xmrig | 4cbad06c2da7476e0f490558ca9c97d0cbafdad8d3acdccb902ef5f89ab5d43b

Analysis

max time kernel
119s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 12:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
Size

1.1MB
MD5

12a7441488b73cdaa80df460767e160e
SHA1

895f74f0c6ed9340b35a3620697b3b1da55bd27a
SHA256

4cbad06c2da7476e0f490558ca9c97d0cbafdad8d3acdccb902ef5f89ab5d43b
SHA512

592336f20822f596178b8341f43916836f20ef336cf670dad7fcce7bd923ce936b80596a84b01082b4958ec382e85313fcd45e01000af9b1b3e15e9ed34fd00c
SSDEEP

24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcmC3f/DFNkTwHloV9ci2D:knw9oUUEEDl37jcmWH/hWm

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/1612-395-0x00007FF627490000-0x00007FF627881000-memory.dmp	xmrig
behavioral2/memory/3300-399-0x00007FF66E7C0000-0x00007FF66EBB1000-memory.dmp	xmrig
behavioral2/memory/2592-404-0x00007FF622C40000-0x00007FF623031000-memory.dmp	xmrig
behavioral2/memory/3176-390-0x00007FF7E0D40000-0x00007FF7E1131000-memory.dmp	xmrig
behavioral2/memory/1208-411-0x00007FF7194D0000-0x00007FF7198C1000-memory.dmp	xmrig
behavioral2/memory/3352-416-0x00007FF7AA660000-0x00007FF7AAA51000-memory.dmp	xmrig
behavioral2/memory/1712-424-0x00007FF6F1530000-0x00007FF6F1921000-memory.dmp	xmrig
behavioral2/memory/3848-422-0x00007FF7B65B0000-0x00007FF7B69A1000-memory.dmp	xmrig
behavioral2/memory/2148-435-0x00007FF7EFCE0000-0x00007FF7F00D1000-memory.dmp	xmrig
behavioral2/memory/668-446-0x00007FF72DA70000-0x00007FF72DE61000-memory.dmp	xmrig
behavioral2/memory/4860-451-0x00007FF76FDE0000-0x00007FF7701D1000-memory.dmp	xmrig
behavioral2/memory/4832-461-0x00007FF66F310000-0x00007FF66F701000-memory.dmp	xmrig
behavioral2/memory/1420-465-0x00007FF756720000-0x00007FF756B11000-memory.dmp	xmrig
behavioral2/memory/3108-467-0x00007FF79DE30000-0x00007FF79E221000-memory.dmp	xmrig
behavioral2/memory/3424-462-0x00007FF7977C0000-0x00007FF797BB1000-memory.dmp	xmrig
behavioral2/memory/4460-458-0x00007FF7BD410000-0x00007FF7BD801000-memory.dmp	xmrig
behavioral2/memory/3332-448-0x00007FF789C40000-0x00007FF78A031000-memory.dmp	xmrig
behavioral2/memory/1648-444-0x00007FF6A1970000-0x00007FF6A1D61000-memory.dmp	xmrig
behavioral2/memory/1676-62-0x00007FF78CC40000-0x00007FF78D031000-memory.dmp	xmrig
behavioral2/memory/1984-51-0x00007FF79DE60000-0x00007FF79E251000-memory.dmp	xmrig
behavioral2/memory/4072-1949-0x00007FF6D2250000-0x00007FF6D2641000-memory.dmp	xmrig
behavioral2/memory/1352-1950-0x00007FF783EC0000-0x00007FF7842B1000-memory.dmp	xmrig
behavioral2/memory/544-1951-0x00007FF6DBA20000-0x00007FF6DBE11000-memory.dmp	xmrig
behavioral2/memory/3012-1984-0x00007FF60EF30000-0x00007FF60F321000-memory.dmp	xmrig
behavioral2/memory/4892-1987-0x00007FF706900000-0x00007FF706CF1000-memory.dmp	xmrig
behavioral2/memory/1352-1991-0x00007FF783EC0000-0x00007FF7842B1000-memory.dmp	xmrig
behavioral2/memory/544-1993-0x00007FF6DBA20000-0x00007FF6DBE11000-memory.dmp	xmrig
behavioral2/memory/3176-1998-0x00007FF7E0D40000-0x00007FF7E1131000-memory.dmp	xmrig
behavioral2/memory/1676-1996-0x00007FF78CC40000-0x00007FF78D031000-memory.dmp	xmrig
behavioral2/memory/1984-1999-0x00007FF79DE60000-0x00007FF79E251000-memory.dmp	xmrig
behavioral2/memory/4892-2003-0x00007FF706900000-0x00007FF706CF1000-memory.dmp	xmrig
behavioral2/memory/3300-2006-0x00007FF66E7C0000-0x00007FF66EBB1000-memory.dmp	xmrig
behavioral2/memory/3424-2009-0x00007FF7977C0000-0x00007FF797BB1000-memory.dmp	xmrig
behavioral2/memory/1612-2008-0x00007FF627490000-0x00007FF627881000-memory.dmp	xmrig
behavioral2/memory/3012-2002-0x00007FF60EF30000-0x00007FF60F321000-memory.dmp	xmrig
behavioral2/memory/1648-2028-0x00007FF6A1970000-0x00007FF6A1D61000-memory.dmp	xmrig
behavioral2/memory/1208-2052-0x00007FF7194D0000-0x00007FF7198C1000-memory.dmp	xmrig
behavioral2/memory/3848-2051-0x00007FF7B65B0000-0x00007FF7B69A1000-memory.dmp	xmrig
behavioral2/memory/1420-2039-0x00007FF756720000-0x00007FF756B11000-memory.dmp	xmrig
behavioral2/memory/668-2033-0x00007FF72DA70000-0x00007FF72DE61000-memory.dmp	xmrig
behavioral2/memory/2148-2030-0x00007FF7EFCE0000-0x00007FF7F00D1000-memory.dmp	xmrig
behavioral2/memory/3332-2026-0x00007FF789C40000-0x00007FF78A031000-memory.dmp	xmrig
behavioral2/memory/4860-2023-0x00007FF76FDE0000-0x00007FF7701D1000-memory.dmp	xmrig
behavioral2/memory/4460-2021-0x00007FF7BD410000-0x00007FF7BD801000-memory.dmp	xmrig
behavioral2/memory/4832-2019-0x00007FF66F310000-0x00007FF66F701000-memory.dmp	xmrig
behavioral2/memory/2592-2017-0x00007FF622C40000-0x00007FF623031000-memory.dmp	xmrig
behavioral2/memory/3108-2041-0x00007FF79DE30000-0x00007FF79E221000-memory.dmp	xmrig
behavioral2/memory/1712-2015-0x00007FF6F1530000-0x00007FF6F1921000-memory.dmp	xmrig
behavioral2/memory/3352-2012-0x00007FF7AA660000-0x00007FF7AAA51000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1352	KOznwDK.exe
544	gsTOeow.exe
3012	vweHPUj.exe
4892	cwVXEmN.exe
1984	GeQZYuU.exe
1676	BSebCBM.exe
3176	CcHzPUu.exe
3424	yyGGGGY.exe
1612	MkVLiAK.exe
3300	ELTLMpP.exe
1420	pjSnzBk.exe
3108	sTXriwx.exe
2592	iLKldvW.exe
1208	MpUZfjK.exe
3352	AAixtVs.exe
3848	JhOUTYq.exe
1712	SNSvtXi.exe
2148	dfwxGZb.exe
1648	IZUGkyR.exe
668	fxaQMGX.exe
3332	VdGrNak.exe
4860	EsRGSDl.exe
4460	HxWppfs.exe
4832	jPYAGRq.exe
4580	lcWajAF.exe
4516	QkLKISF.exe
808	mFzKiJN.exe
4764	hUGKvAr.exe
4712	jwAJOwq.exe
1972	JPWYBIk.exe
4316	QYrhRJT.exe
2552	dJrdKjR.exe
3780	OjKWuqs.exe
2880	IMHhjWt.exe
4184	LHyooXJ.exe
3240	tPMXSaX.exe
5068	jdPrgez.exe
3276	WXWWXGi.exe
1396	bXSjIqf.exe
3608	mdhEGWJ.exe
3548	WcPfowO.exe
1576	tjtbDEi.exe
3996	zpvfTmA.exe
4024	TXNXffQ.exe
4576	htsjteT.exe
4068	gYtcgwH.exe
1116	PPFFMAT.exe
4980	jyCOpkY.exe
4500	QJRWuCc.exe
2024	oKjiEVW.exe
2848	MAkXTRe.exe
1428	PsKluau.exe
1060	dIIJBXU.exe
4876	HjRpajm.exe
4984	HeZglas.exe
1952	oMyLSNW.exe
3252	hQlEeCw.exe
2376	SvQdPiy.exe
4332	HSVBkqk.exe
2912	FyWPGqf.exe
2504	ZhBybju.exe
3260	Mngqejd.exe
4648	lZaZjSF.exe
2860	dHBWgcZ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4072-0-0x00007FF6D2250000-0x00007FF6D2641000-memory.dmp	upx
behavioral2/files/0x000b000000023bba-4.dat	upx
behavioral2/files/0x000a000000023bbf-9.dat	upx
behavioral2/files/0x000a000000023bbe-17.dat	upx
behavioral2/files/0x000a000000023bc2-27.dat	upx
behavioral2/files/0x000a000000023bc3-46.dat	upx
behavioral2/files/0x000a000000023bc7-54.dat	upx
behavioral2/files/0x000a000000023bc4-60.dat	upx
behavioral2/files/0x000a000000023bc9-70.dat	upx
behavioral2/files/0x000a000000023bcf-100.dat	upx
behavioral2/files/0x000a000000023bd4-127.dat	upx
behavioral2/files/0x000a000000023bd6-138.dat	upx
behavioral2/files/0x000a000000023bd9-153.dat	upx
behavioral2/memory/1612-395-0x00007FF627490000-0x00007FF627881000-memory.dmp	upx
behavioral2/memory/3300-399-0x00007FF66E7C0000-0x00007FF66EBB1000-memory.dmp	upx
behavioral2/memory/2592-404-0x00007FF622C40000-0x00007FF623031000-memory.dmp	upx
behavioral2/memory/3176-390-0x00007FF7E0D40000-0x00007FF7E1131000-memory.dmp	upx
behavioral2/memory/1208-411-0x00007FF7194D0000-0x00007FF7198C1000-memory.dmp	upx
behavioral2/memory/3352-416-0x00007FF7AA660000-0x00007FF7AAA51000-memory.dmp	upx
behavioral2/memory/1712-424-0x00007FF6F1530000-0x00007FF6F1921000-memory.dmp	upx
behavioral2/memory/3848-422-0x00007FF7B65B0000-0x00007FF7B69A1000-memory.dmp	upx
behavioral2/memory/2148-435-0x00007FF7EFCE0000-0x00007FF7F00D1000-memory.dmp	upx
behavioral2/memory/668-446-0x00007FF72DA70000-0x00007FF72DE61000-memory.dmp	upx
behavioral2/memory/4860-451-0x00007FF76FDE0000-0x00007FF7701D1000-memory.dmp	upx
behavioral2/memory/4832-461-0x00007FF66F310000-0x00007FF66F701000-memory.dmp	upx
behavioral2/memory/1420-465-0x00007FF756720000-0x00007FF756B11000-memory.dmp	upx
behavioral2/memory/3108-467-0x00007FF79DE30000-0x00007FF79E221000-memory.dmp	upx
behavioral2/memory/3424-462-0x00007FF7977C0000-0x00007FF797BB1000-memory.dmp	upx
behavioral2/memory/4460-458-0x00007FF7BD410000-0x00007FF7BD801000-memory.dmp	upx
behavioral2/memory/3332-448-0x00007FF789C40000-0x00007FF78A031000-memory.dmp	upx
behavioral2/memory/1648-444-0x00007FF6A1970000-0x00007FF6A1D61000-memory.dmp	upx
behavioral2/files/0x000a000000023bdc-167.dat	upx
behavioral2/files/0x000a000000023bdb-163.dat	upx
behavioral2/files/0x000a000000023bda-157.dat	upx
behavioral2/files/0x000a000000023bd8-147.dat	upx
behavioral2/files/0x000a000000023bd7-142.dat	upx
behavioral2/files/0x000a000000023bd5-132.dat	upx
behavioral2/files/0x000a000000023bd3-122.dat	upx
behavioral2/files/0x000a000000023bd2-118.dat	upx
behavioral2/files/0x000a000000023bd1-112.dat	upx
behavioral2/files/0x000a000000023bd0-107.dat	upx
behavioral2/files/0x000a000000023bce-97.dat	upx
behavioral2/files/0x000a000000023bcd-93.dat	upx
behavioral2/files/0x000a000000023bcc-87.dat	upx
behavioral2/files/0x000a000000023bcb-82.dat	upx
behavioral2/files/0x000a000000023bca-78.dat	upx
behavioral2/files/0x000a000000023bc8-68.dat	upx
behavioral2/memory/1676-62-0x00007FF78CC40000-0x00007FF78D031000-memory.dmp	upx
behavioral2/files/0x000a000000023bc6-58.dat	upx
behavioral2/files/0x000a000000023bc5-56.dat	upx
behavioral2/memory/1984-51-0x00007FF79DE60000-0x00007FF79E251000-memory.dmp	upx
behavioral2/memory/4892-43-0x00007FF706900000-0x00007FF706CF1000-memory.dmp	upx
behavioral2/files/0x000a000000023bc1-34.dat	upx
behavioral2/files/0x000a000000023bc0-32.dat	upx
behavioral2/memory/3012-24-0x00007FF60EF30000-0x00007FF60F321000-memory.dmp	upx
behavioral2/memory/544-15-0x00007FF6DBA20000-0x00007FF6DBE11000-memory.dmp	upx
behavioral2/memory/1352-8-0x00007FF783EC0000-0x00007FF7842B1000-memory.dmp	upx
behavioral2/memory/4072-1949-0x00007FF6D2250000-0x00007FF6D2641000-memory.dmp	upx
behavioral2/memory/1352-1950-0x00007FF783EC0000-0x00007FF7842B1000-memory.dmp	upx
behavioral2/memory/544-1951-0x00007FF6DBA20000-0x00007FF6DBE11000-memory.dmp	upx
behavioral2/memory/3012-1984-0x00007FF60EF30000-0x00007FF60F321000-memory.dmp	upx
behavioral2/memory/4892-1987-0x00007FF706900000-0x00007FF706CF1000-memory.dmp	upx
behavioral2/memory/1352-1991-0x00007FF783EC0000-0x00007FF7842B1000-memory.dmp	upx
behavioral2/memory/544-1993-0x00007FF6DBA20000-0x00007FF6DBE11000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\gYtcgwH.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\egANnSr.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\MrWQmpS.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\GsmJAqA.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\GNispXB.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\aZzzUzz.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\mdzgfce.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\jiFAXdn.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\HHWInry.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\JaaArrT.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\GeQZYuU.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\VDyXgVd.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\GQqJfKE.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\LiqNrrZ.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\QYIpZvm.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\VdGrNak.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\mdkujqr.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\RauMIqA.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\iwrWwDp.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\eGwHLja.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\kILanDP.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\YDEVXbT.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\jmbKYkA.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\HCkWJqL.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\jJPrxsG.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\BUhPfPw.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\SNSvtXi.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\RbwnVLG.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\MmaWmzH.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\tGBHtIl.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\fSqebHE.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\GBQiSmg.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\KOznwDK.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\XYrQOpC.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\ewMlHxo.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\CKwfnZU.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\tjBIPDy.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\ZSgRICY.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\HSVBkqk.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\TNfFPuJ.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\rOzaAOF.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\vHMiyCR.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\XsFPPFi.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\qtLyNWK.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\BPCpShq.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\MRmlnWD.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\tcVIEYq.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\yURMGQy.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\HiQOlrV.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\sZUQWSF.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\sTXriwx.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\eTkpTQw.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\KkRoUjo.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\MzUAXJz.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\xXHJmtV.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\zpvfTmA.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\QBNaKqm.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\wYjVFDz.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\xCJXULb.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\FzlJTzD.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\sCIriUD.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\RmhedBZ.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\BqAoBWN.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
File created	C:\Windows\System32\UdjBARj.exe	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 1352	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	85
PID 4072 wrote to memory of 1352	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	85
PID 4072 wrote to memory of 544	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	86
PID 4072 wrote to memory of 544	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	86
PID 4072 wrote to memory of 3012	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	87
PID 4072 wrote to memory of 3012	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	87
PID 4072 wrote to memory of 4892	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	88
PID 4072 wrote to memory of 4892	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	88
PID 4072 wrote to memory of 1984	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	89
PID 4072 wrote to memory of 1984	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	89
PID 4072 wrote to memory of 1676	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	90
PID 4072 wrote to memory of 1676	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	90
PID 4072 wrote to memory of 3176	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	91
PID 4072 wrote to memory of 3176	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	91
PID 4072 wrote to memory of 1420	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	92
PID 4072 wrote to memory of 1420	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	92
PID 4072 wrote to memory of 3424	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	93
PID 4072 wrote to memory of 3424	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	93
PID 4072 wrote to memory of 1612	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	94
PID 4072 wrote to memory of 1612	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	94
PID 4072 wrote to memory of 3300	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	95
PID 4072 wrote to memory of 3300	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	95
PID 4072 wrote to memory of 3108	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	96
PID 4072 wrote to memory of 3108	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	96
PID 4072 wrote to memory of 2592	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	97
PID 4072 wrote to memory of 2592	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	97
PID 4072 wrote to memory of 1208	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	99
PID 4072 wrote to memory of 1208	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	99
PID 4072 wrote to memory of 3352	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	100
PID 4072 wrote to memory of 3352	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	100
PID 4072 wrote to memory of 3848	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	101
PID 4072 wrote to memory of 3848	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	101
PID 4072 wrote to memory of 1712	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	102
PID 4072 wrote to memory of 1712	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	102
PID 4072 wrote to memory of 2148	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	103
PID 4072 wrote to memory of 2148	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	103
PID 4072 wrote to memory of 1648	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	104
PID 4072 wrote to memory of 1648	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	104
PID 4072 wrote to memory of 668	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	105
PID 4072 wrote to memory of 668	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	105
PID 4072 wrote to memory of 3332	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	106
PID 4072 wrote to memory of 3332	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	106
PID 4072 wrote to memory of 4860	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	107
PID 4072 wrote to memory of 4860	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	107
PID 4072 wrote to memory of 4460	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	108
PID 4072 wrote to memory of 4460	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	108
PID 4072 wrote to memory of 4832	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	109
PID 4072 wrote to memory of 4832	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	109
PID 4072 wrote to memory of 4580	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	110
PID 4072 wrote to memory of 4580	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	110
PID 4072 wrote to memory of 4516	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	111
PID 4072 wrote to memory of 4516	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	111
PID 4072 wrote to memory of 808	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	112
PID 4072 wrote to memory of 808	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	112
PID 4072 wrote to memory of 4764	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	113
PID 4072 wrote to memory of 4764	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	113
PID 4072 wrote to memory of 4712	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	114
PID 4072 wrote to memory of 4712	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	114
PID 4072 wrote to memory of 1972	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	115
PID 4072 wrote to memory of 1972	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	115
PID 4072 wrote to memory of 4316	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	116
PID 4072 wrote to memory of 4316	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	116
PID 4072 wrote to memory of 2552	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	117
PID 4072 wrote to memory of 2552	4072	12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe	117

