xmrig | 60f0852d17ef84749b86b5d123602069b26518e31af065d971a69548348c1f82

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 03:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
Size

1.1MB
MD5

d0f6dd570167578e81d94ef939f9ab5a
SHA1

b0e9743ff3049ad6b37dc94c22ce296503b2a9d3
SHA256

60f0852d17ef84749b86b5d123602069b26518e31af065d971a69548348c1f82
SHA512

67aca9294fe4df63c40e083ce00ce7576ef4983291f6ec382080ae88e873eaa8e03ad761756c098a09291c70e5d1e9dc51d3d916ad7549411e011d8257839733
SSDEEP

24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zEeBGJ9pcFtGxS1:knw9oUUEEDl37jcq4ipDY

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/736-309-0x00007FF600A70000-0x00007FF600E61000-memory.dmp	xmrig
behavioral2/memory/696-312-0x00007FF63C160000-0x00007FF63C551000-memory.dmp	xmrig
behavioral2/memory/4988-314-0x00007FF699390000-0x00007FF699781000-memory.dmp	xmrig
behavioral2/memory/4152-317-0x00007FF6C1EE0000-0x00007FF6C22D1000-memory.dmp	xmrig
behavioral2/memory/1248-326-0x00007FF760720000-0x00007FF760B11000-memory.dmp	xmrig
behavioral2/memory/2272-341-0x00007FF60E2A0000-0x00007FF60E691000-memory.dmp	xmrig
behavioral2/memory/2204-349-0x00007FF633E10000-0x00007FF634201000-memory.dmp	xmrig
behavioral2/memory/2948-364-0x00007FF6065B0000-0x00007FF6069A1000-memory.dmp	xmrig
behavioral2/memory/2484-384-0x00007FF74E730000-0x00007FF74EB21000-memory.dmp	xmrig
behavioral2/memory/2912-390-0x00007FF652210000-0x00007FF652601000-memory.dmp	xmrig
behavioral2/memory/1276-392-0x00007FF673B90000-0x00007FF673F81000-memory.dmp	xmrig
behavioral2/memory/5068-391-0x00007FF6831B0000-0x00007FF6835A1000-memory.dmp	xmrig
behavioral2/memory/4808-389-0x00007FF61E840000-0x00007FF61EC31000-memory.dmp	xmrig
behavioral2/memory/4000-373-0x00007FF7CF310000-0x00007FF7CF701000-memory.dmp	xmrig
behavioral2/memory/3284-316-0x00007FF77AA90000-0x00007FF77AE81000-memory.dmp	xmrig
behavioral2/memory/4184-315-0x00007FF7F7330000-0x00007FF7F7721000-memory.dmp	xmrig
behavioral2/memory/3000-313-0x00007FF60DFD0000-0x00007FF60E3C1000-memory.dmp	xmrig
behavioral2/memory/3280-310-0x00007FF6CA8F0000-0x00007FF6CACE1000-memory.dmp	xmrig
behavioral2/memory/2212-1233-0x00007FF75D720000-0x00007FF75DB11000-memory.dmp	xmrig
behavioral2/memory/2416-1361-0x00007FF73A810000-0x00007FF73AC01000-memory.dmp	xmrig
behavioral2/memory/4832-1364-0x00007FF6D6170000-0x00007FF6D6561000-memory.dmp	xmrig
behavioral2/memory/1688-1490-0x00007FF692820000-0x00007FF692C11000-memory.dmp	xmrig
behavioral2/memory/3988-1487-0x00007FF764CD0000-0x00007FF7650C1000-memory.dmp	xmrig
behavioral2/memory/2608-1496-0x00007FF6446A0000-0x00007FF644A91000-memory.dmp	xmrig
behavioral2/memory/1772-1491-0x00007FF7E1DF0000-0x00007FF7E21E1000-memory.dmp	xmrig
behavioral2/memory/2416-2161-0x00007FF73A810000-0x00007FF73AC01000-memory.dmp	xmrig
behavioral2/memory/4832-2163-0x00007FF6D6170000-0x00007FF6D6561000-memory.dmp	xmrig
behavioral2/memory/3988-2165-0x00007FF764CD0000-0x00007FF7650C1000-memory.dmp	xmrig
behavioral2/memory/1688-2169-0x00007FF692820000-0x00007FF692C11000-memory.dmp	xmrig
behavioral2/memory/1772-2168-0x00007FF7E1DF0000-0x00007FF7E21E1000-memory.dmp	xmrig
behavioral2/memory/2608-2174-0x00007FF6446A0000-0x00007FF644A91000-memory.dmp	xmrig
behavioral2/memory/5068-2175-0x00007FF6831B0000-0x00007FF6835A1000-memory.dmp	xmrig
behavioral2/memory/1276-2179-0x00007FF673B90000-0x00007FF673F81000-memory.dmp	xmrig
behavioral2/memory/696-2181-0x00007FF63C160000-0x00007FF63C551000-memory.dmp	xmrig
behavioral2/memory/3000-2184-0x00007FF60DFD0000-0x00007FF60E3C1000-memory.dmp	xmrig
behavioral2/memory/4988-2185-0x00007FF699390000-0x00007FF699781000-memory.dmp	xmrig
behavioral2/memory/736-2178-0x00007FF600A70000-0x00007FF600E61000-memory.dmp	xmrig
behavioral2/memory/3280-2172-0x00007FF6CA8F0000-0x00007FF6CACE1000-memory.dmp	xmrig
behavioral2/memory/2204-2225-0x00007FF633E10000-0x00007FF634201000-memory.dmp	xmrig
behavioral2/memory/2484-2219-0x00007FF74E730000-0x00007FF74EB21000-memory.dmp	xmrig
behavioral2/memory/2912-2215-0x00007FF652210000-0x00007FF652601000-memory.dmp	xmrig
behavioral2/memory/3284-2212-0x00007FF77AA90000-0x00007FF77AE81000-memory.dmp	xmrig
behavioral2/memory/1248-2207-0x00007FF760720000-0x00007FF760B11000-memory.dmp	xmrig
behavioral2/memory/4184-2236-0x00007FF7F7330000-0x00007FF7F7721000-memory.dmp	xmrig
behavioral2/memory/2272-2228-0x00007FF60E2A0000-0x00007FF60E691000-memory.dmp	xmrig
behavioral2/memory/2948-2222-0x00007FF6065B0000-0x00007FF6069A1000-memory.dmp	xmrig
behavioral2/memory/4000-2221-0x00007FF7CF310000-0x00007FF7CF701000-memory.dmp	xmrig
behavioral2/memory/4808-2216-0x00007FF61E840000-0x00007FF61EC31000-memory.dmp	xmrig
behavioral2/memory/4152-2208-0x00007FF6C1EE0000-0x00007FF6C22D1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2416	AhfQrat.exe
3988	MFuJqOr.exe
4832	fjCgMxX.exe
1772	GloWvbE.exe
1688	krgdwKD.exe
5068	pZYKyAE.exe
2608	YFKFLup.exe
1276	ecSmAnH.exe
736	tXyJlJQ.exe
3280	TpSRRcd.exe
696	RHTueGf.exe
3000	cuhwnhq.exe
4988	PNxmPlk.exe
4184	ubDkECp.exe
3284	vddeewl.exe
4152	SBsiXer.exe
1248	tJPOuTZ.exe
2272	xmlEuZJ.exe
2204	wFviGkm.exe
2948	UQQrSNk.exe
4000	RyiKQgN.exe
2484	XXAkhnZ.exe
4808	CHZbonU.exe
2912	CECqqak.exe
3256	cSoGSRA.exe
3212	SNOzUZr.exe
2656	SiszfJD.exe
1844	rFfbRlB.exe
3820	PkqZOdD.exe
3104	dOCtEiw.exe
4128	BdbZznZ.exe
888	mGWlEkY.exe
1056	TueWYoe.exe
4412	xUZyuGf.exe
1532	DWNswAQ.exe
4460	WekAEuh.exe
4140	cxuMwpv.exe
968	hEhyzGX.exe
4716	SDqyDXU.exe
3040	bsBnumS.exe
1804	RSgrnVl.exe
1484	aWiSZUc.exe
1164	dCfsQPx.exe
4920	nyZires.exe
3956	dxaTzZG.exe
556	dyeOpHg.exe
5000	fsaCcxO.exe
1676	kiAelHz.exe
4528	XRQhDBG.exe
1076	WFURAYZ.exe
1952	VwMeUgf.exe
3532	QOuoERW.exe
4300	MSHetUH.exe
4316	RZShCZB.exe
440	nXznozn.exe
620	fPkuuxy.exe
4148	AKJLqpf.exe
4064	XnroYOw.exe
3860	MeCJZGP.exe
1340	UlqOQKS.exe
1196	hAHNkup.exe
2348	jUejRFD.exe
3488	YwAxtEJ.exe
768	zhqODXn.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2212-0-0x00007FF75D720000-0x00007FF75DB11000-memory.dmp	upx
behavioral2/files/0x00070000000234c1-7.dat	upx
behavioral2/files/0x00070000000234c0-12.dat	upx
behavioral2/memory/4832-25-0x00007FF6D6170000-0x00007FF6D6561000-memory.dmp	upx
behavioral2/files/0x00070000000234c2-31.dat	upx
behavioral2/files/0x00070000000234c4-37.dat	upx
behavioral2/memory/1772-40-0x00007FF7E1DF0000-0x00007FF7E21E1000-memory.dmp	upx
behavioral2/files/0x00070000000234c8-53.dat	upx
behavioral2/files/0x00070000000234cb-74.dat	upx
behavioral2/files/0x00070000000234cc-79.dat	upx
behavioral2/files/0x00070000000234cf-94.dat	upx
behavioral2/files/0x00070000000234d1-104.dat	upx
behavioral2/files/0x00070000000234d9-144.dat	upx
behavioral2/files/0x00070000000234dc-153.dat	upx
behavioral2/files/0x00070000000234dd-164.dat	upx
behavioral2/memory/736-309-0x00007FF600A70000-0x00007FF600E61000-memory.dmp	upx
behavioral2/memory/696-312-0x00007FF63C160000-0x00007FF63C551000-memory.dmp	upx
behavioral2/memory/4988-314-0x00007FF699390000-0x00007FF699781000-memory.dmp	upx
behavioral2/memory/4152-317-0x00007FF6C1EE0000-0x00007FF6C22D1000-memory.dmp	upx
behavioral2/memory/1248-326-0x00007FF760720000-0x00007FF760B11000-memory.dmp	upx
behavioral2/memory/2272-341-0x00007FF60E2A0000-0x00007FF60E691000-memory.dmp	upx
behavioral2/memory/2204-349-0x00007FF633E10000-0x00007FF634201000-memory.dmp	upx
behavioral2/memory/2948-364-0x00007FF6065B0000-0x00007FF6069A1000-memory.dmp	upx
behavioral2/memory/2484-384-0x00007FF74E730000-0x00007FF74EB21000-memory.dmp	upx
behavioral2/memory/2912-390-0x00007FF652210000-0x00007FF652601000-memory.dmp	upx
behavioral2/memory/1276-392-0x00007FF673B90000-0x00007FF673F81000-memory.dmp	upx
behavioral2/memory/5068-391-0x00007FF6831B0000-0x00007FF6835A1000-memory.dmp	upx
behavioral2/memory/4808-389-0x00007FF61E840000-0x00007FF61EC31000-memory.dmp	upx
behavioral2/memory/4000-373-0x00007FF7CF310000-0x00007FF7CF701000-memory.dmp	upx
behavioral2/memory/3284-316-0x00007FF77AA90000-0x00007FF77AE81000-memory.dmp	upx
behavioral2/memory/4184-315-0x00007FF7F7330000-0x00007FF7F7721000-memory.dmp	upx
behavioral2/memory/3000-313-0x00007FF60DFD0000-0x00007FF60E3C1000-memory.dmp	upx
behavioral2/memory/3280-310-0x00007FF6CA8F0000-0x00007FF6CACE1000-memory.dmp	upx
behavioral2/memory/2608-308-0x00007FF6446A0000-0x00007FF644A91000-memory.dmp	upx
behavioral2/files/0x00070000000234de-166.dat	upx
behavioral2/files/0x00070000000234db-151.dat	upx
behavioral2/files/0x00070000000234da-149.dat	upx
behavioral2/files/0x00070000000234d8-136.dat	upx
behavioral2/files/0x00070000000234d7-134.dat	upx
behavioral2/files/0x00070000000234d6-129.dat	upx
behavioral2/files/0x00070000000234d5-124.dat	upx
behavioral2/files/0x00070000000234d4-119.dat	upx
behavioral2/files/0x00070000000234d3-114.dat	upx
behavioral2/files/0x00070000000234d2-109.dat	upx
behavioral2/files/0x00070000000234d0-99.dat	upx
behavioral2/files/0x00070000000234ce-89.dat	upx
behavioral2/files/0x00070000000234cd-81.dat	upx
behavioral2/files/0x00070000000234ca-69.dat	upx
behavioral2/files/0x00070000000234c9-64.dat	upx
behavioral2/files/0x00070000000234c7-51.dat	upx
behavioral2/files/0x00070000000234c6-46.dat	upx
behavioral2/files/0x00070000000234c5-44.dat	upx
behavioral2/files/0x00070000000234c3-33.dat	upx
behavioral2/memory/1688-27-0x00007FF692820000-0x00007FF692C11000-memory.dmp	upx
behavioral2/memory/3988-15-0x00007FF764CD0000-0x00007FF7650C1000-memory.dmp	upx
behavioral2/memory/2416-11-0x00007FF73A810000-0x00007FF73AC01000-memory.dmp	upx
behavioral2/files/0x0009000000023462-8.dat	upx
behavioral2/memory/2212-1233-0x00007FF75D720000-0x00007FF75DB11000-memory.dmp	upx
behavioral2/memory/2416-1361-0x00007FF73A810000-0x00007FF73AC01000-memory.dmp	upx
behavioral2/memory/4832-1364-0x00007FF6D6170000-0x00007FF6D6561000-memory.dmp	upx
behavioral2/memory/1688-1490-0x00007FF692820000-0x00007FF692C11000-memory.dmp	upx
behavioral2/memory/3988-1487-0x00007FF764CD0000-0x00007FF7650C1000-memory.dmp	upx
behavioral2/memory/2608-1496-0x00007FF6446A0000-0x00007FF644A91000-memory.dmp	upx
behavioral2/memory/1772-1491-0x00007FF7E1DF0000-0x00007FF7E21E1000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\mRqpbOb.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\XixkOyZ.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\BRuGfev.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\BclEiRr.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\cSoGSRA.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\tptlpGg.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\sWsfxJu.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\XyRJDXK.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\PXzKeLN.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\Jacpmxu.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\GkHIDut.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\loRTaEk.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\hAcwTjE.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\IOYclVg.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\BXmqSjj.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\BsGTGvj.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\GSeXqwa.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\TOGnXKp.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\hpRlWQn.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\XchqFDl.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\gPbPRaZ.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\ONaRHzG.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\GJGzKWC.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\WvpLMBZ.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\OPTkYIh.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\cVVocfM.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\seCoZaN.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\HeCrOmq.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\eclKUbD.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\cWaBjOW.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\xCSNdOF.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\SNWKCvt.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\qSPfZel.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\GEyYmXk.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\hwdifyo.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\DwdhaiN.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\feLLAJT.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\jBVCOPT.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\vgsVCaP.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\tTxzkKV.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\VKfSSzn.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\pUMWpJu.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\fjCgMxX.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\cHxOhrJ.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\dXWrBZF.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\TzjPvRI.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\WrJaWDM.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\uamunBK.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\UgXrbEn.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\fZDKveO.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\AdjcMkj.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\zONMAsO.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\AXZJSpw.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\zcWbEbj.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\RHTueGf.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\IoKNywY.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\SzEidVj.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\TGAsYrq.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\qvEckta.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\sGFpQTm.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\TwPEkyL.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\gIyyYlB.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\AxFZfag.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
