xmrig | 742f8db386d595ef211287a1efb5564f39cb329667f788f3599282ac78ff3d07

Analysis

max time kernel
123s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
28/07/2024, 00:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
Size

1.4MB
MD5

04489f0ca816b302863ac10ab9ab4f15
SHA1

08288f231a9b6199df73e4cc3b76f8c928f1d5c4
SHA256

742f8db386d595ef211287a1efb5564f39cb329667f788f3599282ac78ff3d07
SHA512

dfa12e679afbcd2e2713d976cdfe3d5b8e3d2434cb7271ca042f9543259db512393c07055ab0600dbbcf36b2b92776e80101f814414fc06cedd42d773db2a518
SSDEEP

24576:JanwhSe11QSONCpGJCjETPlGC78XIO9C1MKTbcMfHhGjw2qPICr:knw9oUUEEDlGUjc2HhG82qwM

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/1320-120-0x00007FF652C40000-0x00007FF653031000-memory.dmp	xmrig
behavioral2/memory/5108-134-0x00007FF76B5C0000-0x00007FF76B9B1000-memory.dmp	xmrig
behavioral2/memory/4712-170-0x00007FF775DF0000-0x00007FF7761E1000-memory.dmp	xmrig
behavioral2/memory/716-174-0x00007FF675540000-0x00007FF675931000-memory.dmp	xmrig
behavioral2/memory/5104-167-0x00007FF660DF0000-0x00007FF6611E1000-memory.dmp	xmrig
behavioral2/memory/1084-163-0x00007FF6499E0000-0x00007FF649DD1000-memory.dmp	xmrig
behavioral2/memory/5092-160-0x00007FF79E610000-0x00007FF79EA01000-memory.dmp	xmrig
behavioral2/memory/1780-156-0x00007FF637BE0000-0x00007FF637FD1000-memory.dmp	xmrig
behavioral2/memory/4648-153-0x00007FF63E270000-0x00007FF63E661000-memory.dmp	xmrig
behavioral2/memory/4624-152-0x00007FF6C9680000-0x00007FF6C9A71000-memory.dmp	xmrig
behavioral2/memory/1140-146-0x00007FF61CE10000-0x00007FF61D201000-memory.dmp	xmrig
behavioral2/memory/4664-143-0x00007FF6B7D40000-0x00007FF6B8131000-memory.dmp	xmrig
behavioral2/memory/3896-140-0x00007FF6908D0000-0x00007FF690CC1000-memory.dmp	xmrig
behavioral2/memory/3280-126-0x00007FF66C5D0000-0x00007FF66C9C1000-memory.dmp	xmrig
behavioral2/memory/4136-125-0x00007FF63AA60000-0x00007FF63AE51000-memory.dmp	xmrig
behavioral2/memory/1560-124-0x00007FF7B51B0000-0x00007FF7B55A1000-memory.dmp	xmrig
behavioral2/memory/2132-123-0x00007FF64AD40000-0x00007FF64B131000-memory.dmp	xmrig
behavioral2/memory/1224-108-0x00007FF600C60000-0x00007FF601051000-memory.dmp	xmrig
behavioral2/memory/704-67-0x00007FF79C450000-0x00007FF79C841000-memory.dmp	xmrig
behavioral2/memory/4940-1981-0x00007FF6887B0000-0x00007FF688BA1000-memory.dmp	xmrig
behavioral2/memory/5116-1982-0x00007FF784280000-0x00007FF784671000-memory.dmp	xmrig
behavioral2/memory/3128-1983-0x00007FF67E910000-0x00007FF67ED01000-memory.dmp	xmrig
behavioral2/memory/2760-1984-0x00007FF768F50000-0x00007FF769341000-memory.dmp	xmrig
behavioral2/memory/1140-1989-0x00007FF61CE10000-0x00007FF61D201000-memory.dmp	xmrig
behavioral2/memory/4668-2006-0x00007FF71A670000-0x00007FF71AA61000-memory.dmp	xmrig
behavioral2/memory/704-2008-0x00007FF79C450000-0x00007FF79C841000-memory.dmp	xmrig
behavioral2/memory/4940-2010-0x00007FF6887B0000-0x00007FF688BA1000-memory.dmp	xmrig
behavioral2/memory/5092-2012-0x00007FF79E610000-0x00007FF79EA01000-memory.dmp	xmrig
behavioral2/memory/3128-2014-0x00007FF67E910000-0x00007FF67ED01000-memory.dmp	xmrig
behavioral2/memory/1780-2016-0x00007FF637BE0000-0x00007FF637FD1000-memory.dmp	xmrig
behavioral2/memory/4136-2026-0x00007FF63AA60000-0x00007FF63AE51000-memory.dmp	xmrig
behavioral2/memory/5116-2028-0x00007FF784280000-0x00007FF784671000-memory.dmp	xmrig
behavioral2/memory/2132-2024-0x00007FF64AD40000-0x00007FF64B131000-memory.dmp	xmrig
behavioral2/memory/2760-2023-0x00007FF768F50000-0x00007FF769341000-memory.dmp	xmrig
behavioral2/memory/1320-2032-0x00007FF652C40000-0x00007FF653031000-memory.dmp	xmrig
behavioral2/memory/3280-2031-0x00007FF66C5D0000-0x00007FF66C9C1000-memory.dmp	xmrig
behavioral2/memory/1224-2021-0x00007FF600C60000-0x00007FF601051000-memory.dmp	xmrig
behavioral2/memory/1560-2019-0x00007FF7B51B0000-0x00007FF7B55A1000-memory.dmp	xmrig
behavioral2/memory/5108-2039-0x00007FF76B5C0000-0x00007FF76B9B1000-memory.dmp	xmrig
behavioral2/memory/4624-2046-0x00007FF6C9680000-0x00007FF6C9A71000-memory.dmp	xmrig
behavioral2/memory/4648-2050-0x00007FF63E270000-0x00007FF63E661000-memory.dmp	xmrig
behavioral2/memory/716-2048-0x00007FF675540000-0x00007FF675931000-memory.dmp	xmrig
behavioral2/memory/4712-2044-0x00007FF775DF0000-0x00007FF7761E1000-memory.dmp	xmrig
behavioral2/memory/5104-2042-0x00007FF660DF0000-0x00007FF6611E1000-memory.dmp	xmrig
behavioral2/memory/3896-2041-0x00007FF6908D0000-0x00007FF690CC1000-memory.dmp	xmrig
behavioral2/memory/1084-2035-0x00007FF6499E0000-0x00007FF649DD1000-memory.dmp	xmrig
behavioral2/memory/4664-2037-0x00007FF6B7D40000-0x00007FF6B8131000-memory.dmp	xmrig
behavioral2/memory/1140-2167-0x00007FF61CE10000-0x00007FF61D201000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4668	vHycyzF.exe
4940	tvECiyJ.exe
5116	vZSQpOQ.exe
3128	peYKUhr.exe
704	lELKKTM.exe
1780	QUabiDm.exe
2760	DfxuNUb.exe
5092	BnnOMxB.exe
1224	PUZkjCj.exe
1320	WwseTDr.exe
2132	EmqRuka.exe
1560	YIhlwNj.exe
4136	ZzsDpJP.exe
1084	VBqGdiV.exe
3280	JhGHzhD.exe
5104	IcLfWRp.exe
5108	XLLveJz.exe
3896	DLJfLbM.exe
4664	vBQsJJh.exe
4712	HcyMqjQ.exe
1140	LwwHPVJ.exe
4624	bIjHXty.exe
4648	NuJBMAu.exe
716	VCWTsWw.exe
2856	LVLWnXg.exe
64	RyUNIYG.exe
1856	WvYcgra.exe
4612	UrBVPxK.exe
1616	GebCIcG.exe
3036	TKvJVMF.exe
220	zKRvbhI.exe
924	AHzMTtY.exe
4028	jYgbTxD.exe
4632	ehtrwKk.exe
2380	bqfiEtF.exe
1424	QsWZsuj.exe
1772	JKqHTMe.exe
3780	xDSGocJ.exe
428	MIFltfa.exe
1864	EreBdxN.exe
972	KDWDuEw.exe
2300	QSgkpdW.exe
4732	ZugwAlI.exe
4496	nUnDdxB.exe
1692	RPoDXZD.exe
2740	KwChvMA.exe
4356	dUThcYK.exe
4836	fOWrDxK.exe
868	onNVVOp.exe
3996	aTCEALW.exe
3156	WOmPgcK.exe
2620	nlxeRcK.exe
2324	QDpAnoV.exe
3584	oBVwTJw.exe
4992	pylvaii.exe
4908	DlwMoPN.exe
4396	ZCReqce.exe
632	GrBRbDD.exe
4132	ZBCPTkB.exe
1776	OQdljCr.exe
532	ojqzKWF.exe
4652	dEirdAi.exe
2008	wkbcjiU.exe
2228	cxRaPlc.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2212-0-0x00007FF6EBD10000-0x00007FF6EC101000-memory.dmp	upx
behavioral2/memory/4668-11-0x00007FF71A670000-0x00007FF71AA61000-memory.dmp	upx
behavioral2/files/0x0007000000023456-23.dat	upx
behavioral2/memory/5116-30-0x00007FF784280000-0x00007FF784671000-memory.dmp	upx
behavioral2/files/0x0007000000023459-41.dat	upx
behavioral2/memory/2760-79-0x00007FF768F50000-0x00007FF769341000-memory.dmp	upx
behavioral2/files/0x0007000000023463-91.dat	upx
behavioral2/files/0x0007000000023462-100.dat	upx
behavioral2/memory/1320-120-0x00007FF652C40000-0x00007FF653031000-memory.dmp	upx
behavioral2/memory/5108-134-0x00007FF76B5C0000-0x00007FF76B9B1000-memory.dmp	upx
behavioral2/files/0x000700000002346b-141.dat	upx
behavioral2/files/0x0008000000023450-154.dat	upx
behavioral2/memory/4712-170-0x00007FF775DF0000-0x00007FF7761E1000-memory.dmp	upx
behavioral2/files/0x0007000000023471-185.dat	upx
behavioral2/files/0x000700000002346f-182.dat	upx
behavioral2/files/0x0007000000023470-180.dat	upx
behavioral2/files/0x000700000002346e-177.dat	upx
behavioral2/memory/716-174-0x00007FF675540000-0x00007FF675931000-memory.dmp	upx
behavioral2/files/0x000700000002346d-171.dat	upx
behavioral2/memory/5104-167-0x00007FF660DF0000-0x00007FF6611E1000-memory.dmp	upx
behavioral2/memory/1084-163-0x00007FF6499E0000-0x00007FF649DD1000-memory.dmp	upx
behavioral2/memory/5092-160-0x00007FF79E610000-0x00007FF79EA01000-memory.dmp	upx
behavioral2/files/0x000700000002346c-157.dat	upx
behavioral2/memory/1780-156-0x00007FF637BE0000-0x00007FF637FD1000-memory.dmp	upx
behavioral2/memory/4648-153-0x00007FF63E270000-0x00007FF63E661000-memory.dmp	upx
behavioral2/memory/4624-152-0x00007FF6C9680000-0x00007FF6C9A71000-memory.dmp	upx
behavioral2/files/0x0007000000023466-149.dat	upx
behavioral2/memory/1140-146-0x00007FF61CE10000-0x00007FF61D201000-memory.dmp	upx
behavioral2/memory/4664-143-0x00007FF6B7D40000-0x00007FF6B8131000-memory.dmp	upx
behavioral2/memory/3896-140-0x00007FF6908D0000-0x00007FF690CC1000-memory.dmp	upx
behavioral2/files/0x0007000000023467-132.dat	upx
behavioral2/files/0x0007000000023465-130.dat	upx
behavioral2/files/0x0007000000023469-129.dat	upx
behavioral2/files/0x000700000002346a-128.dat	upx
behavioral2/files/0x0007000000023468-127.dat	upx
behavioral2/memory/3280-126-0x00007FF66C5D0000-0x00007FF66C9C1000-memory.dmp	upx
behavioral2/memory/4136-125-0x00007FF63AA60000-0x00007FF63AE51000-memory.dmp	upx
behavioral2/memory/1560-124-0x00007FF7B51B0000-0x00007FF7B55A1000-memory.dmp	upx
behavioral2/memory/2132-123-0x00007FF64AD40000-0x00007FF64B131000-memory.dmp	upx
behavioral2/files/0x0007000000023464-114.dat	upx
behavioral2/memory/1224-108-0x00007FF600C60000-0x00007FF601051000-memory.dmp	upx
behavioral2/files/0x0007000000023461-89.dat	upx
behavioral2/files/0x000700000002345a-85.dat	upx
behavioral2/files/0x0007000000023460-83.dat	upx
behavioral2/files/0x000700000002345b-75.dat	upx
behavioral2/files/0x000700000002345c-74.dat	upx
behavioral2/files/0x000700000002345e-72.dat	upx
behavioral2/files/0x000700000002345d-70.dat	upx
behavioral2/files/0x0007000000023458-69.dat	upx
behavioral2/memory/704-67-0x00007FF79C450000-0x00007FF79C841000-memory.dmp	upx
behavioral2/files/0x000700000002345f-66.dat	upx
behavioral2/files/0x0007000000023457-49.dat	upx
behavioral2/files/0x0007000000023455-39.dat	upx
behavioral2/memory/3128-37-0x00007FF67E910000-0x00007FF67ED01000-memory.dmp	upx
behavioral2/files/0x0007000000023454-29.dat	upx
behavioral2/memory/4940-16-0x00007FF6887B0000-0x00007FF688BA1000-memory.dmp	upx
behavioral2/files/0x0007000000023453-21.dat	upx
behavioral2/files/0x000800000002344c-6.dat	upx
behavioral2/memory/4940-1981-0x00007FF6887B0000-0x00007FF688BA1000-memory.dmp	upx
behavioral2/memory/5116-1982-0x00007FF784280000-0x00007FF784671000-memory.dmp	upx
behavioral2/memory/3128-1983-0x00007FF67E910000-0x00007FF67ED01000-memory.dmp	upx
behavioral2/memory/2760-1984-0x00007FF768F50000-0x00007FF769341000-memory.dmp	upx
behavioral2/memory/1140-1989-0x00007FF61CE10000-0x00007FF61D201000-memory.dmp	upx
behavioral2/memory/4668-2006-0x00007FF71A670000-0x00007FF71AA61000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\NzFoekT.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\MbfybfM.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\BeKdSxI.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\SbbsUXR.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\tgWZTmx.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\QfRtWhK.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\NlObHbs.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\YHeceHY.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\deJRVlv.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\WvYcgra.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\OQdljCr.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\UnQBkbf.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\pcjOTdV.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\xjNPCLs.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\SWkztvz.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\UrNMhQq.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\scWerVD.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\knlhRZx.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\HHFTxsE.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\xqTpyik.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\jCARZoW.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\NITfvpa.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\DaKGXvS.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\OxLQYtH.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\WcdTlaV.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\hFlZrXA.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\BKQtLYe.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\LnfYYjo.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\pgSFcjk.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\yZYJDRc.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\lcFGXfS.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\EJssASl.