xmrig | 6c9a54656f4e34130dae7a560ed932d1b30c9167325e67284b2c54efb07cc2ef

Analysis

max time kernel
92s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 03:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
Size

1.1MB
MD5

d0fd257e04b9210b3f2f36339f456f57
SHA1

39494162bea46142b933f629de75833706c0546a
SHA256

6c9a54656f4e34130dae7a560ed932d1b30c9167325e67284b2c54efb07cc2ef
SHA512

683ab08c74008005754045844304269bb5787410f211ee76cd62991e353915d167ce3bb96fe91d0cf711d743d5b588c5cd0db5145e92776ba41c167bed688de3
SSDEEP

24576:JanwhSe11QSONCpGJCjETPlGC78XCejIODosTigQytOFaTq:knw9oUUEEDlGUrMNZq

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/324-335-0x00007FF798DF0000-0x00007FF7991E1000-memory.dmp	xmrig
behavioral2/memory/3540-339-0x00007FF78F5D0000-0x00007FF78F9C1000-memory.dmp	xmrig
behavioral2/memory/1040-341-0x00007FF6B26B0000-0x00007FF6B2AA1000-memory.dmp	xmrig
behavioral2/memory/3008-344-0x00007FF704660000-0x00007FF704A51000-memory.dmp	xmrig
behavioral2/memory/832-351-0x00007FF6774E0000-0x00007FF6778D1000-memory.dmp	xmrig
behavioral2/memory/1220-362-0x00007FF7B2640000-0x00007FF7B2A31000-memory.dmp	xmrig
behavioral2/memory/3184-358-0x00007FF7E50E0000-0x00007FF7E54D1000-memory.dmp	xmrig
behavioral2/memory/4692-365-0x00007FF788EE0000-0x00007FF7892D1000-memory.dmp	xmrig
behavioral2/memory/704-366-0x00007FF610930000-0x00007FF610D21000-memory.dmp	xmrig
behavioral2/memory/4880-367-0x00007FF634AB0000-0x00007FF634EA1000-memory.dmp	xmrig
behavioral2/memory/3220-377-0x00007FF671100000-0x00007FF6714F1000-memory.dmp	xmrig
behavioral2/memory/1864-368-0x00007FF7CF230000-0x00007FF7CF621000-memory.dmp	xmrig
behavioral2/memory/1500-364-0x00007FF61B1E0000-0x00007FF61B5D1000-memory.dmp	xmrig
behavioral2/memory/3716-342-0x00007FF61CE10000-0x00007FF61D201000-memory.dmp	xmrig
behavioral2/memory/1392-1001-0x00007FF6E8EB0000-0x00007FF6E92A1000-memory.dmp	xmrig
behavioral2/memory/3744-337-0x00007FF6C2A10000-0x00007FF6C2E01000-memory.dmp	xmrig
behavioral2/memory/4204-67-0x00007FF702C30000-0x00007FF703021000-memory.dmp	xmrig
behavioral2/memory/2028-64-0x00007FF7F1220000-0x00007FF7F1611000-memory.dmp	xmrig
behavioral2/memory/5040-59-0x00007FF71BEA0000-0x00007FF71C291000-memory.dmp	xmrig
behavioral2/memory/4524-48-0x00007FF7A2780000-0x00007FF7A2B71000-memory.dmp	xmrig
behavioral2/memory/4628-1145-0x00007FF65EC80000-0x00007FF65F071000-memory.dmp	xmrig
behavioral2/memory/3708-1147-0x00007FF7C0870000-0x00007FF7C0C61000-memory.dmp	xmrig
behavioral2/memory/1104-1148-0x00007FF7632B0000-0x00007FF7636A1000-memory.dmp	xmrig
behavioral2/memory/3704-1265-0x00007FF6CB740000-0x00007FF6CBB31000-memory.dmp	xmrig
behavioral2/memory/840-1267-0x00007FF760BE0000-0x00007FF760FD1000-memory.dmp	xmrig
behavioral2/memory/4628-2136-0x00007FF65EC80000-0x00007FF65F071000-memory.dmp	xmrig
behavioral2/memory/2028-2138-0x00007FF7F1220000-0x00007FF7F1611000-memory.dmp	xmrig
behavioral2/memory/3708-2140-0x00007FF7C0870000-0x00007FF7C0C61000-memory.dmp	xmrig
behavioral2/memory/1104-2142-0x00007FF7632B0000-0x00007FF7636A1000-memory.dmp	xmrig
behavioral2/memory/1864-2144-0x00007FF7CF230000-0x00007FF7CF621000-memory.dmp	xmrig
behavioral2/memory/4524-2158-0x00007FF7A2780000-0x00007FF7A2B71000-memory.dmp	xmrig
behavioral2/memory/3220-2162-0x00007FF671100000-0x00007FF6714F1000-memory.dmp	xmrig
behavioral2/memory/3540-2161-0x00007FF78F5D0000-0x00007FF78F9C1000-memory.dmp	xmrig
behavioral2/memory/4204-2155-0x00007FF702C30000-0x00007FF703021000-memory.dmp	xmrig
behavioral2/memory/324-2151-0x00007FF798DF0000-0x00007FF7991E1000-memory.dmp	xmrig
behavioral2/memory/3744-2149-0x00007FF6C2A10000-0x00007FF6C2E01000-memory.dmp	xmrig
behavioral2/memory/3704-2157-0x00007FF6CB740000-0x00007FF6CBB31000-memory.dmp	xmrig
behavioral2/memory/5040-2153-0x00007FF71BEA0000-0x00007FF71C291000-memory.dmp	xmrig
behavioral2/memory/840-2147-0x00007FF760BE0000-0x00007FF760FD1000-memory.dmp	xmrig
behavioral2/memory/1040-2175-0x00007FF6B26B0000-0x00007FF6B2AA1000-memory.dmp	xmrig
behavioral2/memory/3008-2203-0x00007FF704660000-0x00007FF704A51000-memory.dmp	xmrig
behavioral2/memory/4692-2211-0x00007FF788EE0000-0x00007FF7892D1000-memory.dmp	xmrig
behavioral2/memory/1500-2209-0x00007FF61B1E0000-0x00007FF61B5D1000-memory.dmp	xmrig
behavioral2/memory/4880-2207-0x00007FF634AB0000-0x00007FF634EA1000-memory.dmp	xmrig
behavioral2/memory/704-2205-0x00007FF610930000-0x00007FF610D21000-memory.dmp	xmrig
behavioral2/memory/3716-2200-0x00007FF61CE10000-0x00007FF61D201000-memory.dmp	xmrig
behavioral2/memory/3184-2198-0x00007FF7E50E0000-0x00007FF7E54D1000-memory.dmp	xmrig
behavioral2/memory/832-2186-0x00007FF6774E0000-0x00007FF6778D1000-memory.dmp	xmrig
behavioral2/memory/1220-2202-0x00007FF7B2640000-0x00007FF7B2A31000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4628	agmVRcs.exe
3708	qzfPHdv.exe
2028	gZIeLjp.exe
1104	UquImrv.exe
4204	taAELHY.exe
3704	TsaSYom.exe
4524	OAlBBzF.exe
5040	bNvExUL.exe
324	pBNokzQ.exe
3744	CmydCUK.exe
840	VOCxAmv.exe
1864	XFxrpAA.exe
3220	lqZxAxT.exe
3540	jzSiKCW.exe
1040	ltHSnaT.exe
3716	lDdsUMG.exe
3008	xNdHsrk.exe
832	eMNPDYl.exe
3184	GgxjJfK.exe
1220	bKbukKR.exe
1500	rULCHbO.exe
4692	HwVRSUm.exe
704	JamdffP.exe
4880	XsclXVy.exe
4884	TxNLgrC.exe
3696	PfddCco.exe
1636	iecGBGz.exe
5024	cWpdXSX.exe
2668	EYrQJlc.exe
4624	SLsybsY.exe
1904	PDXmYXY.exe
216	HStpwZM.exe
1520	bIwQMjA.exe
2016	oFJWXhY.exe
3096	aNurgDn.exe
1296	lZKowND.exe
4216	mgnLWXW.exe
2680	kpacVUh.exe
4840	baHqTnw.exe
3172	eotCkqr.exe
4984	MUeFtdY.exe
3900	dgYBBMi.exe
3168	VulwhLv.exe
4648	CGJwMgB.exe
4308	JgJwjPB.exe
3492	PabdwQH.exe
1312	QIKzBSL.exe
3544	cdWXjMA.exe
1912	dvTsaVG.exe
1860	zpBENrC.exe
536	dHMoCqu.exe
2108	QRXjExH.exe
2988	VFbIhHv.exe
4044	tIpSvId.exe
3212	hsUpZbf.exe
2424	VbPNsEB.exe
1028	EddOSVu.exe
4600	ztsPGiN.exe
4496	rjoYHim.exe
3140	IooAgmh.exe
1380	vmxlmog.exe
2332	FuftZML.exe
2780	yzaogyC.exe
836	wUHzBkM.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1392-0-0x00007FF6E8EB0000-0x00007FF6E92A1000-memory.dmp	upx
behavioral2/files/0x000700000002347b-12.dat	upx
behavioral2/files/0x000700000002347c-17.dat	upx
behavioral2/files/0x0007000000023481-35.dat	upx
behavioral2/memory/3704-46-0x00007FF6CB740000-0x00007FF6CBB31000-memory.dmp	upx
behavioral2/files/0x0007000000023482-54.dat	upx
behavioral2/files/0x0007000000023483-52.dat	upx
behavioral2/memory/840-63-0x00007FF760BE0000-0x00007FF760FD1000-memory.dmp	upx
behavioral2/files/0x0007000000023489-93.dat	upx
behavioral2/files/0x000700000002348d-113.dat	upx
behavioral2/files/0x0007000000023495-146.dat	upx
behavioral2/files/0x0007000000023497-163.dat	upx
behavioral2/memory/324-335-0x00007FF798DF0000-0x00007FF7991E1000-memory.dmp	upx
behavioral2/memory/3540-339-0x00007FF78F5D0000-0x00007FF78F9C1000-memory.dmp	upx
behavioral2/memory/1040-341-0x00007FF6B26B0000-0x00007FF6B2AA1000-memory.dmp	upx
behavioral2/memory/3008-344-0x00007FF704660000-0x00007FF704A51000-memory.dmp	upx
behavioral2/memory/832-351-0x00007FF6774E0000-0x00007FF6778D1000-memory.dmp	upx
behavioral2/memory/1220-362-0x00007FF7B2640000-0x00007FF7B2A31000-memory.dmp	upx
behavioral2/memory/3184-358-0x00007FF7E50E0000-0x00007FF7E54D1000-memory.dmp	upx
behavioral2/memory/4692-365-0x00007FF788EE0000-0x00007FF7892D1000-memory.dmp	upx
behavioral2/memory/704-366-0x00007FF610930000-0x00007FF610D21000-memory.dmp	upx
behavioral2/memory/4880-367-0x00007FF634AB0000-0x00007FF634EA1000-memory.dmp	upx
behavioral2/memory/3220-377-0x00007FF671100000-0x00007FF6714F1000-memory.dmp	upx
behavioral2/memory/1864-368-0x00007FF7CF230000-0x00007FF7CF621000-memory.dmp	upx
behavioral2/memory/1500-364-0x00007FF61B1E0000-0x00007FF61B5D1000-memory.dmp	upx
behavioral2/memory/3716-342-0x00007FF61CE10000-0x00007FF61D201000-memory.dmp	upx
behavioral2/memory/1392-1001-0x00007FF6E8EB0000-0x00007FF6E92A1000-memory.dmp	upx
behavioral2/memory/3744-337-0x00007FF6C2A10000-0x00007FF6C2E01000-memory.dmp	upx
behavioral2/memory/4204-67-0x00007FF702C30000-0x00007FF703021000-memory.dmp	upx
behavioral2/files/0x000700000002349a-171.dat	upx
behavioral2/files/0x0007000000023498-168.dat	upx
behavioral2/files/0x0007000000023499-166.dat	upx
behavioral2/files/0x0007000000023496-155.dat	upx
behavioral2/files/0x0007000000023494-148.dat	upx
behavioral2/files/0x0007000000023493-143.dat	upx
behavioral2/files/0x0007000000023492-138.dat	upx
behavioral2/files/0x0007000000023491-133.dat	upx
behavioral2/files/0x0007000000023490-128.dat	upx
behavioral2/files/0x000700000002348f-120.dat	upx
behavioral2/files/0x000700000002348e-118.dat	upx
behavioral2/files/0x000700000002348c-108.dat	upx
behavioral2/files/0x000700000002348b-103.dat	upx
behavioral2/files/0x000700000002348a-98.dat	upx
behavioral2/files/0x0007000000023488-88.dat	upx
behavioral2/files/0x0007000000023487-83.dat	upx
behavioral2/files/0x0007000000023486-78.dat	upx
behavioral2/files/0x0007000000023485-73.dat	upx
behavioral2/files/0x0007000000023484-71.dat	upx
behavioral2/memory/2028-64-0x00007FF7F1220000-0x00007FF7F1611000-memory.dmp	upx
behavioral2/memory/5040-59-0x00007FF71BEA0000-0x00007FF71C291000-memory.dmp	upx
behavioral2/memory/4524-48-0x00007FF7A2780000-0x00007FF7A2B71000-memory.dmp	upx
behavioral2/files/0x000700000002347f-42.dat	upx
behavioral2/memory/1104-40-0x00007FF7632B0000-0x00007FF7636A1000-memory.dmp	upx
behavioral2/files/0x0007000000023480-39.dat	upx
behavioral2/files/0x000700000002347e-33.dat	upx
behavioral2/memory/3708-21-0x00007FF7C0870000-0x00007FF7C0C61000-memory.dmp	upx
behavioral2/files/0x000700000002347d-19.dat	upx
behavioral2/memory/4628-1145-0x00007FF65EC80000-0x00007FF65F071000-memory.dmp	upx
behavioral2/memory/3708-1147-0x00007FF7C0870000-0x00007FF7C0C61000-memory.dmp	upx
behavioral2/memory/1104-1148-0x00007FF7632B0000-0x00007FF7636A1000-memory.dmp	upx
behavioral2/memory/4628-9-0x00007FF65EC80000-0x00007FF65F071000-memory.dmp	upx
behavioral2/files/0x0008000000023477-7.dat	upx
behavioral2/memory/3704-1265-0x00007FF6CB740000-0x00007FF6CBB31000-memory.dmp	upx
behavioral2/memory/840-1267-0x00007FF760BE0000-0x00007FF760FD1000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\AKKuqGH.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\heyuysa.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\tLiNfjc.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\lVkmdVB.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\GFfcpMd.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\WJEheRo.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\LOJXxdO.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\XsclXVy.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\VUOdrsj.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\dabruWR.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\YokUIqi.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\HwVRSUm.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\CGJwMgB.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\DGUYMVP.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\VXkPRVi.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\hzEhcYb.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\qVqTcfA.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\elukTZx.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\zFFcrcV.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\NffkxLo.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\vyxUhYa.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\mpuLHnV.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\CZDgnHa.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\jjcOfso.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\ggvSECW.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\bwGjsOZ.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\tMHrqVx.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\nIvHKIV.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\sIeIYYE.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\OAlBBzF.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\eQMKxAH.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\LAPfNUm.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\OJFlbFF.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\XOgocFd.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\OBQrmHp.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\MVRDAff.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\eaCsVBE.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\VbPNsEB.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\tOqhOQJ.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\PnBOtDi.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\ajoqBmh.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\XSbDgTg.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\HPFuvoN.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\iIptnOy.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\UJigJrs.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\tyYjTAk.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\wOPTQPq.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\pABqfoX.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\SYHMlXU.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\VncWYWp.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\xNdHsrk.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\lfslsNq.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\uoLZPwD.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\VuxMytJ.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\kfanVQF.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\gMXzOiN.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\yBWURdh.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\NbrGwVd.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\WVRsTFt.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\GOMdNRA.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\ifSWHhG.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\zvJJTSM.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\UJqFdSk.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