File created	C:\Windows\System32\QOuoERW.exe	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2416	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	84
PID 2212 wrote to memory of 2416	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	84
PID 2212 wrote to memory of 3988	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	85
PID 2212 wrote to memory of 3988	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	85
PID 2212 wrote to memory of 4832	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	86
PID 2212 wrote to memory of 4832	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	86
PID 2212 wrote to memory of 1772	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	87
PID 2212 wrote to memory of 1772	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	87
PID 2212 wrote to memory of 1688	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	88
PID 2212 wrote to memory of 1688	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	88
PID 2212 wrote to memory of 5068	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	89
PID 2212 wrote to memory of 5068	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	89
PID 2212 wrote to memory of 2608	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	90
PID 2212 wrote to memory of 2608	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	90
PID 2212 wrote to memory of 1276	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	91
PID 2212 wrote to memory of 1276	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	91
PID 2212 wrote to memory of 736	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	92
PID 2212 wrote to memory of 736	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	92
PID 2212 wrote to memory of 3280	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	93
PID 2212 wrote to memory of 3280	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	93
PID 2212 wrote to memory of 696	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	94
PID 2212 wrote to memory of 696	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	94
PID 2212 wrote to memory of 3000	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	95
PID 2212 wrote to memory of 3000	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	95
PID 2212 wrote to memory of 4988	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	96
PID 2212 wrote to memory of 4988	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	96
PID 2212 wrote to memory of 4184	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	97
PID 2212 wrote to memory of 4184	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	97
PID 2212 wrote to memory of 3284	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	98
PID 2212 wrote to memory of 3284	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	98
PID 2212 wrote to memory of 4152	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	99
PID 2212 wrote to memory of 4152	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	99
PID 2212 wrote to memory of 1248	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	100
PID 2212 wrote to memory of 1248	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	100
PID 2212 wrote to memory of 2272	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	101
PID 2212 wrote to memory of 2272	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	101
PID 2212 wrote to memory of 2204	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	102
PID 2212 wrote to memory of 2204	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	102
PID 2212 wrote to memory of 2948	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	103
PID 2212 wrote to memory of 2948	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	103
PID 2212 wrote to memory of 4000	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	104
PID 2212 wrote to memory of 4000	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	104
PID 2212 wrote to memory of 2484	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	105
PID 2212 wrote to memory of 2484	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	105
PID 2212 wrote to memory of 4808	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	106
PID 2212 wrote to memory of 4808	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	106
PID 2212 wrote to memory of 2912	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	107
PID 2212 wrote to memory of 2912	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	107
PID 2212 wrote to memory of 3256	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	108
PID 2212 wrote to memory of 3256	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	108
PID 2212 wrote to memory of 3212	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	109
PID 2212 wrote to memory of 3212	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	109
PID 2212 wrote to memory of 2656	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	110
PID 2212 wrote to memory of 2656	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	110
PID 2212 wrote to memory of 1844	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	111
PID 2212 wrote to memory of 1844	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	111
PID 2212 wrote to memory of 3820	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	112
PID 2212 wrote to memory of 3820	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	112
PID 2212 wrote to memory of 3104	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	113
PID 2212 wrote to memory of 3104	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	113
PID 2212 wrote to memory of 4128	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	114
PID 2212 wrote to memory of 4128	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	114
PID 2212 wrote to memory of 888	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	115
PID 2212 wrote to memory of 888	2212	d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d0f6dd570167578e81d94ef939f9ab5a_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\System32\AhfQrat.exe
  C:\Windows\System32\AhfQrat.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System32\MFuJqOr.exe
  C:\Windows\System32\MFuJqOr.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System32\fjCgMxX.exe
  C:\Windows\System32\fjCgMxX.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System32\GloWvbE.exe
  C:\Windows\System32\GloWvbE.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System32\krgdwKD.exe
  C:\Windows\System32\krgdwKD.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System32\pZYKyAE.exe
  C:\Windows\System32\pZYKyAE.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System32\YFKFLup.exe
  C:\Windows\System32\YFKFLup.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System32\ecSmAnH.exe
  C:\Windows\System32\ecSmAnH.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System32\tXyJlJQ.exe
  C:\Windows\System32\tXyJlJQ.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System32\TpSRRcd.exe
  C:\Windows\System32\TpSRRcd.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System32\RHTueGf.exe
  C:\Windows\System32\RHTueGf.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System32\cuhwnhq.exe
  C:\Windows\System32\cuhwnhq.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System32\PNxmPlk.exe
  C:\Windows\System32\PNxmPlk.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System32\ubDkECp.exe
  C:\Windows\System32\ubDkECp.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System32\vddeewl.exe
  C:\Windows\System32\vddeewl.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System32\SBsiXer.exe
  C:\Windows\System32\SBsiXer.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System32\tJPOuTZ.exe
  C:\Windows\System32\tJPOuTZ.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System32\xmlEuZJ.exe
  C:\Windows\System32\xmlEuZJ.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System32\wFviGkm.exe
  C:\Windows\System32\wFviGkm.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System32\UQQrSNk.exe
  C:\Windows\System32\UQQrSNk.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System32\RyiKQgN.exe
  C:\Windows\System32\RyiKQgN.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System32\XXAkhnZ.exe
  C:\Windows\System32\XXAkhnZ.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System32\CHZbonU.exe
  C:\Windows\System32\CHZbonU.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System32\CECqqak.exe
  C:\Windows\System32\CECqqak.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System32\cSoGSRA.exe
  C:\Windows\System32\cSoGSRA.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System32\SNOzUZr.exe
  C:\Windows\System32\SNOzUZr.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System32\SiszfJD.exe
  C:\Windows\System32\SiszfJD.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System32\rFfbRlB.exe
  C:\Windows\System32\rFfbRlB.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System32\PkqZOdD.exe
  C:\Windows\System32\PkqZOdD.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System32\dOCtEiw.exe
  C:\Windows\System32\dOCtEiw.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System32\BdbZznZ.exe
  C:\Windows\System32\BdbZznZ.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System32\mGWlEkY.exe
  C:\Windows\System32\mGWlEkY.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System32\TueWYoe.exe
  C:\Windows\System32\TueWYoe.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System32\xUZyuGf.exe
  C:\Windows\System32\xUZyuGf.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System32\DWNswAQ.exe
  C:\Windows\System32\DWNswAQ.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System32\WekAEuh.exe
  C:\Windows\System32\WekAEuh.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System32\cxuMwpv.exe
  C:\Windows\System32\cxuMwpv.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System32\hEhyzGX.exe
  C:\Windows\System32\hEhyzGX.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System32\SDqyDXU.exe
  C:\Windows\System32\SDqyDXU.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System32\bsBnumS.exe
  C:\Windows\System32\bsBnumS.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System32\RSgrnVl.exe
  C:\Windows\System32\RSgrnVl.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System32\aWiSZUc.exe
  C:\Windows\System32\aWiSZUc.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System32\dCfsQPx.exe
  C:\Windows\System32\dCfsQPx.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System32\nyZires.exe
  C:\Windows\System32\nyZires.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System32\dxaTzZG.exe
  C:\Windows\System32\dxaTzZG.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System32\dyeOpHg.exe
  C:\Windows\System32\dyeOpHg.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System32\fsaCcxO.exe
  C:\Windows\System32\fsaCcxO.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System32\kiAelHz.exe
