xmrig | 49b31b46f9962d6b81c66b05dc802c91954a3988a52bd9fa608d15b6f5a25058

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 02:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
Size

1.2MB
MD5

77a969e9e4e2d73096c7264dcbf7bc65
SHA1

933277ca4230b4801b86298751545edb76a1aa78
SHA256

49b31b46f9962d6b81c66b05dc802c91954a3988a52bd9fa608d15b6f5a25058
SHA512

dfe6f8992cf8813eed8ea6f92eb5afd12c492d17a29cd24c6ad12b67cde83784bef69e9c197c7f3572ef34962df3ef5a21f02897b161bfa8a066600301d0e19b
SSDEEP

24576:JanwhSe11QSONCpGJCjETPlGC78XCej5CnGJIO:knw9oUUEEDlGUrM5CnA

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/3712-364-0x00007FF73E070000-0x00007FF73E461000-memory.dmp	xmrig
behavioral2/memory/3432-368-0x00007FF6BE8C0000-0x00007FF6BECB1000-memory.dmp	xmrig
behavioral2/memory/3492-373-0x00007FF62A8B0000-0x00007FF62ACA1000-memory.dmp	xmrig
behavioral2/memory/1968-375-0x00007FF730A60000-0x00007FF730E51000-memory.dmp	xmrig
behavioral2/memory/732-13-0x00007FF6BB9F0000-0x00007FF6BBDE1000-memory.dmp	xmrig
behavioral2/memory/3948-376-0x00007FF7DCFA0000-0x00007FF7DD391000-memory.dmp	xmrig
behavioral2/memory/2340-377-0x00007FF693C20000-0x00007FF694011000-memory.dmp	xmrig
behavioral2/memory/2512-379-0x00007FF6F3B70000-0x00007FF6F3F61000-memory.dmp	xmrig
behavioral2/memory/2120-378-0x00007FF6BA070000-0x00007FF6BA461000-memory.dmp	xmrig
behavioral2/memory/1600-382-0x00007FF6FF070000-0x00007FF6FF461000-memory.dmp	xmrig
behavioral2/memory/4132-383-0x00007FF7D75F0000-0x00007FF7D79E1000-memory.dmp	xmrig
behavioral2/memory/2412-381-0x00007FF62B5E0000-0x00007FF62B9D1000-memory.dmp	xmrig
behavioral2/memory/4656-380-0x00007FF767060000-0x00007FF767451000-memory.dmp	xmrig
behavioral2/memory/1152-409-0x00007FF62BD80000-0x00007FF62C171000-memory.dmp	xmrig
behavioral2/memory/3456-418-0x00007FF6C5170000-0x00007FF6C5561000-memory.dmp	xmrig
behavioral2/memory/2136-403-0x00007FF744ED0000-0x00007FF7452C1000-memory.dmp	xmrig
behavioral2/memory/1604-396-0x00007FF7210E0000-0x00007FF7214D1000-memory.dmp	xmrig
behavioral2/memory/4752-421-0x00007FF68CC80000-0x00007FF68D071000-memory.dmp	xmrig
behavioral2/memory/3100-427-0x00007FF700D10000-0x00007FF701101000-memory.dmp	xmrig
behavioral2/memory/4568-431-0x00007FF769600000-0x00007FF7699F1000-memory.dmp	xmrig
behavioral2/memory/4140-443-0x00007FF7D3ED0000-0x00007FF7D42C1000-memory.dmp	xmrig
behavioral2/memory/3924-436-0x00007FF74BB30000-0x00007FF74BF21000-memory.dmp	xmrig
behavioral2/memory/3172-447-0x00007FF67B240000-0x00007FF67B631000-memory.dmp	xmrig
behavioral2/memory/4124-1978-0x00007FF6F26B0000-0x00007FF6F2AA1000-memory.dmp	xmrig
behavioral2/memory/732-1980-0x00007FF6BB9F0000-0x00007FF6BBDE1000-memory.dmp	xmrig
behavioral2/memory/4124-1985-0x00007FF6F26B0000-0x00007FF6F2AA1000-memory.dmp	xmrig
behavioral2/memory/3712-1988-0x00007FF73E070000-0x00007FF73E461000-memory.dmp	xmrig
behavioral2/memory/732-1989-0x00007FF6BB9F0000-0x00007FF6BBDE1000-memory.dmp	xmrig
behavioral2/memory/3432-1991-0x00007FF6BE8C0000-0x00007FF6BECB1000-memory.dmp	xmrig
behavioral2/memory/3492-1995-0x00007FF62A8B0000-0x00007FF62ACA1000-memory.dmp	xmrig
behavioral2/memory/3172-1994-0x00007FF67B240000-0x00007FF67B631000-memory.dmp	xmrig
behavioral2/memory/4752-2035-0x00007FF68CC80000-0x00007FF68D071000-memory.dmp	xmrig
behavioral2/memory/3456-2043-0x00007FF6C5170000-0x00007FF6C5561000-memory.dmp	xmrig
behavioral2/memory/2120-2055-0x00007FF6BA070000-0x00007FF6BA461000-memory.dmp	xmrig
behavioral2/memory/4140-2061-0x00007FF7D3ED0000-0x00007FF7D42C1000-memory.dmp	xmrig
behavioral2/memory/3924-2067-0x00007FF74BB30000-0x00007FF74BF21000-memory.dmp	xmrig
behavioral2/memory/4568-2059-0x00007FF769600000-0x00007FF7699F1000-memory.dmp	xmrig
behavioral2/memory/3100-2057-0x00007FF700D10000-0x00007FF701101000-memory.dmp	xmrig
behavioral2/memory/1968-2041-0x00007FF730A60000-0x00007FF730E51000-memory.dmp	xmrig
behavioral2/memory/3948-2040-0x00007FF7DCFA0000-0x00007FF7DD391000-memory.dmp	xmrig
behavioral2/memory/2340-2038-0x00007FF693C20000-0x00007FF694011000-memory.dmp	xmrig
behavioral2/memory/4656-2033-0x00007FF767060000-0x00007FF767451000-memory.dmp	xmrig
behavioral2/memory/2512-2031-0x00007FF6F3B70000-0x00007FF6F3F61000-memory.dmp	xmrig
behavioral2/memory/2412-2030-0x00007FF62B5E0000-0x00007FF62B9D1000-memory.dmp	xmrig
behavioral2/memory/1600-2027-0x00007FF6FF070000-0x00007FF6FF461000-memory.dmp	xmrig
behavioral2/memory/4132-2026-0x00007FF7D75F0000-0x00007FF7D79E1000-memory.dmp	xmrig
behavioral2/memory/1604-2023-0x00007FF7210E0000-0x00007FF7214D1000-memory.dmp	xmrig
behavioral2/memory/2136-2021-0x00007FF744ED0000-0x00007FF7452C1000-memory.dmp	xmrig
behavioral2/memory/1152-2019-0x00007FF62BD80000-0x00007FF62C171000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4124	lUUgaDY.exe
732	oOiNrIW.exe
3712	nHmztpH.exe
3432	uBgDZem.exe
3172	jDuqtQk.exe
3492	HSzUopP.exe
1968	kvxfIYG.exe
3948	ldHkmQz.exe
2340	fSiYmQU.exe
2120	WfWQhlg.exe
2512	ZUWJlOB.exe
4656	TzsGwdj.exe
2412	RYSKXbL.exe
1600	jSLquCR.exe
4132	gHFZmym.exe
1604	lOUmbCr.exe
2136	geLJnoJ.exe
1152	cpMRNGp.exe
3456	VKEGPPm.exe
4752	XPhvCSC.exe
3100	umoYzdr.exe
4568	kUHORBP.exe
3924	raLnniQ.exe
4140	LyACDuG.exe
4424	zAlxxWP.exe
3856	gnfgyRJ.exe
2296	TYOESij.exe
4372	GtqupKE.exe
1652	VGqScsa.exe
3140	VdABByB.exe
5096	AYvwCRY.exe
4988	jIChnXw.exe
3780	EAheVYc.exe
3280	ZXVnbZY.exe
3400	GeopokM.exe
2040	tPIfSpT.exe
3540	gDqoFaX.exe
3700	MAkkWzw.exe
3436	SjrYkep.exe
4816	LmpJawp.exe
4236	axbNaII.exe
440	tTSoRbN.exe
4536	kvVzPlv.exe
2056	FPcghsB.exe
3188	KVGFURd.exe
4300	VTmWhdu.exe
4808	tmEYeGr.exe
4824	AwwdrPX.exe
632	KIPGfti.exe
4308	uXgPjxb.exe
100	OPwCJMY.exe
3864	PPRLhYV.exe
3192	wwtcJpC.exe
1984	QiqAZTR.exe
3908	exIpJId.exe
5076	CBgtePU.exe
2764	lwqWxPr.exe
1224	XCbqKoN.exe
4668	ZUUjsHs.exe
2724	ueKWNrV.exe
2240	WTXagAY.exe
1276	GlGSNkk.exe
4848	RxNhzPa.exe
1976	OdfyxzA.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/932-0-0x00007FF62A650000-0x00007FF62AA41000-memory.dmp	upx
behavioral2/files/0x000900000002340c-6.dat	upx
behavioral2/memory/4124-7-0x00007FF6F26B0000-0x00007FF6F2AA1000-memory.dmp	upx
behavioral2/files/0x000700000002341c-11.dat	upx
behavioral2/files/0x000700000002341d-15.dat	upx
behavioral2/files/0x000700000002341e-23.dat	upx
behavioral2/files/0x000700000002341f-28.dat	upx
behavioral2/files/0x0007000000023421-38.dat	upx
behavioral2/files/0x0007000000023422-43.dat	upx
behavioral2/files/0x0007000000023424-56.dat	upx
behavioral2/files/0x0007000000023426-61.dat	upx
behavioral2/files/0x0007000000023427-71.dat	upx
behavioral2/files/0x000700000002342a-81.dat	upx
behavioral2/files/0x000700000002342c-93.dat	upx
behavioral2/files/0x0007000000023437-148.dat	upx
behavioral2/memory/3712-364-0x00007FF73E070000-0x00007FF73E461000-memory.dmp	upx
behavioral2/memory/3432-368-0x00007FF6BE8C0000-0x00007FF6BECB1000-memory.dmp	upx
behavioral2/memory/3492-373-0x00007FF62A8B0000-0x00007FF62ACA1000-memory.dmp	upx
behavioral2/files/0x000700000002343a-163.dat	upx
behavioral2/files/0x0007000000023439-158.dat	upx
behavioral2/files/0x0007000000023438-153.dat	upx
behavioral2/memory/1968-375-0x00007FF730A60000-0x00007FF730E51000-memory.dmp	upx
behavioral2/files/0x0007000000023436-143.dat	upx
behavioral2/files/0x0007000000023435-138.dat	upx
behavioral2/files/0x0007000000023434-133.dat	upx
behavioral2/files/0x0007000000023433-128.dat	upx
behavioral2/files/0x0007000000023432-123.dat	upx
behavioral2/files/0x0007000000023431-121.dat	upx
behavioral2/files/0x0007000000023430-116.dat	upx
behavioral2/files/0x000700000002342f-111.dat	upx
behavioral2/files/0x000700000002342e-103.dat	upx
behavioral2/files/0x000700000002342d-98.dat	upx
behavioral2/files/0x000700000002342b-91.dat	upx
behavioral2/files/0x0007000000023429-78.dat	upx
behavioral2/files/0x0007000000023428-73.dat	upx
behavioral2/files/0x0007000000023425-58.dat	upx
behavioral2/files/0x0007000000023423-48.dat	upx
behavioral2/files/0x0007000000023420-33.dat	upx
behavioral2/memory/732-13-0x00007FF6BB9F0000-0x00007FF6BBDE1000-memory.dmp	upx
behavioral2/memory/3948-376-0x00007FF7DCFA0000-0x00007FF7DD391000-memory.dmp	upx
behavioral2/memory/2340-377-0x00007FF693C20000-0x00007FF694011000-memory.dmp	upx
behavioral2/memory/2512-379-0x00007FF6F3B70000-0x00007FF6F3F61000-memory.dmp	upx
behavioral2/memory/2120-378-0x00007FF6BA070000-0x00007FF6BA461000-memory.dmp	upx
behavioral2/memory/1600-382-0x00007FF6FF070000-0x00007FF6FF461000-memory.dmp	upx
behavioral2/memory/4132-383-0x00007FF7D75F0000-0x00007FF7D79E1000-memory.dmp	upx
behavioral2/memory/2412-381-0x00007FF62B5E0000-0x00007FF62B9D1000-memory.dmp	upx
behavioral2/memory/4656-380-0x00007FF767060000-0x00007FF767451000-memory.dmp	upx
behavioral2/memory/1152-409-0x00007FF62BD80000-0x00007FF62C171000-memory.dmp	upx
behavioral2/memory/3456-418-0x00007FF6C5170000-0x00007FF6C5561000-memory.dmp	upx
behavioral2/memory/2136-403-0x00007FF744ED0000-0x00007FF7452C1000-memory.dmp	upx
behavioral2/memory/1604-396-0x00007FF7210E0000-0x00007FF7214D1000-memory.dmp	upx
behavioral2/memory/4752-421-0x00007FF68CC80000-0x00007FF68D071000-memory.dmp	upx
behavioral2/memory/3100-427-0x00007FF700D10000-0x00007FF701101000-memory.dmp	upx
behavioral2/memory/4568-431-0x00007FF769600000-0x00007FF7699F1000-memory.dmp	upx
behavioral2/memory/4140-443-0x00007FF7D3ED0000-0x00007FF7D42C1000-memory.dmp	upx
behavioral2/memory/3924-436-0x00007FF74BB30000-0x00007FF74BF21000-memory.dmp	upx
behavioral2/memory/3172-447-0x00007FF67B240000-0x00007FF67B631000-memory.dmp	upx
behavioral2/memory/4124-1978-0x00007FF6F26B0000-0x00007FF6F2AA1000-memory.dmp	upx
behavioral2/memory/732-1980-0x00007FF6BB9F0000-0x00007FF6BBDE1000-memory.dmp	upx
behavioral2/memory/4124-1985-0x00007FF6F26B0000-0x00007FF6F2AA1000-memory.dmp	upx
behavioral2/memory/3712-1988-0x00007FF73E070000-0x00007FF73E461000-memory.dmp	upx
behavioral2/memory/732-1989-0x00007FF6BB9F0000-0x00007FF6BBDE1000-memory.dmp	upx
behavioral2/memory/3432-1991-0x00007FF6BE8C0000-0x00007FF6BECB1000-memory.dmp	upx
behavioral2/memory/3492-1995-0x00007FF62A8B0000-0x00007FF62ACA1000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\PPiAKVb.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\smfYeIr.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\ZrFDlaK.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\WFCIYsV.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\HVVNIKA.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\MAkkWzw.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\baIwPeX.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\IbhkQVX.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\nyglfUj.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\geLJnoJ.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\EwEfuuD.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\vpjTXkT.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\PVfqIbO.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\vZWRcqj.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\thwuFAz.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\lnvkEdg.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\VmPxyUM.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\KpLNKxp.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\XjAFsha.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\BOabiHp.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\rfJRAjj.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\SykrXwp.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\IQdcsER.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\MzobOWb.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\QwWBtMq.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\DvvieUQ.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\umFRZJr.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\YbpyRdo.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\QKxTYNI.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\qDgXqxs.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\qiFfvVG.