xmrig | 43039b1de43a27a415cd2bfe73891d0db30697b0f63c8ce31b9bf78f995f8308

Analysis

max time kernel
131s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
Size

1.6MB
MD5

d2ee48e306b954e2f2e998da6afa6861
SHA1

21868c19121ffc0b953998e17ae431dc62d2aab2
SHA256

43039b1de43a27a415cd2bfe73891d0db30697b0f63c8ce31b9bf78f995f8308
SHA512

d3f9dd9873c166921ca4f255e3003be45eb2bc6a9391ef0ef0717d431a632ef6b9610b897b2c5c72cbef46d6cf01142cde21e70c5b1fb3dac345066649fb2297
SSDEEP

24576:JanwhSe11QSONCpGJCjETPlGC78XIO9C1MKTbcMfHhGjw2Do+BRrCfUgSavo:knw9oUUEEDlGUjc2HhG82DiBg

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 45 IoCs

miner

resource	yara_rule
behavioral2/memory/632-474-0x00007FF72BB00000-0x00007FF72BEF1000-memory.dmp	xmrig
behavioral2/memory/3288-475-0x00007FF744C20000-0x00007FF745011000-memory.dmp	xmrig
behavioral2/memory/5096-476-0x00007FF666150000-0x00007FF666541000-memory.dmp	xmrig
behavioral2/memory/3972-478-0x00007FF6FE6D0000-0x00007FF6FEAC1000-memory.dmp	xmrig
behavioral2/memory/1116-479-0x00007FF7530F0000-0x00007FF7534E1000-memory.dmp	xmrig
behavioral2/memory/2892-480-0x00007FF6716C0000-0x00007FF671AB1000-memory.dmp	xmrig
behavioral2/memory/3424-481-0x00007FF626920000-0x00007FF626D11000-memory.dmp	xmrig
behavioral2/memory/3480-482-0x00007FF664520000-0x00007FF664911000-memory.dmp	xmrig
behavioral2/memory/784-477-0x00007FF7CBD40000-0x00007FF7CC131000-memory.dmp	xmrig
behavioral2/memory/1604-483-0x00007FF6D45B0000-0x00007FF6D49A1000-memory.dmp	xmrig
behavioral2/memory/4284-486-0x00007FF7A1670000-0x00007FF7A1A61000-memory.dmp	xmrig
behavioral2/memory/4340-492-0x00007FF740DD0000-0x00007FF7411C1000-memory.dmp	xmrig
behavioral2/memory/1600-500-0x00007FF633830000-0x00007FF633C21000-memory.dmp	xmrig
behavioral2/memory/4176-505-0x00007FF77D140000-0x00007FF77D531000-memory.dmp	xmrig
behavioral2/memory/3456-497-0x00007FF7EA680000-0x00007FF7EAA71000-memory.dmp	xmrig
behavioral2/memory/4780-508-0x00007FF7505E0000-0x00007FF7509D1000-memory.dmp	xmrig
behavioral2/memory/4328-518-0x00007FF6F7F80000-0x00007FF6F8371000-memory.dmp	xmrig
behavioral2/memory/2120-512-0x00007FF79BFE0000-0x00007FF79C3D1000-memory.dmp	xmrig
behavioral2/memory/3668-45-0x00007FF617380000-0x00007FF617771000-memory.dmp	xmrig
behavioral2/memory/3660-1217-0x00007FF7D7A80000-0x00007FF7D7E71000-memory.dmp	xmrig
behavioral2/memory/2124-1223-0x00007FF6A0920000-0x00007FF6A0D11000-memory.dmp	xmrig
behavioral2/memory/4188-1297-0x00007FF671EB0000-0x00007FF6722A1000-memory.dmp	xmrig
behavioral2/memory/2464-1298-0x00007FF719A30000-0x00007FF719E21000-memory.dmp	xmrig
behavioral2/memory/3200-1305-0x00007FF716D20000-0x00007FF717111000-memory.dmp	xmrig
behavioral2/memory/4168-1303-0x00007FF74C220000-0x00007FF74C611000-memory.dmp	xmrig
behavioral2/memory/3668-2072-0x00007FF617380000-0x00007FF617771000-memory.dmp	xmrig
behavioral2/memory/4188-2075-0x00007FF671EB0000-0x00007FF6722A1000-memory.dmp	xmrig
behavioral2/memory/632-2077-0x00007FF72BB00000-0x00007FF72BEF1000-memory.dmp	xmrig
behavioral2/memory/784-2111-0x00007FF7CBD40000-0x00007FF7CC131000-memory.dmp	xmrig
behavioral2/memory/5096-2119-0x00007FF666150000-0x00007FF666541000-memory.dmp	xmrig
behavioral2/memory/3456-2131-0x00007FF7EA680000-0x00007FF7EAA71000-memory.dmp	xmrig
behavioral2/memory/4176-2137-0x00007FF77D140000-0x00007FF77D531000-memory.dmp	xmrig
behavioral2/memory/2120-2139-0x00007FF79BFE0000-0x00007FF79C3D1000-memory.dmp	xmrig
behavioral2/memory/4780-2136-0x00007FF7505E0000-0x00007FF7509D1000-memory.dmp	xmrig
behavioral2/memory/1600-2133-0x00007FF633830000-0x00007FF633C21000-memory.dmp	xmrig
behavioral2/memory/4284-2126-0x00007FF7A1670000-0x00007FF7A1A61000-memory.dmp	xmrig
behavioral2/memory/3480-2125-0x00007FF664520000-0x00007FF664911000-memory.dmp	xmrig
behavioral2/memory/1604-2123-0x00007FF6D45B0000-0x00007FF6D49A1000-memory.dmp	xmrig
behavioral2/memory/4340-2130-0x00007FF740DD0000-0x00007FF7411C1000-memory.dmp	xmrig
behavioral2/memory/3424-2121-0x00007FF626920000-0x00007FF626D11000-memory.dmp	xmrig
behavioral2/memory/3200-2127-0x00007FF716D20000-0x00007FF717111000-memory.dmp	xmrig
behavioral2/memory/4328-2118-0x00007FF6F7F80000-0x00007FF6F8371000-memory.dmp	xmrig
behavioral2/memory/1116-2117-0x00007FF7530F0000-0x00007FF7534E1000-memory.dmp	xmrig
behavioral2/memory/3288-2113-0x00007FF744C20000-0x00007FF745011000-memory.dmp	xmrig
behavioral2/memory/3972-2110-0x00007FF6FE6D0000-0x00007FF6FEAC1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2124	NrvPPhq.exe
4188	MBLuGHX.exe
3668	ZolIPVE.exe
2464	YFmndcK.exe
632	daaslWe.exe
4168	aLFwChT.exe
3288	rZFyKEt.exe
3200	zYDiAwt.exe
5096	FrzajhX.exe
4328	ejnToLT.exe
784	EiQObON.exe
3972	QXlnPdR.exe
1116	ljGHDab.exe
2892	BYekjxD.exe
3424	rQVwACu.exe
3480	ZvfUFlZ.exe
1604	EUmKOlS.exe
4284	ozGoreM.exe
4340	tJIcMpn.exe
3456	TVNzPQI.exe
1600	pjDZVFv.exe
4176	rmUgEpR.exe
4780	dhQwoGs.exe
2120	ogNvVuM.exe
1760	cKNPKqm.exe
3656	DZSVmFH.exe
4148	CEKEmVP.exe
4888	CCUKPgP.exe
3844	aPyczeK.exe
2528	haOiJSi.exe
2868	WrOAAaX.exe
764	EVhWgKT.exe
4740	bnJNYNB.exe
436	IVFmgik.exe
4384	jIGLjJa.exe
4504	sPGavEa.exe
4040	qsokKFS.exe
1648	KLiaAew.exe
4064	ADlgaMT.exe
3008	bqqppvE.exe
912	APbBKrO.exe
892	UINCDdK.exe
4688	BOpMbEj.exe
3164	iPbbtPR.exe
3996	oRelDvw.exe
440	TubIZjt.exe
3036	vukTABZ.exe
3348	eOUeGTR.exe
2608	YTveeSv.exe
4292	ozvFXiR.exe
2012	AVhNHrA.exe
5084	ZewABrg.exe
4404	QHZipTv.exe
1168	kHwOSgD.exe
2344	mBUiriR.exe
5124	zXzOMrJ.exe
5156	NUUaxLN.exe
5184	BYkjkgB.exe
5212	QnPRkbA.exe
5236	uUBWZNq.exe
5264	xWrvNth.exe
5296	XwJkFls.exe
5320	FMUMMFo.exe
5352	qkVFhWb.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3660-0-0x00007FF7D7A80000-0x00007FF7D7E71000-memory.dmp	upx
behavioral2/files/0x0007000000023591-7.dat	upx
behavioral2/files/0x0007000000023590-8.dat	upx
behavioral2/files/0x0007000000023593-34.dat	upx
behavioral2/files/0x0007000000023596-38.dat	upx
behavioral2/files/0x0007000000023597-41.dat	upx
behavioral2/files/0x0007000000023598-59.dat	upx
behavioral2/files/0x000700000002359b-75.dat	upx
behavioral2/files/0x00070000000235a0-100.dat	upx
behavioral2/files/0x00070000000235a2-110.dat	upx
behavioral2/files/0x00070000000235a5-125.dat	upx
behavioral2/files/0x00070000000235a8-140.dat	upx
behavioral2/files/0x00070000000235ac-160.dat	upx
behavioral2/memory/632-474-0x00007FF72BB00000-0x00007FF72BEF1000-memory.dmp	upx
behavioral2/memory/3288-475-0x00007FF744C20000-0x00007FF745011000-memory.dmp	upx
behavioral2/memory/5096-476-0x00007FF666150000-0x00007FF666541000-memory.dmp	upx
behavioral2/memory/3972-478-0x00007FF6FE6D0000-0x00007FF6FEAC1000-memory.dmp	upx
behavioral2/memory/1116-479-0x00007FF7530F0000-0x00007FF7534E1000-memory.dmp	upx
behavioral2/memory/2892-480-0x00007FF6716C0000-0x00007FF671AB1000-memory.dmp	upx
behavioral2/memory/3424-481-0x00007FF626920000-0x00007FF626D11000-memory.dmp	upx
behavioral2/memory/3480-482-0x00007FF664520000-0x00007FF664911000-memory.dmp	upx
behavioral2/memory/784-477-0x00007FF7CBD40000-0x00007FF7CC131000-memory.dmp	upx
behavioral2/memory/1604-483-0x00007FF6D45B0000-0x00007FF6D49A1000-memory.dmp	upx
behavioral2/memory/4284-486-0x00007FF7A1670000-0x00007FF7A1A61000-memory.dmp	upx
behavioral2/memory/4340-492-0x00007FF740DD0000-0x00007FF7411C1000-memory.dmp	upx
behavioral2/memory/1600-500-0x00007FF633830000-0x00007FF633C21000-memory.dmp	upx
behavioral2/memory/4176-505-0x00007FF77D140000-0x00007FF77D531000-memory.dmp	upx
behavioral2/memory/3456-497-0x00007FF7EA680000-0x00007FF7EAA71000-memory.dmp	upx
behavioral2/memory/4780-508-0x00007FF7505E0000-0x00007FF7509D1000-memory.dmp	upx
behavioral2/memory/4328-518-0x00007FF6F7F80000-0x00007FF6F8371000-memory.dmp	upx
behavioral2/memory/2120-512-0x00007FF79BFE0000-0x00007FF79C3D1000-memory.dmp	upx
behavioral2/files/0x00070000000235af-168.dat	upx
behavioral2/files/0x00070000000235ad-165.dat	upx
behavioral2/files/0x00070000000235ae-163.dat	upx
behavioral2/files/0x00070000000235ab-155.dat	upx
behavioral2/files/0x00070000000235aa-150.dat	upx
behavioral2/files/0x00070000000235a9-145.dat	upx
behavioral2/files/0x00070000000235a7-135.dat	upx
behavioral2/files/0x00070000000235a6-130.dat	upx
behavioral2/files/0x00070000000235a4-120.dat	upx
behavioral2/files/0x00070000000235a3-115.dat	upx
behavioral2/files/0x00070000000235a1-105.dat	upx
behavioral2/files/0x000700000002359f-95.dat	upx
behavioral2/files/0x000700000002359e-90.dat	upx
behavioral2/files/0x000700000002359d-85.dat	upx
behavioral2/files/0x000700000002359c-80.dat	upx
behavioral2/files/0x000700000002359a-70.dat	upx
behavioral2/files/0x0007000000023599-65.dat	upx
behavioral2/files/0x0007000000023594-58.dat	upx
behavioral2/files/0x0007000000023595-51.dat	upx
behavioral2/memory/3668-45-0x00007FF617380000-0x00007FF617771000-memory.dmp	upx
behavioral2/memory/3200-43-0x00007FF716D20000-0x00007FF717111000-memory.dmp	upx
behavioral2/memory/4168-39-0x00007FF74C220000-0x00007FF74C611000-memory.dmp	upx
behavioral2/files/0x0007000000023592-32.dat	upx
behavioral2/memory/2464-30-0x00007FF719A30000-0x00007FF719E21000-memory.dmp	upx
behavioral2/memory/4188-21-0x00007FF671EB0000-0x00007FF6722A1000-memory.dmp	upx
behavioral2/memory/2124-11-0x00007FF6A0920000-0x00007FF6A0D11000-memory.dmp	upx
behavioral2/files/0x0009000000023589-14.dat	upx
behavioral2/memory/3660-1217-0x00007FF7D7A80000-0x00007FF7D7E71000-memory.dmp	upx
behavioral2/memory/2124-1223-0x00007FF6A0920000-0x00007FF6A0D11000-memory.dmp	upx
behavioral2/memory/4188-1297-0x00007FF671EB0000-0x00007FF6722A1000-memory.dmp	upx
behavioral2/memory/2464-1298-0x00007FF719A30000-0x00007FF719E21000-memory.dmp	upx
behavioral2/memory/3200-1305-0x00007FF716D20000-0x00007FF717111000-memory.dmp	upx
behavioral2/memory/4168-1303-0x00007FF74C220000-0x00007FF74C611000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\QDjPRDp.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\gXeYEZF.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\JsxqAEJ.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\pZxfKVz.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\haOiJSi.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\xLIUriU.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\PsTWkJL.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\kfMeLMZ.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\MavMcyG.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\XECWcrM.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\xWrvNth.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\EDWMJET.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\nQYvfin.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\jyfVTOX.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\DijLZNO.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\YRGwjJI.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\QluNlVh.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\Jydtvxv.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\QHnSLXs.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\QcuUzCd.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\DnevcrY.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\IRXZucg.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\EcMVlEI.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\daaslWe.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\ldQmEMi.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\pqOapUD.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\enEyXow.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\DIpfZqQ.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\wDTxpjU.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\EzAtmvW.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\xhhobCm.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\xDIKtUB.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\FpsAeVe.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\DveCLBv.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\mBUiriR.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\PYWosoA.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\Cnfgpdh.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\CCxqcWo.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\QDfsAFs.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\WucoLQs.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\kKZeqqX.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\bYuBkvm.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\mYkReJa.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\xhoILlp.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\oBaNiRK.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\duDbUPt.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\uxwJYpt.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\nBGaoaQ.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\NLkYTgo.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\Bxrckxf.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\CepuAXB.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\suiFIAY.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\BYekjxD.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\Iyecnwy.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\LdlgwqA.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\YUkRVhH.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\JGoaEGG.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\qOXFmto.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\cPdwicy.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\wORAYee.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\pcNDWGs.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\cRyFzhk.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\NqrVpdo.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
File created	C:\Windows\System32\VsYWTKy.exe	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 2124	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	91
PID 3660 wrote to memory of 2124	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	91
PID 3660 wrote to memory of 4188	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	92
PID 3660 wrote to memory of 4188	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	92
PID 3660 wrote to memory of 3668	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	93
PID 3660 wrote to memory of 3668	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	93
PID 3660 wrote to memory of 632	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	94
PID 3660 wrote to memory of 632	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	94
PID 3660 wrote to memory of 2464	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	95
PID 3660 wrote to memory of 2464	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	95
PID 3660 wrote to memory of 3288	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	96
PID 3660 wrote to memory of 3288	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	96
PID 3660 wrote to memory of 4168	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	97
PID 3660 wrote to memory of 4168	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	97
PID 3660 wrote to memory of 3200	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	98
PID 3660 wrote to memory of 3200	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	98
PID 3660 wrote to memory of 5096	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	99
PID 3660 wrote to memory of 5096	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	99
PID 3660 wrote to memory of 4328	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	100
PID 3660 wrote to memory of 4328	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	100
PID 3660 wrote to memory of 784	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	101
PID 3660 wrote to memory of 784	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	101
PID 3660 wrote to memory of 3972	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	102
PID 3660 wrote to memory of 3972	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	102
PID 3660 wrote to memory of 1116	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	103
PID 3660 wrote to memory of 1116	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	103
PID 3660 wrote to memory of 2892	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	104
PID 3660 wrote to memory of 2892	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	104
PID 3660 wrote to memory of 3424	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	105
PID 3660 wrote to memory of 3424	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	105
PID 3660 wrote to memory of 3480	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	106
PID 3660 wrote to memory of 3480	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	106
PID 3660 wrote to memory of 1604	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	107
PID 3660 wrote to memory of 1604	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	107
PID 3660 wrote to memory of 4284	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	108
PID 3660 wrote to memory of 4284	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	108
PID 3660 wrote to memory of 4340	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	109
PID 3660 wrote to memory of 4340	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	109
PID 3660 wrote to memory of 3456	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	110
PID 3660 wrote to memory of 3456	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	110
PID 3660 wrote to memory of 1600	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	111
PID 3660 wrote to memory of 1600	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	111
PID 3660 wrote to memory of 4176	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	112
PID 3660 wrote to memory of 4176	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	112
PID 3660 wrote to memory of 4780	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	113
PID 3660 wrote to memory of 4780	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	113
PID 3660 wrote to memory of 2120	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	114
PID 3660 wrote to memory of 2120	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	114
PID 3660 wrote to memory of 1760	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	115
PID 3660 wrote to memory of 1760	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	115
PID 3660 wrote to memory of 3656	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	116
PID 3660 wrote to memory of 3656	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	116
PID 3660 wrote to memory of 4148	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	117
PID 3660 wrote to memory of 4148	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	117
PID 3660 wrote to memory of 4888	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	118
PID 3660 wrote to memory of 4888	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	118
PID 3660 wrote to memory of 3844	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	119
PID 3660 wrote to memory of 3844	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	119
PID 3660 wrote to memory of 2528	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	120
PID 3660 wrote to memory of 2528	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	120
PID 3660 wrote to memory of 2868	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	121
PID 3660 wrote to memory of 2868	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	121
PID 3660 wrote to memory of 764	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	122
PID 3660 wrote to memory of 764	3660	d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe	122