  C:\Windows\System32\kiAelHz.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System32\XRQhDBG.exe
  C:\Windows\System32\XRQhDBG.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System32\WFURAYZ.exe
  C:\Windows\System32\WFURAYZ.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System32\VwMeUgf.exe
  C:\Windows\System32\VwMeUgf.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System32\QOuoERW.exe
  C:\Windows\System32\QOuoERW.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System32\MSHetUH.exe
  C:\Windows\System32\MSHetUH.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System32\RZShCZB.exe
  C:\Windows\System32\RZShCZB.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System32\nXznozn.exe
  C:\Windows\System32\nXznozn.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System32\fPkuuxy.exe
  C:\Windows\System32\fPkuuxy.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System32\AKJLqpf.exe
  C:\Windows\System32\AKJLqpf.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System32\XnroYOw.exe
  C:\Windows\System32\XnroYOw.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System32\MeCJZGP.exe
  C:\Windows\System32\MeCJZGP.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System32\UlqOQKS.exe
  C:\Windows\System32\UlqOQKS.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System32\hAHNkup.exe
  C:\Windows\System32\hAHNkup.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System32\jUejRFD.exe
  C:\Windows\System32\jUejRFD.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System32\YwAxtEJ.exe
  C:\Windows\System32\YwAxtEJ.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System32\zhqODXn.exe
  C:\Windows\System32\zhqODXn.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System32\dbEriEQ.exe
  C:\Windows\System32\dbEriEQ.exe
  2⤵
  PID:3640
- C:\Windows\System32\YNyLjij.exe
  C:\Windows\System32\YNyLjij.exe
  2⤵
  PID:64
- C:\Windows\System32\ktStzlZ.exe
  C:\Windows\System32\ktStzlZ.exe
  2⤵
  PID:4204
- C:\Windows\System32\FEQDOyg.exe
  C:\Windows\System32\FEQDOyg.exe
  2⤵
  PID:3684
- C:\Windows\System32\cPEdqAt.exe
  C:\Windows\System32\cPEdqAt.exe
  2⤵
  PID:4484
- C:\Windows\System32\yXlpBRs.exe
  C:\Windows\System32\yXlpBRs.exe
  2⤵
  PID:976
- C:\Windows\System32\eBBROET.exe
  C:\Windows\System32\eBBROET.exe
  2⤵
  PID:4284
- C:\Windows\System32\HSLimpn.exe
  C:\Windows\System32\HSLimpn.exe
  2⤵
  PID:1708
- C:\Windows\System32\zHxvLXQ.exe
  C:\Windows\System32\zHxvLXQ.exe
  2⤵
  PID:1556
- C:\Windows\System32\HRPgFso.exe
  C:\Windows\System32\HRPgFso.exe
  2⤵
  PID:2200
- C:\Windows\System32\ZKDuxIh.exe
  C:\Windows\System32\ZKDuxIh.exe
  2⤵
  PID:3304
- C:\Windows\System32\sZDKAGy.exe
  C:\Windows\System32\sZDKAGy.exe
  2⤵
  PID:1732
- C:\Windows\System32\XqAwjTZ.exe
  C:\Windows\System32\XqAwjTZ.exe
  2⤵
  PID:3964
- C:\Windows\System32\oHdFsuw.exe
  C:\Windows\System32\oHdFsuw.exe
  2⤵
  PID:2420
- C:\Windows\System32\EFnbBop.exe
  C:\Windows\System32\EFnbBop.exe
  2⤵
  PID:2780
- C:\Windows\System32\wOuzgnr.exe
  C:\Windows\System32\wOuzgnr.exe
  2⤵
  PID:3976
- C:\Windows\System32\lcguXDK.exe
  C:\Windows\System32\lcguXDK.exe
  2⤵
  PID:3220
- C:\Windows\System32\XYvsbzm.exe
  C:\Windows\System32\XYvsbzm.exe
  2⤵
  PID:2056
- C:\Windows\System32\hCDFMoH.exe
  C:\Windows\System32\hCDFMoH.exe
  2⤵
  PID:948
- C:\Windows\System32\BmdbKIE.exe
  C:\Windows\System32\BmdbKIE.exe
  2⤵
  PID:3904
- C:\Windows\System32\FDrKhLj.exe
  C:\Windows\System32\FDrKhLj.exe
  2⤵
  PID:3232
- C:\Windows\System32\sKNnGqD.exe
  C:\Windows\System32\sKNnGqD.exe
  2⤵
  PID:4476
- C:\Windows\System32\YJcXyws.exe
  C:\Windows\System32\YJcXyws.exe
  2⤵
  PID:2528
- C:\Windows\System32\VPkjBdE.exe
  C:\Windows\System32\VPkjBdE.exe
  2⤵
  PID:3660
- C:\Windows\System32\CNomSxn.exe
  C:\Windows\System32\CNomSxn.exe
  2⤵
  PID:5100
- C:\Windows\System32\MoVNGsJ.exe
  C:\Windows\System32\MoVNGsJ.exe
  2⤵
  PID:3952
- C:\Windows\System32\AUzgwVG.exe
  C:\Windows\System32\AUzgwVG.exe
  2⤵
  PID:1880
- C:\Windows\System32\EHxWKxV.exe
  C:\Windows\System32\EHxWKxV.exe
  2⤵
  PID:412
- C:\Windows\System32\KbIXHaM.exe
  C:\Windows\System32\KbIXHaM.exe
  2⤵
  PID:4436
- C:\Windows\System32\vdosfRm.exe
  C:\Windows\System32\vdosfRm.exe
  2⤵
  PID:4772
- C:\Windows\System32\Rbtmtpr.exe
  C:\Windows\System32\Rbtmtpr.exe
  2⤵
  PID:2084
- C:\Windows\System32\YwCCAqZ.exe
  C:\Windows\System32\YwCCAqZ.exe
  2⤵
  PID:1992
- C:\Windows\System32\twlQBYg.exe
  C:\Windows\System32\twlQBYg.exe
  2⤵
  PID:1768
- C:\Windows\System32\UyMZKAS.exe
  C:\Windows\System32\UyMZKAS.exe
  2⤵
  PID:244
- C:\Windows\System32\vNvtCfh.exe
  C:\Windows\System32\vNvtCfh.exe
  2⤵
  PID:3196
- C:\Windows\System32\LqqNRsX.exe
  C:\Windows\System32\LqqNRsX.exe
  2⤵
  PID:2404
- C:\Windows\System32\ElyquUW.exe
  C:\Windows\System32\ElyquUW.exe
  2⤵
  PID:756
- C:\Windows\System32\jfYojFZ.exe
  C:\Windows\System32\jfYojFZ.exe
  2⤵
  PID:4768
- C:\Windows\System32\OqgaRuq.exe
  C:\Windows\System32\OqgaRuq.exe
  2⤵
  PID:1744
- C:\Windows\System32\aCQsovp.exe
  C:\Windows\System32\aCQsovp.exe
  2⤵
  PID:1404
- C:\Windows\System32\WKSLpOh.exe
  C:\Windows\System32\WKSLpOh.exe
  2⤵
  PID:3008
- C:\Windows\System32\xircLRC.exe
  C:\Windows\System32\xircLRC.exe
  2⤵
  PID:1600
- C:\Windows\System32\xdEWwFf.exe
  C:\Windows\System32\xdEWwFf.exe
  2⤵
  PID:3452
- C:\Windows\System32\PoGZlLt.exe
  C:\Windows\System32\PoGZlLt.exe
  2⤵
  PID:4104
- C:\Windows\System32\vgsVCaP.exe
  C:\Windows\System32\vgsVCaP.exe
  2⤵
  PID:3704
- C:\Windows\System32\WmrRxTo.exe
  C:\Windows\System32\WmrRxTo.exe
  2⤵
  PID:3052
- C:\Windows\System32\tptlpGg.exe
  C:\Windows\System32\tptlpGg.exe
  2⤵
  PID:2700
- C:\Windows\System32\anXBilN.exe
  C:\Windows\System32\anXBilN.exe
  2⤵
  PID:4760
- C:\Windows\System32\spitqju.exe
  C:\Windows\System32\spitqju.exe
  2⤵
  PID:5152
- C:\Windows\System32\PdtRQpB.exe
  C:\Windows\System32\PdtRQpB.exe
  2⤵
  PID:5172
- C:\Windows\System32\BXmqSjj.exe
  C:\Windows\System32\BXmqSjj.exe
  2⤵
  PID:5232
- C:\Windows\System32\ncBbyux.exe
  C:\Windows\System32\ncBbyux.exe
  2⤵
  PID:5272
- C:\Windows\System32\xfhUrBT.exe
  C:\Windows\System32\xfhUrBT.exe
  2⤵
  PID:5296
- C:\Windows\System32\nSQgtyp.exe
  C:\Windows\System32\nSQgtyp.exe
  2⤵
  PID:5328
- C:\Windows\System32\YUChWso.exe
  C:\Windows\System32\YUChWso.exe
  2⤵
  PID:5344
- C:\Windows\System32\AweQcwi.exe
  C:\Windows\System32\AweQcwi.exe
  2⤵
  PID:5372
- C:\Windows\System32\eIcoPZn.exe
  C:\Windows\System32\eIcoPZn.exe
  2⤵
  PID:5416
- C:\Windows\System32\qdMAvuI.exe
  C:\Windows\System32\qdMAvuI.exe
  2⤵
  PID:5456
- C:\Windows\System32\rDKMHPr.exe
  C:\Windows\System32\rDKMHPr.exe
  2⤵
  PID:5476
- C:\Windows\System32\sWsfxJu.exe
  C:\Windows\System32\sWsfxJu.exe
  2⤵
  PID:5496
- C:\Windows\System32\WQrkXBO.exe
  C:\Windows\System32\WQrkXBO.exe
  2⤵
  PID:5512
- C:\Windows\System32\EqUfxQK.exe
  C:\Windows\System32\EqUfxQK.exe
  2⤵
  PID:5532
- C:\Windows\System32\xbcuZAO.exe
  C:\Windows\System32\xbcuZAO.exe
  2⤵
  PID:5580
- C:\Windows\System32\KOfNUGx.exe
  C:\Windows\System32\KOfNUGx.exe
  2⤵
  PID:5604
- C:\Windows\System32\rlkVVJl.exe
  C:\Windows\System32\rlkVVJl.exe
  2⤵
  PID:5620
- C:\Windows\System32\BQrSpIy.exe
  C:\Windows\System32\BQrSpIy.exe
  2⤵
  PID:5640
- C:\Windows\System32\yWKuxyd.exe
  C:\Windows\System32\yWKuxyd.exe
  2⤵
  PID:5676
- C:\Windows\System32\vUfDqOZ.exe
  C:\Windows\System32\vUfDqOZ.exe
  2⤵
  PID:5724
- C:\Windows\System32\jPlplUG.exe
  C:\Windows\System32\jPlplUG.exe
  2⤵
  PID:5740
- C:\Windows\System32\SrNDbSQ.exe
  C:\Windows\System32\SrNDbSQ.exe
  2⤵
  PID:5764
- C:\Windows\System32\diSLNHZ.exe
  C:\Windows\System32\diSLNHZ.exe
  2⤵
  PID:5784
- C:\Windows\System32\VmofbIh.exe
  C:\Windows\System32\VmofbIh.exe
  2⤵
  PID:5812
- C:\Windows\System32\rJPApIV.exe
  C:\Windows\System32\rJPApIV.exe
  2⤵
  PID:5832
- C:\Windows\System32\GUFFkJv.exe
  C:\Windows\System32\GUFFkJv.exe
  2⤵
  PID:5856
- C:\Windows\System32\JkgBeCF.exe
  C:\Windows\System32\JkgBeCF.exe
  2⤵
  PID:5880
- C:\Windows\System32\vuvLGzw.exe
  C:\Windows\System32\vuvLGzw.exe
  2⤵
  PID:5904
- C:\Windows\System32\AWwSRvF.exe
  C:\Windows\System32\AWwSRvF.exe
  2⤵
  PID:5924
- C:\Windows\System32\AytNVdB.exe
  C:\Windows\System32\AytNVdB.exe
  2⤵
  PID:5948
- C:\Windows\System32\XsgOhci.exe
  C:\Windows\System32\XsgOhci.exe
  2⤵
  PID:5972
- C:\Windows\System32\WpCBSZr.exe
  C:\Windows\System32\WpCBSZr.exe
  2⤵
  PID:5992
- C:\Windows\System32\HMgFgCF.exe
  C:\Windows\System32\HMgFgCF.exe
  2⤵
  PID:6008
- C:\Windows\System32\SVKIqLt.exe
  C:\Windows\System32\SVKIqLt.exe
  2⤵
  PID:6044
- C:\Windows\System32\TXINUiy.exe
  C:\Windows\System32\TXINUiy.exe
  2⤵
  PID:6060
- C:\Windows\System32\tlaCxou.exe
  C:\Windows\System32\tlaCxou.exe
  2⤵
  PID:6080
- C:\Windows\System32\aIxrAZc.exe
  C:\Windows\System32\aIxrAZc.exe
  2⤵
  PID:6100
- C:\Windows\System32\uYleSty.exe
  C:\Windows\System32\uYleSty.exe
  2⤵
  PID:6116
- C:\Windows\System32\vUvbklK.exe
  C:\Windows\System32\vUvbklK.exe
  2⤵
  PID:2448
- C:\Windows\System32\dZcxOnn.exe
  C:\Windows\System32\dZcxOnn.exe
  2⤵
  PID:5180
- C:\Windows\System32\faDJftX.exe
  C:\Windows\System32\faDJftX.exe
  2⤵
  PID:5248
- C:\Windows\System32\TqqDaNN.exe
  C:\Windows\System32\TqqDaNN.exe
  2⤵
  PID:5244
- C:\Windows\System32\PZbmSII.exe
  C:\Windows\System32\PZbmSII.exe
  2⤵
  PID:5412
- C:\Windows\System32\jySVqYW.exe
  C:\Windows\System32\jySVqYW.exe
  2⤵
  PID:5484
- C:\Windows\System32\pZanRgV.exe
  C:\Windows\System32\pZanRgV.exe
  2⤵
  PID:5696
- C:\Windows\System32\XyRJDXK.exe
  C:\Windows\System32\XyRJDXK.exe
  2⤵
  PID:5808
- C:\Windows\System32\LLClKfm.exe
  C:\Windows\System32\LLClKfm.exe
  2⤵
  PID:5776
- C:\Windows\System32\DUfUOmo.exe
  C:\Windows\System32\DUfUOmo.exe
  2⤵
  PID:5844
- C:\Windows\System32\hnHuuXb.exe
  C:\Windows\System32\hnHuuXb.exe
  2⤵
  PID:5920
- C:\Windows\System32\nHvkQZB.exe
  C:\Windows\System32\nHvkQZB.exe
  2⤵
  PID:5956
- C:\Windows\System32\PEqyTvF.exe
  C:\Windows\System32\PEqyTvF.exe
  2⤵
  PID:6024
- C:\Windows\System32\uqvVLlX.exe
  C:\Windows\System32\uqvVLlX.exe
  2⤵
  PID:6004
- C:\Windows\System32\vFvobYB.exe
  C:\Windows\System32\vFvobYB.exe
  2⤵
  PID:4568
- C:\Windows\System32\LApFMks.exe
  C:\Windows\System32\LApFMks.exe
  2⤵
  PID:5160
- C:\Windows\System32\plaKMPE.exe
  C:\Windows\System32\plaKMPE.exe
  2⤵
  PID:5356
- C:\Windows\System32\atwVwIG.exe
  C:\Windows\System32\atwVwIG.exe
  2⤵
  PID:5508
- C:\Windows\System32\NjIpPLf.exe
  C:\Windows\System32\NjIpPLf.exe
  2⤵
  PID:6124
- C:\Windows\System32\ZVxeWPK.exe
  C:\Windows\System32\ZVxeWPK.exe
  2⤵
  PID:6088
- C:\Windows\System32\RfpUjAZ.exe
  C:\Windows\System32\RfpUjAZ.exe
  2⤵
  PID:5304
- C:\Windows\System32\BsGTGvj.exe
  C:\Windows\System32\BsGTGvj.exe
  2⤵
  PID:5708
- C:\Windows\System32\WxyPTRq.exe
  C:\Windows\System32\WxyPTRq.exe
  2⤵
  PID:6140
- C:\Windows\System32\JjTBaKV.exe
  C:\Windows\System32\JjTBaKV.exe
  2⤵
  PID:5940
- C:\Windows\System32\lJgsXYs.exe
  C:\Windows\System32\lJgsXYs.exe
  2⤵
  PID:6156
- C:\Windows\System32\AOstacW.exe
  C:\Windows\System32\AOstacW.exe
  2⤵
  PID:6184
- C:\Windows\System32\zuMihMv.exe
  C:\Windows\System32\zuMihMv.exe
  2⤵
  PID:6208
- C:\Windows\System32\IoKNywY.exe
  C:\Windows\System32\IoKNywY.exe
  2⤵
  PID:6236
- C:\Windows\System32\gKZOhzC.exe
  C:\Windows\System32\gKZOhzC.exe
  2⤵
  PID:6256
- C:\Windows\System32\PpklXYd.exe
  C:\Windows\System32\PpklXYd.exe
  2⤵
  PID:6288
- C:\Windows\System32\RrjDHzR.exe
  C:\Windows\System32\RrjDHzR.exe
  2⤵
  PID:6312
- C:\Windows\System32\WIWBXrS.exe
  C:\Windows\System32\WIWBXrS.exe
  2⤵
  PID:6328
- C:\Windows\System32\eWAOsdu.exe
  C:\Windows\System32\eWAOsdu.exe
  2⤵
  PID:6380
- C:\Windows\System32\SQwGwcc.exe
  C:\Windows\System32\SQwGwcc.exe
  2⤵
  PID:6396
- C:\Windows\System32\unLUUhs.exe
  C:\Windows\System32\unLUUhs.exe
  2⤵
  PID:6436
- C:\Windows\System32\QDZVwIW.exe
  C:\Windows\System32\QDZVwIW.exe
  2⤵
  PID:6464
- C:\Windows\System32\mRqpbOb.exe
  C:\Windows\System32\mRqpbOb.exe
  2⤵
  PID:6480
- C:\Windows\System32\ycJrSBs.exe
  C:\Windows\System32\ycJrSBs.exe
  2⤵
  PID:6532
- C:\Windows\System32\LAIrBDm.exe
  C:\Windows\System32\LAIrBDm.exe
  2⤵
  PID:6568
- C:\Windows\System32\ThJixiO.exe
  C:\Windows\System32\ThJixiO.exe
  2⤵
  PID:6584
- C:\Windows\System32\IwWtFrk.exe
  C:\Windows\System32\IwWtFrk.exe
  2⤵
  PID:6616
- C:\Windows\System32\NzMZLLC.exe