File created	C:\Windows\System32\myCoIvd.exe	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 4628	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	84
PID 1392 wrote to memory of 4628	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	84
PID 1392 wrote to memory of 3708	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	85
PID 1392 wrote to memory of 3708	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	85
PID 1392 wrote to memory of 1104	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	86
PID 1392 wrote to memory of 1104	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	86
PID 1392 wrote to memory of 2028	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	87
PID 1392 wrote to memory of 2028	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	87
PID 1392 wrote to memory of 4524	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	88
PID 1392 wrote to memory of 4524	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	88
PID 1392 wrote to memory of 4204	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	89
PID 1392 wrote to memory of 4204	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	89
PID 1392 wrote to memory of 3704	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	90
PID 1392 wrote to memory of 3704	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	90
PID 1392 wrote to memory of 5040	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	91
PID 1392 wrote to memory of 5040	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	91
PID 1392 wrote to memory of 324	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	92
PID 1392 wrote to memory of 324	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	92
PID 1392 wrote to memory of 3744	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	93
PID 1392 wrote to memory of 3744	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	93
PID 1392 wrote to memory of 840	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	94
PID 1392 wrote to memory of 840	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	94
PID 1392 wrote to memory of 1864	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	95
PID 1392 wrote to memory of 1864	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	95
PID 1392 wrote to memory of 3220	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	96
PID 1392 wrote to memory of 3220	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	96
PID 1392 wrote to memory of 3540	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	97
PID 1392 wrote to memory of 3540	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	97
PID 1392 wrote to memory of 1040	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	98
PID 1392 wrote to memory of 1040	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	98
PID 1392 wrote to memory of 3716	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	99
PID 1392 wrote to memory of 3716	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	99
PID 1392 wrote to memory of 3008	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	100
PID 1392 wrote to memory of 3008	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	100
PID 1392 wrote to memory of 832	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	101
PID 1392 wrote to memory of 832	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	101
PID 1392 wrote to memory of 3184	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	102
PID 1392 wrote to memory of 3184	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	102
PID 1392 wrote to memory of 1220	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	103
PID 1392 wrote to memory of 1220	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	103
PID 1392 wrote to memory of 1500	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	104
PID 1392 wrote to memory of 1500	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	104
PID 1392 wrote to memory of 4692	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	105
PID 1392 wrote to memory of 4692	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	105
PID 1392 wrote to memory of 704	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	106
PID 1392 wrote to memory of 704	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	106
PID 1392 wrote to memory of 4880	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	107
PID 1392 wrote to memory of 4880	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	107
PID 1392 wrote to memory of 4884	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	108
PID 1392 wrote to memory of 4884	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	108
PID 1392 wrote to memory of 3696	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	109
PID 1392 wrote to memory of 3696	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	109
PID 1392 wrote to memory of 1636	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	110
PID 1392 wrote to memory of 1636	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	110
PID 1392 wrote to memory of 5024	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	111
PID 1392 wrote to memory of 5024	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	111
PID 1392 wrote to memory of 2668	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	112
PID 1392 wrote to memory of 2668	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	112
PID 1392 wrote to memory of 4624	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	113
PID 1392 wrote to memory of 4624	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	113
PID 1392 wrote to memory of 1904	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	114
PID 1392 wrote to memory of 1904	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	114
PID 1392 wrote to memory of 216	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	115
PID 1392 wrote to memory of 216	1392	d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d0fd257e04b9210b3f2f36339f456f57_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\System32\agmVRcs.exe
  C:\Windows\System32\agmVRcs.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System32\qzfPHdv.exe
  C:\Windows\System32\qzfPHdv.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System32\UquImrv.exe
  C:\Windows\System32\UquImrv.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System32\gZIeLjp.exe
  C:\Windows\System32\gZIeLjp.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System32\OAlBBzF.exe
  C:\Windows\System32\OAlBBzF.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System32\taAELHY.exe
  C:\Windows\System32\taAELHY.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System32\TsaSYom.exe
  C:\Windows\System32\TsaSYom.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System32\bNvExUL.exe
  C:\Windows\System32\bNvExUL.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System32\pBNokzQ.exe
  C:\Windows\System32\pBNokzQ.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System32\CmydCUK.exe
  C:\Windows\System32\CmydCUK.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System32\VOCxAmv.exe
  C:\Windows\System32\VOCxAmv.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System32\XFxrpAA.exe
  C:\Windows\System32\XFxrpAA.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System32\lqZxAxT.exe
  C:\Windows\System32\lqZxAxT.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System32\jzSiKCW.exe
  C:\Windows\System32\jzSiKCW.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System32\ltHSnaT.exe
  C:\Windows\System32\ltHSnaT.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System32\lDdsUMG.exe
  C:\Windows\System32\lDdsUMG.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System32\xNdHsrk.exe
  C:\Windows\System32\xNdHsrk.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System32\eMNPDYl.exe
  C:\Windows\System32\eMNPDYl.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System32\GgxjJfK.exe
  C:\Windows\System32\GgxjJfK.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System32\bKbukKR.exe
  C:\Windows\System32\bKbukKR.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System32\rULCHbO.exe
  C:\Windows\System32\rULCHbO.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System32\HwVRSUm.exe
  C:\Windows\System32\HwVRSUm.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System32\JamdffP.exe
  C:\Windows\System32\JamdffP.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System32\XsclXVy.exe
  C:\Windows\System32\XsclXVy.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System32\TxNLgrC.exe
  C:\Windows\System32\TxNLgrC.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System32\PfddCco.exe
  C:\Windows\System32\PfddCco.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System32\iecGBGz.exe
  C:\Windows\System32\iecGBGz.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System32\cWpdXSX.exe
  C:\Windows\System32\cWpdXSX.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System32\EYrQJlc.exe
  C:\Windows\System32\EYrQJlc.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System32\SLsybsY.exe
  C:\Windows\System32\SLsybsY.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System32\PDXmYXY.exe
  C:\Windows\System32\PDXmYXY.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System32\HStpwZM.exe
  C:\Windows\System32\HStpwZM.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System32\bIwQMjA.exe
  C:\Windows\System32\bIwQMjA.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System32\oFJWXhY.exe
  C:\Windows\System32\oFJWXhY.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System32\aNurgDn.exe
  C:\Windows\System32\aNurgDn.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System32\lZKowND.exe
  C:\Windows\System32\lZKowND.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System32\mgnLWXW.exe
  C:\Windows\System32\mgnLWXW.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System32\kpacVUh.exe
  C:\Windows\System32\kpacVUh.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System32\baHqTnw.exe
  C:\Windows\System32\baHqTnw.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System32\eotCkqr.exe
  C:\Windows\System32\eotCkqr.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System32\MUeFtdY.exe
  C:\Windows\System32\MUeFtdY.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System32\dgYBBMi.exe
  C:\Windows\System32\dgYBBMi.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System32\VulwhLv.exe
  C:\Windows\System32\VulwhLv.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System32\CGJwMgB.exe
  C:\Windows\System32\CGJwMgB.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System32\JgJwjPB.exe
  C:\Windows\System32\JgJwjPB.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System32\PabdwQH.exe
  C:\Windows\System32\PabdwQH.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System32\QIKzBSL.exe
  C:\Windows\System32\QIKzBSL.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System32\cdWXjMA.exe