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\RNliWUG.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\KhwabuQ.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\PfHJLQF.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\YAtBuSe.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\VGPlVPD.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\oVPWeDK.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\yahhbYb.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\cAbcHhY.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\snsWyOL.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\uZmMDyu.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\ibXPOcd.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\bJGNIdV.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\GiMEOUN.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\ncUOGHm.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\vBQsJJh.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\NXkiBiB.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\EGtXxKg.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\LCVkxcg.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\XfNjWgF.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\mnkRptr.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\JhGHzhD.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\dQJseVs.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\XFRfvEi.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\XFMHEvS.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\oPZFWwg.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\zoLXEYF.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\QtTWUzo.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\yuzUDZR.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\LAcuvrh.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\RkUtCfX.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\IprjIKp.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
File created	C:\Windows\System32\ICSHhik.exe	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 4668	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	85
PID 2212 wrote to memory of 4668	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	85
PID 2212 wrote to memory of 4940	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	86
PID 2212 wrote to memory of 4940	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	86
PID 2212 wrote to memory of 5116	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	87
PID 2212 wrote to memory of 5116	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	87
PID 2212 wrote to memory of 3128	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	88
PID 2212 wrote to memory of 3128	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	88
PID 2212 wrote to memory of 704	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	89
PID 2212 wrote to memory of 704	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	89
PID 2212 wrote to memory of 1780	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	90
PID 2212 wrote to memory of 1780	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	90
PID 2212 wrote to memory of 2760	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	91
PID 2212 wrote to memory of 2760	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	91
PID 2212 wrote to memory of 5092	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	92
PID 2212 wrote to memory of 5092	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	92
PID 2212 wrote to memory of 1084	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	93
PID 2212 wrote to memory of 1084	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	93
PID 2212 wrote to memory of 1224	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	94
PID 2212 wrote to memory of 1224	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	94
PID 2212 wrote to memory of 1320	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	95
PID 2212 wrote to memory of 1320	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	95
PID 2212 wrote to memory of 2132	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	96
PID 2212 wrote to memory of 2132	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	96
PID 2212 wrote to memory of 1560	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	97
PID 2212 wrote to memory of 1560	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	97
PID 2212 wrote to memory of 4136	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	98
PID 2212 wrote to memory of 4136	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	98
PID 2212 wrote to memory of 3280	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	99
PID 2212 wrote to memory of 3280	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	99
PID 2212 wrote to memory of 5104	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	100
PID 2212 wrote to memory of 5104	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	100
PID 2212 wrote to memory of 5108	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	101
PID 2212 wrote to memory of 5108	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	101
PID 2212 wrote to memory of 3896	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	102
PID 2212 wrote to memory of 3896	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	102
PID 2212 wrote to memory of 4664	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	103
PID 2212 wrote to memory of 4664	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	103
PID 2212 wrote to memory of 4712	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	104
PID 2212 wrote to memory of 4712	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	104
PID 2212 wrote to memory of 2856	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	105
PID 2212 wrote to memory of 2856	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	105
PID 2212 wrote to memory of 1140	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	106
PID 2212 wrote to memory of 1140	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	106
PID 2212 wrote to memory of 4624	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	107
PID 2212 wrote to memory of 4624	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	107
PID 2212 wrote to memory of 4648	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	108
PID 2212 wrote to memory of 4648	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	108
PID 2212 wrote to memory of 716	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	109
PID 2212 wrote to memory of 716	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	109
PID 2212 wrote to memory of 64	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	110
PID 2212 wrote to memory of 64	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	110
PID 2212 wrote to memory of 1856	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	111
PID 2212 wrote to memory of 1856	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	111
PID 2212 wrote to memory of 4612	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	112
PID 2212 wrote to memory of 4612	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	112
PID 2212 wrote to memory of 1616	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	113
PID 2212 wrote to memory of 1616	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	113
PID 2212 wrote to memory of 3036	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	114
PID 2212 wrote to memory of 3036	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	114
PID 2212 wrote to memory of 220	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	115
PID 2212 wrote to memory of 220	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	115
PID 2212 wrote to memory of 924	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	116
PID 2212 wrote to memory of 924	2212	04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04489f0ca816b302863ac10ab9ab4f15_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\System32\vHycyzF.exe
  C:\Windows\System32\vHycyzF.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System32\tvECiyJ.exe
  C:\Windows\System32\tvECiyJ.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System32\vZSQpOQ.exe
  C:\Windows\System32\vZSQpOQ.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System32\peYKUhr.exe
  C:\Windows\System32\peYKUhr.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System32\lELKKTM.exe
  C:\Windows\System32\lELKKTM.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System32\QUabiDm.exe
  C:\Windows\System32\QUabiDm.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System32\DfxuNUb.exe
  C:\Windows\System32\DfxuNUb.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System32\BnnOMxB.exe
  C:\Windows\System32\BnnOMxB.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System32\VBqGdiV.exe
  C:\Windows\System32\VBqGdiV.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System32\PUZkjCj.exe
  C:\Windows\System32\PUZkjCj.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System32\WwseTDr.exe
  C:\Windows\System32\WwseTDr.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System32\EmqRuka.exe
  C:\Windows\System32\EmqRuka.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System32\YIhlwNj.exe
  C:\Windows\System32\YIhlwNj.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System32\ZzsDpJP.exe
  C:\Windows\System32\ZzsDpJP.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System32\JhGHzhD.exe
  C:\Windows\System32\JhGHzhD.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System32\IcLfWRp.exe
  C:\Windows\System32\IcLfWRp.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System32\XLLveJz.exe
  C:\Windows\System32\XLLveJz.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System32\DLJfLbM.exe
  C:\Windows\System32\DLJfLbM.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System32\vBQsJJh.exe
  C:\Windows\System32\vBQsJJh.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System32\HcyMqjQ.exe
  C:\Windows\System32\HcyMqjQ.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System32\LVLWnXg.exe
  C:\Windows\System32\LVLWnXg.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System32\LwwHPVJ.exe
  C:\Windows\System32\LwwHPVJ.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System32\bIjHXty.exe
  C:\Windows\System32\bIjHXty.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System32\NuJBMAu.exe
  C:\Windows\System32\NuJBMAu.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System32\VCWTsWw.exe
  C:\Windows\System32\VCWTsWw.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System32\RyUNIYG.exe
  C:\Windows\System32\RyUNIYG.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System32\WvYcgra.exe
  C:\Windows\System32\WvYcgra.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System32\UrBVPxK.exe
  C:\Windows\System32\UrBVPxK.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System32\GebCIcG.exe
  C:\Windows\System32\GebCIcG.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System32\TKvJVMF.exe
  C:\Windows\System32\TKvJVMF.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System32\zKRvbhI.exe
  C:\Windows\System32\zKRvbhI.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System32\AHzMTtY.exe
  C:\Windows\System32\AHzMTtY.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System32\jYgbTxD.exe
  C:\Windows\System32\jYgbTxD.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System32\ehtrwKk.exe
  C:\Windows\System32\ehtrwKk.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System32\bqfiEtF.exe
  C:\Windows\System32\bqfiEtF.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System32\QsWZsuj.exe
  C:\Windows\System32\QsWZsuj.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System32\JKqHTMe.exe
  C:\Windows\System32\JKqHTMe.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System32\xDSGocJ.exe