C:\Users\Admin\AppData\Local\Temp\12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\12a7441488b73cdaa80df460767e160e_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Windows\System32\KOznwDK.exe
  C:\Windows\System32\KOznwDK.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System32\gsTOeow.exe
  C:\Windows\System32\gsTOeow.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System32\vweHPUj.exe
  C:\Windows\System32\vweHPUj.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System32\cwVXEmN.exe
  C:\Windows\System32\cwVXEmN.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System32\GeQZYuU.exe
  C:\Windows\System32\GeQZYuU.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System32\BSebCBM.exe
  C:\Windows\System32\BSebCBM.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System32\CcHzPUu.exe
  C:\Windows\System32\CcHzPUu.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System32\pjSnzBk.exe
  C:\Windows\System32\pjSnzBk.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System32\yyGGGGY.exe
  C:\Windows\System32\yyGGGGY.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System32\MkVLiAK.exe
  C:\Windows\System32\MkVLiAK.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System32\ELTLMpP.exe
  C:\Windows\System32\ELTLMpP.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System32\sTXriwx.exe
  C:\Windows\System32\sTXriwx.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System32\iLKldvW.exe
  C:\Windows\System32\iLKldvW.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System32\MpUZfjK.exe
  C:\Windows\System32\MpUZfjK.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System32\AAixtVs.exe
  C:\Windows\System32\AAixtVs.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System32\JhOUTYq.exe
  C:\Windows\System32\JhOUTYq.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System32\SNSvtXi.exe
  C:\Windows\System32\SNSvtXi.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System32\dfwxGZb.exe
  C:\Windows\System32\dfwxGZb.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System32\IZUGkyR.exe
  C:\Windows\System32\IZUGkyR.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System32\fxaQMGX.exe
  C:\Windows\System32\fxaQMGX.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System32\VdGrNak.exe
  C:\Windows\System32\VdGrNak.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System32\EsRGSDl.exe
  C:\Windows\System32\EsRGSDl.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System32\HxWppfs.exe
  C:\Windows\System32\HxWppfs.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System32\jPYAGRq.exe
  C:\Windows\System32\jPYAGRq.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System32\lcWajAF.exe
  C:\Windows\System32\lcWajAF.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System32\QkLKISF.exe
  C:\Windows\System32\QkLKISF.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System32\mFzKiJN.exe
  C:\Windows\System32\mFzKiJN.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System32\hUGKvAr.exe
  C:\Windows\System32\hUGKvAr.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System32\jwAJOwq.exe
  C:\Windows\System32\jwAJOwq.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System32\JPWYBIk.exe
  C:\Windows\System32\JPWYBIk.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System32\QYrhRJT.exe
  C:\Windows\System32\QYrhRJT.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System32\dJrdKjR.exe
  C:\Windows\System32\dJrdKjR.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System32\OjKWuqs.exe
  C:\Windows\System32\OjKWuqs.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System32\IMHhjWt.exe
  C:\Windows\System32\IMHhjWt.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System32\LHyooXJ.exe
  C:\Windows\System32\LHyooXJ.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System32\tPMXSaX.exe
  C:\Windows\System32\tPMXSaX.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System32\jdPrgez.exe
  C:\Windows\System32\jdPrgez.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System32\WXWWXGi.exe
  C:\Windows\System32\WXWWXGi.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System32\bXSjIqf.exe
  C:\Windows\System32\bXSjIqf.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System32\mdhEGWJ.exe
  C:\Windows\System32\mdhEGWJ.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System32\WcPfowO.exe
  C:\Windows\System32\WcPfowO.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System32\tjtbDEi.exe
  C:\Windows\System32\tjtbDEi.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System32\zpvfTmA.exe
  C:\Windows\System32\zpvfTmA.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System32\TXNXffQ.exe
  C:\Windows\System32\TXNXffQ.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System32\htsjteT.exe
  C:\Windows\System32\htsjteT.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System32\gYtcgwH.exe
  C:\Windows\System32\gYtcgwH.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System32\PPFFMAT.exe
  C:\Windows\System32\PPFFMAT.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System32\jyCOpkY.exe
  C:\Windows\System32\jyCOpkY.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System32\QJRWuCc.exe
  C:\Windows\System32\QJRWuCc.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System32\oKjiEVW.exe
  C:\Windows\System32\oKjiEVW.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System32\MAkXTRe.exe
  C:\Windows\System32\MAkXTRe.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System32\PsKluau.exe
  C:\Windows\System32\PsKluau.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System32\dIIJBXU.exe
  C:\Windows\System32\dIIJBXU.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System32\HjRpajm.exe
  C:\Windows\System32\HjRpajm.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System32\HeZglas.exe
  C:\Windows\System32\HeZglas.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System32\oMyLSNW.exe
  C:\Windows\System32\oMyLSNW.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System32\hQlEeCw.exe
  C:\Windows\System32\hQlEeCw.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System32\SvQdPiy.exe
  C:\Windows\System32\SvQdPiy.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System32\HSVBkqk.exe
  C:\Windows\System32\HSVBkqk.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System32\FyWPGqf.exe
  C:\Windows\System32\FyWPGqf.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System32\ZhBybju.exe
  C:\Windows\System32\ZhBybju.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System32\Mngqejd.exe
  C:\Windows\System32\Mngqejd.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System32\lZaZjSF.exe
  C:\Windows\System32\lZaZjSF.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System32\dHBWgcZ.exe
  C:\Windows\System32\dHBWgcZ.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System32\LOWqPom.exe
  C:\Windows\System32\LOWqPom.exe
  2⤵
  PID:2996
- C:\Windows\System32\HgWVRrU.exe
  C:\Windows\System32\HgWVRrU.exe
  2⤵
  PID:4436
- C:\Windows\System32\GpOjrlA.exe
  C:\Windows\System32\GpOjrlA.exe
  2⤵
  PID:4104
- C:\Windows\System32\DFzknec.exe
  C:\Windows\System32\DFzknec.exe
  2⤵
  PID:3068
- C:\Windows\System32\qecelhP.exe
  C:\Windows\System32\qecelhP.exe
  2⤵
  PID:3724
- C:\Windows\System32\ASWDUqj.exe
  C:\Windows\System32\ASWDUqj.exe
  2⤵
  PID:3744
- C:\Windows\System32\kJZYqOq.exe
  C:\Windows\System32\kJZYqOq.exe
  2⤵
  PID:2104
- C:\Windows\System32\NUxdtse.exe
  C:\Windows\System32\NUxdtse.exe
  2⤵
  PID:4468
- C:\Windows\System32\soJDauI.exe
  C:\Windows\System32\soJDauI.exe
  2⤵
  PID:1064
- C:\Windows\System32\RmhedBZ.exe
  C:\Windows\System32\RmhedBZ.exe
  2⤵
  PID:4968
- C:\Windows\System32\MRmlnWD.exe
  C:\Windows\System32\MRmlnWD.exe
  2⤵
  PID:4872
- C:\Windows\System32\jAWQrYM.exe
  C:\Windows\System32\jAWQrYM.exe
  2⤵
  PID:4728
- C:\Windows\System32\mmtLbdK.exe
  C:\Windows\System32\mmtLbdK.exe
  2⤵
  PID:2984
- C:\Windows\System32\iSULNWM.exe
  C:\Windows\System32\iSULNWM.exe
  2⤵
  PID:2008
- C:\Windows\System32\tCPNHIK.exe
  C:\Windows\System32\tCPNHIK.exe
  2⤵
  PID:2144
- C:\Windows\System32\NnqKJJM.exe
  C:\Windows\System32\NnqKJJM.exe
  2⤵
  PID:3676
- C:\Windows\System32\kIuZotH.exe
  C:\Windows\System32\kIuZotH.exe
  2⤵
  PID:2928
- C:\Windows\System32\QXcXsYa.exe
  C:\Windows\System32\QXcXsYa.exe
  2⤵
  PID:4508
- C:\Windows\System32\pEGLBen.exe
  C:\Windows\System32\pEGLBen.exe
  2⤵
  PID:3536
- C:\Windows\System32\tHkmBkB.exe
  C:\Windows\System32\tHkmBkB.exe
  2⤵
  PID:536
- C:\Windows\System32\sASKghc.exe
  C:\Windows\System32\sASKghc.exe
  2⤵
  PID:3448
- C:\Windows\System32\UnTRzQt.exe
  C:\Windows\System32\UnTRzQt.exe
  2⤵
  PID:3900
- C:\Windows\System32\sqPiRRp.exe
  C:\Windows\System32\sqPiRRp.exe
  2⤵
  PID:5140
- C:\Windows\System32\TcfJDRL.exe
  C:\Windows\System32\TcfJDRL.exe
  2⤵
  PID:5164
- C:\Windows\System32\BiUjUBG.exe
  C:\Windows\System32\BiUjUBG.exe
  2⤵
  PID:5196
- C:\Windows\System32\WIsJGFM.exe
  C:\Windows\System32\WIsJGFM.exe
  2⤵
  PID:5224
- C:\Windows\System32\XIUAQMN.exe
  C:\Windows\System32\XIUAQMN.exe
  2⤵
  PID:5248
- C:\Windows\System32\vIgDlNz.exe
  C:\Windows\System32\vIgDlNz.exe
  2⤵
  PID:5280
- C:\Windows\System32\jPfPXDS.exe
  C:\Windows\System32\jPfPXDS.exe
  2⤵
  PID:5304
- C:\Windows\System32\ahNSAMU.exe
  C:\Windows\System32\ahNSAMU.exe
  2⤵
  PID:5336
- C:\Windows\System32\qQNEMbp.exe
  C:\Windows\System32\qQNEMbp.exe
  2⤵
  PID:5360
- C:\Windows\System32\nHKFWYt.exe
  C:\Windows\System32\nHKFWYt.exe
  2⤵
  PID:5392
- C:\Windows\System32\AXSgPFn.exe
  C:\Windows\System32\AXSgPFn.exe
  2⤵
  PID:5420
- C:\Windows\System32\emFcJfJ.exe
  C:\Windows\System32\emFcJfJ.exe
  2⤵
  PID:5448
- C:\Windows\System32\ALkVofZ.exe
  C:\Windows\System32\ALkVofZ.exe
  2⤵
  PID:5476
- C:\Windows\System32\BQMsHYI.exe
  C:\Windows\System32\BQMsHYI.exe
  2⤵
  PID:5504
- C:\Windows\System32\mdkujqr.exe
  C:\Windows\System32\mdkujqr.exe
  2⤵
  PID:5528
- C:\Windows\System32\yvvSnKk.exe
  C:\Windows\System32\yvvSnKk.exe
  2⤵
  PID:5560
- C:\Windows\System32\YDEVXbT.exe
  C:\Windows\System32\YDEVXbT.exe
  2⤵
  PID:5584
- C:\Windows\System32\VPOGTgC.exe
  C:\Windows\System32\VPOGTgC.exe
  2⤵
  PID:5612
- C:\Windows\System32\vcdOZku.exe
  C:\Windows\System32\vcdOZku.exe
  2⤵
  PID:5644