  C:\Windows\System32\cdWXjMA.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System32\dvTsaVG.exe
  C:\Windows\System32\dvTsaVG.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System32\zpBENrC.exe
  C:\Windows\System32\zpBENrC.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System32\dHMoCqu.exe
  C:\Windows\System32\dHMoCqu.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System32\QRXjExH.exe
  C:\Windows\System32\QRXjExH.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System32\VFbIhHv.exe
  C:\Windows\System32\VFbIhHv.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System32\tIpSvId.exe
  C:\Windows\System32\tIpSvId.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System32\hsUpZbf.exe
  C:\Windows\System32\hsUpZbf.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System32\VbPNsEB.exe
  C:\Windows\System32\VbPNsEB.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System32\EddOSVu.exe
  C:\Windows\System32\EddOSVu.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System32\ztsPGiN.exe
  C:\Windows\System32\ztsPGiN.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System32\rjoYHim.exe
  C:\Windows\System32\rjoYHim.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System32\IooAgmh.exe
  C:\Windows\System32\IooAgmh.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System32\vmxlmog.exe
  C:\Windows\System32\vmxlmog.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System32\FuftZML.exe
  C:\Windows\System32\FuftZML.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System32\yzaogyC.exe
  C:\Windows\System32\yzaogyC.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System32\wUHzBkM.exe
  C:\Windows\System32\wUHzBkM.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System32\sjAwuZc.exe
  C:\Windows\System32\sjAwuZc.exe
  2⤵
  PID:2380
- C:\Windows\System32\AbEmdrQ.exe
  C:\Windows\System32\AbEmdrQ.exe
  2⤵
  PID:3792
- C:\Windows\System32\PHvDHoy.exe
  C:\Windows\System32\PHvDHoy.exe
  2⤵
  PID:4356
- C:\Windows\System32\REujQbL.exe
  C:\Windows\System32\REujQbL.exe
  2⤵
  PID:2640
- C:\Windows\System32\MWmNbjq.exe
  C:\Windows\System32\MWmNbjq.exe
  2⤵
  PID:1600
- C:\Windows\System32\avooGEX.exe
  C:\Windows\System32\avooGEX.exe
  2⤵
  PID:3560
- C:\Windows\System32\WrqtfzK.exe
  C:\Windows\System32\WrqtfzK.exe
  2⤵
  PID:4592
- C:\Windows\System32\qsNjJKg.exe
  C:\Windows\System32\qsNjJKg.exe
  2⤵
  PID:4140
- C:\Windows\System32\IjTgpoR.exe
  C:\Windows\System32\IjTgpoR.exe
  2⤵
  PID:428
- C:\Windows\System32\rWgiDFW.exe
  C:\Windows\System32\rWgiDFW.exe
  2⤵
  PID:1320
- C:\Windows\System32\PFUTvsP.exe
  C:\Windows\System32\PFUTvsP.exe
  2⤵
  PID:3580
- C:\Windows\System32\sJukRjC.exe
  C:\Windows\System32\sJukRjC.exe
  2⤵
  PID:2508
- C:\Windows\System32\JKJwUIx.exe
  C:\Windows\System32\JKJwUIx.exe
  2⤵
  PID:3936
- C:\Windows\System32\YSJinnV.exe
  C:\Windows\System32\YSJinnV.exe
  2⤵
  PID:4596
- C:\Windows\System32\ZwNBkPO.exe
  C:\Windows\System32\ZwNBkPO.exe
  2⤵
  PID:1396
- C:\Windows\System32\GnyEghS.exe
  C:\Windows\System32\GnyEghS.exe
  2⤵
  PID:5128
- C:\Windows\System32\ktnjFQj.exe
  C:\Windows\System32\ktnjFQj.exe
  2⤵
  PID:5152
- C:\Windows\System32\AYILrHA.exe
  C:\Windows\System32\AYILrHA.exe
  2⤵
  PID:5176
- C:\Windows\System32\LgqRezb.exe
  C:\Windows\System32\LgqRezb.exe
  2⤵
  PID:5204
- C:\Windows\System32\PAWWyVz.exe
  C:\Windows\System32\PAWWyVz.exe
  2⤵
  PID:5232
- C:\Windows\System32\rHNoOjc.exe
  C:\Windows\System32\rHNoOjc.exe
  2⤵
  PID:5264
- C:\Windows\System32\qFhqBCD.exe
  C:\Windows\System32\qFhqBCD.exe
  2⤵
  PID:5288
- C:\Windows\System32\qWKaanC.exe
  C:\Windows\System32\qWKaanC.exe
  2⤵
  PID:5320
- C:\Windows\System32\eQMKxAH.exe
  C:\Windows\System32\eQMKxAH.exe
  2⤵
  PID:5380
- C:\Windows\System32\IUsFZOW.exe
  C:\Windows\System32\IUsFZOW.exe
  2⤵
  PID:5408
- C:\Windows\System32\tOqhOQJ.exe
  C:\Windows\System32\tOqhOQJ.exe
  2⤵
  PID:5436
- C:\Windows\System32\Zsdrcql.exe
  C:\Windows\System32\Zsdrcql.exe
  2⤵
  PID:5460
- C:\Windows\System32\myCoIvd.exe
  C:\Windows\System32\myCoIvd.exe
  2⤵
  PID:5500
- C:\Windows\System32\vxZVfxq.exe
  C:\Windows\System32\vxZVfxq.exe
  2⤵
  PID:5520
- C:\Windows\System32\pbPFpjS.exe
  C:\Windows\System32\pbPFpjS.exe
  2⤵
  PID:5540
- C:\Windows\System32\NbrGwVd.exe
  C:\Windows\System32\NbrGwVd.exe
  2⤵
  PID:5560
- C:\Windows\System32\Pdeuyzz.exe
  C:\Windows\System32\Pdeuyzz.exe
  2⤵
  PID:5656
- C:\Windows\System32\yOfkfym.exe
  C:\Windows\System32\yOfkfym.exe
  2⤵
  PID:5708
- C:\Windows\System32\XcwjgEB.exe
  C:\Windows\System32\XcwjgEB.exe
  2⤵
  PID:5724
- C:\Windows\System32\yBVsfIY.exe
  C:\Windows\System32\yBVsfIY.exe
  2⤵
  PID:5760
- C:\Windows\System32\aqoWqhL.exe
  C:\Windows\System32\aqoWqhL.exe
  2⤵
  PID:5800
- C:\Windows\System32\jXMoJZN.exe
  C:\Windows\System32\jXMoJZN.exe
  2⤵
  PID:5820
- C:\Windows\System32\GRgReUa.exe
  C:\Windows\System32\GRgReUa.exe
  2⤵
  PID:5856
- C:\Windows\System32\UJigJrs.exe
  C:\Windows\System32\UJigJrs.exe
  2⤵
  PID:5888
- C:\Windows\System32\LixCypi.exe
  C:\Windows\System32\LixCypi.exe
  2⤵
  PID:5908
- C:\Windows\System32\BvHcJos.exe
  C:\Windows\System32\BvHcJos.exe
  2⤵
  PID:5952
- C:\Windows\System32\euSNjIT.exe
  C:\Windows\System32\euSNjIT.exe
  2⤵
  PID:5972
- C:\Windows\System32\LTnmJHY.exe
  C:\Windows\System32\LTnmJHY.exe
  2⤵
  PID:5988
- C:\Windows\System32\tyYjTAk.exe
  C:\Windows\System32\tyYjTAk.exe
  2⤵
  PID:6024
- C:\Windows\System32\qkrluOm.exe
  C:\Windows\System32\qkrluOm.exe
  2⤵
  PID:6068
- C:\Windows\System32\qqVpJLh.exe
  C:\Windows\System32\qqVpJLh.exe
  2⤵
  PID:6088
- C:\Windows\System32\RaoiTvk.exe
  C:\Windows\System32\RaoiTvk.exe
  2⤵
  PID:6104
- C:\Windows\System32\kenPQsl.exe
  C:\Windows\System32\kenPQsl.exe
  2⤵
  PID:6120
- C:\Windows\System32\CQDAgpa.exe
  C:\Windows\System32\CQDAgpa.exe
  2⤵
  PID:6140
- C:\Windows\System32\KZWelKb.exe
  C:\Windows\System32\KZWelKb.exe
  2⤵
  PID:3284
- C:\Windows\System32\rWvdpqJ.exe
  C:\Windows\System32\rWvdpqJ.exe
  2⤵
  PID:5084
- C:\Windows\System32\hkjIsbH.exe
  C:\Windows\System32\hkjIsbH.exe
  2⤵
  PID:4248
- C:\Windows\System32\JBhCFFh.exe
  C:\Windows\System32\JBhCFFh.exe
  2⤵
  PID:5196
- C:\Windows\System32\ZHehTpQ.exe
  C:\Windows\System32\ZHehTpQ.exe
  2⤵
  PID:468
- C:\Windows\System32\UcvZAoz.exe
  C:\Windows\System32\UcvZAoz.exe
  2⤵
  PID:208
- C:\Windows\System32\SCqvgwp.exe
  C:\Windows\System32\SCqvgwp.exe
  2⤵
  PID:5272
- C:\Windows\System32\rRnDTFq.exe
  C:\Windows\System32\rRnDTFq.exe
  2⤵
  PID:4472
- C:\Windows\System32\htUubgj.exe
  C:\Windows\System32\htUubgj.exe
  2⤵
  PID:2776
- C:\Windows\System32\OBkMqwo.exe
  C:\Windows\System32\OBkMqwo.exe
  2⤵
  PID:4872
- C:\Windows\System32\OVgZTQy.exe
  C:\Windows\System32\OVgZTQy.exe
  2⤵
  PID:1212
- C:\Windows\System32\omhMnlW.exe
  C:\Windows\System32\omhMnlW.exe
  2⤵
  PID:5048
- C:\Windows\System32\fOpjjwd.exe
  C:\Windows\System32\fOpjjwd.exe
  2⤵
  PID:4484
- C:\Windows\System32\opENiEx.exe
  C:\Windows\System32\opENiEx.exe
  2⤵
  PID:2116
- C:\Windows\System32\zFFcrcV.exe
  C:\Windows\System32\zFFcrcV.exe
  2⤵
  PID:4348
- C:\Windows\System32\oDZYKjc.exe
  C:\Windows\System32\oDZYKjc.exe
  2⤵
  PID:5360
- C:\Windows\System32\JNpMJVM.exe
  C:\Windows\System32\JNpMJVM.exe
  2⤵
  PID:3448
- C:\Windows\System32\lfslsNq.exe
  C:\Windows\System32\lfslsNq.exe
  2⤵
  PID:2032
- C:\Windows\System32\LYVaXal.exe
  C:\Windows\System32\LYVaXal.exe
  2⤵
  PID:4988
- C:\Windows\System32\MPqqrjC.exe
  C:\Windows\System32\MPqqrjC.exe
  2⤵
  PID:2468
- C:\Windows\System32\NRWmMgS.exe
  C:\Windows\System32\NRWmMgS.exe
  2⤵
  PID:4280
- C:\Windows\System32\BWQWVRT.exe
  C:\Windows\System32\BWQWVRT.exe
  2⤵
  PID:4552
- C:\Windows\System32\ZOQNmVG.exe
  C:\Windows\System32\ZOQNmVG.exe
  2⤵
  PID:5572
- C:\Windows\System32\gCXyUIi.exe
  C:\Windows\System32\gCXyUIi.exe
  2⤵
  PID:4256
- C:\Windows\System32\cWqKWLc.exe
  C:\Windows\System32\cWqKWLc.exe
  2⤵
  PID:1640
- C:\Windows\System32\REmsXCU.exe
  C:\Windows\System32\REmsXCU.exe
  2⤵
  PID:5648
- C:\Windows\System32\hZhdTph.exe
  C:\Windows\System32\hZhdTph.exe
  2⤵
  PID:3692
- C:\Windows\System32\rJZfNJa.exe
  C:\Windows\System32\rJZfNJa.exe
  2⤵
  PID:5792
- C:\Windows\System32\iRKVHzU.exe
  C:\Windows\System32\iRKVHzU.exe
  2⤵
  PID:5864
- C:\Windows\System32\jtAOjQG.exe
  C:\Windows\System32\jtAOjQG.exe
  2⤵
  PID:5944
- C:\Windows\System32\uFqYBPY.exe
  C:\Windows\System32\uFqYBPY.exe
  2⤵
  PID:5980
- C:\Windows\System32\BZPINAt.exe
  C:\Windows\System32\BZPINAt.exe
  2⤵
  PID:6044
- C:\Windows\System32\NffkxLo.exe
  C:\Windows\System32\NffkxLo.exe
  2⤵
  PID:6100
- C:\Windows\System32\fusvoze.exe
  C:\Windows\System32\fusvoze.exe
  2⤵
  PID:4644
- C:\Windows\System32\smzIvna.exe
  C:\Windows\System32\smzIvna.exe
  2⤵
  PID:1728
- C:\Windows\System32\uoLZPwD.exe
  C:\Windows\System32\uoLZPwD.exe
  2⤵
  PID:4360
- C:\Windows\System32\mzXuquM.exe
  C:\Windows\System32\mzXuquM.exe
  2⤵
  PID:5008
- C:\Windows\System32\gHcOxaC.exe
  C:\Windows\System32\gHcOxaC.exe
  2⤵
  PID:3216
- C:\Windows\System32\dXcaYMK.exe
  C:\Windows\System32\dXcaYMK.exe
  2⤵
  PID:1936
- C:\Windows\System32\ucgJCvi.exe
  C:\Windows\System32\ucgJCvi.exe
  2⤵
  PID:4876
- C:\Windows\System32\njHgcwM.exe
  C:\Windows\System32\njHgcwM.exe
  2⤵
  PID:4560
- C:\Windows\System32\DYqLnqU.exe
  C:\Windows\System32\DYqLnqU.exe
  2⤵
  PID:2140
- C:\Windows\System32\jwxYvCO.exe
  C:\Windows\System32\jwxYvCO.exe
  2⤵
  PID:2220
- C:\Windows\System32\WlDNOuT.exe
  C:\Windows\System32\WlDNOuT.exe
  2⤵
  PID:5476
- C:\Windows\System32\BUxuqZg.exe
  C:\Windows\System32\BUxuqZg.exe
  2⤵
  PID:1888
- C:\Windows\System32\wzCUPqH.exe
  C:\Windows\System32\wzCUPqH.exe
  2⤵
  PID:764
- C:\Windows\System32\VXYGIQx.exe
  C:\Windows\System32\VXYGIQx.exe
  2⤵
  PID:4412
- C:\Windows\System32\mIVJgQA.exe
  C:\Windows\System32\mIVJgQA.exe
  2⤵
  PID:5768
- C:\Windows\System32\aZLXffQ.exe
  C:\Windows\System32\aZLXffQ.exe
  2⤵
  PID:6032
- C:\Windows\System32\uAdIjyg.exe
  C:\Windows\System32\uAdIjyg.exe
  2⤵
  PID:3120
- C:\Windows\System32\UhVmLLc.exe
  C:\Windows\System32\UhVmLLc.exe
  2⤵
  PID:3968
- C:\Windows\System32\vyxUhYa.exe
  C:\Windows\System32\vyxUhYa.exe
  2⤵
  PID:4744
- C:\Windows\System32\FBokxQz.exe
  C:\Windows\System32\FBokxQz.exe
  2⤵
  PID:440
- C:\Windows\System32\ehrIuNp.exe
  C:\Windows\System32\ehrIuNp.exe
  2⤵
  PID:5508
- C:\Windows\System32\fnhOREo.exe
  C:\Windows\System32\fnhOREo.exe
  2⤵
  PID:6084
- C:\Windows\System32\ryfNMhe.exe
  C:\Windows\System32\ryfNMhe.exe
  2⤵
  PID:5300
- C:\Windows\System32\CewxPUy.exe
  C:\Windows\System32\CewxPUy.exe
  2⤵
  PID:4620
- C:\Windows\System32\APorCIz.exe
  C:\Windows\System32\APorCIz.exe
  2⤵
  PID:6132
- C:\Windows\System32\RrevdDG.exe
  C:\Windows\System32\RrevdDG.exe
  2⤵
  PID:5448
- C:\Windows\System32\jaNdRnh.exe
  C:\Windows\System32\jaNdRnh.exe
  2⤵
  PID:6168
- C:\Windows\System32\nRFaBpQ.exe
  C:\Windows\System32\nRFaBpQ.exe
  2⤵
  PID:6208
- C:\Windows\System32\AlMXwbK.exe
  C:\Windows\System32\AlMXwbK.exe
  2⤵
  PID:6228
- C:\Windows\System32\TZYulYY.exe
  C:\Windows\System32\TZYulYY.exe
  2⤵
  PID:6248
- C:\Windows\System32\fDwbGUn.exe
  C:\Windows\System32\fDwbGUn.exe
  2⤵
  PID:6268
- C:\Windows\System32\cbrFlSf.exe
  C:\Windows\System32\cbrFlSf.exe
  2⤵
  PID:6284
- C:\Windows\System32\NsLpSPr.exe
  C:\Windows\System32\NsLpSPr.exe
  2⤵
  PID:6308
- C:\Windows\System32\yNNfrVr.exe
  C:\Windows\System32\yNNfrVr.exe
  2⤵
  PID:6332
- C:\Windows\System32\kfvnHQN.exe
  C:\Windows\System32\kfvnHQN.exe
  2⤵
  PID:6348
- C:\Windows\System32\pbtpGFD.exe
  C:\Windows\System32\pbtpGFD.exe
  2⤵
  PID:6432
- C:\Windows\System32\plhQqdm.exe
  C:\Windows\System32\plhQqdm.exe
  2⤵
  PID:6448
- C:\Windows\System32\OzsNeVT.exe
  C:\Windows\System32\OzsNeVT.exe
  2⤵
  PID:6476
- C:\Windows\System32\ARXinQu.exe
  C:\Windows\System32\ARXinQu.exe
  2⤵
  PID:6496
- C:\Windows\System32\OLdlVWs.exe
  C:\Windows\System32\OLdlVWs.exe
  2⤵
  PID:6524
- C:\Windows\System32\IDNoeWp.exe
  C:\Windows\System32\IDNoeWp.exe
  2⤵
  PID:6544
- C:\Windows\System32\cnqoeNY.exe
  C:\Windows\System32\cnqoeNY.exe
  2⤵
  PID:6568
- C:\Windows\System32\UlFiYWC.exe
  C:\Windows\System32\UlFiYWC.exe
  2⤵
  PID:6600
- C:\Windows\System32\mbqDnMr.exe
  C:\Windows\System32\mbqDnMr.exe
  2⤵
  PID:6620
- C:\Windows\System32\UsYzvIl.exe
  C:\Windows\System32\UsYzvIl.exe
  2⤵
  PID:6640