  C:\Windows\System32\xDSGocJ.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System32\MIFltfa.exe
  C:\Windows\System32\MIFltfa.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System32\EreBdxN.exe
  C:\Windows\System32\EreBdxN.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System32\KDWDuEw.exe
  C:\Windows\System32\KDWDuEw.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System32\QSgkpdW.exe
  C:\Windows\System32\QSgkpdW.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System32\ZugwAlI.exe
  C:\Windows\System32\ZugwAlI.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System32\nUnDdxB.exe
  C:\Windows\System32\nUnDdxB.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System32\RPoDXZD.exe
  C:\Windows\System32\RPoDXZD.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System32\KwChvMA.exe
  C:\Windows\System32\KwChvMA.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System32\dUThcYK.exe
  C:\Windows\System32\dUThcYK.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System32\fOWrDxK.exe
  C:\Windows\System32\fOWrDxK.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System32\onNVVOp.exe
  C:\Windows\System32\onNVVOp.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System32\aTCEALW.exe
  C:\Windows\System32\aTCEALW.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System32\WOmPgcK.exe
  C:\Windows\System32\WOmPgcK.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System32\nlxeRcK.exe
  C:\Windows\System32\nlxeRcK.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System32\QDpAnoV.exe
  C:\Windows\System32\QDpAnoV.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System32\oBVwTJw.exe
  C:\Windows\System32\oBVwTJw.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System32\pylvaii.exe
  C:\Windows\System32\pylvaii.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System32\DlwMoPN.exe
  C:\Windows\System32\DlwMoPN.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System32\ZCReqce.exe
  C:\Windows\System32\ZCReqce.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System32\GrBRbDD.exe
  C:\Windows\System32\GrBRbDD.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System32\ZBCPTkB.exe
  C:\Windows\System32\ZBCPTkB.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System32\OQdljCr.exe
  C:\Windows\System32\OQdljCr.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System32\ojqzKWF.exe
  C:\Windows\System32\ojqzKWF.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System32\dEirdAi.exe
  C:\Windows\System32\dEirdAi.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System32\wkbcjiU.exe
  C:\Windows\System32\wkbcjiU.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System32\cxRaPlc.exe
  C:\Windows\System32\cxRaPlc.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System32\tbrvcqR.exe
  C:\Windows\System32\tbrvcqR.exe
  2⤵
  PID:4788
- C:\Windows\System32\jpKxMOT.exe
  C:\Windows\System32\jpKxMOT.exe
  2⤵
  PID:4200
- C:\Windows\System32\YLdhxHx.exe
  C:\Windows\System32\YLdhxHx.exe
  2⤵
  PID:2180
- C:\Windows\System32\IkeFJyY.exe
  C:\Windows\System32\IkeFJyY.exe
  2⤵
  PID:3088
- C:\Windows\System32\oKIwbna.exe
  C:\Windows\System32\oKIwbna.exe
  2⤵
  PID:2876
- C:\Windows\System32\LAcuvrh.exe
  C:\Windows\System32\LAcuvrh.exe
  2⤵
  PID:2800
- C:\Windows\System32\SZgYksC.exe
  C:\Windows\System32\SZgYksC.exe
  2⤵
  PID:624
- C:\Windows\System32\CosUPSO.exe
  C:\Windows\System32\CosUPSO.exe
  2⤵
  PID:1880
- C:\Windows\System32\WTElwDN.exe
  C:\Windows\System32\WTElwDN.exe
  2⤵
  PID:1576
- C:\Windows\System32\KUgqjld.exe
  C:\Windows\System32\KUgqjld.exe
  2⤵
  PID:1496
- C:\Windows\System32\kZzvoRw.exe
  C:\Windows\System32\kZzvoRw.exe
  2⤵
  PID:2412
- C:\Windows\System32\rnRFYAY.exe
  C:\Windows\System32\rnRFYAY.exe
  2⤵
  PID:1520
- C:\Windows\System32\SMwJlcX.exe
  C:\Windows\System32\SMwJlcX.exe
  2⤵
  PID:2848
- C:\Windows\System32\WpzBynC.exe
  C:\Windows\System32\WpzBynC.exe
  2⤵
  PID:2516
- C:\Windows\System32\NXkiBiB.exe
  C:\Windows\System32\NXkiBiB.exe
  2⤵
  PID:4872
- C:\Windows\System32\ALDKQcY.exe
  C:\Windows\System32\ALDKQcY.exe
  2⤵
  PID:1832
- C:\Windows\System32\YaHdKHB.exe
  C:\Windows\System32\YaHdKHB.exe
  2⤵
  PID:5164
- C:\Windows\System32\XoBVhTu.exe
  C:\Windows\System32\XoBVhTu.exe
  2⤵
  PID:5184
- C:\Windows\System32\AEXKUcQ.exe
  C:\Windows\System32\AEXKUcQ.exe
  2⤵
  PID:5200
- C:\Windows\System32\TbtDfBJ.exe
  C:\Windows\System32\TbtDfBJ.exe
  2⤵
  PID:5228
- C:\Windows\System32\zolBDdF.exe
  C:\Windows\System32\zolBDdF.exe
  2⤵
  PID:5256
- C:\Windows\System32\Jbuwmxe.exe
  C:\Windows\System32\Jbuwmxe.exe
  2⤵
  PID:5280
- C:\Windows\System32\ymOcpWw.exe
  C:\Windows\System32\ymOcpWw.exe
  2⤵
  PID:5312
- C:\Windows\System32\heINrBX.exe
  C:\Windows\System32\heINrBX.exe
  2⤵
  PID:5340
- C:\Windows\System32\mgByisX.exe
  C:\Windows\System32\mgByisX.exe
  2⤵
  PID:5368
- C:\Windows\System32\maliUYO.exe
  C:\Windows\System32\maliUYO.exe
  2⤵
  PID:5392
- C:\Windows\System32\WtKhHBo.exe
  C:\Windows\System32\WtKhHBo.exe
  2⤵
  PID:5420
- C:\Windows\System32\XglYgam.exe
  C:\Windows\System32\XglYgam.exe
  2⤵
  PID:5452
- C:\Windows\System32\tNIYFWK.exe
  C:\Windows\System32\tNIYFWK.exe
  2⤵
  PID:5476
- C:\Windows\System32\oHeSVyK.exe
  C:\Windows\System32\oHeSVyK.exe
  2⤵
  PID:5508
- C:\Windows\System32\DPStXxY.exe
  C:\Windows\System32\DPStXxY.exe
  2⤵
  PID:5536
- C:\Windows\System32\cknJlSe.exe
  C:\Windows\System32\cknJlSe.exe
  2⤵
  PID:5564
- C:\Windows\System32\dQJseVs.exe
  C:\Windows\System32\dQJseVs.exe
  2⤵
  PID:5588
- C:\Windows\System32\lfwKzNN.exe
  C:\Windows\System32\lfwKzNN.exe
  2⤵
  PID:5624
- C:\Windows\System32\SNcjCUB.exe
  C:\Windows\System32\SNcjCUB.exe
  2⤵
  PID:5648
- C:\Windows\System32\PSJyTkS.exe
  C:\Windows\System32\PSJyTkS.exe
  2⤵
  PID:5672
- C:\Windows\System32\bXCVswV.exe
  C:\Windows\System32\bXCVswV.exe
  2⤵
  PID:5708
- C:\Windows\System32\gDpHfJd.exe
  C:\Windows\System32\gDpHfJd.exe
  2⤵
  PID:5732
- C:\Windows\System32\Vjffbzx.exe
  C:\Windows\System32\Vjffbzx.exe
  2⤵
  PID:5760
- C:\Windows\System32\HhpCaox.exe
  C:\Windows\System32\HhpCaox.exe
  2⤵
  PID:5784
- C:\Windows\System32\qWDiYVM.exe
  C:\Windows\System32\qWDiYVM.exe
  2⤵
  PID:5816
- C:\Windows\System32\SFaKtgF.exe
  C:\Windows\System32\SFaKtgF.exe
  2⤵
  PID:5844
- C:\Windows\System32\uyDOymV.exe
  C:\Windows\System32\uyDOymV.exe
  2⤵
  PID:5876
- C:\Windows\System32\IboACJy.exe
  C:\Windows\System32\IboACJy.exe
  2⤵
  PID:5900
- C:\Windows\System32\wUtazOG.exe
  C:\Windows\System32\wUtazOG.exe
  2⤵
  PID:5928
- C:\Windows\System32\NITfvpa.exe
  C:\Windows\System32\NITfvpa.exe
  2⤵
  PID:5956
- C:\Windows\System32\lyybTZO.exe
  C:\Windows\System32\lyybTZO.exe
  2⤵
  PID:6024
- C:\Windows\System32\iIhQajJ.exe
  C:\Windows\System32\iIhQajJ.exe
  2⤵
  PID:6052
- C:\Windows\System32\FdSMCJA.exe
  C:\Windows\System32\FdSMCJA.exe
  2⤵
  PID:6080
- C:\Windows\System32\jljOPtv.exe
  C:\Windows\System32\jljOPtv.exe
  2⤵
  PID:6104
- C:\Windows\System32\xrfEQNw.exe
  C:\Windows\System32\xrfEQNw.exe
  2⤵
  PID:6120
- C:\Windows\System32\QcVYgXc.exe
  C:\Windows\System32\QcVYgXc.exe
  2⤵
  PID:4120
- C:\Windows\System32\LhSwraG.exe
  C:\Windows\System32\LhSwraG.exe
  2⤵
  PID:3176
- C:\Windows\System32\WlXLYty.exe
  C:\Windows\System32\WlXLYty.exe
  2⤵
  PID:4968
- C:\Windows\System32\KNHwjdc.exe
  C:\Windows\System32\KNHwjdc.exe
  2⤵
  PID:1684
- C:\Windows\System32\jmlgpeh.exe
  C:\Windows\System32\jmlgpeh.exe
  2⤵
  PID:1232
- C:\Windows\System32\BeKdSxI.exe
  C:\Windows\System32\BeKdSxI.exe
  2⤵
  PID:4596
- C:\Windows\System32\uDCQMvP.exe
  C:\Windows\System32\uDCQMvP.exe
  2⤵
  PID:5136
- C:\Windows\System32\IqkZKGT.exe
  C:\Windows\System32\IqkZKGT.exe
  2⤵
  PID:5160
- C:\Windows\System32\SXTSKyP.exe
  C:\Windows\System32\SXTSKyP.exe
  2⤵
  PID:5208
- C:\Windows\System32\FABpZLx.exe
  C:\Windows\System32\FABpZLx.exe
  2⤵
  PID:1688
- C:\Windows\System32\AvfNIhr.exe
  C:\Windows\System32\AvfNIhr.exe
  2⤵
  PID:5276
- C:\Windows\System32\zwlwTPR.exe
  C:\Windows\System32\zwlwTPR.exe
  2⤵
  PID:5360
- C:\Windows\System32\zxRoYOf.exe
  C:\Windows\System32\zxRoYOf.exe
  2⤵
  PID:1860
- C:\Windows\System32\EGtXxKg.exe
  C:\Windows\System32\EGtXxKg.exe
  2⤵
  PID:4260
- C:\Windows\System32\cwvXOqS.exe
  C:\Windows\System32\cwvXOqS.exe
  2⤵
  PID:5416
- C:\Windows\System32\sSHxSUE.exe
  C:\Windows\System32\sSHxSUE.exe
  2⤵
  PID:2804
- C:\Windows\System32\lWdhhAk.exe
  C:\Windows\System32\lWdhhAk.exe
  2⤵
  PID:3504
- C:\Windows\System32\NlPHcyV.exe
  C:\Windows\System32\NlPHcyV.exe
  2⤵
  PID:5528
- C:\Windows\System32\LgbCHRD.exe
  C:\Windows\System32\LgbCHRD.exe
  2⤵
  PID:5724
- C:\Windows\System32\ZPsmRyZ.exe
  C:\Windows\System32\ZPsmRyZ.exe
  2⤵
  PID:5752
- C:\Windows\System32\WitEiGx.exe
  C:\Windows\System32\WitEiGx.exe
  2⤵
  PID:4472
- C:\Windows\System32\wZMFpCl.exe
  C:\Windows\System32\wZMFpCl.exe
  2⤵
  PID:5884
- C:\Windows\System32\bqKJGIU.exe
  C:\Windows\System32\bqKJGIU.exe
  2⤵
  PID:5908
- C:\Windows\System32\MxqaCyN.exe
  C:\Windows\System32\MxqaCyN.exe
  2⤵
  PID:2704
- C:\Windows\System32\mktjffg.exe
  C:\Windows\System32\mktjffg.exe
  2⤵
  PID:4620
- C:\Windows\System32\iaLcXSk.exe
  C:\Windows\System32\iaLcXSk.exe
  2⤵
  PID:4684
- C:\Windows\System32\gGyXqKj.exe
  C:\Windows\System32\gGyXqKj.exe
  2⤵
  PID:876
- C:\Windows\System32\dtkvNJy.exe
  C:\Windows\System32\dtkvNJy.exe
  2⤵
  PID:1912
- C:\Windows\System32\xbtYDnn.exe
  C:\Windows\System32\xbtYDnn.exe
  2⤵
  PID:4840
- C:\Windows\System32\qJRbYLC.exe
  C:\Windows\System32\qJRbYLC.exe
  2⤵
  PID:6040
- C:\Windows\System32\JHoqLfi.exe
  C:\Windows\System32\JHoqLfi.exe
  2⤵
  PID:6112
- C:\Windows\System32\TZpLKiQ.exe
  C:\Windows\System32\TZpLKiQ.exe
  2⤵
  PID:2184
- C:\Windows\System32\BBBXfhZ.exe
  C:\Windows\System32\BBBXfhZ.exe
  2⤵
  PID:2924
- C:\Windows\System32\QWxPYTw.exe
  C:\Windows\System32\QWxPYTw.exe
  2⤵
  PID:856
- C:\Windows\System32\fOACEqR.exe
  C:\Windows\System32\fOACEqR.exe
  2⤵
  PID:1408
- C:\Windows\System32\RnHqVQB.exe
  C:\Windows\System32\RnHqVQB.exe
  2⤵
  PID:5492
- C:\Windows\System32\OoLkqpe.exe
  C:\Windows\System32\OoLkqpe.exe
  2⤵
  PID:5640
- C:\Windows\System32\EZFtKfS.exe
  C:\Windows\System32\EZFtKfS.exe
  2⤵
  PID:3124
- C:\Windows\System32\GNmyxUy.exe
  C:\Windows\System32\GNmyxUy.exe
  2⤵
  PID:1608
- C:\Windows\System32\UxXAiPb.exe
  C:\Windows\System32\UxXAiPb.exe
  2⤵
  PID:5856
- C:\Windows\System32\lFdBuhZ.exe
  C:\Windows\System32\lFdBuhZ.exe
  2⤵
  PID:5976
- C:\Windows\System32\vfhFutY.exe
  C:\Windows\System32\vfhFutY.exe
  2⤵
  PID:2656
- C:\Windows\System32\isyQDZr.exe
  C:\Windows\System32\isyQDZr.exe
  2⤵
  PID:6044
- C:\Windows\System32\eURDkTv.exe
  C:\Windows\System32\eURDkTv.exe
  2⤵
  PID:6136
- C:\Windows\System32\ODjYGgJ.exe
  C:\Windows\System32\ODjYGgJ.exe
  2⤵
  PID:5248
- C:\Windows\System32\IbUnoOV.exe
  C:\Windows\System32\IbUnoOV.exe
  2⤵
  PID:3060
- C:\Windows\System32\zrfXzbL.exe
  C:\Windows\System32\zrfXzbL.exe
  2⤵
  PID:5380
- C:\Windows\System32\bdkexyi.exe
  C:\Windows\System32\bdkexyi.exe
  2⤵
  PID:5896
- C:\Windows\System32\UnQBkbf.exe
  C:\Windows\System32\UnQBkbf.exe
  2⤵
  PID:6128
- C:\Windows\System32\XABuBCA.exe
  C:\Windows\System32\XABuBCA.exe
  2⤵
  PID:5408
- C:\Windows\System32\TDotcIt.exe
  C:\Windows\System32\TDotcIt.exe
  2⤵
  PID:5464
- C:\Windows\System32\iziOULk.exe
  C:\Windows\System32\iziOULk.exe
  2⤵
  PID:6148
- C:\Windows\System32\gwLqTmy.exe
  C:\Windows\System32\gwLqTmy.exe
  2⤵
  PID:6164
- C:\Windows\System32\tilSUer.exe
  C:\Windows\System32\tilSUer.exe
  2⤵
  PID:6192
- C:\Windows\System32\aGjjULk.exe
  C:\Windows\System32\aGjjULk.exe
  2⤵
  PID:6216
- C:\Windows\System32\lFRnATX.exe
  C:\Windows\System32\lFRnATX.exe
  2⤵
  PID:6240
- C:\Windows\System32\VeDGdSW.exe
  C:\Windows\System32\VeDGdSW.exe
  2⤵
  PID:6296
- C:\Windows\System32\BHGXSii.exe
