xmrig | 8b7484cee8f8ae358790f6effc85f9973a78f2ac05f7e35c59a6f02b880743b3

Analysis

max time kernel
132s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
Size 1.0MB
Sample240524-c8jmqaae47
SHA256 8b7484cee8f8ae358790f6effc85f9973a78f2ac05f7e35c59a6f02b880743b3
MD5 6d1717194a80cc0f465d511569e4efea
SHA1 7cc676668c9bf783630e31951c3829132e751434
SHA512 49418b39081f79f1531755ea725e572d54b0b27ef51f0ae854bf378a36dbc5c016ca43cb331878162d20fb888be6e001b75860c1839a826c6841d9cd9a405303
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBLf:knw9oUUEEDl37jcq41
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/3560-56-0x00007FF755420000-0x00007FF755811000-memory.dmp	xmrig
behavioral2/memory/924-70-0x00007FF77C010000-0x00007FF77C401000-memory.dmp	xmrig
behavioral2/memory/2376-378-0x00007FF60EA10000-0x00007FF60EE01000-memory.dmp	xmrig
behavioral2/memory/4896-379-0x00007FF6B8260000-0x00007FF6B8651000-memory.dmp	xmrig
behavioral2/memory/3224-381-0x00007FF64C140000-0x00007FF64C531000-memory.dmp	xmrig
behavioral2/memory/2068-382-0x00007FF7E4080000-0x00007FF7E4471000-memory.dmp	xmrig
behavioral2/memory/1028-383-0x00007FF774850000-0x00007FF774C41000-memory.dmp	xmrig
behavioral2/memory/4948-384-0x00007FF705810000-0x00007FF705C01000-memory.dmp	xmrig
behavioral2/memory/1532-385-0x00007FF734E30000-0x00007FF735221000-memory.dmp	xmrig
behavioral2/memory/652-387-0x00007FF65F770000-0x00007FF65FB61000-memory.dmp	xmrig
behavioral2/memory/3616-388-0x00007FF61E4E0000-0x00007FF61E8D1000-memory.dmp	xmrig
behavioral2/memory/432-386-0x00007FF7CEB90000-0x00007FF7CEF81000-memory.dmp	xmrig
behavioral2/memory/4688-380-0x00007FF6A0CC0000-0x00007FF6A10B1000-memory.dmp	xmrig
behavioral2/memory/3868-71-0x00007FF65DD60000-0x00007FF65E151000-memory.dmp	xmrig
behavioral2/memory/2924-67-0x00007FF7865E0000-0x00007FF7869D1000-memory.dmp	xmrig
behavioral2/memory/4428-59-0x00007FF7138F0000-0x00007FF713CE1000-memory.dmp	xmrig
behavioral2/memory/2552-2009-0x00007FF67E140000-0x00007FF67E531000-memory.dmp	xmrig
behavioral2/memory/336-2010-0x00007FF75A6B0000-0x00007FF75AAA1000-memory.dmp	xmrig
behavioral2/memory/1052-2011-0x00007FF6E1B80000-0x00007FF6E1F71000-memory.dmp	xmrig
behavioral2/memory/4872-2012-0x00007FF7E1D40000-0x00007FF7E2131000-memory.dmp	xmrig
behavioral2/memory/3800-2013-0x00007FF7BA8A0000-0x00007FF7BAC91000-memory.dmp	xmrig
behavioral2/memory/1552-2025-0x00007FF693DB0000-0x00007FF6941A1000-memory.dmp	xmrig
behavioral2/memory/1332-2048-0x00007FF678210000-0x00007FF678601000-memory.dmp	xmrig
behavioral2/memory/3304-2050-0x00007FF730BD0000-0x00007FF730FC1000-memory.dmp	xmrig
behavioral2/memory/2120-2062-0x00007FF77E330000-0x00007FF77E721000-memory.dmp	xmrig
behavioral2/memory/2552-2064-0x00007FF67E140000-0x00007FF67E531000-memory.dmp	xmrig
behavioral2/memory/4428-2067-0x00007FF7138F0000-0x00007FF713CE1000-memory.dmp	xmrig
behavioral2/memory/1052-2068-0x00007FF6E1B80000-0x00007FF6E1F71000-memory.dmp	xmrig
behavioral2/memory/3560-2070-0x00007FF755420000-0x00007FF755811000-memory.dmp	xmrig
behavioral2/memory/336-2072-0x00007FF75A6B0000-0x00007FF75AAA1000-memory.dmp	xmrig
behavioral2/memory/2924-2074-0x00007FF7865E0000-0x00007FF7869D1000-memory.dmp	xmrig
behavioral2/memory/4872-2076-0x00007FF7E1D40000-0x00007FF7E2131000-memory.dmp	xmrig
behavioral2/memory/3800-2083-0x00007FF7BA8A0000-0x00007FF7BAC91000-memory.dmp	xmrig
behavioral2/memory/924-2085-0x00007FF77C010000-0x00007FF77C401000-memory.dmp	xmrig
behavioral2/memory/3304-2086-0x00007FF730BD0000-0x00007FF730FC1000-memory.dmp	xmrig
behavioral2/memory/2376-2090-0x00007FF60EA10000-0x00007FF60EE01000-memory.dmp	xmrig
behavioral2/memory/3224-2094-0x00007FF64C140000-0x00007FF64C531000-memory.dmp	xmrig
behavioral2/memory/2068-2096-0x00007FF7E4080000-0x00007FF7E4471000-memory.dmp	xmrig
behavioral2/memory/4688-2092-0x00007FF6A0CC0000-0x00007FF6A10B1000-memory.dmp	xmrig
behavioral2/memory/4896-2088-0x00007FF6B8260000-0x00007FF6B8651000-memory.dmp	xmrig
behavioral2/memory/3868-2079-0x00007FF65DD60000-0x00007FF65E151000-memory.dmp	xmrig
behavioral2/memory/1552-2081-0x00007FF693DB0000-0x00007FF6941A1000-memory.dmp	xmrig
behavioral2/memory/1532-2119-0x00007FF734E30000-0x00007FF735221000-memory.dmp	xmrig
behavioral2/memory/3616-2135-0x00007FF61E4E0000-0x00007FF61E8D1000-memory.dmp	xmrig
behavioral2/memory/1028-2131-0x00007FF774850000-0x00007FF774C41000-memory.dmp	xmrig
behavioral2/memory/432-2134-0x00007FF7CEB90000-0x00007FF7CEF81000-memory.dmp	xmrig
behavioral2/memory/652-2121-0x00007FF65F770000-0x00007FF65FB61000-memory.dmp	xmrig
behavioral2/memory/4948-2120-0x00007FF705810000-0x00007FF705C01000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2120	cKaEfuv.exe
2552	wDbFyny.exe
3560	GMGwyZi.exe
336	mEdLdHy.exe
1052	MerWWCY.exe
4428	HDyrnWK.exe
4872	rUwUucp.exe
2924	vHJDmHr.exe
3800	xplacFN.exe
924	yDPPzBD.exe
3868	nTtJvci.exe
1552	ugoknnD.exe
3304	VzCdRPn.exe
2376	ZQpJDOZ.exe
4896	tFBUlKQ.exe
4688	iOdpWDi.exe
3224	QTTUCre.exe
2068	FpLGLZi.exe
1028	HfRoXFW.exe
4948	WrlRXwl.exe
1532	DGHNFxB.exe
432	dSJYnEI.exe
652	cAjoCeC.exe
3616	IhesWAz.exe
844	nfuaxeM.exe
4068	hhnYdDb.exe
1924	uLLXLHy.exe
4936	hplqZcN.exe
3348	pJmQryi.exe
3464	kpomvNf.exe
2036	grSWaID.exe
4720	gCeTQcd.exe
2760	qSMIjta.exe
3952	BcoyESk.exe
4080	ahCUMai.exe
3052	sWyYdbm.exe
2840	ffPCCro.exe
4344	sRpAVeJ.exe
2888	iRadfwg.exe
464	PmuEywS.exe
2952	QiZbUTy.exe
1920	ekRHkDo.exe
384	NKbEYXE.exe
4732	MBdTtsu.exe
2904	UZjgGFe.exe
3060	NrwKdUH.exe
4332	ySTrPyk.exe
4296	elfANNH.exe
1184	EiKfBMk.exe
2128	JCfjUSJ.exe
4884	hSbXelt.exe
3692	gSbFmVM.exe
4796	coMfgGN.exe
2876	FDLkUzq.exe
2812	VmToJkD.exe
4904	sneqtvT.exe
4204	BiswoiF.exe
2328	YgUvmOh.exe
3160	znLVLsS.exe
3032	fFPCuzk.exe
1572	EGWvDim.exe
4468	wkBqXbX.exe
3956	kskMHjF.exe
1108	YdQmcsX.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1332-0-0x00007FF678210000-0x00007FF678601000-memory.dmp	upx
behavioral2/files/0x00090000000233f8-4.dat	upx
behavioral2/files/0x0007000000023400-11.dat	upx
behavioral2/files/0x0007000000023401-21.dat	upx
behavioral2/files/0x0007000000023404-23.dat	upx
behavioral2/files/0x0007000000023406-32.dat	upx
behavioral2/files/0x0007000000023403-38.dat	upx
behavioral2/files/0x0007000000023407-44.dat	upx
behavioral2/memory/3560-56-0x00007FF755420000-0x00007FF755811000-memory.dmp	upx
behavioral2/files/0x0007000000023409-63.dat	upx
behavioral2/memory/924-70-0x00007FF77C010000-0x00007FF77C401000-memory.dmp	upx
behavioral2/files/0x000700000002340b-73.dat	upx
behavioral2/files/0x000700000002340c-86.dat	upx
behavioral2/files/0x000700000002340e-96.dat	upx
behavioral2/files/0x0007000000023411-117.dat	upx
behavioral2/files/0x0007000000023417-141.dat	upx
behavioral2/files/0x0007000000023419-157.dat	upx
behavioral2/files/0x000700000002341d-171.dat	upx
behavioral2/memory/2376-378-0x00007FF60EA10000-0x00007FF60EE01000-memory.dmp	upx
behavioral2/memory/4896-379-0x00007FF6B8260000-0x00007FF6B8651000-memory.dmp	upx
behavioral2/memory/3224-381-0x00007FF64C140000-0x00007FF64C531000-memory.dmp	upx
behavioral2/memory/2068-382-0x00007FF7E4080000-0x00007FF7E4471000-memory.dmp	upx
behavioral2/memory/1028-383-0x00007FF774850000-0x00007FF774C41000-memory.dmp	upx
behavioral2/memory/4948-384-0x00007FF705810000-0x00007FF705C01000-memory.dmp	upx
behavioral2/memory/1532-385-0x00007FF734E30000-0x00007FF735221000-memory.dmp	upx
behavioral2/memory/652-387-0x00007FF65F770000-0x00007FF65FB61000-memory.dmp	upx
behavioral2/memory/3616-388-0x00007FF61E4E0000-0x00007FF61E8D1000-memory.dmp	upx
behavioral2/memory/432-386-0x00007FF7CEB90000-0x00007FF7CEF81000-memory.dmp	upx
behavioral2/memory/4688-380-0x00007FF6A0CC0000-0x00007FF6A10B1000-memory.dmp	upx
behavioral2/files/0x000700000002341e-175.dat	upx
behavioral2/files/0x000700000002341c-169.dat	upx
behavioral2/files/0x000700000002341b-164.dat	upx
behavioral2/files/0x000700000002341a-159.dat	upx
behavioral2/files/0x0007000000023418-149.dat	upx
behavioral2/files/0x0007000000023416-139.dat	upx
behavioral2/files/0x0007000000023415-137.dat	upx
behavioral2/files/0x0007000000023414-130.dat	upx
behavioral2/files/0x0007000000023413-127.dat	upx
behavioral2/files/0x0007000000023412-122.dat	upx
behavioral2/files/0x0007000000023410-112.dat	upx
behavioral2/files/0x000700000002340f-104.dat	upx
behavioral2/files/0x000700000002340d-94.dat	upx
behavioral2/files/0x00080000000233fd-85.dat	upx
behavioral2/memory/3304-79-0x00007FF730BD0000-0x00007FF730FC1000-memory.dmp	upx
behavioral2/files/0x000700000002340a-76.dat	upx
behavioral2/memory/1552-75-0x00007FF693DB0000-0x00007FF6941A1000-memory.dmp	upx
behavioral2/memory/3868-71-0x00007FF65DD60000-0x00007FF65E151000-memory.dmp	upx
behavioral2/memory/2924-67-0x00007FF7865E0000-0x00007FF7869D1000-memory.dmp	upx
behavioral2/files/0x0007000000023408-60.dat	upx
behavioral2/memory/4428-59-0x00007FF7138F0000-0x00007FF713CE1000-memory.dmp	upx
behavioral2/memory/3800-52-0x00007FF7BA8A0000-0x00007FF7BAC91000-memory.dmp	upx
behavioral2/memory/4872-48-0x00007FF7E1D40000-0x00007FF7E2131000-memory.dmp	upx
behavioral2/files/0x0007000000023405-47.dat	upx
behavioral2/memory/1052-43-0x00007FF6E1B80000-0x00007FF6E1F71000-memory.dmp	upx
behavioral2/files/0x0007000000023402-40.dat	upx
behavioral2/memory/336-31-0x00007FF75A6B0000-0x00007FF75AAA1000-memory.dmp	upx
behavioral2/memory/2552-20-0x00007FF67E140000-0x00007FF67E531000-memory.dmp	upx
behavioral2/memory/2120-14-0x00007FF77E330000-0x00007FF77E721000-memory.dmp	upx
behavioral2/memory/2552-2009-0x00007FF67E140000-0x00007FF67E531000-memory.dmp	upx
behavioral2/memory/336-2010-0x00007FF75A6B0000-0x00007FF75AAA1000-memory.dmp	upx
behavioral2/memory/1052-2011-0x00007FF6E1B80000-0x00007FF6E1F71000-memory.dmp	upx
behavioral2/memory/4872-2012-0x00007FF7E1D40000-0x00007FF7E2131000-memory.dmp	upx
behavioral2/memory/3800-2013-0x00007FF7BA8A0000-0x00007FF7BAC91000-memory.dmp	upx
behavioral2/memory/1552-2025-0x00007FF693DB0000-0x00007FF6941A1000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\BcoyESk.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\xNESjvt.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\TEXDNAE.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\SKrLYTg.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\znLVLsS.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\cCwQNOo.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\vcASWEO.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\pNcgAHe.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\YQRmojY.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\DNEHlUh.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\MlZUPGE.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\ycWYwOg.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\pHBJGxq.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\uRDIgxM.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\JCfjUSJ.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\wkBqXbX.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\OWSaigT.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\zLmWApL.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\NKMXkGa.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\GpredSp.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\sHhjjfg.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\ioGSVPc.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\zcVbJxR.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\hyVwXwa.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\MIrEAEb.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\zcecWCD.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\CPBHRMw.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\QujYhBg.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\qVSnTXI.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\DGHNFxB.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\vOsXHvV.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\SoOjDxH.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\ToRCLZA.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\cVawhrU.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\eywgWjC.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\UIfMoeZ.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\KqvIjtZ.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\itijiWo.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\QEzdFrq.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\cnykrye.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\dDToVDy.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\hoowVZf.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\JqLngGu.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\NKFrPRx.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\AMDWUDS.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\coMfgGN.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\ORIfDqu.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\DKasFFT.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\KdshabB.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\FvDAZYU.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\WAUPpwx.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\whHkixn.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\NKbEYXE.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\aMxNHIB.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\uLYDhDx.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\KUKZktM.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\PosbQfH.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\GMGwyZi.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\ZtcgXhF.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\vvaGNRN.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\ehKoLBy.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\auSCfEA.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\kHxYqRD.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
File created	C:\Windows\System32\WRpNNVr.exe	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 2120	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	83
PID 1332 wrote to memory of 2120	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	83
PID 1332 wrote to memory of 2552	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	84
PID 1332 wrote to memory of 2552	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	84
PID 1332 wrote to memory of 1052	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	85
PID 1332 wrote to memory of 1052	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	85
PID 1332 wrote to memory of 3560	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	86
PID 1332 wrote to memory of 3560	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	86
PID 1332 wrote to memory of 336	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	87
PID 1332 wrote to memory of 336	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	87
PID 1332 wrote to memory of 4428	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	88
PID 1332 wrote to memory of 4428	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	88
PID 1332 wrote to memory of 4872	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	89
PID 1332 wrote to memory of 4872	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	89
PID 1332 wrote to memory of 2924	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	90
PID 1332 wrote to memory of 2924	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	90
PID 1332 wrote to memory of 3800	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	91
PID 1332 wrote to memory of 3800	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	91
PID 1332 wrote to memory of 924	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	92
PID 1332 wrote to memory of 924	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	92
PID 1332 wrote to memory of 3868	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	93
PID 1332 wrote to memory of 3868	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	93
PID 1332 wrote to memory of 1552	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	94
PID 1332 wrote to memory of 1552	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	94
PID 1332 wrote to memory of 3304	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	95
PID 1332 wrote to memory of 3304	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	95
PID 1332 wrote to memory of 2376	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	96
PID 1332 wrote to memory of 2376	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	96
PID 1332 wrote to memory of 4896	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	97
PID 1332 wrote to memory of 4896	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	97
PID 1332 wrote to memory of 4688	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	98
PID 1332 wrote to memory of 4688	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	98
PID 1332 wrote to memory of 3224	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	99
PID 1332 wrote to memory of 3224	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	99
PID 1332 wrote to memory of 2068	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	100
PID 1332 wrote to memory of 2068	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	100
PID 1332 wrote to memory of 1028	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	101
PID 1332 wrote to memory of 1028	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	101
PID 1332 wrote to memory of 4948	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	102
PID 1332 wrote to memory of 4948	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	102
PID 1332 wrote to memory of 1532	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	103
PID 1332 wrote to memory of 1532	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	103
PID 1332 wrote to memory of 432	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	104
PID 1332 wrote to memory of 432	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	104
PID 1332 wrote to memory of 652	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	105
PID 1332 wrote to memory of 652	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	105
PID 1332 wrote to memory of 3616	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	106
PID 1332 wrote to memory of 3616	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	106
PID 1332 wrote to memory of 844	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	107
PID 1332 wrote to memory of 844	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	107
PID 1332 wrote to memory of 4068	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	108
PID 1332 wrote to memory of 4068	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	108
PID 1332 wrote to memory of 1924	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	109
PID 1332 wrote to memory of 1924	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	109
PID 1332 wrote to memory of 4936	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	110
PID 1332 wrote to memory of 4936	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	110
PID 1332 wrote to memory of 3348	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	111
PID 1332 wrote to memory of 3348	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	111
PID 1332 wrote to memory of 3464	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	112
PID 1332 wrote to memory of 3464	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	112
PID 1332 wrote to memory of 2036	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	113
PID 1332 wrote to memory of 2036	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	113
PID 1332 wrote to memory of 4720	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	114
PID 1332 wrote to memory of 4720	1332	6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe	114