- C:\Windows\System32\tsnMKcw.exe
  C:\Windows\System32\tsnMKcw.exe
  2⤵
  PID:6664
- C:\Windows\System32\lwMSdJR.exe
  C:\Windows\System32\lwMSdJR.exe
  2⤵
  PID:6688
- C:\Windows\System32\FOqLmkO.exe
  C:\Windows\System32\FOqLmkO.exe
  2⤵
  PID:6724
- C:\Windows\System32\mpuLHnV.exe
  C:\Windows\System32\mpuLHnV.exe
  2⤵
  PID:6756
- C:\Windows\System32\KMPmCsf.exe
  C:\Windows\System32\KMPmCsf.exe
  2⤵
  PID:6776
- C:\Windows\System32\YbTmrUE.exe
  C:\Windows\System32\YbTmrUE.exe
  2⤵
  PID:6796
- C:\Windows\System32\FrPSRbp.exe
  C:\Windows\System32\FrPSRbp.exe
  2⤵
  PID:6812
- C:\Windows\System32\iOAlpgv.exe
  C:\Windows\System32\iOAlpgv.exe
  2⤵
  PID:6872
- C:\Windows\System32\fSKvkhv.exe
  C:\Windows\System32\fSKvkhv.exe
  2⤵
  PID:6916
- C:\Windows\System32\ZdaVrGr.exe
  C:\Windows\System32\ZdaVrGr.exe
  2⤵
  PID:6948
- C:\Windows\System32\cwMyRSY.exe
  C:\Windows\System32\cwMyRSY.exe
  2⤵
  PID:6976
- C:\Windows\System32\NpDVodV.exe
  C:\Windows\System32\NpDVodV.exe
  2⤵
  PID:7020
- C:\Windows\System32\AOdAZBb.exe
  C:\Windows\System32\AOdAZBb.exe
  2⤵
  PID:7040
- C:\Windows\System32\ViRxLRo.exe
  C:\Windows\System32\ViRxLRo.exe
  2⤵
  PID:7060
- C:\Windows\System32\xdxZHqD.exe
  C:\Windows\System32\xdxZHqD.exe
  2⤵
  PID:7104
- C:\Windows\System32\XaZkBnR.exe
  C:\Windows\System32\XaZkBnR.exe
  2⤵
  PID:7120
- C:\Windows\System32\QeHHINp.exe
  C:\Windows\System32\QeHHINp.exe
  2⤵
  PID:7144
- C:\Windows\System32\rCOgfmP.exe
  C:\Windows\System32\rCOgfmP.exe
  2⤵
  PID:964
- C:\Windows\System32\dwmsBjP.exe
  C:\Windows\System32\dwmsBjP.exe
  2⤵
  PID:6200
- C:\Windows\System32\vThtnwj.exe
  C:\Windows\System32\vThtnwj.exe
  2⤵
  PID:6220
- C:\Windows\System32\ztPMPUg.exe
  C:\Windows\System32\ztPMPUg.exe
  2⤵
  PID:6276
- C:\Windows\System32\ljtKVxg.exe
  C:\Windows\System32\ljtKVxg.exe
  2⤵
  PID:6296
- C:\Windows\System32\HZgbfqB.exe
  C:\Windows\System32\HZgbfqB.exe
  2⤵
  PID:6316
- C:\Windows\System32\TEtDbgN.exe
  C:\Windows\System32\TEtDbgN.exe
  2⤵
  PID:6404
- C:\Windows\System32\ewNmdFI.exe
  C:\Windows\System32\ewNmdFI.exe
  2⤵
  PID:6588
- C:\Windows\System32\BJXzVXq.exe
  C:\Windows\System32\BJXzVXq.exe
  2⤵
  PID:6616
- C:\Windows\System32\buwrbgq.exe
  C:\Windows\System32\buwrbgq.exe
  2⤵
  PID:6656
- C:\Windows\System32\wOPTQPq.exe
  C:\Windows\System32\wOPTQPq.exe
  2⤵
  PID:6628
- C:\Windows\System32\AiDqZQE.exe
  C:\Windows\System32\AiDqZQE.exe
  2⤵
  PID:6808
- C:\Windows\System32\DjpCGYi.exe
  C:\Windows\System32\DjpCGYi.exe
  2⤵
  PID:5444
- C:\Windows\System32\uVdIutG.exe
  C:\Windows\System32\uVdIutG.exe
  2⤵
  PID:6892
- C:\Windows\System32\tUXDpKg.exe
  C:\Windows\System32\tUXDpKg.exe
  2⤵
  PID:6896
- C:\Windows\System32\TTGCkfR.exe
  C:\Windows\System32\TTGCkfR.exe
  2⤵
  PID:5616
- C:\Windows\System32\PfNLVpO.exe
  C:\Windows\System32\PfNLVpO.exe
  2⤵
  PID:7052
- C:\Windows\System32\cNuDKGx.exe
  C:\Windows\System32\cNuDKGx.exe
  2⤵
  PID:7132
- C:\Windows\System32\lmssIwh.exe
  C:\Windows\System32\lmssIwh.exe
  2⤵
  PID:5700
- C:\Windows\System32\gHQvfog.exe
  C:\Windows\System32\gHQvfog.exe
  2⤵
  PID:6160
- C:\Windows\System32\GPKUujh.exe
  C:\Windows\System32\GPKUujh.exe
  2⤵
  PID:6280
- C:\Windows\System32\ZhFoziJ.exe
  C:\Windows\System32\ZhFoziJ.exe
  2⤵
  PID:6264
- C:\Windows\System32\xGONnaW.exe
  C:\Windows\System32\xGONnaW.exe
  2⤵
  PID:6532
- C:\Windows\System32\rLWOGAE.exe
  C:\Windows\System32\rLWOGAE.exe
  2⤵
  PID:6732
- C:\Windows\System32\LVMPiJr.exe
  C:\Windows\System32\LVMPiJr.exe
  2⤵
  PID:6868
- C:\Windows\System32\FFSdvZv.exe
  C:\Windows\System32\FFSdvZv.exe
  2⤵
  PID:7096
- C:\Windows\System32\kNyYDNk.exe
  C:\Windows\System32\kNyYDNk.exe
  2⤵
  PID:5400
- C:\Windows\System32\qYqxnhR.exe
  C:\Windows\System32\qYqxnhR.exe
  2⤵
  PID:6240
- C:\Windows\System32\CDDZaMH.exe
  C:\Windows\System32\CDDZaMH.exe
  2⤵
  PID:6652
- C:\Windows\System32\RSMBkpD.exe
  C:\Windows\System32\RSMBkpD.exe
  2⤵
  PID:6988
- C:\Windows\System32\YsTuUJn.exe
  C:\Windows\System32\YsTuUJn.exe
  2⤵
  PID:5608
- C:\Windows\System32\ynRpwMm.exe
  C:\Windows\System32\ynRpwMm.exe
  2⤵
  PID:6344
- C:\Windows\System32\CaYTulz.exe
  C:\Windows\System32\CaYTulz.exe
  2⤵
  PID:7184
- C:\Windows\System32\qsAbjzZ.exe
  C:\Windows\System32\qsAbjzZ.exe
  2⤵
  PID:7240
- C:\Windows\System32\xgqcHoI.exe
  C:\Windows\System32\xgqcHoI.exe
  2⤵
  PID:7256
- C:\Windows\System32\xOJLtMg.exe
  C:\Windows\System32\xOJLtMg.exe
  2⤵
  PID:7280
- C:\Windows\System32\uglTVvc.exe
  C:\Windows\System32\uglTVvc.exe
  2⤵
  PID:7296
- C:\Windows\System32\LAPfNUm.exe
  C:\Windows\System32\LAPfNUm.exe
  2⤵
  PID:7312
- C:\Windows\System32\iHVHjIW.exe
  C:\Windows\System32\iHVHjIW.exe
  2⤵
  PID:7356
- C:\Windows\System32\tbDHpKc.exe
  C:\Windows\System32\tbDHpKc.exe
  2⤵
  PID:7376
- C:\Windows\System32\qWpDKBO.exe
  C:\Windows\System32\qWpDKBO.exe
  2⤵
  PID:7448
- C:\Windows\System32\qkCQBFP.exe
  C:\Windows\System32\qkCQBFP.exe
  2⤵
  PID:7476
- C:\Windows\System32\JDOknGT.exe
  C:\Windows\System32\JDOknGT.exe
  2⤵
  PID:7492
- C:\Windows\System32\UdDxAwi.exe
  C:\Windows\System32\UdDxAwi.exe
  2⤵
  PID:7508
- C:\Windows\System32\bSNQbAs.exe
  C:\Windows\System32\bSNQbAs.exe
  2⤵
  PID:7568
- C:\Windows\System32\WVRsTFt.exe
  C:\Windows\System32\WVRsTFt.exe
  2⤵
  PID:7592
- C:\Windows\System32\xQegzrc.exe
  C:\Windows\System32\xQegzrc.exe
  2⤵
  PID:7652
- C:\Windows\System32\GGxcuVV.exe
  C:\Windows\System32\GGxcuVV.exe
  2⤵
  PID:7680
- C:\Windows\System32\OJFlbFF.exe
  C:\Windows\System32\OJFlbFF.exe
  2⤵
  PID:7704
- C:\Windows\System32\FpENsYL.exe
  C:\Windows\System32\FpENsYL.exe
  2⤵
  PID:7736
- C:\Windows\System32\HKnFneh.exe
  C:\Windows\System32\HKnFneh.exe
  2⤵
  PID:7768
- C:\Windows\System32\SyzAfwG.exe
  C:\Windows\System32\SyzAfwG.exe
  2⤵
  PID:7796
- C:\Windows\System32\GOMdNRA.exe
  C:\Windows\System32\GOMdNRA.exe
  2⤵
  PID:7816
- C:\Windows\System32\mmKLxMh.exe
  C:\Windows\System32\mmKLxMh.exe
  2⤵
  PID:7836
- C:\Windows\System32\EDWVlnw.exe
  C:\Windows\System32\EDWVlnw.exe
  2⤵
  PID:7864
- C:\Windows\System32\UJFkvta.exe
  C:\Windows\System32\UJFkvta.exe
  2⤵
  PID:7912
- C:\Windows\System32\LROqtQo.exe
  C:\Windows\System32\LROqtQo.exe
  2⤵
  PID:7932
- C:\Windows\System32\vQmyOZu.exe
  C:\Windows\System32\vQmyOZu.exe
  2⤵
  PID:7956
- C:\Windows\System32\pABqfoX.exe
  C:\Windows\System32\pABqfoX.exe
  2⤵
  PID:8000
- C:\Windows\System32\wkQpCMu.exe
  C:\Windows\System32\wkQpCMu.exe
  2⤵
  PID:8020
- C:\Windows\System32\CHSzyDF.exe
  C:\Windows\System32\CHSzyDF.exe
  2⤵
  PID:8044
- C:\Windows\System32\heyuysa.exe
  C:\Windows\System32\heyuysa.exe
  2⤵
  PID:8072
- C:\Windows\System32\bzZvLpw.exe
  C:\Windows\System32\bzZvLpw.exe
  2⤵
  PID:8100
- C:\Windows\System32\GKwVXRf.exe
  C:\Windows\System32\GKwVXRf.exe
  2⤵
  PID:8128
- C:\Windows\System32\CnGNtGC.exe
  C:\Windows\System32\CnGNtGC.exe
  2⤵
  PID:8152
- C:\Windows\System32\kIlwRoo.exe
  C:\Windows\System32\kIlwRoo.exe
  2⤵
  PID:8180
- C:\Windows\System32\pLrmDSG.exe
  C:\Windows\System32\pLrmDSG.exe
  2⤵
  PID:7204
- C:\Windows\System32\iAcdPDS.exe
  C:\Windows\System32\iAcdPDS.exe
  2⤵
  PID:7288
- C:\Windows\System32\uJbbMag.exe
  C:\Windows\System32\uJbbMag.exe
  2⤵
  PID:7332
- C:\Windows\System32\VUOdrsj.exe
  C:\Windows\System32\VUOdrsj.exe
  2⤵
  PID:7216
- C:\Windows\System32\ragpHgx.exe
  C:\Windows\System32\ragpHgx.exe
  2⤵
  PID:7348
- C:\Windows\System32\HjqBCqz.exe
  C:\Windows\System32\HjqBCqz.exe
  2⤵
  PID:7396
- C:\Windows\System32\eSgGQum.exe
  C:\Windows\System32\eSgGQum.exe
  2⤵
  PID:7468
- C:\Windows\System32\vktJHZq.exe
  C:\Windows\System32\vktJHZq.exe
  2⤵
  PID:7552
- C:\Windows\System32\VXkPRVi.exe
  C:\Windows\System32\VXkPRVi.exe
  2⤵
  PID:7608
- C:\Windows\System32\KJSprNB.exe
  C:\Windows\System32\KJSprNB.exe
  2⤵
  PID:7728
- C:\Windows\System32\wIwhsfz.exe
  C:\Windows\System32\wIwhsfz.exe
  2⤵
  PID:7748
- C:\Windows\System32\trWgykc.exe
  C:\Windows\System32\trWgykc.exe
  2⤵
  PID:7848
- C:\Windows\System32\SOzcXYu.exe
  C:\Windows\System32\SOzcXYu.exe
  2⤵
  PID:7872
- C:\Windows\System32\YbgBpOX.exe
  C:\Windows\System32\YbgBpOX.exe
  2⤵
  PID:7928
- C:\Windows\System32\OCTkdgd.exe
  C:\Windows\System32\OCTkdgd.exe
  2⤵
  PID:8036
- C:\Windows\System32\sUWPTeI.exe
  C:\Windows\System32\sUWPTeI.exe
  2⤵
  PID:8096
- C:\Windows\System32\neQTzbF.exe
  C:\Windows\System32\neQTzbF.exe
  2⤵
  PID:8136
- C:\Windows\System32\hXINWwJ.exe
  C:\Windows\System32\hXINWwJ.exe
  2⤵
  PID:7208
- C:\Windows\System32\MXfTMHG.exe
  C:\Windows\System32\MXfTMHG.exe
  2⤵
  PID:7368
- C:\Windows\System32\PnBOtDi.exe
  C:\Windows\System32\PnBOtDi.exe
  2⤵
  PID:7444
- C:\Windows\System32\aXHYGeK.exe
  C:\Windows\System32\aXHYGeK.exe
  2⤵
  PID:7832
- C:\Windows\System32\BZXNzNh.exe
  C:\Windows\System32\BZXNzNh.exe
  2⤵
  PID:8008
- C:\Windows\System32\EmQyfPg.exe
  C:\Windows\System32\EmQyfPg.exe
  2⤵
  PID:8056
- C:\Windows\System32\YbYRkSq.exe
  C:\Windows\System32\YbYRkSq.exe
  2⤵
  PID:8120
- C:\Windows\System32\EuEoiuA.exe
  C:\Windows\System32\EuEoiuA.exe
  2⤵
  PID:6788
- C:\Windows\System32\FqgRftz.exe
  C:\Windows\System32\FqgRftz.exe
  2⤵
  PID:7392
- C:\Windows\System32\kOlxHhm.exe
  C:\Windows\System32\kOlxHhm.exe
  2⤵
  PID:7324
- C:\Windows\System32\XrghPLz.exe
  C:\Windows\System32\XrghPLz.exe
  2⤵
  PID:8200
- C:\Windows\System32\gwYTXCR.exe
  C:\Windows\System32\gwYTXCR.exe
  2⤵
  PID:8216
- C:\Windows\System32\bwGjsOZ.exe
  C:\Windows\System32\bwGjsOZ.exe
  2⤵
  PID:8232
- C:\Windows\System32\VlhZlBw.exe
  C:\Windows\System32\VlhZlBw.exe
  2⤵
  PID:8248
- C:\Windows\System32\XThMSgs.exe
  C:\Windows\System32\XThMSgs.exe
  2⤵
  PID:8264
- C:\Windows\System32\hPuASGu.exe
  C:\Windows\System32\hPuASGu.exe
  2⤵
  PID:8280
- C:\Windows\System32\tAkGuvw.exe
  C:\Windows\System32\tAkGuvw.exe
  2⤵
  PID:8296
- C:\Windows\System32\nTfwtvl.exe
  C:\Windows\System32\nTfwtvl.exe
  2⤵
  PID:8352
- C:\Windows\System32\dSSGelq.exe
  C:\Windows\System32\dSSGelq.exe
  2⤵
  PID:8400
- C:\Windows\System32\RZOxbJO.exe
  C:\Windows\System32\RZOxbJO.exe
  2⤵
  PID:8540
- C:\Windows\System32\vaCkpTC.exe
  C:\Windows\System32\vaCkpTC.exe
  2⤵
  PID:8564
- C:\Windows\System32\ZMVZAFi.exe
  C:\Windows\System32\ZMVZAFi.exe
  2⤵
  PID:8588
- C:\Windows\System32\uDbyqhk.exe
  C:\Windows\System32\uDbyqhk.exe
  2⤵
  PID:8628
- C:\Windows\System32\tlvUCSs.exe
  C:\Windows\System32\tlvUCSs.exe
  2⤵
  PID:8672
- C:\Windows\System32\dEpXeSz.exe
  C:\Windows\System32\dEpXeSz.exe
  2⤵
  PID:8700
- C:\Windows\System32\tmJNzPM.exe
  C:\Windows\System32\tmJNzPM.exe
  2⤵
  PID:8716
- C:\Windows\System32\vfyfWig.exe
  C:\Windows\System32\vfyfWig.exe
  2⤵
  PID:8736
- C:\Windows\System32\nMuVqBE.exe
  C:\Windows\System32\nMuVqBE.exe
  2⤵
  PID:8772
- C:\Windows\System32\XSbDgTg.exe
  C:\Windows\System32\XSbDgTg.exe
  2⤵
  PID:8812
- C:\Windows\System32\xfIGNDm.exe
  C:\Windows\System32\xfIGNDm.exe
  2⤵
  PID:8832
- C:\Windows\System32\HPFuvoN.exe
  C:\Windows\System32\HPFuvoN.exe
  2⤵
  PID:8848
- C:\Windows\System32\eydOMtw.exe
  C:\Windows\System32\eydOMtw.exe
  2⤵
  PID:8872
- C:\Windows\System32\XrVncDM.exe
  C:\Windows\System32\XrVncDM.exe
  2⤵
  PID:8888
- C:\Windows\System32\kDZJUrG.exe
  C:\Windows\System32\kDZJUrG.exe
  2⤵
  PID:8944
- C:\Windows\System32\gyLGYcw.exe
  C:\Windows\System32\gyLGYcw.exe
  2⤵
  PID:8976
- C:\Windows\System32\bwSnBEt.exe
  C:\Windows\System32\bwSnBEt.exe
  2⤵
  PID:9012
- C:\Windows\System32\YjQhfiv.exe
  C:\Windows\System32\YjQhfiv.exe
  2⤵
  PID:9028
- C:\Windows\System32\yCRMqPC.exe
  C:\Windows\System32\yCRMqPC.exe
  2⤵
  PID:9060
- C:\Windows\System32\hzEhcYb.exe
  C:\Windows\System32\hzEhcYb.exe
  2⤵
  PID:9088
- C:\Windows\System32\AuTmyYX.exe
  C:\Windows\System32\AuTmyYX.exe
  2⤵
  PID:9104
- C:\Windows\System32\VuxMytJ.exe
  C:\Windows\System32\VuxMytJ.exe
  2⤵
  PID:9128
- C:\Windows\System32\edGAyxD.exe
  C:\Windows\System32\edGAyxD.exe
  2⤵
  PID:9152
- C:\Windows\System32\DAuqHIJ.exe
  C:\Windows\System32\DAuqHIJ.exe
  2⤵
  PID:9168
- C:\Windows\System32\kujwgRA.exe
  C:\Windows\System32\kujwgRA.exe
  2⤵
  PID:9196
- C:\Windows\System32\IYlcQQE.exe
  C:\Windows\System32\IYlcQQE.exe
  2⤵
  PID:7636
- C:\Windows\System32\WRxHmio.exe
  C:\Windows\System32\WRxHmio.exe
  2⤵
  PID:7760
- C:\Windows\System32\iPJLOuL.exe
  C:\Windows\System32\iPJLOuL.exe
  2⤵
  PID:7804
- C:\Windows\System32\alxIYxP.exe
