
- C:\Windows\System32\ZhMWwZL.exe
  C:\Windows\System32\ZhMWwZL.exe
  2⤵
  - Executes dropped EXE
  PID:5160
- C:\Windows\System32\GjzeAiO.exe
  C:\Windows\System32\GjzeAiO.exe
  2⤵
  - Executes dropped EXE
  PID:5192
- C:\Windows\System32\LEpaTIe.exe
  C:\Windows\System32\LEpaTIe.exe
  2⤵
  - Executes dropped EXE
  PID:5216
- C:\Windows\System32\vjccFQU.exe
  C:\Windows\System32\vjccFQU.exe
  2⤵
  - Executes dropped EXE
  PID:5256
- C:\Windows\System32\WuCLiGd.exe
  C:\Windows\System32\WuCLiGd.exe
  2⤵
  - Executes dropped EXE
  PID:5276
- C:\Windows\System32\LpYbaXk.exe
  C:\Windows\System32\LpYbaXk.exe
  2⤵
  - Executes dropped EXE
  PID:5300
- C:\Windows\System32\tGyFSrB.exe
  C:\Windows\System32\tGyFSrB.exe
  2⤵
  - Executes dropped EXE
  PID:5328
- C:\Windows\System32\DHBTbPV.exe
  C:\Windows\System32\DHBTbPV.exe
  2⤵
  - Executes dropped EXE
  PID:5356
- C:\Windows\System32\CUesSon.exe
  C:\Windows\System32\CUesSon.exe
  2⤵
  - Executes dropped EXE
  PID:5396
- C:\Windows\System32\BMnvXBd.exe
  C:\Windows\System32\BMnvXBd.exe
  2⤵
  - Executes dropped EXE
  PID:5416
- C:\Windows\System32\EUiGSAj.exe
  C:\Windows\System32\EUiGSAj.exe
  2⤵
  - Executes dropped EXE
  PID:5440
- C:\Windows\System32\eqGcxwe.exe
  C:\Windows\System32\eqGcxwe.exe
  2⤵
  PID:5472
- C:\Windows\System32\CJyhdOL.exe
  C:\Windows\System32\CJyhdOL.exe
  2⤵
  PID:5496
- C:\Windows\System32\YOYjHvd.exe
  C:\Windows\System32\YOYjHvd.exe
  2⤵
  PID:5524
- C:\Windows\System32\QlfvDtj.exe
  C:\Windows\System32\QlfvDtj.exe
  2⤵
  PID:5548
- C:\Windows\System32\kzmMifU.exe
  C:\Windows\System32\kzmMifU.exe
  2⤵
  PID:5580
- C:\Windows\System32\QQrmJje.exe
  C:\Windows\System32\QQrmJje.exe
  2⤵
  PID:5608
- C:\Windows\System32\TBztjLd.exe
  C:\Windows\System32\TBztjLd.exe
  2⤵
  PID:5632
- C:\Windows\System32\VrTDnhJ.exe
  C:\Windows\System32\VrTDnhJ.exe
  2⤵
  PID:5668
- C:\Windows\System32\ChMUVgG.exe
  C:\Windows\System32\ChMUVgG.exe
  2⤵
  PID:5692
- C:\Windows\System32\afgMXih.exe
  C:\Windows\System32\afgMXih.exe
  2⤵
  PID:5720
- C:\Windows\System32\lSRLbGL.exe
  C:\Windows\System32\lSRLbGL.exe
  2⤵
  PID:5748
- C:\Windows\System32\sUQYcBi.exe
  C:\Windows\System32\sUQYcBi.exe
  2⤵
  PID:5780
- C:\Windows\System32\VnUbPss.exe
  C:\Windows\System32\VnUbPss.exe
  2⤵
  PID:5804
- C:\Windows\System32\eLshxWG.exe
  C:\Windows\System32\eLshxWG.exe
  2⤵
  PID:5844
- C:\Windows\System32\iETQGfz.exe
  C:\Windows\System32\iETQGfz.exe
  2⤵
  PID:5868
- C:\Windows\System32\JVWIxuF.exe
  C:\Windows\System32\JVWIxuF.exe
  2⤵
  PID:5892
- C:\Windows\System32\JfOjIhE.exe
  C:\Windows\System32\JfOjIhE.exe
  2⤵
  PID:5916
- C:\Windows\System32\ULMnTOV.exe
  C:\Windows\System32\ULMnTOV.exe
  2⤵
  PID:5948
- C:\Windows\System32\qxKVdHN.exe
  C:\Windows\System32\qxKVdHN.exe
  2⤵
  PID:5972
- C:\Windows\System32\SBrsUWl.exe
  C:\Windows\System32\SBrsUWl.exe
  2⤵
  PID:5996
- C:\Windows\System32\ntVMkGC.exe
  C:\Windows\System32\ntVMkGC.exe
  2⤵
  PID:6028
- C:\Windows\System32\hTcOOYU.exe
  C:\Windows\System32\hTcOOYU.exe
  2⤵
  PID:6056
- C:\Windows\System32\dBkkhQg.exe
  C:\Windows\System32\dBkkhQg.exe
  2⤵
  PID:6088
- C:\Windows\System32\HKIbcio.exe
  C:\Windows\System32\HKIbcio.exe
  2⤵
  PID:6112
- C:\Windows\System32\lJpLEkP.exe
  C:\Windows\System32\lJpLEkP.exe
  2⤵
  PID:6140
- C:\Windows\System32\hYtEPCa.exe
  C:\Windows\System32\hYtEPCa.exe
  2⤵
  PID:2416
- C:\Windows\System32\tAeMPMj.exe
  C:\Windows\System32\tAeMPMj.exe
  2⤵
  PID:468
- C:\Windows\System32\TAjUsor.exe
  C:\Windows\System32\TAjUsor.exe
  2⤵
  PID:3456
- C:\Windows\System32\WtcKueR.exe
  C:\Windows\System32\WtcKueR.exe
  2⤵
  PID:1868
- C:\Windows\System32\JlWjAJs.exe
  C:\Windows\System32\JlWjAJs.exe
  2⤵
  PID:5152
- C:\Windows\System32\jyOpPHD.exe
  C:\Windows\System32\jyOpPHD.exe
  2⤵
  PID:5244
- C:\Windows\System32\iHjtvXB.exe
  C:\Windows\System32\iHjtvXB.exe
  2⤵
  PID:5284
- C:\Windows\System32\ihiMGOd.exe
  C:\Windows\System32\ihiMGOd.exe
  2⤵
  PID:5296
- C:\Windows\System32\zVRoJQT.exe
  C:\Windows\System32\zVRoJQT.exe
  2⤵
  PID:5364
- C:\Windows\System32\WQuIJbf.exe
  C:\Windows\System32\WQuIJbf.exe
  2⤵
  PID:5424
- C:\Windows\System32\GZcRNlJ.exe
  C:\Windows\System32\GZcRNlJ.exe
  2⤵
  PID:5480
- C:\Windows\System32\DdKFWUr.exe
  C:\Windows\System32\DdKFWUr.exe
  2⤵
  PID:5544
- C:\Windows\System32\QaNSDrB.exe
  C:\Windows\System32\QaNSDrB.exe
  2⤵
  PID:5616
- C:\Windows\System32\srHHqjd.exe
  C:\Windows\System32\srHHqjd.exe
  2⤵
  PID:5676
- C:\Windows\System32\aNXLthF.exe
  C:\Windows\System32\aNXLthF.exe
  2⤵
  PID:5760
- C:\Windows\System32\CDcAWai.exe
  C:\Windows\System32\CDcAWai.exe
  2⤵
  PID:5796
- C:\Windows\System32\TTsRBKR.exe
  C:\Windows\System32\TTsRBKR.exe
  2⤵
  PID:5864
- C:\Windows\System32\flLKYqT.exe
  C:\Windows\System32\flLKYqT.exe
  2⤵
  PID:2692
- C:\Windows\System32\HZHayyY.exe
  C:\Windows\System32\HZHayyY.exe
  2⤵
  PID:4520
- C:\Windows\System32\UfiHRqL.exe
  C:\Windows\System32\UfiHRqL.exe
  2⤵
  PID:4616
- C:\Windows\System32\SxZTHDW.exe
  C:\Windows\System32\SxZTHDW.exe
  2⤵
  PID:5124
- C:\Windows\System32\RbOpLNV.exe
  C:\Windows\System32\RbOpLNV.exe
  2⤵
  PID:5208
- C:\Windows\System32\kCSSWVI.exe
  C:\Windows\System32\kCSSWVI.exe
  2⤵
  PID:4912
- C:\Windows\System32\OXQMkWD.exe
  C:\Windows\System32\OXQMkWD.exe
  2⤵
  PID:2632
- C:\Windows\System32\xGqMfRe.exe
  C:\Windows\System32\xGqMfRe.exe
  2⤵
  PID:5592
- C:\Windows\System32\oPUxARY.exe
  C:\Windows\System32\oPUxARY.exe
  2⤵
  PID:5656
- C:\Windows\System32\avbIjOT.exe
  C:\Windows\System32\avbIjOT.exe
  2⤵
  PID:5640
- C:\Windows\System32\qwQksiF.exe
  C:\Windows\System32\qwQksiF.exe
  2⤵
  PID:5712
- C:\Windows\System32\nqsDpnX.exe
  C:\Windows\System32\nqsDpnX.exe
  2⤵
  PID:5856
- C:\Windows\System32\nLbOFOg.exe
  C:\Windows\System32\nLbOFOg.exe
  2⤵
  PID:4008
- C:\Windows\System32\gXkTJwB.exe
  C:\Windows\System32\gXkTJwB.exe
  2⤵
  PID:5728
- C:\Windows\System32\pQeJnxR.exe
  C:\Windows\System32\pQeJnxR.exe
  2⤵
  PID:5908
- C:\Windows\System32\dbXvTUd.exe
  C:\Windows\System32\dbXvTUd.exe
  2⤵
  PID:2320
- C:\Windows\System32\uPuNRqu.exe
  C:\Windows\System32\uPuNRqu.exe
  2⤵
  PID:3708
- C:\Windows\System32\SqnAdFv.exe
  C:\Windows\System32\SqnAdFv.exe
  2⤵
  PID:3700
- C:\Windows\System32\NkyLLth.exe
  C:\Windows\System32\NkyLLth.exe
  2⤵
  PID:3628
- C:\Windows\System32\fyOYTsz.exe
  C:\Windows\System32\fyOYTsz.exe
  2⤵
  PID:4588
- C:\Windows\System32\bmfHQgN.exe
  C:\Windows\System32\bmfHQgN.exe
  2⤵
  PID:4852
- C:\Windows\System32\RYmKrvs.exe
  C:\Windows\System32\RYmKrvs.exe
  2⤵
  PID:4556
- C:\Windows\System32\lWAjsPU.exe
  C:\Windows\System32\lWAjsPU.exe
  2⤵
  PID:5388
- C:\Windows\System32\FgwfOki.exe
  C:\Windows\System32\FgwfOki.exe
  2⤵
  PID:1892
- C:\Windows\System32\cVAhrGn.exe
  C:\Windows\System32\cVAhrGn.exe
  2⤵
  PID:4248
- C:\Windows\System32\qQJHQUP.exe
  C:\Windows\System32\qQJHQUP.exe
  2⤵
  PID:6120
- C:\Windows\System32\HhNOGfX.exe
  C:\Windows\System32\HhNOGfX.exe
  2⤵
  PID:1912
- C:\Windows\System32\wCwNDSN.exe
  C:\Windows\System32\wCwNDSN.exe
  2⤵
  PID:1736
- C:\Windows\System32\XfMkWpP.exe
  C:\Windows\System32\XfMkWpP.exe
  2⤵
  PID:4600
- C:\Windows\System32\DbtkBza.exe
  C:\Windows\System32\DbtkBza.exe
  2⤵
  PID:3948
- C:\Windows\System32\HUbZhsy.exe
  C:\Windows\System32\HUbZhsy.exe
  2⤵
  PID:5628
- C:\Windows\System32\XHgTdaM.exe
  C:\Windows\System32\XHgTdaM.exe
  2⤵
  PID:3564
- C:\Windows\System32\STfVnpA.exe
  C:\Windows\System32\STfVnpA.exe
  2⤵
  PID:4460
- C:\Windows\System32\cXvCJNQ.exe
  C:\Windows\System32\cXvCJNQ.exe
  2⤵
  PID:6164
- C:\Windows\System32\kmoqvMZ.exe
  C:\Windows\System32\kmoqvMZ.exe
  2⤵
  PID:6192
- C:\Windows\System32\eDNIXca.exe
  C:\Windows\System32\eDNIXca.exe
  2⤵
  PID:6212
- C:\Windows\System32\ynHngke.exe
  C:\Windows\System32\ynHngke.exe
  2⤵
  PID:6244
- C:\Windows\System32\SqntIfD.exe
  C:\Windows\System32\SqntIfD.exe
  2⤵
  PID:6268
- C:\Windows\System32\oznPBoP.exe
  C:\Windows\System32\oznPBoP.exe
  2⤵
  PID:6304
- C:\Windows\System32\Hmnqigj.exe
  C:\Windows\System32\Hmnqigj.exe
  2⤵
  PID:6324
- C:\Windows\System32\qOtDQXw.exe
  C:\Windows\System32\qOtDQXw.exe
  2⤵
  PID:6340
- C:\Windows\System32\ftSiqaU.exe
  C:\Windows\System32\ftSiqaU.exe
  2⤵
  PID:6356
- C:\Windows\System32\EGYRtaT.exe
  C:\Windows\System32\EGYRtaT.exe
  2⤵
  PID:6388
- C:\Windows\System32\ddrFXSQ.exe
  C:\Windows\System32\ddrFXSQ.exe
  2⤵
  PID:6404
- C:\Windows\System32\GUkcEXZ.exe
  C:\Windows\System32\GUkcEXZ.exe
  2⤵
  PID:6452
- C:\Windows\System32\XuvcWNx.exe
  C:\Windows\System32\XuvcWNx.exe
  2⤵
  PID:6488
- C:\Windows\System32\ssANHRS.exe
  C:\Windows\System32\ssANHRS.exe
  2⤵
  PID:6528
- C:\Windows\System32\mEYFDcp.exe
  C:\Windows\System32\mEYFDcp.exe
  2⤵
  PID:6564
- C:\Windows\System32\auajFEk.exe
  C:\Windows\System32\auajFEk.exe
  2⤵
  PID:6612
- C:\Windows\System32\YYFgZBr.exe
  C:\Windows\System32\YYFgZBr.exe
  2⤵
  PID:6628