- C:\Windows\System32\ydRQeLP.exe
  C:\Windows\System32\ydRQeLP.exe
  2⤵
  PID:5668
- C:\Windows\System32\bzbzjJO.exe
  C:\Windows\System32\bzbzjJO.exe
  2⤵
  PID:5720
- C:\Windows\System32\GyDZUjf.exe
  C:\Windows\System32\GyDZUjf.exe
  2⤵
  PID:5748
- C:\Windows\System32\uedNfQf.exe
  C:\Windows\System32\uedNfQf.exe
  2⤵
  PID:5764
- C:\Windows\System32\ygVUWji.exe
  C:\Windows\System32\ygVUWji.exe
  2⤵
  PID:5812
- C:\Windows\System32\ZVzZcgj.exe
  C:\Windows\System32\ZVzZcgj.exe
  2⤵
  PID:5828
- C:\Windows\System32\bMCCIPg.exe
  C:\Windows\System32\bMCCIPg.exe
  2⤵
  PID:5868
- C:\Windows\System32\csyfrRH.exe
  C:\Windows\System32\csyfrRH.exe
  2⤵
  PID:5888
- C:\Windows\System32\VsOAFbx.exe
  C:\Windows\System32\VsOAFbx.exe
  2⤵
  PID:5928
- C:\Windows\System32\byhcLLb.exe
  C:\Windows\System32\byhcLLb.exe
  2⤵
  PID:5976
- C:\Windows\System32\uXaHFay.exe
  C:\Windows\System32\uXaHFay.exe
  2⤵
  PID:6008
- C:\Windows\System32\rjwftHa.exe
  C:\Windows\System32\rjwftHa.exe
  2⤵
  PID:6080
- C:\Windows\System32\ozJwxaw.exe
  C:\Windows\System32\ozJwxaw.exe
  2⤵
  PID:6100
- C:\Windows\System32\mOCOZAe.exe
  C:\Windows\System32\mOCOZAe.exe
  2⤵
  PID:6116
- C:\Windows\System32\aWrchYq.exe
  C:\Windows\System32\aWrchYq.exe
  2⤵
  PID:428
- C:\Windows\System32\VdGbQeG.exe
  C:\Windows\System32\VdGbQeG.exe
  2⤵
  PID:4612
- C:\Windows\System32\wiyiaeW.exe
  C:\Windows\System32\wiyiaeW.exe
  2⤵
  PID:5116
- C:\Windows\System32\UNCZjCh.exe
  C:\Windows\System32\UNCZjCh.exe
  2⤵
  PID:5180
- C:\Windows\System32\iefpwzP.exe
  C:\Windows\System32\iefpwzP.exe
  2⤵
  PID:5204
- C:\Windows\System32\PSrDHxF.exe
  C:\Windows\System32\PSrDHxF.exe
  2⤵
  PID:3380
- C:\Windows\System32\EEGJJnx.exe
  C:\Windows\System32\EEGJJnx.exe
  2⤵
  PID:520
- C:\Windows\System32\kOKoUee.exe
  C:\Windows\System32\kOKoUee.exe
  2⤵
  PID:1604
- C:\Windows\System32\AsxYBqW.exe
  C:\Windows\System32\AsxYBqW.exe
  2⤵
  PID:2832
- C:\Windows\System32\CTXYuVz.exe
  C:\Windows\System32\CTXYuVz.exe
  2⤵
  PID:5484
- C:\Windows\System32\HXnQbnn.exe
  C:\Windows\System32\HXnQbnn.exe
  2⤵
  PID:2304
- C:\Windows\System32\VveUCsQ.exe
  C:\Windows\System32\VveUCsQ.exe
  2⤵
  PID:5536
- C:\Windows\System32\UTVcaKM.exe
  C:\Windows\System32\UTVcaKM.exe
  2⤵
  PID:3288
- C:\Windows\System32\RauMIqA.exe
  C:\Windows\System32\RauMIqA.exe
  2⤵
  PID:3224
- C:\Windows\System32\RjGfJoI.exe
  C:\Windows\System32\RjGfJoI.exe
  2⤵
  PID:5592
- C:\Windows\System32\QTGXCHH.exe
  C:\Windows\System32\QTGXCHH.exe
  2⤵
  PID:912
- C:\Windows\System32\VApbNlf.exe
  C:\Windows\System32\VApbNlf.exe
  2⤵
  PID:5740
- C:\Windows\System32\LQvDbWh.exe
  C:\Windows\System32\LQvDbWh.exe
  2⤵
  PID:5860
- C:\Windows\System32\eByJWsr.exe
  C:\Windows\System32\eByJWsr.exe
  2⤵
  PID:5880
- C:\Windows\System32\VDyXgVd.exe
  C:\Windows\System32\VDyXgVd.exe
  2⤵
  PID:644
- C:\Windows\System32\chQwzEk.exe
  C:\Windows\System32\chQwzEk.exe
  2⤵
  PID:5996
- C:\Windows\System32\SlNesKl.exe
  C:\Windows\System32\SlNesKl.exe
  2⤵
  PID:6088
- C:\Windows\System32\fNTvHwD.exe
  C:\Windows\System32\fNTvHwD.exe
  2⤵
  PID:6108
- C:\Windows\System32\XYrQOpC.exe
  C:\Windows\System32\XYrQOpC.exe
  2⤵
  PID:1204
- C:\Windows\System32\wdnYOVG.exe
  C:\Windows\System32\wdnYOVG.exe
  2⤵
  PID:5156
- C:\Windows\System32\VFRFfSg.exe
  C:\Windows\System32\VFRFfSg.exe
  2⤵
  PID:5268
- C:\Windows\System32\vKFCJEw.exe
  C:\Windows\System32\vKFCJEw.exe
  2⤵
  PID:5380
- C:\Windows\System32\qwxtIDQ.exe
  C:\Windows\System32\qwxtIDQ.exe
  2⤵
  PID:5428
- C:\Windows\System32\ymCPGpX.exe
  C:\Windows\System32\ymCPGpX.exe
  2⤵
  PID:4992
- C:\Windows\System32\vmvaExP.exe
  C:\Windows\System32\vmvaExP.exe
  2⤵
  PID:5004
- C:\Windows\System32\LAhnRlB.exe
  C:\Windows\System32\LAhnRlB.exe
  2⤵
  PID:5664
- C:\Windows\System32\edXExLw.exe
  C:\Windows\System32\edXExLw.exe
  2⤵
  PID:5784
- C:\Windows\System32\YjXWRGW.exe
  C:\Windows\System32\YjXWRGW.exe
  2⤵
  PID:5936
- C:\Windows\System32\PqJHuWY.exe
  C:\Windows\System32\PqJHuWY.exe
  2⤵
  PID:6124
- C:\Windows\System32\MrWQmpS.exe
  C:\Windows\System32\MrWQmpS.exe
  2⤵
  PID:1924
- C:\Windows\System32\xyROdQT.exe
  C:\Windows\System32\xyROdQT.exe
  2⤵
  PID:1404
- C:\Windows\System32\DmYySiM.exe
  C:\Windows\System32\DmYySiM.exe
  2⤵
  PID:5524
- C:\Windows\System32\rarsPUI.exe
  C:\Windows\System32\rarsPUI.exe
  2⤵
  PID:3036
- C:\Windows\System32\CgLOUkA.exe
  C:\Windows\System32\CgLOUkA.exe
  2⤵
  PID:6032
- C:\Windows\System32\azLiPJZ.exe
  C:\Windows\System32\azLiPJZ.exe
  2⤵
  PID:3884
- C:\Windows\System32\GsmJAqA.exe
  C:\Windows\System32\GsmJAqA.exe
  2⤵
  PID:5840
- C:\Windows\System32\xFVpEoi.exe
  C:\Windows\System32\xFVpEoi.exe
  2⤵
  PID:6164
- C:\Windows\System32\jjkTSWr.exe
  C:\Windows\System32\jjkTSWr.exe
  2⤵
  PID:6188
- C:\Windows\System32\ZWUZmZd.exe
  C:\Windows\System32\ZWUZmZd.exe
  2⤵
  PID:6220
- C:\Windows\System32\MrzPBuD.exe
  C:\Windows\System32\MrzPBuD.exe
  2⤵
  PID:6244
- C:\Windows\System32\uRGvrEu.exe
  C:\Windows\System32\uRGvrEu.exe
  2⤵
  PID:6284
- C:\Windows\System32\pNAJmIP.exe
  C:\Windows\System32\pNAJmIP.exe
  2⤵
  PID:6324
- C:\Windows\System32\PckKWIB.exe
  C:\Windows\System32\PckKWIB.exe
  2⤵
  PID:6352
- C:\Windows\System32\nZstrTb.exe
  C:\Windows\System32\nZstrTb.exe
  2⤵
  PID:6372
- C:\Windows\System32\RrHTWsE.exe
  C:\Windows\System32\RrHTWsE.exe
  2⤵
  PID:6392
- C:\Windows\System32\XkaawDj.exe
  C:\Windows\System32\XkaawDj.exe
  2⤵
  PID:6408
- C:\Windows\System32\MwXIGZS.exe
  C:\Windows\System32\MwXIGZS.exe
  2⤵
  PID:6440
- C:\Windows\System32\OOcacPH.exe
  C:\Windows\System32\OOcacPH.exe
  2⤵
  PID:6488
- C:\Windows\System32\IvEkPbu.exe
  C:\Windows\System32\IvEkPbu.exe
  2⤵
  PID:6520
- C:\Windows\System32\CRrxkGW.exe
  C:\Windows\System32\CRrxkGW.exe
  2⤵
  PID:6556
- C:\Windows\System32\oYtDlot.exe
  C:\Windows\System32\oYtDlot.exe
  2⤵
  PID:6580
- C:\Windows\System32\uasiKfX.exe
  C:\Windows\System32\uasiKfX.exe
  2⤵
  PID:6628
- C:\Windows\System32\JdXzYEX.exe
  C:\Windows\System32\JdXzYEX.exe
  2⤵
  PID:6644
- C:\Windows\System32\CVdvkmW.exe
  C:\Windows\System32\CVdvkmW.exe
  2⤵
  PID:6664
- C:\Windows\System32\KXqyFfw.exe
  C:\Windows\System32\KXqyFfw.exe
  2⤵
  PID:6696
- C:\Windows\System32\oXtPgBX.exe
  C:\Windows\System32\oXtPgBX.exe
  2⤵
  PID:6736
- C:\Windows\System32\iZGxKIb.exe
  C:\Windows\System32\iZGxKIb.exe
  2⤵
  PID:6764
- C:\Windows\System32\kFvNtpA.exe
  C:\Windows\System32\kFvNtpA.exe
  2⤵
  PID:6788
- C:\Windows\System32\UMhGGWh.exe
  C:\Windows\System32\UMhGGWh.exe
  2⤵
  PID:6812
- C:\Windows\System32\xEuijcB.exe
  C:\Windows\System32\xEuijcB.exe
  2⤵
  PID:6832
- C:\Windows\System32\KILfinU.exe
  C:\Windows\System32\KILfinU.exe
  2⤵
  PID:6852
- C:\Windows\System32\OdMMLbK.exe
  C:\Windows\System32\OdMMLbK.exe
  2⤵
  PID:6892
- C:\Windows\System32\BHYGlbN.exe
  C:\Windows\System32\BHYGlbN.exe
  2⤵
  PID:6912
- C:\Windows\System32\FbfStsJ.exe
  C:\Windows\System32\FbfStsJ.exe
  2⤵
  PID:6936
- C:\Windows\System32\ZvFFOgW.exe
  C:\Windows\System32\ZvFFOgW.exe
  2⤵
  PID:6956
- C:\Windows\System32\PqrPQHW.exe
  C:\Windows\System32\PqrPQHW.exe
  2⤵
  PID:6972
- C:\Windows\System32\xRNdhWY.exe
  C:\Windows\System32\xRNdhWY.exe
  2⤵
  PID:6996
- C:\Windows\System32\bxyvwdz.exe
  C:\Windows\System32\bxyvwdz.exe
  2⤵
  PID:7016
- C:\Windows\System32\MFgMZiN.exe
  C:\Windows\System32\MFgMZiN.exe
  2⤵
  PID:7044
- C:\Windows\System32\qqhwfEl.exe
  C:\Windows\System32\qqhwfEl.exe
  2⤵
  PID:7060
- C:\Windows\System32\oEclbRw.exe
  C:\Windows\System32\oEclbRw.exe
  2⤵
  PID:7080
- C:\Windows\System32\oaGLSJu.exe
  C:\Windows\System32\oaGLSJu.exe
  2⤵
  PID:7148
- C:\Windows\System32\ddsSOcp.exe
  C:\Windows\System32\ddsSOcp.exe
  2⤵
  PID:5652
- C:\Windows\System32\tmYVfUd.exe
  C:\Windows\System32\tmYVfUd.exe
  2⤵
  PID:6236
- C:\Windows\System32\qXOtdUC.exe
  C:\Windows\System32\qXOtdUC.exe
  2⤵
  PID:6348
- C:\Windows\System32\qvxywDu.exe
  C:\Windows\System32\qvxywDu.exe
  2⤵
  PID:6364
- C:\Windows\System32\ZlMuMCj.exe
  C:\Windows\System32\ZlMuMCj.exe
  2⤵
  PID:6436
- C:\Windows\System32\TWnpdxt.exe
  C:\Windows\System32\TWnpdxt.exe
  2⤵
  PID:6472
- C:\Windows\System32\RMnCfmz.exe
  C:\Windows\System32\RMnCfmz.exe
  2⤵
  PID:2220
- C:\Windows\System32\PBBGcrw.exe
  C:\Windows\System32\PBBGcrw.exe
  2⤵
  PID:6572
- C:\Windows\System32\aTGxTYE.exe
  C:\Windows\System32\aTGxTYE.exe
  2⤵
  PID:6604
- C:\Windows\System32\qBFmmLw.exe
  C:\Windows\System32\qBFmmLw.exe
  2⤵
  PID:5408
- C:\Windows\System32\QZpGdji.exe
  C:\Windows\System32\QZpGdji.exe
  2⤵
  PID:6652
- C:\Windows\System32\UXtLFmm.exe
  C:\Windows\System32\UXtLFmm.exe
  2⤵
  PID:6692
- C:\Windows\System32\AHMgqqO.exe
  C:\Windows\System32\AHMgqqO.exe
  2⤵
  PID:6752
- C:\Windows\System32\TNfFPuJ.exe
  C:\Windows\System32\TNfFPuJ.exe
  2⤵
  PID:6872
- C:\Windows\System32\DqZMqeY.exe
  C:\Windows\System32\DqZMqeY.exe
  2⤵
  PID:6992
- C:\Windows\System32\Rbnegef.exe
  C:\Windows\System32\Rbnegef.exe
  2⤵
  PID:7096
- C:\Windows\System32\JMFrXLq.exe
  C:\Windows\System32\JMFrXLq.exe
  2⤵
  PID:7160
- C:\Windows\System32\QCJoSGP.exe
  C:\Windows\System32\QCJoSGP.exe
  2⤵
  PID:7116
- C:\Windows\System32\juSGCNP.exe
  C:\Windows\System32\juSGCNP.exe
  2⤵
  PID:6304
- C:\Windows\System32\hnkRmhZ.exe
  C:\Windows\System32\hnkRmhZ.exe
  2⤵
  PID:6512
- C:\Windows\System32\YDVJoyz.exe
  C:\Windows\System32\YDVJoyz.exe
  2⤵
  PID:6508
- C:\Windows\System32\KmFxdbT.exe
  C:\Windows\System32\KmFxdbT.exe
  2⤵
  PID:6780
- C:\Windows\System32\iwrWwDp.exe
  C:\Windows\System32\iwrWwDp.exe
  2⤵
  PID:6672
- C:\Windows\System32\xeQEYmO.exe
  C:\Windows\System32\xeQEYmO.exe
  2⤵
  PID:6860
- C:\Windows\System32\fcpPAmJ.exe
  C:\Windows\System32\fcpPAmJ.exe
  2⤵
  PID:7076
- C:\Windows\System32\HRgYTfm.exe
  C:\Windows\System32\HRgYTfm.exe
  2⤵
  PID:6296
- C:\Windows\System32\MjIyyeK.exe
  C:\Windows\System32\MjIyyeK.exe
  2⤵
  PID:6748
- C:\Windows\System32\tMciJbj.exe
  C:\Windows\System32\tMciJbj.exe
  2⤵
  PID:6884
- C:\Windows\System32\HsAJhzf.exe
  C:\Windows\System32\HsAJhzf.exe
  2⤵
  PID:7012
- C:\Windows\System32\EcBjxyF.exe
  C:\Windows\System32\EcBjxyF.exe
  2⤵
  PID:6340
- C:\Windows\System32\CMgTFcM.exe
  C:\Windows\System32\CMgTFcM.exe
  2⤵
  PID:6980
- C:\Windows\System32\wYmxWbL.exe
  C:\Windows\System32\wYmxWbL.exe