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\gELceXD.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\dAjlEmq.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\mZqOoPm.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\jIChnXw.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\QiqAZTR.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\YMaEhGB.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\LNJMWwr.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\chmFEHa.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\xLNPGWe.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\xWYBqeZ.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\BBWninM.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\uqohbpK.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\LHViSGi.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\QMOkhER.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\kWcaZtx.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\LiQwkBE.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\sDzTIxJ.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\vsWmTgm.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\KkNEvJx.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\rvwxFla.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\raLnniQ.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\GtqupKE.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\aNvmmrS.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\aTiPrwa.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\pwrDBFO.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\DzhkyvY.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\GxoPGGf.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\frYWUdi.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\LsgKwsg.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\jSLquCR.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\rjELWhQ.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\ArEhKsP.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
File created	C:\Windows\System32\NHuyFDW.exe	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 4124	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	84
PID 932 wrote to memory of 4124	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	84
PID 932 wrote to memory of 732	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	85
PID 932 wrote to memory of 732	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	85
PID 932 wrote to memory of 3712	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	86
PID 932 wrote to memory of 3712	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	86
PID 932 wrote to memory of 3432	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	87
PID 932 wrote to memory of 3432	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	87
PID 932 wrote to memory of 3172	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	88
PID 932 wrote to memory of 3172	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	88
PID 932 wrote to memory of 3492	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	89
PID 932 wrote to memory of 3492	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	89
PID 932 wrote to memory of 1968	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	90
PID 932 wrote to memory of 1968	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	90
PID 932 wrote to memory of 3948	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	91
PID 932 wrote to memory of 3948	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	91
PID 932 wrote to memory of 2340	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	92
PID 932 wrote to memory of 2340	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	92
PID 932 wrote to memory of 2120	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	93
PID 932 wrote to memory of 2120	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	93
PID 932 wrote to memory of 2512	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	94
PID 932 wrote to memory of 2512	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	94
PID 932 wrote to memory of 4656	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	95
PID 932 wrote to memory of 4656	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	95
PID 932 wrote to memory of 2412	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	96
PID 932 wrote to memory of 2412	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	96
PID 932 wrote to memory of 1600	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	97
PID 932 wrote to memory of 1600	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	97
PID 932 wrote to memory of 4132	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	98
PID 932 wrote to memory of 4132	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	98
PID 932 wrote to memory of 1604	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	99
PID 932 wrote to memory of 1604	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	99
PID 932 wrote to memory of 2136	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	100
PID 932 wrote to memory of 2136	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	100
PID 932 wrote to memory of 1152	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	101
PID 932 wrote to memory of 1152	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	101
PID 932 wrote to memory of 3456	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	102
PID 932 wrote to memory of 3456	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	102
PID 932 wrote to memory of 4752	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	103
PID 932 wrote to memory of 4752	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	103
PID 932 wrote to memory of 3100	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	104
PID 932 wrote to memory of 3100	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	104
PID 932 wrote to memory of 4568	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	105
PID 932 wrote to memory of 4568	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	105
PID 932 wrote to memory of 3924	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	106
PID 932 wrote to memory of 3924	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	106
PID 932 wrote to memory of 4140	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	107
PID 932 wrote to memory of 4140	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	107
PID 932 wrote to memory of 4424	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	108
PID 932 wrote to memory of 4424	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	108
PID 932 wrote to memory of 3856	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	109
PID 932 wrote to memory of 3856	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	109
PID 932 wrote to memory of 2296	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	110
PID 932 wrote to memory of 2296	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	110
PID 932 wrote to memory of 4372	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	111
PID 932 wrote to memory of 4372	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	111
PID 932 wrote to memory of 1652	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	112
PID 932 wrote to memory of 1652	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	112
PID 932 wrote to memory of 3140	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	113
PID 932 wrote to memory of 3140	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	113
PID 932 wrote to memory of 5096	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	114
PID 932 wrote to memory of 5096	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	114
PID 932 wrote to memory of 4988	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	115
PID 932 wrote to memory of 4988	932	77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\77a969e9e4e2d73096c7264dcbf7bc65_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:932
- C:\Windows\System32\lUUgaDY.exe
  C:\Windows\System32\lUUgaDY.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System32\oOiNrIW.exe
  C:\Windows\System32\oOiNrIW.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System32\nHmztpH.exe
  C:\Windows\System32\nHmztpH.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System32\uBgDZem.exe
  C:\Windows\System32\uBgDZem.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System32\jDuqtQk.exe
  C:\Windows\System32\jDuqtQk.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System32\HSzUopP.exe
  C:\Windows\System32\HSzUopP.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System32\kvxfIYG.exe
  C:\Windows\System32\kvxfIYG.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System32\ldHkmQz.exe
  C:\Windows\System32\ldHkmQz.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System32\fSiYmQU.exe
  C:\Windows\System32\fSiYmQU.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System32\WfWQhlg.exe
  C:\Windows\System32\WfWQhlg.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System32\ZUWJlOB.exe
  C:\Windows\System32\ZUWJlOB.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System32\TzsGwdj.exe
  C:\Windows\System32\TzsGwdj.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System32\RYSKXbL.exe
  C:\Windows\System32\RYSKXbL.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System32\jSLquCR.exe
  C:\Windows\System32\jSLquCR.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System32\gHFZmym.exe
  C:\Windows\System32\gHFZmym.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System32\lOUmbCr.exe
  C:\Windows\System32\lOUmbCr.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System32\geLJnoJ.exe
  C:\Windows\System32\geLJnoJ.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System32\cpMRNGp.exe
  C:\Windows\System32\cpMRNGp.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System32\VKEGPPm.exe
  C:\Windows\System32\VKEGPPm.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System32\XPhvCSC.exe
  C:\Windows\System32\XPhvCSC.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System32\umoYzdr.exe
  C:\Windows\System32\umoYzdr.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System32\kUHORBP.exe
  C:\Windows\System32\kUHORBP.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System32\raLnniQ.exe
  C:\Windows\System32\raLnniQ.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System32\LyACDuG.exe
  C:\Windows\System32\LyACDuG.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System32\zAlxxWP.exe
  C:\Windows\System32\zAlxxWP.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System32\gnfgyRJ.exe
  C:\Windows\System32\gnfgyRJ.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System32\TYOESij.exe
  C:\Windows\System32\TYOESij.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System32\GtqupKE.exe
  C:\Windows\System32\GtqupKE.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System32\VGqScsa.exe
  C:\Windows\System32\VGqScsa.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System32\VdABByB.exe
  C:\Windows\System32\VdABByB.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System32\AYvwCRY.exe
  C:\Windows\System32\AYvwCRY.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System32\jIChnXw.exe
  C:\Windows\System32\jIChnXw.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System32\EAheVYc.exe
  C:\Windows\System32\EAheVYc.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System32\ZXVnbZY.exe
  C:\Windows\System32\ZXVnbZY.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System32\GeopokM.exe
  C:\Windows\System32\GeopokM.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System32\tPIfSpT.exe
  C:\Windows\System32\tPIfSpT.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System32\gDqoFaX.exe
  C:\Windows\System32\gDqoFaX.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System32\MAkkWzw.exe
  C:\Windows\System32\MAkkWzw.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System32\SjrYkep.exe