- C:\Windows\System32\XbZOvuZ.exe
  C:\Windows\System32\XbZOvuZ.exe
  2⤵
  PID:6652
- C:\Windows\System32\HYaoytm.exe
  C:\Windows\System32\HYaoytm.exe
  2⤵
  PID:6692
- C:\Windows\System32\fclMArq.exe
  C:\Windows\System32\fclMArq.exe
  2⤵
  PID:6724
- C:\Windows\System32\EzgaCSZ.exe
  C:\Windows\System32\EzgaCSZ.exe
  2⤵
  PID:6740
- C:\Windows\System32\ficCYns.exe
  C:\Windows\System32\ficCYns.exe
  2⤵
  PID:6756
- C:\Windows\System32\OpDKLEb.exe
  C:\Windows\System32\OpDKLEb.exe
  2⤵
  PID:6804
- C:\Windows\System32\RYivurC.exe
  C:\Windows\System32\RYivurC.exe
  2⤵
  PID:6828
- C:\Windows\System32\KNVTZVB.exe
  C:\Windows\System32\KNVTZVB.exe
  2⤵
  PID:6844
- C:\Windows\System32\DXzBOhh.exe
  C:\Windows\System32\DXzBOhh.exe
  2⤵
  PID:6872
- C:\Windows\System32\apRIJzQ.exe
  C:\Windows\System32\apRIJzQ.exe
  2⤵
  PID:6916
- C:\Windows\System32\dodTzsx.exe
  C:\Windows\System32\dodTzsx.exe
  2⤵
  PID:6932
- C:\Windows\System32\jXcXzyL.exe
  C:\Windows\System32\jXcXzyL.exe
  2⤵
  PID:6960
- C:\Windows\System32\MpFdTCI.exe
  C:\Windows\System32\MpFdTCI.exe
  2⤵
  PID:6976
- C:\Windows\System32\ZSmiKCq.exe
  C:\Windows\System32\ZSmiKCq.exe
  2⤵
  PID:7020
- C:\Windows\System32\hOySiRG.exe
  C:\Windows\System32\hOySiRG.exe
  2⤵
  PID:7040
- C:\Windows\System32\fmrptiz.exe
  C:\Windows\System32\fmrptiz.exe
  2⤵
  PID:7060
- C:\Windows\System32\mMOJNod.exe
  C:\Windows\System32\mMOJNod.exe
  2⤵
  PID:7080
- C:\Windows\System32\XPLiHRE.exe
  C:\Windows\System32\XPLiHRE.exe
  2⤵
  PID:7096
- C:\Windows\System32\UitKRjc.exe
  C:\Windows\System32\UitKRjc.exe
  2⤵
  PID:7120
- C:\Windows\System32\qmBlrJd.exe
  C:\Windows\System32\qmBlrJd.exe
  2⤵
  PID:7140
- C:\Windows\System32\IrgvdqG.exe
  C:\Windows\System32\IrgvdqG.exe
  2⤵
  PID:7160
- C:\Windows\System32\vSGrKpd.exe
  C:\Windows\System32\vSGrKpd.exe
  2⤵
  PID:6176
- C:\Windows\System32\QNnjnrg.exe
  C:\Windows\System32\QNnjnrg.exe
  2⤵
  PID:6220
- C:\Windows\System32\FAdZJLa.exe
  C:\Windows\System32\FAdZJLa.exe
  2⤵
  PID:6264
- C:\Windows\System32\sQJvXeJ.exe
  C:\Windows\System32\sQJvXeJ.exe
  2⤵
  PID:6352
- C:\Windows\System32\drCFKez.exe
  C:\Windows\System32\drCFKez.exe
  2⤵
  PID:6312
- C:\Windows\System32\NQYTZcv.exe
  C:\Windows\System32\NQYTZcv.exe
  2⤵
  PID:6512
- C:\Windows\System32\YEClEJH.exe
  C:\Windows\System32\YEClEJH.exe
  2⤵
  PID:6668
- C:\Windows\System32\AlmMgtu.exe
  C:\Windows\System32\AlmMgtu.exe
  2⤵
  PID:6736
- C:\Windows\System32\nnYOqKH.exe
  C:\Windows\System32\nnYOqKH.exe
  2⤵
  PID:6784
- C:\Windows\System32\cUkmyGC.exe
  C:\Windows\System32\cUkmyGC.exe
  2⤵
  PID:6856
- C:\Windows\System32\zkmwEtk.exe
  C:\Windows\System32\zkmwEtk.exe
  2⤵
  PID:6880
- C:\Windows\System32\aMjWgjG.exe
  C:\Windows\System32\aMjWgjG.exe
  2⤵
  PID:4612
- C:\Windows\System32\hsXBLLr.exe
  C:\Windows\System32\hsXBLLr.exe
  2⤵
  PID:6972
- C:\Windows\System32\iMVUpqM.exe
  C:\Windows\System32\iMVUpqM.exe
  2⤵
  PID:7092
- C:\Windows\System32\grNVNHQ.exe
  C:\Windows\System32\grNVNHQ.exe
  2⤵
  PID:7128
- C:\Windows\System32\BYVYVRX.exe
  C:\Windows\System32\BYVYVRX.exe
  2⤵
  PID:6156
- C:\Windows\System32\UuHksKT.exe
  C:\Windows\System32\UuHksKT.exe
  2⤵
  PID:6420
- C:\Windows\System32\XSYcxtX.exe
  C:\Windows\System32\XSYcxtX.exe
  2⤵
  PID:6764
- C:\Windows\System32\Kgxgshj.exe
  C:\Windows\System32\Kgxgshj.exe
  2⤵
  PID:6820
- C:\Windows\System32\JWQuAsk.exe
  C:\Windows\System32\JWQuAsk.exe
  2⤵
  PID:6840
- C:\Windows\System32\hRzGYEn.exe
  C:\Windows\System32\hRzGYEn.exe
  2⤵
  PID:7056
- C:\Windows\System32\MqDVMpq.exe
  C:\Windows\System32\MqDVMpq.exe
  2⤵
  PID:7108
- C:\Windows\System32\sTChTWN.exe
  C:\Windows\System32\sTChTWN.exe
  2⤵
  PID:6640
- C:\Windows\System32\twlDMzH.exe
  C:\Windows\System32\twlDMzH.exe
  2⤵
  PID:6440
- C:\Windows\System32\nVtCADA.exe
  C:\Windows\System32\nVtCADA.exe
  2⤵
  PID:6188
- C:\Windows\System32\VChqNYO.exe
  C:\Windows\System32\VChqNYO.exe
  2⤵
  PID:7176
- C:\Windows\System32\QSDKaEi.exe
  C:\Windows\System32\QSDKaEi.exe
  2⤵
  PID:7216
- C:\Windows\System32\pYEhksA.exe
  C:\Windows\System32\pYEhksA.exe
  2⤵
  PID:7232
- C:\Windows\System32\wfwVBiW.exe
  C:\Windows\System32\wfwVBiW.exe
  2⤵
  PID:7256
- C:\Windows\System32\bSOSNnd.exe
  C:\Windows\System32\bSOSNnd.exe
  2⤵
  PID:7284
- C:\Windows\System32\xZZGsIH.exe
  C:\Windows\System32\xZZGsIH.exe
  2⤵
  PID:7300
- C:\Windows\System32\dDOoxNb.exe
  C:\Windows\System32\dDOoxNb.exe
  2⤵
  PID:7324
- C:\Windows\System32\UTHVJnI.exe
  C:\Windows\System32\UTHVJnI.exe
  2⤵
  PID:7392
- C:\Windows\System32\yVwUZQN.exe
  C:\Windows\System32\yVwUZQN.exe
  2⤵
  PID:7440
- C:\Windows\System32\UOntTFr.exe
  C:\Windows\System32\UOntTFr.exe
  2⤵
  PID:7456
- C:\Windows\System32\vxDejqT.exe
  C:\Windows\System32\vxDejqT.exe
  2⤵
  PID:7476
- C:\Windows\System32\XjVDvzY.exe
  C:\Windows\System32\XjVDvzY.exe
  2⤵
  PID:7492
- C:\Windows\System32\EfTjlcx.exe
  C:\Windows\System32\EfTjlcx.exe
  2⤵
  PID:7524
- C:\Windows\System32\PJWidwr.exe
  C:\Windows\System32\PJWidwr.exe
  2⤵
  PID:7548
- C:\Windows\System32\zQlJKAN.exe
  C:\Windows\System32\zQlJKAN.exe
  2⤵
  PID:7568
- C:\Windows\System32\xbzGkaq.exe
  C:\Windows\System32\xbzGkaq.exe
  2⤵
  PID:7584
- C:\Windows\System32\NOOmhAH.exe
  C:\Windows\System32\NOOmhAH.exe
  2⤵
  PID:7616
- C:\Windows\System32\uHlJWpj.exe
  C:\Windows\System32\uHlJWpj.exe
  2⤵
  PID:7648
- C:\Windows\System32\UZeVZGY.exe
  C:\Windows\System32\UZeVZGY.exe
  2⤵
  PID:7668
- C:\Windows\System32\qxNOQyI.exe
  C:\Windows\System32\qxNOQyI.exe
  2⤵
  PID:7736
- C:\Windows\System32\YPeAfyi.exe
  C:\Windows\System32\YPeAfyi.exe
  2⤵
  PID:7752
- C:\Windows\System32\tZxvLPE.exe
  C:\Windows\System32\tZxvLPE.exe
  2⤵
  PID:7776
- C:\Windows\System32\OYnmlOn.exe
  C:\Windows\System32\OYnmlOn.exe
  2⤵
  PID:7800
- C:\Windows\System32\QkKTeYd.exe
  C:\Windows\System32\QkKTeYd.exe
  2⤵
  PID:7820
- C:\Windows\System32\ADexMBP.exe
  C:\Windows\System32\ADexMBP.exe
  2⤵
  PID:7872
- C:\Windows\System32\EJMnpsN.exe
  C:\Windows\System32\EJMnpsN.exe
  2⤵
  PID:7888
- C:\Windows\System32\XWxDSqV.exe
  C:\Windows\System32\XWxDSqV.exe
  2⤵
  PID:7928
- C:\Windows\System32\KobHCSj.exe
  C:\Windows\System32\KobHCSj.exe
  2⤵
  PID:7956
- C:\Windows\System32\GiVtWse.exe
  C:\Windows\System32\GiVtWse.exe
  2⤵
  PID:7984
- C:\Windows\System32\AfKwtLH.exe
  C:\Windows\System32\AfKwtLH.exe
  2⤵
  PID:8024
- C:\Windows\System32\TmTAbTP.exe
  C:\Windows\System32\TmTAbTP.exe
  2⤵
  PID:8060
- C:\Windows\System32\LwNzLwd.exe
  C:\Windows\System32\LwNzLwd.exe
  2⤵
  PID:8076
- C:\Windows\System32\KhGFiBk.exe
  C:\Windows\System32\KhGFiBk.exe
  2⤵
  PID:8104
- C:\Windows\System32\sYgNIJX.exe
  C:\Windows\System32\sYgNIJX.exe
  2⤵
  PID:8124
- C:\Windows\System32\viOQqHt.exe
  C:\Windows\System32\viOQqHt.exe
  2⤵
  PID:8152
- C:\Windows\System32\qOjYGeC.exe
  C:\Windows\System32\qOjYGeC.exe
  2⤵
  PID:8168
- C:\Windows\System32\DCqAFPj.exe
  C:\Windows\System32\DCqAFPj.exe
  2⤵
  PID:8184
- C:\Windows\System32\HppYuvg.exe
  C:\Windows\System32\HppYuvg.exe
  2⤵
  PID:7184
- C:\Windows\System32\XwvXdpe.exe
  C:\Windows\System32\XwvXdpe.exe
  2⤵
  PID:7208
- C:\Windows\System32\ItmJXhz.exe
  C:\Windows\System32\ItmJXhz.exe
  2⤵
  PID:7252
- C:\Windows\System32\QmiEkvT.exe
  C:\Windows\System32\QmiEkvT.exe
  2⤵
  PID:7332
- C:\Windows\System32\hpkfVDl.exe
  C:\Windows\System32\hpkfVDl.exe
  2⤵
  PID:7532
- C:\Windows\System32\xefawqA.exe
  C:\Windows\System32\xefawqA.exe
  2⤵
  PID:7604
- C:\Windows\System32\hyvlVZf.exe
  C:\Windows\System32\hyvlVZf.exe
  2⤵
  PID:7656
- C:\Windows\System32\QVcuIgV.exe
  C:\Windows\System32\QVcuIgV.exe
  2⤵
  PID:7728
- C:\Windows\System32\LtZWEuO.exe
  C:\Windows\System32\LtZWEuO.exe
  2⤵
  PID:7760
- C:\Windows\System32\UDEQwQb.exe
  C:\Windows\System32\UDEQwQb.exe
  2⤵
  PID:6712
- C:\Windows\System32\gVZsFAD.exe
  C:\Windows\System32\gVZsFAD.exe
  2⤵
  PID:7848
- C:\Windows\System32\lopjkLo.exe
  C:\Windows\System32\lopjkLo.exe
  2⤵
  PID:7900
- C:\Windows\System32\RWXGaNS.exe
  C:\Windows\System32\RWXGaNS.exe
  2⤵
  PID:7968
- C:\Windows\System32\KiIavqe.exe
  C:\Windows\System32\KiIavqe.exe
  2⤵
  PID:8000
- C:\Windows\System32\tbvcBgP.exe
  C:\Windows\System32\tbvcBgP.exe
  2⤵
  PID:8032
- C:\Windows\System32\KDsbIic.exe
  C:\Windows\System32\KDsbIic.exe
  2⤵
  PID:8116
- C:\Windows\System32\jcNYEYu.exe
  C:\Windows\System32\jcNYEYu.exe
  2⤵
  PID:8140
- C:\Windows\System32\vyAHqJW.exe
  C:\Windows\System32\vyAHqJW.exe
  2⤵
  PID:7312
- C:\Windows\System32\Keymsph.exe
  C:\Windows\System32\Keymsph.exe
  2⤵
  PID:7508
- C:\Windows\System32\ZusmbcJ.exe
  C:\Windows\System32\ZusmbcJ.exe
  2⤵
  PID:7768
- C:\Windows\System32\OUIevRP.exe
  C:\Windows\System32\OUIevRP.exe
  2⤵
  PID:7976
- C:\Windows\System32\GZYHzqb.exe
  C:\Windows\System32\GZYHzqb.exe
  2⤵
  PID:8040
- C:\Windows\System32\bBcsFEu.exe
  C:\Windows\System32\bBcsFEu.exe
  2⤵
  PID:8016
- C:\Windows\System32\niYjRpt.exe