  2⤵
  PID:7192
- C:\Windows\System32\eYtbVjx.exe
  C:\Windows\System32\eYtbVjx.exe
  2⤵
  PID:7236
- C:\Windows\System32\lhgyqPD.exe
  C:\Windows\System32\lhgyqPD.exe
  2⤵
  PID:7252
- C:\Windows\System32\cDQZeBQ.exe
  C:\Windows\System32\cDQZeBQ.exe
  2⤵
  PID:7280
- C:\Windows\System32\uyIYQdK.exe
  C:\Windows\System32\uyIYQdK.exe
  2⤵
  PID:7296
- C:\Windows\System32\eGwHLja.exe
  C:\Windows\System32\eGwHLja.exe
  2⤵
  PID:7336
- C:\Windows\System32\chFMwsS.exe
  C:\Windows\System32\chFMwsS.exe
  2⤵
  PID:7356
- C:\Windows\System32\QBNaKqm.exe
  C:\Windows\System32\QBNaKqm.exe
  2⤵
  PID:7376
- C:\Windows\System32\QlFOBio.exe
  C:\Windows\System32\QlFOBio.exe
  2⤵
  PID:7396
- C:\Windows\System32\HvUIUAE.exe
  C:\Windows\System32\HvUIUAE.exe
  2⤵
  PID:7412
- C:\Windows\System32\ERFSvQn.exe
  C:\Windows\System32\ERFSvQn.exe
  2⤵
  PID:7432
- C:\Windows\System32\GWRBHXc.exe
  C:\Windows\System32\GWRBHXc.exe
  2⤵
  PID:7452
- C:\Windows\System32\esbfCdF.exe
  C:\Windows\System32\esbfCdF.exe
  2⤵
  PID:7472
- C:\Windows\System32\ZEDZWiA.exe
  C:\Windows\System32\ZEDZWiA.exe
  2⤵
  PID:7492
- C:\Windows\System32\MmaWmzH.exe
  C:\Windows\System32\MmaWmzH.exe
  2⤵
  PID:7512
- C:\Windows\System32\pfZdRZE.exe
  C:\Windows\System32\pfZdRZE.exe
  2⤵
  PID:7536
- C:\Windows\System32\oYXlcsB.exe
  C:\Windows\System32\oYXlcsB.exe
  2⤵
  PID:7556
- C:\Windows\System32\lzYgOej.exe
  C:\Windows\System32\lzYgOej.exe
  2⤵
  PID:7596
- C:\Windows\System32\bMdhJMY.exe
  C:\Windows\System32\bMdhJMY.exe
  2⤵
  PID:7680
- C:\Windows\System32\AHwAara.exe
  C:\Windows\System32\AHwAara.exe
  2⤵
  PID:7748
- C:\Windows\System32\EZuFzaL.exe
  C:\Windows\System32\EZuFzaL.exe
  2⤵
  PID:7768
- C:\Windows\System32\FMOXYPM.exe
  C:\Windows\System32\FMOXYPM.exe
  2⤵
  PID:7800
- C:\Windows\System32\QQsbTmZ.exe
  C:\Windows\System32\QQsbTmZ.exe
  2⤵
  PID:7840
- C:\Windows\System32\bpTElSA.exe
  C:\Windows\System32\bpTElSA.exe
  2⤵
  PID:7876
- C:\Windows\System32\WtndPQz.exe
  C:\Windows\System32\WtndPQz.exe
  2⤵
  PID:7904
- C:\Windows\System32\DHtsKaP.exe
  C:\Windows\System32\DHtsKaP.exe
  2⤵
  PID:7936
- C:\Windows\System32\rtUnoas.exe
  C:\Windows\System32\rtUnoas.exe
  2⤵
  PID:7972
- C:\Windows\System32\kiThqJz.exe
  C:\Windows\System32\kiThqJz.exe
  2⤵
  PID:7988
- C:\Windows\System32\ymwCGDP.exe
  C:\Windows\System32\ymwCGDP.exe
  2⤵
  PID:8016
- C:\Windows\System32\DVAfgDk.exe
  C:\Windows\System32\DVAfgDk.exe
  2⤵
  PID:8032
- C:\Windows\System32\mFoJxAb.exe
  C:\Windows\System32\mFoJxAb.exe
  2⤵
  PID:8060
- C:\Windows\System32\bcLHlrS.exe
  C:\Windows\System32\bcLHlrS.exe
  2⤵
  PID:8076
- C:\Windows\System32\BjycRoU.exe
  C:\Windows\System32\BjycRoU.exe
  2⤵
  PID:8104
- C:\Windows\System32\dowdZRN.exe
  C:\Windows\System32\dowdZRN.exe
  2⤵
  PID:8148
- C:\Windows\System32\OnqBZQs.exe
  C:\Windows\System32\OnqBZQs.exe
  2⤵
  PID:8164
- C:\Windows\System32\ydCtAMZ.exe
  C:\Windows\System32\ydCtAMZ.exe
  2⤵
  PID:8184
- C:\Windows\System32\rWvWMHe.exe
  C:\Windows\System32\rWvWMHe.exe
  2⤵
  PID:7204
- C:\Windows\System32\hrVDplC.exe
  C:\Windows\System32\hrVDplC.exe
  2⤵
  PID:7316
- C:\Windows\System32\xkOquTJ.exe
  C:\Windows\System32\xkOquTJ.exe
  2⤵
  PID:7332
- C:\Windows\System32\yNRqpRd.exe
  C:\Windows\System32\yNRqpRd.exe
  2⤵
  PID:7388
- C:\Windows\System32\JCpfVTC.exe
  C:\Windows\System32\JCpfVTC.exe
  2⤵
  PID:7544
- C:\Windows\System32\OxsBAMO.exe
  C:\Windows\System32\OxsBAMO.exe
  2⤵
  PID:7448
- C:\Windows\System32\ITjAIlh.exe
  C:\Windows\System32\ITjAIlh.exe
  2⤵
  PID:7552
- C:\Windows\System32\DTDPZQT.exe
  C:\Windows\System32\DTDPZQT.exe
  2⤵
  PID:7672
- C:\Windows\System32\YttbqMi.exe
  C:\Windows\System32\YttbqMi.exe
  2⤵
  PID:7780
- C:\Windows\System32\VOiSiXa.exe
  C:\Windows\System32\VOiSiXa.exe
  2⤵
  PID:7852
- C:\Windows\System32\WouIUKd.exe
  C:\Windows\System32\WouIUKd.exe
  2⤵
  PID:7864
- C:\Windows\System32\ANmPNiT.exe
  C:\Windows\System32\ANmPNiT.exe
  2⤵
  PID:7948
- C:\Windows\System32\SGCcdfI.exe
  C:\Windows\System32\SGCcdfI.exe
  2⤵
  PID:7984
- C:\Windows\System32\IOQYEaU.exe
  C:\Windows\System32\IOQYEaU.exe
  2⤵
  PID:8048
- C:\Windows\System32\TuwTomK.exe
  C:\Windows\System32\TuwTomK.exe
  2⤵
  PID:8092
- C:\Windows\System32\aYEGCmQ.exe
  C:\Windows\System32\aYEGCmQ.exe
  2⤵
  PID:8132
- C:\Windows\System32\tSSnRyr.exe
  C:\Windows\System32\tSSnRyr.exe
  2⤵
  PID:4132
- C:\Windows\System32\SSMeGiM.exe
  C:\Windows\System32\SSMeGiM.exe
  2⤵
  PID:7444
- C:\Windows\System32\VgFCeHz.exe
  C:\Windows\System32\VgFCeHz.exe
  2⤵
  PID:7532
- C:\Windows\System32\wCnxdPm.exe
  C:\Windows\System32\wCnxdPm.exe
  2⤵
  PID:7636
- C:\Windows\System32\RcfZuWp.exe
  C:\Windows\System32\RcfZuWp.exe
  2⤵
  PID:7872
- C:\Windows\System32\rOzaAOF.exe
  C:\Windows\System32\rOzaAOF.exe
  2⤵
  PID:7960
- C:\Windows\System32\vHMiyCR.exe
  C:\Windows\System32\vHMiyCR.exe
  2⤵
  PID:8084
- C:\Windows\System32\wYjVFDz.exe
  C:\Windows\System32\wYjVFDz.exe
  2⤵
  PID:7180
- C:\Windows\System32\wdCYTNM.exe
  C:\Windows\System32\wdCYTNM.exe
  2⤵
  PID:7368
- C:\Windows\System32\PZVzjtt.exe
  C:\Windows\System32\PZVzjtt.exe
  2⤵
  PID:8004
- C:\Windows\System32\GhSoipC.exe
  C:\Windows\System32\GhSoipC.exe
  2⤵
  PID:8200
- C:\Windows\System32\MDFpbhC.exe
  C:\Windows\System32\MDFpbhC.exe
  2⤵
  PID:8224
- C:\Windows\System32\jmbKYkA.exe
  C:\Windows\System32\jmbKYkA.exe
  2⤵
  PID:8240
- C:\Windows\System32\GCuBmMi.exe
  C:\Windows\System32\GCuBmMi.exe
  2⤵
  PID:8260
- C:\Windows\System32\ITAmGJU.exe
  C:\Windows\System32\ITAmGJU.exe
  2⤵
  PID:8280
- C:\Windows\System32\oofylVw.exe
  C:\Windows\System32\oofylVw.exe
  2⤵
  PID:8300
- C:\Windows\System32\RDcQIAh.exe
  C:\Windows\System32\RDcQIAh.exe
  2⤵
  PID:8344
- C:\Windows\System32\FwkxUem.exe
  C:\Windows\System32\FwkxUem.exe
  2⤵
  PID:8364
- C:\Windows\System32\pDUTOrM.exe
  C:\Windows\System32\pDUTOrM.exe
  2⤵
  PID:8380
- C:\Windows\System32\lucMcek.exe
  C:\Windows\System32\lucMcek.exe
  2⤵
  PID:8404
- C:\Windows\System32\pxZQGRL.exe
  C:\Windows\System32\pxZQGRL.exe
  2⤵
  PID:8424
- C:\Windows\System32\BfMsMqZ.exe
  C:\Windows\System32\BfMsMqZ.exe
  2⤵
  PID:8456
- C:\Windows\System32\sOOldSd.exe
  C:\Windows\System32\sOOldSd.exe
  2⤵
  PID:8472
- C:\Windows\System32\yRJUcSQ.exe
  C:\Windows\System32\yRJUcSQ.exe
  2⤵
  PID:8500
- C:\Windows\System32\iZLtAMu.exe
  C:\Windows\System32\iZLtAMu.exe
  2⤵
  PID:8520
- C:\Windows\System32\HNPqbka.exe
  C:\Windows\System32\HNPqbka.exe
  2⤵
  PID:8588
- C:\Windows\System32\iPUGBGD.exe
  C:\Windows\System32\iPUGBGD.exe
  2⤵
  PID:8604
- C:\Windows\System32\tcVIEYq.exe
  C:\Windows\System32\tcVIEYq.exe
  2⤵
  PID:8628
- C:\Windows\System32\akNfczw.exe
  C:\Windows\System32\akNfczw.exe
  2⤵
  PID:8664
- C:\Windows\System32\Mpkjsrz.exe
  C:\Windows\System32\Mpkjsrz.exe
  2⤵
  PID:8680
- C:\Windows\System32\fpmkBKS.exe
  C:\Windows\System32\fpmkBKS.exe
  2⤵
  PID:8696
- C:\Windows\System32\WcGWqgX.exe
  C:\Windows\System32\WcGWqgX.exe
  2⤵
  PID:8728
- C:\Windows\System32\eOqYtZg.exe
  C:\Windows\System32\eOqYtZg.exe
  2⤵
  PID:8756
- C:\Windows\System32\XmhhbvN.exe
  C:\Windows\System32\XmhhbvN.exe
  2⤵
  PID:8800
- C:\Windows\System32\HCkWJqL.exe
  C:\Windows\System32\HCkWJqL.exe
  2⤵
  PID:8876
- C:\Windows\System32\hDHavbD.exe
  C:\Windows\System32\hDHavbD.exe
  2⤵
  PID:8908
- C:\Windows\System32\tWRbdsb.exe
  C:\Windows\System32\tWRbdsb.exe
  2⤵
  PID:8932
- C:\Windows\System32\BTaLVoj.exe
  C:\Windows\System32\BTaLVoj.exe
  2⤵
  PID:8956
- C:\Windows\System32\eTkpTQw.exe
  C:\Windows\System32\eTkpTQw.exe
  2⤵
  PID:8976
- C:\Windows\System32\dNcjbID.exe
  C:\Windows\System32\dNcjbID.exe
  2⤵
  PID:9008
- C:\Windows\System32\hSfWZpW.exe
  C:\Windows\System32\hSfWZpW.exe
  2⤵
  PID:9052
- C:\Windows\System32\xXztoDh.exe
  C:\Windows\System32\xXztoDh.exe
  2⤵
  PID:9072
- C:\Windows\System32\doEqFlX.exe
  C:\Windows\System32\doEqFlX.exe
  2⤵
  PID:9096
- C:\Windows\System32\fsDGems.exe
  C:\Windows\System32\fsDGems.exe
  2⤵
  PID:9112
- C:\Windows\System32\FyFklTk.exe
  C:\Windows\System32\FyFklTk.exe
  2⤵
  PID:9132
- C:\Windows\System32\lPhlXKY.exe
  C:\Windows\System32\lPhlXKY.exe
  2⤵
  PID:9156
- C:\Windows\System32\ixWpmoU.exe
  C:\Windows\System32\ixWpmoU.exe
  2⤵
  PID:9172
- C:\Windows\System32\pAUwowO.exe
  C:\Windows\System32\pAUwowO.exe
  2⤵
  PID:9188
- C:\Windows\System32\kdOyrBg.exe
  C:\Windows\System32\kdOyrBg.exe
  2⤵
  PID:6964
- C:\Windows\System32\ngtHHTC.exe
  C:\Windows\System32\ngtHHTC.exe
  2⤵
  PID:8376
- C:\Windows\System32\GNispXB.exe
  C:\Windows\System32\GNispXB.exe
  2⤵
  PID:8360
- C:\Windows\System32\qRRmclZ.exe
  C:\Windows\System32\qRRmclZ.exe
  2⤵
  PID:8432
- C:\Windows\System32\IRMWiJZ.exe
  C:\Windows\System32\IRMWiJZ.exe
  2⤵
  PID:8492
- C:\Windows\System32\SnolHxa.exe
  C:\Windows\System32\SnolHxa.exe
  2⤵
  PID:8548
- C:\Windows\System32\XrnUjOM.exe
  C:\Windows\System32\XrnUjOM.exe
  2⤵
  PID:8716
- C:\Windows\System32\krhKEcy.exe
  C:\Windows\System32\krhKEcy.exe
  2⤵
  PID:8676
- C:\Windows\System32\tGBHtIl.exe
  C:\Windows\System32\tGBHtIl.exe
  2⤵
  PID:8856
- C:\Windows\System32\sbiCdXz.exe
  C:\Windows\System32\sbiCdXz.exe
  2⤵
  PID:8916
- C:\Windows\System32\CafZPjE.exe
  C:\Windows\System32\CafZPjE.exe
  2⤵
  PID:8972
- C:\Windows\System32\mvEeGQd.exe
  C:\Windows\System32\mvEeGQd.exe
  2⤵
  PID:9028
- C:\Windows\System32\tudFfgS.exe
  C:\Windows\System32\tudFfgS.exe
  2⤵
  PID:9104
- C:\Windows\System32\jUUyXUl.exe
  C:\Windows\System32\jUUyXUl.exe
  2⤵
  PID:9204
- C:\Windows\System32\pAvpKGC.exe
  C:\Windows\System32\pAvpKGC.exe
  2⤵
  PID:8248
- C:\Windows\System32\rstEzji.exe
  C:\Windows\System32\rstEzji.exe
  2⤵
  PID:8276
- C:\Windows\System32\mVqLCQY.exe
  C:\Windows\System32\mVqLCQY.exe
  2⤵
  PID:8484
- C:\Windows\System32\nLytFSd.exe
  C:\Windows\System32\nLytFSd.exe
  2⤵
  PID:8596
- C:\Windows\System32\LKKPMsD.exe
  C:\Windows\System32\LKKPMsD.exe
  2⤵
  PID:3936
- C:\Windows\System32\xbkiEAy.exe
  C:\Windows\System32\xbkiEAy.exe
  2⤵
  PID:8844
- C:\Windows\System32\nrRwMmZ.exe
  C:\Windows\System32\nrRwMmZ.exe
  2⤵
  PID:9148
- C:\Windows\System32\UYLhhIl.exe
  C:\Windows\System32\UYLhhIl.exe
  2⤵
  PID:9196
- C:\Windows\System32\hzHmKpJ.exe
  C:\Windows\System32\hzHmKpJ.exe
  2⤵
  PID:8692