  C:\Windows\System32\alxIYxP.exe
  2⤵
  PID:5624
- C:\Windows\System32\jUUoZAZ.exe
  C:\Windows\System32\jUUoZAZ.exe
  2⤵
  PID:8320
- C:\Windows\System32\rOZbANy.exe
  C:\Windows\System32\rOZbANy.exe
  2⤵
  PID:8432
- C:\Windows\System32\cQitOUM.exe
  C:\Windows\System32\cQitOUM.exe
  2⤵
  PID:8596
- C:\Windows\System32\UcIdnjR.exe
  C:\Windows\System32\UcIdnjR.exe
  2⤵
  PID:8604
- C:\Windows\System32\XZHkRQF.exe
  C:\Windows\System32\XZHkRQF.exe
  2⤵
  PID:8692
- C:\Windows\System32\rfcXBjT.exe
  C:\Windows\System32\rfcXBjT.exe
  2⤵
  PID:8724
- C:\Windows\System32\qVqTcfA.exe
  C:\Windows\System32\qVqTcfA.exe
  2⤵
  PID:8780
- C:\Windows\System32\grhmoPn.exe
  C:\Windows\System32\grhmoPn.exe
  2⤵
  PID:8884
- C:\Windows\System32\pwgKcsz.exe
  C:\Windows\System32\pwgKcsz.exe
  2⤵
  PID:8880
- C:\Windows\System32\HrKBSqy.exe
  C:\Windows\System32\HrKBSqy.exe
  2⤵
  PID:9020
- C:\Windows\System32\VhiqNGj.exe
  C:\Windows\System32\VhiqNGj.exe
  2⤵
  PID:9080
- C:\Windows\System32\ldEDDRj.exe
  C:\Windows\System32\ldEDDRj.exe
  2⤵
  PID:9176
- C:\Windows\System32\TcWFXCL.exe
  C:\Windows\System32\TcWFXCL.exe
  2⤵
  PID:9164
- C:\Windows\System32\hCDRrqQ.exe
  C:\Windows\System32\hCDRrqQ.exe
  2⤵
  PID:6836
- C:\Windows\System32\duVGcLR.exe
  C:\Windows\System32\duVGcLR.exe
  2⤵
  PID:7676
- C:\Windows\System32\khMqnfT.exe
  C:\Windows\System32\khMqnfT.exe
  2⤵
  PID:7504
- C:\Windows\System32\ajoqBmh.exe
  C:\Windows\System32\ajoqBmh.exe
  2⤵
  PID:8636
- C:\Windows\System32\iiYOPvd.exe
  C:\Windows\System32\iiYOPvd.exe
  2⤵
  PID:8744
- C:\Windows\System32\NoPCauI.exe
  C:\Windows\System32\NoPCauI.exe
  2⤵
  PID:8856
- C:\Windows\System32\bcHJlFX.exe
  C:\Windows\System32\bcHJlFX.exe
  2⤵
  PID:8992
- C:\Windows\System32\HacMyCF.exe
  C:\Windows\System32\HacMyCF.exe
  2⤵
  PID:9096
- C:\Windows\System32\yTqYswB.exe
  C:\Windows\System32\yTqYswB.exe
  2⤵
  PID:8496
- C:\Windows\System32\uMSMTwE.exe
  C:\Windows\System32\uMSMTwE.exe
  2⤵
  PID:8620
- C:\Windows\System32\iRCIexJ.exe
  C:\Windows\System32\iRCIexJ.exe
  2⤵
  PID:8556
- C:\Windows\System32\xcsGvcO.exe
  C:\Windows\System32\xcsGvcO.exe
  2⤵
  PID:8940
- C:\Windows\System32\iwkMWIk.exe
  C:\Windows\System32\iwkMWIk.exe
  2⤵
  PID:9228
- C:\Windows\System32\HljLwlK.exe
  C:\Windows\System32\HljLwlK.exe
  2⤵
  PID:9244
- C:\Windows\System32\OkuNdie.exe
  C:\Windows\System32\OkuNdie.exe
  2⤵
  PID:9260
- C:\Windows\System32\YUfWSIv.exe
  C:\Windows\System32\YUfWSIv.exe
  2⤵
  PID:9284
- C:\Windows\System32\SuhIcYU.exe
  C:\Windows\System32\SuhIcYU.exe
  2⤵
  PID:9312
- C:\Windows\System32\XlXBCae.exe
  C:\Windows\System32\XlXBCae.exe
  2⤵
  PID:9332
- C:\Windows\System32\wweuaJW.exe
  C:\Windows\System32\wweuaJW.exe
  2⤵
  PID:9360
- C:\Windows\System32\CqYdWcd.exe
  C:\Windows\System32\CqYdWcd.exe
  2⤵
  PID:9384
- C:\Windows\System32\DWhUBDb.exe
  C:\Windows\System32\DWhUBDb.exe
  2⤵
  PID:9460
- C:\Windows\System32\tMHrqVx.exe
  C:\Windows\System32\tMHrqVx.exe
  2⤵
  PID:9476
- C:\Windows\System32\xEOgnpu.exe
  C:\Windows\System32\xEOgnpu.exe
  2⤵
  PID:9508
- C:\Windows\System32\FQNVCWj.exe
  C:\Windows\System32\FQNVCWj.exe
  2⤵
  PID:9560
- C:\Windows\System32\FSPtlYL.exe
  C:\Windows\System32\FSPtlYL.exe
  2⤵
  PID:9584
- C:\Windows\System32\IpQMDJS.exe
  C:\Windows\System32\IpQMDJS.exe
  2⤵
  PID:9604
- C:\Windows\System32\sCwPJCX.exe
  C:\Windows\System32\sCwPJCX.exe
  2⤵
  PID:9628
- C:\Windows\System32\rAeOmbJ.exe
  C:\Windows\System32\rAeOmbJ.exe
  2⤵
  PID:9660
- C:\Windows\System32\DJqnAzW.exe
  C:\Windows\System32\DJqnAzW.exe
  2⤵
  PID:9720
- C:\Windows\System32\RmtzZdq.exe
  C:\Windows\System32\RmtzZdq.exe
  2⤵
  PID:9736
- C:\Windows\System32\Ppclots.exe
  C:\Windows\System32\Ppclots.exe
  2⤵
  PID:9756
- C:\Windows\System32\mhJCqBJ.exe
  C:\Windows\System32\mhJCqBJ.exe
  2⤵
  PID:9772
- C:\Windows\System32\dlFJNRW.exe
  C:\Windows\System32\dlFJNRW.exe
  2⤵
  PID:9788
- C:\Windows\System32\JsCXPVF.exe
  C:\Windows\System32\JsCXPVF.exe
  2⤵
  PID:9804
- C:\Windows\System32\hUrHGxx.exe
  C:\Windows\System32\hUrHGxx.exe
  2⤵
  PID:9824
- C:\Windows\System32\GCJNEVn.exe
  C:\Windows\System32\GCJNEVn.exe
  2⤵
  PID:9840
- C:\Windows\System32\xjjkomn.exe
  C:\Windows\System32\xjjkomn.exe
  2⤵
  PID:9868
- C:\Windows\System32\bKiiSHI.exe
  C:\Windows\System32\bKiiSHI.exe
  2⤵
  PID:9884
- C:\Windows\System32\bWEOjom.exe
  C:\Windows\System32\bWEOjom.exe
  2⤵
  PID:9956
- C:\Windows\System32\LjjeJfi.exe
  C:\Windows\System32\LjjeJfi.exe
  2⤵
  PID:9972
- C:\Windows\System32\mLOQyav.exe
  C:\Windows\System32\mLOQyav.exe
  2⤵
  PID:10036
- C:\Windows\System32\elukTZx.exe
  C:\Windows\System32\elukTZx.exe
  2⤵
  PID:10068
- C:\Windows\System32\inCqDth.exe
  C:\Windows\System32\inCqDth.exe
  2⤵
  PID:10108
- C:\Windows\System32\HRgIhuU.exe
  C:\Windows\System32\HRgIhuU.exe
  2⤵
  PID:10124
- C:\Windows\System32\tLiNfjc.exe
  C:\Windows\System32\tLiNfjc.exe
  2⤵
  PID:10144
- C:\Windows\System32\NCbSsmF.exe
  C:\Windows\System32\NCbSsmF.exe
  2⤵
  PID:10184
- C:\Windows\System32\DYXDQwY.exe
  C:\Windows\System32\DYXDQwY.exe
  2⤵
  PID:10208
- C:\Windows\System32\YQKVuYK.exe
  C:\Windows\System32\YQKVuYK.exe
  2⤵
  PID:10224
- C:\Windows\System32\ovWzDjP.exe
  C:\Windows\System32\ovWzDjP.exe
  2⤵
  PID:8964
- C:\Windows\System32\AsIqwUg.exe
  C:\Windows\System32\AsIqwUg.exe
  2⤵
  PID:8808
- C:\Windows\System32\rCLQzMP.exe
  C:\Windows\System32\rCLQzMP.exe
  2⤵
  PID:9308
- C:\Windows\System32\klJBDZc.exe
  C:\Windows\System32\klJBDZc.exe
  2⤵
  PID:9380
- C:\Windows\System32\rKLOdjN.exe
  C:\Windows\System32\rKLOdjN.exe
  2⤵
  PID:9436
- C:\Windows\System32\tItzQES.exe
  C:\Windows\System32\tItzQES.exe
  2⤵
  PID:8560
- C:\Windows\System32\nIvHKIV.exe
  C:\Windows\System32\nIvHKIV.exe
  2⤵
  PID:9580
- C:\Windows\System32\SCLbMnY.exe
  C:\Windows\System32\SCLbMnY.exe
  2⤵
  PID:9612
- C:\Windows\System32\yyRiyXL.exe
  C:\Windows\System32\yyRiyXL.exe
  2⤵
  PID:9668
- C:\Windows\System32\AxLZnuw.exe
  C:\Windows\System32\AxLZnuw.exe
  2⤵
  PID:9744
- C:\Windows\System32\POedcif.exe
  C:\Windows\System32\POedcif.exe
  2⤵
  PID:9764
- C:\Windows\System32\iczowWB.exe
  C:\Windows\System32\iczowWB.exe
  2⤵
  PID:9908
- C:\Windows\System32\qpcsCaY.exe
  C:\Windows\System32\qpcsCaY.exe
  2⤵
  PID:9984
- C:\Windows\System32\VEQVOSh.exe
  C:\Windows\System32\VEQVOSh.exe
  2⤵
  PID:10052
- C:\Windows\System32\BQzrXNx.exe
  C:\Windows\System32\BQzrXNx.exe
  2⤵
  PID:10080
- C:\Windows\System32\OBQrmHp.exe
  C:\Windows\System32\OBQrmHp.exe
  2⤵
  PID:10140
- C:\Windows\System32\uzWFBbe.exe
  C:\Windows\System32\uzWFBbe.exe
  2⤵
  PID:10156
- C:\Windows\System32\kGxRPQJ.exe
  C:\Windows\System32\kGxRPQJ.exe
  2⤵
  PID:10216
- C:\Windows\System32\ZHEInPX.exe
  C:\Windows\System32\ZHEInPX.exe
  2⤵
  PID:9240
- C:\Windows\System32\lsZwaDe.exe
  C:\Windows\System32\lsZwaDe.exe
  2⤵
  PID:9424
- C:\Windows\System32\qbppMgH.exe
  C:\Windows\System32\qbppMgH.exe
  2⤵
  PID:9352
- C:\Windows\System32\BrDXOQB.exe
  C:\Windows\System32\BrDXOQB.exe
  2⤵
  PID:9484
- C:\Windows\System32\qHsXjWs.exe
  C:\Windows\System32\qHsXjWs.exe
  2⤵
  PID:9968
- C:\Windows\System32\rBlbejw.exe
  C:\Windows\System32\rBlbejw.exe
  2⤵
  PID:8800
- C:\Windows\System32\ZchrLQD.exe
  C:\Windows\System32\ZchrLQD.exe
  2⤵
  PID:10236
- C:\Windows\System32\rHgKGHv.exe
  C:\Windows\System32\rHgKGHv.exe
  2⤵
  PID:9864
- C:\Windows\System32\HDFYkEc.exe
  C:\Windows\System32\HDFYkEc.exe
  2⤵
  PID:10020
- C:\Windows\System32\OTyhtWF.exe
  C:\Windows\System32\OTyhtWF.exe
  2⤵
  PID:10204
- C:\Windows\System32\alWnGPE.exe
  C:\Windows\System32\alWnGPE.exe
  2⤵
  PID:9616
- C:\Windows\System32\UjznhZO.exe
  C:\Windows\System32\UjznhZO.exe
  2⤵
  PID:10248
- C:\Windows\System32\ymngDIw.exe
  C:\Windows\System32\ymngDIw.exe
  2⤵
  PID:10264
- C:\Windows\System32\cWEnACy.exe
  C:\Windows\System32\cWEnACy.exe
  2⤵
  PID:10304
- C:\Windows\System32\gGHVaJx.exe
  C:\Windows\System32\gGHVaJx.exe
  2⤵
  PID:10352
- C:\Windows\System32\dakWXkO.exe
  C:\Windows\System32\dakWXkO.exe
  2⤵
  PID:10404
- C:\Windows\System32\WpqxbAJ.exe
  C:\Windows\System32\WpqxbAJ.exe
  2⤵
  PID:10420
- C:\Windows\System32\YNfHdDF.exe
  C:\Windows\System32\YNfHdDF.exe
  2⤵
  PID:10436
- C:\Windows\System32\aiLDbtw.exe
  C:\Windows\System32\aiLDbtw.exe
  2⤵
  PID:10460
- C:\Windows\System32\mOPaeMF.exe
  C:\Windows\System32\mOPaeMF.exe
  2⤵
  PID:10480
- C:\Windows\System32\mncEJgG.exe
  C:\Windows\System32\mncEJgG.exe
  2⤵
  PID:10496
- C:\Windows\System32\tEQJwQt.exe
  C:\Windows\System32\tEQJwQt.exe
  2⤵
  PID:10536
- C:\Windows\System32\msESJtr.exe
  C:\Windows\System32\msESJtr.exe
  2⤵
  PID:10580
- C:\Windows\System32\uaCWKeo.exe
  C:\Windows\System32\uaCWKeo.exe
  2⤵
  PID:10608
- C:\Windows\System32\WeyZpzk.exe
  C:\Windows\System32\WeyZpzk.exe
  2⤵
  PID:10624
- C:\Windows\System32\yAUUxuL.exe
  C:\Windows\System32\yAUUxuL.exe
  2⤵
  PID:10660
- C:\Windows\System32\XSuXqHb.exe
  C:\Windows\System32\XSuXqHb.exe
  2⤵
  PID:10692
- C:\Windows\System32\lReOKeI.exe
  C:\Windows\System32\lReOKeI.exe
  2⤵
  PID:10728
- C:\Windows\System32\nmpaVQL.exe
  C:\Windows\System32\nmpaVQL.exe
  2⤵
  PID:10744
- C:\Windows\System32\lvzJuvU.exe
  C:\Windows\System32\lvzJuvU.exe
  2⤵
  PID:10764
- C:\Windows\System32\OUVBxwn.exe
  C:\Windows\System32\OUVBxwn.exe
  2⤵
  PID:10796
- C:\Windows\System32\hfwAIHo.exe
  C:\Windows\System32\hfwAIHo.exe
  2⤵
  PID:10840
- C:\Windows\System32\fZVPKhs.exe
  C:\Windows\System32\fZVPKhs.exe
  2⤵
  PID:10868
- C:\Windows\System32\ptnrHli.exe
  C:\Windows\System32\ptnrHli.exe
  2⤵
  PID:10904
- C:\Windows\System32\lVkmdVB.exe
  C:\Windows\System32\lVkmdVB.exe
  2⤵
  PID:10928
- C:\Windows\System32\TTTgowY.exe
  C:\Windows\System32\TTTgowY.exe
  2⤵
  PID:10948
- C:\Windows\System32\MVRDAff.exe
  C:\Windows\System32\MVRDAff.exe
  2⤵
  PID:10972
- C:\Windows\System32\peCybKP.exe
  C:\Windows\System32\peCybKP.exe
  2⤵
  PID:11000
- C:\Windows\System32\cRJuRXx.exe
  C:\Windows\System32\cRJuRXx.exe
  2⤵
  PID:11024
- C:\Windows\System32\jdUWTSa.exe
  C:\Windows\System32\jdUWTSa.exe
  2⤵
  PID:11068
- C:\Windows\System32\nucOtme.exe
  C:\Windows\System32\nucOtme.exe
  2⤵
  PID:11108
- C:\Windows\System32\rMOSzQj.exe
  C:\Windows\System32\rMOSzQj.exe
  2⤵
  PID:11132
- C:\Windows\System32\PTfiuqr.exe
  C:\Windows\System32\PTfiuqr.exe
  2⤵
  PID:11152
- C:\Windows\System32\ZsPNUcI.exe
  C:\Windows\System32\ZsPNUcI.exe
  2⤵
  PID:11172
- C:\Windows\System32\PsVYHRI.exe
  C:\Windows\System32\PsVYHRI.exe
  2⤵
  PID:11188
- C:\Windows\System32\LoovUdr.exe
  C:\Windows\System32\LoovUdr.exe
  2⤵
  PID:11216
- C:\Windows\System32\abohKYy.exe
  C:\Windows\System32\abohKYy.exe
  2⤵
  PID:9652
- C:\Windows\System32\QMwVYTv.exe
  C:\Windows\System32\QMwVYTv.exe
  2⤵
  PID:10244
- C:\Windows\System32\fRpMHnE.exe
  C:\Windows\System32\fRpMHnE.exe
  2⤵
  PID:10276
- C:\Windows\System32\LiFTsPO.exe
  C:\Windows\System32\LiFTsPO.exe
  2⤵
  PID:10376
- C:\Windows\System32\pclazDX.exe
  C:\Windows\System32\pclazDX.exe
  2⤵
  PID:10416
- C:\Windows\System32\GpmXJWc.exe
  C:\Windows\System32\GpmXJWc.exe
  2⤵
  PID:10512
- C:\Windows\System32\mzIPYNl.exe
  C:\Windows\System32\mzIPYNl.exe
  2⤵
  PID:10640
- C:\Windows\System32\EetNdaS.exe
  C:\Windows\System32\EetNdaS.exe
  2⤵
  PID:10616
- C:\Windows\System32\atESyew.exe
  C:\Windows\System32\atESyew.exe
  2⤵
  PID:10776
- C:\Windows\System32\JfACipG.exe
  C:\Windows\System32\JfACipG.exe
  2⤵
  PID:10784
- C:\Windows\System32\tPncpiZ.exe
  C:\Windows\System32\tPncpiZ.exe
  2⤵
  PID:10828
- C:\Windows\System32\fMxMnnr.exe
  C:\Windows\System32\fMxMnnr.exe
  2⤵
  PID:10892
- C:\Windows\System32\oSnqSWn.exe
  C:\Windows\System32\oSnqSWn.exe
  2⤵
  PID:10956
- C:\Windows\System32\XIlivls.exe
  C:\Windows\System32\XIlivls.exe
  2⤵
  PID:11076
- C:\Windows\System32\KHxpSXT.exe
  C:\Windows\System32\KHxpSXT.exe
  2⤵
  PID:11104
- C:\Windows\System32\NEWeSAp.exe
  C:\Windows\System32\NEWeSAp.exe
  2⤵
  PID:11168
- C:\Windows\System32\bAmSXSB.exe
  C:\Windows\System32\bAmSXSB.exe
  2⤵
  PID:10256
- C:\Windows\System32\WwcYzir.exe
  C:\Windows\System32\WwcYzir.exe
  2⤵
  PID:10372
- C:\Windows\System32\cHELFYh.exe
  C:\Windows\System32\cHELFYh.exe
  2⤵
  PID:10488
- C:\Windows\System32\tNwLnXz.exe
  C:\Windows\System32\tNwLnXz.exe
  2⤵
  PID:10564
- C:\Windows\System32\OCDXaGG.exe
  C:\Windows\System32\OCDXaGG.exe
  2⤵
  PID:10812