  C:\Windows\System32\SjrYkep.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System32\LmpJawp.exe
  C:\Windows\System32\LmpJawp.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System32\axbNaII.exe
  C:\Windows\System32\axbNaII.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System32\tTSoRbN.exe
  C:\Windows\System32\tTSoRbN.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System32\kvVzPlv.exe
  C:\Windows\System32\kvVzPlv.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System32\FPcghsB.exe
  C:\Windows\System32\FPcghsB.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System32\KVGFURd.exe
  C:\Windows\System32\KVGFURd.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System32\VTmWhdu.exe
  C:\Windows\System32\VTmWhdu.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System32\tmEYeGr.exe
  C:\Windows\System32\tmEYeGr.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System32\AwwdrPX.exe
  C:\Windows\System32\AwwdrPX.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System32\KIPGfti.exe
  C:\Windows\System32\KIPGfti.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System32\uXgPjxb.exe
  C:\Windows\System32\uXgPjxb.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System32\OPwCJMY.exe
  C:\Windows\System32\OPwCJMY.exe
  2⤵
  - Executes dropped EXE
  PID:100
- C:\Windows\System32\PPRLhYV.exe
  C:\Windows\System32\PPRLhYV.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System32\wwtcJpC.exe
  C:\Windows\System32\wwtcJpC.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System32\QiqAZTR.exe
  C:\Windows\System32\QiqAZTR.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System32\exIpJId.exe
  C:\Windows\System32\exIpJId.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System32\CBgtePU.exe
  C:\Windows\System32\CBgtePU.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System32\lwqWxPr.exe
  C:\Windows\System32\lwqWxPr.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System32\XCbqKoN.exe
  C:\Windows\System32\XCbqKoN.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System32\ZUUjsHs.exe
  C:\Windows\System32\ZUUjsHs.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System32\ueKWNrV.exe
  C:\Windows\System32\ueKWNrV.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System32\WTXagAY.exe
  C:\Windows\System32\WTXagAY.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System32\GlGSNkk.exe
  C:\Windows\System32\GlGSNkk.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System32\RxNhzPa.exe
  C:\Windows\System32\RxNhzPa.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System32\OdfyxzA.exe
  C:\Windows\System32\OdfyxzA.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System32\zcoGvbf.exe
  C:\Windows\System32\zcoGvbf.exe
  2⤵
  PID:1444
- C:\Windows\System32\lbrOMKz.exe
  C:\Windows\System32\lbrOMKz.exe
  2⤵
  PID:448
- C:\Windows\System32\wIcBcPb.exe
  C:\Windows\System32\wIcBcPb.exe
  2⤵
  PID:760
- C:\Windows\System32\MMxtukL.exe
  C:\Windows\System32\MMxtukL.exe
  2⤵
  PID:1020
- C:\Windows\System32\cBBstbC.exe
  C:\Windows\System32\cBBstbC.exe
  2⤵
  PID:2540
- C:\Windows\System32\GIaEkTE.exe
  C:\Windows\System32\GIaEkTE.exe
  2⤵
  PID:4920
- C:\Windows\System32\YoGOGzi.exe
  C:\Windows\System32\YoGOGzi.exe
  2⤵
  PID:2552
- C:\Windows\System32\JZFTDqv.exe
  C:\Windows\System32\JZFTDqv.exe
  2⤵
  PID:4500
- C:\Windows\System32\QXJqzss.exe
  C:\Windows\System32\QXJqzss.exe
  2⤵
  PID:4312
- C:\Windows\System32\HESnPVq.exe
  C:\Windows\System32\HESnPVq.exe
  2⤵
  PID:3520
- C:\Windows\System32\RINKpyh.exe
  C:\Windows\System32\RINKpyh.exe
  2⤵
  PID:3512
- C:\Windows\System32\rNPCkRt.exe
  C:\Windows\System32\rNPCkRt.exe
  2⤵
  PID:1088
- C:\Windows\System32\BcteKuZ.exe
  C:\Windows\System32\BcteKuZ.exe
  2⤵
  PID:3240
- C:\Windows\System32\sLIhIQA.exe
  C:\Windows\System32\sLIhIQA.exe
  2⤵
  PID:5060
- C:\Windows\System32\BynCOfu.exe
  C:\Windows\System32\BynCOfu.exe
  2⤵
  PID:4256
- C:\Windows\System32\PGhLGNe.exe
  C:\Windows\System32\PGhLGNe.exe
  2⤵
  PID:744
- C:\Windows\System32\HeFCwvk.exe
  C:\Windows\System32\HeFCwvk.exe
  2⤵
  PID:1244
- C:\Windows\System32\uaWRURN.exe
  C:\Windows\System32\uaWRURN.exe
  2⤵
  PID:2792
- C:\Windows\System32\QJAJGKj.exe
  C:\Windows\System32\QJAJGKj.exe
  2⤵
  PID:844
- C:\Windows\System32\doquZmd.exe
  C:\Windows\System32\doquZmd.exe
  2⤵
  PID:1896
- C:\Windows\System32\nOmXhCz.exe
  C:\Windows\System32\nOmXhCz.exe
  2⤵
  PID:3252
- C:\Windows\System32\spARxnw.exe
  C:\Windows\System32\spARxnw.exe
  2⤵
  PID:1464
- C:\Windows\System32\WbjirKi.exe
  C:\Windows\System32\WbjirKi.exe
  2⤵
  PID:2008
- C:\Windows\System32\jrrtWEV.exe
  C:\Windows\System32\jrrtWEV.exe
  2⤵
  PID:2456
- C:\Windows\System32\qZTADjR.exe
  C:\Windows\System32\qZTADjR.exe
  2⤵
  PID:1156
- C:\Windows\System32\baIwPeX.exe
  C:\Windows\System32\baIwPeX.exe
  2⤵
  PID:1616
- C:\Windows\System32\zgSGFgP.exe
  C:\Windows\System32\zgSGFgP.exe
  2⤵
  PID:4580
- C:\Windows\System32\ArEhKsP.exe
  C:\Windows\System32\ArEhKsP.exe
  2⤵
  PID:3396
- C:\Windows\System32\pVuaHkG.exe
  C:\Windows\System32\pVuaHkG.exe
  2⤵
  PID:3152
- C:\Windows\System32\PmnAMNo.exe
  C:\Windows\System32\PmnAMNo.exe
  2⤵
  PID:1916
- C:\Windows\System32\SDbgODU.exe
  C:\Windows\System32\SDbgODU.exe
  2⤵
  PID:5148
- C:\Windows\System32\YUXkstB.exe
  C:\Windows\System32\YUXkstB.exe
  2⤵
  PID:5164
- C:\Windows\System32\zJHQAdh.exe
  C:\Windows\System32\zJHQAdh.exe
  2⤵
  PID:5204
- C:\Windows\System32\ptNQXCl.exe
  C:\Windows\System32\ptNQXCl.exe
  2⤵
  PID:5228
- C:\Windows\System32\ZZMfClM.exe
  C:\Windows\System32\ZZMfClM.exe
  2⤵
  PID:5260
- C:\Windows\System32\sEvgZhe.exe
  C:\Windows\System32\sEvgZhe.exe
  2⤵
  PID:5276
- C:\Windows\System32\qNhEOdy.exe
  C:\Windows\System32\qNhEOdy.exe
  2⤵
  PID:5348
- C:\Windows\System32\cmJTkDo.exe
  C:\Windows\System32\cmJTkDo.exe
  2⤵
  PID:5384
- C:\Windows\System32\uqohbpK.exe
  C:\Windows\System32\uqohbpK.exe
  2⤵
  PID:5460
- C:\Windows\System32\xJaduyx.exe
  C:\Windows\System32\xJaduyx.exe
  2⤵
  PID:5480
- C:\Windows\System32\OdtRXQF.exe
  C:\Windows\System32\OdtRXQF.exe
  2⤵
  PID:5496
- C:\Windows\System32\upSSoLV.exe
  C:\Windows\System32\upSSoLV.exe
  2⤵
  PID:5528
- C:\Windows\System32\MaQfPCJ.exe
  C:\Windows\System32\MaQfPCJ.exe
  2⤵
  PID:5620
- C:\Windows\System32\gjbhqMb.exe
  C:\Windows\System32\gjbhqMb.exe
  2⤵
  PID:5636
- C:\Windows\System32\XJMFbHS.exe
  C:\Windows\System32\XJMFbHS.exe
  2⤵
  PID:5652
- C:\Windows\System32\QjTuAPp.exe
  C:\Windows\System32\QjTuAPp.exe
  2⤵
  PID:5676
- C:\Windows\System32\XjAFsha.exe
  C:\Windows\System32\XjAFsha.exe
  2⤵
  PID:5692
- C:\Windows\System32\udSVkzL.exe
  C:\Windows\System32\udSVkzL.exe
  2⤵
  PID:5712
- C:\Windows\System32\HIyGGSv.exe
  C:\Windows\System32\HIyGGSv.exe
  2⤵
  PID:5744
- C:\Windows\System32\mhVMdWn.exe
  C:\Windows\System32\mhVMdWn.exe
  2⤵
  PID:5764
- C:\Windows\System32\mLGdPaZ.exe
  C:\Windows\System32\mLGdPaZ.exe
  2⤵
  PID:5804
- C:\Windows\System32\dhvFOqS.exe
  C:\Windows\System32\dhvFOqS.exe
  2⤵
  PID:5872
- C:\Windows\System32\pJciosT.exe
  C:\Windows\System32\pJciosT.exe
  2⤵
  PID:5892
- C:\Windows\System32\WswibLR.exe
  C:\Windows\System32\WswibLR.exe
  2⤵
  PID:5916
- C:\Windows\System32\YxbKogj.exe
  C:\Windows\System32\YxbKogj.exe
  2⤵
  PID:5960
- C:\Windows\System32\IbhkQVX.exe
  C:\Windows\System32\IbhkQVX.exe
  2⤵
  PID:6000
- C:\Windows\System32\zUnmboR.exe
  C:\Windows\System32\zUnmboR.exe
  2⤵
  PID:6044
- C:\Windows\System32\pIwrRqB.exe
  C:\Windows\System32\pIwrRqB.exe
  2⤵
  PID:6072
- C:\Windows\System32\yssfMVS.exe
  C:\Windows\System32\yssfMVS.exe
  2⤵
  PID:6120
- C:\Windows\System32\AvDvTct.exe
  C:\Windows\System32\AvDvTct.exe
  2⤵
  PID:6136
- C:\Windows\System32\QgJOFyo.exe
  C:\Windows\System32\QgJOFyo.exe
  2⤵
  PID:3828
- C:\Windows\System32\wlduFbg.exe
  C:\Windows\System32\wlduFbg.exe
  2⤵
  PID:552
- C:\Windows\System32\YMaEhGB.exe
  C:\Windows\System32\YMaEhGB.exe
  2⤵
  PID:2072
- C:\Windows\System32\XEZArey.exe
  C:\Windows\System32\XEZArey.exe
  2⤵
  PID:2252
- C:\Windows\System32\jaHHACv.exe
  C:\Windows\System32\jaHHACv.exe
  2⤵
  PID:5176
- C:\Windows\System32\vXagUyg.exe
  C:\Windows\System32\vXagUyg.exe
  2⤵
  PID:5216
- C:\Windows\System32\cRjEOua.exe
  C:\Windows\System32\cRjEOua.exe
  2⤵
  PID:1296
- C:\Windows\System32\QBGiXaQ.exe
  C:\Windows\System32\QBGiXaQ.exe
  2⤵
  PID:3916
- C:\Windows\System32\eKpyMif.exe
  C:\Windows\System32\eKpyMif.exe
  2⤵
  PID:5268
- C:\Windows\System32\vDgTcRK.exe
  C:\Windows\System32\vDgTcRK.exe
  2⤵
  PID:5336
- C:\Windows\System32\vDmMppX.exe
  C:\Windows\System32\vDmMppX.exe
  2⤵
  PID:5404
- C:\Windows\System32\GxoPGGf.exe
  C:\Windows\System32\GxoPGGf.exe
  2⤵
  PID:752
- C:\Windows\System32\ChXLILy.exe
  C:\Windows\System32\ChXLILy.exe
  2⤵
  PID:968
- C:\Windows\System32\tpGDbZP.exe
  C:\Windows\System32\tpGDbZP.exe
  2⤵
  PID:5512
- C:\Windows\System32\ZGpBisV.exe
  C:\Windows\System32\ZGpBisV.exe
  2⤵
  PID:5440
- C:\Windows\System32\xQexllA.exe
  C:\Windows\System32\xQexllA.exe
  2⤵
  PID:5452
- C:\Windows\System32\RadPEXm.exe
  C:\Windows\System32\RadPEXm.exe
  2⤵
  PID:5728
- C:\Windows\System32\SSoXvOv.exe
  C:\Windows\System32\SSoXvOv.exe
  2⤵
  PID:5740
- C:\Windows\System32\QADuXQX.exe
  C:\Windows\System32\QADuXQX.exe
  2⤵
  PID:5840
- C:\Windows\System32\tzIZYKD.exe
  C:\Windows\System32\tzIZYKD.exe
  2⤵
  PID:5904
- C:\Windows\System32\xLGClGw.exe
  C:\Windows\System32\xLGClGw.exe
  2⤵
  PID:5944
- C:\Windows\System32\MedKCZY.exe
  C:\Windows\System32\MedKCZY.exe
  2⤵
  PID:6012
- C:\Windows\System32\KjthQQP.exe
  C:\Windows\System32\KjthQQP.exe
  2⤵
  PID:6052
- C:\Windows\System32\IOCIsaJ.exe
  C:\Windows\System32\IOCIsaJ.exe
  2⤵
  PID:5984
- C:\Windows\System32\rHWApuK.exe
  C:\Windows\System32\rHWApuK.exe
  2⤵
  PID:6112
- C:\Windows\System32\WjUWxAT.exe
  C:\Windows\System32\WjUWxAT.exe
  2⤵
  PID:1972
- C:\Windows\System32\TKKYitk.exe
  C:\Windows\System32\TKKYitk.exe
  2⤵
  PID:4648
- C:\Windows\System32\YXmcgBH.exe
  C:\Windows\System32\YXmcgBH.exe
  2⤵
  PID:5156
- C:\Windows\System32\skPshXI.exe
  C:\Windows\System32\skPshXI.exe
  2⤵
  PID:5224
- C:\Windows\System32\dbKwvUo.exe
  C:\Windows\System32\dbKwvUo.exe
  2⤵
  PID:5252
- C:\Windows\System32\gELceXD.exe
  C:\Windows\System32\gELceXD.exe
  2⤵
  PID:348
- C:\Windows\System32\lvdXYxn.exe
  C:\Windows\System32\lvdXYxn.exe
  2⤵
  PID:5400
- C:\Windows\System32\NwGmfye.exe
  C:\Windows\System32\NwGmfye.exe
  2⤵
  PID:3752
- C:\Windows\System32\EdWRATF.exe
  C:\Windows\System32\EdWRATF.exe
  2⤵
  PID:5776
- C:\Windows\System32\vsWmTgm.exe
  C:\Windows\System32\vsWmTgm.exe
  2⤵
  PID:5980
- C:\Windows\System32\FXlkzJc.exe
  C:\Windows\System32\FXlkzJc.exe
  2⤵
  PID:5760
- C:\Windows\System32\UUAQHKH.exe
  C:\Windows\System32\UUAQHKH.exe
  2⤵
  PID:5132
- C:\Windows\System32\cUuCJNM.exe
  C:\Windows\System32\cUuCJNM.exe
  2⤵
  PID:2200
- C:\Windows\System32\LHViSGi.exe
  C:\Windows\System32\LHViSGi.exe
  2⤵
  PID:5704
- C:\Windows\System32\hhhkgxO.exe
  C:\Windows\System32\hhhkgxO.exe
  2⤵
  PID:5524
- C:\Windows\System32\gaqYGSV.exe
  C:\Windows\System32\gaqYGSV.exe
  2⤵
  PID:5884
- C:\Windows\System32\OqRZqqZ.exe
  C:\Windows\System32\OqRZqqZ.exe
  2⤵
  PID:5796
- C:\Windows\System32\bYMEtXf.exe
  C:\Windows\System32\bYMEtXf.exe
  2⤵
  PID:5048
- C:\Windows\System32\cDMCVUw.exe
  C:\Windows\System32\cDMCVUw.exe
  2⤵
  PID:6148
- C:\Windows\System32\QCWQIXP.exe
  C:\Windows\System32\QCWQIXP.exe
  2⤵
  PID:6168
- C:\Windows\System32\gFrclgc.exe
  C:\Windows\System32\gFrclgc.exe
  2⤵
  PID:6184
- C:\Windows\System32\YpdUici.exe
  C:\Windows\System32\YpdUici.exe
  2⤵
  PID:6240
- C:\Windows\System32\ONlJiQT.exe
  C:\Windows\System32\ONlJiQT.exe
  2⤵
  PID:6256
- C:\Windows\System32\GijXjfP.exe
  C:\Windows\System32\GijXjfP.exe
  2⤵
  PID:6304
- C:\Windows\System32\FUqhqMx.exe