  C:\Windows\System32\niYjRpt.exe
  2⤵
  PID:7628
- C:\Windows\System32\bBcpGRq.exe
  C:\Windows\System32\bBcpGRq.exe
  2⤵
  PID:7908
- C:\Windows\System32\NAlSFwZ.exe
  C:\Windows\System32\NAlSFwZ.exe
  2⤵
  PID:8164
- C:\Windows\System32\yyWlwtq.exe
  C:\Windows\System32\yyWlwtq.exe
  2⤵
  PID:7712
- C:\Windows\System32\UgfjnwX.exe
  C:\Windows\System32\UgfjnwX.exe
  2⤵
  PID:8204
- C:\Windows\System32\urKTCOr.exe
  C:\Windows\System32\urKTCOr.exe
  2⤵
  PID:8236
- C:\Windows\System32\CIMLFhx.exe
  C:\Windows\System32\CIMLFhx.exe
  2⤵
  PID:8256
- C:\Windows\System32\fItvhdT.exe
  C:\Windows\System32\fItvhdT.exe
  2⤵
  PID:8280
- C:\Windows\System32\RemUdFM.exe
  C:\Windows\System32\RemUdFM.exe
  2⤵
  PID:8296
- C:\Windows\System32\MTiHVKp.exe
  C:\Windows\System32\MTiHVKp.exe
  2⤵
  PID:8320
- C:\Windows\System32\nMfzAJb.exe
  C:\Windows\System32\nMfzAJb.exe
  2⤵
  PID:8344
- C:\Windows\System32\snKrOuG.exe
  C:\Windows\System32\snKrOuG.exe
  2⤵
  PID:8364
- C:\Windows\System32\dDflGuN.exe
  C:\Windows\System32\dDflGuN.exe
  2⤵
  PID:8384
- C:\Windows\System32\nQxPXuq.exe
  C:\Windows\System32\nQxPXuq.exe
  2⤵
  PID:8448
- C:\Windows\System32\CvfziHw.exe
  C:\Windows\System32\CvfziHw.exe
  2⤵
  PID:8488
- C:\Windows\System32\FZJpTHE.exe
  C:\Windows\System32\FZJpTHE.exe
  2⤵
  PID:8516
- C:\Windows\System32\kHcKuYK.exe
  C:\Windows\System32\kHcKuYK.exe
  2⤵
  PID:8536
- C:\Windows\System32\ObJXabE.exe
  C:\Windows\System32\ObJXabE.exe
  2⤵
  PID:8552
- C:\Windows\System32\ooYifyY.exe
  C:\Windows\System32\ooYifyY.exe
  2⤵
  PID:8580
- C:\Windows\System32\kNyCmZF.exe
  C:\Windows\System32\kNyCmZF.exe
  2⤵
  PID:8596
- C:\Windows\System32\QtipJxd.exe
  C:\Windows\System32\QtipJxd.exe
  2⤵
  PID:8620
- C:\Windows\System32\xckLiQb.exe
  C:\Windows\System32\xckLiQb.exe
  2⤵
  PID:8640
- C:\Windows\System32\jcXUQMt.exe
  C:\Windows\System32\jcXUQMt.exe
  2⤵
  PID:8684
- C:\Windows\System32\yKJBgTG.exe
  C:\Windows\System32\yKJBgTG.exe
  2⤵
  PID:8748
- C:\Windows\System32\DCFuaMi.exe
  C:\Windows\System32\DCFuaMi.exe
  2⤵
  PID:8772
- C:\Windows\System32\eVfAQgp.exe
  C:\Windows\System32\eVfAQgp.exe
  2⤵
  PID:8792
- C:\Windows\System32\TudLxwV.exe
  C:\Windows\System32\TudLxwV.exe
  2⤵
  PID:8816
- C:\Windows\System32\VqJkWZF.exe
  C:\Windows\System32\VqJkWZF.exe
  2⤵
  PID:8852
- C:\Windows\System32\NourjPl.exe
  C:\Windows\System32\NourjPl.exe
  2⤵
  PID:8868
- C:\Windows\System32\XmRtgxx.exe
  C:\Windows\System32\XmRtgxx.exe
  2⤵
  PID:8904
- C:\Windows\System32\KdSyrUT.exe
  C:\Windows\System32\KdSyrUT.exe
  2⤵
  PID:8944
- C:\Windows\System32\CsbFWYa.exe
  C:\Windows\System32\CsbFWYa.exe
  2⤵
  PID:8968
- C:\Windows\System32\pooAlnv.exe
  C:\Windows\System32\pooAlnv.exe
  2⤵
  PID:8984
- C:\Windows\System32\LvIHVQa.exe
  C:\Windows\System32\LvIHVQa.exe
  2⤵
  PID:9004
- C:\Windows\System32\DpgxGQf.exe
  C:\Windows\System32\DpgxGQf.exe
  2⤵
  PID:9028
- C:\Windows\System32\TgwPFqT.exe
  C:\Windows\System32\TgwPFqT.exe
  2⤵
  PID:9064
- C:\Windows\System32\LuynLdk.exe
  C:\Windows\System32\LuynLdk.exe
  2⤵
  PID:9088
- C:\Windows\System32\KXUbhmD.exe
  C:\Windows\System32\KXUbhmD.exe
  2⤵
  PID:9104
- C:\Windows\System32\jYeClCn.exe
  C:\Windows\System32\jYeClCn.exe
  2⤵
  PID:9128
- C:\Windows\System32\JptzMBY.exe
  C:\Windows\System32\JptzMBY.exe
  2⤵
  PID:9156
- C:\Windows\System32\AmiVtPW.exe
  C:\Windows\System32\AmiVtPW.exe
  2⤵
  PID:9188
- C:\Windows\System32\zypnGxG.exe
  C:\Windows\System32\zypnGxG.exe
  2⤵
  PID:8252
- C:\Windows\System32\vNXVArC.exe
  C:\Windows\System32\vNXVArC.exe
  2⤵
  PID:8288
- C:\Windows\System32\cKtvUHi.exe
  C:\Windows\System32\cKtvUHi.exe
  2⤵
  PID:8372
- C:\Windows\System32\CJmxHbr.exe
  C:\Windows\System32\CJmxHbr.exe
  2⤵
  PID:8424
- C:\Windows\System32\mLOHVKw.exe
  C:\Windows\System32\mLOHVKw.exe
  2⤵
  PID:8416
- C:\Windows\System32\OHskODR.exe
  C:\Windows\System32\OHskODR.exe
  2⤵
  PID:8564
- C:\Windows\System32\ytKbUaf.exe
  C:\Windows\System32\ytKbUaf.exe
  2⤵
  PID:8632
- C:\Windows\System32\UoKbXMA.exe
  C:\Windows\System32\UoKbXMA.exe
  2⤵
  PID:8656
- C:\Windows\System32\SIQXFoI.exe
  C:\Windows\System32\SIQXFoI.exe
  2⤵
  PID:8768
- C:\Windows\System32\iWhebpw.exe
  C:\Windows\System32\iWhebpw.exe
  2⤵
  PID:8824
- C:\Windows\System32\AiirSHF.exe
  C:\Windows\System32\AiirSHF.exe
  2⤵
  PID:8940
- C:\Windows\System32\JGPbzod.exe
  C:\Windows\System32\JGPbzod.exe
  2⤵
  PID:8980
- C:\Windows\System32\xlLBseE.exe
  C:\Windows\System32\xlLBseE.exe
  2⤵
  PID:9056
- C:\Windows\System32\xnJRXSc.exe
  C:\Windows\System32\xnJRXSc.exe
  2⤵
  PID:9080
- C:\Windows\System32\eKotnow.exe
  C:\Windows\System32\eKotnow.exe
  2⤵
  PID:9152
- C:\Windows\System32\DHecvRI.exe
  C:\Windows\System32\DHecvRI.exe
  2⤵
  PID:9200
- C:\Windows\System32\NIsjklO.exe
  C:\Windows\System32\NIsjklO.exe
  2⤵
  PID:8328
- C:\Windows\System32\dEMXuRN.exe
  C:\Windows\System32\dEMXuRN.exe
  2⤵
  PID:8456
- C:\Windows\System32\ThsTtJX.exe
  C:\Windows\System32\ThsTtJX.exe
  2⤵
  PID:8744
- C:\Windows\System32\jRosqcp.exe
  C:\Windows\System32\jRosqcp.exe
  2⤵
  PID:8884
- C:\Windows\System32\fFQPmYr.exe
  C:\Windows\System32\fFQPmYr.exe
  2⤵
  PID:8848
- C:\Windows\System32\aSnXHlQ.exe
  C:\Windows\System32\aSnXHlQ.exe
  2⤵
  PID:9096
- C:\Windows\System32\WRjkEbh.exe
  C:\Windows\System32\WRjkEbh.exe
  2⤵
  PID:9204
- C:\Windows\System32\OuQntag.exe
  C:\Windows\System32\OuQntag.exe
  2⤵
  PID:8504
- C:\Windows\System32\qlWALhd.exe
  C:\Windows\System32\qlWALhd.exe
  2⤵
  PID:8780
- C:\Windows\System32\xNCvSfW.exe
  C:\Windows\System32\xNCvSfW.exe
  2⤵
  PID:7404
- C:\Windows\System32\AJjvBPT.exe
  C:\Windows\System32\AJjvBPT.exe
  2⤵
  PID:9320
- C:\Windows\System32\qJdjuoS.exe
  C:\Windows\System32\qJdjuoS.exe
  2⤵
  PID:9368
- C:\Windows\System32\RsfqhDJ.exe
  C:\Windows\System32\RsfqhDJ.exe
  2⤵
  PID:9384
- C:\Windows\System32\SPANUfI.exe
  C:\Windows\System32\SPANUfI.exe
  2⤵
  PID:9400
- C:\Windows\System32\vhcfpwr.exe
  C:\Windows\System32\vhcfpwr.exe
  2⤵
  PID:9416
- C:\Windows\System32\QXZHxRz.exe
  C:\Windows\System32\QXZHxRz.exe
  2⤵
  PID:9432
- C:\Windows\System32\tEMHscK.exe
  C:\Windows\System32\tEMHscK.exe
  2⤵
  PID:9448
- C:\Windows\System32\xuOAzMT.exe
  C:\Windows\System32\xuOAzMT.exe
  2⤵
  PID:9468
- C:\Windows\System32\whypYNf.exe
  C:\Windows\System32\whypYNf.exe
  2⤵
  PID:9484
- C:\Windows\System32\LfeGJsK.exe
  C:\Windows\System32\LfeGJsK.exe
  2⤵
  PID:9520
- C:\Windows\System32\HSyJGLN.exe
  C:\Windows\System32\HSyJGLN.exe
  2⤵
  PID:9552
- C:\Windows\System32\InOzOws.exe
  C:\Windows\System32\InOzOws.exe
  2⤵
  PID:9580
- C:\Windows\System32\cwGWxaE.exe
  C:\Windows\System32\cwGWxaE.exe
  2⤵
  PID:9600
- C:\Windows\System32\Irvsezn.exe
  C:\Windows\System32\Irvsezn.exe
  2⤵
  PID:9684
- C:\Windows\System32\XDYPUIj.exe
  C:\Windows\System32\XDYPUIj.exe
  2⤵
  PID:9704
- C:\Windows\System32\GNmYomX.exe
  C:\Windows\System32\GNmYomX.exe
  2⤵
  PID:9728
- C:\Windows\System32\WxdeFcy.exe
  C:\Windows\System32\WxdeFcy.exe
  2⤵
  PID:9744
- C:\Windows\System32\BSKrPTo.exe
  C:\Windows\System32\BSKrPTo.exe
  2⤵
  PID:9772
- C:\Windows\System32\xBwsQNX.exe
  C:\Windows\System32\xBwsQNX.exe
  2⤵
  PID:9824
- C:\Windows\System32\yrNHkqf.exe
  C:\Windows\System32\yrNHkqf.exe
  2⤵
  PID:9868
- C:\Windows\System32\IDEnAOk.exe
  C:\Windows\System32\IDEnAOk.exe
  2⤵
  PID:9928
- C:\Windows\System32\mOOZdMG.exe
  C:\Windows\System32\mOOZdMG.exe
  2⤵
  PID:9960
- C:\Windows\System32\BBRQDFQ.exe
  C:\Windows\System32\BBRQDFQ.exe
  2⤵
  PID:9984
- C:\Windows\System32\wxpGwco.exe
  C:\Windows\System32\wxpGwco.exe
  2⤵
  PID:10004
- C:\Windows\System32\GikZPbD.exe
  C:\Windows\System32\GikZPbD.exe
  2⤵
  PID:10024
- C:\Windows\System32\qAPgXJj.exe
  C:\Windows\System32\qAPgXJj.exe
  2⤵
  PID:10044
- C:\Windows\System32\zrxYGNx.exe
  C:\Windows\System32\zrxYGNx.exe
  2⤵
  PID:10092
- C:\Windows\System32\LKEoOzD.exe
  C:\Windows\System32\LKEoOzD.exe
  2⤵
  PID:10120
- C:\Windows\System32\gghrNgN.exe
  C:\Windows\System32\gghrNgN.exe
  2⤵
  PID:10148
- C:\Windows\System32\FiYJjso.exe
  C:\Windows\System32\FiYJjso.exe
  2⤵
  PID:10164
- C:\Windows\System32\qISjuDW.exe
  C:\Windows\System32\qISjuDW.exe
  2⤵
  PID:10188
- C:\Windows\System32\Moznxbu.exe
  C:\Windows\System32\Moznxbu.exe
  2⤵
  PID:10224
- C:\Windows\System32\rjPTNQX.exe
  C:\Windows\System32\rjPTNQX.exe
  2⤵
  PID:9220
- C:\Windows\System32\GOmdJqC.exe
  C:\Windows\System32\GOmdJqC.exe
  2⤵
  PID:9312
- C:\Windows\System32\ymmvuWz.exe
  C:\Windows\System32\ymmvuWz.exe
  2⤵
  PID:8800
- C:\Windows\System32\fsyEkiA.exe
  C:\Windows\System32\fsyEkiA.exe
  2⤵
  PID:9296
- C:\Windows\System32\WFaYFyn.exe
  C:\Windows\System32\WFaYFyn.exe
  2⤵
  PID:9380
- C:\Windows\System32\yXPnkAF.exe
  C:\Windows\System32\yXPnkAF.exe
  2⤵
  PID:9412
- C:\Windows\System32\uOsBHgl.exe
  C:\Windows\System32\uOsBHgl.exe
  2⤵
  PID:9460
- C:\Windows\System32\RTJVWbi.exe
  C:\Windows\System32\RTJVWbi.exe