- C:\Windows\System32\nHSHEnG.exe
  C:\Windows\System32\nHSHEnG.exe
  2⤵
  PID:8740
- C:\Windows\System32\DRaKktB.exe
  C:\Windows\System32\DRaKktB.exe
  2⤵
  PID:9016
- C:\Windows\System32\KkRoUjo.exe
  C:\Windows\System32\KkRoUjo.exe
  2⤵
  PID:9144
- C:\Windows\System32\QddtKgq.exe
  C:\Windows\System32\QddtKgq.exe
  2⤵
  PID:9240
- C:\Windows\System32\lBEgbvf.exe
  C:\Windows\System32\lBEgbvf.exe
  2⤵
  PID:9292
- C:\Windows\System32\ndIFNMv.exe
  C:\Windows\System32\ndIFNMv.exe
  2⤵
  PID:9316
- C:\Windows\System32\aZzzUzz.exe
  C:\Windows\System32\aZzzUzz.exe
  2⤵
  PID:9336
- C:\Windows\System32\lWqFKvr.exe
  C:\Windows\System32\lWqFKvr.exe
  2⤵
  PID:9352
- C:\Windows\System32\diNbdJW.exe
  C:\Windows\System32\diNbdJW.exe
  2⤵
  PID:9380
- C:\Windows\System32\AMiBtgG.exe
  C:\Windows\System32\AMiBtgG.exe
  2⤵
  PID:9420
- C:\Windows\System32\WDLaVRz.exe
  C:\Windows\System32\WDLaVRz.exe
  2⤵
  PID:9456
- C:\Windows\System32\TUdnvwZ.exe
  C:\Windows\System32\TUdnvwZ.exe
  2⤵
  PID:9472
- C:\Windows\System32\OWwmZCq.exe
  C:\Windows\System32\OWwmZCq.exe
  2⤵
  PID:9504
- C:\Windows\System32\zCQJPQq.exe
  C:\Windows\System32\zCQJPQq.exe
  2⤵
  PID:9552
- C:\Windows\System32\LiqNrrZ.exe
  C:\Windows\System32\LiqNrrZ.exe
  2⤵
  PID:9572
- C:\Windows\System32\rUKGozM.exe
  C:\Windows\System32\rUKGozM.exe
  2⤵
  PID:9592
- C:\Windows\System32\sxnLxIp.exe
  C:\Windows\System32\sxnLxIp.exe
  2⤵
  PID:9696
- C:\Windows\System32\nOccUBj.exe
  C:\Windows\System32\nOccUBj.exe
  2⤵
  PID:9728
- C:\Windows\System32\LXpidah.exe
  C:\Windows\System32\LXpidah.exe
  2⤵
  PID:9744
- C:\Windows\System32\ffnDDCe.exe
  C:\Windows\System32\ffnDDCe.exe
  2⤵
  PID:9760
- C:\Windows\System32\MTlgENM.exe
  C:\Windows\System32\MTlgENM.exe
  2⤵
  PID:9776
- C:\Windows\System32\aJFKjFB.exe
  C:\Windows\System32\aJFKjFB.exe
  2⤵
  PID:9792
- C:\Windows\System32\PCNnddB.exe
  C:\Windows\System32\PCNnddB.exe
  2⤵
  PID:9808
- C:\Windows\System32\tjChwvY.exe
  C:\Windows\System32\tjChwvY.exe
  2⤵
  PID:9824
- C:\Windows\System32\ZHmmvlW.exe
  C:\Windows\System32\ZHmmvlW.exe
  2⤵
  PID:9840
- C:\Windows\System32\BqAoBWN.exe
  C:\Windows\System32\BqAoBWN.exe
  2⤵
  PID:9856
- C:\Windows\System32\OefCZqE.exe
  C:\Windows\System32\OefCZqE.exe
  2⤵
  PID:9872
- C:\Windows\System32\lAOuIJU.exe
  C:\Windows\System32\lAOuIJU.exe
  2⤵
  PID:9888
- C:\Windows\System32\ewMlHxo.exe
  C:\Windows\System32\ewMlHxo.exe
  2⤵
  PID:9904
- C:\Windows\System32\esjPjYE.exe
  C:\Windows\System32\esjPjYE.exe
  2⤵
  PID:9920
- C:\Windows\System32\DKlDtRy.exe
  C:\Windows\System32\DKlDtRy.exe
  2⤵
  PID:9936
- C:\Windows\System32\fSqebHE.exe
  C:\Windows\System32\fSqebHE.exe
  2⤵
  PID:9952
- C:\Windows\System32\dxNggaV.exe
  C:\Windows\System32\dxNggaV.exe
  2⤵
  PID:9968
- C:\Windows\System32\odjfbGw.exe
  C:\Windows\System32\odjfbGw.exe
  2⤵
  PID:9984
- C:\Windows\System32\sDRxPaC.exe
  C:\Windows\System32\sDRxPaC.exe
  2⤵
  PID:10000
- C:\Windows\System32\xCJXULb.exe
  C:\Windows\System32\xCJXULb.exe
  2⤵
  PID:10016
- C:\Windows\System32\CEEpiYs.exe
  C:\Windows\System32\CEEpiYs.exe
  2⤵
  PID:10032
- C:\Windows\System32\qOMzNxl.exe
  C:\Windows\System32\qOMzNxl.exe
  2⤵
  PID:10048
- C:\Windows\System32\NlzBGWW.exe
  C:\Windows\System32\NlzBGWW.exe
  2⤵
  PID:10064
- C:\Windows\System32\INWmsEt.exe
  C:\Windows\System32\INWmsEt.exe
  2⤵
  PID:10080
- C:\Windows\System32\ZhKCvLY.exe
  C:\Windows\System32\ZhKCvLY.exe
  2⤵
  PID:10096
- C:\Windows\System32\REDDXlZ.exe
  C:\Windows\System32\REDDXlZ.exe
  2⤵
  PID:10112
- C:\Windows\System32\biTNwiQ.exe
  C:\Windows\System32\biTNwiQ.exe
  2⤵
  PID:10128
- C:\Windows\System32\MivqyFY.exe
  C:\Windows\System32\MivqyFY.exe
  2⤵
  PID:10148
- C:\Windows\System32\fltzubw.exe
  C:\Windows\System32\fltzubw.exe
  2⤵
  PID:10192
- C:\Windows\System32\mdzgfce.exe
  C:\Windows\System32\mdzgfce.exe
  2⤵
  PID:10208
- C:\Windows\System32\roEKAMS.exe
  C:\Windows\System32\roEKAMS.exe
  2⤵
  PID:10224
- C:\Windows\System32\QonbtgI.exe
  C:\Windows\System32\QonbtgI.exe
  2⤵
  PID:9260
- C:\Windows\System32\XsFPPFi.exe
  C:\Windows\System32\XsFPPFi.exe
  2⤵
  PID:9524
- C:\Windows\System32\dGvwOCz.exe
  C:\Windows\System32\dGvwOCz.exe
  2⤵
  PID:9536
- C:\Windows\System32\paSRJmV.exe
  C:\Windows\System32\paSRJmV.exe
  2⤵
  PID:9604
- C:\Windows\System32\egANnSr.exe
  C:\Windows\System32\egANnSr.exe
  2⤵
  PID:9704
- C:\Windows\System32\PNYHagj.exe
  C:\Windows\System32\PNYHagj.exe
  2⤵
  PID:10220
- C:\Windows\System32\GMTExod.exe
  C:\Windows\System32\GMTExod.exe
  2⤵
  PID:9800
- C:\Windows\System32\KNdkYix.exe
  C:\Windows\System32\KNdkYix.exe
  2⤵
  PID:9896
- C:\Windows\System32\QLplEJH.exe
  C:\Windows\System32\QLplEJH.exe
  2⤵
  PID:9740
- C:\Windows\System32\qddiLLZ.exe
  C:\Windows\System32\qddiLLZ.exe
  2⤵
  PID:9388
- C:\Windows\System32\vPCbikc.exe
  C:\Windows\System32\vPCbikc.exe
  2⤵
  PID:9448
- C:\Windows\System32\CKwfnZU.exe
  C:\Windows\System32\CKwfnZU.exe
  2⤵
  PID:9564
- C:\Windows\System32\aUVdRvB.exe
  C:\Windows\System32\aUVdRvB.exe
  2⤵
  PID:9568
- C:\Windows\System32\HENvNnZ.exe
  C:\Windows\System32\HENvNnZ.exe
  2⤵
  PID:10200
- C:\Windows\System32\jwzGCJn.exe
  C:\Windows\System32\jwzGCJn.exe
  2⤵
  PID:9768
- C:\Windows\System32\odkmlXT.exe
  C:\Windows\System32\odkmlXT.exe
  2⤵
  PID:8212
- C:\Windows\System32\JZlUqvq.exe
  C:\Windows\System32\JZlUqvq.exe
  2⤵
  PID:10008
- C:\Windows\System32\jgcTUsW.exe
  C:\Windows\System32\jgcTUsW.exe
  2⤵
  PID:10124
- C:\Windows\System32\DkDdXiM.exe
  C:\Windows\System32\DkDdXiM.exe
  2⤵
  PID:9848
- C:\Windows\System32\LANkSAs.exe
  C:\Windows\System32\LANkSAs.exe
  2⤵
  PID:9668
- C:\Windows\System32\mtlPrmy.exe
  C:\Windows\System32\mtlPrmy.exe
  2⤵
  PID:10268
- C:\Windows\System32\HSQQRnL.exe
  C:\Windows\System32\HSQQRnL.exe
  2⤵
  PID:10288
- C:\Windows\System32\WWcLnMG.exe
  C:\Windows\System32\WWcLnMG.exe
  2⤵
  PID:10312
- C:\Windows\System32\CXqNVPP.exe
  C:\Windows\System32\CXqNVPP.exe
  2⤵
  PID:10360
- C:\Windows\System32\MybeWwK.exe
  C:\Windows\System32\MybeWwK.exe
  2⤵
  PID:10404
- C:\Windows\System32\FemRUYM.exe
  C:\Windows\System32\FemRUYM.exe
  2⤵
  PID:10420
- C:\Windows\System32\HMlmRKf.exe
  C:\Windows\System32\HMlmRKf.exe
  2⤵
  PID:10440
- C:\Windows\System32\moFWbTx.exe
  C:\Windows\System32\moFWbTx.exe
  2⤵
  PID:10464
- C:\Windows\System32\UEGMVSx.exe
  C:\Windows\System32\UEGMVSx.exe
  2⤵
  PID:10492
- C:\Windows\System32\jyxiLtz.exe
  C:\Windows\System32\jyxiLtz.exe
  2⤵
  PID:10512
- C:\Windows\System32\ARaJcCP.exe
  C:\Windows\System32\ARaJcCP.exe
  2⤵
  PID:10560
- C:\Windows\System32\xtVaPcd.exe
  C:\Windows\System32\xtVaPcd.exe
  2⤵
  PID:10600
- C:\Windows\System32\TMtOzQQ.exe
  C:\Windows\System32\TMtOzQQ.exe
  2⤵
  PID:10628
- C:\Windows\System32\AUxMvWs.exe
  C:\Windows\System32\AUxMvWs.exe
  2⤵
  PID:10656
- C:\Windows\System32\fKiTKom.exe
  C:\Windows\System32\fKiTKom.exe
  2⤵
  PID:10688
- C:\Windows\System32\WOmImfq.exe
  C:\Windows\System32\WOmImfq.exe
  2⤵
  PID:10708
- C:\Windows\System32\VzjYfYw.exe
  C:\Windows\System32\VzjYfYw.exe
  2⤵
  PID:10728
- C:\Windows\System32\cnrRnYp.exe
  C:\Windows\System32\cnrRnYp.exe
  2⤵
  PID:10756
- C:\Windows\System32\FzlJTzD.exe
  C:\Windows\System32\FzlJTzD.exe
  2⤵
  PID:10772
- C:\Windows\System32\yjjUHpz.exe
  C:\Windows\System32\yjjUHpz.exe
  2⤵
  PID:10800
- C:\Windows\System32\qrCFBgo.exe
  C:\Windows\System32\qrCFBgo.exe
  2⤵
  PID:10828
- C:\Windows\System32\kHaMktx.exe
  C:\Windows\System32\kHaMktx.exe
  2⤵
  PID:10844
- C:\Windows\System32\xTPczFt.exe
  C:\Windows\System32\xTPczFt.exe
  2⤵
  PID:10860
- C:\Windows\System32\wfIRjib.exe
  C:\Windows\System32\wfIRjib.exe
  2⤵
  PID:10928
- C:\Windows\System32\gSNKKgc.exe
  C:\Windows\System32\gSNKKgc.exe
  2⤵
  PID:10968
- C:\Windows\System32\EEzUVZp.exe
  C:\Windows\System32\EEzUVZp.exe
  2⤵
  PID:10988
- C:\Windows\System32\RbwnVLG.exe
  C:\Windows\System32\RbwnVLG.exe
  2⤵
  PID:11012
- C:\Windows\System32\CtsggrA.exe
  C:\Windows\System32\CtsggrA.exe
  2⤵
  PID:11032
- C:\Windows\System32\KegSHpO.exe
  C:\Windows\System32\KegSHpO.exe
  2⤵
  PID:11056
- C:\Windows\System32\SeVAaEH.exe
  C:\Windows\System32\SeVAaEH.exe
  2⤵
  PID:11072
- C:\Windows\System32\TxZkzId.exe
  C:\Windows\System32\TxZkzId.exe
  2⤵
  PID:11092
- C:\Windows\System32\uAOMLGh.exe
  C:\Windows\System32\uAOMLGh.exe
  2⤵
  PID:11144
- C:\Windows\System32\JoouoQO.exe
  C:\Windows\System32\JoouoQO.exe
  2⤵
  PID:11168
- C:\Windows\System32\GQqJfKE.exe
  C:\Windows\System32\GQqJfKE.exe
  2⤵
  PID:11188
- C:\Windows\System32\iZJQYbS.exe
  C:\Windows\System32\iZJQYbS.exe
  2⤵
  PID:11204
- C:\Windows\System32\FGKOkjM.exe
  C:\Windows\System32\FGKOkjM.exe
  2⤵
  PID:11244
- C:\Windows\System32\YeJLiHf.exe
  C:\Windows\System32\YeJLiHf.exe
  2⤵
  PID:11260
- C:\Windows\System32\kILanDP.exe
  C:\Windows\System32\kILanDP.exe
  2⤵
  PID:10244
- C:\Windows\System32\qKAVmKB.exe
  C:\Windows\System32\qKAVmKB.exe
  2⤵
  PID:10300
- C:\Windows\System32\uhVmGcq.exe
  C:\Windows\System32\uhVmGcq.exe
  2⤵
  PID:10416
- C:\Windows\System32\lCqQWQq.exe
  C:\Windows\System32\lCqQWQq.exe
  2⤵
  PID:10476
- C:\Windows\System32\YZvdiOX.exe
  C:\Windows\System32\YZvdiOX.exe
  2⤵
  PID:10544
- C:\Windows\System32\ejohYCv.exe
  C:\Windows\System32\ejohYCv.exe
  2⤵
  PID:10584
- C:\Windows\System32\vhGITQd.exe
  C:\Windows\System32\vhGITQd.exe
  2⤵
  PID:10720
- C:\Windows\System32\EfVZEkJ.exe
  C:\Windows\System32\EfVZEkJ.exe
  2⤵
  PID:10764
- C:\Windows\System32\MzUAXJz.exe
  C:\Windows\System32\MzUAXJz.exe
  2⤵
  PID:10904
- C:\Windows\System32\FGZNBKY.exe
  C:\Windows\System32\FGZNBKY.exe
  2⤵
  PID:10936
- C:\Windows\System32\Rrpvphs.exe
  C:\Windows\System32\Rrpvphs.exe
  2⤵
  PID:11044
- C:\Windows\System32\muzPuPc.exe
  C:\Windows\System32\muzPuPc.exe
  2⤵
  PID:11068
- C:\Windows\System32\NakQglr.exe
  C:\Windows\System32\NakQglr.exe
  2⤵
  PID:11120
- C:\Windows\System32\iPxSfoJ.exe
  C:\Windows\System32\iPxSfoJ.exe
  2⤵
  PID:11240
- C:\Windows\System32\elczgrI.exe
  C:\Windows\System32\elczgrI.exe
  2⤵
  PID:10252
- C:\Windows\System32\yURMGQy.exe
  C:\Windows\System32\yURMGQy.exe
  2⤵
  PID:10376
- C:\Windows\System32\HsBqULO.exe
  C:\Windows\System32\HsBqULO.exe
  2⤵
  PID:10648
- C:\Windows\System32\plAgnVf.exe
  C:\Windows\System32\plAgnVf.exe