  C:\Windows\System32\BHGXSii.exe
  2⤵
  PID:6364
- C:\Windows\System32\NPlqern.exe
  C:\Windows\System32\NPlqern.exe
  2⤵
  PID:6384
- C:\Windows\System32\aYSdkIR.exe
  C:\Windows\System32\aYSdkIR.exe
  2⤵
  PID:6400
- C:\Windows\System32\bzHPgyx.exe
  C:\Windows\System32\bzHPgyx.exe
  2⤵
  PID:6428
- C:\Windows\System32\yQstJWS.exe
  C:\Windows\System32\yQstJWS.exe
  2⤵
  PID:6448
- C:\Windows\System32\KRMNzzR.exe
  C:\Windows\System32\KRMNzzR.exe
  2⤵
  PID:6464
- C:\Windows\System32\FoqIJFC.exe
  C:\Windows\System32\FoqIJFC.exe
  2⤵
  PID:6496
- C:\Windows\System32\JOmOYsK.exe
  C:\Windows\System32\JOmOYsK.exe
  2⤵
  PID:6540
- C:\Windows\System32\YBmjkkZ.exe
  C:\Windows\System32\YBmjkkZ.exe
  2⤵
  PID:6560
- C:\Windows\System32\wjqoePz.exe
  C:\Windows\System32\wjqoePz.exe
  2⤵
  PID:6588
- C:\Windows\System32\jQOuCPN.exe
  C:\Windows\System32\jQOuCPN.exe
  2⤵
  PID:6608
- C:\Windows\System32\RNliWUG.exe
  C:\Windows\System32\RNliWUG.exe
  2⤵
  PID:6648
- C:\Windows\System32\wdQEJDn.exe
  C:\Windows\System32\wdQEJDn.exe
  2⤵
  PID:6668
- C:\Windows\System32\pgSFcjk.exe
  C:\Windows\System32\pgSFcjk.exe
  2⤵
  PID:6684
- C:\Windows\System32\dgFBloS.exe
  C:\Windows\System32\dgFBloS.exe
  2⤵
  PID:6708
- C:\Windows\System32\DaKGXvS.exe
  C:\Windows\System32\DaKGXvS.exe
  2⤵
  PID:6728
- C:\Windows\System32\YeLlgXV.exe
  C:\Windows\System32\YeLlgXV.exe
  2⤵
  PID:6752
- C:\Windows\System32\AimbZfq.exe
  C:\Windows\System32\AimbZfq.exe
  2⤵
  PID:6792
- C:\Windows\System32\nNwIGda.exe
  C:\Windows\System32\nNwIGda.exe
  2⤵
  PID:6820
- C:\Windows\System32\VKAleAW.exe
  C:\Windows\System32\VKAleAW.exe
  2⤵
  PID:6840
- C:\Windows\System32\KVFskcr.exe
  C:\Windows\System32\KVFskcr.exe
  2⤵
  PID:6860
- C:\Windows\System32\jNcosum.exe
  C:\Windows\System32\jNcosum.exe
  2⤵
  PID:6900
- C:\Windows\System32\KPNkjsb.exe
  C:\Windows\System32\KPNkjsb.exe
  2⤵
  PID:6956
- C:\Windows\System32\RzWmrcs.exe
  C:\Windows\System32\RzWmrcs.exe
  2⤵
  PID:7008
- C:\Windows\System32\RpmCpFa.exe
  C:\Windows\System32\RpmCpFa.exe
  2⤵
  PID:7044
- C:\Windows\System32\OIweZxA.exe
  C:\Windows\System32\OIweZxA.exe
  2⤵
  PID:7068
- C:\Windows\System32\wAVBtKe.exe
  C:\Windows\System32\wAVBtKe.exe
  2⤵
  PID:7084
- C:\Windows\System32\gysLdyc.exe
  C:\Windows\System32\gysLdyc.exe
  2⤵
  PID:7116
- C:\Windows\System32\yKJplWk.exe
  C:\Windows\System32\yKJplWk.exe
  2⤵
  PID:7152
- C:\Windows\System32\TNbIOyt.exe
  C:\Windows\System32\TNbIOyt.exe
  2⤵
  PID:5548
- C:\Windows\System32\OmzwoGk.exe
  C:\Windows\System32\OmzwoGk.exe
  2⤵
  PID:6156
- C:\Windows\System32\dJOhRHE.exe
  C:\Windows\System32\dJOhRHE.exe
  2⤵
  PID:6172
- C:\Windows\System32\hOJZQoT.exe
  C:\Windows\System32\hOJZQoT.exe
  2⤵
  PID:6116
- C:\Windows\System32\BXjzvLA.exe
  C:\Windows\System32\BXjzvLA.exe
  2⤵
  PID:6308
- C:\Windows\System32\eiJPDRf.exe
  C:\Windows\System32\eiJPDRf.exe
  2⤵
  PID:6380
- C:\Windows\System32\ZtDYhZI.exe
  C:\Windows\System32\ZtDYhZI.exe
  2⤵
  PID:6424
- C:\Windows\System32\DaDeNRe.exe
  C:\Windows\System32\DaDeNRe.exe
  2⤵
  PID:1652
- C:\Windows\System32\WfapNnq.exe
  C:\Windows\System32\WfapNnq.exe
  2⤵
  PID:6600
- C:\Windows\System32\xEOSxVO.exe
  C:\Windows\System32\xEOSxVO.exe
  2⤵
  PID:6532
- C:\Windows\System32\SbbsUXR.exe
  C:\Windows\System32\SbbsUXR.exe
  2⤵
  PID:6576
- C:\Windows\System32\QBcbEJb.exe
  C:\Windows\System32\QBcbEJb.exe
  2⤵
  PID:6692
- C:\Windows\System32\yZYJDRc.exe
  C:\Windows\System32\yZYJDRc.exe
  2⤵
  PID:6748
- C:\Windows\System32\AUsYYcu.exe
  C:\Windows\System32\AUsYYcu.exe
  2⤵
  PID:6780
- C:\Windows\System32\NPsdtph.exe
  C:\Windows\System32\NPsdtph.exe
  2⤵
  PID:6944
- C:\Windows\System32\CCOwEwv.exe
  C:\Windows\System32\CCOwEwv.exe
  2⤵
  PID:6992
- C:\Windows\System32\kgCAWLU.exe
  C:\Windows\System32\kgCAWLU.exe
  2⤵
  PID:6980
- C:\Windows\System32\knQmZsD.exe
  C:\Windows\System32\knQmZsD.exe
  2⤵
  PID:7052
- C:\Windows\System32\oOeiGZE.exe
  C:\Windows\System32\oOeiGZE.exe
  2⤵
  PID:7164
- C:\Windows\System32\LGVJcab.exe
  C:\Windows\System32\LGVJcab.exe
  2⤵
  PID:6280
- C:\Windows\System32\jxvivDO.exe
  C:\Windows\System32\jxvivDO.exe
  2⤵
  PID:6304
- C:\Windows\System32\RwJKcOp.exe
  C:\Windows\System32\RwJKcOp.exe
  2⤵
  PID:6320
- C:\Windows\System32\eHZijNp.exe
  C:\Windows\System32\eHZijNp.exe
  2⤵
  PID:6556
- C:\Windows\System32\OSMSIhB.exe
  C:\Windows\System32\OSMSIhB.exe
  2⤵
  PID:6640
- C:\Windows\System32\XFRfvEi.exe
  C:\Windows\System32\XFRfvEi.exe
  2⤵
  PID:6852
- C:\Windows\System32\RjCEkNX.exe
  C:\Windows\System32\RjCEkNX.exe
  2⤵
  PID:6896
- C:\Windows\System32\gUVkfsU.exe
  C:\Windows\System32\gUVkfsU.exe
  2⤵
  PID:6988
- C:\Windows\System32\pcjOTdV.exe
  C:\Windows\System32\pcjOTdV.exe
  2⤵
  PID:224
- C:\Windows\System32\KPFQXgX.exe
  C:\Windows\System32\KPFQXgX.exe
  2⤵
  PID:6552
- C:\Windows\System32\kqNRmqp.exe
  C:\Windows\System32\kqNRmqp.exe
  2⤵
  PID:7056
- C:\Windows\System32\flUgckn.exe
  C:\Windows\System32\flUgckn.exe
  2⤵
  PID:7192
- C:\Windows\System32\txETDma.exe
  C:\Windows\System32\txETDma.exe
  2⤵
  PID:7220
- C:\Windows\System32\FQwXoxZ.exe
  C:\Windows\System32\FQwXoxZ.exe
  2⤵
  PID:7244
- C:\Windows\System32\eQKnCAy.exe
  C:\Windows\System32\eQKnCAy.exe
  2⤵
  PID:7264
- C:\Windows\System32\qBLMepB.exe
  C:\Windows\System32\qBLMepB.exe
  2⤵
  PID:7284
- C:\Windows\System32\hvhMWur.exe
  C:\Windows\System32\hvhMWur.exe
  2⤵
  PID:7304
- C:\Windows\System32\BSAiOfj.exe
  C:\Windows\System32\BSAiOfj.exe
  2⤵
  PID:7348
- C:\Windows\System32\OxLQYtH.exe
  C:\Windows\System32\OxLQYtH.exe
  2⤵
  PID:7364
- C:\Windows\System32\SHtVacn.exe
  C:\Windows\System32\SHtVacn.exe
  2⤵
  PID:7436
- C:\Windows\System32\IBLCTII.exe
  C:\Windows\System32\IBLCTII.exe
  2⤵
  PID:7464
- C:\Windows\System32\suIAnUp.exe
  C:\Windows\System32\suIAnUp.exe
  2⤵
  PID:7480
- C:\Windows\System32\rLBnOFz.exe
  C:\Windows\System32\rLBnOFz.exe
  2⤵
  PID:7508
- C:\Windows\System32\eAsReCG.exe
  C:\Windows\System32\eAsReCG.exe
  2⤵
  PID:7536
- C:\Windows\System32\nvpdACx.exe
  C:\Windows\System32\nvpdACx.exe
  2⤵
  PID:7556
- C:\Windows\System32\reiFfrI.exe
  C:\Windows\System32\reiFfrI.exe
  2⤵
  PID:7592
- C:\Windows\System32\gDGMThd.exe
  C:\Windows\System32\gDGMThd.exe
  2⤵
  PID:7620
- C:\Windows\System32\KhwabuQ.exe
  C:\Windows\System32\KhwabuQ.exe
  2⤵
  PID:7644
- C:\Windows\System32\soMoqmg.exe
  C:\Windows\System32\soMoqmg.exe
  2⤵
  PID:7668
- C:\Windows\System32\WPRUNCy.exe
  C:\Windows\System32\WPRUNCy.exe
  2⤵
  PID:7712
- C:\Windows\System32\REMBMlH.exe
  C:\Windows\System32\REMBMlH.exe
  2⤵
  PID:7732
- C:\Windows\System32\IAacvzQ.exe
  C:\Windows\System32\IAacvzQ.exe
  2⤵
  PID:7752
- C:\Windows\System32\wmBogzy.exe
  C:\Windows\System32\wmBogzy.exe
  2⤵
  PID:7776
- C:\Windows\System32\oBxCAQp.exe
  C:\Windows\System32\oBxCAQp.exe
  2⤵
  PID:7804
- C:\Windows\System32\ChEBHZN.exe
  C:\Windows\System32\ChEBHZN.exe
  2⤵
  PID:7824
- C:\Windows\System32\YiisfJe.exe
  C:\Windows\System32\YiisfJe.exe
  2⤵
  PID:7868
- C:\Windows\System32\BcJBxws.exe
  C:\Windows\System32\BcJBxws.exe
  2⤵
  PID:7892
- C:\Windows\System32\IEnbiJM.exe
  C:\Windows\System32\IEnbiJM.exe
  2⤵
  PID:7920
- C:\Windows\System32\yahhbYb.exe
  C:\Windows\System32\yahhbYb.exe
  2⤵
  PID:7964
- C:\Windows\System32\dXTnvOu.exe
  C:\Windows\System32\dXTnvOu.exe
  2⤵
  PID:8008
- C:\Windows\System32\aMgziPT.exe
  C:\Windows\System32\aMgziPT.exe
  2⤵
  PID:8040
- C:\Windows\System32\JrhDhCQ.exe
  C:\Windows\System32\JrhDhCQ.exe
  2⤵
  PID:8064
- C:\Windows\System32\oILdXrv.exe
  C:\Windows\System32\oILdXrv.exe
  2⤵
  PID:8080
- C:\Windows\System32\YobMkew.exe
  C:\Windows\System32\YobMkew.exe
  2⤵
  PID:8124
- C:\Windows\System32\wfKyiVW.exe
  C:\Windows\System32\wfKyiVW.exe
  2⤵
  PID:8148
- C:\Windows\System32\MWTtiAu.exe
  C:\Windows\System32\MWTtiAu.exe
  2⤵
  PID:8164
- C:\Windows\System32\RkUtCfX.exe
  C:\Windows\System32\RkUtCfX.exe
  2⤵
  PID:8188
- C:\Windows\System32\gaEvtcu.exe
  C:\Windows\System32\gaEvtcu.exe
  2⤵
  PID:6204
- C:\Windows\System32\hzGoCab.exe
  C:\Windows\System32\hzGoCab.exe
  2⤵
  PID:7172
- C:\Windows\System32\rrFvXaE.exe
  C:\Windows\System32\rrFvXaE.exe
  2⤵
  PID:7260
- C:\Windows\System32\yfGFDGe.exe
  C:\Windows\System32\yfGFDGe.exe
  2⤵
  PID:7276
- C:\Windows\System32\XFMHEvS.exe
  C:\Windows\System32\XFMHEvS.exe
  2⤵
  PID:7296
- C:\Windows\System32\ZcjFrgt.exe
  C:\Windows\System32\ZcjFrgt.exe
  2⤵
  PID:7444
- C:\Windows\System32\UlwTLqw.exe
  C:\Windows\System32\UlwTLqw.exe
  2⤵
  PID:7448
- C:\Windows\System32\gAaMwTJ.exe
  C:\Windows\System32\gAaMwTJ.exe
  2⤵
  PID:7552
- C:\Windows\System32\vUORDCn.exe
  C:\Windows\System32\vUORDCn.exe
  2⤵
  PID:7604
- C:\Windows\System32\SBDdcuA.exe
  C:\Windows\System32\SBDdcuA.exe
  2⤵
  PID:7680
- C:\Windows\System32\EnlUVpG.exe
  C:\Windows\System32\EnlUVpG.exe
  2⤵
  PID:7740
- C:\Windows\System32\vBbfQqO.exe
  C:\Windows\System32\vBbfQqO.exe
  2⤵
  PID:7748
- C:\Windows\System32\rgkptRG.exe
  C:\Windows\System32\rgkptRG.exe
  2⤵
  PID:7840
- C:\Windows\System32\wXYAQGg.exe
  C:\Windows\System32\wXYAQGg.exe
  2⤵
  PID:7844
- C:\Windows\System32\smhRvue.exe
  C:\Windows\System32\smhRvue.exe
  2⤵
  PID:8028
- C:\Windows\System32\vaDCMKw.exe
  C:\Windows\System32\vaDCMKw.exe
  2⤵
  PID:8076
- C:\Windows\System32\fiJYpLx.exe
  C:\Windows\System32\fiJYpLx.exe
  2⤵
  PID:8136
- C:\Windows\System32\xKTPJkT.exe
  C:\Windows\System32\xKTPJkT.exe
  2⤵
  PID:8176
- C:\Windows\System32\FCNFJmZ.exe
  C:\Windows\System32\FCNFJmZ.exe
  2⤵
  PID:6480
- C:\Windows\System32\FUGeKfC.exe
  C:\Windows\System32\FUGeKfC.exe
  2⤵
  PID:7280
- C:\Windows\System32\RZvzJie.exe
  C:\Windows\System32\RZvzJie.exe
  2⤵
  PID:2432
- C:\Windows\System32\RcVVWOI.exe
  C:\Windows\System32\RcVVWOI.exe
  2⤵
  PID:7528
- C:\Windows\System32\hxCZrpC.exe
  C:\Windows\System32\hxCZrpC.exe
  2⤵
  PID:7728
- C:\Windows\System32\ezwsGfW.exe
  C:\Windows\System32\ezwsGfW.exe
  2⤵
  PID:7876
- C:\Windows\System32\IprjIKp.exe
  C:\Windows\System32\IprjIKp.exe
  2⤵
  PID:7916
- C:\Windows\System32\OhVoQLb.exe
  C:\Windows\System32\OhVoQLb.exe
  2⤵
  PID:7328
- C:\Windows\System32\GSbcsud.exe
  C:\Windows\System32\GSbcsud.exe
  2⤵
  PID:7696
- C:\Windows\System32\tgWZTmx.exe
  C:\Windows\System32\tgWZTmx.exe
  2⤵
  PID:7792
- C:\Windows\System32\QfRtWhK.exe
  C:\Windows\System32\QfRtWhK.exe
  2⤵
  PID:8056
- C:\Windows\System32\lMkYLzz.exe
  C:\Windows\System32\lMkYLzz.exe
  2⤵
  PID:8140
- C:\Windows\System32\tkEacfL.exe
  C:\Windows\System32\tkEacfL.exe
  2⤵
  PID:7516
- C:\Windows\System32\FqyNIEf.exe
  C:\Windows\System32\FqyNIEf.exe
  2⤵
  PID:8212
- C:\Windows\System32\DTAjhBz.exe
  C:\Windows\System32\DTAjhBz.exe
  2⤵
  PID:8256
- C:\Windows\System32\CFDLVpV.exe
  C:\Windows\System32\CFDLVpV.exe
  2⤵
  PID:8280
- C:\Windows\System32\MsRWFEa.exe
  C:\Windows\System32\MsRWFEa.exe
  2⤵
  PID:8304
- C:\Windows\System32\LCVkxcg.exe
  C:\Windows\System32\LCVkxcg.exe
  2⤵
  PID:8340
- C:\Windows\System32\PqxNpiV.exe
  C:\Windows\System32\PqxNpiV.exe
  2⤵
  PID:8356
- C:\Windows\System32\ibXPOcd.exe
  C:\Windows\System32\ibXPOcd.exe
  2⤵
  PID:8380
- C:\Windows\System32\bJGNIdV.exe
  C:\Windows\System32\bJGNIdV.exe
  2⤵
  PID:8400
- C:\Windows\System32\cAbcHhY.exe
  C:\Windows\System32\cAbcHhY.exe
  2⤵
  PID:8420
- C:\Windows\System32\MJrJvSa.exe
  C:\Windows\System32\MJrJvSa.exe
  2⤵
  PID:8448
- C:\Windows\System32\QvPFArT.exe
  C:\Windows\System32\QvPFArT.exe
  2⤵
  PID:8560
- C:\Windows\System32\NkfKScv.exe
  C:\Windows\System32\NkfKScv.exe
  2⤵
  PID:8628
- C:\Windows\System32\SqjTiSs.exe
  C:\Windows\System32\SqjTiSs.exe
  2⤵
  PID:8676
- C:\Windows\System32\cfOWFzD.exe
  C:\Windows\System32\cfOWFzD.exe
  2⤵
  PID:8692
- C:\Windows\System32\AbhJdMU.exe
  C:\Windows\System32\AbhJdMU.exe
  2⤵
  PID:8720
- C:\Windows\System32\VnoueRJ.exe
  C:\Windows\System32\VnoueRJ.exe