  C:\Windows\System32\FUqhqMx.exe
  2⤵
  PID:6320
- C:\Windows\System32\vJCUjAi.exe
  C:\Windows\System32\vJCUjAi.exe
  2⤵
  PID:6340
- C:\Windows\System32\QxhROZb.exe
  C:\Windows\System32\QxhROZb.exe
  2⤵
  PID:6404
- C:\Windows\System32\OOpxBPK.exe
  C:\Windows\System32\OOpxBPK.exe
  2⤵
  PID:6436
- C:\Windows\System32\mTylyZR.exe
  C:\Windows\System32\mTylyZR.exe
  2⤵
  PID:6452
- C:\Windows\System32\bsSdIfs.exe
  C:\Windows\System32\bsSdIfs.exe
  2⤵
  PID:6468
- C:\Windows\System32\qcdijMB.exe
  C:\Windows\System32\qcdijMB.exe
  2⤵
  PID:6492
- C:\Windows\System32\SNYwpcM.exe
  C:\Windows\System32\SNYwpcM.exe
  2⤵
  PID:6528
- C:\Windows\System32\NHuyFDW.exe
  C:\Windows\System32\NHuyFDW.exe
  2⤵
  PID:6552
- C:\Windows\System32\EvSUYje.exe
  C:\Windows\System32\EvSUYje.exe
  2⤵
  PID:6568
- C:\Windows\System32\nVrTxUM.exe
  C:\Windows\System32\nVrTxUM.exe
  2⤵
  PID:6592
- C:\Windows\System32\IVTIRdw.exe
  C:\Windows\System32\IVTIRdw.exe
  2⤵
  PID:6624
- C:\Windows\System32\QJKRilb.exe
  C:\Windows\System32\QJKRilb.exe
  2⤵
  PID:6664
- C:\Windows\System32\PPiAKVb.exe
  C:\Windows\System32\PPiAKVb.exe
  2⤵
  PID:6684
- C:\Windows\System32\jhYWAdq.exe
  C:\Windows\System32\jhYWAdq.exe
  2⤵
  PID:6708
- C:\Windows\System32\idJyoTz.exe
  C:\Windows\System32\idJyoTz.exe
  2⤵
  PID:6744
- C:\Windows\System32\wvjhFJp.exe
  C:\Windows\System32\wvjhFJp.exe
  2⤵
  PID:6764
- C:\Windows\System32\SKeWYVF.exe
  C:\Windows\System32\SKeWYVF.exe
  2⤵
  PID:6784
- C:\Windows\System32\kDHeTHf.exe
  C:\Windows\System32\kDHeTHf.exe
  2⤵
  PID:6804
- C:\Windows\System32\mtlHxEr.exe
  C:\Windows\System32\mtlHxEr.exe
  2⤵
  PID:6820
- C:\Windows\System32\VPaylPr.exe
  C:\Windows\System32\VPaylPr.exe
  2⤵
  PID:6844
- C:\Windows\System32\pJPHJvl.exe
  C:\Windows\System32\pJPHJvl.exe
  2⤵
  PID:6860
- C:\Windows\System32\aUVBILn.exe
  C:\Windows\System32\aUVBILn.exe
  2⤵
  PID:6884
- C:\Windows\System32\ErqwYMc.exe
  C:\Windows\System32\ErqwYMc.exe
  2⤵
  PID:6900
- C:\Windows\System32\WQyUkem.exe
  C:\Windows\System32\WQyUkem.exe
  2⤵
  PID:6924
- C:\Windows\System32\QDxBYfu.exe
  C:\Windows\System32\QDxBYfu.exe
  2⤵
  PID:6988
- C:\Windows\System32\OxwELAd.exe
  C:\Windows\System32\OxwELAd.exe
  2⤵
  PID:7016
- C:\Windows\System32\XlEbhbI.exe
  C:\Windows\System32\XlEbhbI.exe
  2⤵
  PID:7032
- C:\Windows\System32\SesDqEb.exe
  C:\Windows\System32\SesDqEb.exe
  2⤵
  PID:7080
- C:\Windows\System32\tNnQWPg.exe
  C:\Windows\System32\tNnQWPg.exe
  2⤵
  PID:7144
- C:\Windows\System32\KwDqhtI.exe
  C:\Windows\System32\KwDqhtI.exe
  2⤵
  PID:7164
- C:\Windows\System32\dAjlEmq.exe
  C:\Windows\System32\dAjlEmq.exe
  2⤵
  PID:6028
- C:\Windows\System32\mOnnanD.exe
  C:\Windows\System32\mOnnanD.exe
  2⤵
  PID:6160
- C:\Windows\System32\FibBMVq.exe
  C:\Windows\System32\FibBMVq.exe
  2⤵
  PID:6224
- C:\Windows\System32\zrncUQs.exe
  C:\Windows\System32\zrncUQs.exe
  2⤵
  PID:6108
- C:\Windows\System32\VKaoXpV.exe
  C:\Windows\System32\VKaoXpV.exe
  2⤵
  PID:6424
- C:\Windows\System32\VtZDOnK.exe
  C:\Windows\System32\VtZDOnK.exe
  2⤵
  PID:6500
- C:\Windows\System32\lxPlsPq.exe
  C:\Windows\System32\lxPlsPq.exe
  2⤵
  PID:6564
- C:\Windows\System32\myukvKu.exe
  C:\Windows\System32\myukvKu.exe
  2⤵
  PID:6640
- C:\Windows\System32\EHKkXqg.exe
  C:\Windows\System32\EHKkXqg.exe
  2⤵
  PID:6676
- C:\Windows\System32\zMHSVSX.exe
  C:\Windows\System32\zMHSVSX.exe
  2⤵
  PID:6720
- C:\Windows\System32\DLYoegw.exe
  C:\Windows\System32\DLYoegw.exe
  2⤵
  PID:6756
- C:\Windows\System32\oGawEnM.exe
  C:\Windows\System32\oGawEnM.exe
  2⤵
  PID:6856
- C:\Windows\System32\bQjwjYs.exe
  C:\Windows\System32\bQjwjYs.exe
  2⤵
  PID:7012
- C:\Windows\System32\ExFcRoI.exe
  C:\Windows\System32\ExFcRoI.exe
  2⤵
  PID:7064
- C:\Windows\System32\trazxzG.exe
  C:\Windows\System32\trazxzG.exe
  2⤵
  PID:6212
- C:\Windows\System32\UElIpNp.exe
  C:\Windows\System32\UElIpNp.exe
  2⤵
  PID:5972
- C:\Windows\System32\VKUGxJd.exe
  C:\Windows\System32\VKUGxJd.exe
  2⤵
  PID:6332
- C:\Windows\System32\vGMFIdD.exe
  C:\Windows\System32\vGMFIdD.exe
  2⤵
  PID:6364
- C:\Windows\System32\WKPUIog.exe
  C:\Windows\System32\WKPUIog.exe
  2⤵
  PID:6560
- C:\Windows\System32\dWgRIfD.exe
  C:\Windows\System32\dWgRIfD.exe
  2⤵
  PID:6876
- C:\Windows\System32\EwEfuuD.exe
  C:\Windows\System32\EwEfuuD.exe
  2⤵
  PID:7060
- C:\Windows\System32\opxgipX.exe
  C:\Windows\System32\opxgipX.exe
  2⤵
  PID:6980
- C:\Windows\System32\WWDRRqs.exe
  C:\Windows\System32\WWDRRqs.exe
  2⤵
  PID:6812
- C:\Windows\System32\YNeTUIs.exe
  C:\Windows\System32\YNeTUIs.exe
  2⤵
  PID:6648
- C:\Windows\System32\OHMprsH.exe
  C:\Windows\System32\OHMprsH.exe
  2⤵
  PID:7112
- C:\Windows\System32\CcsFgRn.exe
  C:\Windows\System32\CcsFgRn.exe
  2⤵
  PID:6220
- C:\Windows\System32\bLjWYBT.exe
  C:\Windows\System32\bLjWYBT.exe
  2⤵
  PID:7196
- C:\Windows\System32\ecGDVVe.exe
  C:\Windows\System32\ecGDVVe.exe
  2⤵
  PID:7216
- C:\Windows\System32\sMjBxKy.exe
  C:\Windows\System32\sMjBxKy.exe
  2⤵
  PID:7256
- C:\Windows\System32\VOtydfm.exe
  C:\Windows\System32\VOtydfm.exe
  2⤵
  PID:7272
- C:\Windows\System32\YbjhjEP.exe
  C:\Windows\System32\YbjhjEP.exe
  2⤵
  PID:7324
- C:\Windows\System32\FNCLfMc.exe
  C:\Windows\System32\FNCLfMc.exe
  2⤵
  PID:7340
- C:\Windows\System32\QmLRyJK.exe
  C:\Windows\System32\QmLRyJK.exe
  2⤵
  PID:7356
- C:\Windows\System32\FLpvtRG.exe
  C:\Windows\System32\FLpvtRG.exe
  2⤵
  PID:7580
- C:\Windows\System32\NxvihDr.exe
  C:\Windows\System32\NxvihDr.exe
  2⤵
  PID:7604
- C:\Windows\System32\eJVGHzd.exe
  C:\Windows\System32\eJVGHzd.exe
  2⤵
  PID:7620
- C:\Windows\System32\TmmPhHB.exe
  C:\Windows\System32\TmmPhHB.exe
  2⤵
  PID:7644
- C:\Windows\System32\yNxmNGf.exe
  C:\Windows\System32\yNxmNGf.exe
  2⤵
  PID:7688
- C:\Windows\System32\YcOVDND.exe
  C:\Windows\System32\YcOVDND.exe
  2⤵
  PID:7724
- C:\Windows\System32\tRlZFdE.exe
  C:\Windows\System32\tRlZFdE.exe
  2⤵
  PID:7748
- C:\Windows\System32\XlRoEhH.exe
  C:\Windows\System32\XlRoEhH.exe
  2⤵
  PID:7788
- C:\Windows\System32\nQHpDGo.exe
  C:\Windows\System32\nQHpDGo.exe
  2⤵
  PID:7812
- C:\Windows\System32\frYWUdi.exe
  C:\Windows\System32\frYWUdi.exe
  2⤵
  PID:7836
- C:\Windows\System32\lOSXcVZ.exe
  C:\Windows\System32\lOSXcVZ.exe
  2⤵
  PID:7852
- C:\Windows\System32\GQPFnJx.exe
  C:\Windows\System32\GQPFnJx.exe
  2⤵
  PID:7880
- C:\Windows\System32\uXWApxJ.exe
  C:\Windows\System32\uXWApxJ.exe
  2⤵
  PID:7912
- C:\Windows\System32\wmhWrWP.exe
  C:\Windows\System32\wmhWrWP.exe
  2⤵
  PID:7928
- C:\Windows\System32\dNskqag.exe
  C:\Windows\System32\dNskqag.exe
  2⤵
  PID:7952
- C:\Windows\System32\EBRzmhW.exe
  C:\Windows\System32\EBRzmhW.exe
  2⤵
  PID:7988
- C:\Windows\System32\SKUWRTb.exe
  C:\Windows\System32\SKUWRTb.exe
  2⤵
  PID:8036
- C:\Windows\System32\WFdvmXf.exe
  C:\Windows\System32\WFdvmXf.exe
  2⤵
  PID:8056
- C:\Windows\System32\NGSZeJg.exe
  C:\Windows\System32\NGSZeJg.exe
  2⤵
  PID:8080
- C:\Windows\System32\euPtHiF.exe
  C:\Windows\System32\euPtHiF.exe
  2⤵
  PID:8104
- C:\Windows\System32\PKTsQWV.exe
  C:\Windows\System32\PKTsQWV.exe
  2⤵
  PID:8124
- C:\Windows\System32\WlnmKlG.exe
  C:\Windows\System32\WlnmKlG.exe
  2⤵
  PID:8144
- C:\Windows\System32\zUXvGwf.exe
  C:\Windows\System32\zUXvGwf.exe
  2⤵
  PID:8164
- C:\Windows\System32\SYQwrLn.exe
  C:\Windows\System32\SYQwrLn.exe
  2⤵
  PID:7184
- C:\Windows\System32\HiWkIfr.exe
  C:\Windows\System32\HiWkIfr.exe
  2⤵
  PID:7268
- C:\Windows\System32\iVUgbxJ.exe
  C:\Windows\System32\iVUgbxJ.exe
  2⤵
  PID:7312
- C:\Windows\System32\Hoamiry.exe
  C:\Windows\System32\Hoamiry.exe
  2⤵
  PID:7384
- C:\Windows\System32\aPseyJw.exe
  C:\Windows\System32\aPseyJw.exe
  2⤵
  PID:7424
- C:\Windows\System32\smfYeIr.exe
  C:\Windows\System32\smfYeIr.exe
  2⤵
  PID:7332
- C:\Windows\System32\lrFvIIy.exe
  C:\Windows\System32\lrFvIIy.exe
  2⤵
  PID:7612
- C:\Windows\System32\wXANOYV.exe
  C:\Windows\System32\wXANOYV.exe
  2⤵
  PID:7668
- C:\Windows\System32\BOabiHp.exe
  C:\Windows\System32\BOabiHp.exe
  2⤵
  PID:7696
- C:\Windows\System32\xUhKtfF.exe
  C:\Windows\System32\xUhKtfF.exe
  2⤵
  PID:7544
- C:\Windows\System32\UXKKAth.exe
  C:\Windows\System32\UXKKAth.exe
  2⤵
  PID:7532
- C:\Windows\System32\lyUvdIV.exe
  C:\Windows\System32\lyUvdIV.exe
  2⤵
  PID:7844
- C:\Windows\System32\rfJRAjj.exe
  C:\Windows\System32\rfJRAjj.exe
  2⤵
  PID:7864
- C:\Windows\System32\vZmxoSv.exe
  C:\Windows\System32\vZmxoSv.exe
  2⤵
  PID:7944
- C:\Windows\System32\QrmyKgM.exe
  C:\Windows\System32\QrmyKgM.exe
  2⤵
  PID:7500
- C:\Windows\System32\qckaTVk.exe
  C:\Windows\System32\qckaTVk.exe
  2⤵
  PID:7492
- C:\Windows\System32\lKweHhx.exe
  C:\Windows\System32\lKweHhx.exe
  2⤵
  PID:8088
- C:\Windows\System32\xVFMZyg.exe
  C:\Windows\System32\xVFMZyg.exe
  2⤵
  PID:6716
- C:\Windows\System32\wuxzWvx.exe
  C:\Windows\System32\wuxzWvx.exe
  2⤵
  PID:8160
- C:\Windows\System32\disFGjk.exe
  C:\Windows\System32\disFGjk.exe
  2⤵
  PID:7248
- C:\Windows\System32\lmiuWXF.exe
  C:\Windows\System32\lmiuWXF.exe
  2⤵
  PID:7396
- C:\Windows\System32\zyFVNRn.exe
  C:\Windows\System32\zyFVNRn.exe
  2⤵
  PID:7420
- C:\Windows\System32\jmBDjCQ.exe
  C:\Windows\System32\jmBDjCQ.exe
  2⤵
  PID:7628
- C:\Windows\System32\hORnLqL.exe
  C:\Windows\System32\hORnLqL.exe
  2⤵
  PID:7560
- C:\Windows\System32\JorYaKT.exe
  C:\Windows\System32\JorYaKT.exe
  2⤵
  PID:7516
- C:\Windows\System32\gAlbgfC.exe
  C:\Windows\System32\gAlbgfC.exe
  2⤵
  PID:6944
- C:\Windows\System32\LiQwkBE.exe
  C:\Windows\System32\LiQwkBE.exe
  2⤵
  PID:8096
- C:\Windows\System32\CskHkGZ.exe
  C:\Windows\System32\CskHkGZ.exe
  2⤵
  PID:7700
- C:\Windows\System32\VmrtGGT.exe
  C:\Windows\System32\VmrtGGT.exe
  2⤵
  PID:7600
- C:\Windows\System32\wncfwHp.exe
  C:\Windows\System32\wncfwHp.exe
  2⤵
  PID:7820
- C:\Windows\System32\NvThJjZ.exe
  C:\Windows\System32\NvThJjZ.exe
  2⤵
  PID:7432
- C:\Windows\System32\mGyxPbi.exe
  C:\Windows\System32\mGyxPbi.exe
  2⤵
  PID:7504
- C:\Windows\System32\kvfrrkE.exe
  C:\Windows\System32\kvfrrkE.exe
  2⤵
  PID:8212
- C:\Windows\System32\AfuoKwW.exe
  C:\Windows\System32\AfuoKwW.exe
  2⤵
  PID:8256
- C:\Windows\System32\JclSbGT.exe
  C:\Windows\System32\JclSbGT.exe
  2⤵
  PID:8276
- C:\Windows\System32\lxysHHr.exe
  C:\Windows\System32\lxysHHr.exe
  2⤵
  PID:8296
- C:\Windows\System32\SFSxTJj.exe
  C:\Windows\System32\SFSxTJj.exe
  2⤵
  PID:8316
- C:\Windows\System32\TyxWGQv.exe
  C:\Windows\System32\TyxWGQv.exe
  2⤵
  PID:8336
- C:\Windows\System32\oVuzqyT.exe
  C:\Windows\System32\oVuzqyT.exe
  2⤵
  PID:8408
- C:\Windows\System32\qCCkoDm.exe
  C:\Windows\System32\qCCkoDm.exe
  2⤵
  PID:8428
- C:\Windows\System32\SykrXwp.exe
  C:\Windows\System32\SykrXwp.exe
  2⤵
  PID:8460
- C:\Windows\System32\rMXTgZY.exe
  C:\Windows\System32\rMXTgZY.exe
  2⤵
  PID:8480
- C:\Windows\System32\SKEWYNB.exe
  C:\Windows\System32\SKEWYNB.exe
  2⤵
  PID:8504
- C:\Windows\System32\kovvOgL.exe
  C:\Windows\System32\kovvOgL.exe
  2⤵
  PID:8520
- C:\Windows\System32\GPrPYzy.exe
  C:\Windows\System32\GPrPYzy.exe
  2⤵
  PID:8568
- C:\Windows\System32\GiRYGoj.exe
  C:\Windows\System32\GiRYGoj.exe
  2⤵
  PID:8592
- C:\Windows\System32\VXsTooV.exe
  C:\Windows\System32\VXsTooV.exe
  2⤵
  PID:8612
- C:\Windows\System32\qodHiSl.exe
  C:\Windows\System32\qodHiSl.exe
  2⤵
  PID:8640
- C:\Windows\System32\MUPvRFC.exe
  C:\Windows\System32\MUPvRFC.exe
  2⤵
  PID:8668
- C:\Windows\System32\aPTPRQA.exe
  C:\Windows\System32\aPTPRQA.exe
  2⤵
  PID:8692
- C:\Windows\System32\LsgKwsg.exe
  C:\Windows\System32\LsgKwsg.exe
  2⤵
  PID:8708
- C:\Windows\System32\QMOkhER.exe
  C:\Windows\System32\QMOkhER.exe
  2⤵
  PID:8776
- C:\Windows\System32\LNJMWwr.exe
  C:\Windows\System32\LNJMWwr.exe
  2⤵
  PID:8800
- C:\Windows\System32\JsbcqgG.exe
  C:\Windows\System32\JsbcqgG.exe
  2⤵
  PID:8832
- C:\Windows\System32\NphUxdr.exe
  C:\Windows\System32\NphUxdr.exe
  2⤵
  PID:8848