C:\Users\Admin\AppData\Local\Temp\d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d2ee48e306b954e2f2e998da6afa6861_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Windows\System32\NrvPPhq.exe
  C:\Windows\System32\NrvPPhq.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System32\MBLuGHX.exe
  C:\Windows\System32\MBLuGHX.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System32\ZolIPVE.exe
  C:\Windows\System32\ZolIPVE.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System32\daaslWe.exe
  C:\Windows\System32\daaslWe.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System32\YFmndcK.exe
  C:\Windows\System32\YFmndcK.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System32\rZFyKEt.exe
  C:\Windows\System32\rZFyKEt.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System32\aLFwChT.exe
  C:\Windows\System32\aLFwChT.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System32\zYDiAwt.exe
  C:\Windows\System32\zYDiAwt.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System32\FrzajhX.exe
  C:\Windows\System32\FrzajhX.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System32\ejnToLT.exe
  C:\Windows\System32\ejnToLT.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System32\EiQObON.exe
  C:\Windows\System32\EiQObON.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System32\QXlnPdR.exe
  C:\Windows\System32\QXlnPdR.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System32\ljGHDab.exe
  C:\Windows\System32\ljGHDab.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System32\BYekjxD.exe
  C:\Windows\System32\BYekjxD.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System32\rQVwACu.exe
  C:\Windows\System32\rQVwACu.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System32\ZvfUFlZ.exe
  C:\Windows\System32\ZvfUFlZ.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System32\EUmKOlS.exe
  C:\Windows\System32\EUmKOlS.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System32\ozGoreM.exe
  C:\Windows\System32\ozGoreM.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System32\tJIcMpn.exe
  C:\Windows\System32\tJIcMpn.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System32\TVNzPQI.exe
  C:\Windows\System32\TVNzPQI.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System32\pjDZVFv.exe
  C:\Windows\System32\pjDZVFv.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System32\rmUgEpR.exe
  C:\Windows\System32\rmUgEpR.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System32\dhQwoGs.exe
  C:\Windows\System32\dhQwoGs.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System32\ogNvVuM.exe
  C:\Windows\System32\ogNvVuM.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System32\cKNPKqm.exe
  C:\Windows\System32\cKNPKqm.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System32\DZSVmFH.exe
  C:\Windows\System32\DZSVmFH.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System32\CEKEmVP.exe
  C:\Windows\System32\CEKEmVP.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System32\CCUKPgP.exe
  C:\Windows\System32\CCUKPgP.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System32\aPyczeK.exe
  C:\Windows\System32\aPyczeK.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System32\haOiJSi.exe
  C:\Windows\System32\haOiJSi.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System32\WrOAAaX.exe
  C:\Windows\System32\WrOAAaX.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System32\EVhWgKT.exe
  C:\Windows\System32\EVhWgKT.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System32\bnJNYNB.exe
  C:\Windows\System32\bnJNYNB.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System32\IVFmgik.exe
  C:\Windows\System32\IVFmgik.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System32\jIGLjJa.exe
  C:\Windows\System32\jIGLjJa.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System32\sPGavEa.exe
  C:\Windows\System32\sPGavEa.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System32\qsokKFS.exe
  C:\Windows\System32\qsokKFS.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System32\KLiaAew.exe
  C:\Windows\System32\KLiaAew.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System32\ADlgaMT.exe
  C:\Windows\System32\ADlgaMT.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System32\bqqppvE.exe
  C:\Windows\System32\bqqppvE.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System32\APbBKrO.exe
  C:\Windows\System32\APbBKrO.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System32\UINCDdK.exe
  C:\Windows\System32\UINCDdK.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System32\BOpMbEj.exe
  C:\Windows\System32\BOpMbEj.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System32\iPbbtPR.exe
  C:\Windows\System32\iPbbtPR.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System32\oRelDvw.exe
  C:\Windows\System32\oRelDvw.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System32\TubIZjt.exe
  C:\Windows\System32\TubIZjt.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System32\vukTABZ.exe
  C:\Windows\System32\vukTABZ.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System32\eOUeGTR.exe
  C:\Windows\System32\eOUeGTR.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System32\YTveeSv.exe
  C:\Windows\System32\YTveeSv.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System32\ozvFXiR.exe
  C:\Windows\System32\ozvFXiR.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System32\AVhNHrA.exe
  C:\Windows\System32\AVhNHrA.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System32\ZewABrg.exe
  C:\Windows\System32\ZewABrg.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System32\QHZipTv.exe
  C:\Windows\System32\QHZipTv.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System32\kHwOSgD.exe
  C:\Windows\System32\kHwOSgD.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System32\mBUiriR.exe
  C:\Windows\System32\mBUiriR.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System32\zXzOMrJ.exe
  C:\Windows\System32\zXzOMrJ.exe
  2⤵
  - Executes dropped EXE
  PID:5124
- C:\Windows\System32\NUUaxLN.exe
  C:\Windows\System32\NUUaxLN.exe
  2⤵
  - Executes dropped EXE
  PID:5156
- C:\Windows\System32\BYkjkgB.exe
  C:\Windows\System32\BYkjkgB.exe
  2⤵
  - Executes dropped EXE
  PID:5184
- C:\Windows\System32\QnPRkbA.exe
  C:\Windows\System32\QnPRkbA.exe
  2⤵
  - Executes dropped EXE
  PID:5212
- C:\Windows\System32\uUBWZNq.exe
  C:\Windows\System32\uUBWZNq.exe
  2⤵
  - Executes dropped EXE
  PID:5236
- C:\Windows\System32\xWrvNth.exe
  C:\Windows\System32\xWrvNth.exe
  2⤵
  - Executes dropped EXE
  PID:5264
- C:\Windows\System32\XwJkFls.exe
  C:\Windows\System32\XwJkFls.exe
  2⤵
  - Executes dropped EXE
  PID:5296
- C:\Windows\System32\FMUMMFo.exe
  C:\Windows\System32\FMUMMFo.exe
  2⤵
  - Executes dropped EXE
  PID:5320
- C:\Windows\System32\qkVFhWb.exe
  C:\Windows\System32\qkVFhWb.exe
  2⤵
  - Executes dropped EXE
  PID:5352
- C:\Windows\System32\FaJbFwu.exe
  C:\Windows\System32\FaJbFwu.exe
  2⤵
  PID:5384
- C:\Windows\System32\oudNntB.exe
  C:\Windows\System32\oudNntB.exe
  2⤵
  PID:5408
- C:\Windows\System32\xpVQRdW.exe
  C:\Windows\System32\xpVQRdW.exe
  2⤵
  PID:5432
- C:\Windows\System32\bPQwIxg.exe
  C:\Windows\System32\bPQwIxg.exe
  2⤵
  PID:5464
- C:\Windows\System32\UFkSHdn.exe
  C:\Windows\System32\UFkSHdn.exe
  2⤵
  PID:5492
- C:\Windows\System32\tZiiOOi.exe
  C:\Windows\System32\tZiiOOi.exe
  2⤵
  PID:5520
- C:\Windows\System32\susHqlh.exe
  C:\Windows\System32\susHqlh.exe
  2⤵
  PID:5556
- C:\Windows\System32\dFtItYj.exe
  C:\Windows\System32\dFtItYj.exe
  2⤵
  PID:5580
- C:\Windows\System32\tYaQXgs.exe
  C:\Windows\System32\tYaQXgs.exe
  2⤵
  PID:5604
- C:\Windows\System32\QDfsAFs.exe
  C:\Windows\System32\QDfsAFs.exe
  2⤵
  PID:5640
- C:\Windows\System32\HOQTjJy.exe
  C:\Windows\System32\HOQTjJy.exe
  2⤵
  PID:5660
- C:\Windows\System32\vFreFeP.exe
  C:\Windows\System32\vFreFeP.exe
  2⤵
  PID:5684
- C:\Windows\System32\nxzKhZr.exe
  C:\Windows\System32\nxzKhZr.exe
  2⤵
  PID:5712
- C:\Windows\System32\uxwJYpt.exe
  C:\Windows\System32\uxwJYpt.exe
  2⤵
  PID:5744
- C:\Windows\System32\WucoLQs.exe
  C:\Windows\System32\WucoLQs.exe
  2⤵
  PID:5772
- C:\Windows\System32\RoPsODB.exe
  C:\Windows\System32\RoPsODB.exe
  2⤵
  PID:5796
- C:\Windows\System32\GsWDRQo.exe
  C:\Windows\System32\GsWDRQo.exe
  2⤵
  PID:5836
- C:\Windows\System32\nnDKaJu.exe
  C:\Windows\System32\nnDKaJu.exe
  2⤵
  PID:5856
- C:\Windows\System32\ZWJCiYF.exe
  C:\Windows\System32\ZWJCiYF.exe
  2⤵
  PID:5880
- C:\Windows\System32\osbjenA.exe
  C:\Windows\System32\osbjenA.exe
  2⤵
  PID:5920
- C:\Windows\System32\phbGzuz.exe
  C:\Windows\System32\phbGzuz.exe
  2⤵
  PID:5940
- C:\Windows\System32\fmDNSmR.exe
  C:\Windows\System32\fmDNSmR.exe
  2⤵
  PID:5968
- C:\Windows\System32\pGWNnCd.exe
  C:\Windows\System32\pGWNnCd.exe
  2⤵
  PID:5996
- C:\Windows\System32\PYWosoA.exe
  C:\Windows\System32\PYWosoA.exe
  2⤵
  PID:6024
- C:\Windows\System32\uQUUcxQ.exe
  C:\Windows\System32\uQUUcxQ.exe
  2⤵
  PID:6052
- C:\Windows\System32\AJOSaFl.exe
  C:\Windows\System32\AJOSaFl.exe
  2⤵
  PID:6080
- C:\Windows\System32\zcSKYyY.exe
  C:\Windows\System32\zcSKYyY.exe
  2⤵
  PID:6108
- C:\Windows\System32\nmBewxJ.exe
  C:\Windows\System32\nmBewxJ.exe
  2⤵
  PID:6132
- C:\Windows\System32\OMpmvLx.exe
  C:\Windows\System32\OMpmvLx.exe
  2⤵
  PID:4824
- C:\Windows\System32\EIMBBxM.exe
  C:\Windows\System32\EIMBBxM.exe
  2⤵
  PID:4996
- C:\Windows\System32\jKjYNqv.exe
  C:\Windows\System32\jKjYNqv.exe
  2⤵
  PID:4420
- C:\Windows\System32\QluNlVh.exe
  C:\Windows\System32\QluNlVh.exe
  2⤵
  PID:1720
- C:\Windows\System32\cRyFzhk.exe
  C:\Windows\System32\cRyFzhk.exe
  2⤵
  PID:3892
- C:\Windows\System32\OizVDsM.exe
  C:\Windows\System32\OizVDsM.exe
  2⤵
  PID:5192
- C:\Windows\System32\YRGwjJI.exe
  C:\Windows\System32\YRGwjJI.exe
  2⤵
  PID:3964
- C:\Windows\System32\mLXDfbk.exe
  C:\Windows\System32\mLXDfbk.exe
  2⤵
  PID:5316
- C:\Windows\System32\ZDounUK.exe
  C:\Windows\System32\ZDounUK.exe
  2⤵
  PID:5400
- C:\Windows\System32\xOWumDx.exe
  C:\Windows\System32\xOWumDx.exe
  2⤵
  PID:5440
- C:\Windows\System32\onctFTb.exe
  C:\Windows\System32\onctFTb.exe
  2⤵
  PID:5504
- C:\Windows\System32\yfgLkMi.exe
  C:\Windows\System32\yfgLkMi.exe
  2⤵
  PID:5596
- C:\Windows\System32\uNvxVVe.exe
  C:\Windows\System32\uNvxVVe.exe
  2⤵
  PID:5636
- C:\Windows\System32\qWvlgWy.exe
  C:\Windows\System32\qWvlgWy.exe
  2⤵
  PID:5700
- C:\Windows\System32\MLjUuSD.exe
  C:\Windows\System32\MLjUuSD.exe
  2⤵
  PID:5752
- C:\Windows\System32\DKyvySd.exe
  C:\Windows\System32\DKyvySd.exe
  2⤵
  PID:5832
- C:\Windows\System32\PvmBvEs.exe
  C:\Windows\System32\PvmBvEs.exe
  2⤵
  PID:5904
- C:\Windows\System32\ScKjNhp.exe