  2⤵
  PID:9536
- C:\Windows\System32\cupRTRc.exe
  C:\Windows\System32\cupRTRc.exe
  2⤵
  PID:9456
- C:\Windows\System32\kClhGbq.exe
  C:\Windows\System32\kClhGbq.exe
  2⤵
  PID:9376
- C:\Windows\System32\MyqxXkU.exe
  C:\Windows\System32\MyqxXkU.exe
  2⤵
  PID:9612
- C:\Windows\System32\uPGCcdn.exe
  C:\Windows\System32\uPGCcdn.exe
  2⤵
  PID:9632
- C:\Windows\System32\IQeiayb.exe
  C:\Windows\System32\IQeiayb.exe
  2⤵
  PID:9768
- C:\Windows\System32\FCeVoSD.exe
  C:\Windows\System32\FCeVoSD.exe
  2⤵
  PID:9916
- C:\Windows\System32\zNjHrmA.exe
  C:\Windows\System32\zNjHrmA.exe
  2⤵
  PID:9992
- C:\Windows\System32\YVHlaRO.exe
  C:\Windows\System32\YVHlaRO.exe
  2⤵
  PID:10012
- C:\Windows\System32\YZPUQnh.exe
  C:\Windows\System32\YZPUQnh.exe
  2⤵
  PID:10100
- C:\Windows\System32\EGWIDig.exe
  C:\Windows\System32\EGWIDig.exe
  2⤵
  PID:10160
- C:\Windows\System32\usUiMnS.exe
  C:\Windows\System32\usUiMnS.exe
  2⤵
  PID:10172
- C:\Windows\System32\zTePDOs.exe
  C:\Windows\System32\zTePDOs.exe
  2⤵
  PID:9240
- C:\Windows\System32\UCYLgqQ.exe
  C:\Windows\System32\UCYLgqQ.exe
  2⤵
  PID:9316
- C:\Windows\System32\ZfeqEml.exe
  C:\Windows\System32\ZfeqEml.exe
  2⤵
  PID:9508
- C:\Windows\System32\eTopFXY.exe
  C:\Windows\System32\eTopFXY.exe
  2⤵
  PID:9532
- C:\Windows\System32\drbdJiI.exe
  C:\Windows\System32\drbdJiI.exe
  2⤵
  PID:9724
- C:\Windows\System32\rSzLCBq.exe
  C:\Windows\System32\rSzLCBq.exe
  2⤵
  PID:9784
- C:\Windows\System32\DOJxrNP.exe
  C:\Windows\System32\DOJxrNP.exe
  2⤵
  PID:9976
- C:\Windows\System32\CHvtjxX.exe
  C:\Windows\System32\CHvtjxX.exe
  2⤵
  PID:10040
- C:\Windows\System32\xHPnAgQ.exe
  C:\Windows\System32\xHPnAgQ.exe
  2⤵
  PID:10144
- C:\Windows\System32\CGVmfIU.exe
  C:\Windows\System32\CGVmfIU.exe
  2⤵
  PID:9236
- C:\Windows\System32\eLRBlTn.exe
  C:\Windows\System32\eLRBlTn.exe
  2⤵
  PID:9444
- C:\Windows\System32\JgIYgiD.exe
  C:\Windows\System32\JgIYgiD.exe
  2⤵
  PID:9716
- C:\Windows\System32\bnSmmub.exe
  C:\Windows\System32\bnSmmub.exe
  2⤵
  PID:10112
- C:\Windows\System32\lnpEvey.exe
  C:\Windows\System32\lnpEvey.exe
  2⤵
  PID:10196
- C:\Windows\System32\npPfTps.exe
  C:\Windows\System32\npPfTps.exe
  2⤵
  PID:10256
- C:\Windows\System32\JVCPjqb.exe
  C:\Windows\System32\JVCPjqb.exe
  2⤵
  PID:10280
- C:\Windows\System32\JMQWsNK.exe
  C:\Windows\System32\JMQWsNK.exe
  2⤵
  PID:10300
- C:\Windows\System32\gDmlEdT.exe
  C:\Windows\System32\gDmlEdT.exe
  2⤵
  PID:10348
- C:\Windows\System32\NQxkjQm.exe
  C:\Windows\System32\NQxkjQm.exe
  2⤵
  PID:10408
- C:\Windows\System32\izyjvPg.exe
  C:\Windows\System32\izyjvPg.exe
  2⤵
  PID:10452
- C:\Windows\System32\xkwGZGb.exe
  C:\Windows\System32\xkwGZGb.exe
  2⤵
  PID:10472
- C:\Windows\System32\nbKejxh.exe
  C:\Windows\System32\nbKejxh.exe
  2⤵
  PID:10500
- C:\Windows\System32\QeuepDK.exe
  C:\Windows\System32\QeuepDK.exe
  2⤵
  PID:10516
- C:\Windows\System32\cxlGohI.exe
  C:\Windows\System32\cxlGohI.exe
  2⤵
  PID:10540
- C:\Windows\System32\mGKiMvm.exe
  C:\Windows\System32\mGKiMvm.exe
  2⤵
  PID:10556
- C:\Windows\System32\tQyQObo.exe
  C:\Windows\System32\tQyQObo.exe
  2⤵
  PID:10576
- C:\Windows\System32\iswXBoc.exe
  C:\Windows\System32\iswXBoc.exe
  2⤵
  PID:10628
- C:\Windows\System32\QmHnPcM.exe
  C:\Windows\System32\QmHnPcM.exe
  2⤵
  PID:10672
- C:\Windows\System32\hvdoEhD.exe
  C:\Windows\System32\hvdoEhD.exe
  2⤵
  PID:10696
- C:\Windows\System32\WYUaGMd.exe
  C:\Windows\System32\WYUaGMd.exe
  2⤵
  PID:10724
- C:\Windows\System32\SqWpRJy.exe
  C:\Windows\System32\SqWpRJy.exe
  2⤵
  PID:10744
- C:\Windows\System32\SqzhehH.exe
  C:\Windows\System32\SqzhehH.exe
  2⤵
  PID:10764
- C:\Windows\System32\MMOZRkA.exe
  C:\Windows\System32\MMOZRkA.exe
  2⤵
  PID:10808
- C:\Windows\System32\KBxyicT.exe
  C:\Windows\System32\KBxyicT.exe
  2⤵
  PID:10832
- C:\Windows\System32\nKNeCTn.exe
  C:\Windows\System32\nKNeCTn.exe
  2⤵
  PID:10872
- C:\Windows\System32\QjvcTnR.exe
  C:\Windows\System32\QjvcTnR.exe
  2⤵
  PID:10892
- C:\Windows\System32\KELHPzA.exe
  C:\Windows\System32\KELHPzA.exe
  2⤵
  PID:10920
- C:\Windows\System32\BhzhyNz.exe
  C:\Windows\System32\BhzhyNz.exe
  2⤵
  PID:10948
- C:\Windows\System32\WzDtooO.exe
  C:\Windows\System32\WzDtooO.exe
  2⤵
  PID:10972
- C:\Windows\System32\UtmFXHK.exe
  C:\Windows\System32\UtmFXHK.exe
  2⤵
  PID:11004
- C:\Windows\System32\UxNpaGO.exe
  C:\Windows\System32\UxNpaGO.exe
  2⤵
  PID:11052
- C:\Windows\System32\TRlsbTM.exe
  C:\Windows\System32\TRlsbTM.exe
  2⤵
  PID:11072
- C:\Windows\System32\CSbfowd.exe
  C:\Windows\System32\CSbfowd.exe
  2⤵
  PID:11092
- C:\Windows\System32\jhEGcOc.exe
  C:\Windows\System32\jhEGcOc.exe
  2⤵
  PID:11116
- C:\Windows\System32\SAUqvVF.exe
  C:\Windows\System32\SAUqvVF.exe
  2⤵
  PID:11140
- C:\Windows\System32\JoTLyYQ.exe
  C:\Windows\System32\JoTLyYQ.exe
  2⤵
  PID:11172
- C:\Windows\System32\RdbrMHH.exe
  C:\Windows\System32\RdbrMHH.exe
  2⤵
  PID:11192
- C:\Windows\System32\WmKwNwH.exe
  C:\Windows\System32\WmKwNwH.exe
  2⤵
  PID:11212
- C:\Windows\System32\NPuVhDu.exe
  C:\Windows\System32\NPuVhDu.exe
  2⤵
  PID:11248
- C:\Windows\System32\LZgiybp.exe
  C:\Windows\System32\LZgiybp.exe
  2⤵
  PID:10308
- C:\Windows\System32\tpfmqhN.exe
  C:\Windows\System32\tpfmqhN.exe
  2⤵
  PID:10332
- C:\Windows\System32\lEkLBDD.exe
  C:\Windows\System32\lEkLBDD.exe
  2⤵
  PID:10356
- C:\Windows\System32\XOOWTxm.exe
  C:\Windows\System32\XOOWTxm.exe
  2⤵
  PID:10448
- C:\Windows\System32\WgJCmXU.exe
  C:\Windows\System32\WgJCmXU.exe
  2⤵
  PID:10532
- C:\Windows\System32\QbAhmZK.exe
  C:\Windows\System32\QbAhmZK.exe
  2⤵
  PID:10552
- C:\Windows\System32\QtQcdcz.exe
  C:\Windows\System32\QtQcdcz.exe
  2⤵
  PID:10568
- C:\Windows\System32\wRLsYgw.exe
  C:\Windows\System32\wRLsYgw.exe
  2⤵
  PID:10716
- C:\Windows\System32\rlZPXwH.exe
  C:\Windows\System32\rlZPXwH.exe
  2⤵
  PID:10780
- C:\Windows\System32\cKExNSC.exe
  C:\Windows\System32\cKExNSC.exe
  2⤵
  PID:10788
- C:\Windows\System32\fZebvqC.exe
  C:\Windows\System32\fZebvqC.exe
  2⤵
  PID:10840
- C:\Windows\System32\clQaLDf.exe
  C:\Windows\System32\clQaLDf.exe
  2⤵
  PID:10916
- C:\Windows\System32\eXlebPD.exe
  C:\Windows\System32\eXlebPD.exe
  2⤵
  PID:10964
- C:\Windows\System32\zuYrBFA.exe
  C:\Windows\System32\zuYrBFA.exe
  2⤵
  PID:11068
- C:\Windows\System32\UYQdbKU.exe
  C:\Windows\System32\UYQdbKU.exe
  2⤵
  PID:11188
- C:\Windows\System32\olkFVzm.exe
  C:\Windows\System32\olkFVzm.exe
  2⤵
  PID:11200
- C:\Windows\System32\LGmXRzp.exe
  C:\Windows\System32\LGmXRzp.exe
  2⤵
  PID:10328
- C:\Windows\System32\YEdCFux.exe
  C:\Windows\System32\YEdCFux.exe
  2⤵
  PID:10480
- C:\Windows\System32\WwcejeA.exe
  C:\Windows\System32\WwcejeA.exe
  2⤵
  PID:10636
- C:\Windows\System32\qHktbPf.exe
  C:\Windows\System32\qHktbPf.exe
  2⤵
  PID:10796
- C:\Windows\System32\aKOrxtP.exe
  C:\Windows\System32\aKOrxtP.exe
  2⤵
  PID:10984
- C:\Windows\System32\PmNSNmP.exe
  C:\Windows\System32\PmNSNmP.exe
  2⤵
  PID:11100
- C:\Windows\System32\ytXskMU.exe
  C:\Windows\System32\ytXskMU.exe
  2⤵
  PID:11184
- C:\Windows\System32\MGzqKrN.exe
  C:\Windows\System32\MGzqKrN.exe
  2⤵
  PID:10312
- C:\Windows\System32\HPcRlko.exe
  C:\Windows\System32\HPcRlko.exe
  2⤵
  PID:10772
- C:\Windows\System32\wFtkfqK.exe
  C:\Windows\System32\wFtkfqK.exe
  2⤵
  PID:10600
- C:\Windows\System32\yuSHHnT.exe
  C:\Windows\System32\yuSHHnT.exe
  2⤵
  PID:11128
- C:\Windows\System32\SJAjBPN.exe
  C:\Windows\System32\SJAjBPN.exe
  2⤵
  PID:10884
- C:\Windows\System32\FouaKqj.exe
  C:\Windows\System32\FouaKqj.exe
  2⤵
  PID:11272
- C:\Windows\System32\bDRHcfb.exe
  C:\Windows\System32\bDRHcfb.exe
  2⤵
  PID:11288
- C:\Windows\System32\SXjFcUS.exe
  C:\Windows\System32\SXjFcUS.exe
  2⤵
  PID:11324
- C:\Windows\System32\PcRTdkV.exe
  C:\Windows\System32\PcRTdkV.exe
  2⤵
  PID:11340
- C:\Windows\System32\rKhIuoI.exe
  C:\Windows\System32\rKhIuoI.exe
  2⤵
  PID:11368
- C:\Windows\System32\SSIKNih.exe
  C:\Windows\System32\SSIKNih.exe
  2⤵
  PID:11396
- C:\Windows\System32\OhYDYbx.exe
  C:\Windows\System32\OhYDYbx.exe
  2⤵
  PID:11416
- C:\Windows\System32\bzvSFOv.exe
  C:\Windows\System32\bzvSFOv.exe
  2⤵
  PID:11456
- C:\Windows\System32\ZaaQTuS.exe
  C:\Windows\System32\ZaaQTuS.exe
  2⤵
  PID:11500
- C:\Windows\System32\wohuKDI.exe
  C:\Windows\System32\wohuKDI.exe
  2⤵
  PID:11532
- C:\Windows\System32\ycnIKPw.exe
  C:\Windows\System32\ycnIKPw.exe
  2⤵
  PID:11560
- C:\Windows\System32\GcOyiNK.exe
  C:\Windows\System32\GcOyiNK.exe
  2⤵
  PID:11588
- C:\Windows\System32\iloTzDk.exe
  C:\Windows\System32\iloTzDk.exe
  2⤵
  PID:11612
- C:\Windows\System32\JWvkAgt.exe
  C:\Windows\System32\JWvkAgt.exe
  2⤵
  PID:11644
- C:\Windows\System32\wfarTWv.exe
  C:\Windows\System32\wfarTWv.exe
  2⤵
  PID:11672
- C:\Windows\System32\hZXWnHu.exe
  C:\Windows\System32\hZXWnHu.exe
  2⤵
  PID:11688
- C:\Windows\System32\yhMtQRz.exe
  C:\Windows\System32\yhMtQRz.exe
  2⤵
  PID:11708