  2⤵
  PID:10608
- C:\Windows\System32\qlwoGkw.exe
  C:\Windows\System32\qlwoGkw.exe
  2⤵
  PID:10840
- C:\Windows\System32\cVMcoUT.exe
  C:\Windows\System32\cVMcoUT.exe
  2⤵
  PID:10956
- C:\Windows\System32\BhIRYsz.exe
  C:\Windows\System32\BhIRYsz.exe
  2⤵
  PID:11024
- C:\Windows\System32\RybCYcp.exe
  C:\Windows\System32\RybCYcp.exe
  2⤵
  PID:10432
- C:\Windows\System32\lGuSPEl.exe
  C:\Windows\System32\lGuSPEl.exe
  2⤵
  PID:10528
- C:\Windows\System32\XlrFWsw.exe
  C:\Windows\System32\XlrFWsw.exe
  2⤵
  PID:10888
- C:\Windows\System32\iTeGHPL.exe
  C:\Windows\System32\iTeGHPL.exe
  2⤵
  PID:10588
- C:\Windows\System32\SzRhMNv.exe
  C:\Windows\System32\SzRhMNv.exe
  2⤵
  PID:11268
- C:\Windows\System32\yCcKQJF.exe
  C:\Windows\System32\yCcKQJF.exe
  2⤵
  PID:11284
- C:\Windows\System32\UBOaDlc.exe
  C:\Windows\System32\UBOaDlc.exe
  2⤵
  PID:11316
- C:\Windows\System32\pEokGRH.exe
  C:\Windows\System32\pEokGRH.exe
  2⤵
  PID:11364
- C:\Windows\System32\jJPrxsG.exe
  C:\Windows\System32\jJPrxsG.exe
  2⤵
  PID:11392
- C:\Windows\System32\mMmEoJt.exe
  C:\Windows\System32\mMmEoJt.exe
  2⤵
  PID:11408
- C:\Windows\System32\VlYyOtH.exe
  C:\Windows\System32\VlYyOtH.exe
  2⤵
  PID:11428
- C:\Windows\System32\ebbfUrs.exe
  C:\Windows\System32\ebbfUrs.exe
  2⤵
  PID:11444
- C:\Windows\System32\aYlsDyb.exe
  C:\Windows\System32\aYlsDyb.exe
  2⤵
  PID:11496
- C:\Windows\System32\LKrAsFU.exe
  C:\Windows\System32\LKrAsFU.exe
  2⤵
  PID:11528
- C:\Windows\System32\qItRBeV.exe
  C:\Windows\System32\qItRBeV.exe
  2⤵
  PID:11568
- C:\Windows\System32\UdjBARj.exe
  C:\Windows\System32\UdjBARj.exe
  2⤵
  PID:11592
- C:\Windows\System32\HqLfRAl.exe
  C:\Windows\System32\HqLfRAl.exe
  2⤵
  PID:11608
- C:\Windows\System32\QAmshgf.exe
  C:\Windows\System32\QAmshgf.exe
  2⤵
  PID:11640
- C:\Windows\System32\emfNuhy.exe
  C:\Windows\System32\emfNuhy.exe
  2⤵
  PID:11660
- C:\Windows\System32\mvuPIcr.exe
  C:\Windows\System32\mvuPIcr.exe
  2⤵
  PID:11708
- C:\Windows\System32\jmtaHwZ.exe
  C:\Windows\System32\jmtaHwZ.exe
  2⤵
  PID:11752
- C:\Windows\System32\iozxcwD.exe
  C:\Windows\System32\iozxcwD.exe
  2⤵
  PID:11768
- C:\Windows\System32\HiQOlrV.exe
  C:\Windows\System32\HiQOlrV.exe
  2⤵
  PID:11784
- C:\Windows\System32\UiaygIZ.exe
  C:\Windows\System32\UiaygIZ.exe
  2⤵
  PID:11804
- C:\Windows\System32\hInCbFd.exe
  C:\Windows\System32\hInCbFd.exe
  2⤵
  PID:11832
- C:\Windows\System32\RwGGLGz.exe
  C:\Windows\System32\RwGGLGz.exe
  2⤵
  PID:11860
- C:\Windows\System32\EJwPVFt.exe
  C:\Windows\System32\EJwPVFt.exe
  2⤵
  PID:11876
- C:\Windows\System32\gpBShJW.exe
  C:\Windows\System32\gpBShJW.exe
  2⤵
  PID:11920
- C:\Windows\System32\susdQBf.exe
  C:\Windows\System32\susdQBf.exe
  2⤵
  PID:11976
- C:\Windows\System32\sCIriUD.exe
  C:\Windows\System32\sCIriUD.exe
  2⤵
  PID:12004
- C:\Windows\System32\fzBPmef.exe
  C:\Windows\System32\fzBPmef.exe
  2⤵
  PID:12032
- C:\Windows\System32\ilWcRXd.exe
  C:\Windows\System32\ilWcRXd.exe
  2⤵
  PID:12064
- C:\Windows\System32\rEwkfmp.exe
  C:\Windows\System32\rEwkfmp.exe
  2⤵
  PID:12088
- C:\Windows\System32\QYIpZvm.exe
  C:\Windows\System32\QYIpZvm.exe
  2⤵
  PID:12128
- C:\Windows\System32\DcxxDGN.exe
  C:\Windows\System32\DcxxDGN.exe
  2⤵
  PID:12144
- C:\Windows\System32\WdvynCP.exe
  C:\Windows\System32\WdvynCP.exe
  2⤵
  PID:12172
- C:\Windows\System32\jcbmtIu.exe
  C:\Windows\System32\jcbmtIu.exe
  2⤵
  PID:12188
- C:\Windows\System32\uvWGnYV.exe
  C:\Windows\System32\uvWGnYV.exe
  2⤵
  PID:12208
- C:\Windows\System32\hBDVDFA.exe
  C:\Windows\System32\hBDVDFA.exe
  2⤵
  PID:12228
- C:\Windows\System32\yXeNeDv.exe
  C:\Windows\System32\yXeNeDv.exe
  2⤵
  PID:12252
- C:\Windows\System32\QUaEcIG.exe
  C:\Windows\System32\QUaEcIG.exe
  2⤵
  PID:12276
- C:\Windows\System32\JgXQIyk.exe
  C:\Windows\System32\JgXQIyk.exe
  2⤵
  PID:10452
- C:\Windows\System32\qtLyNWK.exe
  C:\Windows\System32\qtLyNWK.exe
  2⤵
  PID:11324
- C:\Windows\System32\tcDtHRf.exe
  C:\Windows\System32\tcDtHRf.exe
  2⤵
  PID:11420
- C:\Windows\System32\DPqTPEt.exe
  C:\Windows\System32\DPqTPEt.exe
  2⤵
  PID:11484
- C:\Windows\System32\SyWaDFm.exe
  C:\Windows\System32\SyWaDFm.exe
  2⤵
  PID:11580
- C:\Windows\System32\jiFAXdn.exe
  C:\Windows\System32\jiFAXdn.exe
  2⤵
  PID:11648
- C:\Windows\System32\BUhPfPw.exe
  C:\Windows\System32\BUhPfPw.exe
  2⤵
  PID:11668
- C:\Windows\System32\IfxFNcZ.exe
  C:\Windows\System32\IfxFNcZ.exe
  2⤵
  PID:11716
- C:\Windows\System32\cWpqJer.exe
  C:\Windows\System32\cWpqJer.exe
  2⤵
  PID:1072
- C:\Windows\System32\NEvVjpj.exe
  C:\Windows\System32\NEvVjpj.exe
  2⤵
  PID:736
- C:\Windows\System32\LwnPvYF.exe
  C:\Windows\System32\LwnPvYF.exe
  2⤵
  PID:1084
- C:\Windows\System32\myJnHfo.exe
  C:\Windows\System32\myJnHfo.exe
  2⤵
  PID:11872
- C:\Windows\System32\mJXPBcc.exe
  C:\Windows\System32\mJXPBcc.exe
  2⤵
  PID:11960
- C:\Windows\System32\irXhnpN.exe
  C:\Windows\System32\irXhnpN.exe
  2⤵
  PID:12040
- C:\Windows\System32\XriZQEv.exe
  C:\Windows\System32\XriZQEv.exe
  2⤵
  PID:12120
- C:\Windows\System32\bwBSpjH.exe
  C:\Windows\System32\bwBSpjH.exe
  2⤵
  PID:12168
- C:\Windows\System32\pWEjRRq.exe
  C:\Windows\System32\pWEjRRq.exe
  2⤵
  PID:12260
- C:\Windows\System32\xKBmEPB.exe
  C:\Windows\System32\xKBmEPB.exe
  2⤵
  PID:11088
- C:\Windows\System32\mxkAhDn.exe
  C:\Windows\System32\mxkAhDn.exe
  2⤵
  PID:11280
- C:\Windows\System32\ejjNaop.exe
  C:\Windows\System32\ejjNaop.exe
  2⤵
  PID:11456
- C:\Windows\System32\JHkrwSN.exe
  C:\Windows\System32\JHkrwSN.exe
  2⤵
  PID:11672
- C:\Windows\System32\juhgVaQ.exe
  C:\Windows\System32\juhgVaQ.exe
  2⤵
  PID:11820
- C:\Windows\System32\nlQzVCF.exe
  C:\Windows\System32\nlQzVCF.exe
  2⤵
  PID:2684
- C:\Windows\System32\KSqlCPB.exe
  C:\Windows\System32\KSqlCPB.exe
  2⤵
  PID:4700
- C:\Windows\System32\tjBIPDy.exe
  C:\Windows\System32\tjBIPDy.exe
  2⤵
  PID:11940
- C:\Windows\System32\DynFuWA.exe
  C:\Windows\System32\DynFuWA.exe
  2⤵
  PID:12096
- C:\Windows\System32\HHWInry.exe
  C:\Windows\System32\HHWInry.exe
  2⤵
  PID:4928
- C:\Windows\System32\WqQJTdF.exe
  C:\Windows\System32\WqQJTdF.exe
  2⤵
  PID:11332
- C:\Windows\System32\jySLqWU.exe
  C:\Windows\System32\jySLqWU.exe
  2⤵
  PID:12104
- C:\Windows\System32\WcMxght.exe
  C:\Windows\System32\WcMxght.exe
  2⤵
  PID:11536
- C:\Windows\System32\uxmgIcl.exe
  C:\Windows\System32\uxmgIcl.exe
  2⤵
  PID:2348
- C:\Windows\System32\eCtOPLU.exe
  C:\Windows\System32\eCtOPLU.exe
  2⤵
  PID:12312
- C:\Windows\System32\HJaUZhH.exe
  C:\Windows\System32\HJaUZhH.exe
  2⤵
  PID:12336
- C:\Windows\System32\sZUQWSF.exe
  C:\Windows\System32\sZUQWSF.exe
  2⤵
  PID:12364
- C:\Windows\System32\quyvEOQ.exe
  C:\Windows\System32\quyvEOQ.exe
  2⤵
  PID:12388
- C:\Windows\System32\BgCWPoq.exe
  C:\Windows\System32\BgCWPoq.exe
  2⤵
  PID:12404
- C:\Windows\System32\DijZSec.exe
  C:\Windows\System32\DijZSec.exe
  2⤵
  PID:12432
- C:\Windows\System32\sExOQkX.exe
  C:\Windows\System32\sExOQkX.exe
  2⤵
  PID:12464
- C:\Windows\System32\BoeijDe.exe
  C:\Windows\System32\BoeijDe.exe
  2⤵
  PID:12504
- C:\Windows\System32\AdLTLlQ.exe
  C:\Windows\System32\AdLTLlQ.exe
  2⤵
  PID:12520
- C:\Windows\System32\LzLDWYx.exe
  C:\Windows\System32\LzLDWYx.exe
  2⤵
  PID:12580
- C:\Windows\System32\eNZPdlR.exe
  C:\Windows\System32\eNZPdlR.exe
  2⤵
  PID:12600
- C:\Windows\System32\vRuuKtD.exe
  C:\Windows\System32\vRuuKtD.exe
  2⤵
  PID:12620
- C:\Windows\System32\YaBLRqu.exe
  C:\Windows\System32\YaBLRqu.exe
  2⤵
  PID:12644
- C:\Windows\System32\BPCpShq.exe
  C:\Windows\System32\BPCpShq.exe
  2⤵
  PID:12660
- C:\Windows\System32\JpTMFsV.exe
  C:\Windows\System32\JpTMFsV.exe
  2⤵
  PID:12688
- C:\Windows\System32\sVDoTyV.exe
  C:\Windows\System32\sVDoTyV.exe
  2⤵
  PID:12752
- C:\Windows\System32\QBhCbyZ.exe
  C:\Windows\System32\QBhCbyZ.exe
  2⤵
  PID:12780
- C:\Windows\System32\tYqwyRD.exe
  C:\Windows\System32\tYqwyRD.exe
  2⤵
  PID:12796
- C:\Windows\System32\xIBEpeP.exe
  C:\Windows\System32\xIBEpeP.exe
  2⤵
  PID:12836
- C:\Windows\System32\qIgBWxA.exe
  C:\Windows\System32\qIgBWxA.exe
  2⤵
  PID:12860
- C:\Windows\System32\reBHaDx.exe
  C:\Windows\System32\reBHaDx.exe
  2⤵
  PID:12884
- C:\Windows\System32\KqgAdHl.exe
  C:\Windows\System32\KqgAdHl.exe
  2⤵
  PID:12900
- C:\Windows\System32\ynnZdlm.exe
  C:\Windows\System32\ynnZdlm.exe
  2⤵
  PID:12936
- C:\Windows\System32\FdjtcaY.exe
  C:\Windows\System32\FdjtcaY.exe
  2⤵
  PID:12976
- C:\Windows\System32\yjjxJsd.exe
  C:\Windows\System32\yjjxJsd.exe
  2⤵
  PID:12996
- C:\Windows\System32\PGmXQQq.exe
  C:\Windows\System32\PGmXQQq.exe
  2⤵
  PID:13020
- C:\Windows\System32\esNOzTl.exe
  C:\Windows\System32\esNOzTl.exe
  2⤵
  PID:13036
- C:\Windows\System32\EWhLdnw.exe
  C:\Windows\System32\EWhLdnw.exe
  2⤵
  PID:13084
- C:\Windows\System32\KazxpBJ.exe
  C:\Windows\System32\KazxpBJ.exe
  2⤵
  PID:13108
- C:\Windows\System32\gXWmvfm.exe
  C:\Windows\System32\gXWmvfm.exe
  2⤵
  PID:13144
- C:\Windows\System32\VikIfxB.exe
  C:\Windows\System32\VikIfxB.exe
  2⤵
  PID:13160
- C:\Windows\System32\eVauDxp.exe
  C:\Windows\System32\eVauDxp.exe
  2⤵
  PID:13176
- C:\Windows\System32\EZlidJW.exe
  C:\Windows\System32\EZlidJW.exe
  2⤵
  PID:13236
- C:\Windows\System32\GBQiSmg.exe
  C:\Windows\System32\GBQiSmg.exe
  2⤵
  PID:13256
- C:\Windows\System32\aelADMP.exe
  C:\Windows\System32\aelADMP.exe
  2⤵
  PID:13272
- C:\Windows\System32\DKGOHUc.exe
  C:\Windows\System32\DKGOHUc.exe
  2⤵
  PID:13300
- C:\Windows\System32\lNiOWJE.exe
  C:\Windows\System32\lNiOWJE.exe
  2⤵
  PID:11676
- C:\Windows\System32\NxmgNPL.exe
  C:\Windows\System32\NxmgNPL.exe
  2⤵
  PID:1572
- C:\Windows\System32\JaaArrT.exe
  C:\Windows\System32\JaaArrT.exe
  2⤵
  PID:11800
- C:\Windows\System32\CbpmjpJ.exe
  C:\Windows\System32\CbpmjpJ.exe
  2⤵
  PID:12332
- C:\Windows\System32\AkxvuVh.exe
  C:\Windows\System32\AkxvuVh.exe
  2⤵
  PID:12396
- C:\Windows\System32\ZSgRICY.exe
  C:\Windows\System32\ZSgRICY.exe
  2⤵
  PID:12472
- C:\Windows\System32\FWgbflC.exe
  C:\Windows\System32\FWgbflC.exe
  2⤵
  PID:12560
- C:\Windows\System32\pCkMevA.exe
  C:\Windows\System32\pCkMevA.exe
  2⤵
  PID:12592
- C:\Windows\System32\yaieGaY.exe
  C:\Windows\System32\yaieGaY.exe
  2⤵
  PID:12680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\AAixtVs.exe