  C:\Windows\System32\ScKjNhp.exe
  2⤵
  PID:5952
- C:\Windows\System32\roSuNDW.exe
  C:\Windows\System32\roSuNDW.exe
  2⤵
  PID:6008
- C:\Windows\System32\Jydtvxv.exe
  C:\Windows\System32\Jydtvxv.exe
  2⤵
  PID:6088
- C:\Windows\System32\yqNmDZR.exe
  C:\Windows\System32\yqNmDZR.exe
  2⤵
  PID:4532
- C:\Windows\System32\IXLzkOE.exe
  C:\Windows\System32\IXLzkOE.exe
  2⤵
  PID:3156
- C:\Windows\System32\JXSXfPP.exe
  C:\Windows\System32\JXSXfPP.exe
  2⤵
  PID:1484
- C:\Windows\System32\SkCDRjn.exe
  C:\Windows\System32\SkCDRjn.exe
  2⤵
  PID:5280
- C:\Windows\System32\YXDWMHt.exe
  C:\Windows\System32\YXDWMHt.exe
  2⤵
  PID:5328
- C:\Windows\System32\kLySZoD.exe
  C:\Windows\System32\kLySZoD.exe
  2⤵
  PID:5456
- C:\Windows\System32\NqrVpdo.exe
  C:\Windows\System32\NqrVpdo.exe
  2⤵
  PID:5612
- C:\Windows\System32\UAPPhWm.exe
  C:\Windows\System32\UAPPhWm.exe
  2⤵
  PID:5764
- C:\Windows\System32\NLkYTgo.exe
  C:\Windows\System32\NLkYTgo.exe
  2⤵
  PID:2460
- C:\Windows\System32\CfdCMTN.exe
  C:\Windows\System32\CfdCMTN.exe
  2⤵
  PID:6016
- C:\Windows\System32\JUQFvvs.exe
  C:\Windows\System32\JUQFvvs.exe
  2⤵
  PID:6140
- C:\Windows\System32\BNPoRou.exe
  C:\Windows\System32\BNPoRou.exe
  2⤵
  PID:5164
- C:\Windows\System32\mTPRnrB.exe
  C:\Windows\System32\mTPRnrB.exe
  2⤵
  PID:5392
- C:\Windows\System32\wDTxpjU.exe
  C:\Windows\System32\wDTxpjU.exe
  2⤵
  PID:5588
- C:\Windows\System32\xLIUriU.exe
  C:\Windows\System32\xLIUriU.exe
  2⤵
  PID:5980
- C:\Windows\System32\WKAmSUc.exe
  C:\Windows\System32\WKAmSUc.exe
  2⤵
  PID:6156
- C:\Windows\System32\eTIPJwx.exe
  C:\Windows\System32\eTIPJwx.exe
  2⤵
  PID:6180
- C:\Windows\System32\kMCBsUR.exe
  C:\Windows\System32\kMCBsUR.exe
  2⤵
  PID:6208
- C:\Windows\System32\QapOrqh.exe
  C:\Windows\System32\QapOrqh.exe
  2⤵
  PID:6240
- C:\Windows\System32\CDkoCnS.exe
  C:\Windows\System32\CDkoCnS.exe
  2⤵
  PID:6268
- C:\Windows\System32\fFtScYy.exe
  C:\Windows\System32\fFtScYy.exe
  2⤵
  PID:6296
- C:\Windows\System32\EzAtmvW.exe
  C:\Windows\System32\EzAtmvW.exe
  2⤵
  PID:6320
- C:\Windows\System32\zmJKEqa.exe
  C:\Windows\System32\zmJKEqa.exe
  2⤵
  PID:6360
- C:\Windows\System32\SOfSbOd.exe
  C:\Windows\System32\SOfSbOd.exe
  2⤵
  PID:6464
- C:\Windows\System32\tDzCUsS.exe
  C:\Windows\System32\tDzCUsS.exe
  2⤵
  PID:6480
- C:\Windows\System32\BMuVRtO.exe
  C:\Windows\System32\BMuVRtO.exe
  2⤵
  PID:6500
- C:\Windows\System32\wWXKKiF.exe
  C:\Windows\System32\wWXKKiF.exe
  2⤵
  PID:6520
- C:\Windows\System32\GumTqvs.exe
  C:\Windows\System32\GumTqvs.exe
  2⤵
  PID:6560
- C:\Windows\System32\QHnSLXs.exe
  C:\Windows\System32\QHnSLXs.exe
  2⤵
  PID:6620
- C:\Windows\System32\PsTWkJL.exe
  C:\Windows\System32\PsTWkJL.exe
  2⤵
  PID:6656
- C:\Windows\System32\ePYDhmx.exe
  C:\Windows\System32\ePYDhmx.exe
  2⤵
  PID:6680
- C:\Windows\System32\unWSHLF.exe
  C:\Windows\System32\unWSHLF.exe
  2⤵
  PID:6696
- C:\Windows\System32\MiEfvHy.exe
  C:\Windows\System32\MiEfvHy.exe
  2⤵
  PID:6716
- C:\Windows\System32\IALlyCN.exe
  C:\Windows\System32\IALlyCN.exe
  2⤵
  PID:6760
- C:\Windows\System32\jwuwQdG.exe
  C:\Windows\System32\jwuwQdG.exe
  2⤵
  PID:6904
- C:\Windows\System32\ymbpbHq.exe
  C:\Windows\System32\ymbpbHq.exe
  2⤵
  PID:6924
- C:\Windows\System32\FQmhilH.exe
  C:\Windows\System32\FQmhilH.exe
  2⤵
  PID:6940
- C:\Windows\System32\jBFZzHg.exe
  C:\Windows\System32\jBFZzHg.exe
  2⤵
  PID:6956
- C:\Windows\System32\GUutofG.exe
  C:\Windows\System32\GUutofG.exe
  2⤵
  PID:6972
- C:\Windows\System32\SJrpAUn.exe
  C:\Windows\System32\SJrpAUn.exe
  2⤵
  PID:6988
- C:\Windows\System32\ItAHpsp.exe
  C:\Windows\System32\ItAHpsp.exe
  2⤵
  PID:7004
- C:\Windows\System32\LqVXCQn.exe
  C:\Windows\System32\LqVXCQn.exe
  2⤵
  PID:7020
- C:\Windows\System32\IsZErak.exe
  C:\Windows\System32\IsZErak.exe
  2⤵
  PID:7036
- C:\Windows\System32\VsYWTKy.exe
  C:\Windows\System32\VsYWTKy.exe
  2⤵
  PID:7052
- C:\Windows\System32\Rekdvqa.exe
  C:\Windows\System32\Rekdvqa.exe
  2⤵
  PID:7068
- C:\Windows\System32\IJvzUNC.exe
  C:\Windows\System32\IJvzUNC.exe
  2⤵
  PID:7084
- C:\Windows\System32\kPSIxfX.exe
  C:\Windows\System32\kPSIxfX.exe
  2⤵
  PID:7100
- C:\Windows\System32\vBHxcuk.exe
  C:\Windows\System32\vBHxcuk.exe
  2⤵
  PID:7164
- C:\Windows\System32\Bxrckxf.exe
  C:\Windows\System32\Bxrckxf.exe
  2⤵
  PID:3872
- C:\Windows\System32\fgEKjck.exe
  C:\Windows\System32\fgEKjck.exe
  2⤵
  PID:6304
- C:\Windows\System32\gCqSInM.exe
  C:\Windows\System32\gCqSInM.exe
  2⤵
  PID:972
- C:\Windows\System32\BiKWeNq.exe
  C:\Windows\System32\BiKWeNq.exe
  2⤵
  PID:6376
- C:\Windows\System32\zBvgyaz.exe
  C:\Windows\System32\zBvgyaz.exe
  2⤵
  PID:2352
- C:\Windows\System32\cskNKpt.exe
  C:\Windows\System32\cskNKpt.exe
  2⤵
  PID:4368
- C:\Windows\System32\FAWZDpB.exe
  C:\Windows\System32\FAWZDpB.exe
  2⤵
  PID:2848
- C:\Windows\System32\QVaeMzd.exe
  C:\Windows\System32\QVaeMzd.exe
  2⤵
  PID:4636
- C:\Windows\System32\FZNUKGx.exe
  C:\Windows\System32\FZNUKGx.exe
  2⤵
  PID:4980
- C:\Windows\System32\ytEtBNn.exe
  C:\Windows\System32\ytEtBNn.exe
  2⤵
  PID:6444
- C:\Windows\System32\gVYxOeh.exe
  C:\Windows\System32\gVYxOeh.exe
  2⤵
  PID:6512
- C:\Windows\System32\lYeeaJR.exe
  C:\Windows\System32\lYeeaJR.exe
  2⤵
  PID:6556
- C:\Windows\System32\hhKqoKv.exe
  C:\Windows\System32\hhKqoKv.exe
  2⤵
  PID:6664
- C:\Windows\System32\yxXtgvA.exe
  C:\Windows\System32\yxXtgvA.exe
  2⤵
  PID:6708
- C:\Windows\System32\DYmRNcf.exe
  C:\Windows\System32\DYmRNcf.exe
  2⤵
  PID:6756
- C:\Windows\System32\CKPBxMz.exe
  C:\Windows\System32\CKPBxMz.exe
  2⤵
  PID:6456
- C:\Windows\System32\gPZmKAH.exe
  C:\Windows\System32\gPZmKAH.exe
  2⤵
  PID:6712
- C:\Windows\System32\KITbmME.exe
  C:\Windows\System32\KITbmME.exe
  2⤵
  PID:6792
- C:\Windows\System32\MdWGMRF.exe
  C:\Windows\System32\MdWGMRF.exe
  2⤵
  PID:6980
- C:\Windows\System32\ohFyofK.exe
  C:\Windows\System32\ohFyofK.exe
  2⤵
  PID:7124
- C:\Windows\System32\bzwTPNV.exe
  C:\Windows\System32\bzwTPNV.exe
  2⤵
  PID:6824
- C:\Windows\System32\QdWCvBm.exe
  C:\Windows\System32\QdWCvBm.exe
  2⤵
  PID:6860
- C:\Windows\System32\EKwvBQH.exe
  C:\Windows\System32\EKwvBQH.exe
  2⤵
  PID:5792
- C:\Windows\System32\gwAiEWR.exe
  C:\Windows\System32\gwAiEWR.exe
  2⤵
  PID:3076
- C:\Windows\System32\utJVGlf.exe
  C:\Windows\System32\utJVGlf.exe
  2⤵
  PID:7000
- C:\Windows\System32\pqOapUD.exe
  C:\Windows\System32\pqOapUD.exe
  2⤵
  PID:7112
- C:\Windows\System32\kKZeqqX.exe
  C:\Windows\System32\kKZeqqX.exe
  2⤵
  PID:7140
- C:\Windows\System32\ZcHtAcB.exe
  C:\Windows\System32\ZcHtAcB.exe
  2⤵
  PID:6216
- C:\Windows\System32\SIRdqfX.exe
  C:\Windows\System32\SIRdqfX.exe
  2⤵
  PID:6280
- C:\Windows\System32\mNXhjRc.exe
  C:\Windows\System32\mNXhjRc.exe
  2⤵
  PID:6336
- C:\Windows\System32\zvavoPw.exe
  C:\Windows\System32\zvavoPw.exe
  2⤵
  PID:3228
- C:\Windows\System32\HwHVNfC.exe
  C:\Windows\System32\HwHVNfC.exe
  2⤵
  PID:3476
- C:\Windows\System32\wjcdUQn.exe
  C:\Windows\System32\wjcdUQn.exe
  2⤵
  PID:2000
- C:\Windows\System32\KtvuvZW.exe
  C:\Windows\System32\KtvuvZW.exe
  2⤵
  PID:6488
- C:\Windows\System32\trwIuhV.exe
  C:\Windows\System32\trwIuhV.exe
  2⤵
  PID:4644
- C:\Windows\System32\pcNDWGs.exe
  C:\Windows\System32\pcNDWGs.exe
  2⤵
  PID:6816
- C:\Windows\System32\Iyecnwy.exe
  C:\Windows\System32\Iyecnwy.exe
  2⤵
  PID:7160
- C:\Windows\System32\UohwjBG.exe
  C:\Windows\System32\UohwjBG.exe
  2⤵
  PID:6820
- C:\Windows\System32\KJnbKKy.exe
  C:\Windows\System32\KJnbKKy.exe
  2⤵
  PID:336
- C:\Windows\System32\BsgKJrq.exe
  C:\Windows\System32\BsgKJrq.exe
  2⤵
  PID:5072
- C:\Windows\System32\aQuzNve.exe
  C:\Windows\System32\aQuzNve.exe
  2⤵
  PID:2064
- C:\Windows\System32\xhhobCm.exe
  C:\Windows\System32\xhhobCm.exe
  2⤵
  PID:6652
- C:\Windows\System32\AOmhrpy.exe
  C:\Windows\System32\AOmhrpy.exe
  2⤵
  PID:6872
- C:\Windows\System32\jdnEiRq.exe
  C:\Windows\System32\jdnEiRq.exe
  2⤵
  PID:4912
- C:\Windows\System32\jlbfOfv.exe
  C:\Windows\System32\jlbfOfv.exe
  2⤵
  PID:4180
- C:\Windows\System32\dCJVLlA.exe
  C:\Windows\System32\dCJVLlA.exe
  2⤵
  PID:6728
- C:\Windows\System32\uaKJSfy.exe
  C:\Windows\System32\uaKJSfy.exe
  2⤵
  PID:6884
- C:\Windows\System32\LdlgwqA.exe
  C:\Windows\System32\LdlgwqA.exe
  2⤵
  PID:7188
- C:\Windows\System32\TNbnEiL.exe
  C:\Windows\System32\TNbnEiL.exe
  2⤵
  PID:7216
- C:\Windows\System32\LkrqSgy.exe
  C:\Windows\System32\LkrqSgy.exe
  2⤵
  PID:7256
- C:\Windows\System32\ciyMvbI.exe
  C:\Windows\System32\ciyMvbI.exe
  2⤵
  PID:7300
- C:\Windows\System32\VeVDjKF.exe
  C:\Windows\System32\VeVDjKF.exe
  2⤵
  PID:7316
- C:\Windows\System32\jqRtqPO.exe
  C:\Windows\System32\jqRtqPO.exe
  2⤵
  PID:7336
- C:\Windows\System32\QevwrHz.exe
  C:\Windows\System32\QevwrHz.exe
  2⤵
  PID:7368
- C:\Windows\System32\zsklAzT.exe
  C:\Windows\System32\zsklAzT.exe
  2⤵
  PID:7416
- C:\Windows\System32\vxnQMqW.exe
  C:\Windows\System32\vxnQMqW.exe
  2⤵
  PID:7432
- C:\Windows\System32\bYuBkvm.exe
  C:\Windows\System32\bYuBkvm.exe
  2⤵
  PID:7452
- C:\Windows\System32\enEyXow.exe
  C:\Windows\System32\enEyXow.exe
  2⤵
  PID:7476
- C:\Windows\System32\PfoMDod.exe
  C:\Windows\System32\PfoMDod.exe
  2⤵
  PID:7496
- C:\Windows\System32\XZsctoj.exe
  C:\Windows\System32\XZsctoj.exe
  2⤵
  PID:7520
- C:\Windows\System32\SHzGwrM.exe
  C:\Windows\System32\SHzGwrM.exe
  2⤵
  PID:7540
- C:\Windows\System32\YUkRVhH.exe
  C:\Windows\System32\YUkRVhH.exe
  2⤵
  PID:7564
- C:\Windows\System32\OKXCHMj.exe
  C:\Windows\System32\OKXCHMj.exe
  2⤵
  PID:7580
- C:\Windows\System32\ENEOTZx.exe
  C:\Windows\System32\ENEOTZx.exe
  2⤵
  PID:7600
- C:\Windows\System32\LUDqQRF.exe
  C:\Windows\System32\LUDqQRF.exe
  2⤵
  PID:7624
- C:\Windows\System32\GREkDHn.exe
  C:\Windows\System32\GREkDHn.exe
  2⤵
  PID:7644
- C:\Windows\System32\KHlVZjZ.exe
  C:\Windows\System32\KHlVZjZ.exe
  2⤵
  PID:7700
- C:\Windows\System32\dCqFIkH.exe
  C:\Windows\System32\dCqFIkH.exe
  2⤵
  PID:7724
- C:\Windows\System32\gTeIRGm.exe
  C:\Windows\System32\gTeIRGm.exe
  2⤵
  PID:7768
- C:\Windows\System32\QDjPRDp.exe
  C:\Windows\System32\QDjPRDp.exe
  2⤵
  PID:7784
- C:\Windows\System32\OItcoMk.exe
  C:\Windows\System32\OItcoMk.exe
  2⤵
  PID:7860
- C:\Windows\System32\dujKJNz.exe
  C:\Windows\System32\dujKJNz.exe
  2⤵
  PID:7880
- C:\Windows\System32\oQFaePX.exe
  C:\Windows\System32\oQFaePX.exe
  2⤵
  PID:7896
- C:\Windows\System32\hwZuASa.exe
  C:\Windows\System32\hwZuASa.exe
  2⤵
  PID:7924
- C:\Windows\System32\wrNLHoo.exe
  C:\Windows\System32\wrNLHoo.exe
  2⤵
  PID:7992
- C:\Windows\System32\csgpddM.exe
  C:\Windows\System32\csgpddM.exe
  2⤵
  PID:8008
- C:\Windows\System32\SzKzRXO.exe
  C:\Windows\System32\SzKzRXO.exe
  2⤵
  PID:8032
- C:\Windows\System32\qLpCipM.exe
  C:\Windows\System32\qLpCipM.exe
  2⤵
  PID:8048
- C:\Windows\System32\wynWbuM.exe
  C:\Windows\System32\wynWbuM.exe
  2⤵
  PID:8068
- C:\Windows\System32\myXyDFU.exe
  C:\Windows\System32\myXyDFU.exe
  2⤵
  PID:8088
- C:\Windows\System32\TGzNYjM.exe
  C:\Windows\System32\TGzNYjM.exe
  2⤵
  PID:8108
- C:\Windows\System32\LZmMVQC.exe
  C:\Windows\System32\LZmMVQC.exe
  2⤵
  PID:8124
- C:\Windows\System32\SsaSetP.exe
  C:\Windows\System32\SsaSetP.exe
  2⤵
  PID:8164
- C:\Windows\System32\DIpfZqQ.exe
  C:\Windows\System32\DIpfZqQ.exe
  2⤵
  PID:6996
- C:\Windows\System32\QMpFHGS.exe
  C:\Windows\System32\QMpFHGS.exe
  2⤵
  PID:7248
- C:\Windows\System32\StURoGl.exe
  C:\Windows\System32\StURoGl.exe
  2⤵
  PID:7332
- C:\Windows\System32\YXSUNyR.exe
  C:\Windows\System32\YXSUNyR.exe
  2⤵
  PID:7380
- C:\Windows\System32\mYkReJa.exe
  C:\Windows\System32\mYkReJa.exe
  2⤵
  PID:7464
- C:\Windows\System32\IFEhVqR.exe
  C:\Windows\System32\IFEhVqR.exe
  2⤵
  PID:7516
- C:\Windows\System32\qZrbSYS.exe
  C:\Windows\System32\qZrbSYS.exe
  2⤵
  PID:7572
- C:\Windows\System32\CESRmra.exe
  C:\Windows\System32\CESRmra.exe
  2⤵
  PID:7636
- C:\Windows\System32\WygVJHw.exe
  C:\Windows\System32\WygVJHw.exe
  2⤵
  PID:7692
- C:\Windows\System32\wpoCtei.exe
  C:\Windows\System32\wpoCtei.exe
  2⤵
  PID:7660
- C:\Windows\System32\NhNsXnr.exe
  C:\Windows\System32\NhNsXnr.exe
  2⤵
  PID:7760
- C:\Windows\System32\pVZlYsU.exe
  C:\Windows\System32\pVZlYsU.exe
  2⤵
  PID:7876
- C:\Windows\System32\gXeYEZF.exe
  C:\Windows\System32\gXeYEZF.exe
  2⤵
  PID:7932
- C:\Windows\System32\OAjDRkR.exe
  C:\Windows\System32\OAjDRkR.exe
  2⤵
  PID:8004
- C:\Windows\System32\KfXEJUa.exe
  C:\Windows\System32\KfXEJUa.exe
  2⤵
  PID:8140
- C:\Windows\System32\hAHkuaw.exe
  C:\Windows\System32\hAHkuaw.exe
  2⤵
  PID:8100
- C:\Windows\System32\xDIKtUB.exe
  C:\Windows\System32\xDIKtUB.exe
  2⤵
  PID:2132
- C:\Windows\System32\wSfyezc.exe
  C:\Windows\System32\wSfyezc.exe
  2⤵
  PID:7180
- C:\Windows\System32\wiHJUTq.exe
  C:\Windows\System32\wiHJUTq.exe
  2⤵
  PID:7356
- C:\Windows\System32\eGPUuHm.exe
  C:\Windows\System32\eGPUuHm.exe
  2⤵
  PID:7548
- C:\Windows\System32\DZBTgNg.exe
  C:\Windows\System32\DZBTgNg.exe
  2⤵
  PID:7708
- C:\Windows\System32\YsaGIij.exe
  C:\Windows\System32\YsaGIij.exe
  2⤵
  PID:7832
- C:\Windows\System32\zawrimg.exe
  C:\Windows\System32\zawrimg.exe
  2⤵
  PID:7980
- C:\Windows\System32\jOpuoHE.exe
  C:\Windows\System32\jOpuoHE.exe
  2⤵
  PID:6984
- C:\Windows\System32\sKdosGH.exe
  C:\Windows\System32\sKdosGH.exe
  2⤵
  PID:7400
- C:\Windows\System32\BAKeRJY.exe
  C:\Windows\System32\BAKeRJY.exe
  2⤵
  PID:7796
- C:\Windows\System32\YFbYgxu.exe
  C:\Windows\System32\YFbYgxu.exe
  2⤵
  PID:7312
- C:\Windows\System32\oDuGaha.exe
  C:\Windows\System32\oDuGaha.exe
  2⤵
  PID:8236
- C:\Windows\System32\SrQUXac.exe
  C:\Windows\System32\SrQUXac.exe
  2⤵
  PID:8256
- C:\Windows\System32\CTjFTNk.exe
  C:\Windows\System32\CTjFTNk.exe
  2⤵
  PID:8284
- C:\Windows\System32\uxmvDdN.exe
  C:\Windows\System32\uxmvDdN.exe
  2⤵
  PID:8304
- C:\Windows\System32\PFaJHor.exe
  C:\Windows\System32\PFaJHor.exe
  2⤵
  PID:8320
- C:\Windows\System32\ccdkGST.exe
  C:\Windows\System32\ccdkGST.exe
  2⤵
  PID:8340
- C:\Windows\System32\DlUJaaS.exe
  C:\Windows\System32\DlUJaaS.exe
  2⤵
  PID:8364
- C:\Windows\System32\phsrpoC.exe
  C:\Windows\System32\phsrpoC.exe
  2⤵
  PID:8388
- C:\Windows\System32\dqHfbQr.exe
  C:\Windows\System32\dqHfbQr.exe
  2⤵
  PID:8416
- C:\Windows\System32\qmXMiOk.exe
  C:\Windows\System32\qmXMiOk.exe
  2⤵
  PID:8436
- C:\Windows\System32\LZebljG.exe
  C:\Windows\System32\LZebljG.exe
  2⤵
  PID:8456
- C:\Windows\System32\WUSKRLG.exe
  C:\Windows\System32\WUSKRLG.exe
  2⤵
  PID:8512
- C:\Windows\System32\UDztzoH.exe
  C:\Windows\System32\UDztzoH.exe
  2⤵
  PID:8556
- C:\Windows\System32\eveuehk.exe
  C:\Windows\System32\eveuehk.exe
  2⤵
  PID:8592
- C:\Windows\System32\hoVTiXk.exe
  C:\Windows\System32\hoVTiXk.exe
  2⤵
  PID:8612
- C:\Windows\System32\lNeOJis.exe
  C:\Windows\System32\lNeOJis.exe
  2⤵
  PID:8636
- C:\Windows\System32\MkpAdJW.exe
  C:\Windows\System32\MkpAdJW.exe
  2⤵
  PID:8664
- C:\Windows\System32\HltoeWn.exe
  C:\Windows\System32\HltoeWn.exe
  2⤵
  PID:8704
- C:\Windows\System32\WogTDtr.exe
  C:\Windows\System32\WogTDtr.exe
  2⤵
  PID:8736
- C:\Windows\System32\Izgnwjv.exe
  C:\Windows\System32\Izgnwjv.exe
  2⤵
  PID:8772
- C:\Windows\System32\gMgNfWg.exe
  C:\Windows\System32\gMgNfWg.exe
  2⤵
  PID:8792
- C:\Windows\System32\hwIigrE.exe
  C:\Windows\System32\hwIigrE.exe
  2⤵
  PID:8808
- C:\Windows\System32\buMtYMi.exe
  C:\Windows\System32\buMtYMi.exe
  2⤵
  PID:8828
- C:\Windows\System32\xhoILlp.exe
  C:\Windows\System32\xhoILlp.exe
  2⤵
  PID:8852
- C:\Windows\System32\JemPbny.exe
  C:\Windows\System32\JemPbny.exe
  2⤵
  PID:8872
- C:\Windows\System32\MgjAqEq.exe
  C:\Windows\System32\MgjAqEq.exe
  2⤵
  PID:8908
- C:\Windows\System32\IYCHcAR.exe
  C:\Windows\System32\IYCHcAR.exe
  2⤵
  PID:8932
- C:\Windows\System32\DHNUiBS.exe
  C:\Windows\System32\DHNUiBS.exe
  2⤵
  PID:8956
- C:\Windows\System32\yVBCwBR.exe
  C:\Windows\System32\yVBCwBR.exe
  2⤵
  PID:8992
- C:\Windows\System32\vaTOyci.exe
  C:\Windows\System32\vaTOyci.exe
  2⤵
  PID:9032
- C:\Windows\System32\lyhCrqA.exe
  C:\Windows\System32\lyhCrqA.exe
  2⤵
  PID:9056
- C:\Windows\System32\HERbbbG.exe
  C:\Windows\System32\HERbbbG.exe
  2⤵
  PID:9096
- C:\Windows\System32\RtRPcMo.exe
  C:\Windows\System32\RtRPcMo.exe
  2⤵
  PID:9116
- C:\Windows\System32\IbQRhtH.exe
  C:\Windows\System32\IbQRhtH.exe
  2⤵
  PID:9164
- C:\Windows\System32\LbjPgal.exe
  C:\Windows\System32\LbjPgal.exe
  2⤵
  PID:9188
- C:\Windows\System32\LVhmUWt.exe
  C:\Windows\System32\LVhmUWt.exe
  2⤵
  PID:9204
- C:\Windows\System32\ryiIIXE.exe
  C:\Windows\System32\ryiIIXE.exe
  2⤵
  PID:8224
- C:\Windows\System32\zxUHdSO.exe
  C:\Windows\System32\zxUHdSO.exe
  2⤵
  PID:8268
- C:\Windows\System32\opFBYoB.exe
  C:\Windows\System32\opFBYoB.exe
  2⤵
  PID:8372
- C:\Windows\System32\fDbTQrX.exe
  C:\Windows\System32\fDbTQrX.exe
  2⤵
  PID:8432
- C:\Windows\System32\cieAuBr.exe
  C:\Windows\System32\cieAuBr.exe
  2⤵
  PID:8472
- C:\Windows\System32\DdvSGyo.exe
  C:\Windows\System32\DdvSGyo.exe
  2⤵
  PID:8484
- C:\Windows\System32\mnkgeQH.exe
  C:\Windows\System32\mnkgeQH.exe
  2⤵
  PID:8576
- C:\Windows\System32\aYjGgBr.exe
  C:\Windows\System32\aYjGgBr.exe
  2⤵
  PID:8676
- C:\Windows\System32\jGCsyWo.exe
  C:\Windows\System32\jGCsyWo.exe
  2⤵
  PID:8760
- C:\Windows\System32\HpnQJPb.exe
  C:\Windows\System32\HpnQJPb.exe
  2⤵
  PID:8804
- C:\Windows\System32\trKZZyP.exe
  C:\Windows\System32\trKZZyP.exe
  2⤵
  PID:8836
- C:\Windows\System32\YnQaOBy.exe
  C:\Windows\System32\YnQaOBy.exe
  2⤵
  PID:8952
- C:\Windows\System32\PKuLCVT.exe
  C:\Windows\System32\PKuLCVT.exe
  2⤵
  PID:9000
- C:\Windows\System32\zVApIln.exe
  C:\Windows\System32\zVApIln.exe
  2⤵
  PID:9020
- C:\Windows\System32\pozopYL.exe
  C:\Windows\System32\pozopYL.exe
  2⤵
  PID:9140
- C:\Windows\System32\yRnblye.exe
  C:\Windows\System32\yRnblye.exe
  2⤵
  PID:9196
- C:\Windows\System32\vCKgmKL.exe
  C:\Windows\System32\vCKgmKL.exe
  2⤵
  PID:8204
- C:\Windows\System32\iFxbLLC.exe
  C:\Windows\System32\iFxbLLC.exe
  2⤵
  PID:8400
- C:\Windows\System32\OrXyeIf.exe
  C:\Windows\System32\OrXyeIf.exe
  2⤵
  PID:8520
- C:\Windows\System32\ZvSmbVW.exe
  C:\Windows\System32\ZvSmbVW.exe
  2⤵
  PID:8644
- C:\Windows\System32\GlRAkkC.exe
  C:\Windows\System32\GlRAkkC.exe
  2⤵
  PID:7968
- C:\Windows\System32\wXqpsms.exe
  C:\Windows\System32\wXqpsms.exe
  2⤵
  PID:8984
- C:\Windows\System32\mZEBmev.exe
  C:\Windows\System32\mZEBmev.exe
  2⤵
  PID:9088
- C:\Windows\System32\EDWMJET.exe
  C:\Windows\System32\EDWMJET.exe
  2⤵
  PID:9184
- C:\Windows\System32\RKrXliE.exe
  C:\Windows\System32\RKrXliE.exe
  2⤵
  PID:8508
- C:\Windows\System32\NNWvwoT.exe
  C:\Windows\System32\NNWvwoT.exe
  2⤵
  PID:9068
- C:\Windows\System32\OGBFZFe.exe
  C:\Windows\System32\OGBFZFe.exe
  2⤵
  PID:8404
- C:\Windows\System32\HbcafVO.exe
  C:\Windows\System32\HbcafVO.exe
  2⤵
  PID:8824
- C:\Windows\System32\pWUSAwa.exe
  C:\Windows\System32\pWUSAwa.exe
  2⤵
  PID:9224
- C:\Windows\System32\oBaNiRK.exe
  C:\Windows\System32\oBaNiRK.exe
  2⤵
  PID:9260
- C:\Windows\System32\GfKXpMh.exe
  C:\Windows\System32\GfKXpMh.exe
  2⤵
  PID:9292
- C:\Windows\System32\TStWoVN.exe
  C:\Windows\System32\TStWoVN.exe
  2⤵
  PID:9320
- C:\Windows\System32\JrKrUkd.exe
  C:\Windows\System32\JrKrUkd.exe
  2⤵
  PID:9344
- C:\Windows\System32\QcuUzCd.exe
  C:\Windows\System32\QcuUzCd.exe
  2⤵
  PID:9368
- C:\Windows\System32\DcOPDgQ.exe
  C:\Windows\System32\DcOPDgQ.exe
  2⤵
  PID:9400
- C:\Windows\System32\ciCcGNp.exe
  C:\Windows\System32\ciCcGNp.exe
  2⤵
  PID:9448
- C:\Windows\System32\QfMlYVD.exe
  C:\Windows\System32\QfMlYVD.exe
  2⤵
  PID:9484
- C:\Windows\System32\BeGeTsP.exe
  C:\Windows\System32\BeGeTsP.exe
  2⤵
  PID:9508
- C:\Windows\System32\IMXoyCy.exe
  C:\Windows\System32\IMXoyCy.exe
  2⤵
  PID:9536
- C:\Windows\System32\CtVzfXi.exe
  C:\Windows\System32\CtVzfXi.exe
  2⤵
  PID:9564
- C:\Windows\System32\gXhvkSX.exe
  C:\Windows\System32\gXhvkSX.exe
  2⤵
  PID:9584
- C:\Windows\System32\CEuzpDw.exe
  C:\Windows\System32\CEuzpDw.exe
  2⤵
  PID:9608
- C:\Windows\System32\kKvOgYC.exe
  C:\Windows\System32\kKvOgYC.exe
  2⤵
  PID:9628
- C:\Windows\System32\qwytLew.exe
  C:\Windows\System32\qwytLew.exe
  2⤵
  PID:9672
- C:\Windows\System32\LnVZwWJ.exe
  C:\Windows\System32\LnVZwWJ.exe
  2⤵
  PID:9688
- C:\Windows\System32\yKxnGNr.exe
  C:\Windows\System32\yKxnGNr.exe
  2⤵
  PID:9712
- C:\Windows\System32\FfjIFWN.exe
  C:\Windows\System32\FfjIFWN.exe
  2⤵
  PID:9732
- C:\Windows\System32\kVUmmaY.exe
  C:\Windows\System32\kVUmmaY.exe
  2⤵
  PID:9756
- C:\Windows\System32\fFmmeLV.exe
  C:\Windows\System32\fFmmeLV.exe
  2⤵
  PID:9776
- C:\Windows\System32\eZgXTmV.exe
  C:\Windows\System32\eZgXTmV.exe
  2⤵
  PID:9824
- C:\Windows\System32\hBDjUEd.exe
  C:\Windows\System32\hBDjUEd.exe
  2⤵
  PID:9844
- C:\Windows\System32\mQKYYjg.exe
  C:\Windows\System32\mQKYYjg.exe
  2⤵
  PID:9880
- C:\Windows\System32\vKEMVqg.exe
  C:\Windows\System32\vKEMVqg.exe
  2⤵
  PID:9896
- C:\Windows\System32\WyUeAey.exe
  C:\Windows\System32\WyUeAey.exe
  2⤵
  PID:9936
- C:\Windows\System32\ZPEIByX.exe
  C:\Windows\System32\ZPEIByX.exe
  2⤵
  PID:9988
- C:\Windows\System32\jmxjOiE.exe
  C:\Windows\System32\jmxjOiE.exe
  2⤵
  PID:10016
- C:\Windows\System32\XvlqyEM.exe
  C:\Windows\System32\XvlqyEM.exe
  2⤵
  PID:10044
- C:\Windows\System32\iKcjWoJ.exe
  C:\Windows\System32\iKcjWoJ.exe
  2⤵
  PID:10060
- C:\Windows\System32\vsMuJXv.exe
  C:\Windows\System32\vsMuJXv.exe
  2⤵
  PID:10084
- C:\Windows\System32\dWqieSx.exe
  C:\Windows\System32\dWqieSx.exe
  2⤵
  PID:10116
- C:\Windows\System32\AsVXrXA.exe
  C:\Windows\System32\AsVXrXA.exe
  2⤵
  PID:10136
- C:\Windows\System32\RjcIZDc.exe
  C:\Windows\System32\RjcIZDc.exe
  2⤵
  PID:10160
- C:\Windows\System32\sSccgGF.exe
  C:\Windows\System32\sSccgGF.exe
  2⤵
  PID:10208
- C:\Windows\System32\JGoaEGG.exe
  C:\Windows\System32\JGoaEGG.exe
  2⤵
  PID:9268
- C:\Windows\System32\igJCjfC.exe
  C:\Windows\System32\igJCjfC.exe
  2⤵
  PID:9356
- C:\Windows\System32\nQYvfin.exe
  C:\Windows\System32\nQYvfin.exe
  2⤵
  PID:9380
- C:\Windows\System32\jWRlJRa.exe
  C:\Windows\System32\jWRlJRa.exe
  2⤵
  PID:9456
- C:\Windows\System32\WPgwasO.exe
  C:\Windows\System32\WPgwasO.exe
  2⤵
  PID:9524
- C:\Windows\System32\lgQnbQF.exe
  C:\Windows\System32\lgQnbQF.exe
  2⤵
  PID:9572
- C:\Windows\System32\PynUSZQ.exe
  C:\Windows\System32\PynUSZQ.exe
  2⤵
  PID:9624
- C:\Windows\System32\NfKidKl.exe
  C:\Windows\System32\NfKidKl.exe
  2⤵
  PID:9668
- C:\Windows\System32\FnTyHRG.exe
  C:\Windows\System32\FnTyHRG.exe
  2⤵
  PID:9740
- C:\Windows\System32\fAiQHHr.exe
  C:\Windows\System32\fAiQHHr.exe
  2⤵
  PID:3820
- C:\Windows\System32\tvTyYel.exe
  C:\Windows\System32\tvTyYel.exe
  2⤵
  PID:9768
- C:\Windows\System32\FpsAeVe.exe
  C:\Windows\System32\FpsAeVe.exe
  2⤵
  PID:9944
- C:\Windows\System32\YMAPkQI.exe
  C:\Windows\System32\YMAPkQI.exe
  2⤵
  PID:10024
- C:\Windows\System32\ropnnue.exe
  C:\Windows\System32\ropnnue.exe
  2⤵
  PID:10080
- C:\Windows\System32\wLyGsUi.exe
  C:\Windows\System32\wLyGsUi.exe
  2⤵
  PID:10052
- C:\Windows\System32\xxkwsVB.exe
  C:\Windows\System32\xxkwsVB.exe
  2⤵
  PID:10180
- C:\Windows\System32\UXrEYKV.exe
  C:\Windows\System32\UXrEYKV.exe
  2⤵
  PID:9232
- C:\Windows\System32\kfMeLMZ.exe
  C:\Windows\System32\kfMeLMZ.exe
  2⤵
  PID:9376
- C:\Windows\System32\rhsfPOe.exe
  C:\Windows\System32\rhsfPOe.exe
  2⤵
  PID:9652
- C:\Windows\System32\YwreiAk.exe
  C:\Windows\System32\YwreiAk.exe
  2⤵
  PID:9700
- C:\Windows\System32\DFnWtjt.exe
  C:\Windows\System32\DFnWtjt.exe
  2⤵
  PID:9648
- C:\Windows\System32\gKMTdlm.exe
  C:\Windows\System32\gKMTdlm.exe
  2⤵
  PID:9772
- C:\Windows\System32\Hxyswop.exe
  C:\Windows\System32\Hxyswop.exe
  2⤵
  PID:9284
- C:\Windows\System32\NVLjmte.exe
  C:\Windows\System32\NVLjmte.exe
  2⤵
  PID:9420
- C:\Windows\System32\rIEaBFM.exe
  C:\Windows\System32\rIEaBFM.exe
  2⤵
  PID:10068
- C:\Windows\System32\pWZOoUt.exe
  C:\Windows\System32\pWZOoUt.exe
  2⤵
  PID:9812
- C:\Windows\System32\jyfVTOX.exe
  C:\Windows\System32\jyfVTOX.exe
  2⤵
  PID:10128
- C:\Windows\System32\RFIquXS.exe
  C:\Windows\System32\RFIquXS.exe
  2⤵
  PID:220
- C:\Windows\System32\THGfiNj.exe
  C:\Windows\System32\THGfiNj.exe
  2⤵
  PID:10276
- C:\Windows\System32\MnbhtKW.exe
  C:\Windows\System32\MnbhtKW.exe
  2⤵
  PID:10292
- C:\Windows\System32\QgUDpGV.exe
  C:\Windows\System32\QgUDpGV.exe
  2⤵
  PID:10308
- C:\Windows\System32\naebZbh.exe
  C:\Windows\System32\naebZbh.exe
  2⤵
  PID:10340
- C:\Windows\System32\WnDyCqL.exe
  C:\Windows\System32\WnDyCqL.exe
  2⤵
  PID:10380
- C:\Windows\System32\yNZaJNX.exe
  C:\Windows\System32\yNZaJNX.exe
  2⤵
  PID:10396
- C:\Windows\System32\MWtMfKO.exe
  C:\Windows\System32\MWtMfKO.exe
  2⤵
  PID:10424
- C:\Windows\System32\wrkytjn.exe
  C:\Windows\System32\wrkytjn.exe
  2⤵
  PID:10468
- C:\Windows\System32\CqZxlDz.exe
  C:\Windows\System32\CqZxlDz.exe
  2⤵
  PID:10500
- C:\Windows\System32\vWrCYye.exe
  C:\Windows\System32\vWrCYye.exe
  2⤵
  PID:10520
- C:\Windows\System32\GzhEOYg.exe
  C:\Windows\System32\GzhEOYg.exe
  2⤵
  PID:10536
- C:\Windows\System32\RpGMxWh.exe
  C:\Windows\System32\RpGMxWh.exe
  2⤵
  PID:10592
- C:\Windows\System32\oaGVeyn.exe
  C:\Windows\System32\oaGVeyn.exe
  2⤵
  PID:10632
- C:\Windows\System32\XgjqVil.exe
  C:\Windows\System32\XgjqVil.exe
  2⤵
  PID:10648
- C:\Windows\System32\OrnvHtd.exe
  C:\Windows\System32\OrnvHtd.exe
  2⤵
  PID:10668
- C:\Windows\System32\tvsaPoe.exe
  C:\Windows\System32\tvsaPoe.exe
  2⤵
  PID:10712
- C:\Windows\System32\AGLIgOd.exe
  C:\Windows\System32\AGLIgOd.exe
  2⤵
  PID:10736
- C:\Windows\System32\npqVjUo.exe
  C:\Windows\System32\npqVjUo.exe
  2⤵
  PID:10768
- C:\Windows\System32\vydXzKZ.exe
  C:\Windows\System32\vydXzKZ.exe
  2⤵
  PID:10784
- C:\Windows\System32\tbHXBCW.exe
  C:\Windows\System32\tbHXBCW.exe
  2⤵
  PID:10804
- C:\Windows\System32\PTsQQWA.exe
  C:\Windows\System32\PTsQQWA.exe
  2⤵
  PID:10840
- C:\Windows\System32\OHcxBdD.exe
  C:\Windows\System32\OHcxBdD.exe
  2⤵
  PID:10884
- C:\Windows\System32\YoZfYNd.exe
  C:\Windows\System32\YoZfYNd.exe
  2⤵
  PID:10924
- C:\Windows\System32\WMwrpaM.exe
  C:\Windows\System32\WMwrpaM.exe
  2⤵
  PID:10964
- C:\Windows\System32\wmmQHVD.exe
  C:\Windows\System32\wmmQHVD.exe
  2⤵
  PID:10988
- C:\Windows\System32\nQgNlVp.exe
  C:\Windows\System32\nQgNlVp.exe
  2⤵
  PID:11004
- C:\Windows\System32\HrUejic.exe
  C:\Windows\System32\HrUejic.exe
  2⤵
  PID:11028
- C:\Windows\System32\eUxEFUZ.exe
  C:\Windows\System32\eUxEFUZ.exe
  2⤵
  PID:11056
- C:\Windows\System32\eBlQaZU.exe
  C:\Windows\System32\eBlQaZU.exe
  2⤵
  PID:11080
- C:\Windows\System32\utRrdYA.exe
  C:\Windows\System32\utRrdYA.exe
  2⤵
  PID:11128
- C:\Windows\System32\zITeFAL.exe
  C:\Windows\System32\zITeFAL.exe
  2⤵
  PID:11184
- C:\Windows\System32\AbGrUvg.exe
  C:\Windows\System32\AbGrUvg.exe
  2⤵
  PID:11216
- C:\Windows\System32\HfZdTEL.exe
  C:\Windows\System32\HfZdTEL.exe
  2⤵
  PID:11236
- C:\Windows\System32\ykfldtU.exe
  C:\Windows\System32\ykfldtU.exe
  2⤵
  PID:9892
- C:\Windows\System32\pcrJcia.exe
  C:\Windows\System32\pcrJcia.exe
  2⤵
  PID:10040
- C:\Windows\System32\tTHMFtx.exe
  C:\Windows\System32\tTHMFtx.exe
  2⤵
  PID:10304
- C:\Windows\System32\qLrmAMV.exe
  C:\Windows\System32\qLrmAMV.exe
  2⤵
  PID:10376
- C:\Windows\System32\cPAyKZt.exe
  C:\Windows\System32\cPAyKZt.exe
  2⤵
  PID:4836
- C:\Windows\System32\wqtSZet.exe
  C:\Windows\System32\wqtSZet.exe
  2⤵
  PID:10408
- C:\Windows\System32\kONGnrk.exe
  C:\Windows\System32\kONGnrk.exe
  2⤵
  PID:10432
- C:\Windows\System32\RWmEXlX.exe
  C:\Windows\System32\RWmEXlX.exe
  2⤵
  PID:10532
- C:\Windows\System32\iQTGGLW.exe
  C:\Windows\System32\iQTGGLW.exe
  2⤵
  PID:10620
- C:\Windows\System32\ZPhfzfe.exe
  C:\Windows\System32\ZPhfzfe.exe
  2⤵
  PID:10624
- C:\Windows\System32\gBqoMbj.exe
  C:\Windows\System32\gBqoMbj.exe
  2⤵
  PID:10660
- C:\Windows\System32\yGTqenm.exe
  C:\Windows\System32\yGTqenm.exe
  2⤵
  PID:10868
- C:\Windows\System32\pmaCNKv.exe
  C:\Windows\System32\pmaCNKv.exe
  2⤵
  PID:10892
- C:\Windows\System32\UXNYpOD.exe
  C:\Windows\System32\UXNYpOD.exe
  2⤵
  PID:5040
- C:\Windows\System32\fKVAnqK.exe
  C:\Windows\System32\fKVAnqK.exe
  2⤵
  PID:10996
- C:\Windows\System32\MavMcyG.exe
  C:\Windows\System32\MavMcyG.exe
  2⤵
  PID:11156
- C:\Windows\System32\PNZjXHQ.exe
  C:\Windows\System32\PNZjXHQ.exe
  2⤵
  PID:11204
- C:\Windows\System32\FGgBNkW.exe
  C:\Windows\System32\FGgBNkW.exe
  2⤵
  PID:10488
- C:\Windows\System32\xhnTSVK.exe
  C:\Windows\System32\xhnTSVK.exe
  2⤵
  PID:10576
- C:\Windows\System32\EZmyZUl.exe
  C:\Windows\System32\EZmyZUl.exe
  2⤵
  PID:10644
- C:\Windows\System32\sJmNNIY.exe
  C:\Windows\System32\sJmNNIY.exe
  2⤵
  PID:9972
- C:\Windows\System32\lHjLKue.exe
  C:\Windows\System32\lHjLKue.exe
  2⤵
  PID:10880
- C:\Windows\System32\PtXksBK.exe
  C:\Windows\System32\PtXksBK.exe
  2⤵
  PID:10900
- C:\Windows\System32\FOCVFVo.exe
  C:\Windows\System32\FOCVFVo.exe
  2⤵
  PID:11052
- C:\Windows\System32\lpUilut.exe
  C:\Windows\System32\lpUilut.exe
  2⤵
  PID:11024
- C:\Windows\System32\ZSGAplw.exe
  C:\Windows\System32\ZSGAplw.exe
  2⤵
  PID:10268
- C:\Windows\System32\hrUhVta.exe
  C:\Windows\System32\hrUhVta.exe
  2⤵
  PID:10436
- C:\Windows\System32\JqVJRbj.exe
  C:\Windows\System32\JqVJRbj.exe
  2⤵
  PID:10732
- C:\Windows\System32\YSqazME.exe
  C:\Windows\System32\YSqazME.exe
  2⤵
  PID:11320
- C:\Windows\System32\aRzeZLj.exe
  C:\Windows\System32\aRzeZLj.exe
  2⤵
  PID:11336
- C:\Windows\System32\DnevcrY.exe
  C:\Windows\System32\DnevcrY.exe
  2⤵
  PID:11372
- C:\Windows\System32\klKXPaS.exe
  C:\Windows\System32\klKXPaS.exe
  2⤵
  PID:11392
- C:\Windows\System32\LWjvcAd.exe
  C:\Windows\System32\LWjvcAd.exe
  2⤵
  PID:11416
- C:\Windows\System32\LnmqykG.exe
  C:\Windows\System32\LnmqykG.exe
  2⤵
  PID:11440
- C:\Windows\System32\duDbUPt.exe
  C:\Windows\System32\duDbUPt.exe
  2⤵
  PID:11460
- C:\Windows\System32\scizFZr.exe
  C:\Windows\System32\scizFZr.exe
  2⤵
  PID:11516
- C:\Windows\System32\lgvWXwo.exe
  C:\Windows\System32\lgvWXwo.exe
  2⤵
  PID:11548
- C:\Windows\System32\tHtWNOL.exe
  C:\Windows\System32\tHtWNOL.exe
  2⤵
  PID:11564
- C:\Windows\System32\FapuHhM.exe
  C:\Windows\System32\FapuHhM.exe
  2⤵
  PID:11604
- C:\Windows\System32\mXKRjIQ.exe
  C:\Windows\System32\mXKRjIQ.exe
  2⤵
  PID:11628
- C:\Windows\System32\jKfiSDh.exe
  C:\Windows\System32\jKfiSDh.exe
  2⤵
  PID:11656
- C:\Windows\System32\pkAQVuK.exe
  C:\Windows\System32\pkAQVuK.exe
  2⤵
  PID:11704
- C:\Windows\System32\XIenSeZ.exe
  C:\Windows\System32\XIenSeZ.exe
  2⤵
  PID:11744
- C:\Windows\System32\dwUxuLG.exe
  C:\Windows\System32\dwUxuLG.exe
  2⤵
  PID:11764
- C:\Windows\System32\UkIybgh.exe
  C:\Windows\System32\UkIybgh.exe
  2⤵
  PID:11784
- C:\Windows\System32\XECWcrM.exe
  C:\Windows\System32\XECWcrM.exe
  2⤵
  PID:11808
- C:\Windows\System32\wROrGKu.exe
  C:\Windows\System32\wROrGKu.exe
  2⤵
  PID:11848
- C:\Windows\System32\ndnGgzI.exe
  C:\Windows\System32\ndnGgzI.exe
  2⤵
  PID:11876
- C:\Windows\System32\PllAUhC.exe
  C:\Windows\System32\PllAUhC.exe
  2⤵
  PID:11900
- C:\Windows\System32\WLgIIZI.exe
  C:\Windows\System32\WLgIIZI.exe
  2⤵
  PID:11936
- C:\Windows\System32\xKhuPPX.exe
  C:\Windows\System32\xKhuPPX.exe
  2⤵
  PID:11968
- C:\Windows\System32\xZLeTVQ.exe
  C:\Windows\System32\xZLeTVQ.exe
  2⤵
  PID:11984
- C:\Windows\System32\bsGItSL.exe
  C:\Windows\System32\bsGItSL.exe
  2⤵
  PID:12000
- C:\Windows\System32\qxwOwQF.exe
  C:\Windows\System32\qxwOwQF.exe
  2⤵
  PID:12040
- C:\Windows\System32\tbGvWne.exe
  C:\Windows\System32\tbGvWne.exe
  2⤵
  PID:12056
- C:\Windows\System32\bWYuVfu.exe
  C:\Windows\System32\bWYuVfu.exe
  2⤵
  PID:12076
- C:\Windows\System32\zRVxMoy.exe
  C:\Windows\System32\zRVxMoy.exe
  2⤵
  PID:12112
- C:\Windows\System32\ChHrGDk.exe
  C:\Windows\System32\ChHrGDk.exe
  2⤵
  PID:12148
- C:\Windows\System32\QWCeHhS.exe
  C:\Windows\System32\QWCeHhS.exe
  2⤵
  PID:12176
- C:\Windows\System32\DJYtvaJ.exe
  C:\Windows\System32\DJYtvaJ.exe
  2⤵
  PID:12196
- C:\Windows\System32\kARWcDW.exe
  C:\Windows\System32\kARWcDW.exe
  2⤵
  PID:12220
- C:\Windows\System32\IRXZucg.exe
  C:\Windows\System32\IRXZucg.exe
  2⤵
  PID:12248
- C:\Windows\System32\DGYasIu.exe
  C:\Windows\System32\DGYasIu.exe
  2⤵
  PID:12276
- C:\Windows\System32\CepuAXB.exe
  C:\Windows\System32\CepuAXB.exe
  2⤵
  PID:888
- C:\Windows\System32\iSbfyjL.exe
  C:\Windows\System32\iSbfyjL.exe
  2⤵
  PID:10132
- C:\Windows\System32\fRzOdMF.exe
  C:\Windows\System32\fRzOdMF.exe
  2⤵
  PID:11316
- C:\Windows\System32\uODwqdt.exe
  C:\Windows\System32\uODwqdt.exe
  2⤵
  PID:11368
- C:\Windows\System32\pgJbVFx.exe
  C:\Windows\System32\pgJbVFx.exe
  2⤵
  PID:11384
- C:\Windows\System32\ZlHDyeL.exe
  C:\Windows\System32\ZlHDyeL.exe
  2⤵
  PID:11612
- C:\Windows\System32\ZVAQkeJ.exe
  C:\Windows\System32\ZVAQkeJ.exe
  2⤵
  PID:11684
- C:\Windows\System32\EcMVlEI.exe
  C:\Windows\System32\EcMVlEI.exe
  2⤵
  PID:11756
- C:\Windows\System32\hSiEint.exe
  C:\Windows\System32\hSiEint.exe
  2⤵
  PID:11792
- C:\Windows\System32\RGgXEKH.exe
  C:\Windows\System32\RGgXEKH.exe
  2⤵
  PID:11796
- C:\Windows\System32\GQYngGR.exe
  C:\Windows\System32\GQYngGR.exe
  2⤵
  PID:11920
- C:\Windows\System32\wqHwVRf.exe
  C:\Windows\System32\wqHwVRf.exe
  2⤵
  PID:11996
- C:\Windows\System32\vKmsKWr.exe
  C:\Windows\System32\vKmsKWr.exe
  2⤵
  PID:12020
- C:\Windows\System32\NhJNHgZ.exe
  C:\Windows\System32\NhJNHgZ.exe
  2⤵
  PID:12068
- C:\Windows\System32\bhBkdqw.exe
  C:\Windows\System32\bhBkdqw.exe
  2⤵
  PID:12120
- C:\Windows\System32\EYuSlxs.exe
  C:\Windows\System32\EYuSlxs.exe
  2⤵
  PID:12216
- C:\Windows\System32\VHDfDNg.exe
  C:\Windows\System32\VHDfDNg.exe
  2⤵
  PID:10980
- C:\Windows\System32\TUnyJlG.exe
  C:\Windows\System32\TUnyJlG.exe
  2⤵
  PID:11388
- C:\Windows\System32\ERVNbuc.exe
  C:\Windows\System32\ERVNbuc.exe
  2⤵
  PID:11488
- C:\Windows\System32\urYJyqy.exe
  C:\Windows\System32\urYJyqy.exe
  2⤵
  PID:11636
- C:\Windows\System32\jntEGfK.exe
  C:\Windows\System32\jntEGfK.exe
  2⤵
  PID:11688
- C:\Windows\System32\CiklPNJ.exe
  C:\Windows\System32\CiklPNJ.exe
  2⤵
  PID:11724
- C:\Windows\System32\bzReTFK.exe
  C:\Windows\System32\bzReTFK.exe
  2⤵
  PID:11960
- C:\Windows\System32\auuDxQf.exe
  C:\Windows\System32\auuDxQf.exe
  2⤵
  PID:12048
- C:\Windows\System32\IxDzkEm.exe
  C:\Windows\System32\IxDzkEm.exe
  2⤵
  PID:9436
- C:\Windows\System32\EjvPgPk.exe
  C:\Windows\System32\EjvPgPk.exe
  2⤵
  PID:11580
- C:\Windows\System32\VYJZewJ.exe
  C:\Windows\System32\VYJZewJ.exe
  2⤵
  PID:11672
- C:\Windows\System32\NDzFWhV.exe
  C:\Windows\System32\NDzFWhV.exe
  2⤵
  PID:12012
- C:\Windows\System32\OnudmPX.exe
  C:\Windows\System32\OnudmPX.exe
  2⤵
  PID:12064
- C:\Windows\System32\dzAzWqR.exe
  C:\Windows\System32\dzAzWqR.exe
  2⤵
  PID:12204
- C:\Windows\System32\dPovCtW.exe
  C:\Windows\System32\dPovCtW.exe
  2⤵
  PID:12304
- C:\Windows\System32\AOwmKCv.exe
  C:\Windows\System32\AOwmKCv.exe
  2⤵
  PID:12336
- C:\Windows\System32\dtLmaba.exe
  C:\Windows\System32\dtLmaba.exe
  2⤵
  PID:12352
- C:\Windows\System32\zcetunU.exe
  C:\Windows\System32\zcetunU.exe
  2⤵
  PID:12372
- C:\Windows\System32\ElbCyRk.exe
  C:\Windows\System32\ElbCyRk.exe
  2⤵
  PID:12428
- C:\Windows\System32\XQWuOPV.exe
  C:\Windows\System32\XQWuOPV.exe
  2⤵
  PID:12448
- C:\Windows\System32\NRPBQLA.exe
  C:\Windows\System32\NRPBQLA.exe
  2⤵
  PID:12464
- C:\Windows\System32\vDysdCS.exe
  C:\Windows\System32\vDysdCS.exe
  2⤵
  PID:12496
- C:\Windows\System32\TRzvSng.exe
  C:\Windows\System32\TRzvSng.exe
  2⤵
  PID:12520
- C:\Windows\System32\oNCjSFX.exe
  C:\Windows\System32\oNCjSFX.exe
  2⤵
  PID:12548
- C:\Windows\System32\yDBIIxF.exe
  C:\Windows\System32\yDBIIxF.exe
  2⤵
  PID:12576
- C:\Windows\System32\zpMZXlQ.exe
  C:\Windows\System32\zpMZXlQ.exe
  2⤵
  PID:12596
- C:\Windows\System32\PRqsMnK.exe
  C:\Windows\System32\PRqsMnK.exe
  2⤵
  PID:12612
- C:\Windows\System32\xGERreX.exe
  C:\Windows\System32\xGERreX.exe
  2⤵
  PID:12660
- C:\Windows\System32\gRpdqWi.exe
  C:\Windows\System32\gRpdqWi.exe
  2⤵
  PID:12688
- C:\Windows\System32\YZlXiRy.exe
  C:\Windows\System32\YZlXiRy.exe
  2⤵
  PID:12724
- C:\Windows\System32\Qbqgjhn.exe
  C:\Windows\System32\Qbqgjhn.exe
  2⤵
  PID:12748
- C:\Windows\System32\LbGhLWV.exe
  C:\Windows\System32\LbGhLWV.exe
  2⤵
  PID:12776
- C:\Windows\System32\OnfTyXo.exe
  C:\Windows\System32\OnfTyXo.exe
  2⤵
  PID:12800
- C:\Windows\System32\wjijPTA.exe
  C:\Windows\System32\wjijPTA.exe
  2⤵
  PID:12828
- C:\Windows\System32\VwHjWDx.exe
  C:\Windows\System32\VwHjWDx.exe
  2⤵
  PID:12872
- C:\Windows\System32\DrBoIng.exe
  C:\Windows\System32\DrBoIng.exe
  2⤵
  PID:12904
- C:\Windows\System32\CPqxXKr.exe
  C:\Windows\System32\CPqxXKr.exe
  2⤵
  PID:12932
- C:\Windows\System32\qOXFmto.exe
  C:\Windows\System32\qOXFmto.exe
  2⤵
  PID:12956
- C:\Windows\System32\BoQZXXE.exe
  C:\Windows\System32\BoQZXXE.exe
  2⤵
  PID:12976
- C:\Windows\System32\TSPsott.exe
  C:\Windows\System32\TSPsott.exe
  2⤵
  PID:13012
- C:\Windows\System32\eYzoBaM.exe
  C:\Windows\System32\eYzoBaM.exe
  2⤵
  PID:13036
- C:\Windows\System32\cPdwicy.exe
  C:\Windows\System32\cPdwicy.exe
  2⤵
  PID:13052
- C:\Windows\System32\MICUKPO.exe
  C:\Windows\System32\MICUKPO.exe
  2⤵
  PID:13112
- C:\Windows\System32\XTuwsTK.exe
  C:\Windows\System32\XTuwsTK.exe
  2⤵
  PID:13132
- C:\Windows\System32\foLsces.exe
  C:\Windows\System32\foLsces.exe
  2⤵
  PID:13148
- C:\Windows\System32\FeMpEsl.exe
  C:\Windows\System32\FeMpEsl.exe
  2⤵
  PID:13184
- C:\Windows\System32\GvZbuIp.exe
  C:\Windows\System32\GvZbuIp.exe
  2⤵
  PID:13204
- C:\Windows\System32\pJKdQoG.exe
  C:\Windows\System32\pJKdQoG.exe
  2⤵
  PID:13232
- C:\Windows\System32\BHczzam.exe
  C:\Windows\System32\BHczzam.exe
  2⤵
  PID:13248
- C:\Windows\System32\aXYkBKp.exe
  C:\Windows\System32\aXYkBKp.exe
  2⤵
  PID:13288
- C:\Windows\System32\wNeZyIv.exe
  C:\Windows\System32\wNeZyIv.exe
  2⤵
  PID:11596
- C:\Windows\System32\JsxqAEJ.exe
  C:\Windows\System32\JsxqAEJ.exe
  2⤵
  PID:12332
- C:\Windows\System32\ruaKLzD.exe
  C:\Windows\System32\ruaKLzD.exe
  2⤵
  PID:12412
- C:\Windows\System32\ssJJvoe.exe
  C:\Windows\System32\ssJJvoe.exe
  2⤵
  PID:12440
- C:\Windows\System32\XbZhnDW.exe
  C:\Windows\System32\XbZhnDW.exe
  2⤵
  PID:12476
- C:\Windows\System32\eZHpJrt.exe
  C:\Windows\System32\eZHpJrt.exe
  2⤵
  PID:12508
- C:\Windows\System32\ldQmEMi.exe
  C:\Windows\System32\ldQmEMi.exe
  2⤵
  PID:12568
- C:\Windows\System32\TFPkMGT.exe
  C:\Windows\System32\TFPkMGT.exe
  2⤵
  PID:12684
- C:\Windows\System32\JRGIOgq.exe
  C:\Windows\System32\JRGIOgq.exe
  2⤵
  PID:12760
- C:\Windows\System32\dsKAkTw.exe
  C:\Windows\System32\dsKAkTw.exe
  2⤵
  PID:12844
- C:\Windows\System32\pZxfKVz.exe
  C:\Windows\System32\pZxfKVz.exe
  2⤵
  PID:12916
- C:\Windows\System32\dfcdybp.exe
  C:\Windows\System32\dfcdybp.exe
  2⤵
  PID:12984
- C:\Windows\System32\PZKQPyF.exe
  C:\Windows\System32\PZKQPyF.exe
  2⤵
  PID:4000
- C:\Windows\System32\QqfxTOH.exe
  C:\Windows\System32\QqfxTOH.exe
  2⤵
  PID:13168
- C:\Windows\System32\ztkKFHB.exe
  C:\Windows\System32\ztkKFHB.exe
  2⤵
  PID:13220
- C:\Windows\System32\AlDjiKk.exe
  C:\Windows\System32\AlDjiKk.exe
  2⤵
  PID:13296
- C:\Windows\System32\VwOKZvc.exe
  C:\Windows\System32\VwOKZvc.exe
  2⤵
  PID:13304
- C:\Windows\System32\nPKmIbf.exe
  C:\Windows\System32\nPKmIbf.exe
  2⤵
  PID:12404
- C:\Windows\System32\plIgUqK.exe
  C:\Windows\System32\plIgUqK.exe
  2⤵
  PID:12564
- C:\Windows\System32\rQFXGmD.exe
  C:\Windows\System32\rQFXGmD.exe
  2⤵
  PID:12488
- C:\Windows\System32\XZsgLEN.exe
  C:\Windows\System32\XZsgLEN.exe
  2⤵
  PID:12912
- C:\Windows\System32\HLxjgOJ.exe
  C:\Windows\System32\HLxjgOJ.exe
  2⤵
  PID:13072
- C:\Windows\System32\rnhVCiE.exe
  C:\Windows\System32\rnhVCiE.exe
  2⤵
  PID:13144
- C:\Windows\System32\DijLZNO.exe
  C:\Windows\System32\DijLZNO.exe
  2⤵
  PID:11896
- C:\Windows\System32\gbUglFv.exe
  C:\Windows\System32\gbUglFv.exe
  2⤵
  PID:12408
- C:\Windows\System32\iJnojRX.exe
  C:\Windows\System32\iJnojRX.exe
  2⤵
  PID:12504
- C:\Windows\System32\dhviMil.exe
  C:\Windows\System32\dhviMil.exe
  2⤵
  PID:12964
- C:\Windows\System32\RnEhKqf.exe
  C:\Windows\System32\RnEhKqf.exe
  2⤵
  PID:12808
- C:\Windows\System32\liWiNkp.exe
  C:\Windows\System32\liWiNkp.exe
  2⤵
  PID:13324
- C:\Windows\System32\nBGaoaQ.exe
  C:\Windows\System32\nBGaoaQ.exe
  2⤵
  PID:13364
- C:\Windows\System32\bXGxlvF.exe
  C:\Windows\System32\bXGxlvF.exe
  2⤵
  PID:13380
- C:\Windows\System32\DveCLBv.exe
  C:\Windows\System32\DveCLBv.exe
  2⤵
  PID:13400
- C:\Windows\System32\FUXvkdB.exe
  C:\Windows\System32\FUXvkdB.exe
  2⤵
  PID:13472
- C:\Windows\System32\hhboqSQ.exe
  C:\Windows\System32\hhboqSQ.exe
  2⤵
  PID:13496
- C:\Windows\System32\wORAYee.exe
  C:\Windows\System32\wORAYee.exe
  2⤵
  PID:13524
- C:\Windows\System32\QesCYpO.exe
  C:\Windows\System32\QesCYpO.exe
  2⤵
  PID:13544
- C:\Windows\System32\RabYOvo.exe
  C:\Windows\System32\RabYOvo.exe
  2⤵
  PID:13572
- C:\Windows\System32\ykLmBrT.exe
  C:\Windows\System32\ykLmBrT.exe
  2⤵
  PID:13596
- C:\Windows\System32\awaabLK.exe
  C:\Windows\System32\awaabLK.exe
  2⤵
  PID:13620
- C:\Windows\System32\tuQUfei.exe
  C:\Windows\System32\tuQUfei.exe
  2⤵
  PID:13640
- C:\Windows\System32\wCsGhZw.exe
  C:\Windows\System32\wCsGhZw.exe
  2⤵
  PID:13696
- C:\Windows\System32\ghUqZmG.exe
  C:\Windows\System32\ghUqZmG.exe
  2⤵
  PID:13716
- C:\Windows\System32\WHBbbHE.exe
  C:\Windows\System32\WHBbbHE.exe
  2⤵
  PID:13740
- C:\Windows\System32\LlWltIM.exe
  C:\Windows\System32\LlWltIM.exe
  2⤵
  PID:13772
- C:\Windows\System32\OYUFNvm.exe
  C:\Windows\System32\OYUFNvm.exe
  2⤵
  PID:13812
- C:\Windows\System32\LBDUfsR.exe
  C:\Windows\System32\LBDUfsR.exe
  2⤵
  PID:13828
- C:\Windows\System32\mCujnkT.exe
  C:\Windows\System32\mCujnkT.exe
  2⤵
  PID:13848
- C:\Windows\System32\FDBUewC.exe
  C:\Windows\System32\FDBUewC.exe
  2⤵
  PID:13872
- C:\Windows\System32\ZVqrFrE.exe
  C:\Windows\System32\ZVqrFrE.exe
  2⤵
  PID:13900
- C:\Windows\System32\suiFIAY.exe
  C:\Windows\System32\suiFIAY.exe
  2⤵
  PID:13916
- C:\Windows\System32\xKUSTRD.exe
  C:\Windows\System32\xKUSTRD.exe
  2⤵
  PID:13944
- C:\Windows\System32\okoPvuE.exe
  C:\Windows\System32\okoPvuE.exe
  2⤵
  PID:13964
- C:\Windows\System32\MFOuwXk.exe
  C:\Windows\System32\MFOuwXk.exe
  2⤵
  PID:13988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1416,i,11708048364682646792,608099842549576907,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:8
1⤵
PID:6800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\BYekjxD.exe

Filesize
1.6MB

MD5
5c700da7694bdfe4330e6c09c463b02e

SHA1
606f7e693818e2a98049c9b38958866ad52484b3

SHA256
400869a8fc509523b282ad977da82701724ad3508005ba38b6ed965303d9881e

SHA512
98648efa53152d984282044e2e7503eb7f7e9ad34643643c83638283438a5a9f5d4db1e62eff3b7135835f9247ee93019e3d63e94f790122b96d3ef67c736531

Download Submit
C:\Windows\System32\CCUKPgP.exe

Filesize
1.6MB

MD5
7d6fdc7aa8d51c793f993c3be26b4ab9

SHA1
72f0f2f3fad606d830ee5b1e9dd1f4d8ea2cffa5

SHA256
d635ab7d8c17ddd6024f35d0e1583356cce813376d2636724234825d98b04c75

SHA512
398c742c8228fde8042403728f55ed2026eef2d362f35df38d773dc7303d560a6c7e960d4bf560d2d032597d64c96e980cf47a24deafab633496a80e4f6f1e67

Download Submit
C:\Windows\System32\CEKEmVP.exe

Filesize
1.6MB

MD5
c4c5ae8310d331bdcb2631fdaf25f669

SHA1
a2764f3dbdcdeab934fd762b93712940bc4ba322

SHA256
55996db28adca59d871864a69b55e1952f1083a129aa8778d152a2e26f264f7a

SHA512
e01f6f5884d43a77b3e6e741919afa4486312224c7da7e4f3b78517a2c825e5944d3a49694015e649bb72891976ee7e70802e35508e4c06fe8a320d967b53ca2

Download Submit
C:\Windows\System32\DZSVmFH.exe

Filesize
1.6MB

MD5
a906d9d19db8493ed88647b1102bba76

SHA1
47e7c18f3121f98ecdf0a0b6a75bc7deb0e3ca9b

SHA256
1f096ce495bd13c9f049ecb2adf36b29c54c487c51069c534ac208d718a999fc

SHA512
1af4abd6e75a4bba3323f84ffc9b075a6432da93d2630fa1b46f954d99e4539d5c5e74301e83d20976f20bf3322ca32fb1b8fbe3b9cfcac0ea3501de7493a28b

Download Submit
C:\Windows\System32\EUmKOlS.exe

Filesize
1.6MB

MD5
5ced2882a1e68a3e6fb8645b9dc5cdb8

SHA1
fce76799b4df63aad59dd45e9db9cc44b95730ba

SHA256
01a5db9dfbf0a95a760b318942314d349267d1e908d076c837bfb5ab378690c6

SHA512
b76ad3bae6ec7acb263b93782d34a1e36656f257d45eac3c0a8ae7afdc78c5d1d37703c987d551b34ab9d00ea21f7ae51566f0d6122d2268037c3a0d5ea91d2f

Download Submit
C:\Windows\System32\EVhWgKT.exe

Filesize
1.6MB

MD5
4db4b61941f1512a6b36ea464ce772ee

SHA1
2b37ea915da75667622c22907f199c2126de7e7f

SHA256
d5823adca43d43ea2d0b7c3b490a41583a7ab5a872cff61184749031662cfa5a

SHA512
5c98b6d58837587f6ccdc76fc58772f29143f7e2ea5501013dfd25f144177c08c468b5b5a43b22d0298a75a6618ad0d66ecd000a91d952e590bbc3fc1b69f93c

Download Submit
C:\Windows\System32\EiQObON.exe

Filesize
1.6MB

MD5
8cd6b262032e5a01fd3c57ab3ce4634c

SHA1
01a9e34c4672e285960ea0bcab1e4c451e9838ad

SHA256
80756cdeaf2e7b2afee274626c35399554c443c9c8fd51428afac2a6354985d4

SHA512
8af6e6ecd3bd0efcc1644ec810a66ad2250ca02cce71d69333695a4f4d2715ac2e43e5b2e4a4c6251ab62969f3d12a3eacd67809367b5f1f00c38fe12aea4a36

Download Submit
C:\Windows\System32\FrzajhX.exe

Filesize
1.6MB

MD5
af5f95d921c5535370d49937f30a87b3

SHA1
c4e2e6553897ac7f0e2af9c77ea444c3dba14cfe

SHA256
2c9282faa8d27744bacf74079039b4768ade60405cc5d9c792447573b4fa6add

SHA512
750d8df8582cbde08bc0cfd67bab12ce49ff5293a5addb22cbe1e69ffa5dd3fd561905e09aeb37b9ece4bcb0a67006a0bec5add2373a16f9e6b56b1a09a958ae

Download Submit
C:\Windows\System32\MBLuGHX.exe

Filesize
1.6MB

MD5
a1c9a5f24923860bc71cd88fa46ad1da

SHA1
c2dccfa94534ef3339bb2697726e24def980e62e

SHA256
880bbf0bf866f000060ee5ba7c18e9a93a99236edce9099944503cf007762264

SHA512
c477486cba87c93c3720fa79281bd7e8c35f73ac249868ba7af96d7b0acd321c1dd4602bf9527b1cba55b7ecbd658a64882c5ca8a5dbb2a74e8cf247e07bf8ea

Download Submit
C:\Windows\System32\NrvPPhq.exe

Filesize
1.6MB

MD5
6ff55df7a98a112765df9afee1d8cbee

SHA1
5694cb05c0f38643b7d61b2a62f769f8fffbd507

SHA256
6e9b47eaf1bc256b114fd5056b920e0bf117d5c193242026ef696a020b0a823a

SHA512
6d6f55233098b92c13e26c7c83d2ecc4c93d61b4460c974e4543a687c47a22cf98b3fa99325b09f0b9d00ed5614c94f8c217e473bbfb5f790363b66587c4bf81

Download Submit
C:\Windows\System32\QXlnPdR.exe

Filesize
1.6MB

MD5
2a0e4ee75f0d635d457159e85b6b385d

SHA1
f187cdd71afa6fe895589f186355ef50816705b0

SHA256
6fa72b96c8f539857117bbfe1794d9c6bb7ae1a4dee338411d42f7f62b9d08b2

SHA512
cc2100070f806550ba371ee27de850de14061ccf3cd27a8f9401d51929d97b0447063f8047cef1496ace72784f513cc64ddeec9c469742ae93f96754360e08e6

Download Submit
C:\Windows\System32\TVNzPQI.exe

Filesize
1.6MB

MD5
2c53761a366284a10708aeb2f25bc94c

SHA1
8ab0dde3def1daf7766fa6bf0b567ce86a3897bc

SHA256
f8422f34a189b8179df90c371d07603d8ec3692c49246b58d34c515c1272a0ea

SHA512
26c91af443c98cf69d190c58cd5b70970b5fd48f82c3f18d63c704dee3cf3427ee9c350a4bdbf21222b50cc90d6bd4256aac024c8886f58afdca6b96c3aed57f

Download Submit
C:\Windows\System32\WrOAAaX.exe

Filesize
1.6MB

MD5
55ffe27ebb4ce7c0a864b15a29233f29

SHA1
8afa34eb5989275fa10bb56c76ddcb8a10d3b6b1

SHA256
7769234835e931c0c229dca689b089aed3047f6f149466a5e85b5f70de206cbd

SHA512
3d7adf22cfa1eb278717637a940a21dd4d8fa865328a4927c1e0ed2d02f1f51eded50c84d4a68ad0d01f58c53d2a912b9e5a7712ffa299d53255397d7dc14c58

Download Submit
C:\Windows\System32\YFmndcK.exe

Filesize
1.6MB

MD5
4b788bde00f2cdda39b88174c06284a7

SHA1
23d37e05426d154fcb29fcce1c8dd555779de2bf

SHA256
e7cf8e6848adb56fcc2e3737d9b9586fda8e1a9030561e698f79b78ffe78050b

SHA512
fc80d2fac5be898d97088d20f52b5ba0fe58d4acf4ec74723c206a367b93fb86d930ef6741bdf124ca861e2c0bb9f265832f0410d91b6a00b830864506a65533

Download Submit
C:\Windows\System32\ZolIPVE.exe

Filesize
1.6MB

MD5
c0a6ef2552c4e639129b2a6a20a69bfc

SHA1
30ed31e1659dc4fb9a2355e3249c1b70be470356

SHA256
efbc96451f7c0099ab140e15823fad6e91fcf29b4f820e4ca1a86ffff1e6c6e4

SHA512
b20ead603e4422fad10b685fb88f447859e3545f10baf6693ff45d6e34ce6260244c55f26278bfae9f846a2addba5af518c32836c4f51b795ade3e84628a4371

Download Submit
C:\Windows\System32\ZvfUFlZ.exe

Filesize
1.6MB

MD5
df6402974a9494de5fad8e457d01e18e

SHA1
9631f430f04f8917f302de91fddbb372c0d9c0f7

SHA256
fd8154133ed89f6bfe6960a38e83eb3bb1cd22bebe38935b0e796fa314e7eeea

SHA512
dcadabd257ca3155df3a81c052cf87bc81988d210dd220c30a15f3fe8f37ee901fffa727696e4801aa91aee5ea03c57c585e9aa4c637b6366974380b3c1fbbff

Download Submit
C:\Windows\System32\aLFwChT.exe

Filesize
1.6MB

MD5
b8ba74daaeede6e4f8e37260bb7cafef

SHA1
37bab0d52b8a13344e3c2a754d31124eeebf23c6

SHA256
fd3d58a5ed11b1af12549eab1c9c06025f0fa38947e1293404a5ec3d93d5c66b

SHA512
43af164ba2997b2010c6bcf1799f63e7488bb7a267032788d8b0fecd942a6ecf95290d4054d42ba4f6f51acc99b0f6650fda5936ba57e96393613faea1b17c4b

Download Submit
C:\Windows\System32\aPyczeK.exe

Filesize
1.6MB

MD5
5e65a2df40bd37fc32f0a73bc0c16cc0

SHA1
93b64de7075664af31cd96cad1965f3e54251819

SHA256
5a3a8ae6c0543e601e3f4ce92d13a5d0dc85fddeb2d552255e08991bc6f84d79

SHA512
235af1f5f87fa81e328d566bcae3372f46108f04d25d56456a8acb441fe4f5f381a652e99e1e40ef562515d7446c79edd7cc36919b19c889fe4e80184899c8ce

Download Submit
C:\Windows\System32\bnJNYNB.exe

Filesize
1.6MB

MD5
413ac47337d282634f4eacc21a1a7946

SHA1
e2d7370804f878c5c27b934e7adf505c04383de7

SHA256
155cfc6be3b555fc1f82407b70c3f764c3518512c570a0a0514214a10fdb6c74

SHA512
7f9bfe067f03bf1062e6eba5742c0ec61b41c7368499bdfa8b60b78c40cde5f7fb5ad9faee215e641a32892ae1426829a9587f48c6dc50d2ddbeba866b361095

Download Submit
C:\Windows\System32\cKNPKqm.exe

Filesize
1.6MB

MD5
13cc13c6119a97ba349170347eab061b

SHA1
1e35a805befaf57e3470fff085082efa09c08160

SHA256
a52202c5e7ed532e7f33f60fe7f5a23d4e7aed412f46a614bf949e2b7fb86226

SHA512
b5e57d3c569ac528d402bc559f38bc4a12cf83cfbee8148d951098cfcbb108f59b3744581ce3f0b07054222572fa82ff896f30a2e57c463605e6137efaf7aa66

Download Submit
C:\Windows\System32\daaslWe.exe

Filesize
1.6MB

MD5
762d96fc900034b4ec2dc608c15bbca6

SHA1
b7c87c23c1da8d4967c0033859d948d8e978a225

SHA256
82b69d86d972b5f87fe13dac4fd5c8e4583e0e7a989c7cefe6731530bd39c036

SHA512
6a8d5a008522bdf642b71a618d5cc43ca51e87e247879b93a343922436cd99b6b0c68cd5ef387ea2167f59a5b3adf47f8bf244776bae55effca9544b3a2a778b

Download Submit
C:\Windows\System32\dhQwoGs.exe

Filesize
1.6MB

MD5
6ab083022896a4907c45ba26fa60168d

SHA1
be2dbcce8edf7d8616f3fe02d93c9b6bce1abec6

SHA256
f3a3180036cf172fc64d740830859ee1dacda2cc07e6e0d1481afdbe3556e510

SHA512
8b0c516374686ec5fd71a0e35e476083ab7e6e16aafd2ccd9ecc2f537823e79d5a50b331f537be6bba0192349743ef2f90f540748842fbe73af77c50ba8cac86

Download Submit
C:\Windows\System32\ejnToLT.exe

Filesize
1.6MB

MD5
a2bb0d28cf809cd27c5561ab7a871b78

SHA1
1978760f56a64bcdf521ad39c7791687afefb56c

SHA256
1eb89789333ee85c0465da708d15f787925bb46aee32f35288df253703b8e411

SHA512
9cdb021aebd60eef999790a923431e8746bcc695aaf8f1ceb5283f76415c8cb5e812479f040e9a11b0284785b241efa4b75d30032cd9f97da5f8fae0172f8b70

Download Submit
C:\Windows\System32\haOiJSi.exe

Filesize
1.6MB

MD5
26084a53e5cf150e4610df020890076c

SHA1
14dcf76a6753fbe9dfe3265c20be78b317892eb7

SHA256
036413fa3deea35122021cf94186f4a68ffdd6d4c582d199d9125afcc12da8a8

SHA512
2bf9f7ca1e8edc2376f219fe8cb2063183bac6bfc15b8338de59422a850ca27c13a86b95fade70b18c393376483d3726bab97a6c5b469e724c504371b9d14dcf

Download Submit
C:\Windows\System32\ljGHDab.exe

Filesize
1.6MB

MD5
d8ee0419864c5e77d3ec8a3494bec0bb

SHA1
9c0c0be9e7177efe240ec11eef5c6164cc2efa84

SHA256
121bca8bfa6c33f122e62a02c2b59a50104b41de56263ad1910b1b3f08fc6b36

SHA512
c26c3f1070108f75bf27ec64335d96ee0bb5a0551fb8219fe65596c84b2b6cfcafe37aef66d362dae1c5f9dd7cef71b58aa7267565324e2741270829a9bd3ace

Download Submit
C:\Windows\System32\ogNvVuM.exe

Filesize
1.6MB

MD5
b0e8df5af6810284cfd22e061d4de719

SHA1
650d5260e092fb1167f12a301e69fd9e396ee66b

SHA256
c999e38672e5f29840fda5feb6aa5228547c6f946853261115c0768f4b781a2f

SHA512
71bd38683d8c4a08e6c910aa61fb022ae300a2f3f45b2d6182468c28500bd455d17027d20ef7021d68cc5b111919374ba3c738bb707856effebbc8b7c01c4293

Download Submit
C:\Windows\System32\ozGoreM.exe

Filesize
1.6MB

MD5
a103aa83e6d237beba616d073f15ab01

SHA1
8c4a09849a2181bfe60d8e07c442de906598ce4a

SHA256
a1f4085c5c7753303279e8345b9b884da3b992143b5a7bf2cbe7df43a20643c6

SHA512
e7a7a2c17f757b11714b529c4adeea44ad90dba2d5dc71455bb238c9d3dfa568b597846323f2f3676bd623047b4853a05edd64c9191ce9f60c40573d4ce96aac

Download Submit
C:\Windows\System32\pjDZVFv.exe

Filesize
1.6MB

MD5
4d08c0f8a99e9ccef38cc12ccfd3767a

SHA1
2901be35483bbaab8d805911cb9ffbee924d7d2f

SHA256
c360d91e76df1889fd555a33d3ebd4ba93bdffecd58951eb88aeeee04f3cac41

SHA512
7f20792150e3942b5b8d532a2b845baa2a205b9960162dcf25403f060192a5766fb943da521bf583bb72e76141b39e503d8e401172692aa4b55e5e13fd853fee

Download Submit
C:\Windows\System32\rQVwACu.exe

Filesize
1.6MB

MD5
e3b5cdf68b2c2bf124e291c2992b8ad5

SHA1
23185c532dd5edfd762768b50eac06ed7c1458cd

SHA256
a2e786780bca9b7cd804ccf33bbc1d43c8f0565b40789686191e25f19417f5e4

SHA512
b94ace8462dee91f3168c1c8a46bcc3fc18b1523103656d117aead33e1e02d74e60c95838be295a83d9c7d80e7610b985cd85b86a6dddb4a8b338810525c691e

Download Submit
C:\Windows\System32\rZFyKEt.exe

Filesize
1.6MB

MD5
332c5d7eebbe9aef4b0d11bbab7b8827

SHA1
b06846a16f14ae2fbf77bbb0029c5e3c79fc53a3

SHA256
0c599a460aeaca3f1481bf911142f9b5140bcb8908daceb0217d10d16aa3c645

SHA512
eaaf66c58c8d7b38cc590d9ac547ba2e1f20bc5341ff20a77e5e16d3837e371f284bd3e529d34f2d0ef8333d4a61027a9812a6e5fa9a23476f7f3445249ee76a

Download Submit
C:\Windows\System32\rmUgEpR.exe

Filesize
1.6MB

MD5
d00bbf137d4ac3d8e375dafdd4df1980

SHA1
3f46c9a28d16c2d2bd3a9ee38b504bf4d51957a0

SHA256
d9bc871432cefd906b0ecd1bdf467f96c341b5f4cb4c71fc2cf43ce94bd9677e

SHA512
2b3c5f8fde6abc681b771b899ca10b3dc2bb40bb04ba7acc139b781a18ea5b4634c192e5ca0259897103428155986de9512a3446f01e02b0c570f4dbeeb2ffcd

Download Submit
C:\Windows\System32\tJIcMpn.exe

Filesize
1.6MB

MD5
a9fec17aabd4bcefc438d409c3547335

SHA1
929883ae8a5d3c8915cf3a064e358bd3800e80f7

SHA256
888af0123b860d90b0c6d8ed6398debe9e0eef4d1cbf1971dead2d55cae9cd37

SHA512
2b2d57293f2e1344a990834e61fb4e6e4f4e92535fab788fd9063815bc4b7e825f9271bef65bbed8b05beface4f9d1604d77101f5d581df6525cc61a1ca3df74

Download Submit
C:\Windows\System32\zYDiAwt.exe

Filesize
1.6MB

MD5
29451ff7d1ce7f316f986281b3aac12e

SHA1
bcd90c825e78bfce358046cc9a8067a040afc2bc

SHA256
84ebeccdefadc00f1a0885ae5813ebc4c008c407da12902f4ddad3e3ab8f9f15

SHA512
7767d1098063f0af1d47c59140a752dfa315e7910cad503ea5cdd9e9ae1fa3b66699ec4fb12f608670e9db016f60e4f4341fa731b20129c89e2fb89ceea5f853

Download Submit
memory/632-2077-0x00007FF72BB00000-0x00007FF72BEF1000-memory.dmp

Filesize
3.9MB

Download
memory/632-474-0x00007FF72BB00000-0x00007FF72BEF1000-memory.dmp

Filesize
3.9MB

Download
memory/784-2111-0x00007FF7CBD40000-0x00007FF7CC131000-memory.dmp

Filesize
3.9MB

Download
memory/784-477-0x00007FF7CBD40000-0x00007FF7CC131000-memory.dmp

Filesize
3.9MB

Download
memory/1116-479-0x00007FF7530F0000-0x00007FF7534E1000-memory.dmp

Filesize
3.9MB

Download
memory/1116-2117-0x00007FF7530F0000-0x00007FF7534E1000-memory.dmp

Filesize
3.9MB

Download
memory/1600-2133-0x00007FF633830000-0x00007FF633C21000-memory.dmp

Filesize
3.9MB

Download
memory/1600-500-0x00007FF633830000-0x00007FF633C21000-memory.dmp

Filesize
3.9MB

Download
memory/1604-2123-0x00007FF6D45B0000-0x00007FF6D49A1000-memory.dmp

Filesize
3.9MB

Download
memory/1604-483-0x00007FF6D45B0000-0x00007FF6D49A1000-memory.dmp

Filesize
3.9MB

Download
memory/2120-2139-0x00007FF79BFE0000-0x00007FF79C3D1000-memory.dmp

Filesize
3.9MB

Download
memory/2120-512-0x00007FF79BFE0000-0x00007FF79C3D1000-memory.dmp

Filesize
3.9MB

Download
memory/2124-11-0x00007FF6A0920000-0x00007FF6A0D11000-memory.dmp

Filesize
3.9MB

Download
memory/2124-1223-0x00007FF6A0920000-0x00007FF6A0D11000-memory.dmp

Filesize
3.9MB

Download
memory/2464-30-0x00007FF719A30000-0x00007FF719E21000-memory.dmp

Filesize
3.9MB

Download
memory/2464-1298-0x00007FF719A30000-0x00007FF719E21000-memory.dmp

Filesize
3.9MB

Download
memory/2892-480-0x00007FF6716C0000-0x00007FF671AB1000-memory.dmp

Filesize
3.9MB

Download
memory/3200-1305-0x00007FF716D20000-0x00007FF717111000-memory.dmp

Filesize
3.9MB

Download
memory/3200-43-0x00007FF716D20000-0x00007FF717111000-memory.dmp

Filesize
3.9MB

Download
memory/3200-2127-0x00007FF716D20000-0x00007FF717111000-memory.dmp

Filesize
3.9MB

Download
memory/3288-2113-0x00007FF744C20000-0x00007FF745011000-memory.dmp

Filesize
3.9MB

Download
memory/3288-475-0x00007FF744C20000-0x00007FF745011000-memory.dmp

Filesize
3.9MB

Download
memory/3424-2121-0x00007FF626920000-0x00007FF626D11000-memory.dmp

Filesize
3.9MB

Download
memory/3424-481-0x00007FF626920000-0x00007FF626D11000-memory.dmp

Filesize
3.9MB

Download
memory/3456-497-0x00007FF7EA680000-0x00007FF7EAA71000-memory.dmp

Filesize
3.9MB

Download
memory/3456-2131-0x00007FF7EA680000-0x00007FF7EAA71000-memory.dmp

Filesize
3.9MB

Download
memory/3480-482-0x00007FF664520000-0x00007FF664911000-memory.dmp

Filesize
3.9MB

Download
memory/3480-2125-0x00007FF664520000-0x00007FF664911000-memory.dmp

Filesize
3.9MB

Download
memory/3660-1217-0x00007FF7D7A80000-0x00007FF7D7E71000-memory.dmp

Filesize
3.9MB

Download
memory/3660-0-0x00007FF7D7A80000-0x00007FF7D7E71000-memory.dmp

Filesize
3.9MB

Download
memory/3660-1-0x000001CE0EAA0000-0x000001CE0EAB0000-memory.dmp

Filesize
64KB

Download
memory/3668-2072-0x00007FF617380000-0x00007FF617771000-memory.dmp

Filesize
3.9MB

Download
memory/3668-45-0x00007FF617380000-0x00007FF617771000-memory.dmp

Filesize
3.9MB

Download
memory/3972-478-0x00007FF6FE6D0000-0x00007FF6FEAC1000-memory.dmp

Filesize
3.9MB

Download
memory/3972-2110-0x00007FF6FE6D0000-0x00007FF6FEAC1000-memory.dmp

Filesize
3.9MB

Download
memory/4168-1303-0x00007FF74C220000-0x00007FF74C611000-memory.dmp

Filesize
3.9MB

Download
memory/4168-39-0x00007FF74C220000-0x00007FF74C611000-memory.dmp

Filesize
3.9MB

Download
memory/4176-505-0x00007FF77D140000-0x00007FF77D531000-memory.dmp

Filesize
3.9MB

Download
memory/4176-2137-0x00007FF77D140000-0x00007FF77D531000-memory.dmp

Filesize
3.9MB

Download
memory/4188-1297-0x00007FF671EB0000-0x00007FF6722A1000-memory.dmp

Filesize
3.9MB

Download
memory/4188-21-0x00007FF671EB0000-0x00007FF6722A1000-memory.dmp

Filesize
3.9MB

Download
memory/4188-2075-0x00007FF671EB0000-0x00007FF6722A1000-memory.dmp

Filesize
3.9MB

Download
memory/4284-2126-0x00007FF7A1670000-0x00007FF7A1A61000-memory.dmp

Filesize
3.9MB

Download
memory/4284-486-0x00007FF7A1670000-0x00007FF7A1A61000-memory.dmp

Filesize
3.9MB

Download
memory/4328-518-0x00007FF6F7F80000-0x00007FF6F8371000-memory.dmp

Filesize
3.9MB

Download
memory/4328-2118-0x00007FF6F7F80000-0x00007FF6F8371000-memory.dmp

Filesize
3.9MB

Download
memory/4340-2130-0x00007FF740DD0000-0x00007FF7411C1000-memory.dmp

Filesize
3.9MB

Download
memory/4340-492-0x00007FF740DD0000-0x00007FF7411C1000-memory.dmp

Filesize
3.9MB

Download
memory/4780-2136-0x00007FF7505E0000-0x00007FF7509D1000-memory.dmp

Filesize
3.9MB

Download
memory/4780-508-0x00007FF7505E0000-0x00007FF7509D1000-memory.dmp

Filesize
3.9MB

Download
memory/5096-476-0x00007FF666150000-0x00007FF666541000-memory.dmp

Filesize
3.9MB

Download
memory/5096-2119-0x00007FF666150000-0x00007FF666541000-memory.dmp

Filesize
3.9MB

Download