- C:\Windows\System32\WxTjpcm.exe
  C:\Windows\System32\WxTjpcm.exe
  2⤵
  PID:11740
- C:\Windows\System32\BhnxzDT.exe
  C:\Windows\System32\BhnxzDT.exe
  2⤵
  PID:11772
- C:\Windows\System32\xfUHMzT.exe
  C:\Windows\System32\xfUHMzT.exe
  2⤵
  PID:11792
- C:\Windows\System32\GYYKYgx.exe
  C:\Windows\System32\GYYKYgx.exe
  2⤵
  PID:11828
- C:\Windows\System32\NXyhOwn.exe
  C:\Windows\System32\NXyhOwn.exe
  2⤵
  PID:11852
- C:\Windows\System32\NrFAPGU.exe
  C:\Windows\System32\NrFAPGU.exe
  2⤵
  PID:11872
- C:\Windows\System32\OwTJgtz.exe
  C:\Windows\System32\OwTJgtz.exe
  2⤵
  PID:11896
- C:\Windows\System32\YOSJdEW.exe
  C:\Windows\System32\YOSJdEW.exe
  2⤵
  PID:11912
- C:\Windows\System32\VocSqIP.exe
  C:\Windows\System32\VocSqIP.exe
  2⤵
  PID:11940
- C:\Windows\System32\DcyffEK.exe
  C:\Windows\System32\DcyffEK.exe
  2⤵
  PID:11984
- C:\Windows\System32\IrvKnmK.exe
  C:\Windows\System32\IrvKnmK.exe
  2⤵
  PID:12028
- C:\Windows\System32\nXQyokr.exe
  C:\Windows\System32\nXQyokr.exe
  2⤵
  PID:12072
- C:\Windows\System32\wlcUoiu.exe
  C:\Windows\System32\wlcUoiu.exe
  2⤵
  PID:12108
- C:\Windows\System32\UgHpARd.exe
  C:\Windows\System32\UgHpARd.exe
  2⤵
  PID:12132
- C:\Windows\System32\lNjPfFN.exe
  C:\Windows\System32\lNjPfFN.exe
  2⤵
  PID:12148
- C:\Windows\System32\vkuWUMs.exe
  C:\Windows\System32\vkuWUMs.exe
  2⤵
  PID:12164
- C:\Windows\System32\TaHhQFZ.exe
  C:\Windows\System32\TaHhQFZ.exe
  2⤵
  PID:12188
- C:\Windows\System32\QOwTQNb.exe
  C:\Windows\System32\QOwTQNb.exe
  2⤵
  PID:12236
- C:\Windows\System32\DQziikv.exe
  C:\Windows\System32\DQziikv.exe
  2⤵
  PID:12256
- C:\Windows\System32\uSlitag.exe
  C:\Windows\System32\uSlitag.exe
  2⤵
  PID:11296
- C:\Windows\System32\VPFnnEo.exe
  C:\Windows\System32\VPFnnEo.exe
  2⤵
  PID:11316
- C:\Windows\System32\yJkkMbr.exe
  C:\Windows\System32\yJkkMbr.exe
  2⤵
  PID:11348
- C:\Windows\System32\nNYIcrG.exe
  C:\Windows\System32\nNYIcrG.exe
  2⤵
  PID:11412
- C:\Windows\System32\vRKnnOe.exe
  C:\Windows\System32\vRKnnOe.exe
  2⤵
  PID:11440
- C:\Windows\System32\cmARACV.exe
  C:\Windows\System32\cmARACV.exe
  2⤵
  PID:11512
- C:\Windows\System32\oMIVmur.exe
  C:\Windows\System32\oMIVmur.exe
  2⤵
  PID:11528
- C:\Windows\System32\KiBVyLY.exe
  C:\Windows\System32\KiBVyLY.exe
  2⤵
  PID:11600
- C:\Windows\System32\ThaNDNo.exe
  C:\Windows\System32\ThaNDNo.exe
  2⤵
  PID:11716
- C:\Windows\System32\DKZzxFp.exe
  C:\Windows\System32\DKZzxFp.exe
  2⤵
  PID:11836
- C:\Windows\System32\nECfbpa.exe
  C:\Windows\System32\nECfbpa.exe
  2⤵
  PID:11968
- C:\Windows\System32\wCmVfgF.exe
  C:\Windows\System32\wCmVfgF.exe
  2⤵
  PID:12016
- C:\Windows\System32\ccOHrYc.exe
  C:\Windows\System32\ccOHrYc.exe
  2⤵
  PID:12040
- C:\Windows\System32\woOrjof.exe
  C:\Windows\System32\woOrjof.exe
  2⤵
  PID:12120
- C:\Windows\System32\SRCRWcT.exe
  C:\Windows\System32\SRCRWcT.exe
  2⤵
  PID:12228
- C:\Windows\System32\FeZvYkW.exe
  C:\Windows\System32\FeZvYkW.exe
  2⤵
  PID:12284
- C:\Windows\System32\fXCgcet.exe
  C:\Windows\System32\fXCgcet.exe
  2⤵
  PID:11380
- C:\Windows\System32\kNFgpVV.exe
  C:\Windows\System32\kNFgpVV.exe
  2⤵
  PID:11408
- C:\Windows\System32\tssYzNG.exe
  C:\Windows\System32\tssYzNG.exe
  2⤵
  PID:11484
- C:\Windows\System32\MgzOQmz.exe
  C:\Windows\System32\MgzOQmz.exe
  2⤵
  PID:11788
- C:\Windows\System32\wZGjRrD.exe
  C:\Windows\System32\wZGjRrD.exe
  2⤵
  PID:11724
- C:\Windows\System32\RBmqzwC.exe
  C:\Windows\System32\RBmqzwC.exe
  2⤵
  PID:11884
- C:\Windows\System32\vQWabDo.exe
  C:\Windows\System32\vQWabDo.exe
  2⤵
  PID:11992
- C:\Windows\System32\qzmZGMV.exe
  C:\Windows\System32\qzmZGMV.exe
  2⤵
  PID:12128
- C:\Windows\System32\SNBOKvv.exe
  C:\Windows\System32\SNBOKvv.exe
  2⤵
  PID:11284
- C:\Windows\System32\jLXdRwF.exe
  C:\Windows\System32\jLXdRwF.exe
  2⤵
  PID:11428
- C:\Windows\System32\iWZNXBc.exe
  C:\Windows\System32\iWZNXBc.exe
  2⤵
  PID:11596
- C:\Windows\System32\FUQFsHq.exe
  C:\Windows\System32\FUQFsHq.exe
  2⤵
  PID:12304
- C:\Windows\System32\oPfHXuW.exe
  C:\Windows\System32\oPfHXuW.exe
  2⤵
  PID:12348
- C:\Windows\System32\zDcmfSY.exe
  C:\Windows\System32\zDcmfSY.exe
  2⤵
  PID:12368
- C:\Windows\System32\oCOwhws.exe
  C:\Windows\System32\oCOwhws.exe
  2⤵
  PID:12404
- C:\Windows\System32\djpcMov.exe
  C:\Windows\System32\djpcMov.exe
  2⤵
  PID:12420
- C:\Windows\System32\CVrdfzR.exe
  C:\Windows\System32\CVrdfzR.exe
  2⤵
  PID:12444
- C:\Windows\System32\RJJOVed.exe
  C:\Windows\System32\RJJOVed.exe
  2⤵
  PID:12484
- C:\Windows\System32\JCKeOnQ.exe
  C:\Windows\System32\JCKeOnQ.exe
  2⤵
  PID:12520
- C:\Windows\System32\xTdoJRk.exe
  C:\Windows\System32\xTdoJRk.exe
  2⤵
  PID:12540
- C:\Windows\System32\KFfMFAN.exe
  C:\Windows\System32\KFfMFAN.exe
  2⤵
  PID:12556
- C:\Windows\System32\EkxlYLg.exe
  C:\Windows\System32\EkxlYLg.exe
  2⤵
  PID:12588
- C:\Windows\System32\NRinOTv.exe
  C:\Windows\System32\NRinOTv.exe
  2⤵
  PID:12632
- C:\Windows\System32\xENlihc.exe
  C:\Windows\System32\xENlihc.exe
  2⤵
  PID:12648
- C:\Windows\System32\ZqslPFh.exe
  C:\Windows\System32\ZqslPFh.exe
  2⤵
  PID:12668
- C:\Windows\System32\RBFyJuW.exe
  C:\Windows\System32\RBFyJuW.exe
  2⤵
  PID:12684
- C:\Windows\System32\HTNrcYc.exe
  C:\Windows\System32\HTNrcYc.exe
  2⤵
  PID:12712
- C:\Windows\System32\ewGKlza.exe
  C:\Windows\System32\ewGKlza.exe
  2⤵
  PID:12732
- C:\Windows\System32\yBHQumO.exe
  C:\Windows\System32\yBHQumO.exe
  2⤵
  PID:12748
- C:\Windows\System32\pifESwI.exe
  C:\Windows\System32\pifESwI.exe
  2⤵
  PID:12784
- C:\Windows\System32\ooiycIb.exe
  C:\Windows\System32\ooiycIb.exe
  2⤵
  PID:12844
- C:\Windows\System32\pKVVfPJ.exe
  C:\Windows\System32\pKVVfPJ.exe
  2⤵
  PID:12876
- C:\Windows\System32\aAdUdTc.exe
  C:\Windows\System32\aAdUdTc.exe
  2⤵
  PID:12912
- C:\Windows\System32\UpJxaIQ.exe
  C:\Windows\System32\UpJxaIQ.exe
  2⤵
  PID:12932
- C:\Windows\System32\aKDHiFl.exe
  C:\Windows\System32\aKDHiFl.exe
  2⤵
  PID:12952
- C:\Windows\System32\KllJNpG.exe
  C:\Windows\System32\KllJNpG.exe
  2⤵
  PID:13004
- C:\Windows\System32\GaNlqUi.exe
  C:\Windows\System32\GaNlqUi.exe
  2⤵
  PID:13020
- C:\Windows\System32\fgoPNMH.exe
  C:\Windows\System32\fgoPNMH.exe
  2⤵
  PID:13044
- C:\Windows\System32\CzIPGUX.exe
  C:\Windows\System32\CzIPGUX.exe
  2⤵
  PID:13076
- C:\Windows\System32\UMlnkPZ.exe
  C:\Windows\System32\UMlnkPZ.exe
  2⤵
  PID:13096
- C:\Windows\System32\ktJChsj.exe
  C:\Windows\System32\ktJChsj.exe
  2⤵
  PID:13120
- C:\Windows\System32\UiHVvzf.exe
  C:\Windows\System32\UiHVvzf.exe
  2⤵
  PID:13136
- C:\Windows\System32\sGhfAmo.exe
  C:\Windows\System32\sGhfAmo.exe
  2⤵
  PID:13164
- C:\Windows\System32\qmYKTEw.exe
  C:\Windows\System32\qmYKTEw.exe
  2⤵
  PID:13200
- C:\Windows\System32\crSVvgK.exe
  C:\Windows\System32\crSVvgK.exe
  2⤵
  PID:13224
- C:\Windows\System32\LmXiNwN.exe
  C:\Windows\System32\LmXiNwN.exe
  2⤵
  PID:13248
- C:\Windows\System32\vzZUytw.exe
  C:\Windows\System32\vzZUytw.exe
  2⤵
  PID:13300
- C:\Windows\System32\QYcmRWJ.exe
  C:\Windows\System32\QYcmRWJ.exe
  2⤵
  PID:11624
- C:\Windows\System32\KkHMcjC.exe
  C:\Windows\System32\KkHMcjC.exe
  2⤵
  PID:12364
- C:\Windows\System32\OOsKjZs.exe
  C:\Windows\System32\OOsKjZs.exe
  2⤵
  PID:12392
- C:\Windows\System32\Llctsns.exe
  C:\Windows\System32\Llctsns.exe
  2⤵
  PID:12412
- C:\Windows\System32\kVZdHjP.exe
  C:\Windows\System32\kVZdHjP.exe
  2⤵
  PID:12500
- C:\Windows\System32\oVOwteq.exe
  C:\Windows\System32\oVOwteq.exe
  2⤵
  PID:3596
- C:\Windows\System32\TjckXhy.exe
  C:\Windows\System32\TjckXhy.exe
  2⤵
  PID:12640
- C:\Windows\System32\StLrqcS.exe
  C:\Windows\System32\StLrqcS.exe
  2⤵
  PID:12740
- C:\Windows\System32\btbaUXZ.exe
  C:\Windows\System32\btbaUXZ.exe
  2⤵
  PID:12792
- C:\Windows\System32\Jbplqdw.exe
  C:\Windows\System32\Jbplqdw.exe
  2⤵
  PID:12856
- C:\Windows\System32\cTDekjB.exe
  C:\Windows\System32\cTDekjB.exe
  2⤵
  PID:12896
- C:\Windows\System32\CptyRiJ.exe
  C:\Windows\System32\CptyRiJ.exe
  2⤵
  PID:12948
- C:\Windows\System32\CjrpDMa.exe
  C:\Windows\System32\CjrpDMa.exe
  2⤵
  PID:13068
- C:\Windows\System32\srUEdOS.exe
  C:\Windows\System32\srUEdOS.exe
  2⤵
  PID:13172
- C:\Windows\System32\xBhGnok.exe
  C:\Windows\System32\xBhGnok.exe
  2⤵
  PID:13208
- C:\Windows\System32\nGdzocJ.exe
  C:\Windows\System32\nGdzocJ.exe
  2⤵
  PID:13220
- C:\Windows\System32\NyjJcXY.exe
  C:\Windows\System32\NyjJcXY.exe
  2⤵
  PID:13280
- C:\Windows\System32\MhgHuli.exe
  C:\Windows\System32\MhgHuli.exe
  2⤵
  PID:12316
- C:\Windows\System32\GDbvAyS.exe
  C:\Windows\System32\GDbvAyS.exe
  2⤵
  PID:12376
- C:\Windows\System32\MiwFLsS.exe
  C:\Windows\System32\MiwFLsS.exe
  2⤵
  PID:12660
- C:\Windows\System32\DxVwoIW.exe
  C:\Windows\System32\DxVwoIW.exe
  2⤵
  PID:12832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4200,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:8
1⤵
PID:3812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AFAQFlS.exe