Filesize
1.1MB

MD5
6fb790f04244502bbdb2121f2e631693

SHA1
36a5b9ba4c19f411ae10ad7421382092b2611070

SHA256
5668e9c49bfffe9218d276c616df4e3626f0cb6d965d2c0472259c5bd25f0a28

SHA512
4a47d552b46f6e1c8cf56d8c662f11ce523bcf970ea2ee0d1791824a057bd03c1e9d49b4c606947d7489a58f55812577ff871e23f352f2e360cc0e4d3e6e5387

Download Submit
C:\Windows\System32\BSebCBM.exe

Filesize
1.1MB

MD5
6fbf24c3bc927cef563e0f8090b06f12

SHA1
fdbeb277caf6d63803e138d418b35d7977211bd0

SHA256
03fc196b137a281a05f3feafd443ef9be2e6b5817912beefbe122b458126f7b9

SHA512
1750c853844f34e0ae59b420287e2ed0f19c2a601cd5508ee65f8728cfa45274dfd96f0cdaa4e042fa65b7c27345975a283d6a0634554f88b3f658d50569413c

Download Submit
C:\Windows\System32\CcHzPUu.exe

Filesize
1.1MB

MD5
78d045c07b8cd9f1de261d821d536e1c

SHA1
7d58316c63cfe442ef6cada4725d50ed0f9c8dbb

SHA256
a9c2a31a8d214c397a3ec63af0841c6905a88c4e8c2034c23bbc441803d627c5

SHA512
bd4009146bdeb10f45200e56f2e3309368b3e5dbe105c7663bbc44f9d46927cb12e56927326f363c442d0ee5b6257fcb6c6f31183662566249bed6a992a88d3e

Download Submit
C:\Windows\System32\ELTLMpP.exe

Filesize
1.1MB

MD5
b22ff5d33841fa7d32ebaf9945cf2509

SHA1
693a6bbd844ccfe461e77e0b72d1f2a67b0f987b

SHA256
5d23f15cfd6e0b41bc06c2a63a3aac1faa33d05fee7dadfd4cb53271efb95cdb

SHA512
cc2f585df1ce14afd804931a44e45782e3826c7b80b6f42312d02414820adac5661614fd0c3969be65542cf8c4b7ac4ab7d5cc67955e88f925fcea87a56319a7

Download Submit
C:\Windows\System32\EsRGSDl.exe

Filesize
1.1MB

MD5
c6e83c08761f24de144fbf841bfb6a8b

SHA1
b87340be6b24370f9822b16d68118fcf5174c2d4

SHA256
0f7d3ebb131db9e8a4ef701e7391956dd416c7f81007d8f29778c05fcb163169

SHA512
fa5574aa55735e5e80ee9758c5ec276f0b3c37d8305d87e4daea24b47c701f99d89ba2df5c78504ec5233ea259b33eec20654e9492b2a91e492334045cf38875

Download Submit
C:\Windows\System32\GeQZYuU.exe

Filesize
1.1MB

MD5
5afe6122a961fcc1d6c38b0d3b2a5900

SHA1
efd10ae748c5b9c977b5bb5fa86424e28bd6ab62

SHA256
99edeb7346e90232ff42f4e28da6c36ab5315c2be8a5caee60ec2bfa1083c6a0

SHA512
6106534096f2d204651f411348c7678ade114df0fa12b31d400109b85fe85ca7cf4373fdd955fcdd2725d0f74ba8261d08895d61d23b32736eed4b49571fbd32

Download Submit
C:\Windows\System32\HxWppfs.exe

Filesize
1.1MB

MD5
1ba81daefb8193114554a8f36754aaeb

SHA1
61779419a5d7ac4b28c68fcd558b8357e13964a9

SHA256
d041e758b72115ba183560c09e3d9c9c4d3e4820f93cb98f6a6ecc54a8b15abe

SHA512
1628ab999c329639b1cb91beaedcb2a2fd7a1f6bd645761e7425a45603c0cfd9bd9f9d0989d27b3ecc176599db513d523228b50266b18a5b2b50291121983fa1

Download Submit
C:\Windows\System32\IZUGkyR.exe

Filesize
1.1MB

MD5
3d18f271797b40edd7bfc2644d019d2c

SHA1
69ed25d0b7c767b5c68dcba7cc321bc396fb0845

SHA256
d41b6bd8bd9366deb0242e54b667684054b74b317bbd99fe9a6eabd8f147d4ca

SHA512
68c2c9d81b2a7086c390412956fea3c9def70d50888b5c63a74bc6c2d6f0e084019ea348383ca8bf8d67f807a565e6ef5a03fa8032f224975bcb58e9723f4983

Download Submit
C:\Windows\System32\JPWYBIk.exe

Filesize
1.1MB

MD5
99f7d5a87f03db0234382cdbb7c8d167

SHA1
663e2bfd1bc0f2e3b8d3ce938339f74fca894856

SHA256
a5a5b7cc50cba299d8971db2f1fa4f8c463e5e19f33a042db8a395cb92786c51

SHA512
24ec55863f268553bdbb08c5417a14e52fa0feb5fbc0ec3528391c3e2033326d121bf8a4ae256c2d376527fb6b0a0f99d7a0b68bab6b9b763952bb446d10a8e5

Download Submit
C:\Windows\System32\JhOUTYq.exe

Filesize
1.1MB

MD5
49f9947734cc5249130e4242da89b420

SHA1
8a5c90be45d64565a73874ab069aa289fef61bc6

SHA256
0370921d7dddc93f32d8c106bc48a74d3617b29f2d0d11b9ee98173a9f7506f0

SHA512
4eda3388a72eac541242bbca757542f0ba246f10228d328345ec422437d88f9fd9769e02ad7bd1ba0adb9acc3a9aae6a83f22e48acc51f927939c54755794d0e

Download Submit
C:\Windows\System32\KOznwDK.exe

Filesize
1.1MB

MD5
79add2e2885741baf1025946b65bb12a

SHA1
5a8a7e3232ba9edf4b45f40c692f3a4b82d917b2

SHA256
9de335d54357ad755563589bc455be9cc81e1850ceedb995dcdf04f7142682ca

SHA512
0fb3c595d0149f06416ee29d4d1892764ce4129c87363d04a4f9c0287f1d5d397ae272dfa81424c30a72f13501d1e1a492591d117f0973509767db4c292554e3

Download Submit
C:\Windows\System32\MkVLiAK.exe

Filesize
1.1MB

MD5
efea1ce9126b860d8e04369aabe00896

SHA1
adb612a05b8afc7b8aa94efd8463d9c049c8bb8d

SHA256
47c2d8d48b68ad4c2e6cdf370ef4861cf5b478d5abcf28ebfefc04b7acf0eef7

SHA512
4d81eb5252819d5282407c2ca6e94d0310854163edb4278a618ac3cc2678fcc46286bac79df2f94b095b926b70daa2fd20532b9024cc41746b9a1287a989e77f

Download Submit
C:\Windows\System32\MpUZfjK.exe

Filesize
1.1MB

MD5
dd4162869d43c27bf880b6cee13922a5

SHA1
d9ac59202e306d1d8270c2006a8ea7b3aabb6174

SHA256
f66084602a3cabcfdce7b435e03421cdc14ffc6d0198b0c36e8d07739ef6af39

SHA512
5f1d3125f192bed20f09bc151809a6743227e9e1068fe146c3dcefefb26d34a44c4fba3999cc83ec611bcd409712b2cc124bfc4dc2ac08e77d5f742c4f036b3c

Download Submit
C:\Windows\System32\QYrhRJT.exe

Filesize
1.1MB

MD5
f24063b1b8d0c4ad094bed5c8969f555

SHA1
7771d53f79ccfabc9eb5402332fdaed7c7eadbbe

SHA256
eedef45003b9d029695935ef0e83765e1b97db2ce81e8f3ab7662b51c551bf4f

SHA512
d0b709660c464c48fa2d747fd0257a9f450f23d1ac55cee22f70c7de03a9d01721a4f970f7d2e2b122b943431c4e2ca1c77793b89fa2c0980914abfe4affeac6

Download Submit
C:\Windows\System32\QkLKISF.exe

Filesize
1.1MB

MD5
deba76b17d57c505c51e780329f9cef0

SHA1
7b31db102302f4319c9c7b3c4dd94dc6e169235d

SHA256
bb5d2c3149d3e26a6375fded94ec4558e7235b15f5d5cc5b0713a780eeca0f74

SHA512
8c99385ad264665817f1500046068224e3b4079db4eae253d17ebef9f8619f8be95add5148fc20fad79624a552d888604e8839fe18d0a670848e7da5f360449e

Download Submit
C:\Windows\System32\SNSvtXi.exe

Filesize
1.1MB

MD5
3cdefb07759441e4b803edd466556e60

SHA1
2128a93603df06ed09c4f1659a314a0294c2e8dc

SHA256
2fa3e03c28cbfe5b6e34a118a64164f354228459d223b57bfbfb1d13416db5a7

SHA512
839f6f0874cff97331bb721b2f226c7ae6a32b78cf03385a31defe27cc56e8b5eb1dd6a7be40889f837382843379393c5e57de153a491ae2738742acff81286d

Download Submit
C:\Windows\System32\VdGrNak.exe

Filesize
1.1MB

MD5
889003eafc4f36556f9dc8fb9240f9a7

SHA1
eb09e007fc879b6ce68daac1222fd6e9c4e6e159

SHA256
6cc3cfcea0d303b2c70be9456fe467feb631e0baab2812186502e461dc017601

SHA512
7d07375773ff546cf352f0c7633a5800f9bdf140102e49d924ad73fe3de0cba06f6d33bbfa48aef191bf6741361637ca645cfad9a63cfa2ad1c3694ad40aa5e2

Download Submit
C:\Windows\System32\cwVXEmN.exe

Filesize
1.1MB

MD5
771565aed9d9f7047b76faf1dbecbe3b

SHA1
843fdf126468fb2919f0256b0b6b843459f9ff8a

SHA256
3c6494cae1eda6fccaca62e439e2c5a6a1a5caeb03e10d7d87a435e9f8c71a4a

SHA512
1dfc11732aec05f50c830ea6aab2d501d09bc63fed258bee35dfc9d1cf6a55d384b868f01e88804acffbffedf9de9c8e34dce670f45ab667a32966f260b86426