C:\Users\Admin\AppData\Local\Temp\6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6d1717194a80cc0f465d511569e4efea_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Windows\System32\cKaEfuv.exe
  C:\Windows\System32\cKaEfuv.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System32\wDbFyny.exe
  C:\Windows\System32\wDbFyny.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System32\MerWWCY.exe
  C:\Windows\System32\MerWWCY.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System32\GMGwyZi.exe
  C:\Windows\System32\GMGwyZi.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System32\mEdLdHy.exe
  C:\Windows\System32\mEdLdHy.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System32\HDyrnWK.exe
  C:\Windows\System32\HDyrnWK.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System32\rUwUucp.exe
  C:\Windows\System32\rUwUucp.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System32\vHJDmHr.exe
  C:\Windows\System32\vHJDmHr.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System32\xplacFN.exe
  C:\Windows\System32\xplacFN.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System32\yDPPzBD.exe
  C:\Windows\System32\yDPPzBD.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System32\nTtJvci.exe
  C:\Windows\System32\nTtJvci.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System32\ugoknnD.exe
  C:\Windows\System32\ugoknnD.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System32\VzCdRPn.exe
  C:\Windows\System32\VzCdRPn.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System32\ZQpJDOZ.exe
  C:\Windows\System32\ZQpJDOZ.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System32\tFBUlKQ.exe
  C:\Windows\System32\tFBUlKQ.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System32\iOdpWDi.exe
  C:\Windows\System32\iOdpWDi.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System32\QTTUCre.exe
  C:\Windows\System32\QTTUCre.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System32\FpLGLZi.exe
  C:\Windows\System32\FpLGLZi.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System32\HfRoXFW.exe
  C:\Windows\System32\HfRoXFW.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System32\WrlRXwl.exe
  C:\Windows\System32\WrlRXwl.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System32\DGHNFxB.exe
  C:\Windows\System32\DGHNFxB.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System32\dSJYnEI.exe
  C:\Windows\System32\dSJYnEI.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System32\cAjoCeC.exe
  C:\Windows\System32\cAjoCeC.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System32\IhesWAz.exe
  C:\Windows\System32\IhesWAz.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System32\nfuaxeM.exe
  C:\Windows\System32\nfuaxeM.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System32\hhnYdDb.exe
  C:\Windows\System32\hhnYdDb.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System32\uLLXLHy.exe
  C:\Windows\System32\uLLXLHy.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System32\hplqZcN.exe
  C:\Windows\System32\hplqZcN.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System32\pJmQryi.exe
  C:\Windows\System32\pJmQryi.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System32\kpomvNf.exe
  C:\Windows\System32\kpomvNf.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System32\grSWaID.exe
  C:\Windows\System32\grSWaID.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System32\gCeTQcd.exe
  C:\Windows\System32\gCeTQcd.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System32\qSMIjta.exe
  C:\Windows\System32\qSMIjta.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System32\BcoyESk.exe
  C:\Windows\System32\BcoyESk.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System32\ahCUMai.exe
  C:\Windows\System32\ahCUMai.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System32\sWyYdbm.exe
  C:\Windows\System32\sWyYdbm.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System32\ffPCCro.exe
  C:\Windows\System32\ffPCCro.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System32\sRpAVeJ.exe
  C:\Windows\System32\sRpAVeJ.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System32\iRadfwg.exe
  C:\Windows\System32\iRadfwg.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System32\PmuEywS.exe
  C:\Windows\System32\PmuEywS.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System32\QiZbUTy.exe
  C:\Windows\System32\QiZbUTy.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System32\ekRHkDo.exe
  C:\Windows\System32\ekRHkDo.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System32\NKbEYXE.exe
  C:\Windows\System32\NKbEYXE.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System32\MBdTtsu.exe
  C:\Windows\System32\MBdTtsu.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System32\UZjgGFe.exe
  C:\Windows\System32\UZjgGFe.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System32\NrwKdUH.exe
  C:\Windows\System32\NrwKdUH.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System32\ySTrPyk.exe
  C:\Windows\System32\ySTrPyk.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System32\elfANNH.exe
  C:\Windows\System32\elfANNH.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System32\EiKfBMk.exe
  C:\Windows\System32\EiKfBMk.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System32\JCfjUSJ.exe
  C:\Windows\System32\JCfjUSJ.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System32\hSbXelt.exe
  C:\Windows\System32\hSbXelt.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System32\gSbFmVM.exe
  C:\Windows\System32\gSbFmVM.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System32\coMfgGN.exe
  C:\Windows\System32\coMfgGN.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System32\FDLkUzq.exe
  C:\Windows\System32\FDLkUzq.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System32\VmToJkD.exe
  C:\Windows\System32\VmToJkD.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System32\sneqtvT.exe
  C:\Windows\System32\sneqtvT.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System32\BiswoiF.exe
  C:\Windows\System32\BiswoiF.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System32\YgUvmOh.exe
  C:\Windows\System32\YgUvmOh.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System32\znLVLsS.exe
  C:\Windows\System32\znLVLsS.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System32\fFPCuzk.exe
  C:\Windows\System32\fFPCuzk.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System32\EGWvDim.exe
  C:\Windows\System32\EGWvDim.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System32\wkBqXbX.exe
  C:\Windows\System32\wkBqXbX.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System32\kskMHjF.exe
  C:\Windows\System32\kskMHjF.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System32\YdQmcsX.exe
  C:\Windows\System32\YdQmcsX.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System32\qBTXDbA.exe
  C:\Windows\System32\qBTXDbA.exe
  2⤵
  PID:1040
- C:\Windows\System32\VqXoSDJ.exe
  C:\Windows\System32\VqXoSDJ.exe
  2⤵
  PID:3908
- C:\Windows\System32\IOOfGYe.exe
  C:\Windows\System32\IOOfGYe.exe
  2⤵
  PID:2932
- C:\Windows\System32\sWMjrLk.exe
  C:\Windows\System32\sWMjrLk.exe
  2⤵
  PID:2956
- C:\Windows\System32\pRJpiqX.exe
  C:\Windows\System32\pRJpiqX.exe
  2⤵
  PID:3984
- C:\Windows\System32\kHxYqRD.exe
  C:\Windows\System32\kHxYqRD.exe
  2⤵
  PID:4440
- C:\Windows\System32\jzrYSVV.exe
  C:\Windows\System32\jzrYSVV.exe
  2⤵
  PID:2312
- C:\Windows\System32\ZtcgXhF.exe
  C:\Windows\System32\ZtcgXhF.exe
  2⤵
  PID:4544
- C:\Windows\System32\ORIfDqu.exe
  C:\Windows\System32\ORIfDqu.exe
  2⤵
  PID:2440
- C:\Windows\System32\ymLlOwQ.exe
  C:\Windows\System32\ymLlOwQ.exe
  2⤵
  PID:2116
- C:\Windows\System32\QrGczog.exe
  C:\Windows\System32\QrGczog.exe
  2⤵
  PID:5012
- C:\Windows\System32\DKasFFT.exe
  C:\Windows\System32\DKasFFT.exe
  2⤵
  PID:3704
- C:\Windows\System32\vzDoCkj.exe
  C:\Windows\System32\vzDoCkj.exe
  2⤵
  PID:676
- C:\Windows\System32\gwdffLJ.exe
  C:\Windows\System32\gwdffLJ.exe
  2⤵
  PID:116
- C:\Windows\System32\hecbuMT.exe
  C:\Windows\System32\hecbuMT.exe
  2⤵
  PID:1340
- C:\Windows\System32\KVsPNJW.exe
  C:\Windows\System32\KVsPNJW.exe
  2⤵
  PID:3416
- C:\Windows\System32\ZkfgGXH.exe
  C:\Windows\System32\ZkfgGXH.exe
  2⤵
  PID:2896
- C:\Windows\System32\bMmfjrQ.exe
  C:\Windows\System32\bMmfjrQ.exe
  2⤵
  PID:1612
- C:\Windows\System32\tGlVpoN.exe
  C:\Windows\System32\tGlVpoN.exe
  2⤵
  PID:1716
- C:\Windows\System32\mpsJKoP.exe
  C:\Windows\System32\mpsJKoP.exe
  2⤵
  PID:2680
- C:\Windows\System32\VylAjiB.exe
  C:\Windows\System32\VylAjiB.exe
  2⤵
  PID:1524
- C:\Windows\System32\mbKVmXw.exe
  C:\Windows\System32\mbKVmXw.exe
  2⤵
  PID:5124
- C:\Windows\System32\slOxPsb.exe
  C:\Windows\System32\slOxPsb.exe
  2⤵
  PID:5148
- C:\Windows\System32\WPkknol.exe
  C:\Windows\System32\WPkknol.exe
  2⤵
  PID:5184
- C:\Windows\System32\QZCBYIi.exe
  C:\Windows\System32\QZCBYIi.exe
  2⤵
  PID:5200
- C:\Windows\System32\GpredSp.exe
  C:\Windows\System32\GpredSp.exe
  2⤵
  PID:5232
- C:\Windows\System32\IkPacvh.exe
  C:\Windows\System32\IkPacvh.exe
  2⤵
  PID:5256
- C:\Windows\System32\vOsXHvV.exe
  C:\Windows\System32\vOsXHvV.exe
  2⤵
  PID:5296
- C:\Windows\System32\bhOOcCy.exe
  C:\Windows\System32\bhOOcCy.exe
  2⤵
  PID:5312
- C:\Windows\System32\nzTkEkY.exe
  C:\Windows\System32\nzTkEkY.exe
  2⤵
  PID:5344
- C:\Windows\System32\juHljuV.exe
  C:\Windows\System32\juHljuV.exe
  2⤵
  PID:5368
- C:\Windows\System32\PpDvLcn.exe
  C:\Windows\System32\PpDvLcn.exe
  2⤵
  PID:5408
- C:\Windows\System32\caVFFIX.exe
  C:\Windows\System32\caVFFIX.exe
  2⤵
  PID:5424
- C:\Windows\System32\YSMAPdU.exe
  C:\Windows\System32\YSMAPdU.exe
  2⤵
  PID:5452
- C:\Windows\System32\cDAQqTl.exe
  C:\Windows\System32\cDAQqTl.exe
  2⤵
  PID:5484
- C:\Windows\System32\qKocRcQ.exe
  C:\Windows\System32\qKocRcQ.exe
  2⤵
  PID:5508
- C:\Windows\System32\FgMsdHV.exe
  C:\Windows\System32\FgMsdHV.exe
  2⤵
  PID:5608
- C:\Windows\System32\KOmneAG.exe
  C:\Windows\System32\KOmneAG.exe
  2⤵
  PID:5644
- C:\Windows\System32\FLSBnNL.exe
  C:\Windows\System32\FLSBnNL.exe
  2⤵
  PID:5660
- C:\Windows\System32\LyiwFhx.exe
  C:\Windows\System32\LyiwFhx.exe
  2⤵
  PID:5692
- C:\Windows\System32\XVyouAy.exe
  C:\Windows\System32\XVyouAy.exe
  2⤵
  PID:5716
- C:\Windows\System32\mIYOcoc.exe