  C:\Windows\System32\NzMZLLC.exe
  2⤵
  PID:6632
- C:\Windows\System32\cmMuAeu.exe
  C:\Windows\System32\cmMuAeu.exe
  2⤵
  PID:6652
- C:\Windows\System32\WrJaWDM.exe
  C:\Windows\System32\WrJaWDM.exe
  2⤵
  PID:6672
- C:\Windows\System32\EXEXpth.exe
  C:\Windows\System32\EXEXpth.exe
  2⤵
  PID:6692
- C:\Windows\System32\HKlGtpT.exe
  C:\Windows\System32\HKlGtpT.exe
  2⤵
  PID:6748
- C:\Windows\System32\bjzCzxz.exe
  C:\Windows\System32\bjzCzxz.exe
  2⤵
  PID:6764
- C:\Windows\System32\LJsjifm.exe
  C:\Windows\System32\LJsjifm.exe
  2⤵
  PID:6836
- C:\Windows\System32\uwPTIAY.exe
  C:\Windows\System32\uwPTIAY.exe
  2⤵
  PID:6860
- C:\Windows\System32\yufliNO.exe
  C:\Windows\System32\yufliNO.exe
  2⤵
  PID:6884
- C:\Windows\System32\mdkHDhz.exe
  C:\Windows\System32\mdkHDhz.exe
  2⤵
  PID:6900
- C:\Windows\System32\FnglFsl.exe
  C:\Windows\System32\FnglFsl.exe
  2⤵
  PID:6924
- C:\Windows\System32\RaeCebc.exe
  C:\Windows\System32\RaeCebc.exe
  2⤵
  PID:6944
- C:\Windows\System32\IhyqDXH.exe
  C:\Windows\System32\IhyqDXH.exe
  2⤵
  PID:6964
- C:\Windows\System32\NWCwtFY.exe
  C:\Windows\System32\NWCwtFY.exe
  2⤵
  PID:6980
- C:\Windows\System32\FKRXFpO.exe
  C:\Windows\System32\FKRXFpO.exe
  2⤵
  PID:7032
- C:\Windows\System32\LwxPYfV.exe
  C:\Windows\System32\LwxPYfV.exe
  2⤵
  PID:7052
- C:\Windows\System32\AtzDGZC.exe
  C:\Windows\System32\AtzDGZC.exe
  2⤵
  PID:7068
- C:\Windows\System32\AGwetBM.exe
  C:\Windows\System32\AGwetBM.exe
  2⤵
  PID:7088
- C:\Windows\System32\NuGlEow.exe
  C:\Windows\System32\NuGlEow.exe
  2⤵
  PID:7104
- C:\Windows\System32\pMWOXlo.exe
  C:\Windows\System32\pMWOXlo.exe
  2⤵
  PID:7124
- C:\Windows\System32\mGazwHc.exe
  C:\Windows\System32\mGazwHc.exe
  2⤵
  PID:7148
- C:\Windows\System32\rsUMSng.exe
  C:\Windows\System32\rsUMSng.exe
  2⤵
  PID:5944
- C:\Windows\System32\nbEfbwC.exe
  C:\Windows\System32\nbEfbwC.exe
  2⤵
  PID:6172
- C:\Windows\System32\RdAtGCI.exe
  C:\Windows\System32\RdAtGCI.exe
  2⤵
  PID:6204
- C:\Windows\System32\VQxIeml.exe
  C:\Windows\System32\VQxIeml.exe
  2⤵
  PID:856
- C:\Windows\System32\aQkyYtN.exe
  C:\Windows\System32\aQkyYtN.exe
  2⤵
  PID:6376
- C:\Windows\System32\lMhKpfB.exe
  C:\Windows\System32\lMhKpfB.exe
  2⤵
  PID:6404
- C:\Windows\System32\rSQoDXm.exe
  C:\Windows\System32\rSQoDXm.exe
  2⤵
  PID:6488
- C:\Windows\System32\NvPqvzA.exe
  C:\Windows\System32\NvPqvzA.exe
  2⤵
  PID:6576
- C:\Windows\System32\kjaCSBh.exe
  C:\Windows\System32\kjaCSBh.exe
  2⤵
  PID:6772
- C:\Windows\System32\FMKxHaf.exe
  C:\Windows\System32\FMKxHaf.exe
  2⤵
  PID:6812
- C:\Windows\System32\kleUoIv.exe
  C:\Windows\System32\kleUoIv.exe
  2⤵
  PID:6908
- C:\Windows\System32\uJmKOMD.exe
  C:\Windows\System32\uJmKOMD.exe
  2⤵
  PID:6960
- C:\Windows\System32\mNsBfOH.exe
  C:\Windows\System32\mNsBfOH.exe
  2⤵
  PID:7048
- C:\Windows\System32\aoAMgvS.exe
  C:\Windows\System32\aoAMgvS.exe
  2⤵
  PID:7164
- C:\Windows\System32\XPDouZI.exe
  C:\Windows\System32\XPDouZI.exe
  2⤵
  PID:5760
- C:\Windows\System32\XBjvASY.exe
  C:\Windows\System32\XBjvASY.exe
  2⤵
  PID:6284
- C:\Windows\System32\LRqbGaj.exe
  C:\Windows\System32\LRqbGaj.exe
  2⤵
  PID:5980
- C:\Windows\System32\xCSNdOF.exe
  C:\Windows\System32\xCSNdOF.exe
  2⤵
  PID:6592
- C:\Windows\System32\hnqrHpY.exe
  C:\Windows\System32\hnqrHpY.exe
  2⤵
  PID:6844
- C:\Windows\System32\yfxPeIz.exe
  C:\Windows\System32\yfxPeIz.exe
  2⤵
  PID:6744
- C:\Windows\System32\udUWVMe.exe
  C:\Windows\System32\udUWVMe.exe
  2⤵
  PID:7044
- C:\Windows\System32\kzdeULu.exe
  C:\Windows\System32\kzdeULu.exe
  2⤵
  PID:7120
- C:\Windows\System32\xBADrie.exe
  C:\Windows\System32\xBADrie.exe
  2⤵
  PID:6388
- C:\Windows\System32\ZxNPgXi.exe
  C:\Windows\System32\ZxNPgXi.exe
  2⤵
  PID:6412
- C:\Windows\System32\dnmKKex.exe
  C:\Windows\System32\dnmKKex.exe
  2⤵
  PID:6872
- C:\Windows\System32\GCOpjpb.exe
  C:\Windows\System32\GCOpjpb.exe
  2⤵
  PID:5380
- C:\Windows\System32\DuWJBZR.exe
  C:\Windows\System32\DuWJBZR.exe
  2⤵
  PID:7200
- C:\Windows\System32\OBRubNP.exe
  C:\Windows\System32\OBRubNP.exe
  2⤵
  PID:7232
- C:\Windows\System32\FYszwJN.exe
  C:\Windows\System32\FYszwJN.exe
  2⤵
  PID:7252
- C:\Windows\System32\lbVSzUy.exe
  C:\Windows\System32\lbVSzUy.exe
  2⤵
  PID:7276
- C:\Windows\System32\IlazySg.exe
  C:\Windows\System32\IlazySg.exe
  2⤵
  PID:7304
- C:\Windows\System32\azqCJAm.exe
  C:\Windows\System32\azqCJAm.exe
  2⤵
  PID:7328
- C:\Windows\System32\aMrqtib.exe
  C:\Windows\System32\aMrqtib.exe
  2⤵
  PID:7348
- C:\Windows\System32\kYCxOLB.exe
  C:\Windows\System32\kYCxOLB.exe
  2⤵
  PID:7380
- C:\Windows\System32\rupBCFF.exe
  C:\Windows\System32\rupBCFF.exe
  2⤵
  PID:7400
- C:\Windows\System32\UcsFXOG.exe
  C:\Windows\System32\UcsFXOG.exe
  2⤵
  PID:7428
- C:\Windows\System32\bAMWJAi.exe
  C:\Windows\System32\bAMWJAi.exe
  2⤵
  PID:7448
- C:\Windows\System32\XYgqcfX.exe
  C:\Windows\System32\XYgqcfX.exe
  2⤵
  PID:7468
- C:\Windows\System32\BFIRhfh.exe
  C:\Windows\System32\BFIRhfh.exe
  2⤵
  PID:7496
- C:\Windows\System32\bIwROgS.exe
  C:\Windows\System32\bIwROgS.exe
  2⤵
  PID:7520
- C:\Windows\System32\ogGUpOO.exe
  C:\Windows\System32\ogGUpOO.exe
  2⤵
  PID:7568
- C:\Windows\System32\pjVftcs.exe
  C:\Windows\System32\pjVftcs.exe
  2⤵
  PID:7596
- C:\Windows\System32\aOYWEWX.exe
  C:\Windows\System32\aOYWEWX.exe
  2⤵
  PID:7616
- C:\Windows\System32\IfTmoxr.exe
  C:\Windows\System32\IfTmoxr.exe
  2⤵
  PID:7632
- C:\Windows\System32\XMeFgXk.exe
  C:\Windows\System32\XMeFgXk.exe
  2⤵
  PID:7652
- C:\Windows\System32\byMWFgx.exe
  C:\Windows\System32\byMWFgx.exe
  2⤵
  PID:7672
- C:\Windows\System32\KMzJHqA.exe
  C:\Windows\System32\KMzJHqA.exe
  2⤵
  PID:7728
- C:\Windows\System32\hlHnFQG.exe
  C:\Windows\System32\hlHnFQG.exe
  2⤵
  PID:7748
- C:\Windows\System32\HmVAnoq.exe
  C:\Windows\System32\HmVAnoq.exe
  2⤵
  PID:7764
- C:\Windows\System32\qQnuxXN.exe
  C:\Windows\System32\qQnuxXN.exe
  2⤵
  PID:7788
- C:\Windows\System32\NhbKLWZ.exe
  C:\Windows\System32\NhbKLWZ.exe
  2⤵
  PID:7804
- C:\Windows\System32\IOjvHfe.exe
  C:\Windows\System32\IOjvHfe.exe
  2⤵
  PID:7852
- C:\Windows\System32\SzEidVj.exe
  C:\Windows\System32\SzEidVj.exe
  2⤵
  PID:7872
- C:\Windows\System32\lqUbgxP.exe
  C:\Windows\System32\lqUbgxP.exe
  2⤵
  PID:7932
- C:\Windows\System32\iAlPvpL.exe
  C:\Windows\System32\iAlPvpL.exe
  2⤵
  PID:7980
- C:\Windows\System32\XFtIFzC.exe
  C:\Windows\System32\XFtIFzC.exe
  2⤵
  PID:8008
- C:\Windows\System32\qtkMPYu.exe
  C:\Windows\System32\qtkMPYu.exe
  2⤵
  PID:8028
- C:\Windows\System32\JfAgmwN.exe
  C:\Windows\System32\JfAgmwN.exe
  2⤵
  PID:8048
- C:\Windows\System32\SmYsUic.exe
  C:\Windows\System32\SmYsUic.exe
  2⤵
  PID:8072
- C:\Windows\System32\iQSGVjE.exe
  C:\Windows\System32\iQSGVjE.exe
  2⤵
  PID:8092
- C:\Windows\System32\SNWKCvt.exe
  C:\Windows\System32\SNWKCvt.exe
  2⤵
  PID:8116
- C:\Windows\System32\EroeHou.exe
  C:\Windows\System32\EroeHou.exe
  2⤵
  PID:8136
- C:\Windows\System32\DFZzDeC.exe
  C:\Windows\System32\DFZzDeC.exe
  2⤵
  PID:7080
- C:\Windows\System32\eZeXUtU.exe
  C:\Windows\System32\eZeXUtU.exe
  2⤵
  PID:7184
- C:\Windows\System32\clIFVYH.exe
  C:\Windows\System32\clIFVYH.exe
  2⤵
  PID:7296
- C:\Windows\System32\OHqaBqL.exe
  C:\Windows\System32\OHqaBqL.exe
  2⤵
  PID:7344
- C:\Windows\System32\RcFyEqg.exe
  C:\Windows\System32\RcFyEqg.exe
  2⤵
  PID:7368
- C:\Windows\System32\AxbvEnC.exe
  C:\Windows\System32\AxbvEnC.exe
  2⤵
  PID:7436
- C:\Windows\System32\zARqtoI.exe
  C:\Windows\System32\zARqtoI.exe
  2⤵
  PID:7512
- C:\Windows\System32\oxsmJfo.exe
  C:\Windows\System32\oxsmJfo.exe
  2⤵
  PID:7532
- C:\Windows\System32\yHPUGtC.exe
  C:\Windows\System32\yHPUGtC.exe
  2⤵
  PID:7612
- C:\Windows\System32\BGepgGz.exe
  C:\Windows\System32\BGepgGz.exe
  2⤵
  PID:7800
- C:\Windows\System32\zYqnRCQ.exe
  C:\Windows\System32\zYqnRCQ.exe
  2⤵
  PID:7756
- C:\Windows\System32\WsqgSLd.exe
  C:\Windows\System32\WsqgSLd.exe
  2⤵
  PID:7884
- C:\Windows\System32\qYZkOZh.exe
  C:\Windows\System32\qYZkOZh.exe
  2⤵
  PID:7960
- C:\Windows\System32\elhJgLp.exe
  C:\Windows\System32\elhJgLp.exe
  2⤵
  PID:8016
- C:\Windows\System32\ivMkZVA.exe
  C:\Windows\System32\ivMkZVA.exe
  2⤵
  PID:8044
- C:\Windows\System32\tZRAyKb.exe
  C:\Windows\System32\tZRAyKb.exe
  2⤵
  PID:8132
- C:\Windows\System32\HZwDvUz.exe
  C:\Windows\System32\HZwDvUz.exe
  2⤵
  PID:8148
- C:\Windows\System32\GJGzKWC.exe
  C:\Windows\System32\GJGzKWC.exe
  2⤵
  PID:6492
- C:\Windows\System32\PfJTzCA.exe
  C:\Windows\System32\PfJTzCA.exe
  2⤵
  PID:7356
- C:\Windows\System32\GSeXqwa.exe
  C:\Windows\System32\GSeXqwa.exe
  2⤵
  PID:7416
- C:\Windows\System32\XixkOyZ.exe
  C:\Windows\System32\XixkOyZ.exe
  2⤵
  PID:7664
- C:\Windows\System32\aJDVGhD.exe
  C:\Windows\System32\aJDVGhD.exe
  2⤵
  PID:7740
- C:\Windows\System32\KSYmDse.exe
  C:\Windows\System32\KSYmDse.exe
  2⤵
  PID:7880
- C:\Windows\System32\kClOQRQ.exe
  C:\Windows\System32\kClOQRQ.exe
  2⤵
  PID:7944
- C:\Windows\System32\qzHuSMK.exe
  C:\Windows\System32\qzHuSMK.exe
  2⤵
  PID:7340
- C:\Windows\System32\bgrvyHL.exe
  C:\Windows\System32\bgrvyHL.exe
  2⤵
  PID:7648
- C:\Windows\System32\YwniwMX.exe
  C:\Windows\System32\YwniwMX.exe
  2⤵
  PID:8020
- C:\Windows\System32\xeRDEwC.exe
  C:\Windows\System32\xeRDEwC.exe
  2⤵
  PID:7848
- C:\Windows\System32\LcPkXmf.exe
  C:\Windows\System32\LcPkXmf.exe
  2⤵
  PID:8236
- C:\Windows\System32\koszbQa.exe
  C:\Windows\System32\koszbQa.exe
  2⤵
  PID:8256
- C:\Windows\System32\oJwustI.exe
  C:\Windows\System32\oJwustI.exe
  2⤵
  PID:8280
- C:\Windows\System32\GKJAhOw.exe
  C:\Windows\System32\GKJAhOw.exe
  2⤵
  PID:8300
- C:\Windows\System32\AzPFidl.exe
  C:\Windows\System32\AzPFidl.exe
  2⤵
  PID:8316
- C:\Windows\System32\aCypihZ.exe
  C:\Windows\System32\aCypihZ.exe
  2⤵
  PID:8344
- C:\Windows\System32\rLkyifU.exe
  C:\Windows\System32\rLkyifU.exe
  2⤵
  PID:8368
- C:\Windows\System32\gpGMqjU.exe
  C:\Windows\System32\gpGMqjU.exe
  2⤵
  PID:8388
- C:\Windows\System32\WvpLMBZ.exe
  C:\Windows\System32\WvpLMBZ.exe
  2⤵
  PID:8404
- C:\Windows\System32\CsAlsJn.exe
  C:\Windows\System32\CsAlsJn.exe
  2⤵
  PID:8428
- C:\Windows\System32\DrwEqAV.exe
  C:\Windows\System32\DrwEqAV.exe
  2⤵
  PID:8516
- C:\Windows\System32\ZGQERcQ.exe
  C:\Windows\System32\ZGQERcQ.exe
  2⤵
  PID:8552
- C:\Windows\System32\FOPHJxn.exe
  C:\Windows\System32\FOPHJxn.exe
  2⤵
  PID:8596
- C:\Windows\System32\SCzenmC.exe
  C:\Windows\System32\SCzenmC.exe
  2⤵
  PID:8620
- C:\Windows\System32\JrhNjOI.exe
  C:\Windows\System32\JrhNjOI.exe
  2⤵
  PID:8680
- C:\Windows\System32\wJsHgKm.exe
  C:\Windows\System32\wJsHgKm.exe
  2⤵
  PID:8696
- C:\Windows\System32\lqlCUpr.exe
  C:\Windows\System32\lqlCUpr.exe
  2⤵
  PID:8712
- C:\Windows\System32\vzHYjVm.exe
  C:\Windows\System32\vzHYjVm.exe
  2⤵
  PID:8728
- C:\Windows\System32\MXMarPM.exe
  C:\Windows\System32\MXMarPM.exe
  2⤵
  PID:8744
- C:\Windows\System32\wEQDGqp.exe
  C:\Windows\System32\wEQDGqp.exe
  2⤵
  PID:8760
- C:\Windows\System32\QcrUXoa.exe
  C:\Windows\System32\QcrUXoa.exe
  2⤵
  PID:8804
- C:\Windows\System32\tWXXcyP.exe
  C:\Windows\System32\tWXXcyP.exe
  2⤵
  PID:8888
- C:\Windows\System32\vxKChwh.exe
  C:\Windows\System32\vxKChwh.exe
  2⤵
  PID:8944
- C:\Windows\System32\MgQDRHt.exe
  C:\Windows\System32\MgQDRHt.exe
  2⤵
  PID:8980
- C:\Windows\System32\fjdIKLO.exe
  C:\Windows\System32\fjdIKLO.exe
  2⤵
  PID:9000
- C:\Windows\System32\eyDGyLu.exe
  C:\Windows\System32\eyDGyLu.exe
  2⤵
  PID:9024
- C:\Windows\System32\BSjGXlb.exe
  C:\Windows\System32\BSjGXlb.exe
  2⤵
  PID:9040
- C:\Windows\System32\JItRtXH.exe
  C:\Windows\System32\JItRtXH.exe
  2⤵
  PID:9080
- C:\Windows\System32\WBaAPck.exe
  C:\Windows\System32\WBaAPck.exe
  2⤵
  PID:9104
- C:\Windows\System32\EnvALfj.exe
  C:\Windows\System32\EnvALfj.exe
  2⤵
  PID:9132
- C:\Windows\System32\zAUwodr.exe
  C:\Windows\System32\zAUwodr.exe
  2⤵
  PID:9152
- C:\Windows\System32\TOGnXKp.exe
  C:\Windows\System32\TOGnXKp.exe
  2⤵
  PID:9180
- C:\Windows\System32\rxfuExM.exe
  C:\Windows\System32\rxfuExM.exe
  2⤵
  PID:7196
- C:\Windows\System32\cHxOhrJ.exe
  C:\Windows\System32\cHxOhrJ.exe
  2⤵
  PID:8228
- C:\Windows\System32\uGPkgKD.exe
  C:\Windows\System32\uGPkgKD.exe
  2⤵
  PID:8252
- C:\Windows\System32\TTOAxhz.exe
  C:\Windows\System32\TTOAxhz.exe
  2⤵
  PID:8352
- C:\Windows\System32\hpRlWQn.exe
  C:\Windows\System32\hpRlWQn.exe
  2⤵
  PID:8332