- C:\Windows\System32\GStKlkn.exe
  C:\Windows\System32\GStKlkn.exe
  2⤵
  PID:10820
- C:\Windows\System32\eavjnuS.exe
  C:\Windows\System32\eavjnuS.exe
  2⤵
  PID:11020
- C:\Windows\System32\vMyljCc.exe
  C:\Windows\System32\vMyljCc.exe
  2⤵
  PID:11160
- C:\Windows\System32\dabruWR.exe
  C:\Windows\System32\dabruWR.exe
  2⤵
  PID:11184
- C:\Windows\System32\yAqMHeJ.exe
  C:\Windows\System32\yAqMHeJ.exe
  2⤵
  PID:10968
- C:\Windows\System32\kwvYSPu.exe
  C:\Windows\System32\kwvYSPu.exe
  2⤵
  PID:11196
- C:\Windows\System32\bXaWPug.exe
  C:\Windows\System32\bXaWPug.exe
  2⤵
  PID:11268
- C:\Windows\System32\iIptnOy.exe
  C:\Windows\System32\iIptnOy.exe
  2⤵
  PID:11284
- C:\Windows\System32\jSmMsHp.exe
  C:\Windows\System32\jSmMsHp.exe
  2⤵
  PID:11300
- C:\Windows\System32\ifSWHhG.exe
  C:\Windows\System32\ifSWHhG.exe
  2⤵
  PID:11320
- C:\Windows\System32\zvJJTSM.exe
  C:\Windows\System32\zvJJTSM.exe
  2⤵
  PID:11344
- C:\Windows\System32\ToXXTpO.exe
  C:\Windows\System32\ToXXTpO.exe
  2⤵
  PID:11388
- C:\Windows\System32\gRmnRXc.exe
  C:\Windows\System32\gRmnRXc.exe
  2⤵
  PID:11416
- C:\Windows\System32\kfanVQF.exe
  C:\Windows\System32\kfanVQF.exe
  2⤵
  PID:11448
- C:\Windows\System32\AgYmMFC.exe
  C:\Windows\System32\AgYmMFC.exe
  2⤵
  PID:11464
- C:\Windows\System32\kOWKeGT.exe
  C:\Windows\System32\kOWKeGT.exe
  2⤵
  PID:11500
- C:\Windows\System32\wdhORJt.exe
  C:\Windows\System32\wdhORJt.exe
  2⤵
  PID:11524
- C:\Windows\System32\gcsjrCK.exe
  C:\Windows\System32\gcsjrCK.exe
  2⤵
  PID:11552
- C:\Windows\System32\ZHLFvAy.exe
  C:\Windows\System32\ZHLFvAy.exe
  2⤵
  PID:11576
- C:\Windows\System32\JQGJplk.exe
  C:\Windows\System32\JQGJplk.exe
  2⤵
  PID:11596
- C:\Windows\System32\bSXPqLr.exe
  C:\Windows\System32\bSXPqLr.exe
  2⤵
  PID:11636
- C:\Windows\System32\rIbQnxX.exe
  C:\Windows\System32\rIbQnxX.exe
  2⤵
  PID:11680
- C:\Windows\System32\mVhTckZ.exe
  C:\Windows\System32\mVhTckZ.exe
  2⤵
  PID:11716
- C:\Windows\System32\SaDcyDd.exe
  C:\Windows\System32\SaDcyDd.exe
  2⤵
  PID:11732
- C:\Windows\System32\ZlJxmPv.exe
  C:\Windows\System32\ZlJxmPv.exe
  2⤵
  PID:11752
- C:\Windows\System32\VwTptKj.exe
  C:\Windows\System32\VwTptKj.exe
  2⤵
  PID:11776
- C:\Windows\System32\GXqPyfV.exe
  C:\Windows\System32\GXqPyfV.exe
  2⤵
  PID:11816
- C:\Windows\System32\NgmTrvo.exe
  C:\Windows\System32\NgmTrvo.exe
  2⤵
  PID:11844
- C:\Windows\System32\dZacbFV.exe
  C:\Windows\System32\dZacbFV.exe
  2⤵
  PID:11868
- C:\Windows\System32\gMXzOiN.exe
  C:\Windows\System32\gMXzOiN.exe
  2⤵
  PID:11908
- C:\Windows\System32\GFfcpMd.exe
  C:\Windows\System32\GFfcpMd.exe
  2⤵
  PID:11928
- C:\Windows\System32\EGpMrZO.exe
  C:\Windows\System32\EGpMrZO.exe
  2⤵
  PID:11968
- C:\Windows\System32\sIeIYYE.exe
  C:\Windows\System32\sIeIYYE.exe
  2⤵
  PID:11984
- C:\Windows\System32\jwsKhMM.exe
  C:\Windows\System32\jwsKhMM.exe
  2⤵
  PID:12004
- C:\Windows\System32\OHFungS.exe
  C:\Windows\System32\OHFungS.exe
  2⤵
  PID:12028
- C:\Windows\System32\DsaaDqG.exe
  C:\Windows\System32\DsaaDqG.exe
  2⤵
  PID:12060
- C:\Windows\System32\SYHMlXU.exe
  C:\Windows\System32\SYHMlXU.exe
  2⤵
  PID:12080
- C:\Windows\System32\TQCdHcF.exe
  C:\Windows\System32\TQCdHcF.exe
  2⤵
  PID:12100
- C:\Windows\System32\HstNhmm.exe
  C:\Windows\System32\HstNhmm.exe
  2⤵
  PID:12128
- C:\Windows\System32\kJwKJyw.exe
  C:\Windows\System32\kJwKJyw.exe
  2⤵
  PID:12152
- C:\Windows\System32\ObFRUcI.exe
  C:\Windows\System32\ObFRUcI.exe
  2⤵
  PID:12192
- C:\Windows\System32\bAVGVGo.exe
  C:\Windows\System32\bAVGVGo.exe
  2⤵
  PID:12216
- C:\Windows\System32\KahAcvi.exe
  C:\Windows\System32\KahAcvi.exe
  2⤵
  PID:12232
- C:\Windows\System32\GSWsczV.exe
  C:\Windows\System32\GSWsczV.exe
  2⤵
  PID:12284
- C:\Windows\System32\EPHvduk.exe
  C:\Windows\System32\EPHvduk.exe
  2⤵
  PID:11336
- C:\Windows\System32\RPzAzoU.exe
  C:\Windows\System32\RPzAzoU.exe
  2⤵
  PID:11352
- C:\Windows\System32\nkbfspp.exe
  C:\Windows\System32\nkbfspp.exe
  2⤵
  PID:11408
- C:\Windows\System32\nQAZHrA.exe
  C:\Windows\System32\nQAZHrA.exe
  2⤵
  PID:11476
- C:\Windows\System32\VPwgtWu.exe
  C:\Windows\System32\VPwgtWu.exe
  2⤵
  PID:11612
- C:\Windows\System32\HIfYezZ.exe
  C:\Windows\System32\HIfYezZ.exe
  2⤵
  PID:10900
- C:\Windows\System32\BkufzaG.exe
  C:\Windows\System32\BkufzaG.exe
  2⤵
  PID:11724
- C:\Windows\System32\fhqsVXs.exe
  C:\Windows\System32\fhqsVXs.exe
  2⤵
  PID:11772
- C:\Windows\System32\ebObfNC.exe
  C:\Windows\System32\ebObfNC.exe
  2⤵
  PID:11860
- C:\Windows\System32\aOtCnaq.exe
  C:\Windows\System32\aOtCnaq.exe
  2⤵
  PID:11916
- C:\Windows\System32\uWJyJCu.exe
  C:\Windows\System32\uWJyJCu.exe
  2⤵
  PID:11948
- C:\Windows\System32\pROEsfd.exe
  C:\Windows\System32\pROEsfd.exe
  2⤵
  PID:12024
- C:\Windows\System32\CZDgnHa.exe
  C:\Windows\System32\CZDgnHa.exe
  2⤵
  PID:12096
- C:\Windows\System32\EIMBrMJ.exe
  C:\Windows\System32\EIMBrMJ.exe
  2⤵
  PID:12124
- C:\Windows\System32\euVkDpM.exe
  C:\Windows\System32\euVkDpM.exe
  2⤵
  PID:12200
- C:\Windows\System32\uWphbMk.exe
  C:\Windows\System32\uWphbMk.exe
  2⤵
  PID:11412
- C:\Windows\System32\zdwGEtC.exe
  C:\Windows\System32\zdwGEtC.exe
  2⤵
  PID:11508
- C:\Windows\System32\XOgocFd.exe
  C:\Windows\System32\XOgocFd.exe
  2⤵
  PID:11660
- C:\Windows\System32\OHRlvZw.exe
  C:\Windows\System32\OHRlvZw.exe
  2⤵
  PID:11900
- C:\Windows\System32\IZwVgoU.exe
  C:\Windows\System32\IZwVgoU.exe
  2⤵
  PID:11976
- C:\Windows\System32\MGaazoZ.exe
  C:\Windows\System32\MGaazoZ.exe
  2⤵
  PID:12248
- C:\Windows\System32\TZlofkD.exe
  C:\Windows\System32\TZlofkD.exe
  2⤵
  PID:11292
- C:\Windows\System32\eYbnBZO.exe
  C:\Windows\System32\eYbnBZO.exe
  2⤵
  PID:11620
- C:\Windows\System32\GFLZAHa.exe
  C:\Windows\System32\GFLZAHa.exe
  2⤵
  PID:11964
- C:\Windows\System32\OhpGdCR.exe
  C:\Windows\System32\OhpGdCR.exe
  2⤵
  PID:12112
- C:\Windows\System32\oDqzhQG.exe
  C:\Windows\System32\oDqzhQG.exe
  2⤵
  PID:2580
- C:\Windows\System32\KThkExg.exe
  C:\Windows\System32\KThkExg.exe
  2⤵
  PID:12360
- C:\Windows\System32\teMYxOW.exe
  C:\Windows\System32\teMYxOW.exe
  2⤵
  PID:12384
- C:\Windows\System32\mNPLjpV.exe
  C:\Windows\System32\mNPLjpV.exe
  2⤵
  PID:12404
- C:\Windows\System32\TmcdvEQ.exe
  C:\Windows\System32\TmcdvEQ.exe
  2⤵
  PID:12424
- C:\Windows\System32\xKDKwpc.exe
  C:\Windows\System32\xKDKwpc.exe
  2⤵
  PID:12444
- C:\Windows\System32\DCRfPTP.exe
  C:\Windows\System32\DCRfPTP.exe
  2⤵
  PID:12464
- C:\Windows\System32\NTgLQjh.exe
  C:\Windows\System32\NTgLQjh.exe
  2⤵
  PID:12508
- C:\Windows\System32\oRattJU.exe
  C:\Windows\System32\oRattJU.exe
  2⤵
  PID:12528
- C:\Windows\System32\oVrqRSb.exe
  C:\Windows\System32\oVrqRSb.exe
  2⤵
  PID:12560
- C:\Windows\System32\CMAlqFQ.exe
  C:\Windows\System32\CMAlqFQ.exe
  2⤵
  PID:12576
- C:\Windows\System32\jlNoPBx.exe
  C:\Windows\System32\jlNoPBx.exe
  2⤵
  PID:12608
- C:\Windows\System32\PYGHQin.exe
  C:\Windows\System32\PYGHQin.exe
  2⤵
  PID:12632
- C:\Windows\System32\UkOBwEV.exe
  C:\Windows\System32\UkOBwEV.exe
  2⤵
  PID:12664
- C:\Windows\System32\AkvOEsV.exe
  C:\Windows\System32\AkvOEsV.exe
  2⤵
  PID:12696
- C:\Windows\System32\CgFsDpw.exe
  C:\Windows\System32\CgFsDpw.exe
  2⤵
  PID:12720
- C:\Windows\System32\AtISqbl.exe
  C:\Windows\System32\AtISqbl.exe
  2⤵
  PID:12764
- C:\Windows\System32\IzQDyIA.exe
  C:\Windows\System32\IzQDyIA.exe
  2⤵
  PID:12796
- C:\Windows\System32\BFwIaZa.exe
  C:\Windows\System32\BFwIaZa.exe
  2⤵
  PID:12820
- C:\Windows\System32\nGizeGi.exe
  C:\Windows\System32\nGizeGi.exe
  2⤵
  PID:12852
- C:\Windows\System32\DyAVpyL.exe
  C:\Windows\System32\DyAVpyL.exe
  2⤵
  PID:12880
- C:\Windows\System32\DycdYbd.exe
  C:\Windows\System32\DycdYbd.exe
  2⤵
  PID:12900
- C:\Windows\System32\IIOzRMl.exe
  C:\Windows\System32\IIOzRMl.exe
  2⤵
  PID:12936
- C:\Windows\System32\ASjQWME.exe
  C:\Windows\System32\ASjQWME.exe
  2⤵
  PID:12956
- C:\Windows\System32\MSmbwsp.exe
  C:\Windows\System32\MSmbwsp.exe
  2⤵
  PID:12996
- C:\Windows\System32\ThCSzSA.exe
  C:\Windows\System32\ThCSzSA.exe
  2⤵
  PID:13016
- C:\Windows\System32\WmfemqY.exe
  C:\Windows\System32\WmfemqY.exe
  2⤵
  PID:13044
- C:\Windows\System32\jmwlADY.exe
  C:\Windows\System32\jmwlADY.exe
  2⤵
  PID:13080
- C:\Windows\System32\mIEmwfq.exe
  C:\Windows\System32\mIEmwfq.exe
  2⤵
  PID:13132
- C:\Windows\System32\jjcOfso.exe
  C:\Windows\System32\jjcOfso.exe
  2⤵
  PID:13160
- C:\Windows\System32\yrRnJMc.exe
  C:\Windows\System32\yrRnJMc.exe
  2⤵
  PID:13188
- C:\Windows\System32\RuxODat.exe
  C:\Windows\System32\RuxODat.exe
  2⤵
  PID:13212
- C:\Windows\System32\OldobLi.exe
  C:\Windows\System32\OldobLi.exe
  2⤵
  PID:13228
- C:\Windows\System32\RBKmRyl.exe
  C:\Windows\System32\RBKmRyl.exe
  2⤵
  PID:13248
- C:\Windows\System32\ICheazb.exe
  C:\Windows\System32\ICheazb.exe
  2⤵
  PID:13268
- C:\Windows\System32\nDxPCKE.exe
  C:\Windows\System32\nDxPCKE.exe
  2⤵
  PID:13292
- C:\Windows\System32\FlzmWco.exe
  C:\Windows\System32\FlzmWco.exe
  2⤵
  PID:12056
- C:\Windows\System32\vOLtWlL.exe
  C:\Windows\System32\vOLtWlL.exe
  2⤵
  PID:12376
- C:\Windows\System32\uLxpaVs.exe
  C:\Windows\System32\uLxpaVs.exe
  2⤵
  PID:12440
- C:\Windows\System32\roHtPub.exe
  C:\Windows\System32\roHtPub.exe
  2⤵
  PID:12472
- C:\Windows\System32\joVgdYG.exe
  C:\Windows\System32\joVgdYG.exe
  2⤵
  PID:12552
- C:\Windows\System32\IWzkvdc.exe
  C:\Windows\System32\IWzkvdc.exe
  2⤵
  PID:12584
- C:\Windows\System32\oovTnka.exe
  C:\Windows\System32\oovTnka.exe
  2⤵
  PID:12604
- C:\Windows\System32\wBdelhI.exe
  C:\Windows\System32\wBdelhI.exe
  2⤵
  PID:12728
- C:\Windows\System32\VthzWFu.exe
  C:\Windows\System32\VthzWFu.exe
  2⤵
  PID:12836
- C:\Windows\System32\FUfMODA.exe
  C:\Windows\System32\FUfMODA.exe
  2⤵
  PID:12860
- C:\Windows\System32\hpObkDJ.exe
  C:\Windows\System32\hpObkDJ.exe
  2⤵
  PID:12944
- C:\Windows\System32\pDbQklA.exe
  C:\Windows\System32\pDbQklA.exe
  2⤵
  PID:12928
- C:\Windows\System32\CxWTSCg.exe
  C:\Windows\System32\CxWTSCg.exe
  2⤵
  PID:13052
- C:\Windows\System32\uoPWKjs.exe
  C:\Windows\System32\uoPWKjs.exe
  2⤵
  PID:13088
- C:\Windows\System32\OzlWbMB.exe
  C:\Windows\System32\OzlWbMB.exe
  2⤵
  PID:13224
- C:\Windows\System32\aunkGfh.exe
  C:\Windows\System32\aunkGfh.exe
  2⤵
  PID:13304
- C:\Windows\System32\TYeOwrH.exe
  C:\Windows\System32\TYeOwrH.exe
  2⤵
  PID:11936
- C:\Windows\System32\maEeVgM.exe
  C:\Windows\System32\maEeVgM.exe
  2⤵
  PID:12416
- C:\Windows\System32\aBWVWUX.exe
  C:\Windows\System32\aBWVWUX.exe
  2⤵
  PID:12524
- C:\Windows\System32\gFccOEg.exe
  C:\Windows\System32\gFccOEg.exe
  2⤵
  PID:12772
- C:\Windows\System32\NXciUXX.exe
  C:\Windows\System32\NXciUXX.exe
  2⤵
  PID:12872
- C:\Windows\System32\FWBnaqd.exe
  C:\Windows\System32\FWBnaqd.exe
  2⤵
  PID:12980
- C:\Windows\System32\WeOPMTv.exe
  C:\Windows\System32\WeOPMTv.exe
  2⤵
  PID:13120
- C:\Windows\System32\DGUYMVP.exe
  C:\Windows\System32\DGUYMVP.exe
  2⤵
  PID:13196
- C:\Windows\System32\tOZrnBs.exe
  C:\Windows\System32\tOZrnBs.exe
  2⤵
  PID:12988
- C:\Windows\System32\YkUIpZX.exe
  C:\Windows\System32\YkUIpZX.exe
  2⤵
  PID:13240
- C:\Windows\System32\oYWBFCE.exe
  C:\Windows\System32\oYWBFCE.exe
  2⤵
  PID:13336
- C:\Windows\System32\YokUIqi.exe
  C:\Windows\System32\YokUIqi.exe
  2⤵
  PID:13352
- C:\Windows\System32\WJEheRo.exe
  C:\Windows\System32\WJEheRo.exe
  2⤵
  PID:13372
- C:\Windows\System32\vEdokOf.exe
  C:\Windows\System32\vEdokOf.exe
  2⤵
  PID:13412
- C:\Windows\System32\TOXZMHw.exe
  C:\Windows\System32\TOXZMHw.exe
  2⤵
  PID:13432
- C:\Windows\System32\yBWURdh.exe
  C:\Windows\System32\yBWURdh.exe
  2⤵
  PID:13512
- C:\Windows\System32\mlDpSOD.exe
  C:\Windows\System32\mlDpSOD.exe
  2⤵
  PID:13568
- C:\Windows\System32\qwAKuWe.exe
  C:\Windows\System32\qwAKuWe.exe
  2⤵
  PID:13584
- C:\Windows\System32\AJNBegs.exe
  C:\Windows\System32\AJNBegs.exe
  2⤵
  PID:13608
- C:\Windows\System32\tDeioPv.exe
  C:\Windows\System32\tDeioPv.exe
  2⤵
  PID:13640
- C:\Windows\System32\HlTWxip.exe
  C:\Windows\System32\HlTWxip.exe
  2⤵
  PID:13656
- C:\Windows\System32\KJEFiiI.exe
  C:\Windows\System32\KJEFiiI.exe
  2⤵
  PID:13684
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 13684 -s 244
    3⤵
    PID:14260
- C:\Windows\System32\rQnYzEU.exe
  C:\Windows\System32\rQnYzEU.exe
  2⤵
  PID:13712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\CmydCUK.exe