  2⤵
  PID:8756
- C:\Windows\System32\CunajSh.exe
  C:\Windows\System32\CunajSh.exe
  2⤵
  PID:8780
- C:\Windows\System32\JKDWgvp.exe
  C:\Windows\System32\JKDWgvp.exe
  2⤵
  PID:8796
- C:\Windows\System32\oLpKYyV.exe
  C:\Windows\System32\oLpKYyV.exe
  2⤵
  PID:8816
- C:\Windows\System32\LTqpNhA.exe
  C:\Windows\System32\LTqpNhA.exe
  2⤵
  PID:8852
- C:\Windows\System32\GUebKLg.exe
  C:\Windows\System32\GUebKLg.exe
  2⤵
  PID:8900
- C:\Windows\System32\OWDiFFA.exe
  C:\Windows\System32\OWDiFFA.exe
  2⤵
  PID:8932
- C:\Windows\System32\DCHfwZE.exe
  C:\Windows\System32\DCHfwZE.exe
  2⤵
  PID:8968
- C:\Windows\System32\jQihckn.exe
  C:\Windows\System32\jQihckn.exe
  2⤵
  PID:8988
- C:\Windows\System32\MuxFkMd.exe
  C:\Windows\System32\MuxFkMd.exe
  2⤵
  PID:9016
- C:\Windows\System32\BkyNhls.exe
  C:\Windows\System32\BkyNhls.exe
  2⤵
  PID:9036
- C:\Windows\System32\qfBvUdF.exe
  C:\Windows\System32\qfBvUdF.exe
  2⤵
  PID:9064
- C:\Windows\System32\VWghcln.exe
  C:\Windows\System32\VWghcln.exe
  2⤵
  PID:9084
- C:\Windows\System32\DZbJLuH.exe
  C:\Windows\System32\DZbJLuH.exe
  2⤵
  PID:9112
- C:\Windows\System32\WvRgAlC.exe
  C:\Windows\System32\WvRgAlC.exe
  2⤵
  PID:9136
- C:\Windows\System32\NzFoekT.exe
  C:\Windows\System32\NzFoekT.exe
  2⤵
  PID:9176
- C:\Windows\System32\sZqhieF.exe
  C:\Windows\System32\sZqhieF.exe
  2⤵
  PID:9192
- C:\Windows\System32\QBftMSQ.exe
  C:\Windows\System32\QBftMSQ.exe
  2⤵
  PID:8200
- C:\Windows\System32\jCAmvPs.exe
  C:\Windows\System32\jCAmvPs.exe
  2⤵
  PID:8292
- C:\Windows\System32\geWWsTo.exe
  C:\Windows\System32\geWWsTo.exe
  2⤵
  PID:8368
- C:\Windows\System32\xYcrpmX.exe
  C:\Windows\System32\xYcrpmX.exe
  2⤵
  PID:8408
- C:\Windows\System32\jgNzFWF.exe
  C:\Windows\System32\jgNzFWF.exe
  2⤵
  PID:8484
- C:\Windows\System32\raYRSYx.exe
  C:\Windows\System32\raYRSYx.exe
  2⤵
  PID:8428
- C:\Windows\System32\TZYREhz.exe
  C:\Windows\System32\TZYREhz.exe
  2⤵
  PID:8516
- C:\Windows\System32\BZcvRtn.exe
  C:\Windows\System32\BZcvRtn.exe
  2⤵
  PID:8472
- C:\Windows\System32\yxaADMc.exe
  C:\Windows\System32\yxaADMc.exe
  2⤵
  PID:8548
- C:\Windows\System32\ICSHhik.exe
  C:\Windows\System32\ICSHhik.exe
  2⤵
  PID:8648
- C:\Windows\System32\iwRzBDi.exe
  C:\Windows\System32\iwRzBDi.exe
  2⤵
  PID:8636
- C:\Windows\System32\LdToZUD.exe
  C:\Windows\System32\LdToZUD.exe
  2⤵
  PID:8748
- C:\Windows\System32\LRaCmZs.exe
  C:\Windows\System32\LRaCmZs.exe
  2⤵
  PID:8844
- C:\Windows\System32\CzkUgYM.exe
  C:\Windows\System32\CzkUgYM.exe
  2⤵
  PID:8808
- C:\Windows\System32\KcHdiLo.exe
  C:\Windows\System32\KcHdiLo.exe
  2⤵
  PID:8960
- C:\Windows\System32\eBTZoVS.exe
  C:\Windows\System32\eBTZoVS.exe
  2⤵
  PID:8976
- C:\Windows\System32\sSVtruC.exe
  C:\Windows\System32\sSVtruC.exe
  2⤵
  PID:9092
- C:\Windows\System32\PCBqlvO.exe
  C:\Windows\System32\PCBqlvO.exe
  2⤵
  PID:9120
- C:\Windows\System32\NIdgbdQ.exe
  C:\Windows\System32\NIdgbdQ.exe
  2⤵
  PID:9212
- C:\Windows\System32\TmgNtmK.exe
  C:\Windows\System32\TmgNtmK.exe
  2⤵
  PID:8312
- C:\Windows\System32\snsWyOL.exe
  C:\Windows\System32\snsWyOL.exe
  2⤵
  PID:8432
- C:\Windows\System32\ehMebao.exe
  C:\Windows\System32\ehMebao.exe
  2⤵
  PID:8540
- C:\Windows\System32\IGfJCAa.exe
  C:\Windows\System32\IGfJCAa.exe
  2⤵
  PID:8600
- C:\Windows\System32\VqyicOD.exe
  C:\Windows\System32\VqyicOD.exe
  2⤵
  PID:8824
- C:\Windows\System32\SMxrpIi.exe
  C:\Windows\System32\SMxrpIi.exe
  2⤵
  PID:9060
- C:\Windows\System32\NlObHbs.exe
  C:\Windows\System32\NlObHbs.exe
  2⤵
  PID:7788
- C:\Windows\System32\NkpBCdS.exe
  C:\Windows\System32\NkpBCdS.exe
  2⤵
  PID:9164
- C:\Windows\System32\uZmMDyu.exe
  C:\Windows\System32\uZmMDyu.exe
  2⤵
  PID:8460
- C:\Windows\System32\augJSzB.exe
  C:\Windows\System32\augJSzB.exe
  2⤵
  PID:8688
- C:\Windows\System32\jrEgLKX.exe
  C:\Windows\System32\jrEgLKX.exe
  2⤵
  PID:9080
- C:\Windows\System32\NiOaGJM.exe
  C:\Windows\System32\NiOaGJM.exe
  2⤵
  PID:8352
- C:\Windows\System32\gKazsQu.exe
  C:\Windows\System32\gKazsQu.exe
  2⤵
  PID:7880
- C:\Windows\System32\KJBRvrg.exe
  C:\Windows\System32\KJBRvrg.exe
  2⤵
  PID:9236
- C:\Windows\System32\ABeuCXp.exe
  C:\Windows\System32\ABeuCXp.exe
  2⤵
  PID:9268
- C:\Windows\System32\GBVYlMV.exe
  C:\Windows\System32\GBVYlMV.exe
  2⤵
  PID:9300
- C:\Windows\System32\kKSjCbx.exe
  C:\Windows\System32\kKSjCbx.exe
  2⤵
  PID:9328
- C:\Windows\System32\PKppswA.exe
  C:\Windows\System32\PKppswA.exe
  2⤵
  PID:9344
- C:\Windows\System32\uOlUcPt.exe
  C:\Windows\System32\uOlUcPt.exe
  2⤵
  PID:9396
- C:\Windows\System32\wYtSAqU.exe
  C:\Windows\System32\wYtSAqU.exe
  2⤵
  PID:9416
- C:\Windows\System32\xtcpYKm.exe
  C:\Windows\System32\xtcpYKm.exe
  2⤵
  PID:9436
- C:\Windows\System32\uvrwwci.exe
  C:\Windows\System32\uvrwwci.exe
  2⤵
  PID:9460
- C:\Windows\System32\BaQJqHB.exe
  C:\Windows\System32\BaQJqHB.exe
  2⤵
  PID:9496
- C:\Windows\System32\vgELpbB.exe
  C:\Windows\System32\vgELpbB.exe
  2⤵
  PID:9524
- C:\Windows\System32\UamtebK.exe
  C:\Windows\System32\UamtebK.exe
  2⤵
  PID:9564
- C:\Windows\System32\jItXgoK.exe
  C:\Windows\System32\jItXgoK.exe
  2⤵
  PID:9584
- C:\Windows\System32\FOXQigA.exe
  C:\Windows\System32\FOXQigA.exe
  2⤵
  PID:9612
- C:\Windows\System32\UJniaHD.exe
  C:\Windows\System32\UJniaHD.exe
  2⤵
  PID:9640
- C:\Windows\System32\qpFzLna.exe
  C:\Windows\System32\qpFzLna.exe
  2⤵
  PID:9672
- C:\Windows\System32\yiNfHzf.exe
  C:\Windows\System32\yiNfHzf.exe
  2⤵
  PID:9692
- C:\Windows\System32\ncSkgWx.exe
  C:\Windows\System32\ncSkgWx.exe
  2⤵
  PID:9712
- C:\Windows\System32\lOQCARt.exe
  C:\Windows\System32\lOQCARt.exe
  2⤵
  PID:9772
- C:\Windows\System32\bNktRdh.exe
  C:\Windows\System32\bNktRdh.exe
  2⤵
  PID:9788
- C:\Windows\System32\lcFGXfS.exe
  C:\Windows\System32\lcFGXfS.exe
  2⤵
  PID:9808
- C:\Windows\System32\hFcOLdT.exe
  C:\Windows\System32\hFcOLdT.exe
  2⤵
  PID:9824
- C:\Windows\System32\icJFxEY.exe
  C:\Windows\System32\icJFxEY.exe
  2⤵
  PID:9848
- C:\Windows\System32\cirdqzm.exe
  C:\Windows\System32\cirdqzm.exe
  2⤵
  PID:9868
- C:\Windows\System32\MgHbxnX.exe
  C:\Windows\System32\MgHbxnX.exe
  2⤵
  PID:9888
- C:\Windows\System32\WcdTlaV.exe
  C:\Windows\System32\WcdTlaV.exe
  2⤵
  PID:9960
- C:\Windows\System32\XpxNRbR.exe
  C:\Windows\System32\XpxNRbR.exe
  2⤵
  PID:9984
- C:\Windows\System32\gtjrYBO.exe
  C:\Windows\System32\gtjrYBO.exe
  2⤵
  PID:10004
- C:\Windows\System32\rRHydKO.exe
  C:\Windows\System32\rRHydKO.exe
  2⤵
  PID:10020
- C:\Windows\System32\KciDjsB.exe
  C:\Windows\System32\KciDjsB.exe
  2⤵
  PID:10036
- C:\Windows\System32\kcSyXqP.exe
  C:\Windows\System32\kcSyXqP.exe
  2⤵
  PID:10056
- C:\Windows\System32\SFcIuTA.exe
  C:\Windows\System32\SFcIuTA.exe
  2⤵
  PID:10072
- C:\Windows\System32\QDyPvuy.exe
  C:\Windows\System32\QDyPvuy.exe
  2⤵
  PID:10132
- C:\Windows\System32\OlMOMMl.exe
  C:\Windows\System32\OlMOMMl.exe
  2⤵
  PID:10148
- C:\Windows\System32\YOFXGUJ.exe
  C:\Windows\System32\YOFXGUJ.exe
  2⤵
  PID:10172
- C:\Windows\System32\HDwhAAp.exe
  C:\Windows\System32\HDwhAAp.exe
  2⤵
  PID:10204
- C:\Windows\System32\YAtBuSe.exe
  C:\Windows\System32\YAtBuSe.exe
  2⤵
  PID:10220
- C:\Windows\System32\alLdtNJ.exe
  C:\Windows\System32\alLdtNJ.exe
  2⤵
  PID:8500
- C:\Windows\System32\pGOWyfs.exe
  C:\Windows\System32\pGOWyfs.exe
  2⤵
  PID:9244
- C:\Windows\System32\PyXGrvf.exe
  C:\Windows\System32\PyXGrvf.exe
  2⤵
  PID:9360
- C:\Windows\System32\GFIPWKB.exe
  C:\Windows\System32\GFIPWKB.exe
  2⤵
  PID:9408
- C:\Windows\System32\CeSyJtx.exe
  C:\Windows\System32\CeSyJtx.exe
  2⤵
  PID:9448
- C:\Windows\System32\JfuDhMM.exe
  C:\Windows\System32\JfuDhMM.exe
  2⤵
  PID:9572
- C:\Windows\System32\pKqEvvL.exe
  C:\Windows\System32\pKqEvvL.exe
  2⤵
  PID:9684
- C:\Windows\System32\OdjGDOC.exe
  C:\Windows\System32\OdjGDOC.exe
  2⤵
  PID:9704
- C:\Windows\System32\sXPtcXr.exe
  C:\Windows\System32\sXPtcXr.exe
  2⤵
  PID:9844
- C:\Windows\System32\UsXjacT.exe
  C:\Windows\System32\UsXjacT.exe
  2⤵
  PID:9912
- C:\Windows\System32\SWkztvz.exe
  C:\Windows\System32\SWkztvz.exe
  2⤵
  PID:9968
- C:\Windows\System32\qFHHqHl.exe
  C:\Windows\System32\qFHHqHl.exe
  2⤵
  PID:10048
- C:\Windows\System32\qlatMQa.exe
  C:\Windows\System32\qlatMQa.exe
  2⤵
  PID:10000
- C:\Windows\System32\zAmcVKu.exe
  C:\Windows\System32\zAmcVKu.exe
  2⤵
  PID:10028
- C:\Windows\System32\RRxZAlH.exe
  C:\Windows\System32\RRxZAlH.exe
  2⤵
  PID:10160
- C:\Windows\System32\ACDvkKa.exe
  C:\Windows\System32\ACDvkKa.exe
  2⤵
  PID:9224
- C:\Windows\System32\sKIYRic.exe
  C:\Windows\System32\sKIYRic.exe
  2⤵
  PID:9548
- C:\Windows\System32\jwKCsMT.exe
  C:\Windows\System32\jwKCsMT.exe
  2⤵
  PID:9608
- C:\Windows\System32\DpFikSh.exe
  C:\Windows\System32\DpFikSh.exe
  2⤵
  PID:9820
- C:\Windows\System32\PzalRJv.exe
  C:\Windows\System32\PzalRJv.exe
  2⤵
  PID:9896
- C:\Windows\System32\lYjsYcK.exe
  C:\Windows\System32\lYjsYcK.exe
  2⤵
  PID:10096
- C:\Windows\System32\dEFBbHS.exe
  C:\Windows\System32\dEFBbHS.exe
  2⤵
  PID:10156
- C:\Windows\System32\FPXINze.exe
  C:\Windows\System32\FPXINze.exe
  2⤵
  PID:9384
- C:\Windows\System32\YMnabnI.exe
  C:\Windows\System32\YMnabnI.exe
  2⤵
  PID:9764
- C:\Windows\System32\gZbKlPs.exe
  C:\Windows\System32\gZbKlPs.exe
  2⤵
  PID:9636
- C:\Windows\System32\doAJKek.exe
  C:\Windows\System32\doAJKek.exe
  2⤵
  PID:10032
- C:\Windows\System32\tZsnstD.exe
  C:\Windows\System32\tZsnstD.exe
  2⤵
  PID:10248
- C:\Windows\System32\VGPlVPD.exe
  C:\Windows\System32\VGPlVPD.exe
  2⤵
  PID:10276
- C:\Windows\System32\JWdqtTR.exe
  C:\Windows\System32\JWdqtTR.exe
  2⤵
  PID:10292
- C:\Windows\System32\bGyAdrN.exe
  C:\Windows\System32\bGyAdrN.exe
  2⤵
  PID:10312
- C:\Windows\System32\kgxUpQG.exe
  C:\Windows\System32\kgxUpQG.exe
  2⤵
  PID:10336
- C:\Windows\System32\YKNtWqI.exe
  C:\Windows\System32\YKNtWqI.exe
  2⤵
  PID:10356
- C:\Windows\System32\PfHJLQF.exe
  C:\Windows\System32\PfHJLQF.exe
  2⤵
  PID:10392
- C:\Windows\System32\icXJMlz.exe
  C:\Windows\System32\icXJMlz.exe
  2⤵
  PID:10440
- C:\Windows\System32\hYdnQWt.exe
  C:\Windows\System32\hYdnQWt.exe
  2⤵
  PID:10464
- C:\Windows\System32\DnwqFfy.exe
  C:\Windows\System32\DnwqFfy.exe
  2⤵
  PID:10504
- C:\Windows\System32\bDRCmuc.exe
  C:\Windows\System32\bDRCmuc.exe
  2⤵
  PID:10536
- C:\Windows\System32\oPZFWwg.exe
  C:\Windows\System32\oPZFWwg.exe
  2⤵
  PID:10564
- C:\Windows\System32\HHFTxsE.exe
  C:\Windows\System32\HHFTxsE.exe
  2⤵
  PID:10588
- C:\Windows\System32\BdRTzYw.exe
  C:\Windows\System32\BdRTzYw.exe
  2⤵
  PID:10612
- C:\Windows\System32\AzvQghp.exe
  C:\Windows\System32\AzvQghp.exe
  2⤵
  PID:10652
- C:\Windows\System32\UrNMhQq.exe
  C:\Windows\System32\UrNMhQq.exe
  2⤵
  PID:10672
- C:\Windows\System32\SoWDARv.exe
  C:\Windows\System32\SoWDARv.exe
  2⤵
  PID:10716
- C:\Windows\System32\onXCOPL.exe
  C:\Windows\System32\onXCOPL.exe
  2⤵
  PID:10744
- C:\Windows\System32\ECZPiuw.exe
  C:\Windows\System32\ECZPiuw.exe
  2⤵
  PID:10768
- C:\Windows\System32\sfbJosV.exe
  C:\Windows\System32\sfbJosV.exe
  2⤵
  PID:10788
- C:\Windows\System32\LDvOayF.exe
  C:\Windows\System32\LDvOayF.exe
  2⤵
  PID:10828
- C:\Windows\System32\lLEJyAD.exe
  C:\Windows\System32\lLEJyAD.exe
  2⤵
  PID:10852
- C:\Windows\System32\TNjOQhz.exe
  C:\Windows\System32\TNjOQhz.exe
  2⤵
  PID:10876
- C:\Windows\System32\BatEoZD.exe
  C:\Windows\System32\BatEoZD.exe
  2⤵
  PID:10892
- C:\Windows\System32\vCAoFlD.exe
  C:\Windows\System32\vCAoFlD.exe
  2⤵
  PID:10932
- C:\Windows\System32\qgZpzen.exe
  C:\Windows\System32\qgZpzen.exe
  2⤵
  PID:10964
- C:\Windows\System32\mnOmvpV.exe
  C:\Windows\System32\mnOmvpV.exe
  2⤵
  PID:10988
- C:\Windows\System32\zIIeHMy.exe
  C:\Windows\System32\zIIeHMy.exe
  2⤵
  PID:11012
- C:\Windows\System32\EvkaGvD.exe
  C:\Windows\System32\EvkaGvD.exe
  2⤵
  PID:11028
- C:\Windows\System32\ewFXNox.exe