- C:\Windows\System32\DmMpQrd.exe
  C:\Windows\System32\DmMpQrd.exe
  2⤵
  PID:8496
- C:\Windows\System32\gMKszWe.exe
  C:\Windows\System32\gMKszWe.exe
  2⤵
  PID:8564
- C:\Windows\System32\jpLgWMx.exe
  C:\Windows\System32\jpLgWMx.exe
  2⤵
  PID:8376
- C:\Windows\System32\DwdhaiN.exe
  C:\Windows\System32\DwdhaiN.exe
  2⤵
  PID:8492
- C:\Windows\System32\IHaDnVP.exe
  C:\Windows\System32\IHaDnVP.exe
  2⤵
  PID:8668
- C:\Windows\System32\CNlkKzz.exe
  C:\Windows\System32\CNlkKzz.exe
  2⤵
  PID:8616
- C:\Windows\System32\PaMGcBi.exe
  C:\Windows\System32\PaMGcBi.exe
  2⤵
  PID:8660
- C:\Windows\System32\VLSbYsF.exe
  C:\Windows\System32\VLSbYsF.exe
  2⤵
  PID:8788
- C:\Windows\System32\OyMbJZH.exe
  C:\Windows\System32\OyMbJZH.exe
  2⤵
  PID:8840
- C:\Windows\System32\WlwgOWK.exe
  C:\Windows\System32\WlwgOWK.exe
  2⤵
  PID:8916
- C:\Windows\System32\gyMNCZI.exe
  C:\Windows\System32\gyMNCZI.exe
  2⤵
  PID:8968
- C:\Windows\System32\DFLoUWL.exe
  C:\Windows\System32\DFLoUWL.exe
  2⤵
  PID:2196
- C:\Windows\System32\ZkyVUMi.exe
  C:\Windows\System32\ZkyVUMi.exe
  2⤵
  PID:9096
- C:\Windows\System32\IkrlmPi.exe
  C:\Windows\System32\IkrlmPi.exe
  2⤵
  PID:9128
- C:\Windows\System32\UFAiigC.exe
  C:\Windows\System32\UFAiigC.exe
  2⤵
  PID:9196
- C:\Windows\System32\DDeGStw.exe
  C:\Windows\System32\DDeGStw.exe
  2⤵
  PID:7064
- C:\Windows\System32\vXQKont.exe
  C:\Windows\System32\vXQKont.exe
  2⤵
  PID:8324
- C:\Windows\System32\HqqQWHN.exe
  C:\Windows\System32\HqqQWHN.exe
  2⤵
  PID:8448
- C:\Windows\System32\tTxzkKV.exe
  C:\Windows\System32\tTxzkKV.exe
  2⤵
  PID:8632
- C:\Windows\System32\oLMXyXP.exe
  C:\Windows\System32\oLMXyXP.exe
  2⤵
  PID:8692
- C:\Windows\System32\GanwAsq.exe
  C:\Windows\System32\GanwAsq.exe
  2⤵
  PID:9020
- C:\Windows\System32\LjPIpkP.exe
  C:\Windows\System32\LjPIpkP.exe
  2⤵
  PID:8956
- C:\Windows\System32\skveSMO.exe
  C:\Windows\System32\skveSMO.exe
  2⤵
  PID:9112
- C:\Windows\System32\KsEKeNF.exe
  C:\Windows\System32\KsEKeNF.exe
  2⤵
  PID:8396
- C:\Windows\System32\vVIEUiU.exe
  C:\Windows\System32\vVIEUiU.exe
  2⤵
  PID:1780
- C:\Windows\System32\YBtuXcM.exe
  C:\Windows\System32\YBtuXcM.exe
  2⤵
  PID:9140
- C:\Windows\System32\uMScVeC.exe
  C:\Windows\System32\uMScVeC.exe
  2⤵
  PID:8772
- C:\Windows\System32\JgretHy.exe
  C:\Windows\System32\JgretHy.exe
  2⤵
  PID:8292
- C:\Windows\System32\mDslREJ.exe
  C:\Windows\System32\mDslREJ.exe
  2⤵
  PID:9240
- C:\Windows\System32\OyHUPld.exe
  C:\Windows\System32\OyHUPld.exe
  2⤵
  PID:9296
- C:\Windows\System32\zweOuGc.exe
  C:\Windows\System32\zweOuGc.exe
  2⤵
  PID:9324
- C:\Windows\System32\lNSXsnS.exe
  C:\Windows\System32\lNSXsnS.exe
  2⤵
  PID:9348
- C:\Windows\System32\lfiPUFE.exe
  C:\Windows\System32\lfiPUFE.exe
  2⤵
  PID:9368
- C:\Windows\System32\UfaTMyo.exe
  C:\Windows\System32\UfaTMyo.exe
  2⤵
  PID:9396
- C:\Windows\System32\XchqFDl.exe
  C:\Windows\System32\XchqFDl.exe
  2⤵
  PID:9476
- C:\Windows\System32\HqUoSBj.exe
  C:\Windows\System32\HqUoSBj.exe
  2⤵
  PID:9508
- C:\Windows\System32\EDahCLW.exe
  C:\Windows\System32\EDahCLW.exe
  2⤵
  PID:9564
- C:\Windows\System32\xbMnLye.exe
  C:\Windows\System32\xbMnLye.exe
  2⤵
  PID:9608
- C:\Windows\System32\cDBDVLf.exe
  C:\Windows\System32\cDBDVLf.exe
  2⤵
  PID:9628
- C:\Windows\System32\EGbVXlE.exe
  C:\Windows\System32\EGbVXlE.exe
  2⤵
  PID:9668
- C:\Windows\System32\CJRdNVu.exe
  C:\Windows\System32\CJRdNVu.exe
  2⤵
  PID:9700
- C:\Windows\System32\uamunBK.exe
  C:\Windows\System32\uamunBK.exe
  2⤵
  PID:9724
- C:\Windows\System32\iSmldzG.exe
  C:\Windows\System32\iSmldzG.exe
  2⤵
  PID:9744
- C:\Windows\System32\HLkFkfh.exe
  C:\Windows\System32\HLkFkfh.exe
  2⤵
  PID:9760
- C:\Windows\System32\TeBSkPV.exe
  C:\Windows\System32\TeBSkPV.exe
  2⤵
  PID:9784
- C:\Windows\System32\TBYvbvR.exe
  C:\Windows\System32\TBYvbvR.exe
  2⤵
  PID:9804
- C:\Windows\System32\pDVcRWI.exe
  C:\Windows\System32\pDVcRWI.exe
  2⤵
  PID:9824
- C:\Windows\System32\SMMchkv.exe
  C:\Windows\System32\SMMchkv.exe
  2⤵
  PID:9860
- C:\Windows\System32\EAPpcIV.exe
  C:\Windows\System32\EAPpcIV.exe
  2⤵
  PID:9916
- C:\Windows\System32\fTThRPT.exe
  C:\Windows\System32\fTThRPT.exe
  2⤵
  PID:9936
- C:\Windows\System32\QjErEma.exe
  C:\Windows\System32\QjErEma.exe
  2⤵
  PID:9968
- C:\Windows\System32\bavoNvN.exe
  C:\Windows\System32\bavoNvN.exe
  2⤵
  PID:9988
- C:\Windows\System32\UJFJHdp.exe
  C:\Windows\System32\UJFJHdp.exe
  2⤵
  PID:10012
- C:\Windows\System32\pzeKxtR.exe
  C:\Windows\System32\pzeKxtR.exe
  2⤵
  PID:10044
- C:\Windows\System32\JBTcoXq.exe
  C:\Windows\System32\JBTcoXq.exe
  2⤵
  PID:10080
- C:\Windows\System32\qSPfZel.exe
  C:\Windows\System32\qSPfZel.exe
  2⤵
  PID:10116
- C:\Windows\System32\gPbPRaZ.exe
  C:\Windows\System32\gPbPRaZ.exe
  2⤵
  PID:10136
- C:\Windows\System32\hTsYPkQ.exe
  C:\Windows\System32\hTsYPkQ.exe
  2⤵
  PID:10152
- C:\Windows\System32\kzjpEAa.exe
  C:\Windows\System32\kzjpEAa.exe
  2⤵
  PID:10200
- C:\Windows\System32\TGAsYrq.exe
  C:\Windows\System32\TGAsYrq.exe
  2⤵
  PID:10216
- C:\Windows\System32\TxFOAIa.exe
  C:\Windows\System32\TxFOAIa.exe
  2⤵
  PID:9088
- C:\Windows\System32\dlItFUW.exe
  C:\Windows\System32\dlItFUW.exe
  2⤵
  PID:8312
- C:\Windows\System32\qzSDEXr.exe
  C:\Windows\System32\qzSDEXr.exe
  2⤵
  PID:9232
- C:\Windows\System32\HtSsPVf.exe
  C:\Windows\System32\HtSsPVf.exe
  2⤵
  PID:9308
- C:\Windows\System32\jslfYlm.exe
  C:\Windows\System32\jslfYlm.exe
  2⤵
  PID:9360
- C:\Windows\System32\ygQfaFA.exe
  C:\Windows\System32\ygQfaFA.exe
  2⤵
  PID:9364
- C:\Windows\System32\fpLRDdp.exe
  C:\Windows\System32\fpLRDdp.exe
  2⤵
  PID:9500
- C:\Windows\System32\feLLAJT.exe
  C:\Windows\System32\feLLAJT.exe
  2⤵
  PID:9572
- C:\Windows\System32\hcDIZlC.exe
  C:\Windows\System32\hcDIZlC.exe
  2⤵
  PID:9624
- C:\Windows\System32\fQIVEVY.exe
  C:\Windows\System32\fQIVEVY.exe
  2⤵
  PID:9692
- C:\Windows\System32\abeHslX.exe
  C:\Windows\System32\abeHslX.exe
  2⤵
  PID:9740
- C:\Windows\System32\tfTcfEw.exe
  C:\Windows\System32\tfTcfEw.exe
  2⤵
  PID:9732
- C:\Windows\System32\GEyYmXk.exe
  C:\Windows\System32\GEyYmXk.exe
  2⤵
  PID:9852
- C:\Windows\System32\RtDiBfk.exe
  C:\Windows\System32\RtDiBfk.exe
  2⤵
  PID:9948
- C:\Windows\System32\RBeBLuo.exe
  C:\Windows\System32\RBeBLuo.exe
  2⤵
  PID:10036
- C:\Windows\System32\OvVGmin.exe
  C:\Windows\System32\OvVGmin.exe
  2⤵
  PID:10100
- C:\Windows\System32\EUoJTWq.exe
  C:\Windows\System32\EUoJTWq.exe
  2⤵
  PID:10160
- C:\Windows\System32\UeBwkZB.exe
  C:\Windows\System32\UeBwkZB.exe
  2⤵
  PID:10144
- C:\Windows\System32\vFYfInJ.exe
  C:\Windows\System32\vFYfInJ.exe
  2⤵
  PID:9336
- C:\Windows\System32\LJOOYch.exe
  C:\Windows\System32\LJOOYch.exe
  2⤵
  PID:9424
- C:\Windows\System32\fSxMKWR.exe
  C:\Windows\System32\fSxMKWR.exe
  2⤵
  PID:9552
- C:\Windows\System32\nEUlXyI.exe
  C:\Windows\System32\nEUlXyI.exe
  2⤵
  PID:9636
- C:\Windows\System32\ZXjjxjk.exe
  C:\Windows\System32\ZXjjxjk.exe
  2⤵
  PID:8740
- C:\Windows\System32\zlFBJHD.exe
  C:\Windows\System32\zlFBJHD.exe
  2⤵
  PID:9976
- C:\Windows\System32\OPTkYIh.exe
  C:\Windows\System32\OPTkYIh.exe
  2⤵
  PID:10132
- C:\Windows\System32\LTpETvV.exe
  C:\Windows\System32\LTpETvV.exe
  2⤵
  PID:9320
- C:\Windows\System32\sdqraRn.exe
  C:\Windows\System32\sdqraRn.exe
  2⤵
  PID:9756
- C:\Windows\System32\fNKyFfM.exe
  C:\Windows\System32\fNKyFfM.exe
  2⤵
  PID:9776
- C:\Windows\System32\qYspSxP.exe
  C:\Windows\System32\qYspSxP.exe
  2⤵
  PID:10212
- C:\Windows\System32\bukvlmY.exe
  C:\Windows\System32\bukvlmY.exe
  2⤵
  PID:9684
- C:\Windows\System32\FoLDKEM.exe
  C:\Windows\System32\FoLDKEM.exe
  2⤵
  PID:10264
- C:\Windows\System32\BWqjzTu.exe
  C:\Windows\System32\BWqjzTu.exe
  2⤵
  PID:10284
- C:\Windows\System32\ZVpgdib.exe
  C:\Windows\System32\ZVpgdib.exe
  2⤵
  PID:10304
- C:\Windows\System32\lmdIHlu.exe
  C:\Windows\System32\lmdIHlu.exe
  2⤵
  PID:10332
- C:\Windows\System32\MGwFgjA.exe
  C:\Windows\System32\MGwFgjA.exe
  2⤵
  PID:10384
- C:\Windows\System32\NTqmPGV.exe
  C:\Windows\System32\NTqmPGV.exe
  2⤵
  PID:10428
- C:\Windows\System32\GaJgmdE.exe
  C:\Windows\System32\GaJgmdE.exe
  2⤵
  PID:10448
- C:\Windows\System32\xmtMFTg.exe
  C:\Windows\System32\xmtMFTg.exe
  2⤵
  PID:10464
- C:\Windows\System32\HMmaEmL.exe
  C:\Windows\System32\HMmaEmL.exe
  2⤵
  PID:10484
- C:\Windows\System32\zXucdwZ.exe
  C:\Windows\System32\zXucdwZ.exe
  2⤵
  PID:10500
- C:\Windows\System32\OKtqzRV.exe
  C:\Windows\System32\OKtqzRV.exe
  2⤵
  PID:10520
- C:\Windows\System32\uVPyVFv.exe
  C:\Windows\System32\uVPyVFv.exe
  2⤵
  PID:10540
- C:\Windows\System32\zPDGzfC.exe
  C:\Windows\System32\zPDGzfC.exe
  2⤵
  PID:10564
- C:\Windows\System32\kKNULew.exe
  C:\Windows\System32\kKNULew.exe
  2⤵
  PID:10580
- C:\Windows\System32\JGabWjo.exe
  C:\Windows\System32\JGabWjo.exe
  2⤵
  PID:10612
- C:\Windows\System32\UMHkFBb.exe
  C:\Windows\System32\UMHkFBb.exe
  2⤵
  PID:10652
- C:\Windows\System32\KYQDBIn.exe
  C:\Windows\System32\KYQDBIn.exe
  2⤵
  PID:10668
- C:\Windows\System32\PvfnkVv.exe
  C:\Windows\System32\PvfnkVv.exe
  2⤵
  PID:10684
- C:\Windows\System32\KJzgoui.exe
  C:\Windows\System32\KJzgoui.exe
  2⤵
  PID:10700
- C:\Windows\System32\MogSOfv.exe
  C:\Windows\System32\MogSOfv.exe
  2⤵
  PID:10744
- C:\Windows\System32\iwYiyQq.exe
  C:\Windows\System32\iwYiyQq.exe
  2⤵
  PID:10804
- C:\Windows\System32\VvSoOdr.exe
  C:\Windows\System32\VvSoOdr.exe
  2⤵
  PID:10828
- C:\Windows\System32\ktqfIqj.exe
  C:\Windows\System32\ktqfIqj.exe
  2⤵
  PID:10884
- C:\Windows\System32\PNFoHrA.exe
  C:\Windows\System32\PNFoHrA.exe
  2⤵
  PID:10912
- C:\Windows\System32\CjkuvJw.exe
  C:\Windows\System32\CjkuvJw.exe
  2⤵
  PID:10932
- C:\Windows\System32\sXBwFLp.exe
  C:\Windows\System32\sXBwFLp.exe
  2⤵
  PID:10960
- C:\Windows\System32\foNpLMG.exe
  C:\Windows\System32\foNpLMG.exe
  2⤵
  PID:11008
- C:\Windows\System32\AdjcMkj.exe
  C:\Windows\System32\AdjcMkj.exe
  2⤵
  PID:11028
- C:\Windows\System32\dXWrBZF.exe
  C:\Windows\System32\dXWrBZF.exe
  2⤵
  PID:11044
- C:\Windows\System32\fjKxEcZ.exe
  C:\Windows\System32\fjKxEcZ.exe
  2⤵
  PID:11080
- C:\Windows\System32\JMvdIYA.exe
  C:\Windows\System32\JMvdIYA.exe
  2⤵
  PID:11112
- C:\Windows\System32\uxWubIg.exe
  C:\Windows\System32\uxWubIg.exe
  2⤵
  PID:11160
- C:\Windows\System32\CCbGWes.exe
  C:\Windows\System32\CCbGWes.exe
  2⤵
  PID:11184
- C:\Windows\System32\cYdUsFl.exe
  C:\Windows\System32\cYdUsFl.exe
  2⤵
  PID:11208
- C:\Windows\System32\pbLzhSp.exe
  C:\Windows\System32\pbLzhSp.exe
  2⤵
  PID:11252
- C:\Windows\System32\uFPojdu.exe
  C:\Windows\System32\uFPojdu.exe
  2⤵
  PID:9536
- C:\Windows\System32\VjDaGLe.exe
  C:\Windows\System32\VjDaGLe.exe
  2⤵
  PID:10324
- C:\Windows\System32\GoZTeeS.exe
  C:\Windows\System32\GoZTeeS.exe
  2⤵
  PID:10340
- C:\Windows\System32\Fbeykry.exe
  C:\Windows\System32\Fbeykry.exe
  2⤵
  PID:4704
- C:\Windows\System32\bHYKYzc.exe
  C:\Windows\System32\bHYKYzc.exe
  2⤵
  PID:4380
- C:\Windows\System32\seCoZaN.exe
  C:\Windows\System32\seCoZaN.exe
  2⤵
  PID:10408
- C:\Windows\System32\mZNMXtW.exe
  C:\Windows\System32\mZNMXtW.exe
  2⤵
  PID:10512
- C:\Windows\System32\tpUpxnt.exe
  C:\Windows\System32\tpUpxnt.exe
  2⤵
  PID:10588
- C:\Windows\System32\apHldwG.exe
  C:\Windows\System32\apHldwG.exe
  2⤵
  PID:10572
- C:\Windows\System32\pTcVnqE.exe
  C:\Windows\System32\pTcVnqE.exe
  2⤵
  PID:10732
- C:\Windows\System32\EuVVkXd.exe
  C:\Windows\System32\EuVVkXd.exe
  2⤵
  PID:10756
- C:\Windows\System32\UgXrbEn.exe
  C:\Windows\System32\UgXrbEn.exe
  2⤵
  PID:10856
- C:\Windows\System32\RFTwmCE.exe
  C:\Windows\System32\RFTwmCE.exe
  2⤵
  PID:10924
- C:\Windows\System32\cCjjDPW.exe
  C:\Windows\System32\cCjjDPW.exe
  2⤵
  PID:10968
- C:\Windows\System32\iTNTYmY.exe
  C:\Windows\System32\iTNTYmY.exe
  2⤵
  PID:10988
- C:\Windows\System32\QDCSrqh.exe
  C:\Windows\System32\QDCSrqh.exe
  2⤵
  PID:11036
- C:\Windows\System32\HeCrOmq.exe
  C:\Windows\System32\HeCrOmq.exe
  2⤵
  PID:11088
- C:\Windows\System32\eclKUbD.exe
  C:\Windows\System32\eclKUbD.exe
  2⤵
  PID:11192
- C:\Windows\System32\vCPavYd.exe
  C:\Windows\System32\vCPavYd.exe
  2⤵
  PID:10996
- C:\Windows\System32\kzNFAuj.exe
  C:\Windows\System32\kzNFAuj.exe
  2⤵
  PID:10272
- C:\Windows\System32\zuLTmjz.exe
  C:\Windows\System32\zuLTmjz.exe
  2⤵
  PID:4612
- C:\Windows\System32\ErshLgh.exe
  C:\Windows\System32\ErshLgh.exe
  2⤵