Filesize
1.1MB

MD5
c9e109c6f12b6b40799ce55f880ad9a2

SHA1
d41dda4dac225650a1bb482aaef646abbcef9acb

SHA256
3867b58fa1acf35f1ebc61b2e265af12a795adab4ee3300963cb9b324b928855

SHA512
836a5ccff7b7dbbd0dbb0fa95c14228f56e4fd7d64ee6218d995179af2a35a5242729e838e33bda32cf495631f503782f98e6ff2ac2273650199c0d4e3efbc5c

Download Submit
C:\Windows\System32\EYrQJlc.exe

Filesize
1.1MB

MD5
c1aafb2864a70c97669393d9e791b997

SHA1
a902f4459d1f119ba6e9b5280ed8f07322e360ca

SHA256
0150c98dc12f7b3edebf8ffb44e410c3326b41985f1cd32ed4307713bea87770

SHA512
7599e2187469aedc44fe58e0b3c2695310d3ab88e05ce3ee5ffbd0535428b99c47c5fe4c82361146695f78052bb68de198be3d94bf9d21af187c01862b0a92a5

Download Submit
C:\Windows\System32\GgxjJfK.exe

Filesize
1.1MB

MD5
f73de30ba93c569b58bb8bf0547031a0

SHA1
81aaafba017c982072ac330af9cae990f4eed50c

SHA256
b5109f41b03c275cb42e463b99ff96aa5543fbfad6b01d3cae03f4b50a34a3ae

SHA512
985fc73a4e63b78d12525c74f3cf22c841b2bf3740b4b148e85fe97c771c5131acacb3c0e4e29d691a7a0efbd07df7dd963f5346ccadf8cacac4aed0042ad80d

Download Submit
C:\Windows\System32\HStpwZM.exe

Filesize
1.1MB

MD5
62c15be837ecd3d2899b684db6da5db4

SHA1
e0a5725ad625cc3aeb5b328d5d2a72376e026624

SHA256
6bf3b1e7bbd30eb891c9574e23bfaef3a479f1f60bbe8079e3185d366c311138

SHA512
b548c0a64187f16007bc050a2a57ef6d6c7a5de743f7d211d5f99e14853f5db0a9aa4f920d1760977daf1966e81a063ff08d7f100148335d098cb699f37d3ffd

Download Submit
C:\Windows\System32\HwVRSUm.exe

Filesize
1.1MB

MD5
8165521bdd3d8195078a7d16e3404cea

SHA1
a1ff0806ec31ced79a5b2d3b0ddfffa9007d3ef9

SHA256
d59c165dd23fab08cf6526a23a5cb57188508d897fcaeae8ec98d4fcd6bae5d7

SHA512
4a3d6ae85c5f5c0ca64959bd54a5744a698ba717ed8f692034076cdd0df0fc25d847d4fb74ef2b2ff2eb3ae875dba0b6c2cdd493f99f4a92286def741ed05935

Download Submit
C:\Windows\System32\JamdffP.exe

Filesize
1.1MB

MD5
348acbc55c0018960b6ea39483264325

SHA1
60637f6b8a93ee3f66eb5102e16b018609d3d12c

SHA256
c939dde87af48616b49d8f8708a73d04e3a70f45a0ad106f854ca80b8cd37da4

SHA512
cea92cbf5b026a4b85663ec0d8d94e42200ee7309cbc9eab1fab36981224489db8b6149987a9f522dc78691c9783ea26d9be9a82668c176de46d84eeb01c90b8

Download Submit
C:\Windows\System32\OAlBBzF.exe

Filesize
1.1MB

MD5
d04f7a9461787b98cd9a49b810ebd3d6

SHA1
a7bb875cd893366b34b8e54f9da72c6495bd6f23

SHA256
df51f33ae86e655f5c80d0e4926961f4c80743b72d41a4dca50a04a0286ebd62

SHA512
c88a47237044bbeeca4576846eed83b8306b080d6b553325806043e44356027b5a978cdd9b285e76c582e438312f97a41befe3f2419c6ea23ec1ae1adb058331

Download Submit
C:\Windows\System32\PDXmYXY.exe

Filesize
1.1MB

MD5
c161055c03321eb10ce5e3d9885b0ee1

SHA1
05748613ce3711e004e5ea2c0128b59e2de64b0e

SHA256
c14ce49cbaa6d3fd2911ced61db145442138314329af5771dfc95006e901b3e5

SHA512
a270648e0c8eae35122f7dcdd72bb2d0a035217089ede5597b52ef4a9b0ac85f9e5adc578031a057911cb685d472fd573c2b8033417dd5bc6171a6fa7f9eeee7

Download Submit
C:\Windows\System32\PfddCco.exe

Filesize
1.1MB

MD5
ee5d59d3bbd7e68c50243123abc3e924

SHA1
264e401c731b576b6d79c55ed094658c7ce1d394

SHA256
20893ca7f2a0b129c54cc8ae6fa1608ed38a48db582933ccf69e9df593baa0fa

SHA512
b633d6340608e0310329934bb3bcb74bc8a0a54f146e3c14907b277c1d85649bea80572a9a503cb85f41998189df71af09c1d0dfa4df80d9ae2349832a87014f

Download Submit
C:\Windows\System32\SLsybsY.exe

Filesize
1.1MB

MD5
e478af41642add9d3116f2b7240dff8f

SHA1
926229e7f84dc9385cf48aab78d0758bcf45f7df

SHA256
3e5abe17a317a51229aacb22510abbc6c55b63c1d0b21df88b6d600d9d0aebd3

SHA512
507801fdc134ffe0fe765ce23040619a8d165be9ef9362c268c6b6a8f1b8ac5f4e50ecf6dfead80a1c6b7e6f2804c2c77733e8df9ea6ee6a31ffae5e5de6b6aa

Download Submit
C:\Windows\System32\TsaSYom.exe

Filesize
1.1MB

MD5
22331deae673efd6a5c8c533acbf29f5

SHA1
63b7471b6b5cb1dadba5d5c2fb6fbe2228998fa5

SHA256
0a8363430f99c664a62f344fae718ac45dc199cefdaa963f13f821bef75d8a82

SHA512
4d096aa58738b6f2aad504d220126af5e41f180687db335249b003b21352bb9e15f57f819036e966d4872a6e5a31cd8976c86e3b5080668659feeb08accf03ad

Download Submit
C:\Windows\System32\TxNLgrC.exe

Filesize
1.1MB

MD5
a6b934d91038f8aec3e8a4b5dd3b7973

SHA1
b6f57957f332c58d32cfcbab0456a261cf46e49f

SHA256
273132040a2a6a71e67d81203250e01fdefbe03c4c8d463d01e3c8119b14dab5

SHA512
7a0f84be6c9710cbd829c3240136b49d50491fdfb3e0dbf41c9c16f941db71a59ce440d1f18b620d0106dd6c6c78abe987888e59404c1c23d57cf5a617cd8ac9

Download Submit
C:\Windows\System32\UquImrv.exe

Filesize
1.1MB

MD5
c6a57a54422b1decd42003c0692ce1f9

SHA1
915bdce5b87d0e382a4dc7baf1cc72e0e44f21d6

SHA256
2a567bb2bf0c4c30bbb91620234381402bcd4bcdb4dcddc860897dc50a511efb

SHA512
c71c7fb394f9036cf0915e62c05f015b6532ecdabfd8ecfe42db789535a5d8755c1cd418a820a3001ab163f14dd5c7c16920b08e1afbef99778f620fd168d0cf

Download Submit
C:\Windows\System32\VOCxAmv.exe

Filesize
1.1MB

MD5
4d06c1bd6ccd60a76f772e07b6213985

SHA1
fc77e8505c1dac944f137ef3b1f3e71d5b5b3c0e

SHA256
3e9f018c4b1d2a0b7dec2366a69becf90d147928faa1b8239ff9ee987450ebbc

SHA512
7b3db6f2429244ba8f7f302dca6eb78ba1ede1c106ff50a21c04158ecee01b0b1ddff2c58e4d59f06f1979ba131c5d2f9bae2b925341a4dc03c06816d87472f3

Download Submit
C:\Windows\System32\XFxrpAA.exe

Filesize
1.1MB

MD5
4dca49b79bc2af8265fd12d1ba7687f2

SHA1
a9fb8c0d1d0f018a8e87db08bfd78be1d4434057

SHA256
e3441827f1ed76665924c0a7ffaf299cda1fbe4b4c1c8595e2113668a2578d9b

SHA512
5a44ee04a6c4bd2860f4619c4f3f1df4f187f09bbe530edaf384ad830d408e84f191a1595ad80921cc4f54edbad2cebf8bfcd125d11bdf177e611b4ce524cc1c

Download Submit
C:\Windows\System32\XsclXVy.exe

Filesize
1.1MB

MD5
7944333e8f7a912a4e05a00d04698647

SHA1
3258eb2416643db8985408cb0ec24edf97d569b7

SHA256
ad3a618b69913a03751706613c0b22324b108ea6c698f581b885fb7b4dabc529

SHA512
13898a97d6fa69cd7a2fae50134b716486812596085a1052344f8270cbd6149f84c5213de1484304e70fc4a5cf31efa02684aa206c5e510890bf14929ad1ad42

Download Submit
C:\Windows\System32\agmVRcs.exe

Filesize
1.1MB

MD5
8a6f6cb70d14426ead55bf32cff585dd

SHA1
25f3499bae1f82fd95f3e6ed51e910932099c40e

SHA256
ccd399ee8c331ebdac41f8d7be8401fa36fd22f7028bc5347cf209da98d3d50a

SHA512
be8a17187d66f93405222e7b0f26441d142787e466be39ab06b2f852711dadc0a16042ec059bddf71aec78ee2cfeec6d3483ec9ea4a04c6027466bb02c3997b0

Download Submit
C:\Windows\System32\bIwQMjA.exe

Filesize
1.1MB

MD5
b3dac297ba52cfdecf2c63caa13ed30f

SHA1
3e6946bb881b8a19fedaf2498aed060a336a98dc

SHA256
3944501d89de27e343175792fd756af9db6e1beb6b09754bc7cb4423f64b8fb6

SHA512
94a4d606a1cbfd34707f18b3e5959d7b91e58f0f756a87a464b894fe9e3edc2b89bd4cc428f67b38827a18b0ea15d8b48509699c7a93fc8684f4f06e6ba646fd