- C:\Windows\System32\BPztQmv.exe
  C:\Windows\System32\BPztQmv.exe
  2⤵
  PID:8868
- C:\Windows\System32\TIjRBBz.exe
  C:\Windows\System32\TIjRBBz.exe
  2⤵
  PID:8912
- C:\Windows\System32\STlatwe.exe
  C:\Windows\System32\STlatwe.exe
  2⤵
  PID:9012
- C:\Windows\System32\kWcaZtx.exe
  C:\Windows\System32\kWcaZtx.exe
  2⤵
  PID:9028
- C:\Windows\System32\KkXdetj.exe
  C:\Windows\System32\KkXdetj.exe
  2⤵
  PID:9124
- C:\Windows\System32\tFDeAQk.exe
  C:\Windows\System32\tFDeAQk.exe
  2⤵
  PID:9144
- C:\Windows\System32\VWBAWDj.exe
  C:\Windows\System32\VWBAWDj.exe
  2⤵
  PID:9200
- C:\Windows\System32\LICnuhz.exe
  C:\Windows\System32\LICnuhz.exe
  2⤵
  PID:7468
- C:\Windows\System32\pqNcHpU.exe
  C:\Windows\System32\pqNcHpU.exe
  2⤵
  PID:8196
- C:\Windows\System32\EFYoTTW.exe
  C:\Windows\System32\EFYoTTW.exe
  2⤵
  PID:8304
- C:\Windows\System32\mKOGMQY.exe
  C:\Windows\System32\mKOGMQY.exe
  2⤵
  PID:8356
- C:\Windows\System32\DVFGuKS.exe
  C:\Windows\System32\DVFGuKS.exe
  2⤵
  PID:8440
- C:\Windows\System32\QnMYoAD.exe
  C:\Windows\System32\QnMYoAD.exe
  2⤵
  PID:8476
- C:\Windows\System32\zSLHDUd.exe
  C:\Windows\System32\zSLHDUd.exe
  2⤵
  PID:8536
- C:\Windows\System32\uiLyxhG.exe
  C:\Windows\System32\uiLyxhG.exe
  2⤵
  PID:8652
- C:\Windows\System32\dxIvcic.exe
  C:\Windows\System32\dxIvcic.exe
  2⤵
  PID:8680
- C:\Windows\System32\BaQnXfc.exe
  C:\Windows\System32\BaQnXfc.exe
  2⤵
  PID:8764
- C:\Windows\System32\CIGRaxL.exe
  C:\Windows\System32\CIGRaxL.exe
  2⤵
  PID:8748
- C:\Windows\System32\GDujscn.exe
  C:\Windows\System32\GDujscn.exe
  2⤵
  PID:8824
- C:\Windows\System32\OZhONlG.exe
  C:\Windows\System32\OZhONlG.exe
  2⤵
  PID:8840
- C:\Windows\System32\HRWLVxM.exe
  C:\Windows\System32\HRWLVxM.exe
  2⤵
  PID:8844
- C:\Windows\System32\PlMFeMG.exe
  C:\Windows\System32\PlMFeMG.exe
  2⤵
  PID:8940
- C:\Windows\System32\awpIMfz.exe
  C:\Windows\System32\awpIMfz.exe
  2⤵
  PID:8876
- C:\Windows\System32\LEfHOiW.exe
  C:\Windows\System32\LEfHOiW.exe
  2⤵
  PID:9008
- C:\Windows\System32\kwVEHQI.exe
  C:\Windows\System32\kwVEHQI.exe
  2⤵
  PID:9048
- C:\Windows\System32\yWTQdVK.exe
  C:\Windows\System32\yWTQdVK.exe
  2⤵
  PID:9152
- C:\Windows\System32\aNvmmrS.exe
  C:\Windows\System32\aNvmmrS.exe
  2⤵
  PID:4856
- C:\Windows\System32\QuFUelj.exe
  C:\Windows\System32\QuFUelj.exe
  2⤵
  PID:1220
- C:\Windows\System32\uUvqeIf.exe
  C:\Windows\System32\uUvqeIf.exe
  2⤵
  PID:8368
- C:\Windows\System32\klMfknr.exe
  C:\Windows\System32\klMfknr.exe
  2⤵
  PID:8448
- C:\Windows\System32\aTiPrwa.exe
  C:\Windows\System32\aTiPrwa.exe
  2⤵
  PID:8728
- C:\Windows\System32\EomDKFN.exe
  C:\Windows\System32\EomDKFN.exe
  2⤵
  PID:8944
- C:\Windows\System32\gzrVhyv.exe
  C:\Windows\System32\gzrVhyv.exe
  2⤵
  PID:8788
- C:\Windows\System32\tFAeFBk.exe
  C:\Windows\System32\tFAeFBk.exe
  2⤵
  PID:1084
- C:\Windows\System32\IQdcsER.exe
  C:\Windows\System32\IQdcsER.exe
  2⤵
  PID:9120
- C:\Windows\System32\yAwGhFt.exe
  C:\Windows\System32\yAwGhFt.exe
  2⤵
  PID:4116
- C:\Windows\System32\smNkVna.exe
  C:\Windows\System32\smNkVna.exe
  2⤵
  PID:8252
- C:\Windows\System32\tuhtFCx.exe
  C:\Windows\System32\tuhtFCx.exe
  2⤵
  PID:8904
- C:\Windows\System32\FoValjO.exe
  C:\Windows\System32\FoValjO.exe
  2⤵
  PID:8996
- C:\Windows\System32\cAjqIGa.exe
  C:\Windows\System32\cAjqIGa.exe
  2⤵
  PID:9084
- C:\Windows\System32\BVBAbWq.exe
  C:\Windows\System32\BVBAbWq.exe
  2⤵
  PID:8272
- C:\Windows\System32\GEbtAhY.exe
  C:\Windows\System32\GEbtAhY.exe
  2⤵
  PID:9096
- C:\Windows\System32\UznqBaq.exe
  C:\Windows\System32\UznqBaq.exe
  2⤵
  PID:9220
- C:\Windows\System32\pXmJbDc.exe
  C:\Windows\System32\pXmJbDc.exe
  2⤵
  PID:9244
- C:\Windows\System32\MuPrkjD.exe
  C:\Windows\System32\MuPrkjD.exe
  2⤵
  PID:9264
- C:\Windows\System32\uKpTMfQ.exe
  C:\Windows\System32\uKpTMfQ.exe
  2⤵
  PID:9340
- C:\Windows\System32\JGtiuPv.exe
  C:\Windows\System32\JGtiuPv.exe
  2⤵
  PID:9364
- C:\Windows\System32\EuqlrdB.exe
  C:\Windows\System32\EuqlrdB.exe
  2⤵
  PID:9388
- C:\Windows\System32\uZRTMuF.exe
  C:\Windows\System32\uZRTMuF.exe
  2⤵
  PID:9404
- C:\Windows\System32\UJfevpD.exe
  C:\Windows\System32\UJfevpD.exe
  2⤵
  PID:9424
- C:\Windows\System32\CyMqDab.exe
  C:\Windows\System32\CyMqDab.exe
  2⤵
  PID:9472
- C:\Windows\System32\wtsurHc.exe
  C:\Windows\System32\wtsurHc.exe
  2⤵
  PID:9500
- C:\Windows\System32\ynFFfSU.exe
  C:\Windows\System32\ynFFfSU.exe
  2⤵
  PID:9524
- C:\Windows\System32\HynWALE.exe
  C:\Windows\System32\HynWALE.exe
  2⤵
  PID:9552
- C:\Windows\System32\KfSnlAr.exe
  C:\Windows\System32\KfSnlAr.exe
  2⤵
  PID:9572
- C:\Windows\System32\SGLITpy.exe
  C:\Windows\System32\SGLITpy.exe
  2⤵
  PID:9600
- C:\Windows\System32\JoMAgaP.exe
  C:\Windows\System32\JoMAgaP.exe
  2⤵
  PID:9624
- C:\Windows\System32\lnvkEdg.exe
  C:\Windows\System32\lnvkEdg.exe
  2⤵
  PID:9660
- C:\Windows\System32\EHqcMvA.exe
  C:\Windows\System32\EHqcMvA.exe
  2⤵
  PID:9680
- C:\Windows\System32\mTQFAmf.exe
  C:\Windows\System32\mTQFAmf.exe
  2⤵
  PID:9704
- C:\Windows\System32\PQPmsQQ.exe
  C:\Windows\System32\PQPmsQQ.exe
  2⤵
  PID:9752
- C:\Windows\System32\JfLukzd.exe
  C:\Windows\System32\JfLukzd.exe
  2⤵
  PID:9784
- C:\Windows\System32\sUggpra.exe
  C:\Windows\System32\sUggpra.exe
  2⤵
  PID:9804
- C:\Windows\System32\bQHGOyp.exe
  C:\Windows\System32\bQHGOyp.exe
  2⤵
  PID:9824
- C:\Windows\System32\TORcihg.exe
  C:\Windows\System32\TORcihg.exe
  2⤵
  PID:9852
- C:\Windows\System32\FHqrXmU.exe
  C:\Windows\System32\FHqrXmU.exe
  2⤵
  PID:9880
- C:\Windows\System32\pCZAddL.exe
  C:\Windows\System32\pCZAddL.exe
  2⤵
  PID:9932
- C:\Windows\System32\UAJIoPN.exe
  C:\Windows\System32\UAJIoPN.exe
  2⤵
  PID:9956
- C:\Windows\System32\fCJJNTK.exe
  C:\Windows\System32\fCJJNTK.exe
  2⤵
  PID:9984
- C:\Windows\System32\eZrOaiQ.exe
  C:\Windows\System32\eZrOaiQ.exe
  2⤵
  PID:10000
- C:\Windows\System32\fgYoCNX.exe
  C:\Windows\System32\fgYoCNX.exe
  2⤵
  PID:10032
- C:\Windows\System32\ccFUfeu.exe
  C:\Windows\System32\ccFUfeu.exe
  2⤵
  PID:10056
- C:\Windows\System32\OiyvJSv.exe
  C:\Windows\System32\OiyvJSv.exe
  2⤵
  PID:10084
- C:\Windows\System32\WAIUCiQ.exe
  C:\Windows\System32\WAIUCiQ.exe
  2⤵
  PID:10156
- C:\Windows\System32\PjJXcAH.exe
  C:\Windows\System32\PjJXcAH.exe
  2⤵
  PID:10172
- C:\Windows\System32\OKaatXk.exe
  C:\Windows\System32\OKaatXk.exe
  2⤵
  PID:10188
- C:\Windows\System32\FyouLrr.exe
  C:\Windows\System32\FyouLrr.exe
  2⤵
  PID:10216
- C:\Windows\System32\PrhiRSv.exe
  C:\Windows\System32\PrhiRSv.exe
  2⤵
  PID:10232
- C:\Windows\System32\YRUENNX.exe
  C:\Windows\System32\YRUENNX.exe
  2⤵
  PID:9260
- C:\Windows\System32\eWlsmaE.exe
  C:\Windows\System32\eWlsmaE.exe
  2⤵
  PID:9252
- C:\Windows\System32\bMKkYmI.exe
  C:\Windows\System32\bMKkYmI.exe
  2⤵
  PID:9356
- C:\Windows\System32\OZbBhgl.exe
  C:\Windows\System32\OZbBhgl.exe
  2⤵
  PID:9400
- C:\Windows\System32\xMzrHLP.exe
  C:\Windows\System32\xMzrHLP.exe
  2⤵
  PID:9444
- C:\Windows\System32\ZxSByxU.exe
  C:\Windows\System32\ZxSByxU.exe
  2⤵
  PID:9520
- C:\Windows\System32\RsxnYkS.exe
  C:\Windows\System32\RsxnYkS.exe
  2⤵
  PID:9544
- C:\Windows\System32\FMNnfmz.exe
  C:\Windows\System32\FMNnfmz.exe
  2⤵
  PID:9672
- C:\Windows\System32\MzobOWb.exe
  C:\Windows\System32\MzobOWb.exe
  2⤵
  PID:9736
- C:\Windows\System32\iNMJQuW.exe
  C:\Windows\System32\iNMJQuW.exe
  2⤵
  PID:9792
- C:\Windows\System32\gVWIWWE.exe
  C:\Windows\System32\gVWIWWE.exe
  2⤵
  PID:9908
- C:\Windows\System32\PALbFGd.exe
  C:\Windows\System32\PALbFGd.exe
  2⤵
  PID:9972
- C:\Windows\System32\BOPhSHJ.exe
  C:\Windows\System32\BOPhSHJ.exe
  2⤵
  PID:10024
- C:\Windows\System32\VntwSia.exe
  C:\Windows\System32\VntwSia.exe
  2⤵
  PID:10120
- C:\Windows\System32\bnTMgba.exe
  C:\Windows\System32\bnTMgba.exe
  2⤵
  PID:10152
- C:\Windows\System32\mPVaGCO.exe
  C:\Windows\System32\mPVaGCO.exe
  2⤵
  PID:10204
- C:\Windows\System32\tbZaTtz.exe
  C:\Windows\System32\tbZaTtz.exe
  2⤵
  PID:9348
- C:\Windows\System32\pLcQErl.exe
  C:\Windows\System32\pLcQErl.exe
  2⤵
  PID:9292
- C:\Windows\System32\xBtKfRk.exe
  C:\Windows\System32\xBtKfRk.exe
  2⤵
  PID:9540
- C:\Windows\System32\WqtAVNk.exe
  C:\Windows\System32\WqtAVNk.exe
  2⤵
  PID:9564
- C:\Windows\System32\FZEUkZq.exe
  C:\Windows\System32\FZEUkZq.exe
  2⤵
  PID:9676
- C:\Windows\System32\ffDDqAD.exe
  C:\Windows\System32\ffDDqAD.exe
  2⤵
  PID:10012
- C:\Windows\System32\pwrDBFO.exe
  C:\Windows\System32\pwrDBFO.exe
  2⤵
  PID:10132
- C:\Windows\System32\zTaMlBP.exe
  C:\Windows\System32\zTaMlBP.exe
  2⤵
  PID:9208
- C:\Windows\System32\RIHfscO.exe
  C:\Windows\System32\RIHfscO.exe
  2⤵
  PID:9616
- C:\Windows\System32\LRxbNuR.exe
  C:\Windows\System32\LRxbNuR.exe
  2⤵
  PID:10096
- C:\Windows\System32\vpjTXkT.exe
  C:\Windows\System32\vpjTXkT.exe
  2⤵
  PID:9228
- C:\Windows\System32\AHMoIEY.exe
  C:\Windows\System32\AHMoIEY.exe
  2⤵
  PID:4492
- C:\Windows\System32\zWbuvMk.exe
  C:\Windows\System32\zWbuvMk.exe
  2⤵
  PID:10256
- C:\Windows\System32\PTGXesX.exe
  C:\Windows\System32\PTGXesX.exe
  2⤵
  PID:10280
- C:\Windows\System32\fvuyrEm.exe
  C:\Windows\System32\fvuyrEm.exe
  2⤵
  PID:10300
- C:\Windows\System32\gWXcitH.exe
  C:\Windows\System32\gWXcitH.exe
  2⤵
  PID:10328
- C:\Windows\System32\PVfqIbO.exe
  C:\Windows\System32\PVfqIbO.exe
  2⤵
  PID:10360
- C:\Windows\System32\lTXYGaL.exe
  C:\Windows\System32\lTXYGaL.exe
  2⤵
  PID:10380
- C:\Windows\System32\kdIiBcB.exe
  C:\Windows\System32\kdIiBcB.exe
  2⤵
  PID:10396
- C:\Windows\System32\HcWyMno.exe
  C:\Windows\System32\HcWyMno.exe
  2⤵
  PID:10420
- C:\Windows\System32\UCovHZD.exe
  C:\Windows\System32\UCovHZD.exe
  2⤵
  PID:10440
- C:\Windows\System32\ZBXvSkl.exe
  C:\Windows\System32\ZBXvSkl.exe
  2⤵
  PID:10460
- C:\Windows\System32\EeNojCg.exe
  C:\Windows\System32\EeNojCg.exe
  2⤵
  PID:10492
- C:\Windows\System32\GPKoYqf.exe
  C:\Windows\System32\GPKoYqf.exe
  2⤵
  PID:10572
- C:\Windows\System32\LXwebdi.exe
  C:\Windows\System32\LXwebdi.exe
  2⤵
  PID:10588
- C:\Windows\System32\DVTvEIi.exe
  C:\Windows\System32\DVTvEIi.exe
  2⤵
  PID:10612
- C:\Windows\System32\uSuTqCa.exe
  C:\Windows\System32\uSuTqCa.exe
  2⤵
  PID:10632
- C:\Windows\System32\eyzRdoR.exe
  C:\Windows\System32\eyzRdoR.exe
  2⤵
  PID:10656
- C:\Windows\System32\cJYzOgK.exe
  C:\Windows\System32\cJYzOgK.exe
  2⤵
  PID:10704
- C:\Windows\System32\WTnCpPS.exe
  C:\Windows\System32\WTnCpPS.exe
  2⤵
  PID:10732
- C:\Windows\System32\WlSwVSW.exe
  C:\Windows\System32\WlSwVSW.exe
  2⤵
  PID:10756
- C:\Windows\System32\mzDbfeJ.exe
  C:\Windows\System32\mzDbfeJ.exe
  2⤵
  PID:10784
- C:\Windows\System32\XsPYedV.exe
  C:\Windows\System32\XsPYedV.exe
  2⤵
  PID:10824
- C:\Windows\System32\culJMkH.exe
  C:\Windows\System32\culJMkH.exe
  2⤵
  PID:10848
- C:\Windows\System32\sjKqEVR.exe
  C:\Windows\System32\sjKqEVR.exe
  2⤵
  PID:10868
- C:\Windows\System32\gudmvhU.exe
  C:\Windows\System32\gudmvhU.exe
  2⤵
  PID:10908
- C:\Windows\System32\ByAVxqg.exe
  C:\Windows\System32\ByAVxqg.exe
  2⤵
  PID:10932
- C:\Windows\System32\GsqkTcV.exe
  C:\Windows\System32\GsqkTcV.exe
  2⤵
  PID:10952
- C:\Windows\System32\MMUOGWA.exe
  C:\Windows\System32\MMUOGWA.exe
  2⤵
  PID:10972
- C:\Windows\System32\hvCYYri.exe
  C:\Windows\System32\hvCYYri.exe
  2⤵
  PID:11008
- C:\Windows\System32\SvUUIVb.exe
  C:\Windows\System32\SvUUIVb.exe
  2⤵
  PID:11032
- C:\Windows\System32\NWZBTmJ.exe
  C:\Windows\System32\NWZBTmJ.exe
  2⤵
  PID:11060
- C:\Windows\System32\BzmBnia.exe
  C:\Windows\System32\BzmBnia.exe
  2⤵
  PID:11076
- C:\Windows\System32\wsWFnlF.exe
  C:\Windows\System32\wsWFnlF.exe
  2⤵
  PID:11124
- C:\Windows\System32\PnPzJIn.exe
  C:\Windows\System32\PnPzJIn.exe
  2⤵
  PID:11164
- C:\Windows\System32\AxOVADr.exe
  C:\Windows\System32\AxOVADr.exe
  2⤵
  PID:11184
- C:\Windows\System32\qoVBBXC.exe
  C:\Windows\System32\qoVBBXC.exe
  2⤵
  PID:11228
- C:\Windows\System32\QROVKcG.exe
  C:\Windows\System32\QROVKcG.exe
  2⤵
  PID:11248
- C:\Windows\System32\msuLcdk.exe
  C:\Windows\System32\msuLcdk.exe
  2⤵
  PID:9416
- C:\Windows\System32\KDrxKQY.exe
  C:\Windows\System32\KDrxKQY.exe
  2⤵
  PID:10268
- C:\Windows\System32\YnQYBcA.exe
  C:\Windows\System32\YnQYBcA.exe
  2⤵
  PID:10356
- C:\Windows\System32\nmZFdGh.exe
  C:\Windows\System32\nmZFdGh.exe
  2⤵
  PID:10404
- C:\Windows\System32\ZzGOaDM.exe
  C:\Windows\System32\ZzGOaDM.exe
  2⤵
  PID:10456
- C:\Windows\System32\vaqizEb.exe
  C:\Windows\System32\vaqizEb.exe
  2⤵
  PID:10524
- C:\Windows\System32\DLBUotA.exe
  C:\Windows\System32\DLBUotA.exe
  2⤵
  PID:10620
- C:\Windows\System32\COtYFbQ.exe
  C:\Windows\System32\COtYFbQ.exe
  2⤵
  PID:10664
- C:\Windows\System32\aRFebip.exe
  C:\Windows\System32\aRFebip.exe
  2⤵
  PID:10716
- C:\Windows\System32\pGrssUW.exe
  C:\Windows\System32\pGrssUW.exe
  2⤵
  PID:10792
- C:\Windows\System32\njRyuUe.exe
  C:\Windows\System32\njRyuUe.exe
  2⤵
  PID:10892
- C:\Windows\System32\pHMiAio.exe
  C:\Windows\System32\pHMiAio.exe
  2⤵
  PID:10896
- C:\Windows\System32\WQLXbTR.exe
  C:\Windows\System32\WQLXbTR.exe
  2⤵
  PID:10992
- C:\Windows\System32\JLfnDgH.exe
  C:\Windows\System32\JLfnDgH.exe
  2⤵
  PID:11068
- C:\Windows\System32\ElMWwUA.exe
  C:\Windows\System32\ElMWwUA.exe
  2⤵
  PID:11088
- C:\Windows\System32\GpdcdNT.exe
  C:\Windows\System32\GpdcdNT.exe
  2⤵
  PID:11176
- C:\Windows\System32\UnwhGTM.exe
  C:\Windows\System32\UnwhGTM.exe
  2⤵
  PID:11256
- C:\Windows\System32\ztHycmE.exe
  C:\Windows\System32\ztHycmE.exe
  2⤵
  PID:10436
- C:\Windows\System32\QwWBtMq.exe
  C:\Windows\System32\QwWBtMq.exe
  2⤵
  PID:10628
- C:\Windows\System32\qjjcQyf.exe
  C:\Windows\System32\qjjcQyf.exe
  2⤵
  PID:10692
- C:\Windows\System32\QsnLMVV.exe
  C:\Windows\System32\QsnLMVV.exe
  2⤵
  PID:2548
- C:\Windows\System32\ODxDXDC.exe
  C:\Windows\System32\ODxDXDC.exe
  2⤵
  PID:10856
- C:\Windows\System32\eSWebpS.exe
  C:\Windows\System32\eSWebpS.exe
  2⤵
  PID:10928
- C:\Windows\System32\fVySFAH.exe
  C:\Windows\System32\fVySFAH.exe
  2⤵
  PID:11112
- C:\Windows\System32\JQJUhqW.exe
  C:\Windows\System32\JQJUhqW.exe
  2⤵
  PID:11148
- C:\Windows\System32\nyglfUj.exe
  C:\Windows\System32\nyglfUj.exe
  2⤵
  PID:10684
- C:\Windows\System32\jLBcKaV.exe
  C:\Windows\System32\jLBcKaV.exe
  2⤵
  PID:10808
- C:\Windows\System32\OzTYSVW.exe
  C:\Windows\System32\OzTYSVW.exe
  2⤵
  PID:11192
- C:\Windows\System32\vePBOeO.exe
  C:\Windows\System32\vePBOeO.exe
  2⤵
  PID:11244
- C:\Windows\System32\YItQxgu.exe
  C:\Windows\System32\YItQxgu.exe
  2⤵
  PID:11272
- C:\Windows\System32\qLFNfvN.exe
  C:\Windows\System32\qLFNfvN.exe
  2⤵
  PID:11288
- C:\Windows\System32\RHQkXzC.exe
  C:\Windows\System32\RHQkXzC.exe
  2⤵
  PID:11312
- C:\Windows\System32\tACbAMh.exe
  C:\Windows\System32\tACbAMh.exe
  2⤵
  PID:11352
- C:\Windows\System32\NItwLUd.exe
  C:\Windows\System32\NItwLUd.exe
  2⤵
  PID:11368
- C:\Windows\System32\kTxKveK.exe
  C:\Windows\System32\kTxKveK.exe
  2⤵
  PID:11388
- C:\Windows\System32\dbLSDjM.exe
  C:\Windows\System32\dbLSDjM.exe
  2⤵
  PID:11412
- C:\Windows\System32\UrPHeNl.exe
  C:\Windows\System32\UrPHeNl.exe
  2⤵
  PID:11428
- C:\Windows\System32\cnFkBZm.exe
  C:\Windows\System32\cnFkBZm.exe
  2⤵
  PID:11492
- C:\Windows\System32\nkKEkYb.exe
  C:\Windows\System32\nkKEkYb.exe
  2⤵
  PID:11520
- C:\Windows\System32\UBscsZf.exe
  C:\Windows\System32\UBscsZf.exe
  2⤵
  PID:11560
- C:\Windows\System32\DvvieUQ.exe
  C:\Windows\System32\DvvieUQ.exe
  2⤵
  PID:11584
- C:\Windows\System32\hUMKohZ.exe
  C:\Windows\System32\hUMKohZ.exe
  2⤵
  PID:11600
- C:\Windows\System32\RtLVASe.exe
  C:\Windows\System32\RtLVASe.exe
  2⤵
  PID:11620
- C:\Windows\System32\TUxDBse.exe
  C:\Windows\System32\TUxDBse.exe
  2⤵
  PID:11668
- C:\Windows\System32\aIpMtWF.exe
  C:\Windows\System32\aIpMtWF.exe
  2⤵
  PID:11688
- C:\Windows\System32\dxRONoj.exe
  C:\Windows\System32\dxRONoj.exe
  2⤵
  PID:11728
- C:\Windows\System32\ZNFjxlv.exe
  C:\Windows\System32\ZNFjxlv.exe
  2⤵
  PID:11744
- C:\Windows\System32\ZdXSZRi.exe
  C:\Windows\System32\ZdXSZRi.exe
  2⤵
  PID:11772
- C:\Windows\System32\zEXaCQf.exe
  C:\Windows\System32\zEXaCQf.exe
  2⤵
  PID:11792
- C:\Windows\System32\avxJZgg.exe
  C:\Windows\System32\avxJZgg.exe
  2⤵
  PID:11828
- C:\Windows\System32\WRvumIc.exe
  C:\Windows\System32\WRvumIc.exe
  2⤵
  PID:11856
- C:\Windows\System32\KhOJtlq.exe
  C:\Windows\System32\KhOJtlq.exe
  2⤵
  PID:11872
- C:\Windows\System32\LQRlGuz.exe
  C:\Windows\System32\LQRlGuz.exe
  2⤵
  PID:11900
- C:\Windows\System32\KFmvyNX.exe
  C:\Windows\System32\KFmvyNX.exe
  2⤵
  PID:11948
- C:\Windows\System32\mNcsJHk.exe
  C:\Windows\System32\mNcsJHk.exe
  2⤵
  PID:11976
- C:\Windows\System32\VmPxyUM.exe
  C:\Windows\System32\VmPxyUM.exe
  2⤵
  PID:11996
- C:\Windows\System32\chmFEHa.exe
  C:\Windows\System32\chmFEHa.exe
  2⤵
  PID:12024
- C:\Windows\System32\TdOvhqL.exe
  C:\Windows\System32\TdOvhqL.exe
  2⤵
  PID:12076
- C:\Windows\System32\umFRZJr.exe
  C:\Windows\System32\umFRZJr.exe
  2⤵
  PID:12092
- C:\Windows\System32\XrlfOHV.exe
  C:\Windows\System32\XrlfOHV.exe
  2⤵
  PID:12108
- C:\Windows\System32\Urwtivk.exe
  C:\Windows\System32\Urwtivk.exe
  2⤵
  PID:12140
- C:\Windows\System32\vZVjUrr.exe
  C:\Windows\System32\vZVjUrr.exe
  2⤵
  PID:12168
- C:\Windows\System32\XuuVBpc.exe
  C:\Windows\System32\XuuVBpc.exe
  2⤵
  PID:12196
- C:\Windows\System32\rBPKwND.exe
  C:\Windows\System32\rBPKwND.exe
  2⤵
  PID:12220
- C:\Windows\System32\gLunhQU.exe
  C:\Windows\System32\gLunhQU.exe
  2⤵
  PID:12240
- C:\Windows\System32\Druzlne.exe
  C:\Windows\System32\Druzlne.exe
  2⤵
  PID:11296
- C:\Windows\System32\XEOCGWe.exe
  C:\Windows\System32\XEOCGWe.exe
  2⤵
  PID:11344
- C:\Windows\System32\HikazZR.exe
  C:\Windows\System32\HikazZR.exe
  2⤵
  PID:11384
- C:\Windows\System32\xLNPGWe.exe
  C:\Windows\System32\xLNPGWe.exe
  2⤵
  PID:11360
- C:\Windows\System32\LJSygrf.exe
  C:\Windows\System32\LJSygrf.exe
  2⤵
  PID:11444
- C:\Windows\System32\yNOmWvI.exe
  C:\Windows\System32\yNOmWvI.exe
  2⤵
  PID:11484
- C:\Windows\System32\EVlcbfD.exe
  C:\Windows\System32\EVlcbfD.exe
  2⤵
  PID:11612
- C:\Windows\System32\ZzaDBEr.exe
  C:\Windows\System32\ZzaDBEr.exe
  2⤵
  PID:11680
- C:\Windows\System32\ZCTEDPl.exe
  C:\Windows\System32\ZCTEDPl.exe
  2⤵
  PID:11756
- C:\Windows\System32\rjELWhQ.exe
  C:\Windows\System32\rjELWhQ.exe
  2⤵
  PID:11808
- C:\Windows\System32\mZqOoPm.exe
  C:\Windows\System32\mZqOoPm.exe
  2⤵
  PID:11844
- C:\Windows\System32\dgacMei.exe
  C:\Windows\System32\dgacMei.exe
  2⤵
  PID:11912
- C:\Windows\System32\notondk.exe
  C:\Windows\System32\notondk.exe
  2⤵
  PID:11964
- C:\Windows\System32\RfeRbKg.exe
  C:\Windows\System32\RfeRbKg.exe
  2⤵
  PID:12016
- C:\Windows\System32\EKkhgrs.exe
  C:\Windows\System32\EKkhgrs.exe
  2⤵
  PID:12152
- C:\Windows\System32\DzhkyvY.exe
  C:\Windows\System32\DzhkyvY.exe
  2⤵
  PID:12236
- C:\Windows\System32\gyvAmzf.exe
  C:\Windows\System32\gyvAmzf.exe
  2⤵
  PID:11348
- C:\Windows\System32\utyWzLx.exe
  C:\Windows\System32\utyWzLx.exe
  2⤵
  PID:11544
- C:\Windows\System32\LLXPReO.exe
  C:\Windows\System32\LLXPReO.exe
  2⤵
  PID:11640
- C:\Windows\System32\utYUNJI.exe
  C:\Windows\System32\utYUNJI.exe
  2⤵
  PID:11740
- C:\Windows\System32\HaPaJWj.exe
  C:\Windows\System32\HaPaJWj.exe
  2⤵
  PID:11888
- C:\Windows\System32\wvPKHbA.exe
  C:\Windows\System32\wvPKHbA.exe
  2⤵
  PID:12008
- C:\Windows\System32\xOeepGA.exe
  C:\Windows\System32\xOeepGA.exe
  2⤵
  PID:12088
- C:\Windows\System32\aMFhsjA.exe
  C:\Windows\System32\aMFhsjA.exe
  2⤵
  PID:12276
- C:\Windows\System32\qCwosop.exe
  C:\Windows\System32\qCwosop.exe
  2⤵
  PID:11472
- C:\Windows\System32\dHhEeYc.exe
  C:\Windows\System32\dHhEeYc.exe
  2⤵
  PID:11784
- C:\Windows\System32\dmiUCnM.exe
  C:\Windows\System32\dmiUCnM.exe
  2⤵
  PID:2648
- C:\Windows\System32\mbufdjq.exe
  C:\Windows\System32\mbufdjq.exe
  2⤵
  PID:11596
- C:\Windows\System32\WsQrNUD.exe
  C:\Windows\System32\WsQrNUD.exe
  2⤵
  PID:11284
- C:\Windows\System32\BqFhaIm.exe
  C:\Windows\System32\BqFhaIm.exe
  2⤵
  PID:12292
- C:\Windows\System32\rqsidor.exe
  C:\Windows\System32\rqsidor.exe
  2⤵
  PID:12312
- C:\Windows\System32\AeupqQG.exe
  C:\Windows\System32\AeupqQG.exe
  2⤵
  PID:12336
- C:\Windows\System32\aBkMHkB.exe
  C:\Windows\System32\aBkMHkB.exe
  2⤵
  PID:12368
- C:\Windows\System32\qKaKkEB.exe
  C:\Windows\System32\qKaKkEB.exe
  2⤵
  PID:12396
- C:\Windows\System32\MRZDtBv.exe
  C:\Windows\System32\MRZDtBv.exe
  2⤵
  PID:12412
- C:\Windows\System32\yyZuywb.exe
  C:\Windows\System32\yyZuywb.exe
  2⤵
  PID:12440
- C:\Windows\System32\RbazdSB.exe
  C:\Windows\System32\RbazdSB.exe
  2⤵
  PID:12456
- C:\Windows\System32\pKrsfDZ.exe
  C:\Windows\System32\pKrsfDZ.exe
  2⤵
  PID:12508
- C:\Windows\System32\HZFXMPA.exe
  C:\Windows\System32\HZFXMPA.exe
  2⤵
  PID:12528
- C:\Windows\System32\sDzTIxJ.exe
  C:\Windows\System32\sDzTIxJ.exe
  2⤵
  PID:12572
- C:\Windows\System32\WuOZdXA.exe
  C:\Windows\System32\WuOZdXA.exe
  2⤵
  PID:12616
- C:\Windows\System32\zqwtuiw.exe
  C:\Windows\System32\zqwtuiw.exe
  2⤵
  PID:12636
- C:\Windows\System32\xWYBqeZ.exe
  C:\Windows\System32\xWYBqeZ.exe
  2⤵
  PID:12660
- C:\Windows\System32\iVeQHvt.exe
  C:\Windows\System32\iVeQHvt.exe
  2⤵
  PID:12700
- C:\Windows\System32\KpLNKxp.exe
  C:\Windows\System32\KpLNKxp.exe
  2⤵
  PID:12728
- C:\Windows\System32\oUuGCmf.exe
  C:\Windows\System32\oUuGCmf.exe
  2⤵
  PID:12764
- C:\Windows\System32\GsugMTk.exe
  C:\Windows\System32\GsugMTk.exe
  2⤵
  PID:12780
- C:\Windows\System32\KkNEvJx.exe
  C:\Windows\System32\KkNEvJx.exe
  2⤵
  PID:12800
- C:\Windows\System32\zdlaMRg.exe
  C:\Windows\System32\zdlaMRg.exe
  2⤵
  PID:12836
- C:\Windows\System32\vZWRcqj.exe
  C:\Windows\System32\vZWRcqj.exe
  2⤵
  PID:12860
- C:\Windows\System32\tnZJxfs.exe
  C:\Windows\System32\tnZJxfs.exe
  2⤵
  PID:12884
- C:\Windows\System32\cTPTKCP.exe
  C:\Windows\System32\cTPTKCP.exe
  2⤵
  PID:12912
- C:\Windows\System32\lJlJyyu.exe
  C:\Windows\System32\lJlJyyu.exe
  2⤵
  PID:12932
- C:\Windows\System32\zWJOqmI.exe
  C:\Windows\System32\zWJOqmI.exe
  2⤵
  PID:12968
- C:\Windows\System32\dQMRcEY.exe
  C:\Windows\System32\dQMRcEY.exe
  2⤵
  PID:13008
- C:\Windows\System32\zeozuyM.exe
  C:\Windows\System32\zeozuyM.exe
  2⤵
  PID:13024
- C:\Windows\System32\YbpyRdo.exe
  C:\Windows\System32\YbpyRdo.exe
  2⤵
  PID:13052
- C:\Windows\System32\ZCvpvhg.exe
  C:\Windows\System32\ZCvpvhg.exe
  2⤵
  PID:13080
- C:\Windows\System32\RSBODKo.exe
  C:\Windows\System32\RSBODKo.exe
  2⤵
  PID:13116
- C:\Windows\System32\seAGTeb.exe
  C:\Windows\System32\seAGTeb.exe
  2⤵
  PID:13140
- C:\Windows\System32\YrbnQjx.exe
  C:\Windows\System32\YrbnQjx.exe
  2⤵
  PID:13184
- C:\Windows\System32\sQxqnoF.exe
  C:\Windows\System32\sQxqnoF.exe
  2⤵
  PID:13204
- C:\Windows\System32\hHzlymc.exe
  C:\Windows\System32\hHzlymc.exe
  2⤵
  PID:13220
- C:\Windows\System32\DJCnQoP.exe
  C:\Windows\System32\DJCnQoP.exe
  2⤵
  PID:13252
- C:\Windows\System32\cwBSZQc.exe
  C:\Windows\System32\cwBSZQc.exe
  2⤵
  PID:13284
- C:\Windows\System32\IOqmAkJ.exe
  C:\Windows\System32\IOqmAkJ.exe
  2⤵
  PID:13300
- C:\Windows\System32\QKxTYNI.exe
  C:\Windows\System32\QKxTYNI.exe
  2⤵
  PID:12156
- C:\Windows\System32\GdbbZdh.exe
  C:\Windows\System32\GdbbZdh.exe
  2⤵
  PID:12332
- C:\Windows\System32\tiBASdI.exe
  C:\Windows\System32\tiBASdI.exe
  2⤵
  PID:12424
- C:\Windows\System32\gzpMbvo.exe
  C:\Windows\System32\gzpMbvo.exe
  2⤵
  PID:12464
- C:\Windows\System32\thwuFAz.exe
  C:\Windows\System32\thwuFAz.exe
  2⤵
  PID:12452
- C:\Windows\System32\HgBgKMc.exe
  C:\Windows\System32\HgBgKMc.exe
  2⤵
  PID:12520
- C:\Windows\System32\YCfIDUD.exe
  C:\Windows\System32\YCfIDUD.exe
  2⤵
  PID:12644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\AYvwCRY.exe