  PID:10548
- C:\Windows\System32\chCpADb.exe
  C:\Windows\System32\chCpADb.exe
  2⤵
  PID:10800
- C:\Windows\System32\qUVwHfa.exe
  C:\Windows\System32\qUVwHfa.exe
  2⤵
  PID:10788
- C:\Windows\System32\xsuwSuo.exe
  C:\Windows\System32\xsuwSuo.exe
  2⤵
  PID:10956
- C:\Windows\System32\sKqpVoz.exe
  C:\Windows\System32\sKqpVoz.exe
  2⤵
  PID:11092
- C:\Windows\System32\vpFUuXN.exe
  C:\Windows\System32\vpFUuXN.exe
  2⤵
  PID:11052
- C:\Windows\System32\iEosFQq.exe
  C:\Windows\System32\iEosFQq.exe
  2⤵
  PID:10316
- C:\Windows\System32\iaRtRZT.exe
  C:\Windows\System32\iaRtRZT.exe
  2⤵
  PID:10064
- C:\Windows\System32\fZDKveO.exe
  C:\Windows\System32\fZDKveO.exe
  2⤵
  PID:10724
- C:\Windows\System32\bVZHtCP.exe
  C:\Windows\System32\bVZHtCP.exe
  2⤵
  PID:11204
- C:\Windows\System32\TzjPvRI.exe
  C:\Windows\System32\TzjPvRI.exe
  2⤵
  PID:11288
- C:\Windows\System32\LTWzGAN.exe
  C:\Windows\System32\LTWzGAN.exe
  2⤵
  PID:11308
- C:\Windows\System32\FvwNdKy.exe
  C:\Windows\System32\FvwNdKy.exe
  2⤵
  PID:11324
- C:\Windows\System32\FULaNWc.exe
  C:\Windows\System32\FULaNWc.exe
  2⤵
  PID:11364
- C:\Windows\System32\ZzrzkMi.exe
  C:\Windows\System32\ZzrzkMi.exe
  2⤵
  PID:11424
- C:\Windows\System32\OJlukNy.exe
  C:\Windows\System32\OJlukNy.exe
  2⤵
  PID:11484
- C:\Windows\System32\drfgMxu.exe
  C:\Windows\System32\drfgMxu.exe
  2⤵
  PID:11508
- C:\Windows\System32\IpYeTjZ.exe
  C:\Windows\System32\IpYeTjZ.exe
  2⤵
  PID:11528
- C:\Windows\System32\xsVsGWU.exe
  C:\Windows\System32\xsVsGWU.exe
  2⤵
  PID:11552
- C:\Windows\System32\sNdvyTu.exe
  C:\Windows\System32\sNdvyTu.exe
  2⤵
  PID:11572
- C:\Windows\System32\aXqqehs.exe
  C:\Windows\System32\aXqqehs.exe
  2⤵
  PID:11596
- C:\Windows\System32\rFjzmJH.exe
  C:\Windows\System32\rFjzmJH.exe
  2⤵
  PID:11616
- C:\Windows\System32\KgTUvgj.exe
  C:\Windows\System32\KgTUvgj.exe
  2⤵
  PID:11632
- C:\Windows\System32\NqeDJyX.exe
  C:\Windows\System32\NqeDJyX.exe
  2⤵
  PID:11676
- C:\Windows\System32\QjlONhd.exe
  C:\Windows\System32\QjlONhd.exe
  2⤵
  PID:11696
- C:\Windows\System32\xDevRvL.exe
  C:\Windows\System32\xDevRvL.exe
  2⤵
  PID:11768
- C:\Windows\System32\yAKoJbH.exe
  C:\Windows\System32\yAKoJbH.exe
  2⤵
  PID:11792
- C:\Windows\System32\sorTSuK.exe
  C:\Windows\System32\sorTSuK.exe
  2⤵
  PID:11808
- C:\Windows\System32\XeTdyLg.exe
  C:\Windows\System32\XeTdyLg.exe
  2⤵
  PID:11832
- C:\Windows\System32\zONMAsO.exe
  C:\Windows\System32\zONMAsO.exe
  2⤵
  PID:11852
- C:\Windows\System32\jXQaELj.exe
  C:\Windows\System32\jXQaELj.exe
  2⤵
  PID:11896
- C:\Windows\System32\nXJAvAI.exe
  C:\Windows\System32\nXJAvAI.exe
  2⤵
  PID:11920
- C:\Windows\System32\ukPLncr.exe
  C:\Windows\System32\ukPLncr.exe
  2⤵
  PID:11936
- C:\Windows\System32\sGFpQTm.exe
  C:\Windows\System32\sGFpQTm.exe
  2⤵
  PID:11956
- C:\Windows\System32\JmhWARb.exe
  C:\Windows\System32\JmhWARb.exe
  2⤵
  PID:11988
- C:\Windows\System32\VJokKPv.exe
  C:\Windows\System32\VJokKPv.exe
  2⤵
  PID:12028
- C:\Windows\System32\hgrfRQy.exe
  C:\Windows\System32\hgrfRQy.exe
  2⤵
  PID:12052
- C:\Windows\System32\AXZJSpw.exe
  C:\Windows\System32\AXZJSpw.exe
  2⤵
  PID:12092
- C:\Windows\System32\tDKhWTd.exe
  C:\Windows\System32\tDKhWTd.exe
  2⤵
  PID:12132
- C:\Windows\System32\oLlkamO.exe
  C:\Windows\System32\oLlkamO.exe
  2⤵
  PID:12152
- C:\Windows\System32\LSXancv.exe
  C:\Windows\System32\LSXancv.exe
  2⤵
  PID:12192
- C:\Windows\System32\zNtPxHB.exe
  C:\Windows\System32\zNtPxHB.exe
  2⤵
  PID:12220
- C:\Windows\System32\cVVocfM.exe
  C:\Windows\System32\cVVocfM.exe
  2⤵
  PID:12236
- C:\Windows\System32\JDePlSv.exe
  C:\Windows\System32\JDePlSv.exe
  2⤵
  PID:12256
- C:\Windows\System32\pesOmlQ.exe
  C:\Windows\System32\pesOmlQ.exe
  2⤵
  PID:12272
- C:\Windows\System32\wXkbbCA.exe
  C:\Windows\System32\wXkbbCA.exe
  2⤵
  PID:11180
- C:\Windows\System32\hluVgYu.exe
  C:\Windows\System32\hluVgYu.exe
  2⤵
  PID:11336
- C:\Windows\System32\IlsLQFI.exe
  C:\Windows\System32\IlsLQFI.exe
  2⤵
  PID:11316
- C:\Windows\System32\jBVCOPT.exe
  C:\Windows\System32\jBVCOPT.exe
  2⤵
  PID:11420
- C:\Windows\System32\WaOrBzi.exe
  C:\Windows\System32\WaOrBzi.exe
  2⤵
  PID:11540
- C:\Windows\System32\JRTPrmC.exe
  C:\Windows\System32\JRTPrmC.exe
  2⤵
  PID:11536
- C:\Windows\System32\bborrRR.exe
  C:\Windows\System32\bborrRR.exe
  2⤵
  PID:11568
- C:\Windows\System32\QLMDAsL.exe
  C:\Windows\System32\QLMDAsL.exe
  2⤵
  PID:11612
- C:\Windows\System32\cGcGoXS.exe
  C:\Windows\System32\cGcGoXS.exe
  2⤵
  PID:11704
- C:\Windows\System32\ANKtFuu.exe
  C:\Windows\System32\ANKtFuu.exe
  2⤵
  PID:11736
- C:\Windows\System32\spEjiiY.exe
  C:\Windows\System32\spEjiiY.exe
  2⤵
  PID:11804
- C:\Windows\System32\hAcwTjE.exe
  C:\Windows\System32\hAcwTjE.exe
  2⤵
  PID:11916
- C:\Windows\System32\BgJKGJu.exe
  C:\Windows\System32\BgJKGJu.exe
  2⤵
  PID:11912
- C:\Windows\System32\fluIeAA.exe
  C:\Windows\System32\fluIeAA.exe
  2⤵
  PID:11928
- C:\Windows\System32\vHrsPbn.exe
  C:\Windows\System32\vHrsPbn.exe
  2⤵
  PID:12068
- C:\Windows\System32\uErlfFc.exe
  C:\Windows\System32\uErlfFc.exe
  2⤵
  PID:12120
- C:\Windows\System32\grxrVyE.exe
  C:\Windows\System32\grxrVyE.exe
  2⤵
  PID:12168
- C:\Windows\System32\sSRcaRN.exe
  C:\Windows\System32\sSRcaRN.exe
  2⤵
  PID:12228
- C:\Windows\System32\bIbNXlc.exe
  C:\Windows\System32\bIbNXlc.exe
  2⤵
  PID:12264
- C:\Windows\System32\NWYZIpf.exe
  C:\Windows\System32\NWYZIpf.exe
  2⤵
  PID:11644
- C:\Windows\System32\POeUwrh.exe
  C:\Windows\System32\POeUwrh.exe
  2⤵
  PID:11824
- C:\Windows\System32\fMwxQei.exe
  C:\Windows\System32\fMwxQei.exe
  2⤵
  PID:11840
- C:\Windows\System32\wzSaAdR.exe
  C:\Windows\System32\wzSaAdR.exe
  2⤵
  PID:12080
- C:\Windows\System32\YLTfNgD.exe
  C:\Windows\System32\YLTfNgD.exe
  2⤵
  PID:12116
- C:\Windows\System32\cxyNNcm.exe
  C:\Windows\System32\cxyNNcm.exe
  2⤵
  PID:12184
- C:\Windows\System32\BRuGfev.exe
  C:\Windows\System32\BRuGfev.exe
  2⤵
  PID:11472
- C:\Windows\System32\mpSbLhp.exe
  C:\Windows\System32\mpSbLhp.exe
  2⤵
  PID:11640
- C:\Windows\System32\WAqWlfa.exe
  C:\Windows\System32\WAqWlfa.exe
  2⤵
  PID:11888
- C:\Windows\System32\cWaBjOW.exe
  C:\Windows\System32\cWaBjOW.exe
  2⤵
  PID:12144
- C:\Windows\System32\CEOfbzI.exe
  C:\Windows\System32\CEOfbzI.exe
  2⤵
  PID:11436
- C:\Windows\System32\fCzYqbp.exe
  C:\Windows\System32\fCzYqbp.exe
  2⤵
  PID:12300
- C:\Windows\System32\XMgRczk.exe
  C:\Windows\System32\XMgRczk.exe
  2⤵
  PID:12352
- C:\Windows\System32\CtZOWFW.exe
  C:\Windows\System32\CtZOWFW.exe
  2⤵
  PID:12368
- C:\Windows\System32\ippxiDJ.exe
  C:\Windows\System32\ippxiDJ.exe
  2⤵
  PID:12396
- C:\Windows\System32\IvKYJIX.exe
  C:\Windows\System32\IvKYJIX.exe
  2⤵
  PID:12420
- C:\Windows\System32\SaPCoTm.exe
  C:\Windows\System32\SaPCoTm.exe
  2⤵
  PID:12444
- C:\Windows\System32\gdBWeyq.exe
  C:\Windows\System32\gdBWeyq.exe
  2⤵
  PID:12496
- C:\Windows\System32\bqiWLwV.exe
  C:\Windows\System32\bqiWLwV.exe
  2⤵
  PID:12520
- C:\Windows\System32\wyCygsF.exe
  C:\Windows\System32\wyCygsF.exe
  2⤵
  PID:12536
- C:\Windows\System32\ObbTkIx.exe
  C:\Windows\System32\ObbTkIx.exe
  2⤵
  PID:12564
- C:\Windows\System32\PgHHSSq.exe
  C:\Windows\System32\PgHHSSq.exe
  2⤵
  PID:12584
- C:\Windows\System32\JkOrhxX.exe
  C:\Windows\System32\JkOrhxX.exe
  2⤵
  PID:12612
- C:\Windows\System32\jHSOoty.exe
  C:\Windows\System32\jHSOoty.exe
  2⤵
  PID:12652
- C:\Windows\System32\slEhVJw.exe
  C:\Windows\System32\slEhVJw.exe
  2⤵
  PID:12692
- C:\Windows\System32\diLddQL.exe
  C:\Windows\System32\diLddQL.exe
  2⤵
  PID:12720
- C:\Windows\System32\ZeLgVyb.exe
  C:\Windows\System32\ZeLgVyb.exe
  2⤵
  PID:12736
- C:\Windows\System32\lyNzStG.exe
  C:\Windows\System32\lyNzStG.exe
  2⤵
  PID:12756
- C:\Windows\System32\JWkUjkN.exe
  C:\Windows\System32\JWkUjkN.exe
  2⤵
  PID:12780
- C:\Windows\System32\qhlqBVJ.exe
  C:\Windows\System32\qhlqBVJ.exe
  2⤵
  PID:12820
- C:\Windows\System32\PmxFNEQ.exe
  C:\Windows\System32\PmxFNEQ.exe
  2⤵
  PID:12848
- C:\Windows\System32\YwNFKXT.exe
  C:\Windows\System32\YwNFKXT.exe
  2⤵
  PID:12868
- C:\Windows\System32\gsFDLXo.exe
  C:\Windows\System32\gsFDLXo.exe
  2⤵
  PID:12896
- C:\Windows\System32\yiMFUfM.exe
  C:\Windows\System32\yiMFUfM.exe
  2⤵
  PID:12932
- C:\Windows\System32\zcWbEbj.exe
  C:\Windows\System32\zcWbEbj.exe
  2⤵
  PID:12960
- C:\Windows\System32\IOYclVg.exe
  C:\Windows\System32\IOYclVg.exe
  2⤵
  PID:13004
- C:\Windows\System32\BclEiRr.exe
  C:\Windows\System32\BclEiRr.exe
  2⤵
  PID:13028
- C:\Windows\System32\dLutjbm.exe
  C:\Windows\System32\dLutjbm.exe
  2⤵
  PID:13044
- C:\Windows\System32\qvEckta.exe
  C:\Windows\System32\qvEckta.exe
  2⤵
  PID:13064
- C:\Windows\System32\hwdifyo.exe
  C:\Windows\System32\hwdifyo.exe
  2⤵
  PID:13096
- C:\Windows\System32\lDBIExL.exe
  C:\Windows\System32\lDBIExL.exe
  2⤵
  PID:13124
- C:\Windows\System32\FakEpcW.exe
  C:\Windows\System32\FakEpcW.exe
  2⤵
  PID:13156
- C:\Windows\System32\yqxOdJN.exe
  C:\Windows\System32\yqxOdJN.exe
  2⤵
  PID:13188
- C:\Windows\System32\yfIMDfy.exe
  C:\Windows\System32\yfIMDfy.exe
  2⤵
  PID:13204
- C:\Windows\System32\sVXiwwG.exe
  C:\Windows\System32\sVXiwwG.exe
  2⤵
  PID:13228
- C:\Windows\System32\XZdHyjN.exe
  C:\Windows\System32\XZdHyjN.exe
  2⤵
  PID:13244
- C:\Windows\System32\bjkioJD.exe
  C:\Windows\System32\bjkioJD.exe
  2⤵
  PID:13264
- C:\Windows\System32\NfGvKCb.exe
  C:\Windows\System32\NfGvKCb.exe
  2⤵
  PID:13288
- C:\Windows\System32\BWXrEPV.exe
  C:\Windows\System32\BWXrEPV.exe
  2⤵
  PID:13308
- C:\Windows\System32\NJTNMuI.exe
  C:\Windows\System32\NJTNMuI.exe
  2⤵
  PID:12336
- C:\Windows\System32\KNuBbLz.exe
  C:\Windows\System32\KNuBbLz.exe
  2⤵
  PID:12452
- C:\Windows\System32\DvVgFXi.exe
  C:\Windows\System32\DvVgFXi.exe
  2⤵
  PID:12548
- C:\Windows\System32\DPVWzJO.exe
  C:\Windows\System32\DPVWzJO.exe
  2⤵
  PID:12608
- C:\Windows\System32\gsYVdEO.exe
  C:\Windows\System32\gsYVdEO.exe
  2⤵
  PID:12684
- C:\Windows\System32\ighWSbv.exe
  C:\Windows\System32\ighWSbv.exe
  2⤵
  PID:12752
- C:\Windows\System32\wJKnfsq.exe
  C:\Windows\System32\wJKnfsq.exe
  2⤵
  PID:12840
- C:\Windows\System32\UonkQvM.exe
  C:\Windows\System32\UonkQvM.exe
  2⤵
  PID:12888
- C:\Windows\System32\CcQohMS.exe
  C:\Windows\System32\CcQohMS.exe
  2⤵
  PID:12996
- C:\Windows\System32\PXzKeLN.exe
  C:\Windows\System32\PXzKeLN.exe
  2⤵
  PID:13040
- C:\Windows\System32\SCXTlbq.exe
  C:\Windows\System32\SCXTlbq.exe
  2⤵
  PID:13120
- C:\Windows\System32\tmeAfll.exe
  C:\Windows\System32\tmeAfll.exe
  2⤵
  PID:13108
- C:\Windows\System32\VAgMMxy.exe
  C:\Windows\System32\VAgMMxy.exe
  2⤵
  PID:13168
- C:\Windows\System32\lOLaEDt.exe
  C:\Windows\System32\lOLaEDt.exe
  2⤵
  PID:13240
- C:\Windows\System32\wFoozRN.exe
  C:\Windows\System32\wFoozRN.exe
  2⤵
  PID:13272
- C:\Windows\System32\Jacpmxu.exe
  C:\Windows\System32\Jacpmxu.exe
  2⤵
  PID:11584
- C:\Windows\System32\gqFKEeD.exe
  C:\Windows\System32\gqFKEeD.exe
  2⤵
  PID:12572
- C:\Windows\System32\fIwnegG.exe
  C:\Windows\System32\fIwnegG.exe
  2⤵
  PID:12668
- C:\Windows\System32\KrZGfLu.exe
  C:\Windows\System32\KrZGfLu.exe
  2⤵
  PID:12808
- C:\Windows\System32\RsZWAlp.exe
  C:\Windows\System32\RsZWAlp.exe
  2⤵
  PID:11332
- C:\Windows\System32\JJzQynF.exe
  C:\Windows\System32\JJzQynF.exe
  2⤵
  PID:13056
- C:\Windows\System32\RIUuykB.exe
  C:\Windows\System32\RIUuykB.exe
  2⤵
  PID:11280
- C:\Windows\System32\WVBijsT.exe
  C:\Windows\System32\WVBijsT.exe
  2⤵
  PID:13284
- C:\Windows\System32\EoMCqQj.exe
  C:\Windows\System32\EoMCqQj.exe
  2⤵
  PID:12664
- C:\Windows\System32\XpfpOph.exe
  C:\Windows\System32\XpfpOph.exe
  2⤵
  PID:13012
- C:\Windows\System32\ppzDFRz.exe
  C:\Windows\System32\ppzDFRz.exe
  2⤵
  PID:12328
- C:\Windows\System32\ZWykqtO.exe
  C:\Windows\System32\ZWykqtO.exe
  2⤵
  PID:13060
- C:\Windows\System32\FpaGtVR.exe
  C:\Windows\System32\FpaGtVR.exe
  2⤵
  PID:13328
- C:\Windows\System32\HVgfgFW.exe
  C:\Windows\System32\HVgfgFW.exe
  2⤵
  PID:13352
- C:\Windows\System32\NhBhRBJ.exe
  C:\Windows\System32\NhBhRBJ.exe
  2⤵
  PID:13372
- C:\Windows\System32\BVFEkiQ.exe
  C:\Windows\System32\BVFEkiQ.exe
  2⤵
  PID:13408
- C:\Windows\System32\NEDlnpT.exe
  C:\Windows\System32\NEDlnpT.exe
  2⤵
  PID:13480
- C:\Windows\System32\JPglhkM.exe
  C:\Windows\System32\JPglhkM.exe
  2⤵
  PID:13508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\AhfQrat.exe

Filesize
1.1MB

MD5
59f97ad02cab62f59727b7d69b6097d1

SHA1
11a74e6f0bcd90e1e50a66cdc8899647bdfd2a23

SHA256
b6266ea8a92a6a81b3b1b7c1f485cc7a54bebb100f67362a6f627e0382a3cf91

SHA512
e6a5a9c594089a1a47c1efe060d786ec6602d85becaae713db6047ebed586d380a4833a0f89b8d80dffbbf63788f0b9830d0cda7e30f9fac9d52b0089c21e0fb

Download Submit
C:\Windows\System32\BdbZznZ.exe

Filesize
1.1MB

MD5
01fa9649db2ec45e53d7281c8045f932

SHA1
fce03dcb1dba6a9899a6789e58715fcff5cfe565

SHA256
1d04db9df3a0aee6f7ca1eac2f85e1194343d47249303091a6a7ba440b65d00b

SHA512
b5dffd7ce7789b0fc283d29b55665c025c6e017d899f2e17afcf6725db7923bd2a52225af3056eb07bb1a19e65e77bad0c7fba6dae53e964bb768c360ecd0436

Download Submit
C:\Windows\System32\CECqqak.exe

Filesize
1.1MB

MD5
14a1ceaabd6cf95f00aa03eba4481119

SHA1
a6d13393a279c369ce45473d8545259db04c212c

SHA256
89105ed75df88e6e6fbbfaea646925629625b6d1cfe895f5a55e49235e04c39c

SHA512
94e7fd2682e82e35c7c694518dbcaee302385a5299dab3de851120baf870f90cd6d81484b3c6d31acf284c562fdbc425a46080461e3ac077985180bc4efe286e

Download Submit
C:\Windows\System32\CHZbonU.exe

Filesize
1.1MB

MD5
920a78a8a6fc773b643da208eedb3ef1

SHA1
1ae75cf38b17dcf7f9474867c0a7d178d306d43f

SHA256
7d3a7875038d3169be56f3b5c4e57e4f10cb170f8f6c8dc2c7010dc417cad342

SHA512
aa15941c920b1ae745370f4e31e53968237fab7964b64a3c6c9ed0c059f883fab2953ac7fc7dd039390c0bf364c6353628f16fbd237c326519d9cc27cf973c22

Download Submit
C:\Windows\System32\GloWvbE.exe

Filesize
1.1MB

MD5
b2db72d62f1c44428f47dc743c6d8aa4

SHA1
dc4ddfe95c98a65af670c326e0f20eecfedebcbc

SHA256
6059646bcc244141344729f2fb9916ed90ad0566eb1e999e93fd56e8d68bff30

SHA512
52c4bb852744695f6fc04ed1546a1e645ffecd48cf43b2b6619fefa372fce4c90455d2971a62396afacf61f3cd502ac3b4a89d831b9a18bf393450bc82b311e3

Download Submit
C:\Windows\System32\MFuJqOr.exe

Filesize
1.1MB

MD5
80fe2ae27aa043b77f9e1085253d0754

SHA1
34b0e1f2c6d52cb10b487911e07a6cbd1d8b8f9a

SHA256
fb20bdd34eedd24ea381a575f7ba59963330ee0b132621ebbd25ec7907cbd58f

SHA512
2e77fd34f4439527ec166838009c3529b6b0cd8cf31d00bbf7f3cb46e72f640fac224eaa7379dceaefaa8998f1fe12da0be7d0b15ae95b493872984df861ec53

Download Submit
C:\Windows\System32\PNxmPlk.exe

Filesize
1.1MB

MD5
095a08b82306635e8b738f74d6ce5b1b

SHA1
cce74a040dae19259c9803917d53519b87d135b1

SHA256
8010350a367d9aa211d8d85e678680de70679f84caca5898b87097e1f7e3782e

SHA512
6661d51784997cfa1cd06f584886cf25b26720fc797f3867ff5ca008a453a811724372c986cffacd19c1f69d028709293f6829185e6686b1fe498ee079b9ce67

Download Submit
C:\Windows\System32\PkqZOdD.exe

Filesize
1.1MB

MD5
902479cbb64da7f896b3fcd02ef6039f

SHA1
a1c921a957e9947ec5c33393c7d055d77aaa5af5

SHA256
1f3788003d221e935441c76536e11e9c0a0594e4dde508595c78635944eddcf1

SHA512
a96a166bbe9e836436c1dafcecd74ef47fe7c9d626685ce52459a7e3ad4178f02473c5e9bdc4089751400343671fda344d7e7434b67368b95b27e9f0474f2127

Download Submit
C:\Windows\System32\RHTueGf.exe

Filesize
1.1MB

MD5
a080fd61fb0f327329488731b51c2804

SHA1
01b01eb4f0de7478a7142a3a4852876cb52c24a4

SHA256
e372d430c4b3e15737aa547314306e1dc63626edaf54c1c53adcf7404a52d1db

SHA512
59d6c4ce5a4173200bf24000f3625e41c2eb10c16f9cbd71101ed965f9cbc52cd8d32159fed1d4a62d24bbd0ac4fbcdb25990632f973c613bbe6ef20d5380906

Download Submit
C:\Windows\System32\RyiKQgN.exe

Filesize
1.1MB

MD5
829e2ac45958a4ed21d3821ac33fd939

SHA1
2e7ad0bdb4b169662db27b469715b1aad7273016

SHA256
bc7d8db2c8cbbaaa77f991b791c536b5dd67548eaa5d1b4f8fadf84697447ac7

SHA512
d5974abefbeec43bf9b207acbdbbaa1945cd977236b8c99fd677ac4f7569a5cb8cfba4dbcc436f337128c2c392487819295060082e8219a3220e6a21275526e3

Download Submit
C:\Windows\System32\SBsiXer.exe

Filesize
1.1MB

MD5
8357c2f61572f2fd07ecb9a12ebe4f1b

SHA1
2b60971d5282148e7c86092930fadda318e00711

SHA256
e9e8d822e4f7a62e293b73e22cf161a4df4da36f7623e62b3c530fb2ca967c1f

SHA512
34035e44334fb287d9c0ef539cf71414e6f23b9a8ad7c5b8e999dff840a46bb35ea02de28523005686f13cfb2946fb15fc0ee79af911cf306d2218414343ec67

Download Submit
C:\Windows\System32\SNOzUZr.exe

Filesize
1.1MB

MD5
63b91a8df7916196bdde3f2f15e17ea7

SHA1
68f9d42eba170b53c79b52b48681b4d2ffe14b83

SHA256
5d26d09795f19a8d87828d594f0bd571d9f4f4c838137ea839e1c811ede1f743

SHA512
c47b3f7b2d5c4878b6de896ad1b534f52b52aabc2a74a2c5157ee0457456d492da2ce72e64d9145e3c0caae8e3032e5586588eb7fb4876a15bc87b0b16bcebc1

Download Submit
C:\Windows\System32\SiszfJD.exe

Filesize
1.1MB

MD5
035ffd1fa4e8d946a546b9817a4f6b9e

SHA1
04f26e7aa62b736f059c9b441d75d87989444612

SHA256
b26a4664fb2dd30cc9ef663e33cdd60877cab18f3faefafea9743b1181942251

SHA512
52e6f10c075b00278f453f29d4386a213a6b517ed2b1f82237e564b0ed0a432f793cc1d26abbadb3729f0d7882c04022bd067c48fa88961a47e0873b08d10e7c

Download Submit
C:\Windows\System32\TpSRRcd.exe

Filesize
1.1MB

MD5
948ca0301c239ca9ed5cae2c772a7450

SHA1
af11b6e3aa3d203e06cfd470417a2e85b95d4582

SHA256
cd9035b48a764362f9da2c3066fbfa3c28748b5ac45b8cbc6e7f9250aeae7c76

SHA512
b4a85b58f307df56fe5e5ae6c8e70b8a6c0c6c192fb43ee67d56e22d1c531b3726a7d13b3d3f72f21c7ca64d62dcdbbba04377db97ec7a5ce0110d3fee252c35

Download Submit
C:\Windows\System32\UQQrSNk.exe

Filesize
1.1MB

MD5
414caf27e773b5540749bf721f9e0f9b

SHA1
261a3a702ae07a245ab6ee0b897827a6e0ffada0

SHA256
42a83cf3d6853efbf2e7366ec4df5ea144b7ac4bd46772915649dc8c30554f09

SHA512
b763f68232f0c93cdc76a42de871a6aab7959eda627438f7b041ccfa35c6c64fb9c702f259445787aadf5a00b5d438a12fa9364dd212a41c454c5ea033bf1665

Download Submit
C:\Windows\System32\XXAkhnZ.exe

Filesize
1.1MB

MD5
6b09d771283b8d6e37392513755cdb79

SHA1
61af31352a5490ad1fe1238cd60d747a7306997c

SHA256
f0dd0cf793e4067111a864c78e6167c38157fb2559b3d77b10060cf46052537d

SHA512
01a78ee272562bf3ed6b8554625e6b2a91000e960eb992ce5052fbd6214aa87f5ab2ae3601560b876a8a2501142262a6b9c35f43be763863081203a26afb5656

Download Submit
C:\Windows\System32\YFKFLup.exe

Filesize
1.1MB

MD5
0cb7509772c4c7c3746eee4a9d7aa770

SHA1
1f9992b9d0089f730eb15dc8907f8d604f8e8fd8

SHA256
408530c95d52d33572fa5adbc10aa996af094e8d8b3cf86cacb35a1964e48149

SHA512
caca9ff602d369a8851b0979e579d8d8cb1e80c20262256df29981899b2fc9404589a19c0c15b89eaf437da758c4180cf338e5cfaf0f7ec917f5acbfc56c4a64