  C:\Windows\System32\ewFXNox.exe
  2⤵
  PID:11088
- C:\Windows\System32\hWGgjvQ.exe
  C:\Windows\System32\hWGgjvQ.exe
  2⤵
  PID:11120
- C:\Windows\System32\CHDpnli.exe
  C:\Windows\System32\CHDpnli.exe
  2⤵
  PID:11140
- C:\Windows\System32\hPONqUl.exe
  C:\Windows\System32\hPONqUl.exe
  2⤵
  PID:11156
- C:\Windows\System32\yysbZtx.exe
  C:\Windows\System32\yysbZtx.exe
  2⤵
  PID:11180
- C:\Windows\System32\SkSKSPp.exe
  C:\Windows\System32\SkSKSPp.exe
  2⤵
  PID:11220
- C:\Windows\System32\zoLXEYF.exe
  C:\Windows\System32\zoLXEYF.exe
  2⤵
  PID:11244
- C:\Windows\System32\xbBmGje.exe
  C:\Windows\System32\xbBmGje.exe
  2⤵
  PID:10016
- C:\Windows\System32\BMCxJRH.exe
  C:\Windows\System32\BMCxJRH.exe
  2⤵
  PID:10256
- C:\Windows\System32\GhNoYaK.exe
  C:\Windows\System32\GhNoYaK.exe
  2⤵
  PID:10380
- C:\Windows\System32\nXNTDrl.exe
  C:\Windows\System32\nXNTDrl.exe
  2⤵
  PID:10348
- C:\Windows\System32\wJaMeWQ.exe
  C:\Windows\System32\wJaMeWQ.exe
  2⤵
  PID:10496
- C:\Windows\System32\LaOxlev.exe
  C:\Windows\System32\LaOxlev.exe
  2⤵
  PID:10488
- C:\Windows\System32\AvFpbhN.exe
  C:\Windows\System32\AvFpbhN.exe
  2⤵
  PID:10548
- C:\Windows\System32\pZeFWUg.exe
  C:\Windows\System32\pZeFWUg.exe
  2⤵
  PID:10608
- C:\Windows\System32\scWerVD.exe
  C:\Windows\System32\scWerVD.exe
  2⤵
  PID:10732
- C:\Windows\System32\KNJapNz.exe
  C:\Windows\System32\KNJapNz.exe
  2⤵
  PID:10756
- C:\Windows\System32\sdVBHxz.exe
  C:\Windows\System32\sdVBHxz.exe
  2⤵
  PID:10840
- C:\Windows\System32\GbtNQoV.exe
  C:\Windows\System32\GbtNQoV.exe
  2⤵
  PID:10900
- C:\Windows\System32\pwMDSVl.exe
  C:\Windows\System32\pwMDSVl.exe
  2⤵
  PID:10928
- C:\Windows\System32\ntAfmjp.exe
  C:\Windows\System32\ntAfmjp.exe
  2⤵
  PID:10980
- C:\Windows\System32\pFsglPQ.exe
  C:\Windows\System32\pFsglPQ.exe
  2⤵
  PID:11084
- C:\Windows\System32\jyuyLqW.exe
  C:\Windows\System32\jyuyLqW.exe
  2⤵
  PID:11172
- C:\Windows\System32\LROOgMz.exe
  C:\Windows\System32\LROOgMz.exe
  2⤵
  PID:9948
- C:\Windows\System32\INUgIAF.exe
  C:\Windows\System32\INUgIAF.exe
  2⤵
  PID:10328
- C:\Windows\System32\FZrcSWg.exe
  C:\Windows\System32\FZrcSWg.exe
  2⤵
  PID:10476
- C:\Windows\System32\WVnrJlf.exe
  C:\Windows\System32\WVnrJlf.exe
  2⤵
  PID:10684
- C:\Windows\System32\EJssASl.exe
  C:\Windows\System32\EJssASl.exe
  2⤵
  PID:10860
- C:\Windows\System32\ObZWIiK.exe
  C:\Windows\System32\ObZWIiK.exe
  2⤵
  PID:10940
- C:\Windows\System32\KgMFHkg.exe
  C:\Windows\System32\KgMFHkg.exe
  2⤵
  PID:11108
- C:\Windows\System32\YifPpcL.exe
  C:\Windows\System32\YifPpcL.exe
  2⤵
  PID:11252
- C:\Windows\System32\RVgmwiF.exe
  C:\Windows\System32\RVgmwiF.exe
  2⤵
  PID:10524
- C:\Windows\System32\GiMEOUN.exe
  C:\Windows\System32\GiMEOUN.exe
  2⤵
  PID:11064
- C:\Windows\System32\ncUOGHm.exe
  C:\Windows\System32\ncUOGHm.exe
  2⤵
  PID:10696
- C:\Windows\System32\KSIodXz.exe
  C:\Windows\System32\KSIodXz.exe
  2⤵
  PID:11212
- C:\Windows\System32\gaNZYyQ.exe
  C:\Windows\System32\gaNZYyQ.exe
  2⤵
  PID:11280
- C:\Windows\System32\fUxPAia.exe
  C:\Windows\System32\fUxPAia.exe
  2⤵
  PID:11304
- C:\Windows\System32\XfNjWgF.exe
  C:\Windows\System32\XfNjWgF.exe
  2⤵
  PID:11324
- C:\Windows\System32\PRWjtZb.exe
  C:\Windows\System32\PRWjtZb.exe
  2⤵
  PID:11340
- C:\Windows\System32\ghdjGaT.exe
  C:\Windows\System32\ghdjGaT.exe
  2⤵
  PID:11380
- C:\Windows\System32\ZCfTyxC.exe
  C:\Windows\System32\ZCfTyxC.exe
  2⤵
  PID:11420
- C:\Windows\System32\mnlyNIf.exe
  C:\Windows\System32\mnlyNIf.exe
  2⤵
  PID:11460
- C:\Windows\System32\YNnMlOt.exe
  C:\Windows\System32\YNnMlOt.exe
  2⤵
  PID:11484
- C:\Windows\System32\KHSoZaF.exe
  C:\Windows\System32\KHSoZaF.exe
  2⤵
  PID:11504
- C:\Windows\System32\aBDYOiG.exe
  C:\Windows\System32\aBDYOiG.exe
  2⤵
  PID:11536
- C:\Windows\System32\JPEExDd.exe
  C:\Windows\System32\JPEExDd.exe
  2⤵
  PID:11568
- C:\Windows\System32\bXIkrMR.exe
  C:\Windows\System32\bXIkrMR.exe
  2⤵
  PID:11592
- C:\Windows\System32\dguLyGN.exe
  C:\Windows\System32\dguLyGN.exe
  2⤵
  PID:11616
- C:\Windows\System32\qDlAxRB.exe
  C:\Windows\System32\qDlAxRB.exe
  2⤵
  PID:11632
- C:\Windows\System32\hqbAadg.exe
  C:\Windows\System32\hqbAadg.exe
  2⤵
  PID:11660
- C:\Windows\System32\dZxSvOY.exe
  C:\Windows\System32\dZxSvOY.exe
  2⤵
  PID:11684
- C:\Windows\System32\jCGJWrS.exe
  C:\Windows\System32\jCGJWrS.exe
  2⤵
  PID:11704
- C:\Windows\System32\AaLXyPk.exe
  C:\Windows\System32\AaLXyPk.exe
  2⤵
  PID:11736
- C:\Windows\System32\avyfmwe.exe
  C:\Windows\System32\avyfmwe.exe
  2⤵
  PID:11760
- C:\Windows\System32\ZBsHQCf.exe
  C:\Windows\System32\ZBsHQCf.exe
  2⤵
  PID:11812
- C:\Windows\System32\LsfXiRd.exe
  C:\Windows\System32\LsfXiRd.exe
  2⤵
  PID:11832
- C:\Windows\System32\hFlZrXA.exe
  C:\Windows\System32\hFlZrXA.exe
  2⤵
  PID:11872
- C:\Windows\System32\jiacqBU.exe
  C:\Windows\System32\jiacqBU.exe
  2⤵
  PID:11900
- C:\Windows\System32\YHeceHY.exe
  C:\Windows\System32\YHeceHY.exe
  2⤵
  PID:11928
- C:\Windows\System32\dzUePHp.exe
  C:\Windows\System32\dzUePHp.exe
  2⤵
  PID:11944
- C:\Windows\System32\zleIoJE.exe
  C:\Windows\System32\zleIoJE.exe
  2⤵
  PID:11988
- C:\Windows\System32\bqIyoxc.exe
  C:\Windows\System32\bqIyoxc.exe
  2⤵
  PID:12012
- C:\Windows\System32\htCxBxr.exe
  C:\Windows\System32\htCxBxr.exe
  2⤵
  PID:12028
- C:\Windows\System32\wBGufzs.exe
  C:\Windows\System32\wBGufzs.exe
  2⤵
  PID:12072
- C:\Windows\System32\WUkVHQu.exe
  C:\Windows\System32\WUkVHQu.exe
  2⤵
  PID:12104
- C:\Windows\System32\VShQnlp.exe
  C:\Windows\System32\VShQnlp.exe
  2⤵
  PID:12144
- C:\Windows\System32\knlhRZx.exe
  C:\Windows\System32\knlhRZx.exe
  2⤵
  PID:12184
- C:\Windows\System32\TzeoKAr.exe
  C:\Windows\System32\TzeoKAr.exe
  2⤵
  PID:12212
- C:\Windows\System32\TjZjYgu.exe
  C:\Windows\System32\TjZjYgu.exe
  2⤵
  PID:12236
- C:\Windows\System32\xjNPCLs.exe
  C:\Windows\System32\xjNPCLs.exe
  2⤵
  PID:12256
- C:\Windows\System32\gEhtSVV.exe
  C:\Windows\System32\gEhtSVV.exe
  2⤵
  PID:12276
- C:\Windows\System32\DWstzAO.exe
  C:\Windows\System32\DWstzAO.exe
  2⤵
  PID:11288
- C:\Windows\System32\mnkRptr.exe
  C:\Windows\System32\mnkRptr.exe
  2⤵
  PID:11376
- C:\Windows\System32\MbfybfM.exe
  C:\Windows\System32\MbfybfM.exe
  2⤵
  PID:11432
- C:\Windows\System32\JrpxCtt.exe
  C:\Windows\System32\JrpxCtt.exe
  2⤵
  PID:11496
- C:\Windows\System32\buUwVTr.exe
  C:\Windows\System32\buUwVTr.exe
  2⤵
  PID:11600
- C:\Windows\System32\vIyGofm.exe
  C:\Windows\System32\vIyGofm.exe
  2⤵
  PID:11648
- C:\Windows\System32\hLsFXGM.exe
  C:\Windows\System32\hLsFXGM.exe
  2⤵
  PID:11700
- C:\Windows\System32\PMBKDAm.exe
  C:\Windows\System32\PMBKDAm.exe
  2⤵
  PID:11768
- C:\Windows\System32\fATTZcJ.exe
  C:\Windows\System32\fATTZcJ.exe
  2⤵
  PID:11896
- C:\Windows\System32\GQgcupI.exe
  C:\Windows\System32\GQgcupI.exe
  2⤵
  PID:11940
- C:\Windows\System32\yZCIrHc.exe
  C:\Windows\System32\yZCIrHc.exe
  2⤵
  PID:11976
- C:\Windows\System32\onjrZtm.exe
  C:\Windows\System32\onjrZtm.exe
  2⤵
  PID:12040
- C:\Windows\System32\xILrjuY.exe
  C:\Windows\System32\xILrjuY.exe
  2⤵
  PID:12088
- C:\Windows\System32\mGkmtCD.exe
  C:\Windows\System32\mGkmtCD.exe
  2⤵
  PID:12132
- C:\Windows\System32\FLHkQMu.exe
  C:\Windows\System32\FLHkQMu.exe
  2⤵
  PID:12268
- C:\Windows\System32\ShRvhyO.exe
  C:\Windows\System32\ShRvhyO.exe
  2⤵
  PID:11408
- C:\Windows\System32\pcRcDOC.exe
  C:\Windows\System32\pcRcDOC.exe
  2⤵
  PID:11512
- C:\Windows\System32\QvduGQX.exe
  C:\Windows\System32\QvduGQX.exe
  2⤵
  PID:11628
- C:\Windows\System32\UVZfhdK.exe
  C:\Windows\System32\UVZfhdK.exe
  2⤵
  PID:11844
- C:\Windows\System32\BKQtLYe.exe
  C:\Windows\System32\BKQtLYe.exe
  2⤵
  PID:11996
- C:\Windows\System32\avVZhqp.exe
  C:\Windows\System32\avVZhqp.exe
  2⤵
  PID:12036
- C:\Windows\System32\Yxclbal.exe
  C:\Windows\System32\Yxclbal.exe
  2⤵
  PID:10800
- C:\Windows\System32\bLvTVZc.exe
  C:\Windows\System32\bLvTVZc.exe
  2⤵
  PID:11752
- C:\Windows\System32\JBdIjoW.exe
  C:\Windows\System32\JBdIjoW.exe
  2⤵
  PID:12116
- C:\Windows\System32\FPDUeib.exe
  C:\Windows\System32\FPDUeib.exe
  2⤵
  PID:11316
- C:\Windows\System32\DPdjcuO.exe
  C:\Windows\System32\DPdjcuO.exe
  2⤵
  PID:1784
- C:\Windows\System32\tBVyEXC.exe
  C:\Windows\System32\tBVyEXC.exe
  2⤵
  PID:6352
- C:\Windows\System32\ezpwKzF.exe
  C:\Windows\System32\ezpwKzF.exe
  2⤵
  PID:11916
- C:\Windows\System32\lQFuxTy.exe
  C:\Windows\System32\lQFuxTy.exe
  2⤵
  PID:12300
- C:\Windows\System32\uUhXOYn.exe
  C:\Windows\System32\uUhXOYn.exe
  2⤵
  PID:12328
- C:\Windows\System32\swaYKXM.exe
  C:\Windows\System32\swaYKXM.exe
  2⤵
  PID:12348
- C:\Windows\System32\xlpdlzq.exe
  C:\Windows\System32\xlpdlzq.exe
  2⤵
  PID:12372
- C:\Windows\System32\kCiRRSf.exe
  C:\Windows\System32\kCiRRSf.exe
  2⤵
  PID:12396
- C:\Windows\System32\KRKNQqQ.exe
  C:\Windows\System32\KRKNQqQ.exe
  2⤵
  PID:12412
- C:\Windows\System32\wMakRxu.exe
  C:\Windows\System32\wMakRxu.exe
  2⤵
  PID:12436
- C:\Windows\System32\OlwQtAn.exe
  C:\Windows\System32\OlwQtAn.exe
  2⤵
  PID:12464
- C:\Windows\System32\qdxAZeO.exe
  C:\Windows\System32\qdxAZeO.exe
  2⤵
  PID:12520
- C:\Windows\System32\HEpvkQQ.exe
  C:\Windows\System32\HEpvkQQ.exe
  2⤵
  PID:12544
- C:\Windows\System32\aDQCmup.exe
  C:\Windows\System32\aDQCmup.exe
  2⤵
  PID:12564
- C:\Windows\System32\FFPzwHT.exe
  C:\Windows\System32\FFPzwHT.exe
  2⤵
  PID:12592
- C:\Windows\System32\UFwDuOc.exe
  C:\Windows\System32\UFwDuOc.exe
  2⤵
  PID:12612
- C:\Windows\System32\wonWRoU.exe
  C:\Windows\System32\wonWRoU.exe
  2⤵
  PID:12652
- C:\Windows\System32\sqNGbts.exe
  C:\Windows\System32\sqNGbts.exe
  2⤵
  PID:12672
- C:\Windows\System32\xqTpyik.exe
  C:\Windows\System32\xqTpyik.exe
  2⤵
  PID:12720
- C:\Windows\System32\HxJdLcd.exe
  C:\Windows\System32\HxJdLcd.exe
  2⤵
  PID:12740
- C:\Windows\System32\GyKQRui.exe
  C:\Windows\System32\GyKQRui.exe
  2⤵
  PID:12768
- C:\Windows\System32\LnfYYjo.exe
  C:\Windows\System32\LnfYYjo.exe
  2⤵
  PID:12788
- C:\Windows\System32\dlNjAoK.exe
  C:\Windows\System32\dlNjAoK.exe
  2⤵
  PID:12816
- C:\Windows\System32\AlsFzNf.exe
  C:\Windows\System32\AlsFzNf.exe
  2⤵
  PID:12832
- C:\Windows\System32\FnLxKPj.exe
  C:\Windows\System32\FnLxKPj.exe
  2⤵
  PID:12860
- C:\Windows\System32\ZOHEVkm.exe
  C:\Windows\System32\ZOHEVkm.exe
  2⤵
  PID:12876
- C:\Windows\System32\wccEpDR.exe
  C:\Windows\System32\wccEpDR.exe
  2⤵
  PID:12900
- C:\Windows\System32\sqnGqwk.exe
  C:\Windows\System32\sqnGqwk.exe
  2⤵
  PID:12920
- C:\Windows\System32\BcejJvO.exe
  C:\Windows\System32\BcejJvO.exe
  2⤵
  PID:12944
- C:\Windows\System32\oVPWeDK.exe
  C:\Windows\System32\oVPWeDK.exe
  2⤵
  PID:13016
- C:\Windows\System32\pbcrXSK.exe
  C:\Windows\System32\pbcrXSK.exe
  2⤵
  PID:13040
- C:\Windows\System32\QaVaKAn.exe
  C:\Windows\System32\QaVaKAn.exe
  2⤵
  PID:13072
- C:\Windows\System32\iCzUwRb.exe
  C:\Windows\System32\iCzUwRb.exe
  2⤵
  PID:13092
- C:\Windows\System32\MkcPrrn.exe
  C:\Windows\System32\MkcPrrn.exe
  2⤵
  PID:13144
- C:\Windows\System32\jCARZoW.exe
  C:\Windows\System32\jCARZoW.exe
  2⤵
  PID:13172
- C:\Windows\System32\LYiHfNC.exe
  C:\Windows\System32\LYiHfNC.exe
  2⤵
  PID:13196
- C:\Windows\System32\tKthfaD.exe
  C:\Windows\System32\tKthfaD.exe
  2⤵
  PID:13216
- C:\Windows\System32\deJRVlv.exe
  C:\Windows\System32\deJRVlv.exe
  2⤵
  PID:13232
- C:\Windows\System32\PpNWIsq.exe
  C:\Windows\System32\PpNWIsq.exe
  2⤵
  PID:13256
- C:\Windows\System32\phvARvy.exe
  C:\Windows\System32\phvARvy.exe
  2⤵
  PID:13300
- C:\Windows\System32\DWUdQrb.exe
  C:\Windows\System32\DWUdQrb.exe
  2⤵
  PID:1020
- C:\Windows\System32\FTPiOrQ.exe
  C:\Windows\System32\FTPiOrQ.exe
  2⤵
  PID:12360
- C:\Windows\System32\nCuDHEL.exe
  C:\Windows\System32\nCuDHEL.exe
  2⤵
  PID:12460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\AHzMTtY.exe