  C:\Windows\System32\mIYOcoc.exe
  2⤵
  PID:5748
- C:\Windows\System32\pOSRlZa.exe
  C:\Windows\System32\pOSRlZa.exe
  2⤵
  PID:5768
- C:\Windows\System32\sHhjjfg.exe
  C:\Windows\System32\sHhjjfg.exe
  2⤵
  PID:5788
- C:\Windows\System32\sTMCGNU.exe
  C:\Windows\System32\sTMCGNU.exe
  2⤵
  PID:5812
- C:\Windows\System32\eywgWjC.exe
  C:\Windows\System32\eywgWjC.exe
  2⤵
  PID:5860
- C:\Windows\System32\zFVotbL.exe
  C:\Windows\System32\zFVotbL.exe
  2⤵
  PID:5880
- C:\Windows\System32\OJpHVUW.exe
  C:\Windows\System32\OJpHVUW.exe
  2⤵
  PID:5912
- C:\Windows\System32\aMxNHIB.exe
  C:\Windows\System32\aMxNHIB.exe
  2⤵
  PID:5936
- C:\Windows\System32\VQyvfAg.exe
  C:\Windows\System32\VQyvfAg.exe
  2⤵
  PID:5976
- C:\Windows\System32\lLvDSja.exe
  C:\Windows\System32\lLvDSja.exe
  2⤵
  PID:5992
- C:\Windows\System32\omevvFX.exe
  C:\Windows\System32\omevvFX.exe
  2⤵
  PID:6028
- C:\Windows\System32\xBwoCds.exe
  C:\Windows\System32\xBwoCds.exe
  2⤵
  PID:6056
- C:\Windows\System32\juXLRpO.exe
  C:\Windows\System32\juXLRpO.exe
  2⤵
  PID:6104
- C:\Windows\System32\HHnBJXq.exe
  C:\Windows\System32\HHnBJXq.exe
  2⤵
  PID:6132
- C:\Windows\System32\zzZRROm.exe
  C:\Windows\System32\zzZRROm.exe
  2⤵
  PID:3140
- C:\Windows\System32\NsAzfwt.exe
  C:\Windows\System32\NsAzfwt.exe
  2⤵
  PID:2468
- C:\Windows\System32\tRXCPKi.exe
  C:\Windows\System32\tRXCPKi.exe
  2⤵
  PID:3796
- C:\Windows\System32\EJCBSJM.exe
  C:\Windows\System32\EJCBSJM.exe
  2⤵
  PID:1012
- C:\Windows\System32\QNDThfx.exe
  C:\Windows\System32\QNDThfx.exe
  2⤵
  PID:5132
- C:\Windows\System32\fcWMzhP.exe
  C:\Windows\System32\fcWMzhP.exe
  2⤵
  PID:5168
- C:\Windows\System32\eSpJQHq.exe
  C:\Windows\System32\eSpJQHq.exe
  2⤵
  PID:4376
- C:\Windows\System32\AMNRtFf.exe
  C:\Windows\System32\AMNRtFf.exe
  2⤵
  PID:5220
- C:\Windows\System32\ToUvkpd.exe
  C:\Windows\System32\ToUvkpd.exe
  2⤵
  PID:5248
- C:\Windows\System32\FLcrWsB.exe
  C:\Windows\System32\FLcrWsB.exe
  2⤵
  PID:5284
- C:\Windows\System32\qqbibpe.exe
  C:\Windows\System32\qqbibpe.exe
  2⤵
  PID:5332
- C:\Windows\System32\QfVibNq.exe
  C:\Windows\System32\QfVibNq.exe
  2⤵
  PID:4288
- C:\Windows\System32\LbiNhjG.exe
  C:\Windows\System32\LbiNhjG.exe
  2⤵
  PID:4608
- C:\Windows\System32\vvRkOxz.exe
  C:\Windows\System32\vvRkOxz.exe
  2⤵
  PID:4804
- C:\Windows\System32\fmaNEZY.exe
  C:\Windows\System32\fmaNEZY.exe
  2⤵
  PID:4484
- C:\Windows\System32\QsNvyLm.exe
  C:\Windows\System32\QsNvyLm.exe
  2⤵
  PID:3508
- C:\Windows\System32\aUIIhJS.exe
  C:\Windows\System32\aUIIhJS.exe
  2⤵
  PID:664
- C:\Windows\System32\EvTlBTJ.exe
  C:\Windows\System32\EvTlBTJ.exe
  2⤵
  PID:5672
- C:\Windows\System32\KGYpqCc.exe
  C:\Windows\System32\KGYpqCc.exe
  2⤵
  PID:5736
- C:\Windows\System32\oTfmhbl.exe
  C:\Windows\System32\oTfmhbl.exe
  2⤵
  PID:4976
- C:\Windows\System32\jsLkqsj.exe
  C:\Windows\System32\jsLkqsj.exe
  2⤵
  PID:5804
- C:\Windows\System32\wnkhlIW.exe
  C:\Windows\System32\wnkhlIW.exe
  2⤵
  PID:5848
- C:\Windows\System32\sCHhgCy.exe
  C:\Windows\System32\sCHhgCy.exe
  2⤵
  PID:5892
- C:\Windows\System32\OWSaigT.exe
  C:\Windows\System32\OWSaigT.exe
  2⤵
  PID:4424
- C:\Windows\System32\uyEjOyB.exe
  C:\Windows\System32\uyEjOyB.exe
  2⤵
  PID:3712
- C:\Windows\System32\YEGvppH.exe
  C:\Windows\System32\YEGvppH.exe
  2⤵
  PID:6088
- C:\Windows\System32\UJWHNtt.exe
  C:\Windows\System32\UJWHNtt.exe
  2⤵
  PID:2532
- C:\Windows\System32\WRpNNVr.exe
  C:\Windows\System32\WRpNNVr.exe
  2⤵
  PID:5556
- C:\Windows\System32\yGfeyPy.exe
  C:\Windows\System32\yGfeyPy.exe
  2⤵
  PID:5580
- C:\Windows\System32\eMfVtWP.exe
  C:\Windows\System32\eMfVtWP.exe
  2⤵
  PID:1576
- C:\Windows\System32\wIdyZPx.exe
  C:\Windows\System32\wIdyZPx.exe
  2⤵
  PID:4004
- C:\Windows\System32\uKvZIPg.exe
  C:\Windows\System32\uKvZIPg.exe
  2⤵
  PID:5140
- C:\Windows\System32\Xzfrivd.exe
  C:\Windows\System32\Xzfrivd.exe
  2⤵
  PID:5304
- C:\Windows\System32\SPUDgaI.exe
  C:\Windows\System32\SPUDgaI.exe
  2⤵
  PID:5380
- C:\Windows\System32\ubJebfB.exe
  C:\Windows\System32\ubJebfB.exe
  2⤵
  PID:1600
- C:\Windows\System32\peQvfSe.exe
  C:\Windows\System32\peQvfSe.exe
  2⤵
  PID:5636
- C:\Windows\System32\jegEuEt.exe
  C:\Windows\System32\jegEuEt.exe
  2⤵
  PID:5728
- C:\Windows\System32\kZOVIUF.exe
  C:\Windows\System32\kZOVIUF.exe
  2⤵
  PID:5780
- C:\Windows\System32\DNEHlUh.exe
  C:\Windows\System32\DNEHlUh.exe
  2⤵
  PID:5948
- C:\Windows\System32\gMwozCg.exe
  C:\Windows\System32\gMwozCg.exe
  2⤵
  PID:1128
- C:\Windows\System32\FttQTyp.exe
  C:\Windows\System32\FttQTyp.exe
  2⤵
  PID:2668
- C:\Windows\System32\JOYHbUe.exe
  C:\Windows\System32\JOYHbUe.exe
  2⤵
  PID:6128
- C:\Windows\System32\HtdlzXD.exe
  C:\Windows\System32\HtdlzXD.exe
  2⤵
  PID:5244
- C:\Windows\System32\ijEKHYX.exe
  C:\Windows\System32\ijEKHYX.exe
  2⤵
  PID:5592
- C:\Windows\System32\nlVVYyW.exe
  C:\Windows\System32\nlVVYyW.exe
  2⤵
  PID:2696
- C:\Windows\System32\XPvtxLw.exe
  C:\Windows\System32\XPvtxLw.exe
  2⤵
  PID:5796
- C:\Windows\System32\aXOqiyo.exe
  C:\Windows\System32\aXOqiyo.exe
  2⤵
  PID:4408
- C:\Windows\System32\cpREufK.exe
  C:\Windows\System32\cpREufK.exe
  2⤵
  PID:3036
- C:\Windows\System32\SoOjDxH.exe
  C:\Windows\System32\SoOjDxH.exe
  2⤵
  PID:6164
- C:\Windows\System32\cnKmkum.exe
  C:\Windows\System32\cnKmkum.exe
  2⤵
  PID:6184
- C:\Windows\System32\lQXHpPE.exe
  C:\Windows\System32\lQXHpPE.exe
  2⤵
  PID:6200
- C:\Windows\System32\JrtnrmN.exe
  C:\Windows\System32\JrtnrmN.exe
  2⤵
  PID:6224
- C:\Windows\System32\XAfPUvi.exe
  C:\Windows\System32\XAfPUvi.exe
  2⤵
  PID:6256
- C:\Windows\System32\nCaScBQ.exe
  C:\Windows\System32\nCaScBQ.exe
  2⤵
  PID:6292
- C:\Windows\System32\JYHGWCx.exe
  C:\Windows\System32\JYHGWCx.exe
  2⤵
  PID:6324
- C:\Windows\System32\JCyhfua.exe
  C:\Windows\System32\JCyhfua.exe
  2⤵
  PID:6352
- C:\Windows\System32\qTLhLjM.exe
  C:\Windows\System32\qTLhLjM.exe
  2⤵
  PID:6372
- C:\Windows\System32\qKLjAMi.exe
  C:\Windows\System32\qKLjAMi.exe
  2⤵
  PID:6432
- C:\Windows\System32\zLmWApL.exe
  C:\Windows\System32\zLmWApL.exe
  2⤵
  PID:6448
- C:\Windows\System32\tlbSFsh.exe
  C:\Windows\System32\tlbSFsh.exe
  2⤵
  PID:6464
- C:\Windows\System32\FhnCsde.exe
  C:\Windows\System32\FhnCsde.exe
  2⤵
  PID:6516
- C:\Windows\System32\OTlaZyu.exe
  C:\Windows\System32\OTlaZyu.exe
  2⤵
  PID:6532
- C:\Windows\System32\ioGSVPc.exe
  C:\Windows\System32\ioGSVPc.exe
  2⤵
  PID:6568
- C:\Windows\System32\vzCiqXl.exe
  C:\Windows\System32\vzCiqXl.exe
  2⤵
  PID:6588
- C:\Windows\System32\TZEWrxT.exe
  C:\Windows\System32\TZEWrxT.exe
  2⤵
  PID:6604
- C:\Windows\System32\KdshabB.exe
  C:\Windows\System32\KdshabB.exe
  2⤵
  PID:6640
- C:\Windows\System32\mLrGqJK.exe
  C:\Windows\System32\mLrGqJK.exe
  2⤵
  PID:6692
- C:\Windows\System32\BPOTKSk.exe
  C:\Windows\System32\BPOTKSk.exe
  2⤵
  PID:6724
- C:\Windows\System32\GhdUnIA.exe
  C:\Windows\System32\GhdUnIA.exe
  2⤵
  PID:6744
- C:\Windows\System32\asGrhrP.exe
  C:\Windows\System32\asGrhrP.exe
  2⤵
  PID:6760
- C:\Windows\System32\uLYDhDx.exe
  C:\Windows\System32\uLYDhDx.exe
  2⤵
  PID:6788
- C:\Windows\System32\ekorPPu.exe
  C:\Windows\System32\ekorPPu.exe
  2⤵
  PID:6808
- C:\Windows\System32\yQsuFVq.exe
  C:\Windows\System32\yQsuFVq.exe
  2⤵
  PID:6836
- C:\Windows\System32\OBrjWLw.exe
  C:\Windows\System32\OBrjWLw.exe
  2⤵
  PID:6872
- C:\Windows\System32\nTJhujG.exe
  C:\Windows\System32\nTJhujG.exe
  2⤵
  PID:6896
- C:\Windows\System32\jmtwusF.exe
  C:\Windows\System32\jmtwusF.exe
  2⤵
  PID:6952
- C:\Windows\System32\UUmchEF.exe
  C:\Windows\System32\UUmchEF.exe
  2⤵
  PID:6972
- C:\Windows\System32\haqmbuy.exe
  C:\Windows\System32\haqmbuy.exe
  2⤵
  PID:6996
- C:\Windows\System32\bsFSziP.exe
  C:\Windows\System32\bsFSziP.exe
  2⤵
  PID:7016
- C:\Windows\System32\SNNrFiU.exe
  C:\Windows\System32\SNNrFiU.exe
  2⤵
  PID:7036
- C:\Windows\System32\TxImhMV.exe
  C:\Windows\System32\TxImhMV.exe
  2⤵
  PID:7052
- C:\Windows\System32\bhwunWD.exe
  C:\Windows\System32\bhwunWD.exe
  2⤵
  PID:7080
- C:\Windows\System32\FDWAMPf.exe
  C:\Windows\System32\FDWAMPf.exe
  2⤵
  PID:7100
- C:\Windows\System32\zloJcqY.exe
  C:\Windows\System32\zloJcqY.exe
  2⤵
  PID:7120
- C:\Windows\System32\MIrEAEb.exe
  C:\Windows\System32\MIrEAEb.exe
  2⤵
  PID:7160
- C:\Windows\System32\VFxVevI.exe
  C:\Windows\System32\VFxVevI.exe
  2⤵
  PID:4984
- C:\Windows\System32\mQDvLis.exe
  C:\Windows\System32\mQDvLis.exe
  2⤵
  PID:6288
- C:\Windows\System32\NtyyuJX.exe
  C:\Windows\System32\NtyyuJX.exe
  2⤵
  PID:6232
- C:\Windows\System32\dkEdEuS.exe
  C:\Windows\System32\dkEdEuS.exe
  2⤵
  PID:6208
- C:\Windows\System32\sDEntsN.exe
  C:\Windows\System32\sDEntsN.exe
  2⤵
  PID:6380
- C:\Windows\System32\wmrFJRF.exe
  C:\Windows\System32\wmrFJRF.exe
  2⤵
  PID:6424
- C:\Windows\System32\UtmPyiA.exe
  C:\Windows\System32\UtmPyiA.exe
  2⤵
  PID:6444
- C:\Windows\System32\NKMXkGa.exe
  C:\Windows\System32\NKMXkGa.exe
  2⤵
  PID:6556
- C:\Windows\System32\TuulaNo.exe
  C:\Windows\System32\TuulaNo.exe
  2⤵
  PID:6600
- C:\Windows\System32\YIrfbBS.exe
  C:\Windows\System32\YIrfbBS.exe
  2⤵
  PID:6636
- C:\Windows\System32\JtvqwjW.exe
  C:\Windows\System32\JtvqwjW.exe
  2⤵
  PID:6852
- C:\Windows\System32\cvrPKNs.exe
  C:\Windows\System32\cvrPKNs.exe
  2⤵
  PID:6904
- C:\Windows\System32\yPUWHSj.exe
  C:\Windows\System32\yPUWHSj.exe
  2⤵
  PID:6968
- C:\Windows\System32\HhuIjQF.exe
  C:\Windows\System32\HhuIjQF.exe
  2⤵
  PID:7060
- C:\Windows\System32\RsiKAJO.exe
  C:\Windows\System32\RsiKAJO.exe
  2⤵
  PID:7076
- C:\Windows\System32\lSMpwBO.exe
  C:\Windows\System32\lSMpwBO.exe
  2⤵
  PID:7148
- C:\Windows\System32\BjXztqe.exe
  C:\Windows\System32\BjXztqe.exe
  2⤵
  PID:6216
- C:\Windows\System32\WBByuZX.exe
  C:\Windows\System32\WBByuZX.exe
  2⤵
  PID:6340
- C:\Windows\System32\iBPMDMr.exe
  C:\Windows\System32\iBPMDMr.exe
  2⤵
  PID:6268
- C:\Windows\System32\kqIMJox.exe
  C:\Windows\System32\kqIMJox.exe
  2⤵
  PID:6596
- C:\Windows\System32\KUKZktM.exe
  C:\Windows\System32\KUKZktM.exe
  2⤵
  PID:6796
- C:\Windows\System32\yRrzNlM.exe
  C:\Windows\System32\yRrzNlM.exe
  2⤵
  PID:7008
- C:\Windows\System32\PosbQfH.exe
  C:\Windows\System32\PosbQfH.exe
  2⤵
  PID:5924
- C:\Windows\System32\gvJKmuN.exe
  C:\Windows\System32\gvJKmuN.exe
  2⤵
  PID:6384
- C:\Windows\System32\cnykrye.exe
  C:\Windows\System32\cnykrye.exe
  2⤵
  PID:6884
- C:\Windows\System32\vmhdmOT.exe
  C:\Windows\System32\vmhdmOT.exe
  2⤵
  PID:6488
- C:\Windows\System32\SNuMhDa.exe
  C:\Windows\System32\SNuMhDa.exe
  2⤵
  PID:6984
- C:\Windows\System32\FvDAZYU.exe
  C:\Windows\System32\FvDAZYU.exe
  2⤵
  PID:7184
- C:\Windows\System32\ixczitT.exe
  C:\Windows\System32\ixczitT.exe
  2⤵
  PID:7204
- C:\Windows\System32\JePPURC.exe
  C:\Windows\System32\JePPURC.exe
  2⤵
  PID:7220
- C:\Windows\System32\MlZUPGE.exe
  C:\Windows\System32\MlZUPGE.exe
  2⤵
  PID:7244
- C:\Windows\System32\WAUPpwx.exe
  C:\Windows\System32\WAUPpwx.exe
  2⤵
  PID:7264
- C:\Windows\System32\aiYJrDf.exe
  C:\Windows\System32\aiYJrDf.exe
  2⤵
  PID:7308
- C:\Windows\System32\CFhAxqR.exe
  C:\Windows\System32\CFhAxqR.exe
  2⤵
  PID:7336
- C:\Windows\System32\FjKzJJj.exe
  C:\Windows\System32\FjKzJJj.exe
  2⤵
  PID:7360
- C:\Windows\System32\FJZoypg.exe
  C:\Windows\System32\FJZoypg.exe
  2⤵
  PID:7384
- C:\Windows\System32\PSwhBKM.exe
  C:\Windows\System32\PSwhBKM.exe
  2⤵
  PID:7400
- C:\Windows\System32\iLXnrhY.exe
  C:\Windows\System32\iLXnrhY.exe
  2⤵
  PID:7424
- C:\Windows\System32\EcdXhAD.exe
  C:\Windows\System32\EcdXhAD.exe
  2⤵
  PID:7476
- C:\Windows\System32\FuYlprf.exe
  C:\Windows\System32\FuYlprf.exe
  2⤵
  PID:7504
- C:\Windows\System32\TuPeDnq.exe
  C:\Windows\System32\TuPeDnq.exe
  2⤵
  PID:7520
- C:\Windows\System32\WuMBBvd.exe
  C:\Windows\System32\WuMBBvd.exe
  2⤵
  PID:7544
- C:\Windows\System32\dCfPGzJ.exe
  C:\Windows\System32\dCfPGzJ.exe
  2⤵
  PID:7564
- C:\Windows\System32\VJYGuvr.exe
  C:\Windows\System32\VJYGuvr.exe
  2⤵
  PID:7584
- C:\Windows\System32\tVWgpMe.exe
  C:\Windows\System32\tVWgpMe.exe
  2⤵
  PID:7600
- C:\Windows\System32\mivyqYF.exe
  C:\Windows\System32\mivyqYF.exe
  2⤵
  PID:7664
- C:\Windows\System32\ViSTHyn.exe
  C:\Windows\System32\ViSTHyn.exe
  2⤵
  PID:7708
- C:\Windows\System32\WkGNRnj.exe
  C:\Windows\System32\WkGNRnj.exe
  2⤵
  PID:7744
- C:\Windows\System32\hYEkxRe.exe
  C:\Windows\System32\hYEkxRe.exe
  2⤵
  PID:7764
- C:\Windows\System32\vvaGNRN.exe
  C:\Windows\System32\vvaGNRN.exe
  2⤵
  PID:7780
- C:\Windows\System32\dDToVDy.exe
  C:\Windows\System32\dDToVDy.exe
  2⤵
  PID:7800
- C:\Windows\System32\MKlXYUt.exe
  C:\Windows\System32\MKlXYUt.exe
  2⤵
  PID:7820
- C:\Windows\System32\xFUqVDv.exe
  C:\Windows\System32\xFUqVDv.exe
  2⤵
  PID:7844
- C:\Windows\System32\fazzngx.exe
  C:\Windows\System32\fazzngx.exe
  2⤵
  PID:7912
- C:\Windows\System32\KdFrSjL.exe
  C:\Windows\System32\KdFrSjL.exe
  2⤵
  PID:7936
- C:\Windows\System32\bPJfOSU.exe
  C:\Windows\System32\bPJfOSU.exe
  2⤵
  PID:7980
- C:\Windows\System32\aeMKtOf.exe
  C:\Windows\System32\aeMKtOf.exe
  2⤵
  PID:8004
- C:\Windows\System32\WZXXMoW.exe
  C:\Windows\System32\WZXXMoW.exe
  2⤵
  PID:8044
- C:\Windows\System32\qNcbIKO.exe
  C:\Windows\System32\qNcbIKO.exe
  2⤵
  PID:8068
- C:\Windows\System32\wieObXD.exe
  C:\Windows\System32\wieObXD.exe
  2⤵
  PID:8092
- C:\Windows\System32\geLQFdf.exe
  C:\Windows\System32\geLQFdf.exe
  2⤵
  PID:8108
- C:\Windows\System32\caAUgjc.exe
  C:\Windows\System32\caAUgjc.exe
  2⤵
  PID:8152
- C:\Windows\System32\DUzPpHW.exe
  C:\Windows\System32\DUzPpHW.exe
  2⤵
  PID:8180
- C:\Windows\System32\ycWYwOg.exe
  C:\Windows\System32\ycWYwOg.exe
  2⤵
  PID:7180
- C:\Windows\System32\CTceEFs.exe
  C:\Windows\System32\CTceEFs.exe
  2⤵
  PID:7196
- C:\Windows\System32\GxGNnDm.exe
  C:\Windows\System32\GxGNnDm.exe
  2⤵
  PID:7292
- C:\Windows\System32\WgJJdjD.exe
  C:\Windows\System32\WgJJdjD.exe
  2⤵
  PID:7356
- C:\Windows\System32\UyFOYCO.exe
  C:\Windows\System32\UyFOYCO.exe
  2⤵
  PID:7420
- C:\Windows\System32\OtQbXAL.exe
  C:\Windows\System32\OtQbXAL.exe
  2⤵
  PID:7512
- C:\Windows\System32\IhYZCJX.exe
  C:\Windows\System32\IhYZCJX.exe
  2⤵
  PID:7532
- C:\Windows\System32\hnbihpX.exe
  C:\Windows\System32\hnbihpX.exe
  2⤵
  PID:7632
- C:\Windows\System32\lprAPqH.exe
  C:\Windows\System32\lprAPqH.exe
  2⤵
  PID:7676
- C:\Windows\System32\TSuywXw.exe
  C:\Windows\System32\TSuywXw.exe
  2⤵
  PID:7776
- C:\Windows\System32\ZnAdMHM.exe
  C:\Windows\System32\ZnAdMHM.exe
  2⤵
  PID:7792
- C:\Windows\System32\lsKjvko.exe
  C:\Windows\System32\lsKjvko.exe
  2⤵
  PID:7876
- C:\Windows\System32\JVPuJeN.exe
  C:\Windows\System32\JVPuJeN.exe
  2⤵
  PID:7928
- C:\Windows\System32\oHsQBLf.exe
  C:\Windows\System32\oHsQBLf.exe
  2⤵
  PID:8052
- C:\Windows\System32\fdlQsYr.exe
  C:\Windows\System32\fdlQsYr.exe
  2⤵
  PID:8136
- C:\Windows\System32\hVdbHmU.exe
  C:\Windows\System32\hVdbHmU.exe
  2⤵
  PID:8176
- C:\Windows\System32\cAOGJYT.exe
  C:\Windows\System32\cAOGJYT.exe
  2⤵
  PID:7216
- C:\Windows\System32\hmUbzPm.exe
  C:\Windows\System32\hmUbzPm.exe
  2⤵
  PID:7444
- C:\Windows\System32\KFzZqDt.exe
  C:\Windows\System32\KFzZqDt.exe
  2⤵
  PID:7612
- C:\Windows\System32\mZYoKir.exe
  C:\Windows\System32\mZYoKir.exe
  2⤵
  PID:8164
- C:\Windows\System32\dgbuIBX.exe
  C:\Windows\System32\dgbuIBX.exe
  2⤵
  PID:7948
- C:\Windows\System32\qmPHYns.exe
  C:\Windows\System32\qmPHYns.exe
  2⤵
  PID:8080
- C:\Windows\System32\oupUhxI.exe
  C:\Windows\System32\oupUhxI.exe
  2⤵
  PID:8100
- C:\Windows\System32\sSZJUSK.exe
  C:\Windows\System32\sSZJUSK.exe
  2⤵
  PID:7716
- C:\Windows\System32\IkHfhKt.exe
  C:\Windows\System32\IkHfhKt.exe
  2⤵
  PID:8168
- C:\Windows\System32\KoypqUy.exe
  C:\Windows\System32\KoypqUy.exe
  2⤵
  PID:8148
- C:\Windows\System32\udjIeOK.exe
  C:\Windows\System32\udjIeOK.exe
  2⤵
  PID:8228
- C:\Windows\System32\hYfYAzb.exe
  C:\Windows\System32\hYfYAzb.exe
  2⤵
  PID:8252
- C:\Windows\System32\EvELumT.exe
  C:\Windows\System32\EvELumT.exe
  2⤵
  PID:8268
- C:\Windows\System32\GldFYiN.exe
  C:\Windows\System32\GldFYiN.exe
  2⤵
  PID:8288
- C:\Windows\System32\AdAstri.exe
  C:\Windows\System32\AdAstri.exe
  2⤵
  PID:8320
- C:\Windows\System32\zcVbJxR.exe
  C:\Windows\System32\zcVbJxR.exe
  2⤵
  PID:8336
- C:\Windows\System32\kgcbBuV.exe
  C:\Windows\System32\kgcbBuV.exe
  2⤵
  PID:8360
- C:\Windows\System32\gAKpcBk.exe
  C:\Windows\System32\gAKpcBk.exe
  2⤵
  PID:8380
- C:\Windows\System32\cWuixwW.exe
  C:\Windows\System32\cWuixwW.exe
  2⤵
  PID:8396
- C:\Windows\System32\bDAdWCs.exe
  C:\Windows\System32\bDAdWCs.exe
  2⤵
  PID:8416
- C:\Windows\System32\ToRCLZA.exe
  C:\Windows\System32\ToRCLZA.exe
  2⤵
  PID:8488
- C:\Windows\System32\GKozOsj.exe
  C:\Windows\System32\GKozOsj.exe
  2⤵
  PID:8504
- C:\Windows\System32\IpZvDdn.exe
  C:\Windows\System32\IpZvDdn.exe
  2⤵
  PID:8560
- C:\Windows\System32\mAqafjU.exe
  C:\Windows\System32\mAqafjU.exe
  2⤵
  PID:8584
- C:\Windows\System32\mbqgVGz.exe
  C:\Windows\System32\mbqgVGz.exe
  2⤵
  PID:8604
- C:\Windows\System32\DGtpqvp.exe
  C:\Windows\System32\DGtpqvp.exe
  2⤵
  PID:8640
- C:\Windows\System32\FiENdQk.exe
  C:\Windows\System32\FiENdQk.exe
  2⤵
  PID:8660
- C:\Windows\System32\hcTUZda.exe
  C:\Windows\System32\hcTUZda.exe
  2⤵
  PID:8696
- C:\Windows\System32\ElNLzjW.exe
  C:\Windows\System32\ElNLzjW.exe
  2⤵
  PID:8724
- C:\Windows\System32\ZdazXZA.exe
  C:\Windows\System32\ZdazXZA.exe
  2⤵
  PID:8764
- C:\Windows\System32\tmYnopC.exe
  C:\Windows\System32\tmYnopC.exe
  2⤵
  PID:8804
- C:\Windows\System32\prGWCBN.exe
  C:\Windows\System32\prGWCBN.exe
  2⤵
  PID:8828
- C:\Windows\System32\Umxbiiz.exe
  C:\Windows\System32\Umxbiiz.exe
  2⤵
  PID:8848
- C:\Windows\System32\HSdPydT.exe
  C:\Windows\System32\HSdPydT.exe
  2⤵
  PID:8872
- C:\Windows\System32\mKySage.exe
  C:\Windows\System32\mKySage.exe
  2⤵
  PID:8908
- C:\Windows\System32\qAAyioq.exe
  C:\Windows\System32\qAAyioq.exe
  2⤵
  PID:8936
- C:\Windows\System32\hIGSIrz.exe
  C:\Windows\System32\hIGSIrz.exe
  2⤵
  PID:8960
- C:\Windows\System32\VMcezUi.exe
  C:\Windows\System32\VMcezUi.exe
  2⤵
  PID:8992
- C:\Windows\System32\rptKKci.exe
  C:\Windows\System32\rptKKci.exe
  2⤵
  PID:9012
- C:\Windows\System32\dtWgsNv.exe
  C:\Windows\System32\dtWgsNv.exe
  2⤵
  PID:9036
- C:\Windows\System32\HOHyelw.exe
  C:\Windows\System32\HOHyelw.exe
  2⤵
  PID:9076
- C:\Windows\System32\zcecWCD.exe
  C:\Windows\System32\zcecWCD.exe
  2⤵
  PID:9096
- C:\Windows\System32\ZNcpiMl.exe
  C:\Windows\System32\ZNcpiMl.exe
  2⤵
  PID:9116
- C:\Windows\System32\skSTCXt.exe
  C:\Windows\System32\skSTCXt.exe
  2⤵
  PID:9144
- C:\Windows\System32\whHkixn.exe
  C:\Windows\System32\whHkixn.exe
  2⤵
  PID:9176
- C:\Windows\System32\HayCOOT.exe
  C:\Windows\System32\HayCOOT.exe
  2⤵
  PID:9208
- C:\Windows\System32\zlzDOCw.exe
  C:\Windows\System32\zlzDOCw.exe
  2⤵
  PID:7496
- C:\Windows\System32\ZsJPEYq.exe
  C:\Windows\System32\ZsJPEYq.exe
  2⤵
  PID:8236
- C:\Windows\System32\DfjMZIW.exe
  C:\Windows\System32\DfjMZIW.exe
  2⤵
  PID:8284
- C:\Windows\System32\aDLWLiX.exe
  C:\Windows\System32\aDLWLiX.exe
  2⤵
  PID:8376
- C:\Windows\System32\TYsTuNZ.exe
  C:\Windows\System32\TYsTuNZ.exe
  2⤵
  PID:8460
- C:\Windows\System32\wGbNMWo.exe
  C:\Windows\System32\wGbNMWo.exe
  2⤵
  PID:8544
- C:\Windows\System32\qOnMysp.exe
  C:\Windows\System32\qOnMysp.exe
  2⤵
  PID:8580
- C:\Windows\System32\GmnTyOG.exe
  C:\Windows\System32\GmnTyOG.exe
  2⤵
  PID:8636
- C:\Windows\System32\YhWPVEM.exe
  C:\Windows\System32\YhWPVEM.exe
  2⤵
  PID:8748
- C:\Windows\System32\VSuAOEJ.exe
  C:\Windows\System32\VSuAOEJ.exe
  2⤵
  PID:8776
- C:\Windows\System32\DIRtJoU.exe
  C:\Windows\System32\DIRtJoU.exe
  2⤵
  PID:8820
- C:\Windows\System32\PnWqUVO.exe
  C:\Windows\System32\PnWqUVO.exe
  2⤵
  PID:8932
- C:\Windows\System32\IhPuKjn.exe
  C:\Windows\System32\IhPuKjn.exe
  2⤵
  PID:8976
- C:\Windows\System32\vSvoHvf.exe
  C:\Windows\System32\vSvoHvf.exe
  2⤵
  PID:9108
- C:\Windows\System32\NsYqMfK.exe
  C:\Windows\System32\NsYqMfK.exe
  2⤵
  PID:8264
- C:\Windows\System32\fqGfzhf.exe
  C:\Windows\System32\fqGfzhf.exe
  2⤵
  PID:8620
- C:\Windows\System32\yuwKHnD.exe
  C:\Windows\System32\yuwKHnD.exe
  2⤵
  PID:8572
- C:\Windows\System32\FGMjfqx.exe
  C:\Windows\System32\FGMjfqx.exe
  2⤵
  PID:7580
- C:\Windows\System32\cmPkrwl.exe
  C:\Windows\System32\cmPkrwl.exe
  2⤵
  PID:8260
- C:\Windows\System32\uOnFzPl.exe
  C:\Windows\System32\uOnFzPl.exe
  2⤵
  PID:9044
- C:\Windows\System32\HTxcWDM.exe
  C:\Windows\System32\HTxcWDM.exe
  2⤵
  PID:8344
- C:\Windows\System32\wcpoVdf.exe
  C:\Windows\System32\wcpoVdf.exe
  2⤵
  PID:9152
- C:\Windows\System32\HrneCRc.exe
  C:\Windows\System32\HrneCRc.exe
  2⤵
  PID:9104
- C:\Windows\System32\PnHJFLw.exe
  C:\Windows\System32\PnHJFLw.exe
  2⤵
  PID:9220
- C:\Windows\System32\ScEmuZT.exe
  C:\Windows\System32\ScEmuZT.exe
  2⤵
  PID:9236
- C:\Windows\System32\hhWNZPY.exe
  C:\Windows\System32\hhWNZPY.exe
  2⤵
  PID:9252
- C:\Windows\System32\dQcIyAR.exe
  C:\Windows\System32\dQcIyAR.exe
  2⤵
  PID:9272
- C:\Windows\System32\uCLIAxN.exe
  C:\Windows\System32\uCLIAxN.exe
  2⤵
  PID:9288
- C:\Windows\System32\PvzYNUq.exe
  C:\Windows\System32\PvzYNUq.exe
  2⤵
  PID:9304
- C:\Windows\System32\dHVAyVs.exe
  C:\Windows\System32\dHVAyVs.exe
  2⤵
  PID:9320
- C:\Windows\System32\WEHskDt.exe
  C:\Windows\System32\WEHskDt.exe
  2⤵
  PID:9336
- C:\Windows\System32\odxbtPn.exe
  C:\Windows\System32\odxbtPn.exe
  2⤵
  PID:9368
- C:\Windows\System32\KNVIzEJ.exe
  C:\Windows\System32\KNVIzEJ.exe
  2⤵
  PID:9384
- C:\Windows\System32\qpvYhgF.exe
  C:\Windows\System32\qpvYhgF.exe
  2⤵
  PID:9400
- C:\Windows\System32\zueEaZN.exe
  C:\Windows\System32\zueEaZN.exe
  2⤵
  PID:9416
- C:\Windows\System32\WCRMCyQ.exe
  C:\Windows\System32\WCRMCyQ.exe
  2⤵
  PID:9440
- C:\Windows\System32\MpZQXvb.exe
  C:\Windows\System32\MpZQXvb.exe
  2⤵
  PID:9460
- C:\Windows\System32\SXlLDbF.exe
  C:\Windows\System32\SXlLDbF.exe
  2⤵
  PID:9480
- C:\Windows\System32\SFFNCJC.exe
  C:\Windows\System32\SFFNCJC.exe
  2⤵
  PID:9500
- C:\Windows\System32\btORegS.exe
  C:\Windows\System32\btORegS.exe
  2⤵
  PID:9576
- C:\Windows\System32\uXvQITS.exe
  C:\Windows\System32\uXvQITS.exe
  2⤵
  PID:9632
- C:\Windows\System32\ddtnqxT.exe
  C:\Windows\System32\ddtnqxT.exe
  2⤵
  PID:9728
- C:\Windows\System32\UTIrVyZ.exe
  C:\Windows\System32\UTIrVyZ.exe
  2⤵
  PID:9756
- C:\Windows\System32\HbfJmKD.exe
  C:\Windows\System32\HbfJmKD.exe
  2⤵
  PID:9812
- C:\Windows\System32\lCSsUrX.exe
  C:\Windows\System32\lCSsUrX.exe
  2⤵
  PID:9832
- C:\Windows\System32\atVhsEv.exe
  C:\Windows\System32\atVhsEv.exe
  2⤵
  PID:9860
- C:\Windows\System32\GmundIA.exe
  C:\Windows\System32\GmundIA.exe
  2⤵
  PID:9876
- C:\Windows\System32\jHixlgL.exe
  C:\Windows\System32\jHixlgL.exe
  2⤵
  PID:9892
- C:\Windows\System32\dENuwSm.exe
  C:\Windows\System32\dENuwSm.exe
  2⤵
  PID:9924
- C:\Windows\System32\xNESjvt.exe
  C:\Windows\System32\xNESjvt.exe
  2⤵
  PID:9956
- C:\Windows\System32\QDHsniT.exe
  C:\Windows\System32\QDHsniT.exe
  2⤵
  PID:9976
- C:\Windows\System32\hoowVZf.exe
  C:\Windows\System32\hoowVZf.exe
  2⤵
  PID:10000
- C:\Windows\System32\WYZFBcz.exe
  C:\Windows\System32\WYZFBcz.exe
  2⤵
  PID:10096
- C:\Windows\System32\QRHMLii.exe
  C:\Windows\System32\QRHMLii.exe
  2⤵
  PID:10120
- C:\Windows\System32\yosTaVw.exe
  C:\Windows\System32\yosTaVw.exe
  2⤵
  PID:10136
- C:\Windows\System32\brTTJSD.exe
  C:\Windows\System32\brTTJSD.exe
  2⤵
  PID:10152
- C:\Windows\System32\bChQKzW.exe
  C:\Windows\System32\bChQKzW.exe
  2⤵
  PID:10184
- C:\Windows\System32\jbIkEfy.exe
  C:\Windows\System32\jbIkEfy.exe
  2⤵
  PID:10216
- C:\Windows\System32\dsDyKyF.exe
  C:\Windows\System32\dsDyKyF.exe
  2⤵
  PID:8404
- C:\Windows\System32\kqxwUZJ.exe
  C:\Windows\System32\kqxwUZJ.exe
  2⤵
  PID:8836
- C:\Windows\System32\zNvaPsp.exe
  C:\Windows\System32\zNvaPsp.exe
  2⤵
  PID:9352
- C:\Windows\System32\QmufsSg.exe
  C:\Windows\System32\QmufsSg.exe
  2⤵
  PID:9300
- C:\Windows\System32\kcaovZC.exe
  C:\Windows\System32\kcaovZC.exe
  2⤵
  PID:9328
- C:\Windows\System32\stOgvAH.exe
  C:\Windows\System32\stOgvAH.exe
  2⤵
  PID:9132
- C:\Windows\System32\xeXkxIb.exe
  C:\Windows\System32\xeXkxIb.exe
  2⤵
  PID:9508
- C:\Windows\System32\UFlBsEB.exe
  C:\Windows\System32\UFlBsEB.exe
  2⤵
  PID:9604
- C:\Windows\System32\YxOlsMF.exe
  C:\Windows\System32\YxOlsMF.exe
  2⤵
  PID:9560
- C:\Windows\System32\OUespXk.exe
  C:\Windows\System32\OUespXk.exe
  2⤵
  PID:9496
- C:\Windows\System32\Cgcdhdc.exe
  C:\Windows\System32\Cgcdhdc.exe
  2⤵
  PID:9564
- C:\Windows\System32\giPFfGK.exe
  C:\Windows\System32\giPFfGK.exe
  2⤵
  PID:9668
- C:\Windows\System32\pHBJGxq.exe
  C:\Windows\System32\pHBJGxq.exe
  2⤵
  PID:9800
- C:\Windows\System32\YWITQsp.exe
  C:\Windows\System32\YWITQsp.exe
  2⤵
  PID:9912
- C:\Windows\System32\cCwQNOo.exe
  C:\Windows\System32\cCwQNOo.exe
  2⤵
  PID:9984
- C:\Windows\System32\JWQVwOW.exe
  C:\Windows\System32\JWQVwOW.exe
  2⤵
  PID:9996
- C:\Windows\System32\StWHqaW.exe
  C:\Windows\System32\StWHqaW.exe
  2⤵
  PID:10064
- C:\Windows\System32\SsPIBlv.exe
  C:\Windows\System32\SsPIBlv.exe
  2⤵
  PID:10128
- C:\Windows\System32\hyVwXwa.exe
  C:\Windows\System32\hyVwXwa.exe
  2⤵
  PID:10144
- C:\Windows\System32\HLqhmWX.exe
  C:\Windows\System32\HLqhmWX.exe
  2⤵
  PID:9004
- C:\Windows\System32\BMCdGeE.exe
  C:\Windows\System32\BMCdGeE.exe
  2⤵
  PID:4652
- C:\Windows\System32\sguqpBU.exe
  C:\Windows\System32\sguqpBU.exe
  2⤵
  PID:9360
- C:\Windows\System32\JgwuvpS.exe
  C:\Windows\System32\JgwuvpS.exe
  2⤵
  PID:9412
- C:\Windows\System32\UIfMoeZ.exe
  C:\Windows\System32\UIfMoeZ.exe
  2⤵
  PID:8244
- C:\Windows\System32\SrSRThc.exe
  C:\Windows\System32\SrSRThc.exe
  2⤵
  PID:9724
- C:\Windows\System32\pslqpau.exe
  C:\Windows\System32\pslqpau.exe
  2⤵
  PID:10068
- C:\Windows\System32\LNVvaHw.exe
  C:\Windows\System32\LNVvaHw.exe
  2⤵
  PID:10148
- C:\Windows\System32\rDXsAqY.exe
  C:\Windows\System32\rDXsAqY.exe
  2⤵
  PID:8944
- C:\Windows\System32\UQbMEpc.exe
  C:\Windows\System32\UQbMEpc.exe
  2⤵
  PID:8216
- C:\Windows\System32\CPBHRMw.exe
  C:\Windows\System32\CPBHRMw.exe
  2⤵
  PID:9648
- C:\Windows\System32\TEXDNAE.exe
  C:\Windows\System32\TEXDNAE.exe
  2⤵
  PID:9844
- C:\Windows\System32\lFkYzwY.exe
  C:\Windows\System32\lFkYzwY.exe
  2⤵
  PID:10192
- C:\Windows\System32\AMDWUDS.exe
  C:\Windows\System32\AMDWUDS.exe
  2⤵
  PID:9432
- C:\Windows\System32\TZsVuJj.exe
  C:\Windows\System32\TZsVuJj.exe
  2⤵
  PID:10272
- C:\Windows\System32\FYVbEnD.exe
  C:\Windows\System32\FYVbEnD.exe
  2⤵
  PID:10296
- C:\Windows\System32\AVfokYC.exe
  C:\Windows\System32\AVfokYC.exe
  2⤵
  PID:10316
- C:\Windows\System32\EiRnkTZ.exe
  C:\Windows\System32\EiRnkTZ.exe
  2⤵
  PID:10340
- C:\Windows\System32\jUzRJSS.exe
  C:\Windows\System32\jUzRJSS.exe
  2⤵
  PID:10364
- C:\Windows\System32\kLLWzgb.exe
  C:\Windows\System32\kLLWzgb.exe
  2⤵
  PID:10388
- C:\Windows\System32\kysfuJn.exe
  C:\Windows\System32\kysfuJn.exe
  2⤵
  PID:10408
- C:\Windows\System32\vQjYFNS.exe
  C:\Windows\System32\vQjYFNS.exe
  2⤵
  PID:10460
- C:\Windows\System32\EOthTRr.exe
  C:\Windows\System32\EOthTRr.exe
  2⤵
  PID:10480
- C:\Windows\System32\ScfWGHl.exe
  C:\Windows\System32\ScfWGHl.exe
  2⤵
  PID:10508
- C:\Windows\System32\ShohoCH.exe
  C:\Windows\System32\ShohoCH.exe
  2⤵
  PID:10528
- C:\Windows\System32\QqVneYS.exe
  C:\Windows\System32\QqVneYS.exe
  2⤵
  PID:10544
- C:\Windows\System32\FDnDiBF.exe
  C:\Windows\System32\FDnDiBF.exe
  2⤵
  PID:10568
- C:\Windows\System32\HPpvQtX.exe
  C:\Windows\System32\HPpvQtX.exe
  2⤵
  PID:10624
- C:\Windows\System32\fgcyfXh.exe
  C:\Windows\System32\fgcyfXh.exe
  2⤵
  PID:10648
- C:\Windows\System32\kWUDsfL.exe
  C:\Windows\System32\kWUDsfL.exe
  2⤵
  PID:10680
- C:\Windows\System32\SiaMsYb.exe
  C:\Windows\System32\SiaMsYb.exe
  2⤵
  PID:10704
- C:\Windows\System32\KxMoeuG.exe
  C:\Windows\System32\KxMoeuG.exe
  2⤵
  PID:10740
- C:\Windows\System32\kuayHxd.exe
  C:\Windows\System32\kuayHxd.exe
  2⤵
  PID:10756
- C:\Windows\System32\TxYFBLo.exe
  C:\Windows\System32\TxYFBLo.exe
  2⤵
  PID:10784
- C:\Windows\System32\PRjQvEG.exe
  C:\Windows\System32\PRjQvEG.exe
  2⤵
  PID:10800
- C:\Windows\System32\gCDbVhk.exe
  C:\Windows\System32\gCDbVhk.exe
  2⤵
  PID:10820
- C:\Windows\System32\oECJucY.exe
  C:\Windows\System32\oECJucY.exe
  2⤵
  PID:10840
- C:\Windows\System32\NkUSkwg.exe
  C:\Windows\System32\NkUSkwg.exe
  2⤵
  PID:10868
- C:\Windows\System32\bUnHOTF.exe
  C:\Windows\System32\bUnHOTF.exe
  2⤵
  PID:10896
- C:\Windows\System32\YOqAddR.exe
  C:\Windows\System32\YOqAddR.exe
  2⤵
  PID:10920
- C:\Windows\System32\hpRyLBs.exe
  C:\Windows\System32\hpRyLBs.exe
  2⤵
  PID:10940
- C:\Windows\System32\XhbypBj.exe
  C:\Windows\System32\XhbypBj.exe
  2⤵
  PID:10964
- C:\Windows\System32\DZEPLhc.exe
  C:\Windows\System32\DZEPLhc.exe
  2⤵
  PID:11028
- C:\Windows\System32\iwcosaV.exe
  C:\Windows\System32\iwcosaV.exe
  2⤵
  PID:11064
- C:\Windows\System32\xmWeGrc.exe
  C:\Windows\System32\xmWeGrc.exe
  2⤵
  PID:11084
- C:\Windows\System32\NBtVZre.exe
  C:\Windows\System32\NBtVZre.exe
  2⤵
  PID:11100
- C:\Windows\System32\UKMbXbC.exe
  C:\Windows\System32\UKMbXbC.exe
  2⤵
  PID:11124
- C:\Windows\System32\abNgXqK.exe
  C:\Windows\System32\abNgXqK.exe
  2⤵
  PID:11148
- C:\Windows\System32\JrxbaVt.exe
  C:\Windows\System32\JrxbaVt.exe
  2⤵
  PID:11168
- C:\Windows\System32\YRRGWhI.exe
  C:\Windows\System32\YRRGWhI.exe
  2⤵
  PID:11192
- C:\Windows\System32\OQaykvQ.exe
  C:\Windows\System32\OQaykvQ.exe
  2⤵
  PID:11208
- C:\Windows\System32\fArXpak.exe
  C:\Windows\System32\fArXpak.exe
  2⤵
  PID:11260
- C:\Windows\System32\yTdaiTH.exe
  C:\Windows\System32\yTdaiTH.exe
  2⤵
  PID:10260
- C:\Windows\System32\ISlycpA.exe
  C:\Windows\System32\ISlycpA.exe
  2⤵
  PID:10308
- C:\Windows\System32\xSvvACY.exe
  C:\Windows\System32\xSvvACY.exe
  2⤵
  PID:10376
- C:\Windows\System32\KqvIjtZ.exe
  C:\Windows\System32\KqvIjtZ.exe
  2⤵
  PID:10420
- C:\Windows\System32\tSuBCzV.exe
  C:\Windows\System32\tSuBCzV.exe
  2⤵
  PID:10580
- C:\Windows\System32\auIUmai.exe
  C:\Windows\System32\auIUmai.exe
  2⤵
  PID:10700
- C:\Windows\System32\fuFLhHx.exe
  C:\Windows\System32\fuFLhHx.exe
  2⤵
  PID:10776
- C:\Windows\System32\zUvWrTC.exe
  C:\Windows\System32\zUvWrTC.exe
  2⤵
  PID:10836
- C:\Windows\System32\ZPkDYjt.exe
  C:\Windows\System32\ZPkDYjt.exe
  2⤵
  PID:10892
- C:\Windows\System32\DmNEoGU.exe
  C:\Windows\System32\DmNEoGU.exe
  2⤵
  PID:10936
- C:\Windows\System32\CjNXARX.exe
  C:\Windows\System32\CjNXARX.exe
  2⤵
  PID:10980
- C:\Windows\System32\guGBDpa.exe
  C:\Windows\System32\guGBDpa.exe
  2⤵
  PID:11072
- C:\Windows\System32\xXpvMnv.exe
  C:\Windows\System32\xXpvMnv.exe
  2⤵
  PID:11156
- C:\Windows\System32\RZEmExi.exe
  C:\Windows\System32\RZEmExi.exe
  2⤵
  PID:10244
- C:\Windows\System32\zdJRmNd.exe
  C:\Windows\System32\zdJRmNd.exe
  2⤵
  PID:11244
- C:\Windows\System32\QXUZGmM.exe
  C:\Windows\System32\QXUZGmM.exe
  2⤵
  PID:10400
- C:\Windows\System32\PLvgbVb.exe
  C:\Windows\System32\PLvgbVb.exe
  2⤵
  PID:10468
- C:\Windows\System32\yOgvgPP.exe
  C:\Windows\System32\yOgvgPP.exe
  2⤵
  PID:10688
- C:\Windows\System32\hmlcIMt.exe
  C:\Windows\System32\hmlcIMt.exe
  2⤵
  PID:10716
- C:\Windows\System32\PmALhJM.exe
  C:\Windows\System32\PmALhJM.exe
  2⤵
  PID:10828
- C:\Windows\System32\UBJIybO.exe
  C:\Windows\System32\UBJIybO.exe
  2⤵
  PID:11024
- C:\Windows\System32\pFwJFbH.exe
  C:\Windows\System32\pFwJFbH.exe
  2⤵
  PID:11140
- C:\Windows\System32\aDGhIZR.exe
  C:\Windows\System32\aDGhIZR.exe
  2⤵
  PID:10792
- C:\Windows\System32\QUUGSVE.exe
  C:\Windows\System32\QUUGSVE.exe
  2⤵
  PID:10932
- C:\Windows\System32\EuXZDQn.exe
  C:\Windows\System32\EuXZDQn.exe
  2⤵
  PID:11144
- C:\Windows\System32\QSlnhzo.exe
  C:\Windows\System32\QSlnhzo.exe
  2⤵
  PID:9936
- C:\Windows\System32\vhxNTdP.exe
  C:\Windows\System32\vhxNTdP.exe
  2⤵
  PID:11236
- C:\Windows\System32\RIXjyjA.exe
  C:\Windows\System32\RIXjyjA.exe
  2⤵
  PID:11292
- C:\Windows\System32\XRHZmgE.exe
  C:\Windows\System32\XRHZmgE.exe
  2⤵
  PID:11372
- C:\Windows\System32\dGNZVHw.exe
  C:\Windows\System32\dGNZVHw.exe
  2⤵
  PID:11392
- C:\Windows\System32\QSQryta.exe
  C:\Windows\System32\QSQryta.exe
  2⤵
  PID:11412
- C:\Windows\System32\KJGWYTo.exe
  C:\Windows\System32\KJGWYTo.exe
  2⤵
  PID:11428
- C:\Windows\System32\uRDIgxM.exe
  C:\Windows\System32\uRDIgxM.exe
  2⤵
  PID:11448
- C:\Windows\System32\SYHZBWz.exe
  C:\Windows\System32\SYHZBWz.exe
  2⤵
  PID:11496
- C:\Windows\System32\haKsgUs.exe
  C:\Windows\System32\haKsgUs.exe
  2⤵
  PID:11520
- C:\Windows\System32\Fxrlsgz.exe
  C:\Windows\System32\Fxrlsgz.exe
  2⤵
  PID:11544
- C:\Windows\System32\JqLngGu.exe
  C:\Windows\System32\JqLngGu.exe
  2⤵
  PID:11568
- C:\Windows\System32\VlOTsmx.exe
  C:\Windows\System32\VlOTsmx.exe
  2⤵
  PID:11588
- C:\Windows\System32\BoihWPy.exe
  C:\Windows\System32\BoihWPy.exe
  2⤵
  PID:11604
- C:\Windows\System32\IXVhhRO.exe
  C:\Windows\System32\IXVhhRO.exe
  2⤵
  PID:11624
- C:\Windows\System32\MnMraAS.exe
  C:\Windows\System32\MnMraAS.exe
  2⤵
  PID:11700
- C:\Windows\System32\yFWmoOy.exe
  C:\Windows\System32\yFWmoOy.exe
  2⤵
  PID:11716
- C:\Windows\System32\ppidYRK.exe
  C:\Windows\System32\ppidYRK.exe
  2⤵
  PID:11756
- C:\Windows\System32\RSEINer.exe
  C:\Windows\System32\RSEINer.exe
  2⤵
  PID:11796
- C:\Windows\System32\ZJWzFiU.exe
  C:\Windows\System32\ZJWzFiU.exe
  2⤵
  PID:11812
- C:\Windows\System32\VZCwXtS.exe
  C:\Windows\System32\VZCwXtS.exe
  2⤵
  PID:11828
- C:\Windows\System32\sFEIItV.exe
  C:\Windows\System32\sFEIItV.exe
  2⤵
  PID:11856
- C:\Windows\System32\WKazQYR.exe
  C:\Windows\System32\WKazQYR.exe
  2⤵
  PID:11872
- C:\Windows\System32\vcASWEO.exe
  C:\Windows\System32\vcASWEO.exe
  2⤵
  PID:11916
- C:\Windows\System32\zfzswmF.exe
  C:\Windows\System32\zfzswmF.exe
  2⤵
  PID:11932
- C:\Windows\System32\sBXNAlW.exe
  C:\Windows\System32\sBXNAlW.exe
  2⤵
  PID:11956
- C:\Windows\System32\omGUoDM.exe
  C:\Windows\System32\omGUoDM.exe
  2⤵
  PID:11976
- C:\Windows\System32\ehKoLBy.exe
  C:\Windows\System32\ehKoLBy.exe
  2⤵
  PID:11996
- C:\Windows\System32\gHGgzxg.exe
  C:\Windows\System32\gHGgzxg.exe
  2⤵
  PID:12016
- C:\Windows\System32\oFMfAxl.exe
  C:\Windows\System32\oFMfAxl.exe
  2⤵
  PID:12060
- C:\Windows\System32\RjNSrbm.exe
  C:\Windows\System32\RjNSrbm.exe
  2⤵
  PID:12076
- C:\Windows\System32\zOpmJCU.exe
  C:\Windows\System32\zOpmJCU.exe
  2⤵
  PID:12104
- C:\Windows\System32\WRrJAyk.exe
  C:\Windows\System32\WRrJAyk.exe
  2⤵
  PID:12136
- C:\Windows\System32\YrIXgsG.exe
  C:\Windows\System32\YrIXgsG.exe
  2⤵
  PID:12188
- C:\Windows\System32\yxqJokU.exe
  C:\Windows\System32\yxqJokU.exe
  2⤵
  PID:12232
- C:\Windows\System32\IwmsnKt.exe
  C:\Windows\System32\IwmsnKt.exe
  2⤵
  PID:12252
- C:\Windows\System32\nTlLasU.exe
  C:\Windows\System32\nTlLasU.exe
  2⤵
  PID:10492
- C:\Windows\System32\pNcgAHe.exe
  C:\Windows\System32\pNcgAHe.exe
  2⤵
  PID:11272
- C:\Windows\System32\RmggQmD.exe
  C:\Windows\System32\RmggQmD.exe
  2⤵
  PID:11344
- C:\Windows\System32\seOgplv.exe
  C:\Windows\System32\seOgplv.exe
  2⤵
  PID:11400
- C:\Windows\System32\tGWGbHD.exe
  C:\Windows\System32\tGWGbHD.exe
  2⤵
  PID:11504
- C:\Windows\System32\YBjVMJr.exe
  C:\Windows\System32\YBjVMJr.exe
  2⤵
  PID:11580
- C:\Windows\System32\EThalXt.exe
  C:\Windows\System32\EThalXt.exe
  2⤵
  PID:11576
- C:\Windows\System32\dNXdEKk.exe
  C:\Windows\System32\dNXdEKk.exe
  2⤵
  PID:11684
- C:\Windows\System32\kNElhGA.exe
  C:\Windows\System32\kNElhGA.exe
  2⤵
  PID:11708
- C:\Windows\System32\TALAbUC.exe
  C:\Windows\System32\TALAbUC.exe
  2⤵
  PID:11784
- C:\Windows\System32\qEPvHTD.exe
  C:\Windows\System32\qEPvHTD.exe
  2⤵
  PID:11848
- C:\Windows\System32\JJMrxsn.exe
  C:\Windows\System32\JJMrxsn.exe
  2⤵
  PID:11948
- C:\Windows\System32\BSriwrL.exe
  C:\Windows\System32\BSriwrL.exe
  2⤵
  PID:11984
- C:\Windows\System32\gAzBpUV.exe
  C:\Windows\System32\gAzBpUV.exe
  2⤵
  PID:12040
- C:\Windows\System32\oSNXHUT.exe
  C:\Windows\System32\oSNXHUT.exe
  2⤵
  PID:12116
- C:\Windows\System32\MaekahM.exe
  C:\Windows\System32\MaekahM.exe
  2⤵
  PID:12144
- C:\Windows\System32\AXTphHW.exe
  C:\Windows\System32\AXTphHW.exe
  2⤵
  PID:12200
- C:\Windows\System32\PRPUbmn.exe
  C:\Windows\System32\PRPUbmn.exe
  2⤵
  PID:12244
- C:\Windows\System32\HHBJFPo.exe
  C:\Windows\System32\HHBJFPo.exe
  2⤵
  PID:11440
- C:\Windows\System32\acYaMLg.exe
  C:\Windows\System32\acYaMLg.exe
  2⤵
  PID:11664
- C:\Windows\System32\gxMFsqH.exe
  C:\Windows\System32\gxMFsqH.exe
  2⤵
  PID:11740
- C:\Windows\System32\oKBFFCA.exe
  C:\Windows\System32\oKBFFCA.exe
  2⤵
  PID:11852
- C:\Windows\System32\myxGggN.exe
  C:\Windows\System32\myxGggN.exe
  2⤵
  PID:11940
- C:\Windows\System32\vmBosSI.exe
  C:\Windows\System32\vmBosSI.exe
  2⤵
  PID:12164
- C:\Windows\System32\pEejzYU.exe
  C:\Windows\System32\pEejzYU.exe
  2⤵
  PID:11092
- C:\Windows\System32\stZUHsD.exe
  C:\Windows\System32\stZUHsD.exe
  2⤵
  PID:11556
- C:\Windows\System32\VCIjECn.exe
  C:\Windows\System32\VCIjECn.exe
  2⤵
  PID:10404
- C:\Windows\System32\cVawhrU.exe
  C:\Windows\System32\cVawhrU.exe
  2⤵
  PID:5064
- C:\Windows\System32\uAyFecC.exe
  C:\Windows\System32\uAyFecC.exe
  2⤵
  PID:12248
- C:\Windows\System32\rrQqlXy.exe
  C:\Windows\System32\rrQqlXy.exe
  2⤵
  PID:12304
- C:\Windows\System32\anODExZ.exe
  C:\Windows\System32\anODExZ.exe
  2⤵
  PID:12332
- C:\Windows\System32\xdqxvxU.exe
  C:\Windows\System32\xdqxvxU.exe
  2⤵
  PID:12352
- C:\Windows\System32\OSZUUGO.exe
  C:\Windows\System32\OSZUUGO.exe
  2⤵
  PID:12376
- C:\Windows\System32\aDzxOGi.exe
  C:\Windows\System32\aDzxOGi.exe
  2⤵
  PID:12392
- C:\Windows\System32\PIRIbxj.exe
  C:\Windows\System32\PIRIbxj.exe
  2⤵
  PID:12412
- C:\Windows\System32\wJWkhZX.exe
  C:\Windows\System32\wJWkhZX.exe
  2⤵
  PID:12436
- C:\Windows\System32\asJSEFR.exe
  C:\Windows\System32\asJSEFR.exe
  2⤵
  PID:12460
- C:\Windows\System32\KoDdYHF.exe
  C:\Windows\System32\KoDdYHF.exe
  2⤵
  PID:12492
- C:\Windows\System32\eqmLqyy.exe
  C:\Windows\System32\eqmLqyy.exe
  2⤵
  PID:12540
- C:\Windows\System32\NPPdIDu.exe
  C:\Windows\System32\NPPdIDu.exe
  2⤵
  PID:12576
- C:\Windows\System32\mRMxfAL.exe
  C:\Windows\System32\mRMxfAL.exe
  2⤵
  PID:12592
- C:\Windows\System32\ikEQBij.exe
  C:\Windows\System32\ikEQBij.exe
  2⤵
  PID:12628
- C:\Windows\System32\EpJArZY.exe
  C:\Windows\System32\EpJArZY.exe
  2⤵
  PID:12656
- C:\Windows\System32\eYILirx.exe
  C:\Windows\System32\eYILirx.exe
  2⤵
  PID:12696
- C:\Windows\System32\luIOytR.exe
  C:\Windows\System32\luIOytR.exe
  2⤵
  PID:12712
- C:\Windows\System32\QujYhBg.exe
  C:\Windows\System32\QujYhBg.exe
  2⤵
  PID:12732
- C:\Windows\System32\mzuzHAs.exe
  C:\Windows\System32\mzuzHAs.exe
  2⤵
  PID:12768
- C:\Windows\System32\vwYNTcL.exe
  C:\Windows\System32\vwYNTcL.exe
  2⤵
  PID:12792
- C:\Windows\System32\itijiWo.exe
  C:\Windows\System32\itijiWo.exe
  2⤵
  PID:12808
- C:\Windows\System32\zJzvtHG.exe
  C:\Windows\System32\zJzvtHG.exe
  2⤵
  PID:12832
- C:\Windows\System32\VjtthGB.exe
  C:\Windows\System32\VjtthGB.exe
  2⤵
  PID:12880
- C:\Windows\System32\FdTpTwq.exe
  C:\Windows\System32\FdTpTwq.exe
  2⤵
  PID:12896
- C:\Windows\System32\ciFqoWT.exe
  C:\Windows\System32\ciFqoWT.exe
  2⤵
  PID:12956
- C:\Windows\System32\ZXzoUaS.exe
  C:\Windows\System32\ZXzoUaS.exe
  2⤵
  PID:12980
- C:\Windows\System32\pKJXTPD.exe
  C:\Windows\System32\pKJXTPD.exe
  2⤵
  PID:13004
- C:\Windows\System32\eLqqLeI.exe
  C:\Windows\System32\eLqqLeI.exe
  2⤵
  PID:13024
- C:\Windows\System32\QOmPFgd.exe
  C:\Windows\System32\QOmPFgd.exe
  2⤵
  PID:13044
- C:\Windows\System32\DRzIdPz.exe
  C:\Windows\System32\DRzIdPz.exe
  2⤵
  PID:13080
- C:\Windows\System32\LvuygUG.exe
  C:\Windows\System32\LvuygUG.exe
  2⤵
  PID:13096
- C:\Windows\System32\sHdPBtb.exe
  C:\Windows\System32\sHdPBtb.exe
  2⤵
  PID:13120
- C:\Windows\System32\JIXovhu.exe
  C:\Windows\System32\JIXovhu.exe
  2⤵
  PID:13136
- C:\Windows\System32\fhNObUE.exe
  C:\Windows\System32\fhNObUE.exe
  2⤵
  PID:13160
- C:\Windows\System32\BiNrkIm.exe
  C:\Windows\System32\BiNrkIm.exe
  2⤵
  PID:13188
- C:\Windows\System32\oDuoEHb.exe
  C:\Windows\System32\oDuoEHb.exe
  2⤵
  PID:13208
- C:\Windows\System32\OWNZEjf.exe
  C:\Windows\System32\OWNZEjf.exe
  2⤵
  PID:13260
- C:\Windows\System32\DuZuXtx.exe
  C:\Windows\System32\DuZuXtx.exe
  2⤵
  PID:13292
- C:\Windows\System32\yaVzYyW.exe
  C:\Windows\System32\yaVzYyW.exe
  2⤵
  PID:12316
- C:\Windows\System32\FebAaOW.exe
  C:\Windows\System32\FebAaOW.exe
  2⤵
  PID:12364
- C:\Windows\System32\QmhzuGQ.exe
  C:\Windows\System32\QmhzuGQ.exe
  2⤵
  PID:12420
- C:\Windows\System32\DGxFTOc.exe
  C:\Windows\System32\DGxFTOc.exe
  2⤵
  PID:12488
- C:\Windows\System32\oTFdHpr.exe
  C:\Windows\System32\oTFdHpr.exe
  2⤵
  PID:12588
- C:\Windows\System32\JLvShtI.exe
  C:\Windows\System32\JLvShtI.exe
  2⤵
  PID:12516
- C:\Windows\System32\JVYkNYF.exe
  C:\Windows\System32\JVYkNYF.exe
  2⤵
  PID:12640
- C:\Windows\System32\mOdMAir.exe
  C:\Windows\System32\mOdMAir.exe
  2⤵
  PID:12800
- C:\Windows\System32\QEzdFrq.exe
  C:\Windows\System32\QEzdFrq.exe
  2⤵
  PID:12124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

DGHNFxB.exe

Path C:\Windows\System32\DGHNFxB.exe
Size 1.0MB
SHA256 27549dfbaf973dbbe1c0a06d6457cdceb75d8e72d697b6d77be1451553ecc965
MD5 08eaa8a5421cf373cf646475e6f896db
SHA1 f584881b11fe599303dfa52ed0acaf62d62ffb37
SHA512 ca491efd324f7658d5a2a135948f03b88ee5c24f5897204e8d71e89ef12b2ad7ce8ac4a8115ae1c47ebefa2f5f8a3cedf6be7f88dc883c56adce27c88970410c
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBLKO:knw9oUUEEDl37jcq4sO
MD5 SHA1 SHA512 SSDEEP

Submit Download

FpLGLZi.exe

Path C:\Windows\System32\FpLGLZi.exe
Size 1.0MB
SHA256 3cc8b2a8913f26da5377f066add54189acf7b1c0970c684178f74ee62bbabc71
MD5 067a2dc46c0547d9743db1ec5827485d
SHA1 1fe68831369c744622aad57f7d2d610566659c49
SHA512 7ea7276138bc3d5098b7ba63a6d4632986d8fda054e893d6ba48280d3d42717f505e6d38685334ba6766dad02e018eb52f9af84a9b9af03618a096c08ace76df
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBLaM:knw9oUUEEDl37jcq4gM
MD5 SHA1 SHA512 SSDEEP

Submit Download

GMGwyZi.exe

Path C:\Windows\System32\GMGwyZi.exe
Size 1.0MB
SHA256 7a5112c33412a829dcc7c278a4410c5d682c237f1a2333d9244c8a7d4e9c1e6f
MD5 ff90562fe21d6ada812f4e03412d907a
SHA1 277ee6937214ae75a12cd19653d1533078292b5c
SHA512 7f6be474348f144cd5717c8cb898f5b57898b97319c14a0e2b56e17121bb3d133d2b0c5183fa9bd7ce44e70782c02142c13f9f9481e5367bfd3c7d81500b5cc9
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBLa:knw9oUUEEDl37jcq4E
MD5 SHA1 SHA512 SSDEEP

Submit Download

HDyrnWK.exe

Path C:\Windows\System32\HDyrnWK.exe
Size 1.0MB
SHA256 9e257e053df41c7c3fa3e2b43b649236058fee179c8db03c86c235d43cb55ac0
MD5 90b160690238d3eff5fbbbf749142fab
SHA1 ffea2cc3c8504642193cf4d9a72bbcc383da692e
SHA512 26a1a3f501addc090e0afe06ff6f91742ff718a78a58de3ac48783a46192520cf9ece51b8ae09b854161d6cc05794ea1a35b654593a812326c27a159a1e5a11c
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBLR:knw9oUUEEDl37jcq4P
MD5 SHA1 SHA512 SSDEEP

Submit Download

HfRoXFW.exe

Path C:\Windows\System32\HfRoXFW.exe
Size 1.0MB
SHA256 aa30c552f8231a06aa43c35e42da6ae7cd43c40fd9eb27c9d77bbc7c5808e5fa
MD5 7b2a4782d2da801d08f76f3709b13dfe
SHA1 f106e93eb91e671f17e26e598237a567ff4eec18
SHA512 cae43d05ceb9fdeb886a9bb51b4f138482595ecb5fcc6145b4f8b4ccaf1cb4e2b9f0b6e561939e2d5db193002ee000f1fcad6f3798e75b159a4a428a1d05f38b
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBLl:knw9oUUEEDl37jcq4X
MD5 SHA1 SHA512 SSDEEP

Submit Download

IhesWAz.exe

Path C:\Windows\System32\IhesWAz.exe
Size 1.0MB
SHA256 baac6fb6c8539cb6f9253c5f9e4b932e7929d087cab9aa3ea75a062e7f85b508
MD5 9464fc89af6c82eb9900e4d6b66586d3
SHA1 511d6582e878b0442275639a02f852ed9febf3dc
SHA512 cd6481bf64f63c67f3aa2ba2ae2bc30aaa3dc89a57ee39fe7ef4f4375a6147523cbfd2421af335b67c66630e83a13547e439eadbeeff81a7f26b0d02c0789a38
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBLs:knw9oUUEEDl37jcq4O
MD5 SHA1 SHA512 SSDEEP

Submit Download

MerWWCY.exe

Path C:\Windows\System32\MerWWCY.exe
Size 1.0MB
SHA256 98a9b922ec8b31b9df9adee41b8ac93b13ce5b2d0d502b53d3d7ca32597de3b2
MD5 f54692b5ec5e79a779d9dbb8ff541bb4
SHA1 9b4efd6649b6899cc75ce61934d5351ab917e892
SHA512 c4da17c2cdade022189124cb568997291d6410c18afcdd56698c32a1b04082218433d586fa66bfccb5f480f1e7c49de9e955a117cae978e2a22faa570c827dbb
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBLe:knw9oUUEEDl37jcq4Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

QTTUCre.exe

Path C:\Windows\System32\QTTUCre.exe
Size 1.0MB
SHA256 b786cace73061c087066578ef6750b6a267a3bb246798eb8f09f6ca5fb817e76
MD5 778d6ea00e988ae532b2ed3030807ccd
SHA1 bd71986c169262903723b7687d7618896d7a8eb3
SHA512 4e4e5bc82922af50247647960d86e9996c215c9fcd62095ac7e70e8d30e69eea6a50dea2b3bb3bd8cd92cc4206ac0aaa22d6be52374bf15c90bab8fa8602bda2
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBLs:knw9oUUEEDl37jcq4i
MD5 SHA1 SHA512 SSDEEP

Submit Download

VzCdRPn.exe

Path C:\Windows\System32\VzCdRPn.exe
Size 1.0MB
SHA256 97fdf824f98f6bed853e594975a4a5bfe0fcbb9bdea4f3796c13648f2588740c
MD5 d6ac35bfa5b783b8a5c9cfabc8690398
SHA1 018fec69176e8eface74ea63fcb7bdf8067b6205
SHA512 4aaf403b45b8ca002529f90a36658590945d578a0ce9663960738b501c026da69f918b223134c6151a966f0b2e9ddf6ecc9055a70dda665a765a8a468d5af7f5
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBLc:knw9oUUEEDl37jcq46
MD5 SHA1 SHA512 SSDEEP

Submit Download

WrlRXwl.exe

Path C:\Windows\System32\WrlRXwl.exe
Size 1.0MB
SHA256 9bfe258b61f0049a337c55fa44de3e81f84dc4d73d17cb22e2a257e3d0cc2aa4
MD5 3f09c35736794f58e097373a3dfd1d81
SHA1 4f6e1372ef2a040d12f014ed9e552a69acbf9435
SHA512 a72103bfe733000fac39418c2f80a2b61d9f00c05a246245be2db9e7b7c3bb2f2f064835d5c851b37efafa90efc6a1bec3d790118b4f02d072ec3bff72f954bb
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBLY1:knw9oUUEEDl37jcq4A
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZQpJDOZ.exe

Path C:\Windows\System32\ZQpJDOZ.exe
Size 1.0MB
SHA256 f367c00044331ce2c3bd3bf5baa68385e1760031e8352b61e12dbf95eca94903
MD5 6f8ed2f9ef0a13e052fa8d3c79ba1c8f
SHA1 bffec8ca75ec3a0b57959b419c5f294560d45375
SHA512 06f27f402a1093bae17bf44e91e6d076a0af0399ba34eb15c8261f2c7297e3fcf97afacb329a2046a7e0acbe560e1f23a1186d753ce2275956ce2101f2a1d271
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBL/:knw9oUUEEDl37jcq4F
MD5 SHA1 SHA512 SSDEEP

Submit Download

cAjoCeC.exe

Path C:\Windows\System32\cAjoCeC.exe
Size 1.0MB
SHA256 0745ed880e26235018f306626fa999a6f97cc021c130d953a59fb60cb3f72ef1
MD5 d8d35be963934bdc80aed06c2bb0271c
SHA1 838d977cea94596673f83c9fcb3325316e2367fd
SHA512 fbd0b949ad76ef3da565b135a1b26be85080b5dab38d45e72f5c7c67700b6e7df66a27337678a6ef6c9c579ccd8abb9c19d1f0a566fd2bb67be12e347ddb6b7f
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBL+:knw9oUUEEDl37jcq4Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

cKaEfuv.exe

Path C:\Windows\System32\cKaEfuv.exe
Size 1.0MB
SHA256 e429f34b1949af205d9dc24a72428eb44e4d8f2f04cb64c87b6fd65f05414516
MD5 de355dd60cb978b9899a9e7e99454d03
SHA1 89d57ba15afcfe0d1b45d95b17ced5d8f71bbcdb
SHA512 eb76ca894f5f785660611cbf86d529abdfa89cf89d75b229b3620ec5e8fe241dbe3e9a89890bda124e1160a63e928ff71aa2396eeda05ae8d73e4c905894b892
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBLw:knw9oUUEEDl37jcq4O
MD5 SHA1 SHA512 SSDEEP

Submit Download

dSJYnEI.exe

Path C:\Windows\System32\dSJYnEI.exe
Size 1.0MB
SHA256 a26b53d6fd8f64636fe153663952aff817f41b8e1be7721b589379626bf89f92
MD5 392135beef513da75cb02f18fd8de671
SHA1 fbee579183d793e489c2a339fa6c8d4706def071
SHA512 6d1292ea4c789753e938753e6009f182ebe343a18b703aa520e85d95462fcdefd7232052ea36cf05f860912840763c0c2e5df7fbb9d0752cda6e7667c5fb72a8
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBL9:knw9oUUEEDl37jcq4T
MD5 SHA1 SHA512 SSDEEP

Submit Download

gCeTQcd.exe

Path C:\Windows\System32\gCeTQcd.exe
Size 1.0MB
SHA256 be7aed5b7451d60033528357766c90676d15afdbb7ffb5f82b1f8d3beb782c6c
MD5 8d3873555c77a1282c9c810d5ebbbacd
SHA1 7aea0c59f283e145978978c4d91aa52b8d1e7a0b
SHA512 02027e75df54fa51b88e0b34d2dd663aee1d0e0fc845cceda93d21e4f0a3f60965c75f66c094a23c1ff0903b250a51d66013383ddb205b57a39bb45a7d768643
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBLjV:knw9oUUEEDl37jcq4f
MD5 SHA1 SHA512 SSDEEP

Submit Download

grSWaID.exe

Path C:\Windows\System32\grSWaID.exe
Size 1.0MB
SHA256 89b81313e9435c3eb6468c7e88bf3bf3fa386e29403899802b825e6b30108285
MD5 53c94f7b43cac318a6d75b7f642eeaf2
SHA1 ecc0fa17c24b2362fc3b0a73f5a24158cb7c436b
SHA512 1d6f3543f90ccea14de3e795c7d1974a9c19011d834858eacd9f1bbbfa37fec3ed448dac70318ff2370c78dff0844283608b92ae00d6083b98801b0ad96cc663
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBL6:knw9oUUEEDl37jcq4A
MD5 SHA1 SHA512 SSDEEP

Submit Download

hhnYdDb.exe

Path C:\Windows\System32\hhnYdDb.exe
Size 1.0MB
SHA256 ef987d8b74ce2597451d0643f24403320f3ef8c7b75300c5cad8973545eebe18
MD5 3ed992022be1d421ca22be97ace8deef
SHA1 2f2a2c4a6065ecfb3d62f8f35d96b484142d9665
SHA512 52062823bb1aa465af52bde2827b78bcf8a947ee18d4d12e6ae437096d08038cc0a7ae3b507166825c5849ec6b75e19ccb18fe55fe7b7687dcbd77f5798445ea
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBLB:knw9oUUEEDl37jcq4v
MD5 SHA1 SHA512 SSDEEP

Submit Download

hplqZcN.exe

Path C:\Windows\System32\hplqZcN.exe
Size 1.0MB
SHA256 476940d41211e4471f3dbd175f90b1ff5e049c3d0d881493dab9e4e326d3e77a
MD5 0967702cf56b2e3de2b40422d05d462d
SHA1 f72b25f13053145d0fb1017b448a9c8e5205849d
SHA512 ca4f960733683917dff1505fb44e5792cd7e71f2a9a4910d11aec73ed2b1ce22e2837e68b1cbe398af1037df146d5b9548bd52be05be49b5ecd1bbf43e811f79
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBLr7:knw9oUUEEDl37jcq45
MD5 SHA1 SHA512 SSDEEP

Submit Download

iOdpWDi.exe

Path C:\Windows\System32\iOdpWDi.exe
Size 1.0MB
SHA256 a7ffaead5e362f92d4ecd129a5b1affc23b0ab06505dbdeb97d35da6a35b33cf
MD5 09dea9ab8a3c34c5de49fbf38373bc46
SHA1 33f15f37ad48bdc2d627b2f7af556fe67951ccc8
SHA512 57f0e761da4034c528167ef8d74e8ac22eb8d627b14ddada01f82e9421b05de60a5031fde2668709e86bac8aa8a3aa478d5b09706e42f5e23255623fbfd7da1d
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBLT:knw9oUUEEDl37jcq4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

kpomvNf.exe

Path C:\Windows\System32\kpomvNf.exe
Size 1.0MB
SHA256 b17a8138dcff63d6f131adab58f996458abef1b244e3b7f51b2a8cf8f5250c1f
MD5 f47c3da3ebd84d536f6f3cae62c08d1c
SHA1 0458c8d18d56dd4291f80f3900434a3782121118
SHA512 78f936d65b285668f75ad9e0780413f3eeabbb9fc917c1d03816af355b9555a3fa247bcc9141817f80fd78432b678a0f6c1c3552bdbbd00e19aa7c3d0763ff6b
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBLy:knw9oUUEEDl37jcq44
MD5 SHA1 SHA512 SSDEEP

Submit Download

mEdLdHy.exe

Path C:\Windows\System32\mEdLdHy.exe
Size 1.0MB
SHA256 73a2d002808eac67012e6dcede9cad6a714479ce3660e6614f6a67bf8062e995
MD5 e412ab70666e1e185b4c19c128c61a87
SHA1 614ff3c295b6651406e4e14540b1d88b0d2b137d
SHA512 c2ce35d6cbfa921605dbd5c5bda9cd38faff0c1e36413c98041aef0ab68d47dc77b16806ad8b522ac97722f4277431308657ba39db43f1833da27452c30093ac
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBL9:knw9oUUEEDl37jcq4b
MD5 SHA1 SHA512 SSDEEP

Submit Download

nTtJvci.exe

Path C:\Windows\System32\nTtJvci.exe
Size 1.0MB
SHA256 c4beba8d22bb8d7e2a54d0c9c9d8407cdb4ccf850d20e8b39a182b0899358ba4
MD5 b287d7146496390f35cbf7dc573e7ce3
SHA1 8ab141c908b012ebee04c631f9eeb8751bd8d763
SHA512 67aa39b6971c655c2809e5355bd2e86fa448f6bff0689474a25a84ca348c2959a99134c859301374f6b26b86335c834f83a49cc71973ae2ea4256be9097cc782
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBLT:knw9oUUEEDl37jcq41
MD5 SHA1 SHA512 SSDEEP

Submit Download

nfuaxeM.exe

Path C:\Windows\System32\nfuaxeM.exe
Size 1.0MB
SHA256 ba8568541398e1bb567d5b7a891483f50c308b02c04373903ee93e2f183b8b5d
MD5 1286a50e754e5c997fa0fc43edb91d11
SHA1 fcbe4dd0603f7696507e58fcd4e3707f2c41a4aa
SHA512 095731b5956145beb35654449cda1c8b8070322abd16bf37db49978cc1bd9665ff4c62517f85bb0514d123cc96d149d31a58995419b509526ac039d3d0f5bece
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBLXF:knw9oUUEEDl37jcq4H
MD5 SHA1 SHA512 SSDEEP

Submit Download

pJmQryi.exe

Path C:\Windows\System32\pJmQryi.exe
Size 1.0MB
SHA256 978072d4dc8df6a56f2a2a00329396e46d0f1622c5d77327ff7ee328e55bcde2
MD5 f89dc6ea322fdef23e49d2faa15817b7
SHA1 ae59697c4cab6bf5806ac32577cf6a238066bab6
SHA512 c3efc9c3f44986686f4dd154719b4229d0d606133843b459e45960af3c6f917c611814fd65887870c37d7769473982686000ba52b4dbd59abeee04b51a31b7be
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBLM:knw9oUUEEDl37jcq4q
MD5 SHA1 SHA512 SSDEEP

Submit Download

qSMIjta.exe

Path C:\Windows\System32\qSMIjta.exe
Size 1.0MB
SHA256 c9e8aca10b36560f217e63d95c608de1c180b88efdb01f10c8b6cfbc5762a5ca
MD5 eba12746f26a34557d186a5482c950de
SHA1 1369a91aea426eabf969433849ffea4c140c2ef5
SHA512 e08047013d6835cfad4f25cc65fe77aa9d45df3428da4e8a756553150b80c8a568d3774b1d869f4b6d4e5b3e56c0681f4ad6c1d73f8584ce5d6e6a65f3a0a5e0
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBL/:knw9oUUEEDl37jcq41
MD5 SHA1 SHA512 SSDEEP

Submit Download

rUwUucp.exe

Path C:\Windows\System32\rUwUucp.exe
Size 1.0MB
SHA256 2023fe4e267e6e196faf1c95fd2f3f2a6e34f439d50dca6d0d3ff19aa0570886
MD5 3b4cd3f5deeb93511c2461f4c70affbd
SHA1 192090e0a21a71eadb9790291468e2a46380ffde
SHA512 5086f0709684dfd25eecaa71af8ef0ee8fef04114614512f7828f20765396df4b8874323f055c0260e4fbaae849dc8c8e9eff1089605b1e74a9507b96acd752b
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBLs:knw9oUUEEDl37jcq4K
MD5 SHA1 SHA512 SSDEEP

Submit Download

tFBUlKQ.exe

Path C:\Windows\System32\tFBUlKQ.exe
Size 1.0MB
SHA256 a2ff03030fde0994b0288df8885bc2ca05504e1d3c24e72fc2de17036e55f4f0
MD5 818216cdc36d8355c52199636e8596a0
SHA1 9d4a7469ea31cf4442826372672648c7f85dd907
SHA512 5ade07740cd85eb569e7a6f72e9782aefaff7a54e1fe5dc0139f83194e45f2b46bef5967b84aca4d0b5c2449fe820bfd5a4506769907d7a6e8c4f6d0d4a477f1
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBLE:knw9oUUEEDl37jcq4O
MD5 SHA1 SHA512 SSDEEP

Submit Download

uLLXLHy.exe

Path C:\Windows\System32\uLLXLHy.exe
Size 1.0MB
SHA256 a6ef06e67f4810fd70c024b9087d198bf32dbc64bc899a9e3556165e47989602
MD5 1f63fc64be3a72689d643ebc39213f3b
SHA1 6e7fa55f3f5aad4bfb97c925861367e328b4c462
SHA512 1975c4e1da6eabdc2ce9a348c550c13c0d2d8d82fc7ddf07f09f1bb170008fbfe8bd91b3f8bbe10499d2be93a4336b5ee8ff8bfe45883af3de775fea5cbcd503
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBLw:knw9oUUEEDl37jcq4G
MD5 SHA1 SHA512 SSDEEP

Submit Download

ugoknnD.exe

Path C:\Windows\System32\ugoknnD.exe
Size 1.0MB
SHA256 90f98cef29034eeeb12237a281fb6076dce38671953e90da7e511bd6a20214aa
MD5 3599fd3500bb394b3a29f20d6335b365
SHA1 dc063ae3d63a33f656c6dec6725f8ef14cf11486
SHA512 6831809542f8ebfc062f2b64a68d0dbc02520e4ebc51e6b2f49c5f83497f970dfaa644eb848a0d410a8c2c8b82a208a06bbd42f1e33732e5fe85b27f2ad622f7
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBLa:knw9oUUEEDl37jcq4M
MD5 SHA1 SHA512 SSDEEP

Submit Download

vHJDmHr.exe

Path C:\Windows\System32\vHJDmHr.exe
Size 1.0MB
SHA256 ea38b00333a3e286c61439b74859404166096ecb40a4dfaf6d2c09797f03e2cf
MD5 66c9f6451a0f4511258a865608807bae
SHA1 553d2c923d6e94d730552c3197e9dbe9d430665c
SHA512 090ec3d0c2dd1c2bde097b9f173831c43836a6fc03d6be1d1e7c391c2a0a66f1fcd87e8adb7ee0aaf4463f04888ad245403a67d67be0bb252bfd115658c17c16
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBLJ:knw9oUUEEDl37jcq4T
MD5 SHA1 SHA512 SSDEEP

Submit Download

wDbFyny.exe

Path C:\Windows\System32\wDbFyny.exe
Size 1.0MB
SHA256 2bccecb20dca535ce4a11f0b07fb36be2ce27a52473604e62a6c5b48429d1fc4
MD5 4e38e87864215fe5b636547820e2efc9
SHA1 229cb56c070efc208d08e7204f0c200def479ee6
SHA512 2c57efc190dca32debf871c886776f0543cbfcb53a3a902b7d33cc3c281d5a0da77c3ed75b30bf0a600ab5bc8732759d6ca71a66d6ffc64faf9e554018aef8a9
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBL7:knw9oUUEEDl37jcq4B
MD5 SHA1 SHA512 SSDEEP

Submit Download

xplacFN.exe

Path C:\Windows\System32\xplacFN.exe
Size 1.0MB
SHA256 c2fc7d9bf4daedf498c6a08eefee57686f22a863db9141c6e76cc1ccba36f4ee
MD5 3ecac9ca969853da33477b319b7a4228
SHA1 71fb52766c38b3dccb97325e596115a26f01c528
SHA512 41f7b48b2fb9777ec2d8337c17661cf35be646210b19bfb56e174cf62cc4ebbad7d33a418b25938351fff261664cfaee2ae06edb3a6b8cab2989a264e552e221
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBLB:knw9oUUEEDl37jcq4f
MD5 SHA1 SHA512 SSDEEP

Submit Download

yDPPzBD.exe

Path C:\Windows\System32\yDPPzBD.exe
Size 1.0MB
SHA256 9128b310d785b37c4c0cc40aae5ae24051b596baf9d3b84819da5e7562b5c778
MD5 6930f200bdebd490dfe5cd6c0c356ac5
SHA1 32c9d432c6305e39b11165e5d05f0b03fce6d77e
SHA512 85e2a0502f5ea0d2dcc6bb99df5b5dd7d7a37f2c43b6524c57cdd9eff1622c50c4e930c79f75615d192d2077ac30427d95e65091af732fc21cefb858adcad991
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBL+X:knw9oUUEEDl37jcq4e
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/336-2072-0x00007FF75A6B0000-0x00007FF75AAA1000-memory.dmp

Download

memory/336-2010-0x00007FF75A6B0000-0x00007FF75AAA1000-memory.dmp

Download

memory/336-31-0x00007FF75A6B0000-0x00007FF75AAA1000-memory.dmp

Download

memory/432-386-0x00007FF7CEB90000-0x00007FF7CEF81000-memory.dmp

Download

memory/432-2134-0x00007FF7CEB90000-0x00007FF7CEF81000-memory.dmp

Download

memory/652-387-0x00007FF65F770000-0x00007FF65FB61000-memory.dmp

Download

memory/652-2121-0x00007FF65F770000-0x00007FF65FB61000-memory.dmp

Download

memory/924-2085-0x00007FF77C010000-0x00007FF77C401000-memory.dmp

Download

memory/924-70-0x00007FF77C010000-0x00007FF77C401000-memory.dmp

Download

memory/1028-383-0x00007FF774850000-0x00007FF774C41000-memory.dmp

Download

memory/1028-2131-0x00007FF774850000-0x00007FF774C41000-memory.dmp

Download

memory/1052-43-0x00007FF6E1B80000-0x00007FF6E1F71000-memory.dmp

Download

memory/1052-2068-0x00007FF6E1B80000-0x00007FF6E1F71000-memory.dmp

Download

memory/1052-2011-0x00007FF6E1B80000-0x00007FF6E1F71000-memory.dmp

Download

memory/1332-1-0x0000019EFB790000-0x0000019EFB7A0000-memory.dmp

Download

memory/1332-2048-0x00007FF678210000-0x00007FF678601000-memory.dmp

Download

memory/1332-0-0x00007FF678210000-0x00007FF678601000-memory.dmp

Download

memory/1532-2119-0x00007FF734E30000-0x00007FF735221000-memory.dmp

Download

memory/1532-385-0x00007FF734E30000-0x00007FF735221000-memory.dmp

Download

memory/1552-2025-0x00007FF693DB0000-0x00007FF6941A1000-memory.dmp

Download

memory/1552-75-0x00007FF693DB0000-0x00007FF6941A1000-memory.dmp

Download

memory/1552-2081-0x00007FF693DB0000-0x00007FF6941A1000-memory.dmp

Download

memory/2068-382-0x00007FF7E4080000-0x00007FF7E4471000-memory.dmp

Download

memory/2068-2096-0x00007FF7E4080000-0x00007FF7E4471000-memory.dmp

Download

memory/2120-2062-0x00007FF77E330000-0x00007FF77E721000-memory.dmp

Download

memory/2120-14-0x00007FF77E330000-0x00007FF77E721000-memory.dmp

Download

memory/2376-378-0x00007FF60EA10000-0x00007FF60EE01000-memory.dmp

Download

memory/2376-2090-0x00007FF60EA10000-0x00007FF60EE01000-memory.dmp

Download

memory/2552-20-0x00007FF67E140000-0x00007FF67E531000-memory.dmp

Download

memory/2552-2009-0x00007FF67E140000-0x00007FF67E531000-memory.dmp

Download

memory/2552-2064-0x00007FF67E140000-0x00007FF67E531000-memory.dmp

Download

memory/2924-67-0x00007FF7865E0000-0x00007FF7869D1000-memory.dmp

Download

memory/2924-2074-0x00007FF7865E0000-0x00007FF7869D1000-memory.dmp

Download

memory/3224-381-0x00007FF64C140000-0x00007FF64C531000-memory.dmp

Download

memory/3224-2094-0x00007FF64C140000-0x00007FF64C531000-memory.dmp

Download

memory/3304-2050-0x00007FF730BD0000-0x00007FF730FC1000-memory.dmp

Download

memory/3304-2086-0x00007FF730BD0000-0x00007FF730FC1000-memory.dmp

Download

memory/3304-79-0x00007FF730BD0000-0x00007FF730FC1000-memory.dmp

Download

memory/3560-2070-0x00007FF755420000-0x00007FF755811000-memory.dmp

Download

memory/3560-56-0x00007FF755420000-0x00007FF755811000-memory.dmp

Download

memory/3616-388-0x00007FF61E4E0000-0x00007FF61E8D1000-memory.dmp

Download

memory/3616-2135-0x00007FF61E4E0000-0x00007FF61E8D1000-memory.dmp

Download

memory/3800-2083-0x00007FF7BA8A0000-0x00007FF7BAC91000-memory.dmp

Download

memory/3800-52-0x00007FF7BA8A0000-0x00007FF7BAC91000-memory.dmp

Download

memory/3800-2013-0x00007FF7BA8A0000-0x00007FF7BAC91000-memory.dmp

Download

memory/3868-2079-0x00007FF65DD60000-0x00007FF65E151000-memory.dmp

Download

memory/3868-71-0x00007FF65DD60000-0x00007FF65E151000-memory.dmp

Download

memory/4428-59-0x00007FF7138F0000-0x00007FF713CE1000-memory.dmp

Download

memory/4428-2067-0x00007FF7138F0000-0x00007FF713CE1000-memory.dmp

Download

memory/4688-2092-0x00007FF6A0CC0000-0x00007FF6A10B1000-memory.dmp

Download

memory/4688-380-0x00007FF6A0CC0000-0x00007FF6A10B1000-memory.dmp

Download

memory/4872-48-0x00007FF7E1D40000-0x00007FF7E2131000-memory.dmp

Download

memory/4872-2012-0x00007FF7E1D40000-0x00007FF7E2131000-memory.dmp

Download

memory/4872-2076-0x00007FF7E1D40000-0x00007FF7E2131000-memory.dmp

Download

memory/4896-2088-0x00007FF6B8260000-0x00007FF6B8651000-memory.dmp

Download

memory/4896-379-0x00007FF6B8260000-0x00007FF6B8651000-memory.dmp

Download

memory/4948-384-0x00007FF705810000-0x00007FF705C01000-memory.dmp

Download

memory/4948-2120-0x00007FF705810000-0x00007FF705C01000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads