xmrig | 54aaf59c799583ff49266d38bbaf30b36ad862a6057460b1ecc91a5605fdbfcc

Analysis

max time kernel
94s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240729-en
resource tags

arch:x64arch:x86image:win10v2004-20240729-enlocale:en-usos:windows10-2004-x64system
submitted
27-07-2024 23:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
Size

1.1MB
MD5

02d59a875e88a8cdf99f497eb384afcb
SHA1

1e33a10b53da44c1216913a03952a2ecabd688a6
SHA256

54aaf59c799583ff49266d38bbaf30b36ad862a6057460b1ecc91a5605fdbfcc
SHA512

95d73616a0394d7d32b36f18fa9728cd7dfc7f1d5043509185059e0395e0bd4c1769025859b39ed4312bfa92eee09da71765913cb0ff16ee8a6ca37c75a4d01c
SSDEEP

24576:JanwhSe11QSONCpGJCjETPlGC78XCej06sSsJc:knw9oUUEEDlGUrMjV

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/2908-30-0x00007FF666C60000-0x00007FF667051000-memory.dmp	xmrig
behavioral2/memory/1280-48-0x00007FF6F81B0000-0x00007FF6F85A1000-memory.dmp	xmrig
behavioral2/memory/2036-352-0x00007FF6CC9E0000-0x00007FF6CCDD1000-memory.dmp	xmrig
behavioral2/memory/2120-354-0x00007FF617010000-0x00007FF617401000-memory.dmp	xmrig
behavioral2/memory/2644-355-0x00007FF6610B0000-0x00007FF6614A1000-memory.dmp	xmrig
behavioral2/memory/3192-359-0x00007FF7E3360000-0x00007FF7E3751000-memory.dmp	xmrig
behavioral2/memory/848-377-0x00007FF687230000-0x00007FF687621000-memory.dmp	xmrig
behavioral2/memory/3896-390-0x00007FF6E63F0000-0x00007FF6E67E1000-memory.dmp	xmrig
behavioral2/memory/4816-399-0x00007FF70F340000-0x00007FF70F731000-memory.dmp	xmrig
behavioral2/memory/4512-424-0x00007FF673A60000-0x00007FF673E51000-memory.dmp	xmrig
behavioral2/memory/3728-431-0x00007FF6797C0000-0x00007FF679BB1000-memory.dmp	xmrig
behavioral2/memory/928-443-0x00007FF7BFC50000-0x00007FF7C0041000-memory.dmp	xmrig
behavioral2/memory/2104-410-0x00007FF6BAF20000-0x00007FF6BB311000-memory.dmp	xmrig
behavioral2/memory/4892-384-0x00007FF6F82F0000-0x00007FF6F86E1000-memory.dmp	xmrig
behavioral2/memory/4996-373-0x00007FF61FDD0000-0x00007FF6201C1000-memory.dmp	xmrig
behavioral2/memory/2044-340-0x00007FF6036E0000-0x00007FF603AD1000-memory.dmp	xmrig
behavioral2/memory/1360-51-0x00007FF631260000-0x00007FF631651000-memory.dmp	xmrig
behavioral2/memory/2196-44-0x00007FF7362E0000-0x00007FF7366D1000-memory.dmp	xmrig
behavioral2/memory/4244-42-0x00007FF6B0900000-0x00007FF6B0CF1000-memory.dmp	xmrig
behavioral2/memory/4136-1990-0x00007FF7F85A0000-0x00007FF7F8991000-memory.dmp	xmrig
behavioral2/memory/380-1991-0x00007FF7619B0000-0x00007FF761DA1000-memory.dmp	xmrig
behavioral2/memory/4244-1992-0x00007FF6B0900000-0x00007FF6B0CF1000-memory.dmp	xmrig
behavioral2/memory/2340-1993-0x00007FF6B9E70000-0x00007FF6BA261000-memory.dmp	xmrig
behavioral2/memory/316-2026-0x00007FF61BCE0000-0x00007FF61C0D1000-memory.dmp	xmrig
behavioral2/memory/1184-2027-0x00007FF6E54B0000-0x00007FF6E58A1000-memory.dmp	xmrig
behavioral2/memory/1556-2033-0x00007FF7C94C0000-0x00007FF7C98B1000-memory.dmp	xmrig
behavioral2/memory/2908-2035-0x00007FF666C60000-0x00007FF667051000-memory.dmp	xmrig
behavioral2/memory/1360-2037-0x00007FF631260000-0x00007FF631651000-memory.dmp	xmrig
behavioral2/memory/380-2039-0x00007FF7619B0000-0x00007FF761DA1000-memory.dmp	xmrig
behavioral2/memory/2196-2041-0x00007FF7362E0000-0x00007FF7366D1000-memory.dmp	xmrig
behavioral2/memory/1280-2043-0x00007FF6F81B0000-0x00007FF6F85A1000-memory.dmp	xmrig
behavioral2/memory/4244-2045-0x00007FF6B0900000-0x00007FF6B0CF1000-memory.dmp	xmrig
behavioral2/memory/316-2047-0x00007FF61BCE0000-0x00007FF61C0D1000-memory.dmp	xmrig
behavioral2/memory/2340-2049-0x00007FF6B9E70000-0x00007FF6BA261000-memory.dmp	xmrig
behavioral2/memory/1184-2051-0x00007FF6E54B0000-0x00007FF6E58A1000-memory.dmp	xmrig
behavioral2/memory/2120-2055-0x00007FF617010000-0x00007FF617401000-memory.dmp	xmrig
behavioral2/memory/928-2053-0x00007FF7BFC50000-0x00007FF7C0041000-memory.dmp	xmrig
behavioral2/memory/2644-2057-0x00007FF6610B0000-0x00007FF6614A1000-memory.dmp	xmrig
behavioral2/memory/2044-2061-0x00007FF6036E0000-0x00007FF603AD1000-memory.dmp	xmrig
behavioral2/memory/2036-2060-0x00007FF6CC9E0000-0x00007FF6CCDD1000-memory.dmp	xmrig
behavioral2/memory/3192-2063-0x00007FF7E3360000-0x00007FF7E3751000-memory.dmp	xmrig
behavioral2/memory/4512-2075-0x00007FF673A60000-0x00007FF673E51000-memory.dmp	xmrig
behavioral2/memory/2104-2077-0x00007FF6BAF20000-0x00007FF6BB311000-memory.dmp	xmrig
behavioral2/memory/3728-2106-0x00007FF6797C0000-0x00007FF679BB1000-memory.dmp	xmrig
behavioral2/memory/4816-2074-0x00007FF70F340000-0x00007FF70F731000-memory.dmp	xmrig
behavioral2/memory/3896-2071-0x00007FF6E63F0000-0x00007FF6E67E1000-memory.dmp	xmrig
behavioral2/memory/4996-2070-0x00007FF61FDD0000-0x00007FF6201C1000-memory.dmp	xmrig
behavioral2/memory/848-2068-0x00007FF687230000-0x00007FF687621000-memory.dmp	xmrig
behavioral2/memory/4892-2066-0x00007FF6F82F0000-0x00007FF6F86E1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1556	VTdNEfs.exe
2908	wPWTCvW.exe
1360	jCfHupd.exe
380	FrPyePC.exe
4244	WpQxJTS.exe
2196	RZVsAGQ.exe
1280	OEweDiG.exe
316	yGwCsuj.exe
2340	brtjVDt.exe
1184	FfwehrQ.exe
928	KfUYhsg.exe
2044	laEedcW.exe
2036	egKTUrc.exe
2120	CfKEmEO.exe
2644	ONdspyX.exe
3192	xfsylXa.exe
4996	FjdWHEA.exe
848	nBkBBYT.exe
4892	qfNcYjI.exe
3896	JrFstkd.exe
4816	eilCapc.exe
2104	zezEiWI.exe
4512	heMJLTG.exe
3728	OYSRsFY.exe
2708	tezAZxV.exe
2724	xyGGFHT.exe
372	bWVQGGX.exe
2424	TUaaekR.exe
456	AnpjUVq.exe
2992	NprglCj.exe
2880	VIYNFHE.exe
3600	qrKpAMo.exe
2216	NghffDi.exe
4944	KdJFjPa.exe
4132	dqHVREf.exe
4936	yoaHEUF.exe
2848	nDefUFn.exe
1872	ELJSozF.exe
4992	YyRdWtE.exe
4596	joyrZms.exe
2528	sJjzQZd.exe
4504	PmxXeOL.exe
3568	ENyFLHJ.exe
1488	ogdtyYw.exe
4648	ZRuCfLr.exe
344	WzLGNbV.exe
4408	TRyfZfN.exe
4044	OruMyqY.exe
1908	OLqHsbP.exe
4556	zqPfxmm.exe
3960	UkdBPzx.exe
3660	pEyOXeZ.exe
3536	BmceWXz.exe
2236	fWgEoCB.exe
1324	DMSttft.exe
4292	FgQDYcY.exe
1940	dzQaAxX.exe
3876	DcJfPxQ.exe
3236	dDVFjEq.exe
4696	dBnjTrG.exe
2592	VbRZapN.exe
3364	Ciqeuzy.exe
436	WfdWDLV.exe
3496	cSXSYAF.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4136-0-0x00007FF7F85A0000-0x00007FF7F8991000-memory.dmp	upx
behavioral2/files/0x000900000002353d-4.dat	upx
behavioral2/files/0x0009000000023599-11.dat	upx
behavioral2/files/0x00070000000235a1-26.dat	upx
behavioral2/memory/2908-30-0x00007FF666C60000-0x00007FF667051000-memory.dmp	upx
behavioral2/memory/1280-48-0x00007FF6F81B0000-0x00007FF6F85A1000-memory.dmp	upx
behavioral2/memory/2340-49-0x00007FF6B9E70000-0x00007FF6BA261000-memory.dmp	upx
behavioral2/files/0x00070000000235a7-52.dat	upx
behavioral2/files/0x00070000000235a8-80.dat	upx
behavioral2/files/0x00070000000235ac-84.dat	upx
behavioral2/files/0x00070000000235ad-90.dat	upx
behavioral2/files/0x00070000000235ae-93.dat	upx
behavioral2/files/0x00070000000235aa-88.dat	upx
behavioral2/files/0x00070000000235af-103.dat	upx
behavioral2/files/0x00070000000235b6-138.dat	upx
behavioral2/files/0x00070000000235ba-152.dat	upx
behavioral2/files/0x00070000000235bd-167.dat	upx
behavioral2/files/0x00070000000235be-171.dat	upx
behavioral2/memory/1184-330-0x00007FF6E54B0000-0x00007FF6E58A1000-memory.dmp	upx
behavioral2/memory/2036-352-0x00007FF6CC9E0000-0x00007FF6CCDD1000-memory.dmp	upx
behavioral2/memory/2120-354-0x00007FF617010000-0x00007FF617401000-memory.dmp	upx
behavioral2/memory/2644-355-0x00007FF6610B0000-0x00007FF6614A1000-memory.dmp	upx
behavioral2/memory/3192-359-0x00007FF7E3360000-0x00007FF7E3751000-memory.dmp	upx
behavioral2/memory/848-377-0x00007FF687230000-0x00007FF687621000-memory.dmp	upx
behavioral2/memory/3896-390-0x00007FF6E63F0000-0x00007FF6E67E1000-memory.dmp	upx
behavioral2/memory/4816-399-0x00007FF70F340000-0x00007FF70F731000-memory.dmp	upx
behavioral2/memory/4512-424-0x00007FF673A60000-0x00007FF673E51000-memory.dmp	upx
behavioral2/memory/3728-431-0x00007FF6797C0000-0x00007FF679BB1000-memory.dmp	upx
behavioral2/memory/928-443-0x00007FF7BFC50000-0x00007FF7C0041000-memory.dmp	upx
behavioral2/memory/2104-410-0x00007FF6BAF20000-0x00007FF6BB311000-memory.dmp	upx
behavioral2/memory/4892-384-0x00007FF6F82F0000-0x00007FF6F86E1000-memory.dmp	upx
behavioral2/memory/4996-373-0x00007FF61FDD0000-0x00007FF6201C1000-memory.dmp	upx
behavioral2/memory/2044-340-0x00007FF6036E0000-0x00007FF603AD1000-memory.dmp	upx
behavioral2/files/0x00070000000235bc-166.dat	upx
behavioral2/files/0x00070000000235bb-163.dat	upx
behavioral2/files/0x00070000000235b9-151.dat	upx
behavioral2/files/0x00070000000235b8-148.dat	upx
behavioral2/files/0x00070000000235b7-143.dat	upx
behavioral2/files/0x00070000000235b5-133.dat	upx
behavioral2/files/0x00070000000235b4-128.dat	upx
behavioral2/files/0x00070000000235b3-123.dat	upx
behavioral2/files/0x00070000000235b2-118.dat	upx
behavioral2/files/0x00070000000235b1-113.dat	upx
behavioral2/files/0x00070000000235b0-108.dat	upx
behavioral2/files/0x00070000000235a9-86.dat	upx
behavioral2/files/0x00070000000235ab-82.dat	upx
behavioral2/files/0x00070000000235a5-56.dat	upx
behavioral2/files/0x00070000000235a6-55.dat	upx
behavioral2/memory/316-54-0x00007FF61BCE0000-0x00007FF61C0D1000-memory.dmp	upx
behavioral2/memory/1360-51-0x00007FF631260000-0x00007FF631651000-memory.dmp	upx
behavioral2/memory/2196-44-0x00007FF7362E0000-0x00007FF7366D1000-memory.dmp	upx
behavioral2/memory/4244-42-0x00007FF6B0900000-0x00007FF6B0CF1000-memory.dmp	upx
behavioral2/memory/380-41-0x00007FF7619B0000-0x00007FF761DA1000-memory.dmp	upx
behavioral2/files/0x00070000000235a4-39.dat	upx
behavioral2/files/0x00080000000235a0-34.dat	upx
behavioral2/files/0x00070000000235a2-32.dat	upx
behavioral2/files/0x00070000000235a3-31.dat	upx
behavioral2/memory/1556-17-0x00007FF7C94C0000-0x00007FF7C98B1000-memory.dmp	upx
behavioral2/memory/4136-1990-0x00007FF7F85A0000-0x00007FF7F8991000-memory.dmp	upx
behavioral2/memory/380-1991-0x00007FF7619B0000-0x00007FF761DA1000-memory.dmp	upx
behavioral2/memory/4244-1992-0x00007FF6B0900000-0x00007FF6B0CF1000-memory.dmp	upx
behavioral2/memory/2340-1993-0x00007FF6B9E70000-0x00007FF6BA261000-memory.dmp	upx
behavioral2/memory/316-2026-0x00007FF61BCE0000-0x00007FF61C0D1000-memory.dmp	upx
behavioral2/memory/1184-2027-0x00007FF6E54B0000-0x00007FF6E58A1000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\HmGcSIU.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\DpvmMxE.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\XwtlFJN.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\yxtMdaK.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\jCfHupd.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\qrKpAMo.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\pmYZXrr.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\hJjlqSo.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\sihGGNZ.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\fVxwqLe.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\WhxcvWD.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\cXLgupy.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\hZTHhcZ.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\nlpLseI.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\fdgWjgv.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\KdJFjPa.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\LSHUeCP.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\BUvlsyr.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\nyVcNSO.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\USUCLoY.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\gTBPrnv.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\gbAIFhz.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\DBrprvi.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\unisLJD.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\ttHtWHO.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\tOpiguU.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\ENyFLHJ.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\yqQhpsG.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\myKhNST.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\zyfVMUa.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\NduWiuM.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\CyOOLDh.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\ELJSozF.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\EuelWif.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\lvldWgs.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\UYOhYZx.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\EhZmNXD.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\nBkBBYT.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\SxHfmVA.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\RcaeJqG.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\wHCibin.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\CHXlOvl.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\QVTfjta.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\SZsqQSD.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\iZXsztQ.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\wUwDFKJ.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\BnKfjln.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\pOHXbRz.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\QkLGTha.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\CbQXTKZ.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\guepwAK.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\zZZxjcb.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\WYQUlZn.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\gVHzoGl.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\RYaCJDI.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\VTdNEfs.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\jkfsmfD.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\ZdCRMdf.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\yfuXESv.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\GQBQVkS.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\FtSuFSX.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\gWlDAZe.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\QMDYtud.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
File created	C:\Windows\System32\aPPRRjY.exe	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 1556	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	83
PID 4136 wrote to memory of 1556	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	83
PID 4136 wrote to memory of 2908	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	84
PID 4136 wrote to memory of 2908	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	84
PID 4136 wrote to memory of 4244	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	85
PID 4136 wrote to memory of 4244	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	85
PID 4136 wrote to memory of 1360	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	86
PID 4136 wrote to memory of 1360	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	86
PID 4136 wrote to memory of 380	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	87
PID 4136 wrote to memory of 380	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	87
PID 4136 wrote to memory of 2196	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	88
PID 4136 wrote to memory of 2196	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	88
PID 4136 wrote to memory of 1280	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	89
PID 4136 wrote to memory of 1280	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	89
PID 4136 wrote to memory of 316	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	90
PID 4136 wrote to memory of 316	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	90
PID 4136 wrote to memory of 2340	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	91
PID 4136 wrote to memory of 2340	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	91
PID 4136 wrote to memory of 1184	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	92
PID 4136 wrote to memory of 1184	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	92
PID 4136 wrote to memory of 928	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	93
PID 4136 wrote to memory of 928	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	93
PID 4136 wrote to memory of 2044	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	94
PID 4136 wrote to memory of 2044	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	94
PID 4136 wrote to memory of 2036	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	95
PID 4136 wrote to memory of 2036	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	95
PID 4136 wrote to memory of 2120	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	96
PID 4136 wrote to memory of 2120	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	96
PID 4136 wrote to memory of 2644	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	97
PID 4136 wrote to memory of 2644	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	97
PID 4136 wrote to memory of 3192	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	98
PID 4136 wrote to memory of 3192	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	98
PID 4136 wrote to memory of 4996	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	99
PID 4136 wrote to memory of 4996	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	99
PID 4136 wrote to memory of 848	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	100
PID 4136 wrote to memory of 848	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	100
PID 4136 wrote to memory of 4892	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	101
PID 4136 wrote to memory of 4892	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	101
PID 4136 wrote to memory of 3896	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	102
PID 4136 wrote to memory of 3896	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	102
PID 4136 wrote to memory of 4816	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	103
PID 4136 wrote to memory of 4816	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	103
PID 4136 wrote to memory of 2104	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	104
PID 4136 wrote to memory of 2104	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	104
PID 4136 wrote to memory of 4512	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	105
PID 4136 wrote to memory of 4512	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	105
PID 4136 wrote to memory of 3728	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	106
PID 4136 wrote to memory of 3728	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	106
PID 4136 wrote to memory of 2708	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	107
PID 4136 wrote to memory of 2708	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	107
PID 4136 wrote to memory of 2724	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	108
PID 4136 wrote to memory of 2724	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	108
PID 4136 wrote to memory of 372	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	109
PID 4136 wrote to memory of 372	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	109
PID 4136 wrote to memory of 2424	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	110
PID 4136 wrote to memory of 2424	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	110
PID 4136 wrote to memory of 456	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	111
PID 4136 wrote to memory of 456	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	111
PID 4136 wrote to memory of 2992	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	112
PID 4136 wrote to memory of 2992	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	112
PID 4136 wrote to memory of 2880	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	113
PID 4136 wrote to memory of 2880	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	113
PID 4136 wrote to memory of 3600	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	114
PID 4136 wrote to memory of 3600	4136	02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe	114

C:\Users\Admin\AppData\Local\Temp\02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02d59a875e88a8cdf99f497eb384afcb_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\System32\VTdNEfs.exe
  C:\Windows\System32\VTdNEfs.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System32\wPWTCvW.exe
  C:\Windows\System32\wPWTCvW.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System32\WpQxJTS.exe
  C:\Windows\System32\WpQxJTS.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System32\jCfHupd.exe
  C:\Windows\System32\jCfHupd.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System32\FrPyePC.exe
  C:\Windows\System32\FrPyePC.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System32\RZVsAGQ.exe
  C:\Windows\System32\RZVsAGQ.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System32\OEweDiG.exe
  C:\Windows\System32\OEweDiG.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System32\yGwCsuj.exe
  C:\Windows\System32\yGwCsuj.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System32\brtjVDt.exe
  C:\Windows\System32\brtjVDt.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System32\FfwehrQ.exe
  C:\Windows\System32\FfwehrQ.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System32\KfUYhsg.exe
  C:\Windows\System32\KfUYhsg.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System32\laEedcW.exe
  C:\Windows\System32\laEedcW.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System32\egKTUrc.exe
  C:\Windows\System32\egKTUrc.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System32\CfKEmEO.exe
  C:\Windows\System32\CfKEmEO.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System32\ONdspyX.exe
  C:\Windows\System32\ONdspyX.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System32\xfsylXa.exe
  C:\Windows\System32\xfsylXa.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System32\FjdWHEA.exe
  C:\Windows\System32\FjdWHEA.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System32\nBkBBYT.exe
  C:\Windows\System32\nBkBBYT.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System32\qfNcYjI.exe
  C:\Windows\System32\qfNcYjI.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System32\JrFstkd.exe
  C:\Windows\System32\JrFstkd.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System32\eilCapc.exe
  C:\Windows\System32\eilCapc.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System32\zezEiWI.exe
  C:\Windows\System32\zezEiWI.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System32\heMJLTG.exe
  C:\Windows\System32\heMJLTG.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System32\OYSRsFY.exe
  C:\Windows\System32\OYSRsFY.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System32\tezAZxV.exe
  C:\Windows\System32\tezAZxV.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System32\xyGGFHT.exe
  C:\Windows\System32\xyGGFHT.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System32\bWVQGGX.exe
  C:\Windows\System32\bWVQGGX.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System32\TUaaekR.exe
  C:\Windows\System32\TUaaekR.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System32\AnpjUVq.exe
  C:\Windows\System32\AnpjUVq.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System32\NprglCj.exe
  C:\Windows\System32\NprglCj.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System32\VIYNFHE.exe
  C:\Windows\System32\VIYNFHE.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System32\qrKpAMo.exe
  C:\Windows\System32\qrKpAMo.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System32\NghffDi.exe
  C:\Windows\System32\NghffDi.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System32\KdJFjPa.exe
  C:\Windows\System32\KdJFjPa.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System32\dqHVREf.exe
  C:\Windows\System32\dqHVREf.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System32\yoaHEUF.exe
  C:\Windows\System32\yoaHEUF.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System32\nDefUFn.exe
  C:\Windows\System32\nDefUFn.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System32\ELJSozF.exe
  C:\Windows\System32\ELJSozF.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System32\YyRdWtE.exe
  C:\Windows\System32\YyRdWtE.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System32\joyrZms.exe
  C:\Windows\System32\joyrZms.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System32\sJjzQZd.exe
  C:\Windows\System32\sJjzQZd.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System32\PmxXeOL.exe
  C:\Windows\System32\PmxXeOL.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System32\ENyFLHJ.exe
  C:\Windows\System32\ENyFLHJ.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System32\ogdtyYw.exe
  C:\Windows\System32\ogdtyYw.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System32\ZRuCfLr.exe
  C:\Windows\System32\ZRuCfLr.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System32\WzLGNbV.exe
  C:\Windows\System32\WzLGNbV.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System32\TRyfZfN.exe
  C:\Windows\System32\TRyfZfN.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System32\OruMyqY.exe
  C:\Windows\System32\OruMyqY.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System32\OLqHsbP.exe
  C:\Windows\System32\OLqHsbP.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System32\zqPfxmm.exe
  C:\Windows\System32\zqPfxmm.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System32\UkdBPzx.exe
  C:\Windows\System32\UkdBPzx.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System32\pEyOXeZ.exe
  C:\Windows\System32\pEyOXeZ.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System32\BmceWXz.exe
  C:\Windows\System32\BmceWXz.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System32\fWgEoCB.exe
  C:\Windows\System32\fWgEoCB.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System32\DMSttft.exe
  C:\Windows\System32\DMSttft.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System32\FgQDYcY.exe
  C:\Windows\System32\FgQDYcY.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System32\dzQaAxX.exe
  C:\Windows\System32\dzQaAxX.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System32\DcJfPxQ.exe
  C:\Windows\System32\DcJfPxQ.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System32\dDVFjEq.exe
  C:\Windows\System32\dDVFjEq.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System32\dBnjTrG.exe
  C:\Windows\System32\dBnjTrG.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System32\VbRZapN.exe
  C:\Windows\System32\VbRZapN.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System32\Ciqeuzy.exe
  C:\Windows\System32\Ciqeuzy.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System32\WfdWDLV.exe
  C:\Windows\System32\WfdWDLV.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System32\cSXSYAF.exe
  C:\Windows\System32\cSXSYAF.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System32\fnYHumy.exe
  C:\Windows\System32\fnYHumy.exe
  2⤵
  PID:2520
- C:\Windows\System32\dykpmVU.exe
  C:\Windows\System32\dykpmVU.exe
  2⤵
  PID:2416
- C:\Windows\System32\lhnvPPH.exe
  C:\Windows\System32\lhnvPPH.exe
  2⤵
  PID:3460
- C:\Windows\System32\LHHQIlV.exe
  C:\Windows\System32\LHHQIlV.exe
  2⤵
  PID:3704
- C:\Windows\System32\oVhZXUe.exe
  C:\Windows\System32\oVhZXUe.exe
  2⤵
  PID:4768
- C:\Windows\System32\aGXawff.exe
  C:\Windows\System32\aGXawff.exe
  2⤵
  PID:1092
- C:\Windows\System32\vdbUUVC.exe
  C:\Windows\System32\vdbUUVC.exe
  2⤵
  PID:4032
- C:\Windows\System32\waEdfai.exe
  C:\Windows\System32\waEdfai.exe
  2⤵
  PID:712
- C:\Windows\System32\BGdNQJb.exe
  C:\Windows\System32\BGdNQJb.exe
  2⤵
  PID:2032
- C:\Windows\System32\rxLamAi.exe
  C:\Windows\System32\rxLamAi.exe
  2⤵
  PID:2240
- C:\Windows\System32\tcriwkc.exe
  C:\Windows\System32\tcriwkc.exe
  2⤵
  PID:1072
- C:\Windows\System32\YzxQfoy.exe
  C:\Windows\System32\YzxQfoy.exe
  2⤵
  PID:2844
- C:\Windows\System32\cpTyNOK.exe
  C:\Windows\System32\cpTyNOK.exe
  2⤵
  PID:4680
- C:\Windows\System32\pWguuvp.exe
  C:\Windows\System32\pWguuvp.exe
  2⤵
  PID:2316
- C:\Windows\System32\AKDNIBN.exe
  C:\Windows\System32\AKDNIBN.exe
  2⤵
  PID:2384
- C:\Windows\System32\dViyPBL.exe
  C:\Windows\System32\dViyPBL.exe
  2⤵
  PID:4092
- C:\Windows\System32\uXPDLfI.exe
  C:\Windows\System32\uXPDLfI.exe
  2⤵
  PID:4540
- C:\Windows\System32\pDUKVtO.exe
  C:\Windows\System32\pDUKVtO.exe
  2⤵
  PID:5076
- C:\Windows\System32\NZYnAVj.exe
  C:\Windows\System32\NZYnAVj.exe
  2⤵
  PID:956
- C:\Windows\System32\iZXsztQ.exe
  C:\Windows\System32\iZXsztQ.exe
  2⤵
  PID:3528
- C:\Windows\System32\tiEMyAD.exe
  C:\Windows\System32\tiEMyAD.exe
  2⤵
  PID:4972
- C:\Windows\System32\zHpwMDV.exe
  C:\Windows\System32\zHpwMDV.exe
  2⤵
  PID:1672
- C:\Windows\System32\hinLzCU.exe
  C:\Windows\System32\hinLzCU.exe
  2⤵
  PID:2900
- C:\Windows\System32\pTjXUlc.exe
  C:\Windows\System32\pTjXUlc.exe
  2⤵
  PID:2204
- C:\Windows\System32\DBrprvi.exe
  C:\Windows\System32\DBrprvi.exe
  2⤵
  PID:3948
- C:\Windows\System32\hogeklT.exe
  C:\Windows\System32\hogeklT.exe
  2⤵
  PID:3984
- C:\Windows\System32\VfvhPLM.exe
  C:\Windows\System32\VfvhPLM.exe
  2⤵
  PID:2308
- C:\Windows\System32\SxHfmVA.exe
  C:\Windows\System32\SxHfmVA.exe
  2⤵
  PID:4036
- C:\Windows\System32\wUUMRJh.exe
  C:\Windows\System32\wUUMRJh.exe
  2⤵
  PID:2832
- C:\Windows\System32\dIeFDaM.exe
  C:\Windows\System32\dIeFDaM.exe
  2⤵
  PID:940
- C:\Windows\System32\xodbKSr.exe
  C:\Windows\System32\xodbKSr.exe
  2⤵
  PID:212
- C:\Windows\System32\WPtgmFA.exe
  C:\Windows\System32\WPtgmFA.exe
  2⤵
  PID:516
- C:\Windows\System32\TgZoaAW.exe
  C:\Windows\System32\TgZoaAW.exe
  2⤵
  PID:3928
- C:\Windows\System32\sdMrhKP.exe
  C:\Windows\System32\sdMrhKP.exe
  2⤵
  PID:4420
- C:\Windows\System32\CDbCNaS.exe
  C:\Windows\System32\CDbCNaS.exe
  2⤵
  PID:2400
- C:\Windows\System32\KkzinNW.exe
  C:\Windows\System32\KkzinNW.exe
  2⤵
  PID:3340
- C:\Windows\System32\wEYsoJX.exe
  C:\Windows\System32\wEYsoJX.exe
  2⤵
  PID:2244
- C:\Windows\System32\qEYrZSW.exe
  C:\Windows\System32\qEYrZSW.exe
  2⤵
  PID:2188
- C:\Windows\System32\jkSAaDX.exe
  C:\Windows\System32\jkSAaDX.exe
  2⤵
  PID:468
- C:\Windows\System32\KoIJewi.exe
  C:\Windows\System32\KoIJewi.exe
  2⤵
  PID:1816
- C:\Windows\System32\EuelWif.exe
  C:\Windows\System32\EuelWif.exe
  2⤵
  PID:2100
- C:\Windows\System32\sPvJvaq.exe
  C:\Windows\System32\sPvJvaq.exe
  2⤵
  PID:5124
- C:\Windows\System32\qgoMPLm.exe
  C:\Windows\System32\qgoMPLm.exe
  2⤵
  PID:5140
- C:\Windows\System32\dSNPrij.exe
  C:\Windows\System32\dSNPrij.exe
  2⤵
  PID:5156
- C:\Windows\System32\HHJcyMc.exe
  C:\Windows\System32\HHJcyMc.exe
  2⤵
  PID:5208
- C:\Windows\System32\fYtowpX.exe
  C:\Windows\System32\fYtowpX.exe
  2⤵
  PID:5228
- C:\Windows\System32\dKBtqsc.exe
  C:\Windows\System32\dKBtqsc.exe
  2⤵
  PID:5244
- C:\Windows\System32\xHAaVop.exe
  C:\Windows\System32\xHAaVop.exe
  2⤵
  PID:5272
- C:\Windows\System32\PWFFhvA.exe
  C:\Windows\System32\PWFFhvA.exe
  2⤵
  PID:5296
- C:\Windows\System32\WhxcvWD.exe
  C:\Windows\System32\WhxcvWD.exe
  2⤵
  PID:5316
- C:\Windows\System32\wytHWXC.exe
  C:\Windows\System32\wytHWXC.exe
  2⤵
  PID:5340
- C:\Windows\System32\fOIlhRu.exe
  C:\Windows\System32\fOIlhRu.exe
  2⤵
  PID:5388
- C:\Windows\System32\LSHUeCP.exe
  C:\Windows\System32\LSHUeCP.exe
  2⤵
  PID:5420
- C:\Windows\System32\YHOvCET.exe
  C:\Windows\System32\YHOvCET.exe
  2⤵
  PID:5436
- C:\Windows\System32\ObgXTJm.exe
  C:\Windows\System32\ObgXTJm.exe
  2⤵
  PID:5464
- C:\Windows\System32\ZVjQOWL.exe
  C:\Windows\System32\ZVjQOWL.exe
  2⤵
  PID:5524
- C:\Windows\System32\FQjYpvg.exe
  C:\Windows\System32\FQjYpvg.exe
  2⤵
  PID:5592
- C:\Windows\System32\GBShimo.exe
  C:\Windows\System32\GBShimo.exe
  2⤵
  PID:5648
- C:\Windows\System32\unisLJD.exe
  C:\Windows\System32\unisLJD.exe
  2⤵
  PID:5672
- C:\Windows\System32\yMfNbOc.exe
  C:\Windows\System32\yMfNbOc.exe
  2⤵
  PID:5700
- C:\Windows\System32\RcaeJqG.exe
  C:\Windows\System32\RcaeJqG.exe
  2⤵
  PID:5724
- C:\Windows\System32\YXbTXpT.exe
  C:\Windows\System32\YXbTXpT.exe
  2⤵
  PID:5744
- C:\Windows\System32\jnvaNzm.exe
  C:\Windows\System32\jnvaNzm.exe
  2⤵
  PID:5764
- C:\Windows\System32\URZladx.exe
  C:\Windows\System32\URZladx.exe
  2⤵
  PID:5780
- C:\Windows\System32\JvAKDIe.exe
  C:\Windows\System32\JvAKDIe.exe
  2⤵
  PID:5804
- C:\Windows\System32\onuuWuU.exe
  C:\Windows\System32\onuuWuU.exe
  2⤵
  PID:5820
- C:\Windows\System32\LoBXSLo.exe
  C:\Windows\System32\LoBXSLo.exe
  2⤵
  PID:5868
- C:\Windows\System32\vkJVQTX.exe
  C:\Windows\System32\vkJVQTX.exe
  2⤵
  PID:5916
- C:\Windows\System32\dInIIrT.exe
  C:\Windows\System32\dInIIrT.exe
  2⤵
  PID:5932
- C:\Windows\System32\TobdiHR.exe
  C:\Windows\System32\TobdiHR.exe
  2⤵
  PID:5948
- C:\Windows\System32\AlrMweU.exe
  C:\Windows\System32\AlrMweU.exe
  2⤵
  PID:5988
- C:\Windows\System32\wHCibin.exe
  C:\Windows\System32\wHCibin.exe
  2⤵
  PID:6024
- C:\Windows\System32\uJHHBVp.exe
  C:\Windows\System32\uJHHBVp.exe
  2⤵
  PID:6056
- C:\Windows\System32\icFeokC.exe
  C:\Windows\System32\icFeokC.exe
  2⤵
  PID:6072
- C:\Windows\System32\ryhmMoJ.exe
  C:\Windows\System32\ryhmMoJ.exe
  2⤵
  PID:6092
- C:\Windows\System32\jHrivKd.exe
  C:\Windows\System32\jHrivKd.exe
  2⤵
  PID:6112
- C:\Windows\System32\AcknylF.exe
  C:\Windows\System32\AcknylF.exe
  2⤵
  PID:6128
- C:\Windows\System32\RdQIfjP.exe
  C:\Windows\System32\RdQIfjP.exe
  2⤵
  PID:5188
- C:\Windows\System32\SmqFiem.exe
  C:\Windows\System32\SmqFiem.exe
  2⤵
  PID:5288
- C:\Windows\System32\DRDFiHo.exe
  C:\Windows\System32\DRDFiHo.exe
  2⤵
  PID:5328
- C:\Windows\System32\PiCbpQC.exe
  C:\Windows\System32\PiCbpQC.exe
  2⤵
  PID:5348
- C:\Windows\System32\uIoGpzq.exe
  C:\Windows\System32\uIoGpzq.exe
  2⤵
  PID:5308
- C:\Windows\System32\uQBAseX.exe
  C:\Windows\System32\uQBAseX.exe
  2⤵
  PID:5368
- C:\Windows\System32\LHRaiwS.exe
  C:\Windows\System32\LHRaiwS.exe
  2⤵
  PID:5432
- C:\Windows\System32\jkfsmfD.exe
  C:\Windows\System32\jkfsmfD.exe
  2⤵
  PID:5052
- C:\Windows\System32\IPUKvqJ.exe
  C:\Windows\System32\IPUKvqJ.exe
  2⤵
  PID:5476
- C:\Windows\System32\yqQhpsG.exe
  C:\Windows\System32\yqQhpsG.exe
  2⤵
  PID:5544
- C:\Windows\System32\uUXXnFZ.exe
  C:\Windows\System32\uUXXnFZ.exe
  2⤵
  PID:3420
- C:\Windows\System32\AzhamXW.exe
  C:\Windows\System32\AzhamXW.exe
  2⤵
  PID:5660
- C:\Windows\System32\fzwJLZA.exe
  C:\Windows\System32\fzwJLZA.exe
  2⤵
  PID:5680
- C:\Windows\System32\pmYZXrr.exe
  C:\Windows\System32\pmYZXrr.exe
  2⤵
  PID:5716
- C:\Windows\System32\BVqxNLV.exe
  C:\Windows\System32\BVqxNLV.exe
  2⤵
  PID:5792
- C:\Windows\System32\FaKYWUY.exe
  C:\Windows\System32\FaKYWUY.exe
  2⤵
  PID:5832
- C:\Windows\System32\UKiiTHp.exe
  C:\Windows\System32\UKiiTHp.exe
  2⤵
  PID:6000
- C:\Windows\System32\rcUatiK.exe
  C:\Windows\System32\rcUatiK.exe
  2⤵
  PID:6064
- C:\Windows\System32\RlmoLql.exe
  C:\Windows\System32\RlmoLql.exe
  2⤵
  PID:5256
- C:\Windows\System32\pIBNcqA.exe
  C:\Windows\System32\pIBNcqA.exe
  2⤵
  PID:5400
- C:\Windows\System32\YPHAbtR.exe
  C:\Windows\System32\YPHAbtR.exe
  2⤵
  PID:4184
- C:\Windows\System32\gWHuRXe.exe
  C:\Windows\System32\gWHuRXe.exe
  2⤵
  PID:5776
- C:\Windows\System32\CFBVQjK.exe
  C:\Windows\System32\CFBVQjK.exe
  2⤵
  PID:5688
- C:\Windows\System32\siNUZAB.exe
  C:\Windows\System32\siNUZAB.exe
  2⤵
  PID:5708
- C:\Windows\System32\TtANoyR.exe
  C:\Windows\System32\TtANoyR.exe
  2⤵
  PID:3796
- C:\Windows\System32\GKgnBOR.exe
  C:\Windows\System32\GKgnBOR.exe
  2⤵
  PID:548
- C:\Windows\System32\LnAyIFl.exe
  C:\Windows\System32\LnAyIFl.exe
  2⤵
  PID:4288
- C:\Windows\System32\HmGcSIU.exe
  C:\Windows\System32\HmGcSIU.exe
  2⤵
  PID:3248
- C:\Windows\System32\GNpJZyu.exe
  C:\Windows\System32\GNpJZyu.exe
  2⤵
  PID:5500
- C:\Windows\System32\jRiaqGD.exe
  C:\Windows\System32\jRiaqGD.exe
  2⤵
  PID:5736
- C:\Windows\System32\CBWWGzu.exe
  C:\Windows\System32\CBWWGzu.exe
  2⤵
  PID:5896
- C:\Windows\System32\cXLgupy.exe
  C:\Windows\System32\cXLgupy.exe
  2⤵
  PID:5812
- C:\Windows\System32\lULewxw.exe
  C:\Windows\System32\lULewxw.exe
  2⤵
  PID:6152
- C:\Windows\System32\HiURhOL.exe
  C:\Windows\System32\HiURhOL.exe
  2⤵
  PID:6168
- C:\Windows\System32\mWUGjKk.exe
  C:\Windows\System32\mWUGjKk.exe
  2⤵
  PID:6212
- C:\Windows\System32\gFAlMJw.exe
  C:\Windows\System32\gFAlMJw.exe
  2⤵
  PID:6232
- C:\Windows\System32\cOdvtRZ.exe
  C:\Windows\System32\cOdvtRZ.exe
  2⤵
  PID:6268
- C:\Windows\System32\erwQYOJ.exe
  C:\Windows\System32\erwQYOJ.exe
  2⤵
  PID:6300
- C:\Windows\System32\EkvNKcG.exe
  C:\Windows\System32\EkvNKcG.exe
  2⤵
  PID:6332
- C:\Windows\System32\YHweacT.exe
  C:\Windows\System32\YHweacT.exe
  2⤵
  PID:6348
- C:\Windows\System32\oLCbnvR.exe
  C:\Windows\System32\oLCbnvR.exe
  2⤵
  PID:6380
- C:\Windows\System32\ZdCRMdf.exe
  C:\Windows\System32\ZdCRMdf.exe
  2⤵
  PID:6400
- C:\Windows\System32\wyJfrTm.exe
  C:\Windows\System32\wyJfrTm.exe
  2⤵
  PID:6420
- C:\Windows\System32\koDCnOk.exe
  C:\Windows\System32\koDCnOk.exe
  2⤵
  PID:6436
- C:\Windows\System32\DbfJdbF.exe
  C:\Windows\System32\DbfJdbF.exe
  2⤵
  PID:6460
- C:\Windows\System32\BUvlsyr.exe
  C:\Windows\System32\BUvlsyr.exe
  2⤵
  PID:6500
- C:\Windows\System32\jGcfYrh.exe
  C:\Windows\System32\jGcfYrh.exe
  2⤵
  PID:6548
- C:\Windows\System32\wzJtoTE.exe
  C:\Windows\System32\wzJtoTE.exe
  2⤵
  PID:6564
- C:\Windows\System32\ijSEapD.exe
  C:\Windows\System32\ijSEapD.exe
  2⤵
  PID:6604
- C:\Windows\System32\ICOIOoz.exe
  C:\Windows\System32\ICOIOoz.exe
  2⤵
  PID:6628
- C:\Windows\System32\pOHXbRz.exe
  C:\Windows\System32\pOHXbRz.exe
  2⤵
  PID:6644
- C:\Windows\System32\njVhlea.exe
  C:\Windows\System32\njVhlea.exe
  2⤵
  PID:6688
- C:\Windows\System32\dZSSfDF.exe
  C:\Windows\System32\dZSSfDF.exe
  2⤵
  PID:6716
- C:\Windows\System32\yfuXESv.exe
  C:\Windows\System32\yfuXESv.exe
  2⤵
  PID:6732
- C:\Windows\System32\fsfHqGh.exe
  C:\Windows\System32\fsfHqGh.exe
  2⤵
  PID:6752
- C:\Windows\System32\cKDBBPt.exe
  C:\Windows\System32\cKDBBPt.exe
  2⤵
  PID:6772
- C:\Windows\System32\ttHtWHO.exe
  C:\Windows\System32\ttHtWHO.exe
  2⤵
  PID:6788
- C:\Windows\System32\hZTHhcZ.exe
  C:\Windows\System32\hZTHhcZ.exe
  2⤵
  PID:6804
- C:\Windows\System32\KLcyCFw.exe
  C:\Windows\System32\KLcyCFw.exe
  2⤵
  PID:6844
- C:\Windows\System32\jflicWh.exe
  C:\Windows\System32\jflicWh.exe
  2⤵
  PID:6872
- C:\Windows\System32\MNaHmvu.exe
  C:\Windows\System32\MNaHmvu.exe
  2⤵
  PID:6888
- C:\Windows\System32\CduJDzg.exe
  C:\Windows\System32\CduJDzg.exe
  2⤵
  PID:6904
- C:\Windows\System32\ibjZlFS.exe
  C:\Windows\System32\ibjZlFS.exe
  2⤵
  PID:6928
- C:\Windows\System32\yEXTIIG.exe
  C:\Windows\System32\yEXTIIG.exe
  2⤵
  PID:6944
- C:\Windows\System32\BjlKfBY.exe
  C:\Windows\System32\BjlKfBY.exe
  2⤵
  PID:6976
- C:\Windows\System32\cmzTOtb.exe
  C:\Windows\System32\cmzTOtb.exe
  2⤵
  PID:7008
- C:\Windows\System32\bqLTlMv.exe
  C:\Windows\System32\bqLTlMv.exe
  2⤵
  PID:7084
- C:\Windows\System32\BlTdJCA.exe
  C:\Windows\System32\BlTdJCA.exe
  2⤵
  PID:7156
- C:\Windows\System32\ERakdDL.exe
  C:\Windows\System32\ERakdDL.exe
  2⤵
  PID:404
- C:\Windows\System32\tuyApzI.exe
  C:\Windows\System32\tuyApzI.exe
  2⤵
  PID:6184
- C:\Windows\System32\NYxQAtQ.exe
  C:\Windows\System32\NYxQAtQ.exe
  2⤵
  PID:3360
- C:\Windows\System32\OAQXKdY.exe
  C:\Windows\System32\OAQXKdY.exe
  2⤵
  PID:6224
- C:\Windows\System32\IXcYNmQ.exe
  C:\Windows\System32\IXcYNmQ.exe
  2⤵
  PID:6368
- C:\Windows\System32\nyVcNSO.exe
  C:\Windows\System32\nyVcNSO.exe
  2⤵
  PID:6396
- C:\Windows\System32\mvHyCYm.exe
  C:\Windows\System32\mvHyCYm.exe
  2⤵
  PID:6544
- C:\Windows\System32\lpDxcdN.exe
  C:\Windows\System32\lpDxcdN.exe
  2⤵
  PID:6612
- C:\Windows\System32\rAoaKeR.exe
  C:\Windows\System32\rAoaKeR.exe
  2⤵
  PID:6664
- C:\Windows\System32\rCMIcgn.exe
  C:\Windows\System32\rCMIcgn.exe
  2⤵
  PID:6800
- C:\Windows\System32\UJNTJKO.exe
  C:\Windows\System32\UJNTJKO.exe
  2⤵
  PID:6780
- C:\Windows\System32\xNIiDSJ.exe
  C:\Windows\System32\xNIiDSJ.exe
  2⤵
  PID:6936
- C:\Windows\System32\UwbXNxV.exe
  C:\Windows\System32\UwbXNxV.exe
  2⤵
  PID:6912
- C:\Windows\System32\QaXanUU.exe
  C:\Windows\System32\QaXanUU.exe
  2⤵
  PID:6920
- C:\Windows\System32\NFzLRTb.exe
  C:\Windows\System32\NFzLRTb.exe
  2⤵
  PID:7056
- C:\Windows\System32\QkLGTha.exe
  C:\Windows\System32\QkLGTha.exe
  2⤵
  PID:7140
- C:\Windows\System32\KOiLlIg.exe
  C:\Windows\System32\KOiLlIg.exe
  2⤵
  PID:4928
- C:\Windows\System32\lvldWgs.exe
  C:\Windows\System32\lvldWgs.exe
  2⤵
  PID:7164
- C:\Windows\System32\btMdIvV.exe
  C:\Windows\System32\btMdIvV.exe
  2⤵
  PID:6180
- C:\Windows\System32\XTFzCQj.exe
  C:\Windows\System32\XTFzCQj.exe
  2⤵
  PID:6432
- C:\Windows\System32\ZWRjVvs.exe
  C:\Windows\System32\ZWRjVvs.exe
  2⤵
  PID:6488
- C:\Windows\System32\NYgbJDu.exe
  C:\Windows\System32\NYgbJDu.exe
  2⤵
  PID:6636
- C:\Windows\System32\uDbFZmd.exe
  C:\Windows\System32\uDbFZmd.exe
  2⤵
  PID:3252
- C:\Windows\System32\HCLPkAo.exe
  C:\Windows\System32\HCLPkAo.exe
  2⤵
  PID:7128
- C:\Windows\System32\LwGAftP.exe
  C:\Windows\System32\LwGAftP.exe
  2⤵
  PID:6452
- C:\Windows\System32\dTWiyaq.exe
  C:\Windows\System32\dTWiyaq.exe
  2⤵
  PID:4280
- C:\Windows\System32\nOEJMxr.exe
  C:\Windows\System32\nOEJMxr.exe
  2⤵
  PID:6868
- C:\Windows\System32\wUwDFKJ.exe
  C:\Windows\System32\wUwDFKJ.exe
  2⤵
  PID:4552
- C:\Windows\System32\rcPlXed.exe
  C:\Windows\System32\rcPlXed.exe
  2⤵
  PID:7176
- C:\Windows\System32\VeVUGRh.exe
  C:\Windows\System32\VeVUGRh.exe
  2⤵
  PID:7192
- C:\Windows\System32\VyEpqDX.exe
  C:\Windows\System32\VyEpqDX.exe
  2⤵
  PID:7220
- C:\Windows\System32\NUFEpkP.exe
  C:\Windows\System32\NUFEpkP.exe
  2⤵
  PID:7236
- C:\Windows\System32\jZtdHDl.exe
  C:\Windows\System32\jZtdHDl.exe
  2⤵
  PID:7292
- C:\Windows\System32\aNnHfdZ.exe
  C:\Windows\System32\aNnHfdZ.exe
  2⤵
  PID:7324
- C:\Windows\System32\NJblkqN.exe
  C:\Windows\System32\NJblkqN.exe
  2⤵
  PID:7352
- C:\Windows\System32\DtBCiux.exe
  C:\Windows\System32\DtBCiux.exe
  2⤵
  PID:7372
- C:\Windows\System32\VDGDGAG.exe
  C:\Windows\System32\VDGDGAG.exe
  2⤵
  PID:7388
- C:\Windows\System32\kCGxzbH.exe
  C:\Windows\System32\kCGxzbH.exe
  2⤵
  PID:7412
- C:\Windows\System32\hqutNYm.exe
  C:\Windows\System32\hqutNYm.exe
  2⤵
  PID:7428
- C:\Windows\System32\gTNoUqv.exe
  C:\Windows\System32\gTNoUqv.exe
  2⤵
  PID:7448
- C:\Windows\System32\fvSsAno.exe
  C:\Windows\System32\fvSsAno.exe
  2⤵
  PID:7468
- C:\Windows\System32\ajmBpiz.exe
  C:\Windows\System32\ajmBpiz.exe
  2⤵
  PID:7508
- C:\Windows\System32\UYOhYZx.exe
  C:\Windows\System32\UYOhYZx.exe
  2⤵
  PID:7528
- C:\Windows\System32\QEMHLTb.exe
  C:\Windows\System32\QEMHLTb.exe
  2⤵
  PID:7576
- C:\Windows\System32\EHWDQPm.exe
  C:\Windows\System32\EHWDQPm.exe
  2⤵
  PID:7592
- C:\Windows\System32\htiKcbu.exe
  C:\Windows\System32\htiKcbu.exe
  2⤵
  PID:7608
- C:\Windows\System32\dZPsZGG.exe
  C:\Windows\System32\dZPsZGG.exe
  2⤵
  PID:7632
- C:\Windows\System32\CHXlOvl.exe
  C:\Windows\System32\CHXlOvl.exe
  2⤵
  PID:7648
- C:\Windows\System32\EluRbEy.exe
  C:\Windows\System32\EluRbEy.exe
  2⤵
  PID:7668
- C:\Windows\System32\kdqNvtk.exe
  C:\Windows\System32\kdqNvtk.exe
  2⤵
  PID:7724
- C:\Windows\System32\EonxOLK.exe
  C:\Windows\System32\EonxOLK.exe
  2⤵
  PID:7776
- C:\Windows\System32\hJjlqSo.exe
  C:\Windows\System32\hJjlqSo.exe
  2⤵
  PID:7808
- C:\Windows\System32\rNBltGj.exe
  C:\Windows\System32\rNBltGj.exe
  2⤵
  PID:7876
- C:\Windows\System32\GQBQVkS.exe
  C:\Windows\System32\GQBQVkS.exe
  2⤵
  PID:7896
- C:\Windows\System32\ysJZagX.exe
  C:\Windows\System32\ysJZagX.exe
  2⤵
  PID:7920
- C:\Windows\System32\JcluNlN.exe
  C:\Windows\System32\JcluNlN.exe
  2⤵
  PID:7936
- C:\Windows\System32\bbnYEXM.exe
  C:\Windows\System32\bbnYEXM.exe
  2⤵
  PID:7964
- C:\Windows\System32\szuvPaz.exe
  C:\Windows\System32\szuvPaz.exe
  2⤵
  PID:7980
- C:\Windows\System32\BTnptqL.exe
  C:\Windows\System32\BTnptqL.exe
  2⤵
  PID:8004
- C:\Windows\System32\myKhNST.exe
  C:\Windows\System32\myKhNST.exe
  2⤵
  PID:8040
- C:\Windows\System32\gpDhxlY.exe
  C:\Windows\System32\gpDhxlY.exe
  2⤵
  PID:8056
- C:\Windows\System32\aCQZcqS.exe
  C:\Windows\System32\aCQZcqS.exe
  2⤵
  PID:8084
- C:\Windows\System32\BhyfTmL.exe
  C:\Windows\System32\BhyfTmL.exe
  2⤵
  PID:8100
- C:\Windows\System32\CbQXTKZ.exe
  C:\Windows\System32\CbQXTKZ.exe
  2⤵
  PID:8116
- C:\Windows\System32\dNjlWMx.exe
  C:\Windows\System32\dNjlWMx.exe
  2⤵
  PID:8136
- C:\Windows\System32\CkqHhYv.exe
  C:\Windows\System32\CkqHhYv.exe
  2⤵
  PID:8160
- C:\Windows\System32\apGyPDs.exe
  C:\Windows\System32\apGyPDs.exe
  2⤵
  PID:8180
- C:\Windows\System32\saswmXm.exe
  C:\Windows\System32\saswmXm.exe
  2⤵
  PID:7204
- C:\Windows\System32\hOpWBMO.exe
  C:\Windows\System32\hOpWBMO.exe
  2⤵
  PID:5444
- C:\Windows\System32\AdDfHTd.exe
  C:\Windows\System32\AdDfHTd.exe
  2⤵
  PID:7340
- C:\Windows\System32\YzWTCbV.exe
  C:\Windows\System32\YzWTCbV.exe
  2⤵
  PID:7380
- C:\Windows\System32\HjzIAFc.exe
  C:\Windows\System32\HjzIAFc.exe
  2⤵
  PID:5372
- C:\Windows\System32\xHcSpyc.exe
  C:\Windows\System32\xHcSpyc.exe
  2⤵
  PID:7604
- C:\Windows\System32\PkXxdYH.exe
  C:\Windows\System32\PkXxdYH.exe
  2⤵
  PID:7584
- C:\Windows\System32\rdyeMgy.exe
  C:\Windows\System32\rdyeMgy.exe
  2⤵
  PID:7736
- C:\Windows\System32\LPcbtZb.exe
  C:\Windows\System32\LPcbtZb.exe
  2⤵
  PID:7792
- C:\Windows\System32\cueqmFv.exe
  C:\Windows\System32\cueqmFv.exe
  2⤵
  PID:7840
- C:\Windows\System32\pFUuiUV.exe
  C:\Windows\System32\pFUuiUV.exe
  2⤵
  PID:7916
- C:\Windows\System32\kuvpDDq.exe
  C:\Windows\System32\kuvpDDq.exe
  2⤵
  PID:7932
- C:\Windows\System32\SvqVFvO.exe
  C:\Windows\System32\SvqVFvO.exe
  2⤵
  PID:7992
- C:\Windows\System32\aOTUwGU.exe
  C:\Windows\System32\aOTUwGU.exe
  2⤵
  PID:8092
- C:\Windows\System32\QxriGIv.exe
  C:\Windows\System32\QxriGIv.exe
  2⤵
  PID:8176
- C:\Windows\System32\HhomldL.exe
  C:\Windows\System32\HhomldL.exe
  2⤵
  PID:7268
- C:\Windows\System32\XAQwkLH.exe
  C:\Windows\System32\XAQwkLH.exe
  2⤵
  PID:7344
- C:\Windows\System32\WuXFtWO.exe
  C:\Windows\System32\WuXFtWO.exe
  2⤵
  PID:7456
- C:\Windows\System32\UtswIae.exe
  C:\Windows\System32\UtswIae.exe
  2⤵
  PID:7504
- C:\Windows\System32\UFGbDLy.exe
  C:\Windows\System32\UFGbDLy.exe
  2⤵
  PID:5164
- C:\Windows\System32\KxRHsef.exe
  C:\Windows\System32\KxRHsef.exe
  2⤵
  PID:7804
- C:\Windows\System32\qVxWBcB.exe
  C:\Windows\System32\qVxWBcB.exe
  2⤵
  PID:8152
- C:\Windows\System32\SsSJucy.exe
  C:\Windows\System32\SsSJucy.exe
  2⤵
  PID:8112
- C:\Windows\System32\JgnpXAT.exe
  C:\Windows\System32\JgnpXAT.exe
  2⤵
  PID:7520
- C:\Windows\System32\RuBZEKJ.exe
  C:\Windows\System32\RuBZEKJ.exe
  2⤵
  PID:8128
- C:\Windows\System32\lcLsgIo.exe
  C:\Windows\System32\lcLsgIo.exe
  2⤵
  PID:8072
- C:\Windows\System32\vazpRuq.exe
  C:\Windows\System32\vazpRuq.exe
  2⤵
  PID:8220
- C:\Windows\System32\DHyDxkA.exe
  C:\Windows\System32\DHyDxkA.exe
  2⤵
  PID:8256
- C:\Windows\System32\zyfVMUa.exe
  C:\Windows\System32\zyfVMUa.exe
  2⤵
  PID:8296
- C:\Windows\System32\JFYJhaG.exe
  C:\Windows\System32\JFYJhaG.exe
  2⤵
  PID:8320
- C:\Windows\System32\AJcFlYy.exe
  C:\Windows\System32\AJcFlYy.exe
  2⤵
  PID:8340
- C:\Windows\System32\DFlWBJb.exe
  C:\Windows\System32\DFlWBJb.exe
  2⤵
  PID:8356
- C:\Windows\System32\XNFlKIw.exe
  C:\Windows\System32\XNFlKIw.exe
  2⤵
  PID:8384
- C:\Windows\System32\BaMwnbF.exe
  C:\Windows\System32\BaMwnbF.exe
  2⤵
  PID:8400
- C:\Windows\System32\PkTckyi.exe
  C:\Windows\System32\PkTckyi.exe
  2⤵
  PID:8424
- C:\Windows\System32\TbiWOdA.exe
  C:\Windows\System32\TbiWOdA.exe
  2⤵
  PID:8492
- C:\Windows\System32\HDrPnAp.exe
  C:\Windows\System32\HDrPnAp.exe
  2⤵
  PID:8524
- C:\Windows\System32\ExRNzbv.exe
  C:\Windows\System32\ExRNzbv.exe
  2⤵
  PID:8544
- C:\Windows\System32\BMJoCRs.exe
  C:\Windows\System32\BMJoCRs.exe
  2⤵
  PID:8580
- C:\Windows\System32\ldagqpc.exe
  C:\Windows\System32\ldagqpc.exe
  2⤵
  PID:8604
- C:\Windows\System32\jiGzfDX.exe
  C:\Windows\System32\jiGzfDX.exe
  2⤵
  PID:8628
- C:\Windows\System32\mOvZnGV.exe
  C:\Windows\System32\mOvZnGV.exe
  2⤵
  PID:8664
- C:\Windows\System32\fPUUpYd.exe
  C:\Windows\System32\fPUUpYd.exe
  2⤵
  PID:8692
- C:\Windows\System32\HVOfHVJ.exe
  C:\Windows\System32\HVOfHVJ.exe
  2⤵
  PID:8712
- C:\Windows\System32\oemmJJc.exe
  C:\Windows\System32\oemmJJc.exe
  2⤵
  PID:8748
- C:\Windows\System32\FGZKPYJ.exe
  C:\Windows\System32\FGZKPYJ.exe
  2⤵
  PID:8784
- C:\Windows\System32\MgtdhLp.exe
  C:\Windows\System32\MgtdhLp.exe
  2⤵
  PID:8808
- C:\Windows\System32\tMMgAhC.exe
  C:\Windows\System32\tMMgAhC.exe
  2⤵
  PID:8832
- C:\Windows\System32\YFdDTVM.exe
  C:\Windows\System32\YFdDTVM.exe
  2⤵
  PID:8852
- C:\Windows\System32\gxQapuC.exe
  C:\Windows\System32\gxQapuC.exe
  2⤵
  PID:8876
- C:\Windows\System32\frNhGyC.exe
  C:\Windows\System32\frNhGyC.exe
  2⤵
  PID:8892
- C:\Windows\System32\YypWRfP.exe
  C:\Windows\System32\YypWRfP.exe
  2⤵
  PID:8928
- C:\Windows\System32\nlpLseI.exe
  C:\Windows\System32\nlpLseI.exe
  2⤵
  PID:8956
- C:\Windows\System32\pvaffaX.exe
  C:\Windows\System32\pvaffaX.exe
  2⤵
  PID:8988
- C:\Windows\System32\QeaLbxA.exe
  C:\Windows\System32\QeaLbxA.exe
  2⤵
  PID:9100
- C:\Windows\System32\xGBtYcz.exe
  C:\Windows\System32\xGBtYcz.exe
  2⤵
  PID:9116
- C:\Windows\System32\YBEinEW.exe
  C:\Windows\System32\YBEinEW.exe
  2⤵
  PID:9140
- C:\Windows\System32\QGnhNLf.exe
  C:\Windows\System32\QGnhNLf.exe
  2⤵
  PID:9156
- C:\Windows\System32\NRnMsgQ.exe
  C:\Windows\System32\NRnMsgQ.exe
  2⤵
  PID:9172
- C:\Windows\System32\SBQmeqN.exe
  C:\Windows\System32\SBQmeqN.exe
  2⤵
  PID:9188
- C:\Windows\System32\vNPibTZ.exe
  C:\Windows\System32\vNPibTZ.exe
  2⤵
  PID:9204
- C:\Windows\System32\YywpKgA.exe
  C:\Windows\System32\YywpKgA.exe
  2⤵
  PID:6592
- C:\Windows\System32\JxZoyIy.exe
  C:\Windows\System32\JxZoyIy.exe
  2⤵
  PID:7536
- C:\Windows\System32\ENAxpzQ.exe
  C:\Windows\System32\ENAxpzQ.exe
  2⤵
  PID:8248
- C:\Windows\System32\ktYYely.exe
  C:\Windows\System32\ktYYely.exe
  2⤵
  PID:8200
- C:\Windows\System32\CJrtjTj.exe
  C:\Windows\System32\CJrtjTj.exe
  2⤵
  PID:8292
- C:\Windows\System32\hFvoPRY.exe
  C:\Windows\System32\hFvoPRY.exe
  2⤵
  PID:6964
- C:\Windows\System32\UxYDRxx.exe
  C:\Windows\System32\UxYDRxx.exe
  2⤵
  PID:8408
- C:\Windows\System32\xUgThhZ.exe
  C:\Windows\System32\xUgThhZ.exe
  2⤵
  PID:8352
- C:\Windows\System32\CfSRQGg.exe
  C:\Windows\System32\CfSRQGg.exe
  2⤵
  PID:8372
- C:\Windows\System32\FvlVKTJ.exe
  C:\Windows\System32\FvlVKTJ.exe
  2⤵
  PID:8452
- C:\Windows\System32\LMsZtXl.exe
  C:\Windows\System32\LMsZtXl.exe
  2⤵
  PID:8500
- C:\Windows\System32\OqYzuzC.exe
  C:\Windows\System32\OqYzuzC.exe
  2⤵
  PID:8536
- C:\Windows\System32\knBVAnZ.exe
  C:\Windows\System32\knBVAnZ.exe
  2⤵
  PID:8588
- C:\Windows\System32\STaHIid.exe
  C:\Windows\System32\STaHIid.exe
  2⤵
  PID:8620
- C:\Windows\System32\FtSuFSX.exe
  C:\Windows\System32\FtSuFSX.exe
  2⤵
  PID:8640
- C:\Windows\System32\ludwFiO.exe
  C:\Windows\System32\ludwFiO.exe
  2⤵
  PID:8704
- C:\Windows\System32\RdHJGQe.exe
  C:\Windows\System32\RdHJGQe.exe
  2⤵
  PID:8756
- C:\Windows\System32\NVAajZC.exe
  C:\Windows\System32\NVAajZC.exe
  2⤵
  PID:8844
- C:\Windows\System32\gUWbUgh.exe
  C:\Windows\System32\gUWbUgh.exe
  2⤵
  PID:8916
- C:\Windows\System32\RgWohJI.exe
  C:\Windows\System32\RgWohJI.exe
  2⤵
  PID:8964
- C:\Windows\System32\UGzJanT.exe
  C:\Windows\System32\UGzJanT.exe
  2⤵
  PID:3432
- C:\Windows\System32\DGeZYbh.exe
  C:\Windows\System32\DGeZYbh.exe
  2⤵
  PID:9036
- C:\Windows\System32\bsfolwR.exe
  C:\Windows\System32\bsfolwR.exe
  2⤵
  PID:9048
- C:\Windows\System32\OMFcWhm.exe
  C:\Windows\System32\OMFcWhm.exe
  2⤵
  PID:9060
- C:\Windows\System32\CcZisfJ.exe
  C:\Windows\System32\CcZisfJ.exe
  2⤵
  PID:9168
- C:\Windows\System32\BVliCXo.exe
  C:\Windows\System32\BVliCXo.exe
  2⤵
  PID:8904
- C:\Windows\System32\SZsqQSD.exe
  C:\Windows\System32\SZsqQSD.exe
  2⤵
  PID:8508
- C:\Windows\System32\svMBAee.exe
  C:\Windows\System32\svMBAee.exe
  2⤵
  PID:9288
- C:\Windows\System32\vrRITID.exe
  C:\Windows\System32\vrRITID.exe
  2⤵
  PID:9308
- C:\Windows\System32\GNSGSpK.exe
  C:\Windows\System32\GNSGSpK.exe
  2⤵
  PID:9332
- C:\Windows\System32\eDwjolK.exe
  C:\Windows\System32\eDwjolK.exe
  2⤵
  PID:9348
- C:\Windows\System32\YofOlfX.exe
  C:\Windows\System32\YofOlfX.exe
  2⤵
  PID:9368
- C:\Windows\System32\ZnbgYoP.exe
  C:\Windows\System32\ZnbgYoP.exe
  2⤵
  PID:9388
- C:\Windows\System32\tOpiguU.exe
  C:\Windows\System32\tOpiguU.exe
  2⤵
  PID:9404
- C:\Windows\System32\RNQcYGk.exe
  C:\Windows\System32\RNQcYGk.exe
  2⤵
  PID:9460
- C:\Windows\System32\azwOWuc.exe
  C:\Windows\System32\azwOWuc.exe
  2⤵
  PID:9496
- C:\Windows\System32\mZKGiPQ.exe
  C:\Windows\System32\mZKGiPQ.exe
  2⤵
  PID:9512
- C:\Windows\System32\akRVHDQ.exe
  C:\Windows\System32\akRVHDQ.exe
  2⤵
  PID:9540
- C:\Windows\System32\USyVUhK.exe
  C:\Windows\System32\USyVUhK.exe
  2⤵
  PID:9556
- C:\Windows\System32\bOPDAUW.exe
  C:\Windows\System32\bOPDAUW.exe
  2⤵
  PID:9580
- C:\Windows\System32\rInBXHw.exe
  C:\Windows\System32\rInBXHw.exe
  2⤵
  PID:9596
- C:\Windows\System32\nmXxfFH.exe
  C:\Windows\System32\nmXxfFH.exe
  2⤵
  PID:9668
- C:\Windows\System32\LimUWrz.exe
  C:\Windows\System32\LimUWrz.exe
  2⤵
  PID:9708
- C:\Windows\System32\kCMGSPp.exe
  C:\Windows\System32\kCMGSPp.exe
  2⤵
  PID:9728
- C:\Windows\System32\keVUlOK.exe
  C:\Windows\System32\keVUlOK.exe
  2⤵
  PID:9748
- C:\Windows\System32\cVaYwSL.exe
  C:\Windows\System32\cVaYwSL.exe
  2⤵
  PID:9772
- C:\Windows\System32\jGtxNNj.exe
  C:\Windows\System32\jGtxNNj.exe
  2⤵
  PID:9808
- C:\Windows\System32\vAnjSRx.exe
  C:\Windows\System32\vAnjSRx.exe
  2⤵
  PID:9832
- C:\Windows\System32\lirhAUF.exe
  C:\Windows\System32\lirhAUF.exe
  2⤵
  PID:9864
- C:\Windows\System32\CtQRQNH.exe
  C:\Windows\System32\CtQRQNH.exe
  2⤵
  PID:9888
- C:\Windows\System32\dHKMZVF.exe
  C:\Windows\System32\dHKMZVF.exe
  2⤵
  PID:9924
- C:\Windows\System32\SYjQJzh.exe
  C:\Windows\System32\SYjQJzh.exe
  2⤵
  PID:9964
- C:\Windows\System32\CxoconV.exe
  C:\Windows\System32\CxoconV.exe
  2⤵
  PID:9984
- C:\Windows\System32\sihGGNZ.exe
  C:\Windows\System32\sihGGNZ.exe
  2⤵
  PID:10004
- C:\Windows\System32\RqkONlU.exe
  C:\Windows\System32\RqkONlU.exe
  2⤵
  PID:10032
- C:\Windows\System32\BmTQWEC.exe
  C:\Windows\System32\BmTQWEC.exe
  2⤵
  PID:10052
- C:\Windows\System32\xdlZhsP.exe
  C:\Windows\System32\xdlZhsP.exe
  2⤵
  PID:10100
- C:\Windows\System32\iiwmbzW.exe
  C:\Windows\System32\iiwmbzW.exe
  2⤵
  PID:10116
- C:\Windows\System32\spgaAML.exe
  C:\Windows\System32\spgaAML.exe
  2⤵
  PID:10148
- C:\Windows\System32\lfRCwWV.exe
  C:\Windows\System32\lfRCwWV.exe
  2⤵
  PID:10172
- C:\Windows\System32\hDXqTqx.exe
  C:\Windows\System32\hDXqTqx.exe
  2⤵
  PID:10196
- C:\Windows\System32\PIifKvG.exe
  C:\Windows\System32\PIifKvG.exe
  2⤵
  PID:10220
- C:\Windows\System32\cjabFjH.exe
  C:\Windows\System32\cjabFjH.exe
  2⤵
  PID:9224
- C:\Windows\System32\pnLxKOs.exe
  C:\Windows\System32\pnLxKOs.exe
  2⤵
  PID:9028
- C:\Windows\System32\VYobLIY.exe
  C:\Windows\System32\VYobLIY.exe
  2⤵
  PID:9088
- C:\Windows\System32\LzHYDwL.exe
  C:\Windows\System32\LzHYDwL.exe
  2⤵
  PID:9384
- C:\Windows\System32\WNHlRFD.exe
  C:\Windows\System32\WNHlRFD.exe
  2⤵
  PID:9344
- C:\Windows\System32\iFGfryy.exe
  C:\Windows\System32\iFGfryy.exe
  2⤵
  PID:9356
- C:\Windows\System32\fUyJvMY.exe
  C:\Windows\System32\fUyJvMY.exe
  2⤵
  PID:9448
- C:\Windows\System32\WPjchsV.exe
  C:\Windows\System32\WPjchsV.exe
  2⤵
  PID:9508
- C:\Windows\System32\CpRJlMP.exe
  C:\Windows\System32\CpRJlMP.exe
  2⤵
  PID:9548
- C:\Windows\System32\nViXFkK.exe
  C:\Windows\System32\nViXFkK.exe
  2⤵
  PID:9632
- C:\Windows\System32\QVTfjta.exe
  C:\Windows\System32\QVTfjta.exe
  2⤵
  PID:9756
- C:\Windows\System32\icCrDWE.exe
  C:\Windows\System32\icCrDWE.exe
  2⤵
  PID:9824
- C:\Windows\System32\efvmgTm.exe
  C:\Windows\System32\efvmgTm.exe
  2⤵
  PID:9884
- C:\Windows\System32\guepwAK.exe
  C:\Windows\System32\guepwAK.exe
  2⤵
  PID:9944
- C:\Windows\System32\QgmslfO.exe
  C:\Windows\System32\QgmslfO.exe
  2⤵
  PID:10000
- C:\Windows\System32\QVBBktZ.exe
  C:\Windows\System32\QVBBktZ.exe
  2⤵
  PID:10060
- C:\Windows\System32\gVYVPSo.exe
  C:\Windows\System32\gVYVPSo.exe
  2⤵
  PID:10168
- C:\Windows\System32\LFqHHSl.exe
  C:\Windows\System32\LFqHHSl.exe
  2⤵
  PID:9108
- C:\Windows\System32\lVvAFSI.exe
  C:\Windows\System32\lVvAFSI.exe
  2⤵
  PID:9320
- C:\Windows\System32\IncNAlr.exe
  C:\Windows\System32\IncNAlr.exe
  2⤵
  PID:9340
- C:\Windows\System32\BLARShJ.exe
  C:\Windows\System32\BLARShJ.exe
  2⤵
  PID:9568
- C:\Windows\System32\mxoWyje.exe
  C:\Windows\System32\mxoWyje.exe
  2⤵
  PID:9576
- C:\Windows\System32\uqbdeqT.exe
  C:\Windows\System32\uqbdeqT.exe
  2⤵
  PID:9796
- C:\Windows\System32\uPhTTJA.exe
  C:\Windows\System32\uPhTTJA.exe
  2⤵
  PID:9876
- C:\Windows\System32\ZpwTmso.exe
  C:\Windows\System32\ZpwTmso.exe
  2⤵
  PID:10204
- C:\Windows\System32\KjhdjSb.exe
  C:\Windows\System32\KjhdjSb.exe
  2⤵
  PID:8280
- C:\Windows\System32\VxjiGBt.exe
  C:\Windows\System32\VxjiGBt.exe
  2⤵
  PID:9592
- C:\Windows\System32\CtjWSdq.exe
  C:\Windows\System32\CtjWSdq.exe
  2⤵
  PID:9800
- C:\Windows\System32\gWlDAZe.exe
  C:\Windows\System32\gWlDAZe.exe
  2⤵
  PID:10080
- C:\Windows\System32\OFPgIJM.exe
  C:\Windows\System32\OFPgIJM.exe
  2⤵
  PID:9296
- C:\Windows\System32\pmslQKZ.exe
  C:\Windows\System32\pmslQKZ.exe
  2⤵
  PID:10260
- C:\Windows\System32\QMDYtud.exe
  C:\Windows\System32\QMDYtud.exe
  2⤵
  PID:10280
- C:\Windows\System32\orNirJx.exe
  C:\Windows\System32\orNirJx.exe
  2⤵
  PID:10296
- C:\Windows\System32\CxrDtzM.exe
  C:\Windows\System32\CxrDtzM.exe
  2⤵
  PID:10360
- C:\Windows\System32\LqUGPdO.exe
  C:\Windows\System32\LqUGPdO.exe
  2⤵
  PID:10380
- C:\Windows\System32\zZZxjcb.exe
  C:\Windows\System32\zZZxjcb.exe
  2⤵
  PID:10408
- C:\Windows\System32\bhHOdQU.exe
  C:\Windows\System32\bhHOdQU.exe
  2⤵
  PID:10428
- C:\Windows\System32\LDCGLvV.exe
  C:\Windows\System32\LDCGLvV.exe
  2⤵
  PID:10452
- C:\Windows\System32\TTaMDZm.exe
  C:\Windows\System32\TTaMDZm.exe
  2⤵
  PID:10472
- C:\Windows\System32\ChsatNR.exe
  C:\Windows\System32\ChsatNR.exe
  2⤵
  PID:10488
- C:\Windows\System32\fiofKZq.exe
  C:\Windows\System32\fiofKZq.exe
  2⤵
  PID:10508
- C:\Windows\System32\vAvALtm.exe
  C:\Windows\System32\vAvALtm.exe
  2⤵
  PID:10524
- C:\Windows\System32\RBMQOqW.exe
  C:\Windows\System32\RBMQOqW.exe
  2⤵
  PID:10552
- C:\Windows\System32\GiYNEUm.exe
  C:\Windows\System32\GiYNEUm.exe
  2⤵
  PID:10576
- C:\Windows\System32\IjwhInI.exe
  C:\Windows\System32\IjwhInI.exe
  2⤵
  PID:10592
- C:\Windows\System32\bbkgWuj.exe
  C:\Windows\System32\bbkgWuj.exe
  2⤵
  PID:10652
- C:\Windows\System32\WYQUlZn.exe
  C:\Windows\System32\WYQUlZn.exe
  2⤵
  PID:10676
- C:\Windows\System32\ePqrMqj.exe
  C:\Windows\System32\ePqrMqj.exe
  2⤵
  PID:10692
- C:\Windows\System32\ZCDSfYF.exe
  C:\Windows\System32\ZCDSfYF.exe
  2⤵
  PID:10732
- C:\Windows\System32\KbERpKp.exe
  C:\Windows\System32\KbERpKp.exe
  2⤵
  PID:10780
- C:\Windows\System32\OycMZni.exe
  C:\Windows\System32\OycMZni.exe
  2⤵
  PID:10800
- C:\Windows\System32\eHNubXv.exe
  C:\Windows\System32\eHNubXv.exe
  2⤵
  PID:10816
- C:\Windows\System32\WKxITfr.exe
  C:\Windows\System32\WKxITfr.exe
  2⤵
  PID:10840
- C:\Windows\System32\tjsUCFA.exe
  C:\Windows\System32\tjsUCFA.exe
  2⤵
  PID:10856
- C:\Windows\System32\EhZmNXD.exe
  C:\Windows\System32\EhZmNXD.exe
  2⤵
  PID:10908
- C:\Windows\System32\ixWcMaD.exe
  C:\Windows\System32\ixWcMaD.exe
  2⤵
  PID:10932
- C:\Windows\System32\XwHAdPO.exe
  C:\Windows\System32\XwHAdPO.exe
  2⤵
  PID:10976
- C:\Windows\System32\DvqRZYX.exe
  C:\Windows\System32\DvqRZYX.exe
  2⤵
  PID:11000
- C:\Windows\System32\rsqtfeo.exe
  C:\Windows\System32\rsqtfeo.exe
  2⤵
  PID:11020
- C:\Windows\System32\WRqfbNt.exe
  C:\Windows\System32\WRqfbNt.exe
  2⤵
  PID:11092
- C:\Windows\System32\YPsoHmt.exe
  C:\Windows\System32\YPsoHmt.exe
  2⤵
  PID:11108
- C:\Windows\System32\fVxwqLe.exe
  C:\Windows\System32\fVxwqLe.exe
  2⤵
  PID:11128
- C:\Windows\System32\ZIYjTqm.exe
  C:\Windows\System32\ZIYjTqm.exe
  2⤵
  PID:11148
- C:\Windows\System32\WvvLfZW.exe
  C:\Windows\System32\WvvLfZW.exe
  2⤵
  PID:11188
- C:\Windows\System32\FnqTUXW.exe
  C:\Windows\System32\FnqTUXW.exe
  2⤵
  PID:11212
- C:\Windows\System32\XwrlSnm.exe
  C:\Windows\System32\XwrlSnm.exe
  2⤵
  PID:11244
- C:\Windows\System32\gsfMTTN.exe
  C:\Windows\System32\gsfMTTN.exe
  2⤵
  PID:10248
- C:\Windows\System32\KrRyUot.exe
  C:\Windows\System32\KrRyUot.exe
  2⤵
  PID:10276
- C:\Windows\System32\QdUirYF.exe
  C:\Windows\System32\QdUirYF.exe
  2⤵
  PID:10328
- C:\Windows\System32\ucwcbXc.exe
  C:\Windows\System32\ucwcbXc.exe
  2⤵
  PID:10388
- C:\Windows\System32\czqZhXz.exe
  C:\Windows\System32\czqZhXz.exe
  2⤵
  PID:10504
- C:\Windows\System32\EBZWyGq.exe
  C:\Windows\System32\EBZWyGq.exe
  2⤵
  PID:10500
- C:\Windows\System32\eORvRxV.exe
  C:\Windows\System32\eORvRxV.exe
  2⤵
  PID:10584
- C:\Windows\System32\xFKsoom.exe
  C:\Windows\System32\xFKsoom.exe
  2⤵
  PID:10712
- C:\Windows\System32\ZZcnrlg.exe
  C:\Windows\System32\ZZcnrlg.exe
  2⤵
  PID:10764
- C:\Windows\System32\YjrogJo.exe
  C:\Windows\System32\YjrogJo.exe
  2⤵
  PID:10812
- C:\Windows\System32\qNYapZA.exe
  C:\Windows\System32\qNYapZA.exe
  2⤵
  PID:10868
- C:\Windows\System32\YUcSWdL.exe
  C:\Windows\System32\YUcSWdL.exe
  2⤵
  PID:10900
- C:\Windows\System32\ttINQYb.exe
  C:\Windows\System32\ttINQYb.exe
  2⤵
  PID:11036
- C:\Windows\System32\KHBbmtD.exe
  C:\Windows\System32\KHBbmtD.exe
  2⤵
  PID:11052
- C:\Windows\System32\VvhTBMj.exe
  C:\Windows\System32\VvhTBMj.exe
  2⤵
  PID:11116
- C:\Windows\System32\ajBHXcT.exe
  C:\Windows\System32\ajBHXcT.exe
  2⤵
  PID:11176
- C:\Windows\System32\cCNJPvs.exe
  C:\Windows\System32\cCNJPvs.exe
  2⤵
  PID:11228
- C:\Windows\System32\xKfCxoR.exe
  C:\Windows\System32\xKfCxoR.exe
  2⤵
  PID:9980
- C:\Windows\System32\KmAshMd.exe
  C:\Windows\System32\KmAshMd.exe
  2⤵
  PID:10288
- C:\Windows\System32\oncbgFB.exe
  C:\Windows\System32\oncbgFB.exe
  2⤵
  PID:10664
- C:\Windows\System32\khJtUSb.exe
  C:\Windows\System32\khJtUSb.exe
  2⤵
  PID:10788
- C:\Windows\System32\avZyAEh.exe
  C:\Windows\System32\avZyAEh.exe
  2⤵
  PID:10924
- C:\Windows\System32\wjwFAPd.exe
  C:\Windows\System32\wjwFAPd.exe
  2⤵
  PID:11032
- C:\Windows\System32\mNWXdFc.exe
  C:\Windows\System32\mNWXdFc.exe
  2⤵
  PID:9680
- C:\Windows\System32\bPQrtnP.exe
  C:\Windows\System32\bPQrtnP.exe
  2⤵
  PID:10368
- C:\Windows\System32\RuRpTfF.exe
  C:\Windows\System32\RuRpTfF.exe
  2⤵
  PID:10752
- C:\Windows\System32\BCfBVJg.exe
  C:\Windows\System32\BCfBVJg.exe
  2⤵
  PID:9660
- C:\Windows\System32\RAYKbcf.exe
  C:\Windows\System32\RAYKbcf.exe
  2⤵
  PID:10968
- C:\Windows\System32\AcAjQGe.exe
  C:\Windows\System32\AcAjQGe.exe
  2⤵
  PID:11288
- C:\Windows\System32\LqwGnsj.exe
  C:\Windows\System32\LqwGnsj.exe
  2⤵
  PID:11308
- C:\Windows\System32\LSpbihx.exe
  C:\Windows\System32\LSpbihx.exe
  2⤵
  PID:11332
- C:\Windows\System32\USUCLoY.exe
  C:\Windows\System32\USUCLoY.exe
  2⤵
  PID:11360
- C:\Windows\System32\nfACxmO.exe
  C:\Windows\System32\nfACxmO.exe
  2⤵
  PID:11448
- C:\Windows\System32\EJsruZw.exe
  C:\Windows\System32\EJsruZw.exe
  2⤵
  PID:11472
- C:\Windows\System32\RhodgsU.exe
  C:\Windows\System32\RhodgsU.exe
  2⤵
  PID:11492
- C:\Windows\System32\WEnBrUg.exe
  C:\Windows\System32\WEnBrUg.exe
  2⤵
  PID:11508
- C:\Windows\System32\wGvOCxH.exe
  C:\Windows\System32\wGvOCxH.exe
  2⤵
  PID:11552
- C:\Windows\System32\tldoUlp.exe
  C:\Windows\System32\tldoUlp.exe
  2⤵
  PID:11584
- C:\Windows\System32\ZQOwAkT.exe
  C:\Windows\System32\ZQOwAkT.exe
  2⤵
  PID:11612
- C:\Windows\System32\vjtZUoq.exe
  C:\Windows\System32\vjtZUoq.exe
  2⤵
  PID:11628
- C:\Windows\System32\ZDgWdVs.exe
  C:\Windows\System32\ZDgWdVs.exe
  2⤵
  PID:11656
- C:\Windows\System32\EDEbVeH.exe
  C:\Windows\System32\EDEbVeH.exe
  2⤵
  PID:11684
- C:\Windows\System32\GDnGwTB.exe
  C:\Windows\System32\GDnGwTB.exe
  2⤵
  PID:11712
- C:\Windows\System32\kSvwGRn.exe
  C:\Windows\System32\kSvwGRn.exe
  2⤵
  PID:11736
- C:\Windows\System32\wHkRSdy.exe
  C:\Windows\System32\wHkRSdy.exe
  2⤵
  PID:11760
- C:\Windows\System32\AkOEvXX.exe
  C:\Windows\System32\AkOEvXX.exe
  2⤵
  PID:11784
- C:\Windows\System32\dqXZZjo.exe
  C:\Windows\System32\dqXZZjo.exe
  2⤵
  PID:11800
- C:\Windows\System32\UdDnWJx.exe
  C:\Windows\System32\UdDnWJx.exe
  2⤵
  PID:11820
- C:\Windows\System32\idoBdmt.exe
  C:\Windows\System32\idoBdmt.exe
  2⤵
  PID:11840
- C:\Windows\System32\ETWLuYv.exe
  C:\Windows\System32\ETWLuYv.exe
  2⤵
  PID:11856
- C:\Windows\System32\nwZFQbI.exe
  C:\Windows\System32\nwZFQbI.exe
  2⤵
  PID:11908
- C:\Windows\System32\bJkysDc.exe
  C:\Windows\System32\bJkysDc.exe
  2⤵
  PID:11932
- C:\Windows\System32\OcTNbnX.exe
  C:\Windows\System32\OcTNbnX.exe
  2⤵
  PID:11984
- C:\Windows\System32\zytXMYw.exe
  C:\Windows\System32\zytXMYw.exe
  2⤵
  PID:12004
- C:\Windows\System32\gHcSxYl.exe
  C:\Windows\System32\gHcSxYl.exe
  2⤵
  PID:12044
- C:\Windows\System32\BnKfjln.exe
  C:\Windows\System32\BnKfjln.exe
  2⤵
  PID:12068
- C:\Windows\System32\PpbcSsW.exe
  C:\Windows\System32\PpbcSsW.exe
  2⤵
  PID:12096
- C:\Windows\System32\gVHzoGl.exe
  C:\Windows\System32\gVHzoGl.exe
  2⤵
  PID:12144
- C:\Windows\System32\MVBKcuu.exe
  C:\Windows\System32\MVBKcuu.exe
  2⤵
  PID:12160
- C:\Windows\System32\kWkVUYo.exe
  C:\Windows\System32\kWkVUYo.exe
  2⤵
  PID:12180
- C:\Windows\System32\JYzkKVb.exe
  C:\Windows\System32\JYzkKVb.exe
  2⤵
  PID:12200
- C:\Windows\System32\EpZoNwm.exe
  C:\Windows\System32\EpZoNwm.exe
  2⤵
  PID:12216
- C:\Windows\System32\gMuqwmr.exe
  C:\Windows\System32\gMuqwmr.exe
  2⤵
  PID:12256
- C:\Windows\System32\tNNaVGs.exe
  C:\Windows\System32\tNNaVGs.exe
  2⤵
  PID:12280
- C:\Windows\System32\RqBUoCU.exe
  C:\Windows\System32\RqBUoCU.exe
  2⤵
  PID:10724
- C:\Windows\System32\IkNbBvM.exe
  C:\Windows\System32\IkNbBvM.exe
  2⤵
  PID:11328
- C:\Windows\System32\mZFzABy.exe
  C:\Windows\System32\mZFzABy.exe
  2⤵
  PID:11368
- C:\Windows\System32\ontggUj.exe
  C:\Windows\System32\ontggUj.exe
  2⤵
  PID:11412
- C:\Windows\System32\JBQKaDG.exe
  C:\Windows\System32\JBQKaDG.exe
  2⤵
  PID:11524
- C:\Windows\System32\xnsoEMC.exe
  C:\Windows\System32\xnsoEMC.exe
  2⤵
  PID:11576
- C:\Windows\System32\MZEOhLF.exe
  C:\Windows\System32\MZEOhLF.exe
  2⤵
  PID:11704
- C:\Windows\System32\zdWuMGl.exe
  C:\Windows\System32\zdWuMGl.exe
  2⤵
  PID:11720
- C:\Windows\System32\kinherr.exe
  C:\Windows\System32\kinherr.exe
  2⤵
  PID:11872
- C:\Windows\System32\lrywOUy.exe
  C:\Windows\System32\lrywOUy.exe
  2⤵
  PID:11940
- C:\Windows\System32\aDpUgFc.exe
  C:\Windows\System32\aDpUgFc.exe
  2⤵
  PID:11952
- C:\Windows\System32\zgRBrWV.exe
  C:\Windows\System32\zgRBrWV.exe
  2⤵
  PID:12052
- C:\Windows\System32\BdmltvG.exe
  C:\Windows\System32\BdmltvG.exe
  2⤵
  PID:12156
- C:\Windows\System32\TQSeaMt.exe
  C:\Windows\System32\TQSeaMt.exe
  2⤵
  PID:4020
- C:\Windows\System32\gTBPrnv.exe
  C:\Windows\System32\gTBPrnv.exe
  2⤵
  PID:2156
- C:\Windows\System32\VdYIZQs.exe
  C:\Windows\System32\VdYIZQs.exe
  2⤵
  PID:12152
- C:\Windows\System32\paLJGIN.exe
  C:\Windows\System32\paLJGIN.exe
  2⤵
  PID:11272
- C:\Windows\System32\suVCabs.exe
  C:\Windows\System32\suVCabs.exe
  2⤵
  PID:11296
- C:\Windows\System32\nwNLHkY.exe
  C:\Windows\System32\nwNLHkY.exe
  2⤵
  PID:11592
- C:\Windows\System32\FQwXSzl.exe
  C:\Windows\System32\FQwXSzl.exe
  2⤵
  PID:11596
- C:\Windows\System32\qAoagHp.exe
  C:\Windows\System32\qAoagHp.exe
  2⤵
  PID:11792
- C:\Windows\System32\FvmFTBW.exe
  C:\Windows\System32\FvmFTBW.exe
  2⤵
  PID:11956
- C:\Windows\System32\OnDyKmr.exe
  C:\Windows\System32\OnDyKmr.exe
  2⤵
  PID:3032
- C:\Windows\System32\ODZmSxQ.exe
  C:\Windows\System32\ODZmSxQ.exe
  2⤵
  PID:12176
- C:\Windows\System32\mSIHDJR.exe
  C:\Windows\System32\mSIHDJR.exe
  2⤵
  PID:11304
- C:\Windows\System32\ypNefgK.exe
  C:\Windows\System32\ypNefgK.exe
  2⤵
  PID:11372
- C:\Windows\System32\PynQdfd.exe
  C:\Windows\System32\PynQdfd.exe
  2⤵
  PID:11904
- C:\Windows\System32\bGJezrM.exe
  C:\Windows\System32\bGJezrM.exe
  2⤵
  PID:12104
- C:\Windows\System32\SPZxtDK.exe
  C:\Windows\System32\SPZxtDK.exe
  2⤵
  PID:12028
- C:\Windows\System32\eEXBWEU.exe
  C:\Windows\System32\eEXBWEU.exe
  2⤵
  PID:11624
- C:\Windows\System32\NKkTpwa.exe
  C:\Windows\System32\NKkTpwa.exe
  2⤵
  PID:12296
- C:\Windows\System32\qLDtaHu.exe
  C:\Windows\System32\qLDtaHu.exe
  2⤵
  PID:12320
- C:\Windows\System32\pishgjv.exe
  C:\Windows\System32\pishgjv.exe
  2⤵
  PID:12336
- C:\Windows\System32\zrifFGx.exe
  C:\Windows\System32\zrifFGx.exe
  2⤵
  PID:12360
- C:\Windows\System32\vYmEmKH.exe
  C:\Windows\System32\vYmEmKH.exe
  2⤵
  PID:12376
- C:\Windows\System32\sygqkwX.exe
  C:\Windows\System32\sygqkwX.exe
  2⤵
  PID:12420
- C:\Windows\System32\JvRuQKX.exe
  C:\Windows\System32\JvRuQKX.exe
  2⤵
  PID:12436
- C:\Windows\System32\ptuuKvV.exe
  C:\Windows\System32\ptuuKvV.exe
  2⤵
  PID:12452
- C:\Windows\System32\ogzvGcB.exe
  C:\Windows\System32\ogzvGcB.exe
  2⤵
  PID:12532
- C:\Windows\System32\UkQbzpM.exe
  C:\Windows\System32\UkQbzpM.exe
  2⤵
  PID:12596
- C:\Windows\System32\aPPRRjY.exe
  C:\Windows\System32\aPPRRjY.exe
  2⤵
  PID:12620
- C:\Windows\System32\APzIrdB.exe
  C:\Windows\System32\APzIrdB.exe
  2⤵
  PID:12668
- C:\Windows\System32\oTzQOah.exe
  C:\Windows\System32\oTzQOah.exe
  2⤵
  PID:12688
- C:\Windows\System32\gnuDCUc.exe
  C:\Windows\System32\gnuDCUc.exe
  2⤵
  PID:12716
- C:\Windows\System32\fdWyyud.exe
  C:\Windows\System32\fdWyyud.exe
  2⤵
  PID:12740
- C:\Windows\System32\hVYJtvq.exe
  C:\Windows\System32\hVYJtvq.exe
  2⤵
  PID:12760
- C:\Windows\System32\DpvmMxE.exe
  C:\Windows\System32\DpvmMxE.exe
  2⤵
  PID:12784
- C:\Windows\System32\jOjSxKE.exe
  C:\Windows\System32\jOjSxKE.exe
  2⤵
  PID:12800
- C:\Windows\System32\sNbcmFU.exe
  C:\Windows\System32\sNbcmFU.exe
  2⤵
  PID:12824
- C:\Windows\System32\EMuSxZN.exe
  C:\Windows\System32\EMuSxZN.exe
  2⤵
  PID:12840
- C:\Windows\System32\hqibbAN.exe
  C:\Windows\System32\hqibbAN.exe
  2⤵
  PID:12916
- C:\Windows\System32\HIfneYo.exe
  C:\Windows\System32\HIfneYo.exe
  2⤵
  PID:12932
- C:\Windows\System32\VTftsWA.exe
  C:\Windows\System32\VTftsWA.exe
  2⤵
  PID:12948
- C:\Windows\System32\FgxXugE.exe
  C:\Windows\System32\FgxXugE.exe
  2⤵
  PID:13012
- C:\Windows\System32\XwtlFJN.exe
  C:\Windows\System32\XwtlFJN.exe
  2⤵
  PID:13032
- C:\Windows\System32\zbfCjUK.exe
  C:\Windows\System32\zbfCjUK.exe
  2⤵
  PID:13056
- C:\Windows\System32\iXvqZlJ.exe
  C:\Windows\System32\iXvqZlJ.exe
  2⤵
  PID:13076
- C:\Windows\System32\kGHCUDa.exe
  C:\Windows\System32\kGHCUDa.exe
  2⤵
  PID:13092
- C:\Windows\System32\UPHpSPz.exe
  C:\Windows\System32\UPHpSPz.exe
  2⤵
  PID:13112
- C:\Windows\System32\bAfMaZv.exe
  C:\Windows\System32\bAfMaZv.exe
  2⤵
  PID:13164
- C:\Windows\System32\OwLPadH.exe
  C:\Windows\System32\OwLPadH.exe
  2⤵
  PID:13180
- C:\Windows\System32\bLslScZ.exe
  C:\Windows\System32\bLslScZ.exe
  2⤵
  PID:13204
- C:\Windows\System32\cvkHzil.exe
  C:\Windows\System32\cvkHzil.exe
  2⤵
  PID:13220
- C:\Windows\System32\jVwXCic.exe
  C:\Windows\System32\jVwXCic.exe
  2⤵
  PID:13272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\AnpjUVq.exe