Filesize
1.2MB

MD5
0d0839eae7c69ea0b5eb83ff02f9da63

SHA1
35ac65d783e2f2a16add1cb8a433a05ecc3755cb

SHA256
f7f57636069ac95b7095c0f1b6c2fb80fee891cb81035691859b237a5ac85137

SHA512
acb481ccd815167a52cdc36762107aac742cf7c5042c3c7124bb41fe4926ef668d37419bfe9ed6e06f5fbbcb184444f0c8c06ef9d964875645542e931ef2a827

Download Submit
C:\Windows\System32\GtqupKE.exe

Filesize
1.2MB

MD5
106974dfb599614a95bbadeb317bbc01

SHA1
77bd0f1b7548c953cd6c7fca1b517a492e0a7b6d

SHA256
0ab45f6fd66a60ba12105ceef57a77a6b8dff3f750b11e11059bd93b224acf14

SHA512
7d67f5d89f245798f21bd68af16a841122013fb4ed4085f815c6935dcd1dedc9231e577918f0f5eb886588e8ad1b7e627dd4e8a8b6891a13a601bdbda129b9af

Download Submit
C:\Windows\System32\HSzUopP.exe

Filesize
1.2MB

MD5
4e020511900a694f07c2bdf9c1693cd6

SHA1
1d0797e6882e3a124d1a3e8268bf0a2c29ae7dde

SHA256
12d04895b1ec2600d13b8ede03c3ec3d2d404149f8593919b24adf03f8a4ddbf

SHA512
ae75d91bcebb90bd8d279d05677b547b67333d920bba7a3e9aaea75690ffa4b6a4070036949859fd01214eb0d8d8e499f6f05772f35df34ed44cc0a9790e1136

Download Submit
C:\Windows\System32\LyACDuG.exe

Filesize
1.2MB

MD5
ac930bde7f38dbabecee850e11ee3f5e

SHA1
8b20c5d82b7c183c82ff7a041c48729833ead4e7

SHA256
45249a05442d048e92252fd9a4f2240c29e9c4d98093f4fe886da0e9e291bfdc

SHA512
e3448da2341a19928ed169be1d5651f8f8d5ec80214084e5df6f8a899ec33272abfcfd718548a8288c0ab6b64205ba2122b57e1ebe9780e24440b732b77f88d5

Download Submit
C:\Windows\System32\RYSKXbL.exe

Filesize
1.2MB

MD5
cf8343c9761e7f8b57f06a02a074f661

SHA1
6a52622ea4df92a3fe681864fba7329d5a3d1366

SHA256
be9d13f6521e99ed061b0afc74860be80ed92547dbf0b578f80780379e03541d

SHA512
f0693623ebb7d1753cb70116371832c9bce97706069b377213a8ac81287eb58d5568bd02a02da0b61d4629126fc95077849ba22663be3bb4ac96042650f7e463

Download Submit
C:\Windows\System32\TYOESij.exe

Filesize
1.2MB

MD5
7413ec6733e91fb04526ca0e36edbcbc

SHA1
6ab31315daec61cbb5f782418f2e24b7c0c1666d

SHA256
12d1378bd7dbfbd285851e2078b765d5ddee498347ab0fdeb638734f66bb560d

SHA512
e287150fb15eab3da88dc20337a803f6501d09e33fb284d9aef023acf80cc009cc3c6ffcad0a30974663ee0325d95471b06c2efaad3edf44afc741cb62fd971a

Download Submit
C:\Windows\System32\TzsGwdj.exe

Filesize
1.2MB

MD5
af9485d512e5b308194a101f5ad14e28

SHA1
0567ad8b850ac6487e68e34cc2e99cd00cc8684f

SHA256
08bd24c72548b3df98944cb3e4c7a3f3b4ba61d56404bfbaee17f9edec8c7b67

SHA512
d41f04241200f14a512d00258e6795e1ebe976bbb44eb1fd17a9881fd11e7045bf0aa2969b946f1d1af8626429ee6542d3e33e2e5c990a87746a84de6dea7525

Download Submit
C:\Windows\System32\VGqScsa.exe

Filesize
1.2MB

MD5
1e6ce75a6ece69d5cbf92cac07da2f80

SHA1
04f4cf89ed9fbd3f2d1e12bf8f7c98ead274e8e4

SHA256
6156930541164f3f8cfbed0b93ba4b8f50b9a74e9ad3dd44c9854d5f2d64b706

SHA512
1e559fb86c3cd854657ae09bc96f14610d96a0627a89f2032cecf2487888277bbf592adade970d78a7bb49730353ad2d5544935d9ec9787c2a5c50d6262f5296

Download Submit
C:\Windows\System32\VKEGPPm.exe

Filesize
1.2MB

MD5
9dcfe6fcf01b35936580a28f636b24b1

SHA1
3757b347d13221e6bad8d3e71cacc8d988863662

SHA256
a8a3ebc8fec31b197df41452890e840cadad7b70c97620bf041de3556bc99eb6

SHA512
3aec06d1d4cf5b56aeb67bda232c5bfaf3a165a1e022102324db5e3d272500f598579d058910e98090a38cf11acc25dfcf34ac04f866ed9fdf59990952500ee7

Download Submit
C:\Windows\System32\VdABByB.exe

Filesize
1.2MB

MD5
dc38df433c5d25ac6f747011a5b987b0

SHA1
e7ea99b4784f3f73d2e3d1c13015f25231891f2d

SHA256
b923210098306608981a3198de1c6a1037a83019c1552857c1a880f9c4a4222a

SHA512
ed1f57117ad8c1859add673d512b2746991319159421754ff29c780e244550ad761da8a859237485c813dc658721928f2e4bbe18f9a3016696621d67fa4cff50

Download Submit
C:\Windows\System32\WfWQhlg.exe

Filesize
1.2MB

MD5
c9aeab0943a106f529728490026d5474

SHA1
2cfd29232a5cb854677a244c1921bf1130a848d8

SHA256
130ce4b08820ae9b303655bc565bb30b84edd137d0fd19064163b1bd9ac52be3

SHA512
c520f1ca3a3e8e5377b9ac0502308bd08c8a132a99ff92defe1477d3462b2480ef841e8969c79d355c407e03dab5440ee3774f31fadf75e2bdc4afb0173e96d1

Download Submit
C:\Windows\System32\XPhvCSC.exe

Filesize
1.2MB

MD5
76aaf45e209acc466e73b70ce0b7b7a3

SHA1
df63c2af87b7843db2fbcbbd387490bff3e9e497

SHA256
562adb72abc6ddf2dc1ba051b0be0733d3ffb83506ed0796a9d2219e39d2b4e4

SHA512
cd7cd78272b592193058b4c84cd26fc85d71ba0f792859aaf70674db4ac10bdb9f10e482b0ef6671a3ed8a79f6b03cbbe11ce3f31c2b31aff0a15f99517d41dd

Download Submit
C:\Windows\System32\ZUWJlOB.exe

Filesize
1.2MB

MD5
6b091ff18552f66f680a89defdb61288

SHA1
823d71fac417d95e8f724f95c4c75f6ecb5112db

SHA256
353d39e22e33554fb79f1ba8bd1c8040de01e8112bc9c013234e6823d207e878

SHA512
99f090c1dae9a7967603842f76b5cda8af8d6057a17f27e987950212c1e89a2e0bdad9230e5b4229667d15448cf6f14113f012b5a0e6ea672a50aec645ac1398

Download Submit
C:\Windows\System32\cpMRNGp.exe

Filesize
1.2MB

MD5
9fd5c4fac848d362e48ce68a60003252

SHA1
0c1157d15aa1be5c5b044ec7a469a1585e63abd0

SHA256
efdf17d2299710c040f1507e418536e37524c65c3627908096a41722e0455103

SHA512
741fe7f63a869da7b120bab2c1aa5e3d20121a10b5920643e2c1ff32ae119749757ecec5ab3bb8c24aadf5685eb3856b0d1427845f4237ac7fcbadc3733579e5

Download Submit
C:\Windows\System32\fSiYmQU.exe

Filesize
1.2MB

MD5
70aefcac86fe2a633fa3b4757c582b1f

SHA1
c8fe3ee28b2077db0f7c4afe55ccc40912a4d1c6

SHA256
deaab154a8cbc9024ee3beb05aae83123b3f516a671128c9fe0f071141093bad

SHA512
497c91d47f7ed0878d85ab61d16f7b98fe918b85aade80c341fa752d016633fe0abc5b83a65819203f2b85a5db25199276a409694c5201189c2e3ee180fd2c46

Download Submit
C:\Windows\System32\gHFZmym.exe

Filesize
1.2MB

MD5
96a74c5543a4c69a987e2017ca525c5a

SHA1
0ddda204e34aa8ea35b47363b20c323c06ec6967

SHA256
4f569de167c62c495b77d15d7c48d2028219fab1bd10438f47320db936ffd066

SHA512
b809bb596c8a4218914b1407cdd775924f75e8239e7efbd28554f63cfe3d534e14c31c282e5d238af9dea54f40b52cf81940e89bbd5d49b2bdf70b40a06da2cf

Download Submit
C:\Windows\System32\geLJnoJ.exe

Filesize
1.2MB

MD5
48131b2dcbdb32a23419f4350ed707f4

SHA1
b7f89650eec9cef2b6d145be653c089cbc34291a

SHA256
67d3fd552902b468070fc43c5be972bd2cc8b3a78ada381848563c4a76734d4d

SHA512
164bc19af825f061fa710e63f616132cc0568d5f2d46bf9f9c1c766989fa47f37a433b700f3a6c1d155e404daa549d5839439fdda4f31030266b086479dd79e5