Download Submit
C:\Windows\System32\dJrdKjR.exe

Filesize
1.1MB

MD5
daa9bb09b4c3a9e1eed30255f649b823

SHA1
ef2687fdfad762c0f854bacddeb7744483b29ebd

SHA256
7835d8edd80ea60038f05b1aaa8702839de3e2d35d2ab1426b1db7bd8ab2847e

SHA512
4e9b165c258d8b44e6c8451ed27d77db0a03bf84e8d08236ae933e6f9db56b6b22ab5997fdc09178cc0e0750d98f2682e81e14d0c703ccda4106cf5445e5c0de

Download Submit
C:\Windows\System32\dfwxGZb.exe

Filesize
1.1MB

MD5
1192d3d286c5815f5d35041cfca02bf8

SHA1
e234c411a23560569582fc1b65a595de1c2ba38c

SHA256
6f3b4e1b5658167a721a2a50ae8cf26758b3971a8204a72606381d9dd5ac5a19

SHA512
8eb2289d34f8bdec7ef7e5053c8d9058ca5ef40af60a26a36fce0bc31a539344d8973911766f39de4e5576da8c9d2df86ef989b9265b9dcfcbf46ce2dfd1cb9f

Download Submit
C:\Windows\System32\fxaQMGX.exe

Filesize
1.1MB

MD5
7d50f09a44d2c33a22f4247af6d5f478

SHA1
91f14684af78385f1ce4287f72a64ceb31da5851

SHA256
5b2b0381089b0c813bcd5db63d06e3f356710446c90e404e8b7565b154828e07

SHA512
6bbe3e02451e6d96fa3d738f897d5b4b0244cb74c522ed2393a522fd1f30ee27f32b491da87e0653ce29e8f5df8d4425c9978e77a9716e1abb2fea75b504bf6a

Download Submit
C:\Windows\System32\gsTOeow.exe

Filesize
1.1MB

MD5
c9012f58c025bd0ea6bbfc6ab9ed5aaf

SHA1
378210e80eabb3756894f36994264848595ff883

SHA256
d82543e90a7853f01f2c15a5b9174a4ac83f7cec539741f48605b7a8a4df9657

SHA512
279214cd2fe50e4a57a360060ce5749d042f5bb8b560138e5149dcb77ccc0ba5bca8bd840011ffe8a7136622f512d9795433651f6611ad955a73cc9066acf5ca

Download Submit
C:\Windows\System32\hUGKvAr.exe

Filesize
1.1MB

MD5
8a400687c049b0ab8c0070901bba7de6

SHA1
65e1e932572b01cfb7d6fd7d4e266d14b7e50642

SHA256
7c9af3d44ee85f9409b78a807a421672733cbb2a8f1e938a49a75aef3a87f330

SHA512
a355faf230be9c4ac79687f081121b8275b603f7841b290226c1a21f9e529818b7acf1f495d39680bacbf8b6d8ca13e5e4f5c1cdab9e5d90c45d0cd84d94f82f

Download Submit
C:\Windows\System32\iLKldvW.exe

Filesize
1.1MB

MD5
55fb87a0c0d6c26aadb9caf4191f8bbd

SHA1
61f370bd5938d8c0c09fc66df39906503b4f72ab

SHA256
4002ed631f3a75f990a3f4fdc9ba23d71df6b166719f61b7f19e3e1700dcf5ee

SHA512
425533333bc92854643e9bec1f81d75b2c4874c8211e4a9e131e1930e1ac6371e1fe3a9cd48cc8d7f0879331e7218cc5cfd353ec006df5502c705e71c3b1301c

Download Submit
C:\Windows\System32\jPYAGRq.exe

Filesize
1.1MB

MD5
2353b3a9095c121f152b67a083964eb6

SHA1
e9f18356c2c7653bee51940fb153fad201fbbf56

SHA256
16e814ad39896036b4d3663c7ba9eedb957e7360b7bb142c1e67bdfcf7e19f71

SHA512
a23404b958227b9527e5ff6c930b8a40d55b605d2a68c063c8351ae116bb19b290d8470734b4899dd51b2876a098ab23ecb67617b2dc29398f6f435ed4ec558d

Download Submit
C:\Windows\System32\jwAJOwq.exe

Filesize
1.1MB

MD5
4829f93f3e3a19c5b8b41f650f0399d5

SHA1
dd279f5c371dd60ff84c11bd01c114eafdc6563d

SHA256
8e51dc126fe8777360bf70db1936364e80320a8e4f30771fd5b72bf2100d750c

SHA512
028ded7c8e0c30202beb8fa33ddac557abe734e609c91f2a413d5f291401cd2924f32bbf14c181c6b22ade1ed5bab18d7cce60e498bfd32830ae61c119e134d1

Download Submit
C:\Windows\System32\lcWajAF.exe

Filesize
1.1MB

MD5
9a98c263f3f162e3cee72104967b676d

SHA1
b64c2961062c58bb9f6c1f2d1bfa90f6176b451e

SHA256
d1f1bf601f8104fd4c41a992f505e686538ee396c99b68ed7e8005dbb666d497

SHA512
902903a62c58234acae6b072ec1343447e8c8b6d447a4435282a308b5b183f17123c94796993b956deda248214042823c3bbd72a2ecf00077c0d455c06cef299

Download Submit
C:\Windows\System32\mFzKiJN.exe

Filesize
1.1MB

MD5
51921f336d78d78df21437176eaa96af

SHA1
0f0a4796ea53fed7514ef84f0443646f7ec5c300

SHA256
61369d690d7e1d73603cc0744cdf7b35cc2716bbe37b981b52e75d4676390b66

SHA512
aff84fa62a4b4eee4d54d909e040ab9aeeba08e767c8277ee0b94d5cc1b3709887c4e44cbb3b823b683d6e869cfc28b8d4f14f12c8e99e86e2bd6f5f77bf3e25

Download Submit
C:\Windows\System32\pjSnzBk.exe

Filesize
1.1MB

MD5
07d0c4b1f751dc1c67ed1aeebc6a11aa

SHA1
7b6e2e8f6c7c0e15844759b4aa81f5ccd517c979

SHA256
79a57cccfb30268e2710a6622a8b99e95f70cad74ef401e0eba366b8c1ac7108

SHA512
7bb82e17d0b24adee27f185d599b2585b6e92231f1071ba9a0f772d2740ca0cb48de5c25c33a34ff3f8e9901f3764fb790db9ed1e7c1547dc4f0168cd015f513

Download Submit
C:\Windows\System32\sTXriwx.exe

Filesize
1.1MB

MD5
66b9a4a7d0b6939f536c755035ad2bbc

SHA1
ba5e0ace97fca21628dac5ae97f93fdf37d02eb7

SHA256
27a4078050365a1a0b3e49ec46ba855f4ee33669b42c6831f760fc656243901b

SHA512
ceb2ee2e8c68224e0d4b5319fc2c529eadd4b8b2a1d07c49c49bd3d750e32771115cd5b8689e785deb70d75c7ff37733f393567f71cf793abf1d434c212047f5

Download Submit
C:\Windows\System32\vweHPUj.exe

Filesize
1.1MB

MD5
8bc15210ecb2c4b714423ebbfa2a4df2

SHA1
c4b1e388cc48b948f5419a9e9dca8b79ad826f8b

SHA256
6a0e02c92026cdb90efc9dbbc595fac4797eac00aa53085dda8a82b9ac680b9c

SHA512
6b86fd2027fb27d7f5e9c65d1ddd3494236ce0380005682a0bb1762b277f46b9acc1412ad52b4e879ac3ed1488dbe96e1bc25279e990e60c7d03f5653a1d41b8

Download Submit
C:\Windows\System32\yyGGGGY.exe

Filesize
1.1MB

MD5
0c39c33da5bb740a53f1386a7318a9ea

SHA1
230603968cb249bbe6aa852a1381eef33247b49a

SHA256
377e4fd8e50e4656b1c5cdbf656bbb08318ea4a80dde373ede458dfa6a298278

SHA512
085c5cfeed0234280b07e254e53c5314683e5426038bb6e677cacbe7d14e729d088643e71708ecbd4149fbc1eb01d781959a281e2b8c51443d345a50d9fdb938

Download Submit
memory/544-1993-0x00007FF6DBA20000-0x00007FF6DBE11000-memory.dmp

Filesize
3.9MB

Download
memory/544-1951-0x00007FF6DBA20000-0x00007FF6DBE11000-memory.dmp

Filesize
3.9MB

Download
memory/544-15-0x00007FF6DBA20000-0x00007FF6DBE11000-memory.dmp

Filesize
3.9MB

Download
memory/668-446-0x00007FF72DA70000-0x00007FF72DE61000-memory.dmp

Filesize
3.9MB

Download
memory/668-2033-0x00007FF72DA70000-0x00007FF72DE61000-memory.dmp

Filesize
3.9MB

Download
memory/1208-2052-0x00007FF7194D0000-0x00007FF7198C1000-memory.dmp

Filesize
3.9MB

Download
memory/1208-411-0x00007FF7194D0000-0x00007FF7198C1000-memory.dmp

Filesize
3.9MB

Download
memory/1352-1991-0x00007FF783EC0000-0x00007FF7842B1000-memory.dmp

Filesize
3.9MB

Download
memory/1352-1950-0x00007FF783EC0000-0x00007FF7842B1000-memory.dmp

Filesize
3.9MB

Download
memory/1352-8-0x00007FF783EC0000-0x00007FF7842B1000-memory.dmp

Filesize
3.9MB

Download
memory/1420-2039-0x00007FF756720000-0x00007FF756B11000-memory.dmp

Filesize
3.9MB

Download
memory/1420-465-0x00007FF756720000-0x00007FF756B11000-memory.dmp

Filesize
3.9MB

Download
memory/1612-395-0x00007FF627490000-0x00007FF627881000-memory.dmp

Filesize
3.9MB

Download
memory/1612-2008-0x00007FF627490000-0x00007FF627881000-memory.dmp

Filesize
3.9MB

Download
memory/1648-2028-0x00007FF6A1970000-0x00007FF6A1D61000-memory.dmp

Filesize
3.9MB

Download
memory/1648-444-0x00007FF6A1970000-0x00007FF6A1D61000-memory.dmp

Filesize
3.9MB

Download
memory/1676-1996-0x00007FF78CC40000-0x00007FF78D031000-memory.dmp

Filesize
3.9MB

Download
memory/1676-62-0x00007FF78CC40000-0x00007FF78D031000-memory.dmp

Filesize
3.9MB

Download
memory/1712-424-0x00007FF6F1530000-0x00007FF6F1921000-memory.dmp

Filesize
3.9MB

Download
memory/1712-2015-0x00007FF6F1530000-0x00007FF6F1921000-memory.dmp

Filesize
3.9MB

Download
memory/1984-51-0x00007FF79DE60000-0x00007FF79E251000-memory.dmp

Filesize
3.9MB

Download
memory/1984-1999-0x00007FF79DE60000-0x00007FF79E251000-memory.dmp

Filesize
3.9MB

Download
memory/2148-2030-0x00007FF7EFCE0000-0x00007FF7F00D1000-memory.dmp

Filesize
3.9MB

Download
memory/2148-435-0x00007FF7EFCE0000-0x00007FF7F00D1000-memory.dmp

Filesize
3.9MB

Download
memory/2592-2017-0x00007FF622C40000-0x00007FF623031000-memory.dmp

Filesize
3.9MB

Download
memory/2592-404-0x00007FF622C40000-0x00007FF623031000-memory.dmp

Filesize
3.9MB

Download
memory/3012-24-0x00007FF60EF30000-0x00007FF60F321000-memory.dmp

Filesize
3.9MB

Download
memory/3012-1984-0x00007FF60EF30000-0x00007FF60F321000-memory.dmp

Filesize
3.9MB

Download
memory/3012-2002-0x00007FF60EF30000-0x00007FF60F321000-memory.dmp

Filesize
3.9MB

Download
memory/3108-2041-0x00007FF79DE30000-0x00007FF79E221000-memory.dmp

Filesize
3.9MB

Download
memory/3108-467-0x00007FF79DE30000-0x00007FF79E221000-memory.dmp

Filesize
3.9MB

Download
memory/3176-1998-0x00007FF7E0D40000-0x00007FF7E1131000-memory.dmp

Filesize
3.9MB

Download
memory/3176-390-0x00007FF7E0D40000-0x00007FF7E1131000-memory.dmp

Filesize
3.9MB

Download
memory/3300-2006-0x00007FF66E7C0000-0x00007FF66EBB1000-memory.dmp

Filesize
3.9MB

Download
memory/3300-399-0x00007FF66E7C0000-0x00007FF66EBB1000-memory.dmp

Filesize
3.9MB

Download
memory/3332-448-0x00007FF789C40000-0x00007FF78A031000-memory.dmp

Filesize
3.9MB

Download
memory/3332-2026-0x00007FF789C40000-0x00007FF78A031000-memory.dmp

Filesize
3.9MB

Download
memory/3352-2012-0x00007FF7AA660000-0x00007FF7AAA51000-memory.dmp

Filesize
3.9MB

Download
memory/3352-416-0x00007FF7AA660000-0x00007FF7AAA51000-memory.dmp

Filesize
3.9MB

Download
memory/3424-2009-0x00007FF7977C0000-0x00007FF797BB1000-memory.dmp

Filesize
3.9MB

Download
memory/3424-462-0x00007FF7977C0000-0x00007FF797BB1000-memory.dmp

Filesize
3.9MB

Download
memory/3848-422-0x00007FF7B65B0000-0x00007FF7B69A1000-memory.dmp

Filesize
3.9MB

Download
memory/3848-2051-0x00007FF7B65B0000-0x00007FF7B69A1000-memory.dmp

Filesize
3.9MB

Download
memory/4072-1949-0x00007FF6D2250000-0x00007FF6D2641000-memory.dmp

Filesize
3.9MB

Download
memory/4072-0-0x00007FF6D2250000-0x00007FF6D2641000-memory.dmp

Filesize
3.9MB

Download
memory/4072-1-0x000001C1B1BE0000-0x000001C1B1BF0000-memory.dmp

Filesize
64KB

Download
memory/4460-2021-0x00007FF7BD410000-0x00007FF7BD801000-memory.dmp

Filesize
3.9MB

Download
memory/4460-458-0x00007FF7BD410000-0x00007FF7BD801000-memory.dmp

Filesize
3.9MB

Download
memory/4832-2019-0x00007FF66F310000-0x00007FF66F701000-memory.dmp

Filesize
3.9MB

Download
memory/4832-461-0x00007FF66F310000-0x00007FF66F701000-memory.dmp

Filesize
3.9MB

Download
memory/4860-2023-0x00007FF76FDE0000-0x00007FF7701D1000-memory.dmp

Filesize
3.9MB

Download
memory/4860-451-0x00007FF76FDE0000-0x00007FF7701D1000-memory.dmp

Filesize
3.9MB

Download
memory/4892-1987-0x00007FF706900000-0x00007FF706CF1000-memory.dmp

Filesize
3.9MB

Download
memory/4892-43-0x00007FF706900000-0x00007FF706CF1000-memory.dmp

Filesize
3.9MB

Download
memory/4892-2003-0x00007FF706900000-0x00007FF706CF1000-memory.dmp

Filesize
3.9MB

Download