Path C:\Windows\System32\AFAQFlS.exe
Size 1.1MB
SHA256 d7005ea9a0068319cb65c6797aa600fd942d72373e681183c4b815bade2b19de
MD5 d741169f68ca4ccd05feb80db349786c
SHA1 c3d66263b66aa6d9283707f072b808e0250df47e
SHA512 adfdea0b98474fa0db768af7ddd195f44adda1e0fc0b87b03d963782a40f5b4fcb19b49fc3196fbc55237fb65f911ff97252db5f62b8296c0e380d15ce095aad
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlGC78XCejIODosTigQytOFM:knw9oUUEEDlGUrMNT
MD5 SHA1 SHA512 SSDEEP

Submit Download

ASsHUWq.exe

Path C:\Windows\System32\ASsHUWq.exe
Size 1.1MB
SHA256 538ebb24350f47de6be2fc19178d8d1850663ac12b1877aac5cb2ab0ec4c369a
MD5 f2f12ad9469c4fd8605f25ca234b04c4
SHA1 f19ca378977175f5d1f3b02ce24735528039ad1f
SHA512 38d5df6f6cee95d603b2b1a7f1a5ae6f42184d00755243e15891e70199f51db2fee383e0f5808aee5ffb9a34fdd8a2c155b2e5269b88cde86320799070af2ea9
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlGC78XCejIODosTigQytOF3:knw9oUUEEDlGUrMNy
MD5 SHA1 SHA512 SSDEEP

Submit Download

AcTPSDz.exe

Path C:\Windows\System32\AcTPSDz.exe
Size 1.1MB
SHA256 abad3da4aad0cdb24e9da6eb84e63996220746fd7a3e3fd755dbefa830e67542
MD5 3c72fc5f86784ab96f6847acd8265dda
SHA1 4f3899396e0b87c649bc995aaa18f86e685fb925
SHA512 fa582dc25ff92ec246c395b3586c58f8388887f5feb862e44ab020aaa1cca52ab4fdbcf9bcbbe551f5b3bb81946566ab7e7e6fe0257c16c6fcd26d892f46a9da
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlGC78XCejIODosTigQytOFm:knw9oUUEEDlGUrMNr
MD5 SHA1 SHA512 SSDEEP

Submit Download

DFSabLW.exe

Path C:\Windows\System32\DFSabLW.exe
Size 1.1MB
SHA256 b3a44f6e4e7f74f947be777cba79f0a0e67a2c0c4e7107931ec6c014969d159c
MD5 ccea65a83d11766a4531227894004440
SHA1 43fc8fe25d5af0976ded93e3ee297a337ae229cc
SHA512 2d821f978c8e5bff6ef30c3488e85c7923d220c3e6b953820ba1052734fcbfb206f18423e07793318a69cf4bc1e951ab8a9918a04cedd0a73139bcefab5ca809
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlGC78XCejIODosTigQytOFw:knw9oUUEEDlGUrMN/
MD5 SHA1 SHA512 SSDEEP

Submit Download

GCzQJId.exe

Path C:\Windows\System32\GCzQJId.exe
Size 1.1MB
SHA256 e0da843f63eb55df3add4650777bb87efb65adaf855e038895bd6c2479f3bde1
MD5 17d56a689810b70e7e3d50a649efd47e
SHA1 738acb0f0815632367edb203f35fcf955dd16965
SHA512 f1607e6b0e22a9eac1602266b7c67cc1157b210214ed8ca7910ce4a5ffab02e3e908a0bbe9ae217d6367b89523e23b0a25e568c22fd40ef87bcb4eb29f444ffb
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlGC78XCejIODosTigQytOFg:knw9oUUEEDlGUrMNr
MD5 SHA1 SHA512 SSDEEP

Submit Download

IaTvuxo.exe

Path C:\Windows\System32\IaTvuxo.exe
Size 1.1MB
SHA256 82b1fa2e8a5ca6075260878845e48512679fd031bb83f5bd87bca65c63199f2a
MD5 b4182028b27835593117e45902c68529
SHA1 2e9c0ca1d18f56d4c7e8cf8ba3c6b16867409541
SHA512 34f44a35f6ff6fc6a4430c9350258d4b680759a1ba008a0e35482cb772aa494ab9f414f72143e7f77be9090810ce7bfee82e3eef3b1a5147ad2aa72a3e83bb4a
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlGC78XCejIODosTigQytOFF:knw9oUUEEDlGUrMNe
MD5 SHA1 SHA512 SSDEEP