Filesize
1.4MB

MD5
86c9b82351334cabc6c8610c40f88eaf

SHA1
21175aa7866cffcef60e05c475a59eb6543edb00

SHA256
fc2dda264e5e94ee87a6b4e50c4bca0dba0841738b1b41ec73616e302ef587b5

SHA512
090fc1c8426a99863c63eb3cec3b5673f354cb6ccfbfde56aa9e1d4e661bba07fc14c417f995e74882d8121100d9f24b230b0b5a546fb0990a4c1da0f0281c40

Download Submit
C:\Windows\System32\BnnOMxB.exe

Filesize
1.4MB

MD5
f6388c3522f5d72ce65fb4e184b52ba4

SHA1
6af44540c3b8e2cec8de4cb48ab4de323a2446d2

SHA256
0d6b2f5e9c76e8adfb0fcf9b892cc03566aaa2b308796fc58af10be123f0db57

SHA512
96416ba07079390a096b7f7282df35edf0c2a7eed0ff8488cc40cec3d0755e97463b53397cf882143ab249852a6f4cb05f565284d7215beca0332f2d7f65e903

Download Submit
C:\Windows\System32\DLJfLbM.exe

Filesize
1.4MB

MD5
d14c912172e2daa2d62bdc953fb62f38

SHA1
2b377aa92a2163cbd23d96957979fc6daa904ba1

SHA256
9b821b23302f8e6a5f8f25764a0713cfbec95083af8e81abed55970318026fc5

SHA512
a2b1b34deac67493d843694bd54fe0c86c22e23198c8b363725e09d8626b5f005aeda957f84167e688b4d6fb52c5961368cf312f5bed9e86c5b691ef7f075dba

Download Submit
C:\Windows\System32\DfxuNUb.exe

Filesize
1.4MB

MD5
f1d3cc8d999cd82366e1d74ffb62adf1

SHA1
505a6fabc567410d8729a7fb9e88728d1fe20f3e

SHA256
d6bb1e129e1cc210f6527f11ad51af648b3989bfa195ace7a1f51af80b580518

SHA512
ceaabcaf50d7b1e638cc1750dd2f107f028ab7c7e956e2e6181efc1a3c91b8eeefc6bae1bc03e119288482245771b4f992d21cb378786875c3d132910a8b8e5a

Download Submit
C:\Windows\System32\EmqRuka.exe

Filesize
1.4MB

MD5
eba8cc8ab74b9d4d9f8d305df90991ed

SHA1
aad7e73ff83124d41879499bb04382e662f57aae

SHA256
d32b68e04c7f6ae8a98097582fb7f1cb47e8c0a149f97a75102e36a5f8d9c6f2

SHA512
4d33e5ab3acbc6f1ed9372fed4ce23c4735cbb81430deeb688753520c22ae4d3c29cc875cbdcaa0c7b1dbf4fda6ed97776ae44a764cacc44fa3802b9c67872e2

Download Submit
C:\Windows\System32\GebCIcG.exe

Filesize
1.4MB

MD5
f66af1afddae1dd52842a8dd3ef8ffaa

SHA1
70472e8ada846ec6ca3233004ecfbe9053c85002

SHA256
b66ae139f49147d843e655fba1c211292acf087e0bcc8de9c2e29b2fdcc94c2a

SHA512
55316554d6612c063c03a4667d9b237821ddfb125a44df689135fedefc6eeea50c0744df269b383059899317d87bd259e80878e4efe0732bc6cdc7221d4073ef

Download Submit
C:\Windows\System32\HcyMqjQ.exe

Filesize
1.4MB

MD5
48e962cc62896efd760abc993debfd03

SHA1
2bf0744b9a7176cea9a3e56e80854d18552bb77e

SHA256
4512ce5fe35e96b51af8c26aba72410e58c57b371ccf714ba501a0b55084ba9a

SHA512
ba397eead88c2a5b099b0ec5201498b925268f5fd3589fb9a1d43fa4ee5f9c3317c02e0eb1403c130598ef770694fb12a6480224358fb667b26679f344dcadaf

Download Submit
C:\Windows\System32\IcLfWRp.exe

Filesize
1.4MB

MD5
96f00aa4e6a1ba058998e8d81ee35d6c

SHA1
7ce61cd6cc4a3899b1d650ef35a80310e1d2a72d

SHA256
a1596b0895f756ce45973096aef6edc8872860e56d32396f6b329d62b06771c7

SHA512
c74e2f7bfa205bbee7abe1bf2951e074a3e3d4f63de84a6b3650479b1112c7c31d4887e9689f1eb17911e19e66e6de4ce0432ab64d0897608805dff342dafb77

Download Submit
C:\Windows\System32\JhGHzhD.exe

Filesize
1.4MB

MD5
6d32c911ac52799d100f0da7110384a4

SHA1
0406f5a068d6dd639596884458ba2e111d3fb646

SHA256
a0dfb7e63056b3b05e7b4728bd240b316d3ca6995725986bed83d6763a6fc9eb

SHA512
a807dac3d8de875eafce068e5708da5b4b8a0f56e8e4a0ba644bcdff1ce5054e0f3b4abb042afd3683d298492a4890654f44cffd9a8f8c2b81606ad0578b5a27

Download Submit
C:\Windows\System32\LVLWnXg.exe

Filesize
1.4MB

MD5
558c1f55685f45b47d07fcbde66f2de0

SHA1
0bd2600a96cd6a50c726d5745fad406d127e78d6

SHA256
b72fcb3fbe24c5f9024dfbc03b8122d2a994c7c3bf9b4b9f4f21e7d9c9709b69

SHA512
45e42f922920e5e86c78ed5e521e82059427fc931fc02d9c0cb3796e8c7aa64aad2b45daa61faa8cf8e5eb0e25a9a8ade4cc9a7d0bfc9a98b1a8228e02709397

Download Submit
C:\Windows\System32\LwwHPVJ.exe

Filesize
1.4MB

MD5
57866f02d358a2bc2acea29221e4aaad

SHA1
d61a87b57dc659165d8f43b8b775919b542ccca2

SHA256
822e58e412240df696879649da1d4a5eb0f1ad02c5d6616adb98821ab899303c

SHA512
0ad7122da163925a3266d23fa66080a702d0226cb91c82df421a8df4097e0f9fd9ec042d658517fd9bd478478409a8235acc5e8b5bfb3f5ff4d38618c2b7ea94

Download Submit
C:\Windows\System32\NuJBMAu.exe

Filesize
1.4MB

MD5
1eedb5fcef7c0c142aabda7d7a6e4432

SHA1
836d5e8d9a52aa3914369c7abd3e4b138e4ba697

SHA256
25786c1cf835dee0dd4ac13a49485c010df43f5d2ac38788f393571d35f3e6a3

SHA512
6231b5f016704aad106fa7cff676aed1a44958f6edeb185fff94e6c66c45f04c3926862afd88eafdc01bfd55e5db42aea6194120331af0c5429de05f19789e4c

Download Submit
C:\Windows\System32\PUZkjCj.exe

Filesize
1.4MB

MD5
ec337761995229f6f81e7aa7f64adf22

SHA1
a066ff4d6ee508e288d35933c880ced2db63e164

SHA256
57846ab846428caff9e5992e7b4235b9cae4d3ec4d7cca42fadf5a12ab186a9c

SHA512
159c0b3648aa101f3fa86e75d37264ddf45e944bf1c4d0e78fd57661086679d37cd2966d40207b58cb114d045d30f238372189b34fa851fff6e744c139d073f4

Download Submit
C:\Windows\System32\QUabiDm.exe

Filesize
1.4MB

MD5
720041e0eac3f6f114dde8a8cdda794d

SHA1
4272b5af24a02e2f6fa05c4ef074813838fd8cb3

SHA256
a56700d487f9e696f709c038871897790c14d3b1571b526bd11959ee20ad288e

SHA512
69479a1a6f6a1449bc962be318008a32c0ca4b8d6208d1ee022c99f64e587b57912f65f8be608f318ab7d76ec1528aa014f380bb8ee1d9dad09afefb8c3f9517

Download Submit
C:\Windows\System32\RyUNIYG.exe

Filesize
1.4MB

MD5
8bffc40aa0f821f6811afd94d709a765

SHA1
923c6a36087586ea833cd5c2e8b0554db50d7680

SHA256
2f69c519afc12292cb460e2e02c69ec9d6905e8804cd4aabe01d2842a747090c

SHA512
2ff0b3018af448ad68e6e57e778495135feed15f8952a40f44b1aa3f0670cb686bd63916d16cc937fcc75e191078302ed408f0c4bac5ab339b56980233c99744

Download Submit
C:\Windows\System32\TKvJVMF.exe

Filesize
1.4MB

MD5
7b52ed696a36542d6e1abcd85d15c79b

SHA1
2b026f67336793730e55bed0f5501bc24161f691

SHA256
64d86241cdaf78a7bffd3f429b1d42f528364a5cc2c5d37b2b8e985e72d01496

SHA512
71a468273828f9ab8f8d32c34abb9d20850f9ecf9e46d240c28d81ea1d420653a423316117955cd2b07699317d2aa6e3f5b0614ff4d7b24825562cb5980fe115

Download Submit
C:\Windows\System32\UrBVPxK.exe

Filesize
1.4MB

MD5
fc2a1ae1193c8b43fc141ddf3a975eff

SHA1
1ba93ee2f371c22f1d617be34bef0fb5046f5fab

SHA256
457a3fe8dc959e8da2c3d918e213fbef0c3571b2c8546e512abb93356863f770

SHA512
37ff2912de092c46be6d0186821a325fbf47d96615a51a887a3444ceae5b6bc1dd0eeac37c6f4d93b3335f7466a28717efa9a8aff667e5949806d966b5d841e7

Download Submit
C:\Windows\System32\VBqGdiV.exe

Filesize
1.4MB

MD5
0e516bfb6dc621b3dd202a9359588631

SHA1
316247f04ce5f54d3d9e24e97703bc0d367de755

SHA256
aae6a8091ba6f684bf24a139aaa55e34ddef5d0d508a9dd26bac364ee474e90f

SHA512
01dc737ec3b3a29fef96a33212a18364f67629bee883140fd82d7059828541d029365f5ac36b2ae4638eb0a760657d8c36a8c3ea6825f3ccc2bb081688b0cec4