Download Submit
C:\Windows\System32\gnfgyRJ.exe

Filesize
1.2MB

MD5
7d45e604f74c7d47f74bfa53d7e26673

SHA1
e7761601ffca2edf5b47eab173ef3328ae109a8e

SHA256
f919dc32a4d97fbf37e992f14d57b9b5b406b08e7a2681e9317c3ca5f77d28ae

SHA512
dd65cfd448cf326ce351bc9a7fe29e422f0bf386933d52528f3b5d652589df24364a0f0a49c3e902e9bea5a993fddf71c2bc92b64536f1d9c595b21286d1436a

Download Submit
C:\Windows\System32\jDuqtQk.exe

Filesize
1.2MB

MD5
fbc13a3d5f22e3802d7f6cd135b0691a

SHA1
18f2f7e3e61f18d97b7077adc531c10239747978

SHA256
3d97ccb123c4df799410ad87697ca5052e1ad78b6416c7aaa49683529c9fc03b

SHA512
79ea644466b5bd1733b762201b0ba45daea3f26cb4b7edc00334c2f723cdf11f848f7fa3db7cb6e0cc2f0f9520dc4ed771c8b6332862bbeb9ba6dddf55023510

Download Submit
C:\Windows\System32\jIChnXw.exe

Filesize
1.2MB

MD5
f0937dc02777c12d6378255645833669

SHA1
2533a69e9f0e89b2bd66e9902b4f73eb5af06f83

SHA256
2a0eb414df7dbf8dad434e116733c42cd5037081e158601dc1873e6f6ced56ac

SHA512
af01555213ff1b686cd2ed788b719a90e88a8c93cdab3981704b8522fe699be9f4568c3cc191939d3d9185a4269e112a4e5a6fe3174ae2936f98873693ea686c

Download Submit
C:\Windows\System32\jSLquCR.exe

Filesize
1.2MB

MD5
55fb140a36077fd252c9274552cddd0f

SHA1
e5db44b7071db7a1c4c0a16c55a5ca652ac0e4c5

SHA256
7d2f3a9ef6641cb647501cc6b2025143f308c067b0425cb971320efaebb17475

SHA512
5096adea576f455985e2692b14178182d5bdaaa6165be098a3f3bb43074fde20a14f2c74e1e1c61f0d89287d0357783f42c084ccd87086482e79cdc4061aeefd

Download Submit
C:\Windows\System32\kUHORBP.exe

Filesize
1.2MB

MD5
9511ad1bba1a432e818e53c487e4d437

SHA1
14d38cb8a5e684905e5722286424979d2539fb72

SHA256
7865857641f107eae0fb1e15c56011e74de8b70b15e80c2808bbaf74ecf026ad

SHA512
69130dbb948954801d638a92bf2a7504d483484ed331ab8da402b4b9673d867775821228eedcd1a457bfe14095aa4809db3eb47f9340fbb5f8ca425013deb035

Download Submit
C:\Windows\System32\kvxfIYG.exe

Filesize
1.2MB

MD5
65396677b419eb0d3c83d2402250f56b

SHA1
a1fa3667a0550facb3fcd7e486472bdea97a928c

SHA256
0e98a76e0a42afe9df60c74b317fbb7bae02e35bd45a8cdbaa538be8feafd2be

SHA512
81c3972fcd6733a8ff1200dd0f2b1988dec8bac93d9b275f4c96dbfdb09d4d479d113a8d42d30bcc6e47b454235aaed3e6a61230c41221f066a85720ce279356

Download Submit
C:\Windows\System32\lOUmbCr.exe

Filesize
1.2MB

MD5
ee3dd8635b57be5e3c5cd4069788a8cc

SHA1
cc3fc2f07ca098b721ad8c8b5d20dfe0c6b1230b

SHA256
69fb926788ecd14844c50993bd56bdad9e712d56131122a0dbb5914450dca5e0

SHA512
4e0886ecfaeeea8a4856e5b65fafaa4164742c69dbc8a940ee04900f7c3715f9d742cd516e3c13f2df20531f31fccd96522257164fb883187a0b82da788a86bc

Download Submit
C:\Windows\System32\lUUgaDY.exe

Filesize
1.2MB

MD5
873237cb634d29fbfa84d2fd4988cc9d

SHA1
18d004bd2bd24f30275b61a01b761bba3750f7a0

SHA256
79821ee55a49c90f4dfb2cedc20a8c941cb53bc4ff31ee7e5edf3b4ea1a76c88

SHA512
579665e4bcb073ba61d1f39ed1e66573423eb20e46e1165800e561fa223abf437355a1f0a26e3beac2d4ad66e9f9d45f388fd2dc4bf05616986ce918327267aa

Download Submit
C:\Windows\System32\ldHkmQz.exe

Filesize
1.2MB

MD5
1be30cbf2275409165a9a03bece0570b

SHA1
fdaff0d1ab9ee3d894f886c12cac41c0a7a8f4df

SHA256
f9555fc0e640821ab26e3e953d31c2247f29cb02fb80f07cf2eb420f43d167e7

SHA512
ccdf22571f433ccc7e1c32fe462bd74c5fe7908b707a16e3f9944431cf2d53de2bc68527abfd68e69a1f077b2d71dd30f433cd5d9b48ce04430ad24ee9cca00a

Download Submit
C:\Windows\System32\nHmztpH.exe

Filesize
1.2MB

MD5
6cfd40b5a6414b2c6d94e93d083d2129

SHA1
cca2e4c7c63d4668bc1f36a437aa9a810e1c7e36

SHA256
cfa6234dbbc4d827565a8d1d73ffe4b5864f38afa3f4577ddc64658a2a5671ab

SHA512
a2958b22b4be49851a13fda48b11effc806fb3384f3f7b234f6edfba0b1d50698b9253bed1fbfc02104d338a401d97325a8b2edf688496e93464e70c66295898

Download Submit
C:\Windows\System32\oOiNrIW.exe

Filesize
1.2MB

MD5
430128fe71e9be538381f48718f01f90

SHA1
e6c0ae03e20c5eec6fa8d54c707058c5501a4793

SHA256
e086ff17183822a6886c53fd5c48f7ca5f9a64c2bbff44629f4e13129fa70af3

SHA512
15b2aa2b1f9243bdda22b143cef926ab0bfc531f4b83104fac7fc735f817ec2834156f1893df3172aa68ae9be955acc10d9cf168f64f54bdff9af6ad62bb57fb

Download Submit
C:\Windows\System32\raLnniQ.exe

Filesize
1.2MB

MD5
1db17c61ba75a6dfe4c98aef2f878a2a

SHA1
0ab66bddf7c8f88f21d6e1b02352de29e5638e4a

SHA256
0433e976d14a1b76ba880301b20cae9178847e94f47efbd10da00f43287cdaa0

SHA512
e100fc60a7ee08c7654e2713def072123c98683041bd31f56b411f18eea04ba990e94e08a41a239682ead2c32bcdcf3a7eab63f0c892d33940e182e8ff3d3feb

Download Submit
C:\Windows\System32\uBgDZem.exe

Filesize
1.2MB

MD5
bf8f68837697cd0d00b32ca8dc33fc32

SHA1
4f572bf5a58671196d7993777659303dcce68ea3

SHA256
ea1240b3ace18e2a881aea697fe0d1cec67e6cabfc89aa70c3cd29293a319723

SHA512
34ec2b87f18391c5ceee9e9135e8d63072ec3c26f522e91646db0b0e7d4b86b89c48bb4e3a558096491d14132899595f215d5bc29e5c57dbecc3a9d86f29e1e3

Download Submit
C:\Windows\System32\umoYzdr.exe

Filesize
1.2MB

MD5
375514e9c445f7f06eaaaa87c1232be9

SHA1
e9fd65e7a8022551eb8257ecd26160fd87f11bfe

SHA256
3f97bc78b6294ee53524d032fa2c21777c1360c3eb08761765e8383c1bc0058a

SHA512
d0f956a0617245ce605dd61d2dfcc3588ce3c141c840c1a206da160bca728504c47852f03dd13a52444221cf56487668913f0fc3249f1fd739a6eaf06da08ceb

Download Submit
C:\Windows\System32\zAlxxWP.exe

Filesize
1.2MB

MD5
acd2e6656bbe8398eccbe8b13d98425a

SHA1
e4ba89b40f81ff197f62144b48dd4e5094843dda

SHA256
5a4b313d1af3a8d7eb03c01f0881ede9beb99dae90cf2a6e402546773eeb3c7f

SHA512
b96c4395113219df93166357f356145b935246af2ccf354179c891df962a277fbee0677b7f739d089fcb62e1deaa3afdfff49bb5e4d4dbef5674abe83b42f0fd

Download Submit
memory/732-1989-0x00007FF6BB9F0000-0x00007FF6BBDE1000-memory.dmp

Filesize
3.9MB

Download
memory/732-1980-0x00007FF6BB9F0000-0x00007FF6BBDE1000-memory.dmp

Filesize
3.9MB

Download
memory/732-13-0x00007FF6BB9F0000-0x00007FF6BBDE1000-memory.dmp

Filesize
3.9MB

Download
memory/932-1-0x0000013CB4EC0000-0x0000013CB4ED0000-memory.dmp

Filesize
64KB

Download
memory/932-0-0x00007FF62A650000-0x00007FF62AA41000-memory.dmp

Filesize
3.9MB

Download
memory/1152-2019-0x00007FF62BD80000-0x00007FF62C171000-memory.dmp

Filesize
3.9MB

Download
memory/1152-409-0x00007FF62BD80000-0x00007FF62C171000-memory.dmp

Filesize
3.9MB

Download
memory/1600-2027-0x00007FF6FF070000-0x00007FF6FF461000-memory.dmp

Filesize
3.9MB

Download
memory/1600-382-0x00007FF6FF070000-0x00007FF6FF461000-memory.dmp

Filesize
3.9MB

Download
memory/1604-396-0x00007FF7210E0000-0x00007FF7214D1000-memory.dmp

Filesize
3.9MB

Download
memory/1604-2023-0x00007FF7210E0000-0x00007FF7214D1000-memory.dmp

Filesize
3.9MB

Download
memory/1968-375-0x00007FF730A60000-0x00007FF730E51000-memory.dmp

Filesize
3.9MB

Download
memory/1968-2041-0x00007FF730A60000-0x00007FF730E51000-memory.dmp

Filesize
3.9MB

Download
memory/2120-378-0x00007FF6BA070000-0x00007FF6BA461000-memory.dmp

Filesize
3.9MB

Download
memory/2120-2055-0x00007FF6BA070000-0x00007FF6BA461000-memory.dmp

Filesize
3.9MB

Download
memory/2136-2021-0x00007FF744ED0000-0x00007FF7452C1000-memory.dmp

Filesize
3.9MB

Download
memory/2136-403-0x00007FF744ED0000-0x00007FF7452C1000-memory.dmp

Filesize
3.9MB

Download
memory/2340-377-0x00007FF693C20000-0x00007FF694011000-memory.dmp

Filesize
3.9MB

Download
memory/2340-2038-0x00007FF693C20000-0x00007FF694011000-memory.dmp

Filesize
3.9MB

Download
memory/2412-2030-0x00007FF62B5E0000-0x00007FF62B9D1000-memory.dmp

Filesize
3.9MB

Download
memory/2412-381-0x00007FF62B5E0000-0x00007FF62B9D1000-memory.dmp

Filesize
3.9MB

Download
memory/2512-2031-0x00007FF6F3B70000-0x00007FF6F3F61000-memory.dmp

Filesize
3.9MB

Download
memory/2512-379-0x00007FF6F3B70000-0x00007FF6F3F61000-memory.dmp

Filesize
3.9MB

Download
memory/3100-427-0x00007FF700D10000-0x00007FF701101000-memory.dmp

Filesize
3.9MB

Download
memory/3100-2057-0x00007FF700D10000-0x00007FF701101000-memory.dmp

Filesize
3.9MB

Download
memory/3172-1994-0x00007FF67B240000-0x00007FF67B631000-memory.dmp

Filesize
3.9MB

Download
memory/3172-447-0x00007FF67B240000-0x00007FF67B631000-memory.dmp

Filesize
3.9MB

Download
memory/3432-368-0x00007FF6BE8C0000-0x00007FF6BECB1000-memory.dmp

Filesize
3.9MB

Download
memory/3432-1991-0x00007FF6BE8C0000-0x00007FF6BECB1000-memory.dmp

Filesize
3.9MB

Download
memory/3456-418-0x00007FF6C5170000-0x00007FF6C5561000-memory.dmp

Filesize
3.9MB

Download
memory/3456-2043-0x00007FF6C5170000-0x00007FF6C5561000-memory.dmp

Filesize
3.9MB

Download
memory/3492-373-0x00007FF62A8B0000-0x00007FF62ACA1000-memory.dmp

Filesize
3.9MB

Download
memory/3492-1995-0x00007FF62A8B0000-0x00007FF62ACA1000-memory.dmp

Filesize
3.9MB

Download
memory/3712-364-0x00007FF73E070000-0x00007FF73E461000-memory.dmp

Filesize
3.9MB

Download
memory/3712-1988-0x00007FF73E070000-0x00007FF73E461000-memory.dmp

Filesize
3.9MB

Download
memory/3924-436-0x00007FF74BB30000-0x00007FF74BF21000-memory.dmp

Filesize
3.9MB

Download
memory/3924-2067-0x00007FF74BB30000-0x00007FF74BF21000-memory.dmp

Filesize
3.9MB

Download
memory/3948-2040-0x00007FF7DCFA0000-0x00007FF7DD391000-memory.dmp

Filesize
3.9MB

Download
memory/3948-376-0x00007FF7DCFA0000-0x00007FF7DD391000-memory.dmp

Filesize
3.9MB

Download
memory/4124-1978-0x00007FF6F26B0000-0x00007FF6F2AA1000-memory.dmp

Filesize
3.9MB

Download
memory/4124-1985-0x00007FF6F26B0000-0x00007FF6F2AA1000-memory.dmp

Filesize
3.9MB

Download
memory/4124-7-0x00007FF6F26B0000-0x00007FF6F2AA1000-memory.dmp

Filesize
3.9MB

Download
memory/4132-383-0x00007FF7D75F0000-0x00007FF7D79E1000-memory.dmp

Filesize
3.9MB

Download
memory/4132-2026-0x00007FF7D75F0000-0x00007FF7D79E1000-memory.dmp

Filesize
3.9MB

Download
memory/4140-2061-0x00007FF7D3ED0000-0x00007FF7D42C1000-memory.dmp

Filesize
3.9MB

Download
memory/4140-443-0x00007FF7D3ED0000-0x00007FF7D42C1000-memory.dmp

Filesize
3.9MB

Download
memory/4568-2059-0x00007FF769600000-0x00007FF7699F1000-memory.dmp

Filesize
3.9MB

Download
memory/4568-431-0x00007FF769600000-0x00007FF7699F1000-memory.dmp

Filesize
3.9MB

Download
memory/4656-2033-0x00007FF767060000-0x00007FF767451000-memory.dmp

Filesize
3.9MB

Download
memory/4656-380-0x00007FF767060000-0x00007FF767451000-memory.dmp

Filesize
3.9MB

Download
memory/4752-2035-0x00007FF68CC80000-0x00007FF68D071000-memory.dmp

Filesize
3.9MB

Download
memory/4752-421-0x00007FF68CC80000-0x00007FF68D071000-memory.dmp

Filesize
3.9MB

Download