Filesize
1.1MB

MD5
8f4f550d0ce07a78d109df1fef5cd416

SHA1
4325bc23dc9433d92225b138108fac43be6ad784

SHA256
024c5f428d79314a49f92bb2a755d78c2e0097a7bac6eada69c83419319fcc1e

SHA512
30e824e0d844d8f97dc635f29a7848413cd762d2402d4e520fba555cc0244d99b57a063173d3ea1a95a6d57aad354ac916b1c6957b797d76c806543928cc018e

Download Submit
C:\Windows\System32\CfKEmEO.exe

Filesize
1.1MB

MD5
c1fa376c5f9a1d361992e51712f1e15a

SHA1
6bfb08946b998bafd159adf2056ee422a244fdf2

SHA256
b8e0cbe288b5eb5ad8ece01d7106ac8b9aedb4294c7f4e54e512b0f507d48b50

SHA512
668a9e8f19f60b4f427043fac2690440141cd1a928c97a77f7340046e053f13782d2f7f850dfa94a2e337c558bd5f4474ef0c49b306f074e71bd9c542ec53fbf

Download Submit
C:\Windows\System32\FfwehrQ.exe

Filesize
1.1MB

MD5
4eb013865f27b902537c7e4892a8bae5

SHA1
1c285c3ce8d982ffb3efb04c6c6dde2842210c5e

SHA256
8d23a2b62a4e5f13d98217fd06db2182474f9c396da8197e6f3c89dfd8a484ab

SHA512
163d5af518c4f5fc3192ffa3ed8d554b8ef10a45b0243157108e1d7e3830ff274ac34d46d01624f871bc150f0b04d27d1df14aa1d8e48262b66b8954748091a7

Download Submit
C:\Windows\System32\FjdWHEA.exe

Filesize
1.1MB

MD5
0993988e4bc985aecb88baa86024e6bc

SHA1
b31571a7e675b5fd95e01405bf204786ccd25fa8

SHA256
8924812ff90352b1fbe2016d35e17fe0487a31c9ded656a872101eacf461a90b

SHA512
c1881777549651f5348225e5b41acf7c12bab719de3659244db6c744f7d938b2e493417d06095e9c5206373cffdf0840ec175c7e712bc17d60a31d1581b81bb3

Download Submit
C:\Windows\System32\FrPyePC.exe

Filesize
1.1MB

MD5
1b9039976d1f763d24de6694c78edb70

SHA1
ce4466f710d39378596e2911d8bf70a4ca9e498a

SHA256
8bc0428b7b410ae92608a8d1a88a8e5d3ce645793ec08cbde2dfd513afbd1bcb

SHA512
b5c30d3c742b26afacffe451cefc0cbc6f1abebce8cce7ef09857e0b4fd3706fca49aa399f5ab62e384c3dfcd4134a0f62a4ddbdce1e944ce7c3c64a01e30e90

Download Submit
C:\Windows\System32\JrFstkd.exe

Filesize
1.1MB

MD5
da16d33f1e66d2a3cecbc7f92ca6e237

SHA1
f157d0a38e61cd1abfe1cab1ec21643a994b9220

SHA256
99e4db4f6d8108221422eb13944248a356b7caea9592c8ab7a05c1288493a7ef

SHA512
ec695e0521446658a9a1f904b67812015d1da0bc0387af449b21bef72bd0de38c037d26cdbce9c871cc93487530929f0b87f96793739e59a3dc6483cf08fb2bb

Download Submit
C:\Windows\System32\KfUYhsg.exe

Filesize
1.1MB

MD5
c0a6512401eaef98b5815bf9a162a998

SHA1
5fc04ae70f586645fc58ae709375773d953b4344

SHA256
024872fdea1b8a2a596d2da01b901278184f3c50038afe7d706f4de72bfa2080

SHA512
306ee2d8c1771b67cae1aea1017c9803f2c7081e9396826d60f298e2a4688da33ec46365072fe1f55e75b7fa095b262d79c136a788d2cb06554e2be945554c0a

Download Submit
C:\Windows\System32\NghffDi.exe

Filesize
1.1MB

MD5
fb8da7fb5a92e3422a16dc1e2755ab86

SHA1
b25c7d747576620c9dc04bd613b51719804ce050

SHA256
0043e95229540cb14ee276b6a2ae032bbe3955403bc57d25b8b13c45048b7942

SHA512
b97e351cfb088ebb016e9f5fcaf0547c5bfbb3a746f4cfa96143ef9b04b8d7c83756278210c60e49f7f9089e9091b34bd4b96de089e6efcef3675b94052c414c

Download Submit
C:\Windows\System32\NprglCj.exe

Filesize
1.1MB

MD5
af71f74ed8daac6caaafbb2df9efda62

SHA1
78962a36082b43ee1bd59f9560bc5b0afe142b34

SHA256
f63056b4b624ae7363fc651a0cf07dd1a827a7a304b478167db9c04fe7951e62

SHA512
9d543cde301b23abcd5a33f464e84f0f465e2f438457a15324c491415d9f272cb079ddbebc5ead335441e68fb5a7b441131b318217303c515f387d1387588e6d

Download Submit
C:\Windows\System32\OEweDiG.exe

Filesize
1.1MB

MD5
080fa6ea99d641a6c1700901b3735ace

SHA1
39f3e804384c1e25e152bbfe3a58ce803fa3ecc9

SHA256
eaeb74894a8b7b5f80d44cbe707c9a4ce33ab755e60ffc97ca8dd17ff636a91c

SHA512
c32ee5e15119044df39780cd553ad4d467a2d15c90a4cc7d1285ebd203f4ab9a7173055cd5fee57fa53991031b9ab4de7d32ad4298d1ae561cebf1272d74a2a6

Download Submit
C:\Windows\System32\ONdspyX.exe

Filesize
1.1MB

MD5
3d90d778922482b60892fc9aa90f6fb5

SHA1
5c44d2c2342858aa985d6dcf71a48ecb62d38a04

SHA256
378b6dee91d2a24641e8ec95524ce2bc91c655fd6632d08f2ab739b9cf613302

SHA512
4f115de1d905e9d61f3e09032afbd745f66a5f0fcc8c98194342960c80400d3a448031ebe01d07eedd2817cf2825933936a58d53c426168bffb5e13e818a0aaa

Download Submit
C:\Windows\System32\OYSRsFY.exe

Filesize
1.1MB

MD5
88b5be4e1399eb25fd8fc6641db624db

SHA1
d2da676f9ac4df0276389c1f048ac73364f7dd6c

SHA256
fab2817a7f54a7a0df685e30839d93bfe5f97cd11caa260ccf2e96351d62e5e2

SHA512
e867966264aa2a58b47102ed81aa1175070113590acaf9b0d802fe018a2926cd2f00ffb0aeac680c9df8ee79b29d99fb3bb318c2fbed8d38c84cd2091805ada0

Download Submit
C:\Windows\System32\RZVsAGQ.exe

Filesize
1.1MB

MD5
5a633c41edd43e6043118ede1b7f2530

SHA1
eda855ed16708b1ec696ee2d51354b1b2b29b778

SHA256
9a578cbbf51aa6c4df275d8461e90b35476c80e5ac295edb3c900a8a5d864cca

SHA512
3ec211c2e4c13bb6a9274c5d28d10908766615878cae2853beafdb59d96e53981a2e7625f445db46a29c0c6aeb28c71fd71b2e0cdeb310047266654dfb5831e0

Download Submit
C:\Windows\System32\TUaaekR.exe

Filesize
1.1MB

MD5
d3445ee70d9048378b16d292ff6fdc8a

SHA1
4cbecf9d57d1cb7630b409023b78549261168eae

SHA256
96619c8829c8389546e76e5452d7163f71008552bdc1b9a5e86411b3906c3263

SHA512
5154d7fc9bc9275f328d29634e0aec73c238d0d5fbc80e19cbae6c1720984774ac0fe3245996c5b46a9d7d2a52bd01cbd1a1b4bdac6b4c162118b520cc5a66cf

Download Submit
C:\Windows\System32\VIYNFHE.exe

Filesize
1.1MB

MD5
d702dc4739a39625c9b9c28727814678

SHA1
609deb59707f725ff20e408572179f55690f37d0

SHA256
c77b6b33dfff74ed83f14eb1fb9bb26d580a72e4c3ffd65d8f7275d86ae5cd06

SHA512
dd028f6fa7867d5bcc5086616ef3054c11824604d2012b5db82f99df6f2869433a302c5e80421cba21de4071916d4ffc4a55828f7857479282503c5f4030c4e7

Download Submit
C:\Windows\System32\VTdNEfs.exe

Filesize
1.1MB

MD5
2d9fec6bd3059e07b0eee527de896a54

SHA1
207b1d90161c85e971f262e0103cfdbf4dbdcced

SHA256
f14b1d0c1fc3fe410de6f0381644340a975d01d3a7b5de45521394ef529afaae

SHA512
249c058a20a44faa76d1099943195d88bad057a25da607ff1ae78587a099aa148f601e4cb599082272c3cd1f7bc3a66dedad92a7327d17025fe2619997e8a3bc

Download Submit
C:\Windows\System32\WpQxJTS.exe

Filesize
1.1MB

MD5
28757c56b24afb0ea398cf04f3096332

SHA1
3d4fbdca71830c58833b6b456041028e289fd9e5

SHA256
27b7898f0fa74a3cc25006f2916a4507947e19c79366536a8c5d4f97049ac94c

SHA512
cfc55d887dc6e5dda9da0e81312d4b8a4d7f6ceedb69b38d52dde5f19a7cc2cd7902494c113d409c767aa6776e4c152b2c5e2d640a16918bee333958bbba2ad4

Download Submit
C:\Windows\System32\bWVQGGX.exe

Filesize
1.1MB

MD5
4d88c7e16ad7f2658615cca5d29dcf27

SHA1
e4eac70a3e90d2671d5d28e7cdb2a1640b0081b8

SHA256
a5fe719e1181985f5d56deac81dcf7fa66f225408c98ff38aaf42ac1d79eec8c

SHA512
d6f61cedbb629997c8401096418d5fb26026aded11d99e8828f6faea348eef9c155774106722dee8395df294e69caf17c27f5f0236a5dd6007eb115c23c93232

Download Submit
C:\Windows\System32\brtjVDt.exe

Filesize
1.1MB

MD5
41b632a23fdb306cc95e6c1441c86740

SHA1
ee480b3e978c36a5adfbaa3d07bf615486591237

SHA256
791eca8f4e7b91b842a9834a2bb1ac2c5bc31dad5cae99068de2da0685d2b522

SHA512
7388dec4159bde2b021e1acbec1588774968bd44ede487c5512a754374287d7c794eab898af138748731dcd3cafa388fd6bc905c27d7a9f1c5d4fef0c6cdc311