Download Submit
C:\Windows\System32\cSoGSRA.exe

Filesize
1.1MB

MD5
048d90e02281099bf8ee67cb4d44988a

SHA1
2c23727d34a3946c7ac8604f0cb5626b0d44564f

SHA256
211081bf9fa3defddc843ad6aff2912acadbdfdf18d3cdb0b8368d15188fc3b3

SHA512
ad8086833c0622dfcf20c0742ecbda7a8c4aaa0ea6fc3b769712bf664c4d5323c332d9098f929e3c59995a6d3e52888cae8027da1031a70e8d8cc3e1ffad3667

Download Submit
C:\Windows\System32\cuhwnhq.exe

Filesize
1.1MB

MD5
3757354fecbf1a7d28d0ed9277e77eea

SHA1
9ea11112cc6314df68f17b8c96d2f5116d35c718

SHA256
4fcb474b53b1a680abd02b95578b82b92bae9affa9cc3715d0ebbe3d0101f45d

SHA512
ced4f12c2ac5c26670e7abf5666f66447b96b44457f0d992e3d4741f0127e87136a0ba32ba50a3185012bb8ed7e165bb074b98771b3c5c7c0f8d39060bc33f6c

Download Submit
C:\Windows\System32\dOCtEiw.exe

Filesize
1.1MB

MD5
e263ddce46f35da8d3cf8e1763e3394f

SHA1
baea1767a6f74bb7134d0dcfd4de98be16647c2a

SHA256
11f60b3f658348847d1963bd897404535bab219bb7398c74676d05ce12bdfb34

SHA512
50fb9da6a53102ded13eceb414a8c3b2f62e3fb58d09abc44172332b0f04aca0cf362a28ca5e0a028da9316ecff2dc647d295115c74b2e77bdb685d480467d1e

Download Submit
C:\Windows\System32\ecSmAnH.exe

Filesize
1.1MB

MD5
6782faee11cdd142a756834da8961274

SHA1
cbc674feee5eb90d18c126ef8b147f832b2ffa10

SHA256
195cb0b4bccde08ad19902edf637acef9476acbdc37b36b0224abab52436c80d

SHA512
3edcedd8c5275b3761406e729ac05c71d8f88a355f371866b499d4156ae2e8a124ee79b13bd21c33bda6c4641c02fe19e70a40596332b122ee0bf1a554064dc1

Download Submit
C:\Windows\System32\fjCgMxX.exe

Filesize
1.1MB

MD5
300a3d391b093795a126d0a25082ea86

SHA1
64502ea1869d6626fef2890cf0f8ffff157865df

SHA256
f66d3b328ce94eb34db755934c590577a06cc81330abbf687e5dfa683145fccc

SHA512
86e725dea4ae33a78b5ac4cd75844081e5a9d11970dadc17c392eaec2779e872f0737c1ffde85c4b6f912710cafd078f5b6e9999dc7a230333c5063ea082d8ed

Download Submit
C:\Windows\System32\krgdwKD.exe

Filesize
1.1MB

MD5
3c03e20a0acee4e8956b693841df1fdf

SHA1
9303a5a87377a9e200eee7873aa8a6cfbb41f709

SHA256
b9681cfb335e6d64a416a046f022ae7cc61a7b844ea28283b6dd431465429cae

SHA512
1c06ebc55c0aa19bc93cf83f69e196edcf403beb66e0f873709774fca80a29c8b05dfeb3f9ae7ec4a02f1a097ee606b979654ed3832011c51590e9a1e34bb987

Download Submit
C:\Windows\System32\mGWlEkY.exe

Filesize
1.1MB

MD5
89b53cbee6f6e3e979a117eb1d71fece

SHA1
33c5a52686c0f91bedcfc4860d7c2adb0117fbc5

SHA256
60ba64607a92681a0e24c7df95031bdda6b6ed4b160d6566a0233262f4c6a003

SHA512
267eabc30cbc3ffa72d575d99ad5778e4e9d0fa2f6a8f4c8149624b2cb5bf4ba505153dd1227676b70f68a5dfc972f8f39ad5a3dad34197188a59414e50927c4

Download Submit
C:\Windows\System32\pZYKyAE.exe

Filesize
1.1MB

MD5
c3cea62ac54bc92f9c71fcd0ffee3129

SHA1
59edaee11948b7f3fe23e391c619a33ad3c446c8

SHA256
b8eb8497b3f590e378f04fba94f537bfac9e3d2a73c733051f32c539d78a26fc

SHA512
d6fc5dfb9c9906a5fa946b2bb8a640d53df4c9e85827fcc3c305c539a435cdd35cb03d7c03be247acd85506932d9419279728c212ba81c41a8610de8cccbfb7e

Download Submit
C:\Windows\System32\rFfbRlB.exe

Filesize
1.1MB

MD5
c1c95696b6f5ce4632122cb19f4ef3df

SHA1
51de0459e595c31c3662538d449c467b13f7874e

SHA256
3b185700e5b8b59b70040f805dbf0722c2b711c3890fc6bfed872e9fb4c85713

SHA512
d02fd644fe22d811e14bbb848f111e82db32b27091f7b12916877cbca61d8cf8414c53cf9ec53ef056940953106632ab706aa8e83025d8a55cf26909355ef598

Download Submit
C:\Windows\System32\tJPOuTZ.exe

Filesize
1.1MB

MD5
6472f7c6ccdbe8c5b2c67f347fb82ef4

SHA1
97a8981836a78c504d8a2734c3fc13df997af910

SHA256
03da7f87892351083b0b7bfd2b7db7f6b2a1b2fff153f9cb0382c6d5bba2354e

SHA512
b3339a60b6b97f03242a45bcc232f1e488b8b015e3adfa7e09bc1389b45c3ddcdc1d358cb5adb47ba505ceedc21d5dad582181a264b5e9cf89f0899784c220ae

Download Submit
C:\Windows\System32\tXyJlJQ.exe

Filesize
1.1MB

MD5
33944105d05dc21e892df0eee6cc521f

SHA1
60e3e50127280b5404992ea14cdfaa3b0b92ad39

SHA256
9b9c540b03f09feebdf212bbb9155f1bb8d7c9fb7ccc161d740b7c7ec580816f

SHA512
d1c85c7da20cd9e5decac822da2520e714972bfd7328561b2f217c42699012dfa115cc4765275ce2bff4c6a32ad13fde9273e4a12373ca4bf84c52d610cf6fac

Download Submit
C:\Windows\System32\ubDkECp.exe

Filesize
1.1MB

MD5
66fe9d9e500e5d8bab1ae6b40b51b171

SHA1
b79c05627034a49fae851cccb56ca2bb0342a79e

SHA256
803b25be0e697b280ca1381e24a423503be88c047f16552307b4c1b84fd7ecf0

SHA512
80e849292e1673b86fde198e3e7df1225f9dbed4c0525e2e011e6d77881df782ef40b5d37392484f751bb6808252324d690d22d8a25374ca9c8b157bace73c06

Download Submit
C:\Windows\System32\vddeewl.exe

Filesize
1.1MB

MD5
3d3fc3abbc729fab585e9347c2f046d4

SHA1
368eb32a9093d49dfbd389a7a4f55325bbf84fb5

SHA256
86a59de3f22502128234f373090faa15bc0d1acd85437d655707d800bddeb91f

SHA512
005417de280406bf99b4692d5136299194f41b9f246a1a367617ecf8d056e6378246f34a5a30600e2e1464baab155371219e14e5f8523606f2ae2c084005b6e2

Download Submit
C:\Windows\System32\wFviGkm.exe

Filesize
1.1MB

MD5
625c83d2f6821c0be6efa4ee97481ed7

SHA1
ae416e9b52af4f213af110545cbf8ee07b84269d

SHA256
41519c3facb9700d13bc53bf856900715ded8a3a44d3cf68d8917c6bd1dc5068

SHA512
a4468762054757c9d31f0ea7acb54cd57ea02991702746074a37ce5454a0dfc5d132c00765aa1b06b8f53773aedad690e54cfa7d24421ce1ad5969e5d23c735c

Download Submit
C:\Windows\System32\xmlEuZJ.exe

Filesize
1.1MB

MD5
f9ae6e0275ebdb321a5eb447a68db5c8

SHA1
344acc36e13042af8834f8144da0861040765030

SHA256
997e626c9e54348198a945b886eb81bbca21d6b24b15891866e964d91ec9b51c

SHA512
f842133eeb5c4bb420cb85bd45fcc1b723ed93dd225e78c920483d10fa9a5d30cbdbc110d2af727530d0adb63ea8621c0ac54a4a5bbbd30c930148ca3acab00e

Download Submit
memory/696-2181-0x00007FF63C160000-0x00007FF63C551000-memory.dmp

Filesize
3.9MB

Download
memory/696-312-0x00007FF63C160000-0x00007FF63C551000-memory.dmp

Filesize
3.9MB

Download
memory/736-2178-0x00007FF600A70000-0x00007FF600E61000-memory.dmp

Filesize
3.9MB

Download
memory/736-309-0x00007FF600A70000-0x00007FF600E61000-memory.dmp

Filesize
3.9MB

Download
memory/1248-2207-0x00007FF760720000-0x00007FF760B11000-memory.dmp

Filesize
3.9MB

Download
memory/1248-326-0x00007FF760720000-0x00007FF760B11000-memory.dmp

Filesize
3.9MB

Download
memory/1276-392-0x00007FF673B90000-0x00007FF673F81000-memory.dmp

Filesize
3.9MB

Download
memory/1276-2179-0x00007FF673B90000-0x00007FF673F81000-memory.dmp

Filesize
3.9MB

Download
memory/1688-27-0x00007FF692820000-0x00007FF692C11000-memory.dmp

Filesize
3.9MB

Download
memory/1688-2169-0x00007FF692820000-0x00007FF692C11000-memory.dmp

Filesize
3.9MB

Download
memory/1688-1490-0x00007FF692820000-0x00007FF692C11000-memory.dmp

Filesize
3.9MB

Download
memory/1772-2168-0x00007FF7E1DF0000-0x00007FF7E21E1000-memory.dmp

Filesize
3.9MB

Download
memory/1772-40-0x00007FF7E1DF0000-0x00007FF7E21E1000-memory.dmp

Filesize
3.9MB

Download
memory/1772-1491-0x00007FF7E1DF0000-0x00007FF7E21E1000-memory.dmp

Filesize
3.9MB

Download
memory/2204-2225-0x00007FF633E10000-0x00007FF634201000-memory.dmp

Filesize
3.9MB

Download
memory/2204-349-0x00007FF633E10000-0x00007FF634201000-memory.dmp

Filesize
3.9MB

Download
memory/2212-0-0x00007FF75D720000-0x00007FF75DB11000-memory.dmp

Filesize
3.9MB

Download
memory/2212-1233-0x00007FF75D720000-0x00007FF75DB11000-memory.dmp

Filesize
3.9MB

Download
memory/2212-1-0x00000222CF5C0000-0x00000222CF5D0000-memory.dmp

Filesize
64KB

Download
memory/2272-341-0x00007FF60E2A0000-0x00007FF60E691000-memory.dmp

Filesize
3.9MB

Download
memory/2272-2228-0x00007FF60E2A0000-0x00007FF60E691000-memory.dmp

Filesize
3.9MB

Download
memory/2416-1361-0x00007FF73A810000-0x00007FF73AC01000-memory.dmp

Filesize
3.9MB

Download
memory/2416-11-0x00007FF73A810000-0x00007FF73AC01000-memory.dmp

Filesize
3.9MB

Download
memory/2416-2161-0x00007FF73A810000-0x00007FF73AC01000-memory.dmp

Filesize
3.9MB

Download
memory/2484-2219-0x00007FF74E730000-0x00007FF74EB21000-memory.dmp

Filesize
3.9MB

Download
memory/2484-384-0x00007FF74E730000-0x00007FF74EB21000-memory.dmp

Filesize
3.9MB

Download
memory/2608-2174-0x00007FF6446A0000-0x00007FF644A91000-memory.dmp

Filesize
3.9MB

Download
memory/2608-1496-0x00007FF6446A0000-0x00007FF644A91000-memory.dmp

Filesize
3.9MB

Download
memory/2608-308-0x00007FF6446A0000-0x00007FF644A91000-memory.dmp

Filesize
3.9MB

Download
memory/2912-2215-0x00007FF652210000-0x00007FF652601000-memory.dmp

Filesize
3.9MB

Download
memory/2912-390-0x00007FF652210000-0x00007FF652601000-memory.dmp

Filesize
3.9MB

Download
memory/2948-364-0x00007FF6065B0000-0x00007FF6069A1000-memory.dmp

Filesize
3.9MB

Download
memory/2948-2222-0x00007FF6065B0000-0x00007FF6069A1000-memory.dmp

Filesize
3.9MB

Download
memory/3000-2184-0x00007FF60DFD0000-0x00007FF60E3C1000-memory.dmp

Filesize
3.9MB

Download
memory/3000-313-0x00007FF60DFD0000-0x00007FF60E3C1000-memory.dmp

Filesize
3.9MB

Download
memory/3280-2172-0x00007FF6CA8F0000-0x00007FF6CACE1000-memory.dmp

Filesize
3.9MB

Download
memory/3280-310-0x00007FF6CA8F0000-0x00007FF6CACE1000-memory.dmp

Filesize
3.9MB

Download
memory/3284-2212-0x00007FF77AA90000-0x00007FF77AE81000-memory.dmp

Filesize
3.9MB

Download
memory/3284-316-0x00007FF77AA90000-0x00007FF77AE81000-memory.dmp

Filesize
3.9MB

Download
memory/3988-2165-0x00007FF764CD0000-0x00007FF7650C1000-memory.dmp

Filesize
3.9MB

Download
memory/3988-1487-0x00007FF764CD0000-0x00007FF7650C1000-memory.dmp

Filesize
3.9MB

Download
memory/3988-15-0x00007FF764CD0000-0x00007FF7650C1000-memory.dmp

Filesize
3.9MB

Download
memory/4000-2221-0x00007FF7CF310000-0x00007FF7CF701000-memory.dmp

Filesize
3.9MB

Download
memory/4000-373-0x00007FF7CF310000-0x00007FF7CF701000-memory.dmp

Filesize
3.9MB

Download
memory/4152-317-0x00007FF6C1EE0000-0x00007FF6C22D1000-memory.dmp

Filesize
3.9MB

Download
memory/4152-2208-0x00007FF6C1EE0000-0x00007FF6C22D1000-memory.dmp

Filesize
3.9MB

Download
memory/4184-2236-0x00007FF7F7330000-0x00007FF7F7721000-memory.dmp

Filesize
3.9MB

Download
memory/4184-315-0x00007FF7F7330000-0x00007FF7F7721000-memory.dmp

Filesize
3.9MB

Download
memory/4808-389-0x00007FF61E840000-0x00007FF61EC31000-memory.dmp

Filesize
3.9MB

Download
memory/4808-2216-0x00007FF61E840000-0x00007FF61EC31000-memory.dmp

Filesize
3.9MB

Download
memory/4832-1364-0x00007FF6D6170000-0x00007FF6D6561000-memory.dmp

Filesize
3.9MB

Download
memory/4832-25-0x00007FF6D6170000-0x00007FF6D6561000-memory.dmp

Filesize
3.9MB

Download
memory/4832-2163-0x00007FF6D6170000-0x00007FF6D6561000-memory.dmp

Filesize
3.9MB

Download
memory/4988-314-0x00007FF699390000-0x00007FF699781000-memory.dmp

Filesize
3.9MB

Download
memory/4988-2185-0x00007FF699390000-0x00007FF699781000-memory.dmp

Filesize
3.9MB

Download
memory/5068-2175-0x00007FF6831B0000-0x00007FF6835A1000-memory.dmp

Filesize
3.9MB

Download
memory/5068-391-0x00007FF6831B0000-0x00007FF6835A1000-memory.dmp

Filesize
3.9MB

Download