Download Submit
C:\Windows\System32\VCWTsWw.exe

Filesize
1.4MB

MD5
9be017a2f7363b01487d7a02585f1a30

SHA1
679302dc4ebe084ee2955c0d3e31049be69eaf05

SHA256
f9b356eb8aa925dec1df0bae0c342cc9c581c20e855d401ecc5a1d816b08f6e0

SHA512
bd578c16765df4793c94202ce773711f6a5d671e8aa55e84eb74be2f2b1c07c93ab0277854e620bae132ce801727a07b67e18f7fe0480e08f0c69f02baf3df3d

Download Submit
C:\Windows\System32\WvYcgra.exe

Filesize
1.4MB

MD5
3717af78891d987eac58f1707f67ab38

SHA1
c0ad12fed568196a3b907aa58d920ced4aef97f7

SHA256
74cc2c23161a48ca5baa3a39aebd7e2c3321028cb3916dd6c7e359c05863d68d

SHA512
0e47cc8416d3fcdb402321ea04579235f72ac43a483c53db4c3c3c285af43fbb197202aac06259e91a71fd046b92ad125c10ac8e3c7fc620b9b046553b2c5ce5

Download Submit
C:\Windows\System32\WwseTDr.exe

Filesize
1.4MB

MD5
65c52b4640672302b0969789dc8a00c5

SHA1
edd250a777ae1c1e9cf91e7512633519639856c5

SHA256
41488bfada9a31d6399da0e1217996fe022496e5f633b73063f5a2e9e9c52c99

SHA512
ade1e5fcedc5f8d2c0f7da0e477801c9f4dbcbcbbc6d11c13bd714f53b6adebcda6198c3b8c0a800f38fddd707f0800ca2be0346afc94e66ca48bedc2d424200

Download Submit
C:\Windows\System32\XLLveJz.exe

Filesize
1.4MB

MD5
637fcbaee3a321f2c8e88a2c8314fb43

SHA1
cd679e2ec57884da9d6cf883f0f7a77b1baf4871

SHA256
673421421a69ec412ccaf31af9e6f54440e3686087b0fcba46770756e4b5f54e

SHA512
4c77b07d9889dafda2f8f0e31045b685becdbad22fb1dc3e29dc7a9ee48d44e2f72db2f11f0991fa499fa85d1c1002073ecd82605d79da857f5b6e191f6e75d7

Download Submit
C:\Windows\System32\YIhlwNj.exe

Filesize
1.4MB

MD5
68433e440c63b181c9bd48168efc3ec5

SHA1
8e1429600f11541414bcf79e424e9389635c25df

SHA256
fe80d17c9354e8e1768204fcbee76a066cabab81a15e59a3e1c0b219893b4cca

SHA512
f286cc434d8b264aa759a6f6509ffe795d3f1467684e341bb562c1362407794f040d2d33f99d6a4a08bd435022143a9c258c0b6236bb375b10ab0dc323bfc76f

Download Submit
C:\Windows\System32\ZzsDpJP.exe

Filesize
1.4MB

MD5
05a262ec386d5a33fca8d9012174b874

SHA1
529451eaf80a40eb3c2ab07e69a2658e28989737

SHA256
badd81ec0aac1f7ca83214e42006d68ec1aedaafac58cc92d47735c92661f31f

SHA512
d3b4d8deaa09e8a780158cbbd50e3102dd9583c709d1d4b227946fa0ee531982d1b4387cd56a27b558abba39fb2874df002500c0d1edd1193c2610edc201b061

Download Submit
C:\Windows\System32\bIjHXty.exe

Filesize
1.4MB

MD5
64e6e188bc8447c047a3d9da34e79581

SHA1
c456987e8dd026ccc870705554b6c83850057e18

SHA256
22685eef3b3bdc238fd4b7bd110d9bdfe3dbd77a2edf19d253ad8b51934c5075

SHA512
f65b488ab85468d678270e8acd718ffd014b08f21018c75bc4bdcfe12e1aeeda85d6d6d9f45869dfb58a3f7cbfe527f3bf72a23b22be34736158a18d0daad56b

Download Submit
C:\Windows\System32\jYgbTxD.exe

Filesize
1.4MB

MD5
d00d9a2a3047757bb9ea6610381b8548

SHA1
29eac57659a4baba95ab808f9d967cae44256f30

SHA256
71c0d0f780c5e73da0b15fe32d6f8edb10c49dffaed768e37c24fa85dc76c48e

SHA512
d3b4e333109a15e4e661663df07daf1dc1a25b1f7b848978cd05185508734b9eae2b7cce29e979bd2ff12f0c4a829fac20fb2f24a9e6306645100d67cdb79d24

Download Submit
C:\Windows\System32\lELKKTM.exe

Filesize
1.4MB

MD5
7d6ef59c6b0aaa1e5a249272e73c14d2

SHA1
71510189e0d632e564be3c31ca912e2a4811217f

SHA256
6eaacfff0eac6213ed47e530f588a292cf0f35452d227d8800683243f6ea3213

SHA512
f8da75460639af2268bc246b45d9bad7559ac341178637994c346e4e637a6eef5fbb4a0e30374d3b1ab679c15bc0a0be49fa288670387bab039855510687c0ce

Download Submit
C:\Windows\System32\peYKUhr.exe

Filesize
1.4MB

MD5
0f9e4888fe5dc5b70eb525e4be45dba6

SHA1
de960a1da7d14c67010569c558c9a4330d738ab6

SHA256
e6fde324c3a70059bcc6010c27561b92e4441575233fd605c84ff89e40a7b549

SHA512
aa8ae40699e8a3444e57b90d09c0b8b99928158abbc1386d4a1a99281aad6cdfe9fbf475799a0561f9e6505719f8a3d34ca2161106b59e214bbfa32a14055bd0

Download Submit
C:\Windows\System32\tvECiyJ.exe

Filesize
1.4MB

MD5
c02b77ffcff874e356ce86e0a6f57513

SHA1
8511de449a5cb7d8b99fb693cabfb0d1777523ef

SHA256
f520d9dd46082cc92d53630577c9578541db7dcfd8061b001796d33a11d96263

SHA512
8662da0b296427615a77efcec78bcb07e04f0777d9a7ab1aeac8f7a226db099f84a0f0f872fbc6b8847e6f51b568818237038ed52467e67209a9c043fa9230e1

Download Submit
C:\Windows\System32\vBQsJJh.exe

Filesize
1.4MB

MD5
e2ab40a8a793387098141fa5d9a720ad

SHA1
e0ac45e118adafc3870482c305451fd74fc49ecd

SHA256
a48224c490a088c32f1d9d1d20f8a6679ec376af5949e6fa510afb62df14aea4

SHA512
97c11dc9a4fcdd2cf994e51c20f3205f0c0e35f222ccff5bdaaab26d140b9354fbc6572c5076f2282d5779b6f7bf26fe15d5c1aa4b2ccd02ad71f8aec6c69d58

Download Submit
C:\Windows\System32\vHycyzF.exe

Filesize
1.4MB

MD5
a8e34b79c43e9ef3a6668c15f31ae02a

SHA1
aa07c727f3538fb2d903502f2c6bb18faf9b08a3

SHA256
81842b2aeb739dc592a653611929534cd486a381a9889233d50845c06601ea94

SHA512
24e8f191b8ab2cf111ef375e6c2903542155291b522e2087086f590ee797256f837669a4742cbd17d8e5a2a2df0a1bdeeec2faa177b1251ecc09f825f7874019

Download Submit
C:\Windows\System32\vZSQpOQ.exe

Filesize
1.4MB

MD5
35f0fdb08591effaa6b33c5729ffaef5

SHA1
747f8bc27702b98d47cb5042eb282902e2a2de63

SHA256
2fe97e43f995b13a5e2a4b0f207452462a8932c2bf4a854e0ad69e12eef313dc

SHA512
1b24bcf377c7d71db27a39dfe28862a4cb12f89fb6182bcc7c12b619c150b04dd277f18117f3e17f62700cd3389f2e031d7413b84e2056e0ce3508a53413f839

Download Submit
C:\Windows\System32\zKRvbhI.exe

Filesize
1.4MB

MD5
8bde66b74368ba491b47f248a7c65f31

SHA1
573b17662d07de7897c7d970c33b94ffaefd1e2f

SHA256
f25e983b97597075eadc173b80fabfd61e50984e52bb4d4c718954415efcfdf3

SHA512
7d2204a0f7b1ce621c07ef314463589de4bb765733404a093478171d87ce28fb0c6fae387c9481dd5897872b48d809e970a328540fc874fd0d8d93d9850f8892

Download Submit
memory/704-67-0x00007FF79C450000-0x00007FF79C841000-memory.dmp

Filesize
3.9MB

Download
memory/704-2008-0x00007FF79C450000-0x00007FF79C841000-memory.dmp

Filesize
3.9MB

Download
memory/716-2048-0x00007FF675540000-0x00007FF675931000-memory.dmp

Filesize
3.9MB

Download
memory/716-174-0x00007FF675540000-0x00007FF675931000-memory.dmp

Filesize
3.9MB

Download
memory/1084-163-0x00007FF6499E0000-0x00007FF649DD1000-memory.dmp

Filesize
3.9MB

Download
memory/1084-2035-0x00007FF6499E0000-0x00007FF649DD1000-memory.dmp

Filesize
3.9MB

Download
memory/1140-1989-0x00007FF61CE10000-0x00007FF61D201000-memory.dmp

Filesize
3.9MB

Download
memory/1140-146-0x00007FF61CE10000-0x00007FF61D201000-memory.dmp

Filesize
3.9MB

Download
memory/1140-2167-0x00007FF61CE10000-0x00007FF61D201000-memory.dmp

Filesize
3.9MB

Download
memory/1224-108-0x00007FF600C60000-0x00007FF601051000-memory.dmp

Filesize
3.9MB

Download
memory/1224-2021-0x00007FF600C60000-0x00007FF601051000-memory.dmp

Filesize
3.9MB

Download
memory/1320-2032-0x00007FF652C40000-0x00007FF653031000-memory.dmp

Filesize
3.9MB

Download
memory/1320-120-0x00007FF652C40000-0x00007FF653031000-memory.dmp

Filesize
3.9MB

Download
memory/1560-124-0x00007FF7B51B0000-0x00007FF7B55A1000-memory.dmp

Filesize
3.9MB

Download
memory/1560-2019-0x00007FF7B51B0000-0x00007FF7B55A1000-memory.dmp

Filesize
3.9MB

Download
memory/1780-156-0x00007FF637BE0000-0x00007FF637FD1000-memory.dmp

Filesize
3.9MB

Download
memory/1780-2016-0x00007FF637BE0000-0x00007FF637FD1000-memory.dmp

Filesize
3.9MB

Download
memory/2132-2024-0x00007FF64AD40000-0x00007FF64B131000-memory.dmp

Filesize
3.9MB

Download
memory/2132-123-0x00007FF64AD40000-0x00007FF64B131000-memory.dmp

Filesize
3.9MB

Download
memory/2212-1-0x0000018D00730000-0x0000018D00740000-memory.dmp

Filesize
64KB

Download
memory/2212-0-0x00007FF6EBD10000-0x00007FF6EC101000-memory.dmp

Filesize
3.9MB

Download
memory/2760-79-0x00007FF768F50000-0x00007FF769341000-memory.dmp

Filesize
3.9MB

Download
memory/2760-1984-0x00007FF768F50000-0x00007FF769341000-memory.dmp

Filesize
3.9MB

Download
memory/2760-2023-0x00007FF768F50000-0x00007FF769341000-memory.dmp

Filesize
3.9MB

Download
memory/3128-1983-0x00007FF67E910000-0x00007FF67ED01000-memory.dmp

Filesize
3.9MB

Download
memory/3128-37-0x00007FF67E910000-0x00007FF67ED01000-memory.dmp

Filesize
3.9MB

Download
memory/3128-2014-0x00007FF67E910000-0x00007FF67ED01000-memory.dmp

Filesize
3.9MB

Download
memory/3280-2031-0x00007FF66C5D0000-0x00007FF66C9C1000-memory.dmp

Filesize
3.9MB

Download
memory/3280-126-0x00007FF66C5D0000-0x00007FF66C9C1000-memory.dmp

Filesize
3.9MB

Download
memory/3896-2041-0x00007FF6908D0000-0x00007FF690CC1000-memory.dmp

Filesize
3.9MB

Download
memory/3896-140-0x00007FF6908D0000-0x00007FF690CC1000-memory.dmp

Filesize
3.9MB

Download
memory/4136-2026-0x00007FF63AA60000-0x00007FF63AE51000-memory.dmp

Filesize
3.9MB

Download
memory/4136-125-0x00007FF63AA60000-0x00007FF63AE51000-memory.dmp

Filesize
3.9MB

Download
memory/4624-2046-0x00007FF6C9680000-0x00007FF6C9A71000-memory.dmp

Filesize
3.9MB

Download
memory/4624-152-0x00007FF6C9680000-0x00007FF6C9A71000-memory.dmp

Filesize
3.9MB

Download
memory/4648-2050-0x00007FF63E270000-0x00007FF63E661000-memory.dmp

Filesize
3.9MB

Download
memory/4648-153-0x00007FF63E270000-0x00007FF63E661000-memory.dmp

Filesize
3.9MB

Download
memory/4664-2037-0x00007FF6B7D40000-0x00007FF6B8131000-memory.dmp

Filesize
3.9MB

Download
memory/4664-143-0x00007FF6B7D40000-0x00007FF6B8131000-memory.dmp

Filesize
3.9MB

Download
memory/4668-2006-0x00007FF71A670000-0x00007FF71AA61000-memory.dmp

Filesize
3.9MB

Download
memory/4668-11-0x00007FF71A670000-0x00007FF71AA61000-memory.dmp

Filesize
3.9MB

Download
memory/4712-170-0x00007FF775DF0000-0x00007FF7761E1000-memory.dmp

Filesize
3.9MB

Download
memory/4712-2044-0x00007FF775DF0000-0x00007FF7761E1000-memory.dmp

Filesize
3.9MB

Download
memory/4940-16-0x00007FF6887B0000-0x00007FF688BA1000-memory.dmp

Filesize
3.9MB

Download
memory/4940-1981-0x00007FF6887B0000-0x00007FF688BA1000-memory.dmp

Filesize
3.9MB

Download
memory/4940-2010-0x00007FF6887B0000-0x00007FF688BA1000-memory.dmp

Filesize
3.9MB

Download
memory/5092-2012-0x00007FF79E610000-0x00007FF79EA01000-memory.dmp

Filesize
3.9MB

Download
memory/5092-160-0x00007FF79E610000-0x00007FF79EA01000-memory.dmp

Filesize
3.9MB

Download
memory/5104-2042-0x00007FF660DF0000-0x00007FF6611E1000-memory.dmp

Filesize
3.9MB

Download
memory/5104-167-0x00007FF660DF0000-0x00007FF6611E1000-memory.dmp

Filesize
3.9MB

Download
memory/5108-2039-0x00007FF76B5C0000-0x00007FF76B9B1000-memory.dmp

Filesize
3.9MB

Download
memory/5108-134-0x00007FF76B5C0000-0x00007FF76B9B1000-memory.dmp

Filesize
3.9MB

Download
memory/5116-1982-0x00007FF784280000-0x00007FF784671000-memory.dmp

Filesize
3.9MB

Download
memory/5116-30-0x00007FF784280000-0x00007FF784671000-memory.dmp

Filesize
3.9MB

Download
memory/5116-2028-0x00007FF784280000-0x00007FF784671000-memory.dmp

Filesize
3.9MB

Download