Download Submit
C:\Windows\System32\egKTUrc.exe

Filesize
1.1MB

MD5
a757619117c3a6022b44cb1ebbf5369b

SHA1
c80d99026fcb3e9d61dffc39357b48921d4af32d

SHA256
416299dc65281e855c0723d0873c8e9e7e83c00b6a896d6fd3a7a656fb0fb703

SHA512
c731ca03f0a0db67c3a1e2d12f76d8c8807577b7568448f9a2302ac56792bfd9f7b776c9b8683eaf3c7c3989c8f91fe1fec9632fb1531bd9bb1c4f50ac4810de

Download Submit
C:\Windows\System32\eilCapc.exe

Filesize
1.1MB

MD5
a407ffc577f7fe94b501c1df7f6ca1cb

SHA1
c77ccbc71bc925307a3042c2c7f33bbe78d9a79a

SHA256
76bc03a48eae726874c79400beaceb1e0132a58cac1b698e1e016617156d93b0

SHA512
8bc2e55e063aa650eafee42f20806d6e2b0ddc964f4ad817bfcc765c1aaff6237f2940b5a702516104966cf8aa7b420c74d74eca67214a8d03785fa72dacd877

Download Submit
C:\Windows\System32\heMJLTG.exe

Filesize
1.1MB

MD5
c1fba1f940c399f1fd2cb5f256501c89

SHA1
901403b2ce54c1ae38e352c44ae4164d04d60137

SHA256
014a48b01b41dfe419ccf4c1c09ca27e7337a3e877f5e7e2bff62a304a0224a3

SHA512
27f4f01f94cc29074cd1c5022b64a05e3615c154da0a02cc260b9873542434f2d335533b0b2b6b7731292ccd491d59a67edf605bd08ef0b53bfb8e9902e24fb9

Download Submit
C:\Windows\System32\jCfHupd.exe

Filesize
1.1MB

MD5
c56bdde65fd26ca1f62406bdcf6a6fc9

SHA1
5fe369dab10091fe3f003a48e592132f50b51ec9

SHA256
754bf07e1cb081966fb3c54998de1364ed82ed818284d8a595b917f88a6b4ed9

SHA512
78bdcfd13cbf104f0a4722eedd72bb53c8e39d5ce558d8b20adcc95b292bc83761e77667ee4a0ee4562db3ea824b81e8e88ec11d378434e5251d7a289d21ff67

Download Submit
C:\Windows\System32\laEedcW.exe

Filesize
1.1MB

MD5
a6c0ab56a51545c2db4aff06a0e059c8

SHA1
13956b824882e4286b858adb02b5f757cbdb417e

SHA256
2450813e3ef64588939a656fe2629cbd8f68f369875dce137bd8ce738f369197

SHA512
d93697d3c1f5a24e40c8917b669367bf88087e2cffb8f86bb673cdd2999eab20ed2ec5c5b59f0f2ac85789fdcd6b3efe36ecd25a9b267e3f78f8d576dd4c6de1

Download Submit
C:\Windows\System32\nBkBBYT.exe

Filesize
1.1MB

MD5
5054c17fb29a8e5e1d93a377fc5c0c81

SHA1
a859bbbb4a5783594fb8a3158be533855a440139

SHA256
a4ea3b32436831dfddd2e3ef1b5359540d0aeee64401bf23d75891d4deae4a71

SHA512
62500a62472b37f249b2102729a7d3e32fdb0d5c76cd597224e85054591f6353728b9de651f66121e972377cf21f20cb8a96edf412484eec7c9a2615aea95e5a

Download Submit
C:\Windows\System32\qfNcYjI.exe

Filesize
1.1MB

MD5
569f3ae7d737aff587fd909ecaabcbd1

SHA1
57a93feae2f7ad6377c26df2bd947d1c82fc16e6

SHA256
b9bb21b732ed3342255314009a6aba7f2103c25d5b9097500407c42ea1af4de7

SHA512
181b60be9d8ca57f341e9da3aa18939e4e61800bf0b9711837949725900e47a6e2b40e9ad41b5ae444299ed8c76942d6738a1559325121ab3f6037b55cfb22a0

Download Submit
C:\Windows\System32\qrKpAMo.exe

Filesize
1.1MB

MD5
93dff58ae6de9cac6455c0e53bdd1610

SHA1
fbef0ecf3ec2779b4ed79b7e9f0d573a0c5fd259

SHA256
aa01000a7e15d38dde32e775f32f49cec0d6264a8d7e0b2677a247f26ece0260

SHA512
77e46270c7c5a69ca552bd0f0cd07bf5b6eb3740f4d2aa7df1a8b7638f7819a1b74ce2b48ad5bc69605180be8d424448e86bf6e60f0403b0f184a2bf581c648d

Download Submit
C:\Windows\System32\tezAZxV.exe

Filesize
1.1MB

MD5
ff99765eb22ecfc8d5b6f187c69f4b8f

SHA1
3642f6b953d8902cbbb94a8928c4227fab88db1c

SHA256
304c4ec3cbbd17af5bb6dacbb9a8c05d2240204e4778feed6d844fe34378ff01

SHA512
f0d6bf8df2d2b905d73f0f75390edfca1ad690078ef0bab951b2f5dafc4a55d8d03a6209bc8275fe8e23007b9863dd937aaaa0c77928273d73a4b914f38bb9aa

Download Submit
C:\Windows\System32\wPWTCvW.exe

Filesize
1.1MB

MD5
dc65b5d1f85f296e1cea56abcf2e58ed

SHA1
fff43e59e048ca0c62472128ebd00393bec58ebb

SHA256
614437aa32685e1b4f6d7bd78572651de5006dade7c521f26bab8401bff4a979

SHA512
6294395d48bcda9686324dd41e187d4fa5d7580ef781ef25454d6aa2de131641822d1ade1f00105848d7fd81aab1522c944109ff19ac3ff35f19a46886af4575

Download Submit
C:\Windows\System32\xfsylXa.exe

Filesize
1.1MB

MD5
2b542397688102adc5aa27ee63302a3d

SHA1
55df23da0760dedf78446acb2902572a0e5a42ec

SHA256
fac012b3964cb180c7ce8ec3a184afdcea36c80dea37ccda0192749c3366d6b3

SHA512
c22f3aaa3ca51bf08547d9a0b5f847ff7563db29ead7d95cbd258a743b54bf28ac82194857d8cf4e10deb8d24e4b5f2d66de3590f00d4fe6d6b5ab52ad23b59f

Download Submit
C:\Windows\System32\xyGGFHT.exe

Filesize
1.1MB

MD5
f804d21858c339044f0e6acafe61ecfc

SHA1
b39418d14b534827523417adccc80daf8501a3ac

SHA256
e8d8871256dd844ee1beeb87c7f1ed88a25225adba904ba12a1a6a80efb659ef

SHA512
c289f26c1a697970b9583029d24e16ddbb4e37bddf3a70c17fa123e0e19a73327545555aecd2eb21b544c04d79d5361302cee7463de1b1ee5cc44650f85a45ef

Download Submit
C:\Windows\System32\yGwCsuj.exe

Filesize
1.1MB

MD5
60aa572a52a5af297321dc93d7d17a48

SHA1
1ed9e9078cd28feba3d52bbcf1c2e628ce178b4d

SHA256
9d0fb6947ffb7dab91ed3791adf70af35e2f4cf2387b3eb86078be0267da59cc

SHA512
9a532fff8baba77fe87ea7fa6905fd0e533c8e1fd1c45761de4dc1232f89843463197e60039015a915f8fde3c2bdb033b738d163f89d78c5c3fb420fd9c81a87

Download Submit
C:\Windows\System32\zezEiWI.exe

Filesize
1.1MB

MD5
89b73c05bb180efd2505703a7830fc5a

SHA1
91b57545e9e43921591268499732953b16fd0dbb

SHA256
0f22c3c71c1da85bfff310f3cc2b7eab2121d9340a01992bd785d6bd7ed244c2

SHA512
29cb680a61e9aab9d9691b034a4ac18ea874bf0372f9e9106bfae9259464a5b4440dc1868bd3535a2281750c7818c41b8aadb7145eef011ff5588738acf1de65

Download Submit
memory/316-2026-0x00007FF61BCE0000-0x00007FF61C0D1000-memory.dmp

Filesize
3.9MB

Download
memory/316-2047-0x00007FF61BCE0000-0x00007FF61C0D1000-memory.dmp

Filesize
3.9MB

Download
memory/316-54-0x00007FF61BCE0000-0x00007FF61C0D1000-memory.dmp

Filesize
3.9MB

Download
memory/380-1991-0x00007FF7619B0000-0x00007FF761DA1000-memory.dmp

Filesize
3.9MB

Download
memory/380-41-0x00007FF7619B0000-0x00007FF761DA1000-memory.dmp

Filesize
3.9MB

Download
memory/380-2039-0x00007FF7619B0000-0x00007FF761DA1000-memory.dmp

Filesize
3.9MB

Download
memory/848-2068-0x00007FF687230000-0x00007FF687621000-memory.dmp

Filesize
3.9MB

Download
memory/848-377-0x00007FF687230000-0x00007FF687621000-memory.dmp

Filesize
3.9MB

Download
memory/928-2053-0x00007FF7BFC50000-0x00007FF7C0041000-memory.dmp

Filesize
3.9MB

Download
memory/928-443-0x00007FF7BFC50000-0x00007FF7C0041000-memory.dmp

Filesize
3.9MB

Download
memory/1184-2051-0x00007FF6E54B0000-0x00007FF6E58A1000-memory.dmp

Filesize
3.9MB

Download
memory/1184-330-0x00007FF6E54B0000-0x00007FF6E58A1000-memory.dmp

Filesize
3.9MB

Download
memory/1184-2027-0x00007FF6E54B0000-0x00007FF6E58A1000-memory.dmp

Filesize
3.9MB

Download
memory/1280-48-0x00007FF6F81B0000-0x00007FF6F85A1000-memory.dmp

Filesize
3.9MB

Download
memory/1280-2043-0x00007FF6F81B0000-0x00007FF6F85A1000-memory.dmp

Filesize
3.9MB

Download
memory/1360-51-0x00007FF631260000-0x00007FF631651000-memory.dmp

Filesize
3.9MB

Download
memory/1360-2037-0x00007FF631260000-0x00007FF631651000-memory.dmp

Filesize
3.9MB

Download
memory/1556-2033-0x00007FF7C94C0000-0x00007FF7C98B1000-memory.dmp

Filesize
3.9MB

Download
memory/1556-17-0x00007FF7C94C0000-0x00007FF7C98B1000-memory.dmp

Filesize
3.9MB

Download
memory/2036-2060-0x00007FF6CC9E0000-0x00007FF6CCDD1000-memory.dmp

Filesize
3.9MB

Download
memory/2036-352-0x00007FF6CC9E0000-0x00007FF6CCDD1000-memory.dmp

Filesize
3.9MB

Download
memory/2044-340-0x00007FF6036E0000-0x00007FF603AD1000-memory.dmp

Filesize
3.9MB

Download
memory/2044-2061-0x00007FF6036E0000-0x00007FF603AD1000-memory.dmp

Filesize
3.9MB

Download
memory/2104-2077-0x00007FF6BAF20000-0x00007FF6BB311000-memory.dmp

Filesize
3.9MB

Download
memory/2104-410-0x00007FF6BAF20000-0x00007FF6BB311000-memory.dmp

Filesize
3.9MB

Download
memory/2120-354-0x00007FF617010000-0x00007FF617401000-memory.dmp

Filesize
3.9MB

Download
memory/2120-2055-0x00007FF617010000-0x00007FF617401000-memory.dmp

Filesize
3.9MB

Download
memory/2196-2041-0x00007FF7362E0000-0x00007FF7366D1000-memory.dmp

Filesize
3.9MB

Download
memory/2196-44-0x00007FF7362E0000-0x00007FF7366D1000-memory.dmp

Filesize
3.9MB

Download
memory/2340-2049-0x00007FF6B9E70000-0x00007FF6BA261000-memory.dmp

Filesize
3.9MB

Download
memory/2340-1993-0x00007FF6B9E70000-0x00007FF6BA261000-memory.dmp

Filesize
3.9MB

Download
memory/2340-49-0x00007FF6B9E70000-0x00007FF6BA261000-memory.dmp

Filesize
3.9MB

Download
memory/2644-2057-0x00007FF6610B0000-0x00007FF6614A1000-memory.dmp

Filesize
3.9MB

Download
memory/2644-355-0x00007FF6610B0000-0x00007FF6614A1000-memory.dmp

Filesize
3.9MB

Download
memory/2908-30-0x00007FF666C60000-0x00007FF667051000-memory.dmp

Filesize
3.9MB

Download
memory/2908-2035-0x00007FF666C60000-0x00007FF667051000-memory.dmp

Filesize
3.9MB

Download
memory/3192-2063-0x00007FF7E3360000-0x00007FF7E3751000-memory.dmp

Filesize
3.9MB

Download
memory/3192-359-0x00007FF7E3360000-0x00007FF7E3751000-memory.dmp

Filesize
3.9MB

Download
memory/3728-431-0x00007FF6797C0000-0x00007FF679BB1000-memory.dmp

Filesize
3.9MB

Download
memory/3728-2106-0x00007FF6797C0000-0x00007FF679BB1000-memory.dmp

Filesize
3.9MB

Download
memory/3896-390-0x00007FF6E63F0000-0x00007FF6E67E1000-memory.dmp

Filesize
3.9MB

Download
memory/3896-2071-0x00007FF6E63F0000-0x00007FF6E67E1000-memory.dmp

Filesize
3.9MB

Download
memory/4136-0-0x00007FF7F85A0000-0x00007FF7F8991000-memory.dmp

Filesize
3.9MB

Download
memory/4136-1-0x000002592C2C0000-0x000002592C2D0000-memory.dmp

Filesize
64KB

Download
memory/4136-1990-0x00007FF7F85A0000-0x00007FF7F8991000-memory.dmp

Filesize
3.9MB

Download
memory/4244-2045-0x00007FF6B0900000-0x00007FF6B0CF1000-memory.dmp

Filesize
3.9MB

Download
memory/4244-1992-0x00007FF6B0900000-0x00007FF6B0CF1000-memory.dmp

Filesize
3.9MB

Download
memory/4244-42-0x00007FF6B0900000-0x00007FF6B0CF1000-memory.dmp

Filesize
3.9MB

Download
memory/4512-424-0x00007FF673A60000-0x00007FF673E51000-memory.dmp

Filesize
3.9MB

Download
memory/4512-2075-0x00007FF673A60000-0x00007FF673E51000-memory.dmp

Filesize
3.9MB

Download
memory/4816-399-0x00007FF70F340000-0x00007FF70F731000-memory.dmp

Filesize
3.9MB

Download
memory/4816-2074-0x00007FF70F340000-0x00007FF70F731000-memory.dmp

Filesize
3.9MB

Download
memory/4892-384-0x00007FF6F82F0000-0x00007FF6F86E1000-memory.dmp

Filesize
3.9MB

Download
memory/4892-2066-0x00007FF6F82F0000-0x00007FF6F86E1000-memory.dmp

Filesize
3.9MB

Download
memory/4996-373-0x00007FF61FDD0000-0x00007FF6201C1000-memory.dmp

Filesize
3.9MB

Download
memory/4996-2070-0x00007FF61FDD0000-0x00007FF6201C1000-memory.dmp

Filesize
3.9MB

Download