Submit Download

IrkToHD.exe

Path C:\Windows\System32\IrkToHD.exe
Size 1.1MB
SHA256 2393148cefb6cea08255c0024569460de5e86e8af2b653268b2e4808d16a4db7
MD5 f773d3a62d58bf9fcd8bbbe5e9376444
SHA1 15070a020f06c2152e01fef7e035accaa8d86fec
SHA512 8fb8ba93c69970a07b4bf967e8d0c33f33019570f30e9033943a5ab1cb67d3b2da70c33475bf24c8bb7729c6c1b1643be48156f6724ac0f591f33938b819f21d
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlGC78XCejIODosTigQytOFH:knw9oUUEEDlGUrMNq
MD5 SHA1 SHA512 SSDEEP

Submit Download

MvzDDLc.exe

Path C:\Windows\System32\MvzDDLc.exe
Size 1.1MB
SHA256 7ebc12dc8ab69eb8ecdde1375f307dde9b37c8463f74457629a52b85e3afa58e
MD5 a326eb5bf238747c554fdaab510785de
SHA1 2c5cf489f5efe649efb6ebf16d3553838a42dd6d
SHA512 5705a50ce832533df08a6f185a5bb02e19e8c115577817c9c39bf6ad01461b70f6f6974631c005daa0741a5f300b48154dc1fc63e9f61a70c543703aa27f286f
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlGC78XCejIODosTigQytOFL:knw9oUUEEDlGUrMNy
MD5 SHA1 SHA512 SSDEEP

Submit Download

QfdiLrZ.exe

Path C:\Windows\System32\QfdiLrZ.exe
Size 1.1MB
SHA256 f492df5aae879b4981d289f1dfe9466fd59112da042e96647d96d7f0ae2721d6
MD5 ae9d89a01adfce1ee889701e5849d68d
SHA1 b5acdd6c02804cf1e861b4d829476190ee1b17f9
SHA512 59bb50d98e9c847792ca7be31aee7727180606f23cae4baeb9a208286f24f6c6092c6e7ffa5b7cc6d09bbe89580354f9b0befd35b94f162b0086a0dfa2597d5c
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlGC78XCejIODosTigQytOFE:knw9oUUEEDlGUrMNb
MD5 SHA1 SHA512 SSDEEP

Submit Download

WHkIRgF.exe

Path C:\Windows\System32\WHkIRgF.exe
Size 1.1MB
SHA256 b530686c92e90ecef71f6b11c8b6273675cd4c944bfc30afcaa9acd777b53ffd
MD5 6192a5dab22ed10578b63b626cb48ce4
SHA1 21b4be7ad0454dbdb1868f3fc44a361e2e5fdcc3
SHA512 334a83c4bdb969ecb2939d003dbd1423a1f0b49ed0f8348da936a26fed60257d59a129dc22b1983fc8b212ffaf5cf6c9cc6343645e6606fc7c326020f208e32b
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlGC78XCejIODosTigQytOFZ:knw9oUUEEDlGUrMNY
MD5 SHA1 SHA512 SSDEEP

Submit Download

XLlLxcq.exe

Path C:\Windows\System32\XLlLxcq.exe
Size 1.1MB
SHA256 5cbe7cdc76e520b4a00b2134810b622636220b622e28e83f599ccaed27b158cd
MD5 ce5cd477d97c6719b456bf65a6bb5ea4
SHA1 c5421641c816f9e5d065b54900be29ebd50a002d
SHA512 364d11a7b79722e03f6dbc869e8980e014ef69917e8ebf32a8dfd670bd2a5d895e89dffb57ff4249f9d04490c651bed7a36d6d43a6172ae87375695a5d91dda2
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlGC78XCejIODosTigQytOFY:knw9oUUEEDlGUrMN/
MD5 SHA1 SHA512 SSDEEP

Submit Download

aAuYiKL.exe

Path C:\Windows\System32\aAuYiKL.exe
Size 1.1MB
SHA256 3e6564e072c42521e9ad4dd20e2aa99f1ffcd64bbf97bc346948221ff854e836
MD5 59f0ae8521c16f597644d113c550dd9c
SHA1 3640732169ac3670a841f3a3c97eef5eb730f4fe
SHA512 d10b5e7c0b79e836eed77903eafc1575d870ced76abb1622ee7acf7e7ddf50ce9a09da2d55d1aedb48142193373a7ab655df93cd935f1ef42e886494f923f680
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlGC78XCejIODosTigQytOFY:knw9oUUEEDlGUrMNH
MD5 SHA1 SHA512 SSDEEP

Submit Download

bGjhVWA.exe

Path C:\Windows\System32\bGjhVWA.exe
Size 1.1MB
SHA256 400bba7c4f2b953415368424f7577c750d0733b07057a1bdade73eb7ab787749
MD5 61832d05bc444af05277b4166ee03a76
SHA1 ba2b87dd263e18bc1b13f48dde22bff9a1f74ddb
SHA512 c882245f258110b7a7f81cb0e8d0f594e179bf33a6055c25aca0a0c5e44c5408c2c0256238a12d38a84db76c333ec9c91886db1b7200f53c794fa71c65348866
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlGC78XCejIODosTigQytOFg:knw9oUUEEDlGUrMNr
MD5 SHA1 SHA512 SSDEEP

Submit Download

cBYdaSL.exe

Path C:\Windows\System32\cBYdaSL.exe
Size 1.1MB
SHA256 9eea54b6ea7091a91caf24f63c3886d1d74450a4993ffd94f53e76a8920dbfc0
MD5 9f5515fcff78f4d07ff4deba1de74289
SHA1 a4dc7369870ab9a22b51965bedbe0e2ad9f23ff7
SHA512 1a31cf95b28ab51da1cdeefbaff2a90d6139f948ef6cca506422d6ef4be34658b1a14934d149ec56ecac37fa6af29067a41e5a2238f9eb904b2e0ff1890c3fb3
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlGC78XCejIODosTigQytOFGy:knw9oUUEEDlGUrMNfy
MD5 SHA1 SHA512 SSDEEP

Submit Download

cpWYVGr.exe

Path C:\Windows\System32\cpWYVGr.exe
Size 1.1MB
SHA256 02d9b615c81ce322ac850bec2670691e9dfa41980116205ed484e3771424b006
MD5 a5f870756f8fa5190028bf26966ade69
SHA1 221b989b507dd7a60ba87c597c993b55de2b8732
SHA512 6f9743c03e5901017ffa08bb4a5e2d1e7a2bbe0e2764ae3ae1b1ec80ad1f5101bb557400b216e4d2cf31505ba857f14740f1feac6cfe425e541bb1cd82c8e17a
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlGC78XCejIODosTigQytOF3:knw9oUUEEDlGUrMNa
MD5 SHA1 SHA512 SSDEEP

Submit Download

ezzaJHZ.exe

Path C:\Windows\System32\ezzaJHZ.exe
Size 1.1MB
SHA256 fbfaf4e73a7b551af4752c977e9afd56d641674e85fbede65d79061d3d4d6446
MD5 5abd13ba0c82013c28d99cfe0adb2f73
SHA1 a066903436c213ce09eedabb462b90444e0682e2
SHA512 c97b2c8158b6f6f7ac0d1bb07c213aa85f4056040ce9205a169f4650948d2a3f886175a62ba12fa58c773b36792e095ea1c716ac79d2440356bb14bd24dd69d2
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlGC78XCejIODosTigQytOFQt:knw9oUUEEDlGUrMNp
MD5 SHA1 SHA512 SSDEEP

Submit Download

gKGKmrL.exe

Path C:\Windows\System32\gKGKmrL.exe
Size 1.1MB
SHA256 70980ba722628e8c581717f0de94ff0043c95f3912bba72da2152ecaff4439d5
MD5 2f8f43d012b7cf1f7e3f9dee9fa375db
SHA1 bdea28a59fc0f085a5ca9aa9606a4eeb1bb3a919
SHA512 3160e69c13df029df189e9402f3edfa530692e0ece7dc52d2f530c1c85c814ef1f7163c39c860f55d6429e363f9dc3aa67f76b314f83c75ffb526254fb8b9628
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlGC78XCejIODosTigQytOFJ:knw9oUUEEDlGUrMNY
MD5 SHA1 SHA512 SSDEEP

Submit Download

gbdFCwg.exe

Path C:\Windows\System32\gbdFCwg.exe
Size 1.1MB
SHA256 5f8097821d7196e13e16dd65412be7b746699c008ea78d0cfa762f71e1163f55
MD5 32410fec60618ad9c2e725bdcf08b6b3
SHA1 29de7f5d4ceb55c64fac16a1ef1675ddb000055c
SHA512 bb83e8030ea8eddc61584e62666d1065ac2ed9329fa92fb8307c4ec02b780d7d4558c478797c87e2a44e07803df10c6275cc7375f87cd6ad91a6bedab5299f35
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlGC78XCejIODosTigQytOFj:knw9oUUEEDlGUrMNW
MD5 SHA1 SHA512 SSDEEP

Submit Download

gpnMqVI.exe

Path C:\Windows\System32\gpnMqVI.exe
Size 1.1MB
SHA256 be561c3f945c0d4d960a8444b757b71360ac454ff65ed25ad44136e4b2f24caa
MD5 d41404da27e343e9365bf9075aab820d
SHA1 7c43c888125e43603c2daf25ed1405856b664901
SHA512 c0482e89c6d1f080f688d0e8afbfe4d33c3210133bdb83d2215d4e7cadf40995e97c98d2cff2da859717d689bd61eff46772e86ed9afd9417bd98641d81ed950
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlGC78XCejIODosTigQytOFn:knw9oUUEEDlGUrMNa
MD5 SHA1 SHA512 SSDEEP

Submit Download

kugLAuQ.exe

Path C:\Windows\System32\kugLAuQ.exe
Size 1.1MB
SHA256 bdbadf914703d23ed17fabcd5c00a6ab042ee5f9e122e91de0a6b3bfc2d379eb
MD5 d84af5689e27b3d18f4d1266b9f5ac71
SHA1 c37ec1460815d451169afab2fc384b517de770d4
SHA512 0bab31013b05b42e412c4490aa363ea036ab15c308644bafe8ec6aac5ac481d43810162416faedd35d19738e50d12f270bc4248eed6b4cbdee293fe1850b5466
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlGC78XCejIODosTigQytOF8N:knw9oUUEEDlGUrMNvN
MD5 SHA1 SHA512 SSDEEP

Submit Download

lfltuDj.exe

Path C:\Windows\System32\lfltuDj.exe
Size 1.1MB
SHA256 69bd5126dc651ccaff9dc299a3390c071b6dcb2c0f0df86dc0c4b96c0595d967
MD5 7f4a371bf1c631fc170a1555c9e26a68
SHA1 fabb37514921181c1b55bd3975d4070e9dc9afe2
SHA512 834428ff84896a0a2a40d8e20baa3aecefc42dbcc40bb9859e232c304a84147107a35fee2565cc7132d094e55d31fcbfa9d15643df2395a142e1621cebffea2c
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlGC78XCejIODosTigQytOFJ:knw9oUUEEDlGUrMNO
MD5 SHA1 SHA512 SSDEEP

Submit Download

lnAUeJp.exe

Path C:\Windows\System32\lnAUeJp.exe
Size 1.1MB
SHA256 88c552236e9a5eaeb57e8c36083b0d713a31ce543bd10f3d4899bacc1d4dc2e1
MD5 f7dfcbc9a14b1c037011876dd48ac25a
SHA1 21843cdd938ecc8f90ff88a68d9e7ad642e1f11d
SHA512 943288bef0e2fae698402c663bb0623cb320bbf56e021c915c8844a1b2343d5df1159e142a6b1d0005ae4e1e30980e1a21ad90e7b0fec776e32b0f030c3141be
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlGC78XCejIODosTigQytOFY:knw9oUUEEDlGUrMNb
MD5 SHA1 SHA512 SSDEEP

Submit Download

pGDovGJ.exe

Path C:\Windows\System32\pGDovGJ.exe
Size 1.1MB
SHA256 b47c62dc81a6a0bc9424a8514edf01d395974fd4f79beab5189e70ed93a6d6da
MD5 0c788d24554b309d1bd48ab0c6bcd632
SHA1 f60ae949e3ae397134aee5f8f1bd8a4464ffd278
SHA512 4003eb334db06de6a4fe29e5234f98bceb95368620cd81323c3659a9a34c7720e821b2dbfdd0466204511d64f17bf9659d01224d48485235db3738839ef34bd4
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlGC78XCejIODosTigQytOF/:knw9oUUEEDlGUrMNs
MD5 SHA1 SHA512 SSDEEP