Download Submit
C:\Windows\System32\bKbukKR.exe

Filesize
1.1MB

MD5
0e200e5d8f3c934cdd080843eb650754

SHA1
d7fce862ab847da1ace6af349386053198966c51

SHA256
583d48972c44bddf94466f707ab31e8c476ddd31cc138a9cf03ee4cb28c31a00

SHA512
b20974cba3b0200db5c0fdfa191c22ce5b7844b48c37c5adef6856eb903c272bb993ab47ad859d1776f97eeaaee83c2a34c10b5d93d89cd1839ff633810ebab8

Download Submit
C:\Windows\System32\bNvExUL.exe

Filesize
1.1MB

MD5
816ef90fbf402f1f4257956816a7dd26

SHA1
8f1a6b05e014b49d7583b7162f25992b3781b768

SHA256
328ab6bff13ed30b0c9d19bc38b08c1b9ec6ab127085bfd0ea6374f4f7233eb6

SHA512
5fa884cb08a88856be7cd684f3ad3681d4093744d18b4f278ed3fc41b81ed33077bd2dea2d112493cf1d1ebf76c6237c36d5ed98c4a0cffd39c63332645eabec

Download Submit
C:\Windows\System32\cWpdXSX.exe

Filesize
1.1MB

MD5
d21ae73b05c882c7918e08add16dc4da

SHA1
55c63fab9494512a0a55f9c333b745ac790de447

SHA256
aba7d62b8a50fc3dc111587296f4105bf142917c46b9a18f03b5f1ecae779bbc

SHA512
d377e62b2ad1129d42a4bd60125edb3ba8289f1001ea3829c24d9d0ebcde7d7d91fba8409d83aa4b747f75c5b450090cddc3a5720504a0de79058f6bd3014d44

Download Submit
C:\Windows\System32\eMNPDYl.exe

Filesize
1.1MB

MD5
438638653fbe0d160b178736f4f0763d

SHA1
10375707426f53f3e9a5c214833297eb5ca581fc

SHA256
d5198110133dfcb070c736e6362ca3b95eeec18fc0e09085307946c330cf2f04

SHA512
2121a359408f9db6f61c8e7267fea8515b157708d1429a58f95872319d0a67e1ccc05e00ca00a6bf4833e955f6471d4d5f5570f38550f74be30c02d065fef6c8

Download Submit
C:\Windows\System32\gZIeLjp.exe

Filesize
1.1MB

MD5
e2cbdce2813150af105d50b263d2bc71

SHA1
23a09d5862816818a06312e14581510a9cd29d1d

SHA256
d5ea614df73729ecbb349b734b0c18dd45e9aff9a9502a95711b96fe7fc032d2

SHA512
e298977ee309e8b27d199ee94eb6f9cd3b221e2981b44c033d64550ff0d30ee83d75544928c9de9c3f251b8c1de36b58315a594c01c7728f072c6536f5e77169

Download Submit
C:\Windows\System32\iecGBGz.exe

Filesize
1.1MB

MD5
c408a9c54598e0dc1fabf5a1f9a70954

SHA1
1ab57c9a4a19e0b490ae0daf246ee16397d05d18

SHA256
30ae302b28a362b69ad82ec7623b9f2ecb44d7753a96e66401e2b363efd3af5b

SHA512
986a96cb9706692af7ccd0a5b5ed2d306bc73df3b3ba1abdb2fda023ec6af7cce2eca90bfc51e20896f056a9ea786ea0e85505cc7a8cc6278adb63f48d139575

Download Submit
C:\Windows\System32\jzSiKCW.exe

Filesize
1.1MB

MD5
7fc241815ed614edadac8f4ab2af44e0

SHA1
2fe1021c1ef1c0fb18e9bc9e0a7db48084e29349

SHA256
4085140de5de2ee058918177df78c044b36674d1d4f3410087463a3941377115

SHA512
54fce758a573018f1e73a5737735b255d93d4711d4cab4b45d17f3a8961f33cf7b3f0952713723208d70f174e071d6c0b0850972191e10322a95694895fcf12a

Download Submit
C:\Windows\System32\lDdsUMG.exe

Filesize
1.1MB

MD5
9d59d51d84ee05f50fe5f2226a57557b

SHA1
61a3c1c0a26932efa270ebc18e90117823936a77

SHA256
1277a5d57ad3ebd6247482c4e31f81634f382638547949a7586eb548f3d8e309

SHA512
d8e5d521b2aa02831b9bd0414632287b19447290dd956145e936af0f6624b76eb5a03ca6e61480658578ec0abd8b2becd291fef8cf802310f53251f8b550fb84

Download Submit
C:\Windows\System32\lqZxAxT.exe

Filesize
1.1MB

MD5
be64d3b1cea1e3a7b594bbfa167ce1d7

SHA1
af69d0c89e3c38c0b78b687f817cc2531ee8cd9e

SHA256
292e17fbccecff16d30bcb5265f72e75d4d9e9a5bca7dc55e8bbfed22485bfb6

SHA512
6ed706e5f367972f53d35b8b30206a3aecefd0a160a48ba0e709f03ead40ff3993db0247afed217ed6e6365e742f79858b231ae61eb5c02c49443e849bb98fa9

Download Submit
C:\Windows\System32\ltHSnaT.exe

Filesize
1.1MB

MD5
def7e3984597f0e4ca2aadade227fa5f

SHA1
f85138426043ae70f1c74c7720f77c6dc3f82ddf

SHA256
fbf3729f61584d147fd05be84f8d2e413ac406ecd60446c7a0172ba47abdf6c1

SHA512
dbc9c55e691de01e1cc6ffa3e2689e5fabe7314a868c81a90c8b0928e8cc170018dbd99f5b4f17e9dc9785a1ba048bbc250d366f31edcf29e25f686b3bf5a275

Download Submit
C:\Windows\System32\pBNokzQ.exe

Filesize
1.1MB

MD5
59b15c411df77521485df3608983334f

SHA1
fc60691ae28a8a02fd0d00241d74bfa8fd51a787

SHA256
d0785066b132f51c3e17200134aa22f2012089632538dc0d3e59dafd6d80f25c

SHA512
bb2a2704c4781fb3f7978a531cf529728b90003f5cb3303bc891aa0629b23ff3651eb27176f2070e2397ab1c27ce4c7ec5397e2e88d1418cdf258defb97816b9

Download Submit
C:\Windows\System32\qzfPHdv.exe

Filesize
1.1MB

MD5
bb882fb2159f3badc9394a8bafaca343

SHA1
1fbb807bd7fadfad45f24f16fb50758dcf3b9cbf

SHA256
9e056659584da491069b4109ad1a6dfe9d8545f251128c6f7822cdae49f71c39

SHA512
2bcc389d5ecc14d6b117fe63a8a0299966305b37a4a60ddbdcf7f79ae09eb6ada466744caee999d9b165329194ef6d39da4ada9b655c48959723349ea05d85e7

Download Submit
C:\Windows\System32\rULCHbO.exe

Filesize
1.1MB

MD5
5d9b1dd65aa6ab297ecb8a8d1aa273ba

SHA1
0a9c776c9d9de9b70096ceeb8c57ba580a308fd5

SHA256
9bfb3e823ebf60e18c9cda981f75b20833250a391a8c7ba185eb107cf5bcc652

SHA512
2022a69686502fcf0573a1d89acc5015c69c740ec8e97ce2b0005c707321f8242b231945145a341a02eff80f66abc99daf14e5e172f0d4412349e643c2498be3

Download Submit
C:\Windows\System32\taAELHY.exe

Filesize
1.1MB

MD5
0793175f541e86232d8750edff20626b

SHA1
6035d440febe5b9cfffd302436987dd981186af3

SHA256
1632ad90bf407ed9ddcc88c61a7627d05bccbe4db1b324b13f0ca5b658690ff5

SHA512
4e7c8d2f563d111dc37b0e537c314a98200691021b31da10d524b7ea393b6679565ec6e00a18d250d3fb2cc01b90db920f677f3e571d00d3d20097934b0c039a

Download Submit
C:\Windows\System32\xNdHsrk.exe

Filesize
1.1MB

MD5
31bad3e67b1529844bed9c8da0632e03

SHA1
b91c158497897250a3d0cd9863a20b6ae1411bac

SHA256
dc170f967bdcf1349bf8b92f19fd8c7aa7c3f93c5391bfce7565d676b74c9af6

SHA512
41bec54cb6ccaf7f9085674672be09367f2e4bc3b600dab4ffebbcd5e9b16eb303dd5ec6f45328e62736ed96438deca85631de37689aab5dfab5629d29bb67f5

Download Submit
memory/324-335-0x00007FF798DF0000-0x00007FF7991E1000-memory.dmp

Filesize
3.9MB

Download
memory/324-2151-0x00007FF798DF0000-0x00007FF7991E1000-memory.dmp

Filesize
3.9MB

Download
memory/704-366-0x00007FF610930000-0x00007FF610D21000-memory.dmp

Filesize
3.9MB

Download
memory/704-2205-0x00007FF610930000-0x00007FF610D21000-memory.dmp

Filesize
3.9MB

Download
memory/832-351-0x00007FF6774E0000-0x00007FF6778D1000-memory.dmp

Filesize
3.9MB

Download
memory/832-2186-0x00007FF6774E0000-0x00007FF6778D1000-memory.dmp

Filesize
3.9MB

Download
memory/840-2147-0x00007FF760BE0000-0x00007FF760FD1000-memory.dmp

Filesize
3.9MB

Download
memory/840-63-0x00007FF760BE0000-0x00007FF760FD1000-memory.dmp

Filesize
3.9MB

Download
memory/840-1267-0x00007FF760BE0000-0x00007FF760FD1000-memory.dmp

Filesize
3.9MB

Download
memory/1040-341-0x00007FF6B26B0000-0x00007FF6B2AA1000-memory.dmp

Filesize
3.9MB

Download
memory/1040-2175-0x00007FF6B26B0000-0x00007FF6B2AA1000-memory.dmp

Filesize
3.9MB

Download
memory/1104-40-0x00007FF7632B0000-0x00007FF7636A1000-memory.dmp

Filesize
3.9MB

Download
memory/1104-1148-0x00007FF7632B0000-0x00007FF7636A1000-memory.dmp

Filesize
3.9MB

Download
memory/1104-2142-0x00007FF7632B0000-0x00007FF7636A1000-memory.dmp

Filesize
3.9MB

Download
memory/1220-362-0x00007FF7B2640000-0x00007FF7B2A31000-memory.dmp

Filesize
3.9MB

Download
memory/1220-2202-0x00007FF7B2640000-0x00007FF7B2A31000-memory.dmp

Filesize
3.9MB

Download
memory/1392-1001-0x00007FF6E8EB0000-0x00007FF6E92A1000-memory.dmp

Filesize
3.9MB

Download
memory/1392-0-0x00007FF6E8EB0000-0x00007FF6E92A1000-memory.dmp

Filesize
3.9MB

Download
memory/1392-1-0x0000027730EF0000-0x0000027730F00000-memory.dmp

Filesize
64KB

Download
memory/1500-364-0x00007FF61B1E0000-0x00007FF61B5D1000-memory.dmp

Filesize
3.9MB

Download
memory/1500-2209-0x00007FF61B1E0000-0x00007FF61B5D1000-memory.dmp

Filesize
3.9MB

Download
memory/1864-368-0x00007FF7CF230000-0x00007FF7CF621000-memory.dmp

Filesize
3.9MB

Download
memory/1864-2144-0x00007FF7CF230000-0x00007FF7CF621000-memory.dmp

Filesize
3.9MB

Download
memory/2028-2138-0x00007FF7F1220000-0x00007FF7F1611000-memory.dmp

Filesize
3.9MB

Download
memory/2028-64-0x00007FF7F1220000-0x00007FF7F1611000-memory.dmp

Filesize
3.9MB

Download
memory/3008-2203-0x00007FF704660000-0x00007FF704A51000-memory.dmp

Filesize
3.9MB

Download
memory/3008-344-0x00007FF704660000-0x00007FF704A51000-memory.dmp

Filesize
3.9MB

Download
memory/3184-2198-0x00007FF7E50E0000-0x00007FF7E54D1000-memory.dmp

Filesize
3.9MB

Download
memory/3184-358-0x00007FF7E50E0000-0x00007FF7E54D1000-memory.dmp

Filesize
3.9MB

Download
memory/3220-377-0x00007FF671100000-0x00007FF6714F1000-memory.dmp

Filesize
3.9MB

Download
memory/3220-2162-0x00007FF671100000-0x00007FF6714F1000-memory.dmp

Filesize
3.9MB

Download
memory/3540-339-0x00007FF78F5D0000-0x00007FF78F9C1000-memory.dmp

Filesize
3.9MB

Download
memory/3540-2161-0x00007FF78F5D0000-0x00007FF78F9C1000-memory.dmp

Filesize
3.9MB

Download
memory/3704-1265-0x00007FF6CB740000-0x00007FF6CBB31000-memory.dmp

Filesize
3.9MB

Download
memory/3704-46-0x00007FF6CB740000-0x00007FF6CBB31000-memory.dmp

Filesize
3.9MB

Download
memory/3704-2157-0x00007FF6CB740000-0x00007FF6CBB31000-memory.dmp

Filesize
3.9MB

Download
memory/3708-1147-0x00007FF7C0870000-0x00007FF7C0C61000-memory.dmp

Filesize
3.9MB

Download
memory/3708-2140-0x00007FF7C0870000-0x00007FF7C0C61000-memory.dmp

Filesize
3.9MB

Download
memory/3708-21-0x00007FF7C0870000-0x00007FF7C0C61000-memory.dmp

Filesize
3.9MB

Download
memory/3716-2200-0x00007FF61CE10000-0x00007FF61D201000-memory.dmp

Filesize
3.9MB

Download
memory/3716-342-0x00007FF61CE10000-0x00007FF61D201000-memory.dmp

Filesize
3.9MB

Download
memory/3744-2149-0x00007FF6C2A10000-0x00007FF6C2E01000-memory.dmp

Filesize
3.9MB

Download
memory/3744-337-0x00007FF6C2A10000-0x00007FF6C2E01000-memory.dmp

Filesize
3.9MB

Download
memory/4204-2155-0x00007FF702C30000-0x00007FF703021000-memory.dmp

Filesize
3.9MB

Download
memory/4204-67-0x00007FF702C30000-0x00007FF703021000-memory.dmp

Filesize
3.9MB

Download
memory/4524-2158-0x00007FF7A2780000-0x00007FF7A2B71000-memory.dmp

Filesize
3.9MB

Download
memory/4524-48-0x00007FF7A2780000-0x00007FF7A2B71000-memory.dmp

Filesize
3.9MB

Download
memory/4628-1145-0x00007FF65EC80000-0x00007FF65F071000-memory.dmp

Filesize
3.9MB

Download
memory/4628-9-0x00007FF65EC80000-0x00007FF65F071000-memory.dmp

Filesize
3.9MB

Download
memory/4628-2136-0x00007FF65EC80000-0x00007FF65F071000-memory.dmp

Filesize
3.9MB

Download
memory/4692-2211-0x00007FF788EE0000-0x00007FF7892D1000-memory.dmp

Filesize
3.9MB

Download
memory/4692-365-0x00007FF788EE0000-0x00007FF7892D1000-memory.dmp

Filesize
3.9MB

Download
memory/4880-367-0x00007FF634AB0000-0x00007FF634EA1000-memory.dmp

Filesize
3.9MB

Download
memory/4880-2207-0x00007FF634AB0000-0x00007FF634EA1000-memory.dmp

Filesize
3.9MB

Download
memory/5040-59-0x00007FF71BEA0000-0x00007FF71C291000-memory.dmp

Filesize
3.9MB

Download
memory/5040-2153-0x00007FF71BEA0000-0x00007FF71C291000-memory.dmp

Filesize
3.9MB

Download