Submit Download

pwqPUHe.exe

Path C:\Windows\System32\pwqPUHe.exe
Size 1.1MB
SHA256 8cb86409b4909660fa260e211de9876f91257a3cc49460cd54244fe44b3a2aae
MD5 6cbcb9436c3f650d5d93dd17939c89e0
SHA1 452b60d8438596e698bc93bbd504284fc40e59c7
SHA512 d382682fee4fcd639fb6f158bccf4f8644c382371ef1ea7713c2ce3707c20faeab397f6bf60ad1768b65e265b768f00bcd2cab8c8a292e1fcb95e7b8197d2642
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlGC78XCejIODosTigQytOFL:knw9oUUEEDlGUrMNy
MD5 SHA1 SHA512 SSDEEP

Submit Download

qgjpNwY.exe

Path C:\Windows\System32\qgjpNwY.exe
Size 1.1MB
SHA256 7d20bbbb6140695159f2ecf065fdba2f7f0b75530427a95c02d8ac6759ad068a
MD5 be82586d52a17c61b75a388f47c4c30c
SHA1 b9f3b238b4fd5023b9f02dc79413cdf1d6b0d5c9
SHA512 676221116554606e70b7b7dd41481c31d8a4b8d0e659f771623b222bba86373d54f6e12f14fc04a1983dd9d0318d0867e237d8ea0f68fcade411dfe91fad967b
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlGC78XCejIODosTigQytOFg:knw9oUUEEDlGUrMNN
MD5 SHA1 SHA512 SSDEEP

Submit Download

qsmpWtW.exe

Path C:\Windows\System32\qsmpWtW.exe
Size 1.1MB
SHA256 93276b3efb677f2e7674514b413231596c870bb074f748bab8f4106db1c0ca16
MD5 abe0c02a85abc9d329055163bb0db43b
SHA1 70d3b22d111bc6c6d5a41f4ed8d9b7849bfc0649
SHA512 46864a4c44f82f455406e2564eb7ca271a77baed3fff0aa29a905eda05dd26839153a4e1b1f3b59852538bfe002cf09ce3dbd8da242bfbd844bac16b5e5c5c8e
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlGC78XCejIODosTigQytOFdE:knw9oUUEEDlGUrMNZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqjSUZm.exe

Path C:\Windows\System32\sqjSUZm.exe
Size 1.1MB
SHA256 083dd2c4fc395d61fec90df2b5d086e683249d905c50b67eee4706ceb2163d69
MD5 d8894e6b6555f3b3e1f5e01b1ab688e3
SHA1 7cc868e838d82c10491fbf4fbb17c9375419f1d6
SHA512 80ad185f013ba07cf55ceb1b6b773b14fe6fd986f4820e45fce1258fc404b87b273f877cae039b1a89d6e531d042bdcbf0ab6b3fdef84d996240951ec5702585
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlGC78XCejIODosTigQytOFR:knw9oUUEEDlGUrMNa
MD5 SHA1 SHA512 SSDEEP

Submit Download

tJPfvET.exe

Path C:\Windows\System32\tJPfvET.exe
Size 1.1MB
SHA256 afd105b88f9ff3ac7fa4a2d1739d05d3b9b80d8c901b8a4503e70b28ec904bc1
MD5 fd6467682f4ab1be733fd3b10b4a27be
SHA1 e1bb063d2ea36ca93d15a6b7f13691ee8aa6f221
SHA512 ba55dd05ce1e285c76c5e2171d3240ec6fab450731cb72283773e0a1b7575df508a438a6dd5c4ea087d093c29a2883e44a170ced8d048e94fb22221c2d044b76
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlGC78XCejIODosTigQytOFi:knw9oUUEEDlGUrMNv
MD5 SHA1 SHA512 SSDEEP

Submit Download

uFAAdDx.exe

Path C:\Windows\System32\uFAAdDx.exe
Size 1.1MB
SHA256 a86f0ad20f3cd0a3a30e57bcc6a2965f8f71ae98342a53e95ae522c498d86705
MD5 ce5eab27221c33485688e9f995cff77b
SHA1 e4d4b3343e329f4804e96d2b91fb32911dd40c91
SHA512 b2a3492a5551ac0bd28c31227889a905cc48a9445bf301acd627ccf1cb3c7061a6b6046deab8c0747f3e5b71901636548aaf3b05d0f9c00c5741fa10e2008867
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlGC78XCejIODosTigQytOF+:knw9oUUEEDlGUrMNJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

vFDoWAu.exe

Path C:\Windows\System32\vFDoWAu.exe
Size 1.1MB
SHA256 b4a70b97a70313783ebace68ced3387843e2279011545cd34be853582e95ee2b
MD5 8d754575a404eb472f71f21200394661
SHA1 a01d522b9a0522c2412b022a2da645a6e311a40a
SHA512 3948324c25fb9af9f75b92537893a412dcc4e119313857d6c81d250e5573bf94b8c07999b968faffd5712a84de3c9d52501082545aa3bc42f96051896718165a
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlGC78XCejIODosTigQytOFo:knw9oUUEEDlGUrMNH
MD5 SHA1 SHA512 SSDEEP

Submit Download

vuFQjlQ.exe

Path C:\Windows\System32\vuFQjlQ.exe
Size 1.1MB
SHA256 a75e1fafd6a4cac49a8b3ff5694f057ac4ab046f5de2476351f77ab3c3f05511
MD5 f13f2647bdb9db2235b0768bb364e87e
SHA1 4ddad3c9ebb7fe8ecd8993984f6ea08317f94d14
SHA512 6a4892eace0ef94c60d0cc57e12e04d46c5c617b7e9d73a2775e8d442c48e4d94b48827f88ba57d2cd251b7a1eb23703d67c478e1e5f5233c8eb916f15df80bf
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlGC78XCejIODosTigQytOFe:knw9oUUEEDlGUrMNn
MD5 SHA1 SHA512 SSDEEP

Submit Download

wnsVlMs.exe

Path C:\Windows\System32\wnsVlMs.exe
Size 1.1MB
SHA256 91a3a2a9184b9c26113020717b0e1faf24ff55f8c48a1efd0790735dcf4cb7ea
MD5 b4c192570d42351e6a32403bb6db0a54
SHA1 5192be0e6f09c6cd9afd4535430019f6f92dc811
SHA512 4a19fd67d7e6ddb279345fdf60640381cc411251ac562a1acf3e4b46c69f305a6c4c6eae994f7c1655e58419af2e3f5f1c80b45cfed81942bbfe9504f843d9ed
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlGC78XCejIODosTigQytOFN:knw9oUUEEDlGUrMN8
MD5 SHA1 SHA512 SSDEEP

Submit Download

xpjasNu.exe

Path C:\Windows\System32\xpjasNu.exe
Size 1.1MB
SHA256 d7cd7ae66dd00c6f2a39aaefcdd49867a36465db4a809407d56fdc86bf5095dc
MD5 0c0ced64c7eeed162d001f2ca184b0f7
SHA1 399e2f44a4f40fe358968dd7d9b43897b3d2d04b
SHA512 bfe747dc69ca44f5c6189e04c0b163223e8d36c3bc576e10b2de98828c8574767716640688f03f2d8e690f2cddbe8c1e8ab0e8d41463de3eac8b4d0c5ef81c60
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlGC78XCejIODosTigQytOFp:knw9oUUEEDlGUrMNa
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/212-414-0x00007FF611120000-0x00007FF611511000-memory.dmp

Download

memory/212-1991-0x00007FF611120000-0x00007FF611511000-memory.dmp

Download

memory/652-2020-0x00007FF6B73B0000-0x00007FF6B77A1000-memory.dmp

Download

memory/652-403-0x00007FF6B73B0000-0x00007FF6B77A1000-memory.dmp

Download

memory/756-2025-0x00007FF788A50000-0x00007FF788E41000-memory.dmp

Download

memory/756-402-0x00007FF788A50000-0x00007FF788E41000-memory.dmp

Download

memory/1020-2015-0x00007FF6FE190000-0x00007FF6FE581000-memory.dmp

Download

memory/1020-404-0x00007FF6FE190000-0x00007FF6FE581000-memory.dmp

Download

memory/1692-1995-0x00007FF674460000-0x00007FF674851000-memory.dmp

Download

memory/1692-418-0x00007FF674460000-0x00007FF674851000-memory.dmp

Download

memory/1792-1988-0x00007FF6BE180000-0x00007FF6BE571000-memory.dmp

Download

memory/1792-27-0x00007FF6BE180000-0x00007FF6BE571000-memory.dmp

Download

memory/1792-1963-0x00007FF6BE180000-0x00007FF6BE571000-memory.dmp

Download

memory/2260-1941-0x00007FF7C4BA0000-0x00007FF7C4F91000-memory.dmp

Download

memory/2260-30-0x00007FF7C4BA0000-0x00007FF7C4F91000-memory.dmp

Download

memory/2260-1986-0x00007FF7C4BA0000-0x00007FF7C4F91000-memory.dmp

Download

memory/2468-1996-0x00007FF6A9950000-0x00007FF6A9D41000-memory.dmp

Download

memory/2468-63-0x00007FF6A9950000-0x00007FF6A9D41000-memory.dmp

Download

memory/2468-1965-0x00007FF6A9950000-0x00007FF6A9D41000-memory.dmp

Download

memory/2476-2017-0x00007FF73B8A0000-0x00007FF73BC91000-memory.dmp

Download

memory/2476-406-0x00007FF73B8A0000-0x00007FF73BC91000-memory.dmp

Download

memory/2484-400-0x00007FF6C2AD0000-0x00007FF6C2EC1000-memory.dmp

Download

memory/2484-2033-0x00007FF6C2AD0000-0x00007FF6C2EC1000-memory.dmp

Download

memory/2520-2011-0x00007FF756790000-0x00007FF756B81000-memory.dmp

Download

memory/2520-405-0x00007FF756790000-0x00007FF756B81000-memory.dmp

Download

memory/2684-397-0x00007FF608D40000-0x00007FF609131000-memory.dmp

Download

memory/2684-2006-0x00007FF608D40000-0x00007FF609131000-memory.dmp

Download

memory/2712-57-0x00007FF7CE0C0000-0x00007FF7CE4B1000-memory.dmp

Download

memory/2712-1992-0x00007FF7CE0C0000-0x00007FF7CE4B1000-memory.dmp

Download

memory/2852-2002-0x00007FF694B00000-0x00007FF694EF1000-memory.dmp

Download

memory/2852-396-0x00007FF694B00000-0x00007FF694EF1000-memory.dmp

Download

memory/2908-0-0x00007FF7CB860000-0x00007FF7CBC51000-memory.dmp

Download

memory/2908-1-0x000001AFFEA10000-0x000001AFFEA20000-memory.dmp

Download

memory/3060-2029-0x00007FF700E50000-0x00007FF701241000-memory.dmp

Download

memory/3060-401-0x00007FF700E50000-0x00007FF701241000-memory.dmp

Download

memory/3224-58-0x00007FF683550000-0x00007FF683941000-memory.dmp

Download

memory/3224-1998-0x00007FF683550000-0x00007FF683941000-memory.dmp

Download

memory/3224-1964-0x00007FF683550000-0x00007FF683941000-memory.dmp

Download

memory/3360-37-0x00007FF7B6C30000-0x00007FF7B7021000-memory.dmp

Download

memory/3360-1982-0x00007FF7B6C30000-0x00007FF7B7021000-memory.dmp

Download

memory/3448-2000-0x00007FF78E790000-0x00007FF78EB81000-memory.dmp

Download

memory/3448-410-0x00007FF78E790000-0x00007FF78EB81000-memory.dmp

Download

memory/3776-1984-0x00007FF7663C0000-0x00007FF7667B1000-memory.dmp

Download

memory/3776-55-0x00007FF7663C0000-0x00007FF7667B1000-memory.dmp

Download

memory/4204-395-0x00007FF7FB9B0000-0x00007FF7FBDA1000-memory.dmp

Download

memory/4204-2004-0x00007FF7FB9B0000-0x00007FF7FBDA1000-memory.dmp

Download

memory/4208-2008-0x00007FF75FBB0000-0x00007FF75FFA1000-memory.dmp

Download

memory/4208-398-0x00007FF75FBB0000-0x00007FF75FFA1000-memory.dmp

Download

memory/4292-25-0x00007FF7502F0000-0x00007FF7506E1000-memory.dmp

Download

memory/4292-1980-0x00007FF7502F0000-0x00007FF7506E1000-memory.dmp

Download

memory/4384-1978-0x00007FF7DF650000-0x00007FF7DFA41000-memory.dmp

Download

memory/4384-16-0x00007FF7DF650000-0x00007FF7DFA41000-memory.dmp

Download

memory/4800-2038-0x00007FF6D2710000-0x00007FF6D2B01000-memory.dmp

Download

memory/4800-399-0x00007FF6D2710000-0x00007FF6D2B01000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads