xmrig | 04c468cd3b08378227111dd984135539bd04ac1fe843195255baba59584b2fe3

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 19:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
Size

2.1MB
MD5

2eb1fbbb7eb6a094a284949d3fad9010
SHA1

3000941b93e48fd352ef93ed2656ffe84d272a53
SHA256

04c468cd3b08378227111dd984135539bd04ac1fe843195255baba59584b2fe3
SHA512

651fe2608117edc29bd813a0143cc4d890e12bf178f626d0fe63f04745604c68e556903470c8dc963ba867caa59edca68bb10f3dd8a2fe3ba6897f8e57420919
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIQwNU6ff91p:BemTLkNdfE0pZrQo

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1320-0-0x00007FF688550000-0x00007FF6888A4000-memory.dmp	xmrig
behavioral2/files/0x0008000000023437-8.dat	xmrig
behavioral2/memory/4916-15-0x00007FF7D3EA0000-0x00007FF7D41F4000-memory.dmp	xmrig
behavioral2/files/0x000700000002343c-14.dat	xmrig
behavioral2/files/0x0007000000023443-47.dat	xmrig
behavioral2/memory/3208-83-0x00007FF751820000-0x00007FF751B74000-memory.dmp	xmrig
behavioral2/files/0x0007000000023444-113.dat	xmrig
behavioral2/files/0x0007000000023449-127.dat	xmrig
behavioral2/files/0x0007000000023453-142.dat	xmrig
behavioral2/memory/2352-148-0x00007FF608D00000-0x00007FF609054000-memory.dmp	xmrig
behavioral2/memory/2172-153-0x00007FF7CCCA0000-0x00007FF7CCFF4000-memory.dmp	xmrig
behavioral2/memory/4324-158-0x00007FF69CE20000-0x00007FF69D174000-memory.dmp	xmrig
behavioral2/memory/3092-157-0x00007FF7BB6E0000-0x00007FF7BBA34000-memory.dmp	xmrig
behavioral2/memory/3652-156-0x00007FF703270000-0x00007FF7035C4000-memory.dmp	xmrig
behavioral2/memory/3388-155-0x00007FF77BE60000-0x00007FF77C1B4000-memory.dmp	xmrig
behavioral2/memory/4148-154-0x00007FF701A60000-0x00007FF701DB4000-memory.dmp	xmrig
behavioral2/memory/4436-152-0x00007FF73BCA0000-0x00007FF73BFF4000-memory.dmp	xmrig
behavioral2/memory/4556-151-0x00007FF68F1A0000-0x00007FF68F4F4000-memory.dmp	xmrig
behavioral2/memory/1308-150-0x00007FF7890F0000-0x00007FF789444000-memory.dmp	xmrig
behavioral2/memory/1644-149-0x00007FF6F67C0000-0x00007FF6F6B14000-memory.dmp	xmrig
behavioral2/memory/4928-147-0x00007FF761E70000-0x00007FF7621C4000-memory.dmp	xmrig
behavioral2/memory/1300-146-0x00007FF7B88B0000-0x00007FF7B8C04000-memory.dmp	xmrig
behavioral2/memory/4368-145-0x00007FF7C1670000-0x00007FF7C19C4000-memory.dmp	xmrig
behavioral2/memory/396-144-0x00007FF6DA610000-0x00007FF6DA964000-memory.dmp	xmrig
behavioral2/files/0x0007000000023452-140.dat	xmrig
behavioral2/files/0x0007000000023451-138.dat	xmrig
behavioral2/files/0x0007000000023450-136.dat	xmrig
behavioral2/files/0x000700000002344f-134.dat	xmrig
behavioral2/files/0x000700000002344e-132.dat	xmrig
behavioral2/memory/4456-131-0x00007FF6928B0000-0x00007FF692C04000-memory.dmp	xmrig
behavioral2/files/0x000700000002344b-129.dat	xmrig
behavioral2/memory/4920-125-0x00007FF648F30000-0x00007FF649284000-memory.dmp	xmrig
behavioral2/memory/4768-124-0x00007FF65D7A0000-0x00007FF65DAF4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023448-117.dat	xmrig
behavioral2/files/0x0007000000023447-115.dat	xmrig
behavioral2/files/0x0007000000023446-111.dat	xmrig
behavioral2/memory/3052-108-0x00007FF65A520000-0x00007FF65A874000-memory.dmp	xmrig
behavioral2/files/0x000700000002344d-104.dat	xmrig
behavioral2/files/0x000700000002344c-99.dat	xmrig
behavioral2/files/0x0007000000023445-89.dat	xmrig
behavioral2/files/0x000700000002344a-79.dat	xmrig
behavioral2/files/0x0007000000023442-73.dat	xmrig
behavioral2/files/0x0007000000023441-71.dat	xmrig
behavioral2/files/0x000700000002343e-66.dat	xmrig
behavioral2/memory/2724-76-0x00007FF67E6F0000-0x00007FF67EA44000-memory.dmp	xmrig
behavioral2/files/0x0007000000023440-61.dat	xmrig
behavioral2/memory/3392-58-0x00007FF709CA0000-0x00007FF709FF4000-memory.dmp	xmrig
behavioral2/files/0x000700000002343f-56.dat	xmrig
behavioral2/files/0x000700000002343d-36.dat	xmrig
behavioral2/memory/2008-34-0x00007FF6FBA60000-0x00007FF6FBDB4000-memory.dmp	xmrig
behavioral2/memory/1848-30-0x00007FF7E6B90000-0x00007FF7E6EE4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023454-161.dat	xmrig
behavioral2/files/0x0008000000023438-166.dat	xmrig
behavioral2/memory/4348-179-0x00007FF6F4100000-0x00007FF6F4454000-memory.dmp	xmrig
behavioral2/files/0x0007000000023459-187.dat	xmrig
behavioral2/files/0x000700000002345b-197.dat	xmrig
behavioral2/files/0x000700000002345a-191.dat	xmrig
behavioral2/files/0x0007000000023456-188.dat	xmrig
behavioral2/files/0x0007000000023458-186.dat	xmrig
behavioral2/files/0x0007000000023455-183.dat	xmrig
behavioral2/files/0x0007000000023457-182.dat	xmrig
behavioral2/memory/4580-189-0x00007FF71F0C0000-0x00007FF71F414000-memory.dmp	xmrig
behavioral2/memory/2328-172-0x00007FF625CA0000-0x00007FF625FF4000-memory.dmp	xmrig
behavioral2/files/0x000700000002343b-19.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4400	FDFdMbE.exe
4916	NWDaCTX.exe
1848	shZRfkl.exe
4436	TEOeGwr.exe
2008	BHFfIPa.exe
2172	fxcrCJQ.exe
3392	QUULfEC.exe
4148	ZnLxPFT.exe
2724	bRhUuBq.exe
3208	WqysfLF.exe
3052	VzXuPQj.exe
4768	dSIScHz.exe
3388	uAYKRKq.exe
4920	JegLiCg.exe
4456	XWtOqlM.exe
396	imBIQQx.exe
3652	OGFviCu.exe
4368	hKnFNjQ.exe
1300	xpbwKoM.exe
3092	doggvMv.exe
4324	lDspCur.exe
4928	mJXFhrf.exe
2352	amunQpH.exe
1644	eoBKfwc.exe
1308	DEJqzDD.exe
4556	XgELRHr.exe
2328	wGajJvM.exe
4348	tNTbLmg.exe
4580	kRbQRVs.exe
1444	sgxopbb.exe
1588	IdfWhNA.exe
3588	xxEeAsm.exe
2920	YvmYjjX.exe
628	YpPwKhJ.exe
2688	InoiTSn.exe
2196	PgaSipC.exe
3904	aFZSjQv.exe
3584	gXmgvVH.exe
2752	RjSGtnX.exe
728	uNypFfx.exe
400	AINjTbh.exe
4860	HQZcbtJ.exe
4384	DRXHPvx.exe
3088	mCFlyVj.exe
4092	TvXHtjk.exe
4888	wMRcgCm.exe
4504	wGrERzZ.exe
1448	FoilkCb.exe
2704	VMiOUqb.exe
1676	ZYlJKma.exe
4524	LrlnYdv.exe
2800	SZFlosy.exe
1784	iUisRAa.exe
3944	yTkOALT.exe
1792	WXzuqNb.exe
3212	LIiPWEb.exe
4168	BMujpOo.exe
4228	lSbTzRc.exe
1484	HuYEDYr.exe
3956	TAAQaTs.exe
1620	OiBdeWC.exe
4804	dyqhKzH.exe
1968	VeHegEW.exe
3856	KdBANBU.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1320-0-0x00007FF688550000-0x00007FF6888A4000-memory.dmp	upx
behavioral2/files/0x0008000000023437-8.dat	upx
behavioral2/memory/4916-15-0x00007FF7D3EA0000-0x00007FF7D41F4000-memory.dmp	upx
behavioral2/files/0x000700000002343c-14.dat	upx
behavioral2/files/0x0007000000023443-47.dat	upx
behavioral2/memory/3208-83-0x00007FF751820000-0x00007FF751B74000-memory.dmp	upx
behavioral2/files/0x0007000000023444-113.dat	upx
behavioral2/files/0x0007000000023449-127.dat	upx
behavioral2/files/0x0007000000023453-142.dat	upx
behavioral2/memory/2352-148-0x00007FF608D00000-0x00007FF609054000-memory.dmp	upx
behavioral2/memory/2172-153-0x00007FF7CCCA0000-0x00007FF7CCFF4000-memory.dmp	upx
behavioral2/memory/4324-158-0x00007FF69CE20000-0x00007FF69D174000-memory.dmp	upx
behavioral2/memory/3092-157-0x00007FF7BB6E0000-0x00007FF7BBA34000-memory.dmp	upx
behavioral2/memory/3652-156-0x00007FF703270000-0x00007FF7035C4000-memory.dmp	upx
behavioral2/memory/3388-155-0x00007FF77BE60000-0x00007FF77C1B4000-memory.dmp	upx
behavioral2/memory/4148-154-0x00007FF701A60000-0x00007FF701DB4000-memory.dmp	upx
behavioral2/memory/4436-152-0x00007FF73BCA0000-0x00007FF73BFF4000-memory.dmp	upx
behavioral2/memory/4556-151-0x00007FF68F1A0000-0x00007FF68F4F4000-memory.dmp	upx
behavioral2/memory/1308-150-0x00007FF7890F0000-0x00007FF789444000-memory.dmp	upx
behavioral2/memory/1644-149-0x00007FF6F67C0000-0x00007FF6F6B14000-memory.dmp	upx
behavioral2/memory/4928-147-0x00007FF761E70000-0x00007FF7621C4000-memory.dmp	upx
behavioral2/memory/1300-146-0x00007FF7B88B0000-0x00007FF7B8C04000-memory.dmp	upx
behavioral2/memory/4368-145-0x00007FF7C1670000-0x00007FF7C19C4000-memory.dmp	upx
behavioral2/memory/396-144-0x00007FF6DA610000-0x00007FF6DA964000-memory.dmp	upx
behavioral2/files/0x0007000000023452-140.dat	upx
behavioral2/files/0x0007000000023451-138.dat	upx
behavioral2/files/0x0007000000023450-136.dat	upx
behavioral2/files/0x000700000002344f-134.dat	upx
behavioral2/files/0x000700000002344e-132.dat	upx
behavioral2/memory/4456-131-0x00007FF6928B0000-0x00007FF692C04000-memory.dmp	upx
behavioral2/files/0x000700000002344b-129.dat	upx
behavioral2/memory/4920-125-0x00007FF648F30000-0x00007FF649284000-memory.dmp	upx
behavioral2/memory/4768-124-0x00007FF65D7A0000-0x00007FF65DAF4000-memory.dmp	upx
behavioral2/files/0x0007000000023448-117.dat	upx
behavioral2/files/0x0007000000023447-115.dat	upx
behavioral2/files/0x0007000000023446-111.dat	upx
behavioral2/memory/3052-108-0x00007FF65A520000-0x00007FF65A874000-memory.dmp	upx
behavioral2/files/0x000700000002344d-104.dat	upx
behavioral2/files/0x000700000002344c-99.dat	upx
behavioral2/files/0x0007000000023445-89.dat	upx
behavioral2/files/0x000700000002344a-79.dat	upx
behavioral2/files/0x0007000000023442-73.dat	upx
behavioral2/files/0x0007000000023441-71.dat	upx
behavioral2/files/0x000700000002343e-66.dat	upx
behavioral2/memory/2724-76-0x00007FF67E6F0000-0x00007FF67EA44000-memory.dmp	upx
behavioral2/files/0x0007000000023440-61.dat	upx
behavioral2/memory/3392-58-0x00007FF709CA0000-0x00007FF709FF4000-memory.dmp	upx
behavioral2/files/0x000700000002343f-56.dat	upx
behavioral2/files/0x000700000002343d-36.dat	upx
behavioral2/memory/2008-34-0x00007FF6FBA60000-0x00007FF6FBDB4000-memory.dmp	upx
behavioral2/memory/1848-30-0x00007FF7E6B90000-0x00007FF7E6EE4000-memory.dmp	upx
behavioral2/files/0x0007000000023454-161.dat	upx
behavioral2/files/0x0008000000023438-166.dat	upx
behavioral2/memory/4348-179-0x00007FF6F4100000-0x00007FF6F4454000-memory.dmp	upx
behavioral2/files/0x0007000000023459-187.dat	upx
behavioral2/files/0x000700000002345b-197.dat	upx
behavioral2/files/0x000700000002345a-191.dat	upx
behavioral2/files/0x0007000000023456-188.dat	upx
behavioral2/files/0x0007000000023458-186.dat	upx
behavioral2/files/0x0007000000023455-183.dat	upx
behavioral2/files/0x0007000000023457-182.dat	upx
behavioral2/memory/4580-189-0x00007FF71F0C0000-0x00007FF71F414000-memory.dmp	upx
behavioral2/memory/2328-172-0x00007FF625CA0000-0x00007FF625FF4000-memory.dmp	upx
behavioral2/files/0x000700000002343b-19.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\MjnmiIp.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\qcAwseJ.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\QePqGLq.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\JUDOlqa.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\BQEZITK.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\adKsUpK.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\XDcDZlk.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\NPThyNn.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\hYnEBGu.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\imBIQQx.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\ySNKqHn.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\BDsMioA.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\LCYfuGc.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\kCMqJop.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\QsoQQbH.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\JGCwUMi.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\VzXuPQj.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\mAGmWtj.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\kKTHcpr.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\yXdbBXZ.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\Rlchrgc.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\ofyLTmb.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\OGFviCu.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\mJXFhrf.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\lSbTzRc.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\SzQjPvS.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\KfuJyov.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\wGBanKo.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\MuzMjEO.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\eMQBAIy.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\shZRfkl.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\fxPNLfs.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\ARErFaa.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\dLOzfaG.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\YQjagiR.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\vguPOQf.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\OXqDWiE.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\hxREnMI.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\OPpaHno.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\UXlJEBp.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\BmGzcMs.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\JeksyBt.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\ENtuudA.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\vhKgOWS.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\ScRcymS.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\SMxDolG.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\mmcCKgf.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\mThUpOx.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\gSNewDc.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\CbMirXG.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\TiFzPlF.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\SKZmIyR.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\wsamhJH.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\eyMZZTJ.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\UUnqeCR.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\NpAjOXp.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\ypKtRxI.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\iIXRZzh.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\XZYteBk.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\TEOeGwr.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\nTmYhde.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\DUFELPS.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\PVkeoMO.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
File created	C:\Windows\System\meTXDRR.exe	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFaultSecure.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFaultSecure.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4828	WerFaultSecure.exe
4828	WerFaultSecure.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 4400	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	84
PID 1320 wrote to memory of 4400	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	84
PID 1320 wrote to memory of 4916	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	85
PID 1320 wrote to memory of 4916	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	85
PID 1320 wrote to memory of 1848	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	86
PID 1320 wrote to memory of 1848	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	86
PID 1320 wrote to memory of 4436	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	87
PID 1320 wrote to memory of 4436	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	87
PID 1320 wrote to memory of 3392	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	88
PID 1320 wrote to memory of 3392	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	88
PID 1320 wrote to memory of 2008	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	89
PID 1320 wrote to memory of 2008	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	89
PID 1320 wrote to memory of 2172	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	90
PID 1320 wrote to memory of 2172	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	90
PID 1320 wrote to memory of 4148	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	91
PID 1320 wrote to memory of 4148	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	91
PID 1320 wrote to memory of 2724	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	92
PID 1320 wrote to memory of 2724	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	92
PID 1320 wrote to memory of 3208	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	93
PID 1320 wrote to memory of 3208	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	93
PID 1320 wrote to memory of 3052	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	94
PID 1320 wrote to memory of 3052	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	94
PID 1320 wrote to memory of 4768	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	95
PID 1320 wrote to memory of 4768	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	95
PID 1320 wrote to memory of 3388	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	96
PID 1320 wrote to memory of 3388	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	96
PID 1320 wrote to memory of 4920	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	97
PID 1320 wrote to memory of 4920	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	97
PID 1320 wrote to memory of 4456	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	98
PID 1320 wrote to memory of 4456	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	98
PID 1320 wrote to memory of 3652	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	99
PID 1320 wrote to memory of 3652	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	99
PID 1320 wrote to memory of 396	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	100
PID 1320 wrote to memory of 396	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	100
PID 1320 wrote to memory of 4368	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	101
PID 1320 wrote to memory of 4368	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	101
PID 1320 wrote to memory of 1300	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	102
PID 1320 wrote to memory of 1300	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	102
PID 1320 wrote to memory of 3092	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	103
PID 1320 wrote to memory of 3092	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	103
PID 1320 wrote to memory of 4324	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	104
PID 1320 wrote to memory of 4324	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	104
PID 1320 wrote to memory of 4928	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	105
PID 1320 wrote to memory of 4928	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	105
PID 1320 wrote to memory of 2352	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	106
PID 1320 wrote to memory of 2352	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	106
PID 1320 wrote to memory of 1644	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	107
PID 1320 wrote to memory of 1644	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	107
PID 1320 wrote to memory of 1308	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	108
PID 1320 wrote to memory of 1308	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	108
PID 1320 wrote to memory of 4556	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	109
PID 1320 wrote to memory of 4556	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	109
PID 1320 wrote to memory of 2328	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	110
PID 1320 wrote to memory of 2328	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	110
PID 1320 wrote to memory of 4348	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	111
PID 1320 wrote to memory of 4348	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	111
PID 1320 wrote to memory of 1588	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	112
PID 1320 wrote to memory of 1588	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	112
PID 1320 wrote to memory of 4580	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	113
PID 1320 wrote to memory of 4580	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	113
PID 1320 wrote to memory of 1444	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	114
PID 1320 wrote to memory of 1444	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	114
PID 1320 wrote to memory of 3588	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	115
PID 1320 wrote to memory of 3588	1320	2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2eb1fbbb7eb6a094a284949d3fad9010_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\System\FDFdMbE.exe
  C:\Windows\System\FDFdMbE.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\NWDaCTX.exe
  C:\Windows\System\NWDaCTX.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\shZRfkl.exe
  C:\Windows\System\shZRfkl.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\TEOeGwr.exe
  C:\Windows\System\TEOeGwr.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\QUULfEC.exe
  C:\Windows\System\QUULfEC.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\BHFfIPa.exe
  C:\Windows\System\BHFfIPa.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\fxcrCJQ.exe
  C:\Windows\System\fxcrCJQ.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\ZnLxPFT.exe
  C:\Windows\System\ZnLxPFT.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\bRhUuBq.exe
  C:\Windows\System\bRhUuBq.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\WqysfLF.exe
  C:\Windows\System\WqysfLF.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\VzXuPQj.exe
  C:\Windows\System\VzXuPQj.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\dSIScHz.exe
  C:\Windows\System\dSIScHz.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\uAYKRKq.exe
  C:\Windows\System\uAYKRKq.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\JegLiCg.exe
  C:\Windows\System\JegLiCg.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\XWtOqlM.exe
  C:\Windows\System\XWtOqlM.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\OGFviCu.exe
  C:\Windows\System\OGFviCu.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\imBIQQx.exe
  C:\Windows\System\imBIQQx.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\hKnFNjQ.exe
  C:\Windows\System\hKnFNjQ.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\xpbwKoM.exe
  C:\Windows\System\xpbwKoM.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\doggvMv.exe
  C:\Windows\System\doggvMv.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\lDspCur.exe
  C:\Windows\System\lDspCur.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\mJXFhrf.exe
  C:\Windows\System\mJXFhrf.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\amunQpH.exe
  C:\Windows\System\amunQpH.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\eoBKfwc.exe
  C:\Windows\System\eoBKfwc.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\DEJqzDD.exe
  C:\Windows\System\DEJqzDD.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\XgELRHr.exe
  C:\Windows\System\XgELRHr.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\wGajJvM.exe
  C:\Windows\System\wGajJvM.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\tNTbLmg.exe
  C:\Windows\System\tNTbLmg.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\IdfWhNA.exe
  C:\Windows\System\IdfWhNA.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\kRbQRVs.exe
  C:\Windows\System\kRbQRVs.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\sgxopbb.exe
  C:\Windows\System\sgxopbb.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\xxEeAsm.exe
  C:\Windows\System\xxEeAsm.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\YvmYjjX.exe
  C:\Windows\System\YvmYjjX.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\YpPwKhJ.exe
  C:\Windows\System\YpPwKhJ.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\InoiTSn.exe
  C:\Windows\System\InoiTSn.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\PgaSipC.exe
  C:\Windows\System\PgaSipC.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\aFZSjQv.exe
  C:\Windows\System\aFZSjQv.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\gXmgvVH.exe
  C:\Windows\System\gXmgvVH.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\RjSGtnX.exe
  C:\Windows\System\RjSGtnX.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\uNypFfx.exe
  C:\Windows\System\uNypFfx.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\AINjTbh.exe
  C:\Windows\System\AINjTbh.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\HQZcbtJ.exe
  C:\Windows\System\HQZcbtJ.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\DRXHPvx.exe
  C:\Windows\System\DRXHPvx.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\mCFlyVj.exe
  C:\Windows\System\mCFlyVj.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\TvXHtjk.exe
  C:\Windows\System\TvXHtjk.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\wMRcgCm.exe
  C:\Windows\System\wMRcgCm.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\wGrERzZ.exe
  C:\Windows\System\wGrERzZ.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\FoilkCb.exe
  C:\Windows\System\FoilkCb.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\VMiOUqb.exe
  C:\Windows\System\VMiOUqb.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\ZYlJKma.exe
  C:\Windows\System\ZYlJKma.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\LrlnYdv.exe
  C:\Windows\System\LrlnYdv.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\iUisRAa.exe
  C:\Windows\System\iUisRAa.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\SZFlosy.exe
  C:\Windows\System\SZFlosy.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\yTkOALT.exe
  C:\Windows\System\yTkOALT.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\WXzuqNb.exe
  C:\Windows\System\WXzuqNb.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\LIiPWEb.exe
  C:\Windows\System\LIiPWEb.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\BMujpOo.exe
  C:\Windows\System\BMujpOo.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\lSbTzRc.exe
  C:\Windows\System\lSbTzRc.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\TAAQaTs.exe
  C:\Windows\System\TAAQaTs.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\HuYEDYr.exe
  C:\Windows\System\HuYEDYr.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\OiBdeWC.exe
  C:\Windows\System\OiBdeWC.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\dyqhKzH.exe
  C:\Windows\System\dyqhKzH.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\VeHegEW.exe
  C:\Windows\System\VeHegEW.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\KdBANBU.exe
  C:\Windows\System\KdBANBU.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\JIBSggs.exe
  C:\Windows\System\JIBSggs.exe
  2⤵
  PID:4484
- C:\Windows\System\CSFeZqY.exe
  C:\Windows\System\CSFeZqY.exe
  2⤵
  PID:1692
- C:\Windows\System\mmcCKgf.exe
  C:\Windows\System\mmcCKgf.exe
  2⤵
  PID:2420
- C:\Windows\System\hrsuZoj.exe
  C:\Windows\System\hrsuZoj.exe
  2⤵
  PID:1764
- C:\Windows\System\uujAFfB.exe
  C:\Windows\System\uujAFfB.exe
  2⤵
  PID:3376
- C:\Windows\System\yUQdAHK.exe
  C:\Windows\System\yUQdAHK.exe
  2⤵
  PID:4548
- C:\Windows\System\fvYtxtn.exe
  C:\Windows\System\fvYtxtn.exe
  2⤵
  PID:4632
- C:\Windows\System\fipOcXo.exe
  C:\Windows\System\fipOcXo.exe
  2⤵
  PID:4992
- C:\Windows\System\IhrrrYC.exe
  C:\Windows\System\IhrrrYC.exe
  2⤵
  PID:5108
- C:\Windows\System\oQgQvUs.exe
  C:\Windows\System\oQgQvUs.exe
  2⤵
  PID:1276
- C:\Windows\System\ujHPENZ.exe
  C:\Windows\System\ujHPENZ.exe
  2⤵
  PID:2664
- C:\Windows\System\dfOTeCZ.exe
  C:\Windows\System\dfOTeCZ.exe
  2⤵
  PID:772
- C:\Windows\System\KKIEYOw.exe
  C:\Windows\System\KKIEYOw.exe
  2⤵
  PID:864
- C:\Windows\System\hVoWpwn.exe
  C:\Windows\System\hVoWpwn.exe
  2⤵
  PID:3988
- C:\Windows\System\syEIIpJ.exe
  C:\Windows\System\syEIIpJ.exe
  2⤵
  PID:3324
- C:\Windows\System\QMfOTOi.exe
  C:\Windows\System\QMfOTOi.exe
  2⤵
  PID:2072
- C:\Windows\System\tvHWYaU.exe
  C:\Windows\System\tvHWYaU.exe
  2⤵
  PID:2312
- C:\Windows\System\acMmEmU.exe
  C:\Windows\System\acMmEmU.exe
  2⤵
  PID:2856
- C:\Windows\System\RLanLTf.exe
  C:\Windows\System\RLanLTf.exe
  2⤵
  PID:3048
- C:\Windows\System\wArbwsU.exe
  C:\Windows\System\wArbwsU.exe
  2⤵
  PID:1548
- C:\Windows\System\mBAlmxM.exe
  C:\Windows\System\mBAlmxM.exe
  2⤵
  PID:2080
- C:\Windows\System\KdlxwFS.exe
  C:\Windows\System\KdlxwFS.exe
  2⤵
  PID:2620
- C:\Windows\System\JIhbUUC.exe
  C:\Windows\System\JIhbUUC.exe
  2⤵
  PID:5036
- C:\Windows\System\DESgDep.exe
  C:\Windows\System\DESgDep.exe
  2⤵
  PID:5064
- C:\Windows\System\btyIQNC.exe
  C:\Windows\System\btyIQNC.exe
  2⤵
  PID:2764
- C:\Windows\System\JhKZOZT.exe
  C:\Windows\System\JhKZOZT.exe
  2⤵
  PID:4600
- C:\Windows\System\JoOgPWe.exe
  C:\Windows\System\JoOgPWe.exe
  2⤵
  PID:5032
- C:\Windows\System\QWEDpXh.exe
  C:\Windows\System\QWEDpXh.exe
  2⤵
  PID:3216
- C:\Windows\System\rCBZzhJ.exe
  C:\Windows\System\rCBZzhJ.exe
  2⤵
  PID:5000
- C:\Windows\System\wsamhJH.exe
  C:\Windows\System\wsamhJH.exe
  2⤵
  PID:3616
- C:\Windows\System\cjizyFH.exe
  C:\Windows\System\cjizyFH.exe
  2⤵
  PID:5128
- C:\Windows\System\poLIgEk.exe
  C:\Windows\System\poLIgEk.exe
  2⤵
  PID:5168
- C:\Windows\System\rAkmgOz.exe
  C:\Windows\System\rAkmgOz.exe
  2⤵
  PID:5196
- C:\Windows\System\WjArXme.exe
  C:\Windows\System\WjArXme.exe
  2⤵
  PID:5224
- C:\Windows\System\LCKSsNx.exe
  C:\Windows\System\LCKSsNx.exe
  2⤵
  PID:5260
- C:\Windows\System\pjYebvm.exe
  C:\Windows\System\pjYebvm.exe
  2⤵
  PID:5300
- C:\Windows\System\LiFTgdB.exe
  C:\Windows\System\LiFTgdB.exe
  2⤵
  PID:5340
- C:\Windows\System\BETnkXz.exe
  C:\Windows\System\BETnkXz.exe
  2⤵
  PID:5372
- C:\Windows\System\aASnSHT.exe
  C:\Windows\System\aASnSHT.exe
  2⤵
  PID:5400
- C:\Windows\System\ANjNYzr.exe
  C:\Windows\System\ANjNYzr.exe
  2⤵
  PID:5420
- C:\Windows\System\WLrleaz.exe
  C:\Windows\System\WLrleaz.exe
  2⤵
  PID:5452
- C:\Windows\System\UyxRCGu.exe
  C:\Windows\System\UyxRCGu.exe
  2⤵
  PID:5476
- C:\Windows\System\qcAwseJ.exe
  C:\Windows\System\qcAwseJ.exe
  2⤵
  PID:5516
- C:\Windows\System\wmgBHHr.exe
  C:\Windows\System\wmgBHHr.exe
  2⤵
  PID:5544
- C:\Windows\System\nTmYhde.exe
  C:\Windows\System\nTmYhde.exe
  2⤵
  PID:5576
- C:\Windows\System\ySNKqHn.exe
  C:\Windows\System\ySNKqHn.exe
  2⤵
  PID:5624
- C:\Windows\System\diZSjdR.exe
  C:\Windows\System\diZSjdR.exe
  2⤵
  PID:5652
- C:\Windows\System\tKxcJPR.exe
  C:\Windows\System\tKxcJPR.exe
  2⤵
  PID:5676
- C:\Windows\System\EBHpAOx.exe
  C:\Windows\System\EBHpAOx.exe
  2⤵
  PID:5704
- C:\Windows\System\zfGQCzi.exe
  C:\Windows\System\zfGQCzi.exe
  2⤵
  PID:5728
- C:\Windows\System\LJzNbGi.exe
  C:\Windows\System\LJzNbGi.exe
  2⤵
  PID:5760
- C:\Windows\System\FALsvyi.exe
  C:\Windows\System\FALsvyi.exe
  2⤵
  PID:5776
- C:\Windows\System\CHOswjG.exe
  C:\Windows\System\CHOswjG.exe
  2⤵
  PID:5808
- C:\Windows\System\eAQCECZ.exe
  C:\Windows\System\eAQCECZ.exe
  2⤵
  PID:5844
- C:\Windows\System\TwadkUL.exe
  C:\Windows\System\TwadkUL.exe
  2⤵
  PID:5864
- C:\Windows\System\BmGzcMs.exe
  C:\Windows\System\BmGzcMs.exe
  2⤵
  PID:5888
- C:\Windows\System\CrHoIsh.exe
  C:\Windows\System\CrHoIsh.exe
  2⤵
  PID:5916
- C:\Windows\System\mDulXEe.exe
  C:\Windows\System\mDulXEe.exe
  2⤵
  PID:5932
- C:\Windows\System\uKVJkij.exe
  C:\Windows\System\uKVJkij.exe
  2⤵
  PID:5964
- C:\Windows\System\syOXjMC.exe
  C:\Windows\System\syOXjMC.exe
  2⤵
  PID:6000
- C:\Windows\System\lUytGBU.exe
  C:\Windows\System\lUytGBU.exe
  2⤵
  PID:6040
- C:\Windows\System\rAWmlID.exe
  C:\Windows\System\rAWmlID.exe
  2⤵
  PID:6068
- C:\Windows\System\COnaufS.exe
  C:\Windows\System\COnaufS.exe
  2⤵
  PID:6100
- C:\Windows\System\BkhiZpU.exe
  C:\Windows\System\BkhiZpU.exe
  2⤵
  PID:6132
- C:\Windows\System\sChpKsT.exe
  C:\Windows\System\sChpKsT.exe
  2⤵
  PID:1380
- C:\Windows\System\RNiLIyq.exe
  C:\Windows\System\RNiLIyq.exe
  2⤵
  PID:5208
- C:\Windows\System\mThUpOx.exe
  C:\Windows\System\mThUpOx.exe
  2⤵
  PID:5292
- C:\Windows\System\SaMXrne.exe
  C:\Windows\System\SaMXrne.exe
  2⤵
  PID:5360
- C:\Windows\System\mKUEaMR.exe
  C:\Windows\System\mKUEaMR.exe
  2⤵
  PID:5448
- C:\Windows\System\eyMZZTJ.exe
  C:\Windows\System\eyMZZTJ.exe
  2⤵
  PID:5528
- C:\Windows\System\GOwwpMU.exe
  C:\Windows\System\GOwwpMU.exe
  2⤵
  PID:5608
- C:\Windows\System\uTCYQFv.exe
  C:\Windows\System\uTCYQFv.exe
  2⤵
  PID:5700
- C:\Windows\System\fPhpVzN.exe
  C:\Windows\System\fPhpVzN.exe
  2⤵
  PID:5720
- C:\Windows\System\HyRBCpI.exe
  C:\Windows\System\HyRBCpI.exe
  2⤵
  PID:5816
- C:\Windows\System\UpeHpoX.exe
  C:\Windows\System\UpeHpoX.exe
  2⤵
  PID:5880
- C:\Windows\System\sqxXxzl.exe
  C:\Windows\System\sqxXxzl.exe
  2⤵
  PID:5956
- C:\Windows\System\vguPOQf.exe
  C:\Windows\System\vguPOQf.exe
  2⤵
  PID:6024
- C:\Windows\System\JeksyBt.exe
  C:\Windows\System\JeksyBt.exe
  2⤵
  PID:6112
- C:\Windows\System\KLInPll.exe
  C:\Windows\System\KLInPll.exe
  2⤵
  PID:5216
- C:\Windows\System\PCXhrYK.exe
  C:\Windows\System\PCXhrYK.exe
  2⤵
  PID:5332
- C:\Windows\System\LYKnhki.exe
  C:\Windows\System\LYKnhki.exe
  2⤵
  PID:5556
- C:\Windows\System\kFvfyKh.exe
  C:\Windows\System\kFvfyKh.exe
  2⤵
  PID:5756
- C:\Windows\System\SzQjPvS.exe
  C:\Windows\System\SzQjPvS.exe
  2⤵
  PID:5900
- C:\Windows\System\SonLLXU.exe
  C:\Windows\System\SonLLXU.exe
  2⤵
  PID:6080
- C:\Windows\System\NqLIaKy.exe
  C:\Windows\System\NqLIaKy.exe
  2⤵
  PID:5508
- C:\Windows\System\myHahrE.exe
  C:\Windows\System\myHahrE.exe
  2⤵
  PID:6064
- C:\Windows\System\QkhtVxT.exe
  C:\Windows\System\QkhtVxT.exe
  2⤵
  PID:5428
- C:\Windows\System\GExNohq.exe
  C:\Windows\System\GExNohq.exe
  2⤵
  PID:5388
- C:\Windows\System\HjMkSPF.exe
  C:\Windows\System\HjMkSPF.exe
  2⤵
  PID:6012
- C:\Windows\System\dtTTGof.exe
  C:\Windows\System\dtTTGof.exe
  2⤵
  PID:5288
- C:\Windows\System\recSwzU.exe
  C:\Windows\System\recSwzU.exe
  2⤵
  PID:5324
- C:\Windows\System\vheltvS.exe
  C:\Windows\System\vheltvS.exe
  2⤵
  PID:6164
- C:\Windows\System\YNiPuXL.exe
  C:\Windows\System\YNiPuXL.exe
  2⤵
  PID:6192
- C:\Windows\System\ENtuudA.exe
  C:\Windows\System\ENtuudA.exe
  2⤵
  PID:6212
- C:\Windows\System\hrJxkGu.exe
  C:\Windows\System\hrJxkGu.exe
  2⤵
  PID:6252
- C:\Windows\System\izpyYBa.exe
  C:\Windows\System\izpyYBa.exe
  2⤵
  PID:6280
- C:\Windows\System\rbbiWzZ.exe
  C:\Windows\System\rbbiWzZ.exe
  2⤵
  PID:6308
- C:\Windows\System\mHRqnZo.exe
  C:\Windows\System\mHRqnZo.exe
  2⤵
  PID:6324
- C:\Windows\System\sUypIhn.exe
  C:\Windows\System\sUypIhn.exe
  2⤵
  PID:6352
- C:\Windows\System\aXJtpkE.exe
  C:\Windows\System\aXJtpkE.exe
  2⤵
  PID:6372
- C:\Windows\System\qmQfFCL.exe
  C:\Windows\System\qmQfFCL.exe
  2⤵
  PID:6404
- C:\Windows\System\hjNEOUl.exe
  C:\Windows\System\hjNEOUl.exe
  2⤵
  PID:6440
- C:\Windows\System\XqXVeZu.exe
  C:\Windows\System\XqXVeZu.exe
  2⤵
  PID:6476
- C:\Windows\System\QYzYicq.exe
  C:\Windows\System\QYzYicq.exe
  2⤵
  PID:6496
- C:\Windows\System\TGZOzRf.exe
  C:\Windows\System\TGZOzRf.exe
  2⤵
  PID:6520
- C:\Windows\System\GrHpyBV.exe
  C:\Windows\System\GrHpyBV.exe
  2⤵
  PID:6548
- C:\Windows\System\zyQxYNR.exe
  C:\Windows\System\zyQxYNR.exe
  2⤵
  PID:6592
- C:\Windows\System\RvTcVch.exe
  C:\Windows\System\RvTcVch.exe
  2⤵
  PID:6620
- C:\Windows\System\ZqvRaBZ.exe
  C:\Windows\System\ZqvRaBZ.exe
  2⤵
  PID:6640
- C:\Windows\System\DdOLxEi.exe
  C:\Windows\System\DdOLxEi.exe
  2⤵
  PID:6668
- C:\Windows\System\CorfnPk.exe
  C:\Windows\System\CorfnPk.exe
  2⤵
  PID:6696
- C:\Windows\System\bgzHVxn.exe
  C:\Windows\System\bgzHVxn.exe
  2⤵
  PID:6736
- C:\Windows\System\WrgnmlC.exe
  C:\Windows\System\WrgnmlC.exe
  2⤵
  PID:6764
- C:\Windows\System\GFsfvGz.exe
  C:\Windows\System\GFsfvGz.exe
  2⤵
  PID:6788
- C:\Windows\System\FnoitMe.exe
  C:\Windows\System\FnoitMe.exe
  2⤵
  PID:6808
- C:\Windows\System\HJxSjfx.exe
  C:\Windows\System\HJxSjfx.exe
  2⤵
  PID:6848
- C:\Windows\System\rjHQgkq.exe
  C:\Windows\System\rjHQgkq.exe
  2⤵
  PID:6876
- C:\Windows\System\xRQZZFy.exe
  C:\Windows\System\xRQZZFy.exe
  2⤵
  PID:6892
- C:\Windows\System\gvGuUVq.exe
  C:\Windows\System\gvGuUVq.exe
  2⤵
  PID:6916
- C:\Windows\System\dbhfCdi.exe
  C:\Windows\System\dbhfCdi.exe
  2⤵
  PID:6948
- C:\Windows\System\QXxTVdR.exe
  C:\Windows\System\QXxTVdR.exe
  2⤵
  PID:6976
- C:\Windows\System\JzEOnnd.exe
  C:\Windows\System\JzEOnnd.exe
  2⤵
  PID:7016
- C:\Windows\System\kblDFXg.exe
  C:\Windows\System\kblDFXg.exe
  2⤵
  PID:7044
- C:\Windows\System\BDsMioA.exe
  C:\Windows\System\BDsMioA.exe
  2⤵
  PID:7072
- C:\Windows\System\exWyeNS.exe
  C:\Windows\System\exWyeNS.exe
  2⤵
  PID:7100
- C:\Windows\System\ZPCZJze.exe
  C:\Windows\System\ZPCZJze.exe
  2⤵
  PID:7128
- C:\Windows\System\xGsEVqv.exe
  C:\Windows\System\xGsEVqv.exe
  2⤵
  PID:7152
- C:\Windows\System\hCVgUXV.exe
  C:\Windows\System\hCVgUXV.exe
  2⤵
  PID:6188
- C:\Windows\System\fJiSJbA.exe
  C:\Windows\System\fJiSJbA.exe
  2⤵
  PID:6236
- C:\Windows\System\mLRFSvE.exe
  C:\Windows\System\mLRFSvE.exe
  2⤵
  PID:6276
- C:\Windows\System\cPlVTcM.exe
  C:\Windows\System\cPlVTcM.exe
  2⤵
  PID:6396
- C:\Windows\System\LCYfuGc.exe
  C:\Windows\System\LCYfuGc.exe
  2⤵
  PID:6400
- C:\Windows\System\MWQlXKx.exe
  C:\Windows\System\MWQlXKx.exe
  2⤵
  PID:6492
- C:\Windows\System\utcMESr.exe
  C:\Windows\System\utcMESr.exe
  2⤵
  PID:6536
- C:\Windows\System\ErRVHKN.exe
  C:\Windows\System\ErRVHKN.exe
  2⤵
  PID:6612
- C:\Windows\System\jkBSUhO.exe
  C:\Windows\System\jkBSUhO.exe
  2⤵
  PID:6680
- C:\Windows\System\HpQMwUL.exe
  C:\Windows\System\HpQMwUL.exe
  2⤵
  PID:6748
- C:\Windows\System\kCMqJop.exe
  C:\Windows\System\kCMqJop.exe
  2⤵
  PID:6804
- C:\Windows\System\jPDIlUZ.exe
  C:\Windows\System\jPDIlUZ.exe
  2⤵
  PID:6900
- C:\Windows\System\alEMiQY.exe
  C:\Windows\System\alEMiQY.exe
  2⤵
  PID:6936
- C:\Windows\System\NYaKweu.exe
  C:\Windows\System\NYaKweu.exe
  2⤵
  PID:7008
- C:\Windows\System\IHFowhN.exe
  C:\Windows\System\IHFowhN.exe
  2⤵
  PID:7084
- C:\Windows\System\OlRhfXL.exe
  C:\Windows\System\OlRhfXL.exe
  2⤵
  PID:6160
- C:\Windows\System\ITxIrjv.exe
  C:\Windows\System\ITxIrjv.exe
  2⤵
  PID:6272
- C:\Windows\System\BahdfdG.exe
  C:\Windows\System\BahdfdG.exe
  2⤵
  PID:6416
- C:\Windows\System\UMZwsIG.exe
  C:\Windows\System\UMZwsIG.exe
  2⤵
  PID:6632
- C:\Windows\System\BWkuXEi.exe
  C:\Windows\System\BWkuXEi.exe
  2⤵
  PID:6820
- C:\Windows\System\oOHHjhi.exe
  C:\Windows\System\oOHHjhi.exe
  2⤵
  PID:6928
- C:\Windows\System\tDtIunV.exe
  C:\Windows\System\tDtIunV.exe
  2⤵
  PID:7068
- C:\Windows\System\dFBWHvo.exe
  C:\Windows\System\dFBWHvo.exe
  2⤵
  PID:6208
- C:\Windows\System\rFFFPGb.exe
  C:\Windows\System\rFFFPGb.exe
  2⤵
  PID:6660
- C:\Windows\System\OmHnMwc.exe
  C:\Windows\System\OmHnMwc.exe
  2⤵
  PID:7004
- C:\Windows\System\qBayKba.exe
  C:\Windows\System\qBayKba.exe
  2⤵
  PID:7112
- C:\Windows\System\elGMepL.exe
  C:\Windows\System\elGMepL.exe
  2⤵
  PID:6428
- C:\Windows\System\jqtcygb.exe
  C:\Windows\System\jqtcygb.exe
  2⤵
  PID:7184
- C:\Windows\System\qgpNKHQ.exe
  C:\Windows\System\qgpNKHQ.exe
  2⤵
  PID:7216
- C:\Windows\System\mbRugFN.exe
  C:\Windows\System\mbRugFN.exe
  2⤵
  PID:7244
- C:\Windows\System\rnKApdI.exe
  C:\Windows\System\rnKApdI.exe
  2⤵
  PID:7284
- C:\Windows\System\QsoQQbH.exe
  C:\Windows\System\QsoQQbH.exe
  2⤵
  PID:7308
- C:\Windows\System\moVMrDF.exe
  C:\Windows\System\moVMrDF.exe
  2⤵
  PID:7328
- C:\Windows\System\aKawKwC.exe
  C:\Windows\System\aKawKwC.exe
  2⤵
  PID:7356
- C:\Windows\System\zznyLUL.exe
  C:\Windows\System\zznyLUL.exe
  2⤵
  PID:7380
- C:\Windows\System\GWxhMKy.exe
  C:\Windows\System\GWxhMKy.exe
  2⤵
  PID:7412
- C:\Windows\System\nIEBFZB.exe
  C:\Windows\System\nIEBFZB.exe
  2⤵
  PID:7440
- C:\Windows\System\jhNESZN.exe
  C:\Windows\System\jhNESZN.exe
  2⤵
  PID:7468
- C:\Windows\System\RSIzdAK.exe
  C:\Windows\System\RSIzdAK.exe
  2⤵
  PID:7504
- C:\Windows\System\zNgNDTU.exe
  C:\Windows\System\zNgNDTU.exe
  2⤵
  PID:7536
- C:\Windows\System\CXOAgSx.exe
  C:\Windows\System\CXOAgSx.exe
  2⤵
  PID:7568
- C:\Windows\System\xMVoRqW.exe
  C:\Windows\System\xMVoRqW.exe
  2⤵
  PID:7588
- C:\Windows\System\OHwqUMM.exe
  C:\Windows\System\OHwqUMM.exe
  2⤵
  PID:7620
- C:\Windows\System\hgjKIVG.exe
  C:\Windows\System\hgjKIVG.exe
  2⤵
  PID:7652
- C:\Windows\System\tdSMdwJ.exe
  C:\Windows\System\tdSMdwJ.exe
  2⤵
  PID:7672
- C:\Windows\System\UUnqeCR.exe
  C:\Windows\System\UUnqeCR.exe
  2⤵
  PID:7696
- C:\Windows\System\cRbSbYQ.exe
  C:\Windows\System\cRbSbYQ.exe
  2⤵
  PID:7724
- C:\Windows\System\byqKsnW.exe
  C:\Windows\System\byqKsnW.exe
  2⤵
  PID:7752
- C:\Windows\System\rcnulVq.exe
  C:\Windows\System\rcnulVq.exe
  2⤵
  PID:7784
- C:\Windows\System\ceJytTm.exe
  C:\Windows\System\ceJytTm.exe
  2⤵
  PID:7820
- C:\Windows\System\fSeCGqt.exe
  C:\Windows\System\fSeCGqt.exe
  2⤵
  PID:7840
- C:\Windows\System\pUoYGci.exe
  C:\Windows\System\pUoYGci.exe
  2⤵
  PID:7864
- C:\Windows\System\RUgekPD.exe
  C:\Windows\System\RUgekPD.exe
  2⤵
  PID:7892
- C:\Windows\System\ibmIQSL.exe
  C:\Windows\System\ibmIQSL.exe
  2⤵
  PID:7920
- C:\Windows\System\YktWdLV.exe
  C:\Windows\System\YktWdLV.exe
  2⤵
  PID:7948
- C:\Windows\System\BqahFFD.exe
  C:\Windows\System\BqahFFD.exe
  2⤵
  PID:7976
- C:\Windows\System\GTmXYrN.exe
  C:\Windows\System\GTmXYrN.exe
  2⤵
  PID:8004
- C:\Windows\System\NlvQURA.exe
  C:\Windows\System\NlvQURA.exe
  2⤵
  PID:8036
- C:\Windows\System\xOhoPkM.exe
  C:\Windows\System\xOhoPkM.exe
  2⤵
  PID:8060
- C:\Windows\System\inPhaxV.exe
  C:\Windows\System\inPhaxV.exe
  2⤵
  PID:8092
- C:\Windows\System\hRjrSno.exe
  C:\Windows\System\hRjrSno.exe
  2⤵
  PID:8116
- C:\Windows\System\NpAjOXp.exe
  C:\Windows\System\NpAjOXp.exe
  2⤵
  PID:8140
- C:\Windows\System\OXqDWiE.exe
  C:\Windows\System\OXqDWiE.exe
  2⤵
  PID:8160
- C:\Windows\System\JMlBuUQ.exe
  C:\Windows\System\JMlBuUQ.exe
  2⤵
  PID:6832
- C:\Windows\System\zvKnDxO.exe
  C:\Windows\System\zvKnDxO.exe
  2⤵
  PID:7200
- C:\Windows\System\OSUGaho.exe
  C:\Windows\System\OSUGaho.exe
  2⤵
  PID:7276
- C:\Windows\System\MkfiIxL.exe
  C:\Windows\System\MkfiIxL.exe
  2⤵
  PID:7320
- C:\Windows\System\fNjzQEL.exe
  C:\Windows\System\fNjzQEL.exe
  2⤵
  PID:7424
- C:\Windows\System\YMMkGcE.exe
  C:\Windows\System\YMMkGcE.exe
  2⤵
  PID:7464
- C:\Windows\System\XMfxTxH.exe
  C:\Windows\System\XMfxTxH.exe
  2⤵
  PID:7556
- C:\Windows\System\mlFIhTX.exe
  C:\Windows\System\mlFIhTX.exe
  2⤵
  PID:7616
- C:\Windows\System\fxPNLfs.exe
  C:\Windows\System\fxPNLfs.exe
  2⤵
  PID:7708
- C:\Windows\System\dwfQAZh.exe
  C:\Windows\System\dwfQAZh.exe
  2⤵
  PID:7772
- C:\Windows\System\iVbGyFz.exe
  C:\Windows\System\iVbGyFz.exe
  2⤵
  PID:7848
- C:\Windows\System\zCKzrBq.exe
  C:\Windows\System\zCKzrBq.exe
  2⤵
  PID:7860
- C:\Windows\System\ZMXhxFF.exe
  C:\Windows\System\ZMXhxFF.exe
  2⤵
  PID:7964
- C:\Windows\System\lWgowIW.exe
  C:\Windows\System\lWgowIW.exe
  2⤵
  PID:8020
- C:\Windows\System\JwtBWKy.exe
  C:\Windows\System\JwtBWKy.exe
  2⤵
  PID:8084
- C:\Windows\System\HGnJslh.exe
  C:\Windows\System\HGnJslh.exe
  2⤵
  PID:8156
- C:\Windows\System\PYDuZtM.exe
  C:\Windows\System\PYDuZtM.exe
  2⤵
  PID:8184
- C:\Windows\System\ijHIvnw.exe
  C:\Windows\System\ijHIvnw.exe
  2⤵
  PID:7292
- C:\Windows\System\HGdGbNF.exe
  C:\Windows\System\HGdGbNF.exe
  2⤵
  PID:7512
- C:\Windows\System\pnqxuuM.exe
  C:\Windows\System\pnqxuuM.exe
  2⤵
  PID:7636
- C:\Windows\System\qVXOXOr.exe
  C:\Windows\System\qVXOXOr.exe
  2⤵
  PID:7668
- C:\Windows\System\dxUsxnH.exe
  C:\Windows\System\dxUsxnH.exe
  2⤵
  PID:7912
- C:\Windows\System\jiNrdlw.exe
  C:\Windows\System\jiNrdlw.exe
  2⤵
  PID:8052
- C:\Windows\System\DUFELPS.exe
  C:\Windows\System\DUFELPS.exe
  2⤵
  PID:7212
- C:\Windows\System\pmCnHWx.exe
  C:\Windows\System\pmCnHWx.exe
  2⤵
  PID:7432
- C:\Windows\System\UcDpHFX.exe
  C:\Windows\System\UcDpHFX.exe
  2⤵
  PID:7996
- C:\Windows\System\lZYesvu.exe
  C:\Windows\System\lZYesvu.exe
  2⤵
  PID:7692
- C:\Windows\System\hLAGNSN.exe
  C:\Windows\System\hLAGNSN.exe
  2⤵
  PID:7480
- C:\Windows\System\xuouaWS.exe
  C:\Windows\System\xuouaWS.exe
  2⤵
  PID:8216
- C:\Windows\System\ARErFaa.exe
  C:\Windows\System\ARErFaa.exe
  2⤵
  PID:8240
- C:\Windows\System\VZnxNBI.exe
  C:\Windows\System\VZnxNBI.exe
  2⤵
  PID:8256
- C:\Windows\System\OhfBRvb.exe
  C:\Windows\System\OhfBRvb.exe
  2⤵
  PID:8300
- C:\Windows\System\QePqGLq.exe
  C:\Windows\System\QePqGLq.exe
  2⤵
  PID:8336
- C:\Windows\System\ntcLByp.exe
  C:\Windows\System\ntcLByp.exe
  2⤵
  PID:8364
- C:\Windows\System\YjzAEzV.exe
  C:\Windows\System\YjzAEzV.exe
  2⤵
  PID:8400
- C:\Windows\System\OatpLlq.exe
  C:\Windows\System\OatpLlq.exe
  2⤵
  PID:8432
- C:\Windows\System\KWqYXRK.exe
  C:\Windows\System\KWqYXRK.exe
  2⤵
  PID:8460
- C:\Windows\System\LOqkGUp.exe
  C:\Windows\System\LOqkGUp.exe
  2⤵
  PID:8488
- C:\Windows\System\BvFxKQJ.exe
  C:\Windows\System\BvFxKQJ.exe
  2⤵
  PID:8516
- C:\Windows\System\xDgdjDt.exe
  C:\Windows\System\xDgdjDt.exe
  2⤵
  PID:8532
- C:\Windows\System\PZqABXg.exe
  C:\Windows\System\PZqABXg.exe
  2⤵
  PID:8548
- C:\Windows\System\RQPctNt.exe
  C:\Windows\System\RQPctNt.exe
  2⤵
  PID:8564
- C:\Windows\System\dyoJxij.exe
  C:\Windows\System\dyoJxij.exe
  2⤵
  PID:8580
- C:\Windows\System\TjQjOZb.exe
  C:\Windows\System\TjQjOZb.exe
  2⤵
  PID:8608
- C:\Windows\System\FAoOUbE.exe
  C:\Windows\System\FAoOUbE.exe
  2⤵
  PID:8652
- C:\Windows\System\dcufOYQ.exe
  C:\Windows\System\dcufOYQ.exe
  2⤵
  PID:8692
- C:\Windows\System\FNeXRMx.exe
  C:\Windows\System\FNeXRMx.exe
  2⤵
  PID:8720
- C:\Windows\System\JmObhLg.exe
  C:\Windows\System\JmObhLg.exe
  2⤵
  PID:8748
- C:\Windows\System\rWynXaS.exe
  C:\Windows\System\rWynXaS.exe
  2⤵
  PID:8776
- C:\Windows\System\QIytlxe.exe
  C:\Windows\System\QIytlxe.exe
  2⤵
  PID:8820
- C:\Windows\System\dagMGBE.exe
  C:\Windows\System\dagMGBE.exe
  2⤵
  PID:8848
- C:\Windows\System\ljuFKrL.exe
  C:\Windows\System\ljuFKrL.exe
  2⤵
  PID:8868
- C:\Windows\System\voqdcAD.exe
  C:\Windows\System\voqdcAD.exe
  2⤵
  PID:8896
- C:\Windows\System\ynvcHGf.exe
  C:\Windows\System\ynvcHGf.exe
  2⤵
  PID:8928
- C:\Windows\System\meTXDRR.exe
  C:\Windows\System\meTXDRR.exe
  2⤵
  PID:8956
- C:\Windows\System\DEfVpdD.exe
  C:\Windows\System\DEfVpdD.exe
  2⤵
  PID:8988
- C:\Windows\System\VyfOYBj.exe
  C:\Windows\System\VyfOYBj.exe
  2⤵
  PID:9012
- C:\Windows\System\xiKbFLw.exe
  C:\Windows\System\xiKbFLw.exe
  2⤵
  PID:9040
- C:\Windows\System\mvqjBUd.exe
  C:\Windows\System\mvqjBUd.exe
  2⤵
  PID:9056
- C:\Windows\System\XgwLmmL.exe
  C:\Windows\System\XgwLmmL.exe
  2⤵
  PID:9088
- C:\Windows\System\jKUDuob.exe
  C:\Windows\System\jKUDuob.exe
  2⤵
  PID:9124
- C:\Windows\System\yZCscuX.exe
  C:\Windows\System\yZCscuX.exe
  2⤵
  PID:9144
- C:\Windows\System\GIBkNJw.exe
  C:\Windows\System\GIBkNJw.exe
  2⤵
  PID:9168
- C:\Windows\System\DlMqCEU.exe
  C:\Windows\System\DlMqCEU.exe
  2⤵
  PID:9196
- C:\Windows\System\oHPLMqn.exe
  C:\Windows\System\oHPLMqn.exe
  2⤵
  PID:7404
- C:\Windows\System\jjvRSVo.exe
  C:\Windows\System\jjvRSVo.exe
  2⤵
  PID:8248
- C:\Windows\System\wreDsCr.exe
  C:\Windows\System\wreDsCr.exe
  2⤵
  PID:8312
- C:\Windows\System\fkMblwj.exe
  C:\Windows\System\fkMblwj.exe
  2⤵
  PID:8376
- C:\Windows\System\YrIppdb.exe
  C:\Windows\System\YrIppdb.exe
  2⤵
  PID:8444
- C:\Windows\System\crWooxr.exe
  C:\Windows\System\crWooxr.exe
  2⤵
  PID:8508
- C:\Windows\System\EeEmDOg.exe
  C:\Windows\System\EeEmDOg.exe
  2⤵
  PID:8572
- C:\Windows\System\pnPKHYp.exe
  C:\Windows\System\pnPKHYp.exe
  2⤵
  PID:8640
- C:\Windows\System\NztnlYt.exe
  C:\Windows\System\NztnlYt.exe
  2⤵
  PID:8764
- C:\Windows\System\yjPCjfR.exe
  C:\Windows\System\yjPCjfR.exe
  2⤵
  PID:8760
- C:\Windows\System\QigyExy.exe
  C:\Windows\System\QigyExy.exe
  2⤵
  PID:8888
- C:\Windows\System\zBDsZeU.exe
  C:\Windows\System\zBDsZeU.exe
  2⤵
  PID:8916
- C:\Windows\System\jQWKoDs.exe
  C:\Windows\System\jQWKoDs.exe
  2⤵
  PID:9032
- C:\Windows\System\XbdGNbP.exe
  C:\Windows\System\XbdGNbP.exe
  2⤵
  PID:9052
- C:\Windows\System\jDnsbWi.exe
  C:\Windows\System\jDnsbWi.exe
  2⤵
  PID:9100
- C:\Windows\System\ahKRCXG.exe
  C:\Windows\System\ahKRCXG.exe
  2⤵
  PID:9184
- C:\Windows\System\LYdgBWs.exe
  C:\Windows\System\LYdgBWs.exe
  2⤵
  PID:8324
- C:\Windows\System\aqTfnYP.exe
  C:\Windows\System\aqTfnYP.exe
  2⤵
  PID:8428
- C:\Windows\System\QCJlhoe.exe
  C:\Windows\System\QCJlhoe.exe
  2⤵
  PID:8528
- C:\Windows\System\pFxLbyv.exe
  C:\Windows\System\pFxLbyv.exe
  2⤵
  PID:8540
- C:\Windows\System\cGRiGFk.exe
  C:\Windows\System\cGRiGFk.exe
  2⤵
  PID:8864
- C:\Windows\System\XplnBwS.exe
  C:\Windows\System\XplnBwS.exe
  2⤵
  PID:9004
- C:\Windows\System\mgkDUxA.exe
  C:\Windows\System\mgkDUxA.exe
  2⤵
  PID:9180
- C:\Windows\System\aBYkwZs.exe
  C:\Windows\System\aBYkwZs.exe
  2⤵
  PID:8420
- C:\Windows\System\jSbvlND.exe
  C:\Windows\System\jSbvlND.exe
  2⤵
  PID:8784
- C:\Windows\System\gBGbiTu.exe
  C:\Windows\System\gBGbiTu.exe
  2⤵
  PID:8236
- C:\Windows\System\bGYwHhR.exe
  C:\Windows\System\bGYwHhR.exe
  2⤵
  PID:8676
- C:\Windows\System\WVMBcQD.exe
  C:\Windows\System\WVMBcQD.exe
  2⤵
  PID:8592
- C:\Windows\System\MlKsHeW.exe
  C:\Windows\System\MlKsHeW.exe
  2⤵
  PID:9232
- C:\Windows\System\WbzLqrO.exe
  C:\Windows\System\WbzLqrO.exe
  2⤵
  PID:9248
- C:\Windows\System\qybAuik.exe
  C:\Windows\System\qybAuik.exe
  2⤵
  PID:9276
- C:\Windows\System\wppvLMZ.exe
  C:\Windows\System\wppvLMZ.exe
  2⤵
  PID:9308
- C:\Windows\System\HeMeFtJ.exe
  C:\Windows\System\HeMeFtJ.exe
  2⤵
  PID:9344
- C:\Windows\System\hJupAPx.exe
  C:\Windows\System\hJupAPx.exe
  2⤵
  PID:9384
- C:\Windows\System\eFrPDyP.exe
  C:\Windows\System\eFrPDyP.exe
  2⤵
  PID:9408
- C:\Windows\System\nDJISDu.exe
  C:\Windows\System\nDJISDu.exe
  2⤵
  PID:9440
- C:\Windows\System\khHkWQD.exe
  C:\Windows\System\khHkWQD.exe
  2⤵
  PID:9460
- C:\Windows\System\Pmmldmf.exe
  C:\Windows\System\Pmmldmf.exe
  2⤵
  PID:9488
- C:\Windows\System\tcEJydB.exe
  C:\Windows\System\tcEJydB.exe
  2⤵
  PID:9512
- C:\Windows\System\AtEESeP.exe
  C:\Windows\System\AtEESeP.exe
  2⤵
  PID:9528
- C:\Windows\System\nflNtLz.exe
  C:\Windows\System\nflNtLz.exe
  2⤵
  PID:9544
- C:\Windows\System\KZLZOmm.exe
  C:\Windows\System\KZLZOmm.exe
  2⤵
  PID:9572
- C:\Windows\System\ehlwDyD.exe
  C:\Windows\System\ehlwDyD.exe
  2⤵
  PID:9608
- C:\Windows\System\SdqZITb.exe
  C:\Windows\System\SdqZITb.exe
  2⤵
  PID:9652
- C:\Windows\System\fgQAjyW.exe
  C:\Windows\System\fgQAjyW.exe
  2⤵
  PID:9680
- C:\Windows\System\psvQFye.exe
  C:\Windows\System\psvQFye.exe
  2⤵
  PID:9704
- C:\Windows\System\cODskHm.exe
  C:\Windows\System\cODskHm.exe
  2⤵
  PID:9752
- C:\Windows\System\iIQeqBX.exe
  C:\Windows\System\iIQeqBX.exe
  2⤵
  PID:9788
- C:\Windows\System\zWLPcxJ.exe
  C:\Windows\System\zWLPcxJ.exe
  2⤵
  PID:9808
- C:\Windows\System\TKjJQri.exe
  C:\Windows\System\TKjJQri.exe
  2⤵
  PID:9836
- C:\Windows\System\SLWEVWo.exe
  C:\Windows\System\SLWEVWo.exe
  2⤵
  PID:9876
- C:\Windows\System\tvxBJZy.exe
  C:\Windows\System\tvxBJZy.exe
  2⤵
  PID:9896
- C:\Windows\System\SbXLVCp.exe
  C:\Windows\System\SbXLVCp.exe
  2⤵
  PID:9920
- C:\Windows\System\TYKkTQu.exe
  C:\Windows\System\TYKkTQu.exe
  2⤵
  PID:9948
- C:\Windows\System\hEnHyhD.exe
  C:\Windows\System\hEnHyhD.exe
  2⤵
  PID:9968
- C:\Windows\System\FdhCMlE.exe
  C:\Windows\System\FdhCMlE.exe
  2⤵
  PID:9992
- C:\Windows\System\YQRZdrl.exe
  C:\Windows\System\YQRZdrl.exe
  2⤵
  PID:10020
- C:\Windows\System\NUkjGfn.exe
  C:\Windows\System\NUkjGfn.exe
  2⤵
  PID:10060
- C:\Windows\System\OLKRfaV.exe
  C:\Windows\System\OLKRfaV.exe
  2⤵
  PID:10088
- C:\Windows\System\ypKtRxI.exe
  C:\Windows\System\ypKtRxI.exe
  2⤵
  PID:10124
- C:\Windows\System\pVTpvoF.exe
  C:\Windows\System\pVTpvoF.exe
  2⤵
  PID:10148
- C:\Windows\System\tJuUTbc.exe
  C:\Windows\System\tJuUTbc.exe
  2⤵
  PID:10184
- C:\Windows\System\QCBVERc.exe
  C:\Windows\System\QCBVERc.exe
  2⤵
  PID:10212
- C:\Windows\System\XPOUytm.exe
  C:\Windows\System\XPOUytm.exe
  2⤵
  PID:10228
- C:\Windows\System\HHdskqw.exe
  C:\Windows\System\HHdskqw.exe
  2⤵
  PID:9212
- C:\Windows\System\wjmTEiT.exe
  C:\Windows\System\wjmTEiT.exe
  2⤵
  PID:9336
- C:\Windows\System\CFJzofF.exe
  C:\Windows\System\CFJzofF.exe
  2⤵
  PID:9364
- C:\Windows\System\NPThyNn.exe
  C:\Windows\System\NPThyNn.exe
  2⤵
  PID:9428
- C:\Windows\System\XEfXeLg.exe
  C:\Windows\System\XEfXeLg.exe
  2⤵
  PID:9468
- C:\Windows\System\APYCEVc.exe
  C:\Windows\System\APYCEVc.exe
  2⤵
  PID:9560
- C:\Windows\System\fHkHDXP.exe
  C:\Windows\System\fHkHDXP.exe
  2⤵
  PID:8664
- C:\Windows\System\YBpDPUK.exe
  C:\Windows\System\YBpDPUK.exe
  2⤵
  PID:9692
- C:\Windows\System\qzUXcvV.exe
  C:\Windows\System\qzUXcvV.exe
  2⤵
  PID:9796
- C:\Windows\System\vhKgOWS.exe
  C:\Windows\System\vhKgOWS.exe
  2⤵
  PID:9820
- C:\Windows\System\yYkcpIz.exe
  C:\Windows\System\yYkcpIz.exe
  2⤵
  PID:9916
- C:\Windows\System\xnbRLEe.exe
  C:\Windows\System\xnbRLEe.exe
  2⤵
  PID:9964
- C:\Windows\System\kTjDrbx.exe
  C:\Windows\System\kTjDrbx.exe
  2⤵
  PID:10012
- C:\Windows\System\gymeuVK.exe
  C:\Windows\System\gymeuVK.exe
  2⤵
  PID:10100
- C:\Windows\System\fdgfIUv.exe
  C:\Windows\System\fdgfIUv.exe
  2⤵
  PID:10168
- C:\Windows\System\IKtjpVz.exe
  C:\Windows\System\IKtjpVz.exe
  2⤵
  PID:9228
- C:\Windows\System\nhIUXCW.exe
  C:\Windows\System\nhIUXCW.exe
  2⤵
  PID:9304
- C:\Windows\System\cEOaaKJ.exe
  C:\Windows\System\cEOaaKJ.exe
  2⤵
  PID:9496
- C:\Windows\System\JUDOlqa.exe
  C:\Windows\System\JUDOlqa.exe
  2⤵
  PID:9620
- C:\Windows\System\FbPIoeu.exe
  C:\Windows\System\FbPIoeu.exe
  2⤵
  PID:9716
- C:\Windows\System\snpiElW.exe
  C:\Windows\System\snpiElW.exe
  2⤵
  PID:9984
- C:\Windows\System\ryXIGHJ.exe
  C:\Windows\System\ryXIGHJ.exe
  2⤵
  PID:9980
- C:\Windows\System\vudzzCR.exe
  C:\Windows\System\vudzzCR.exe
  2⤵
  PID:9268
- C:\Windows\System\gSNewDc.exe
  C:\Windows\System\gSNewDc.exe
  2⤵
  PID:9424
- C:\Windows\System\cuVRgXi.exe
  C:\Windows\System\cuVRgXi.exe
  2⤵
  PID:10136
- C:\Windows\System\NxoiVDy.exe
  C:\Windows\System\NxoiVDy.exe
  2⤵
  PID:9664
- C:\Windows\System\BQEZITK.exe
  C:\Windows\System\BQEZITK.exe
  2⤵
  PID:9960
- C:\Windows\System\syDTLIS.exe
  C:\Windows\System\syDTLIS.exe
  2⤵
  PID:10248
- C:\Windows\System\pmbmjWz.exe
  C:\Windows\System\pmbmjWz.exe
  2⤵
  PID:10264
- C:\Windows\System\bysOUUZ.exe
  C:\Windows\System\bysOUUZ.exe
  2⤵
  PID:10304
- C:\Windows\System\ZVrfDMQ.exe
  C:\Windows\System\ZVrfDMQ.exe
  2⤵
  PID:10332
- C:\Windows\System\mynEHpR.exe
  C:\Windows\System\mynEHpR.exe
  2⤵
  PID:10348
- C:\Windows\System\tOoweLi.exe
  C:\Windows\System\tOoweLi.exe
  2⤵
  PID:10376
- C:\Windows\System\xUKwyAG.exe
  C:\Windows\System\xUKwyAG.exe
  2⤵
  PID:10408
- C:\Windows\System\MoRDwoM.exe
  C:\Windows\System\MoRDwoM.exe
  2⤵
  PID:10440
- C:\Windows\System\hYnEBGu.exe
  C:\Windows\System\hYnEBGu.exe
  2⤵
  PID:10476
- C:\Windows\System\XAeklAs.exe
  C:\Windows\System\XAeklAs.exe
  2⤵
  PID:10512
- C:\Windows\System\PiOUecg.exe
  C:\Windows\System\PiOUecg.exe
  2⤵
  PID:10540
- C:\Windows\System\ipNiyLd.exe
  C:\Windows\System\ipNiyLd.exe
  2⤵
  PID:10556
- C:\Windows\System\DQMeKEE.exe
  C:\Windows\System\DQMeKEE.exe
  2⤵
  PID:10588
- C:\Windows\System\SZogryo.exe
  C:\Windows\System\SZogryo.exe
  2⤵
  PID:10616
- C:\Windows\System\VMtBjPn.exe
  C:\Windows\System\VMtBjPn.exe
  2⤵
  PID:10644
- C:\Windows\System\uOCFmce.exe
  C:\Windows\System\uOCFmce.exe
  2⤵
  PID:10672
- C:\Windows\System\fDOGqKE.exe
  C:\Windows\System\fDOGqKE.exe
  2⤵
  PID:10688
- C:\Windows\System\quyVSiV.exe
  C:\Windows\System\quyVSiV.exe
  2⤵
  PID:10728
- C:\Windows\System\YlhrZYm.exe
  C:\Windows\System\YlhrZYm.exe
  2⤵
  PID:10748
- C:\Windows\System\oVyVnEP.exe
  C:\Windows\System\oVyVnEP.exe
  2⤵
  PID:10784
- C:\Windows\System\ePonsWF.exe
  C:\Windows\System\ePonsWF.exe
  2⤵
  PID:10804
- C:\Windows\System\jEwAOCf.exe
  C:\Windows\System\jEwAOCf.exe
  2⤵
  PID:10832
- C:\Windows\System\IkDcnCn.exe
  C:\Windows\System\IkDcnCn.exe
  2⤵
  PID:10856
- C:\Windows\System\raaOZhc.exe
  C:\Windows\System\raaOZhc.exe
  2⤵
  PID:10892
- C:\Windows\System\adKsUpK.exe
  C:\Windows\System\adKsUpK.exe
  2⤵
  PID:10920
- C:\Windows\System\zqDFpNj.exe
  C:\Windows\System\zqDFpNj.exe
  2⤵
  PID:10952
- C:\Windows\System\gRrDppz.exe
  C:\Windows\System\gRrDppz.exe
  2⤵
  PID:10988
- C:\Windows\System\AKyzciu.exe
  C:\Windows\System\AKyzciu.exe
  2⤵
  PID:11024
- C:\Windows\System\SMIRkgj.exe
  C:\Windows\System\SMIRkgj.exe
  2⤵
  PID:11052
- C:\Windows\System\ovPbjte.exe
  C:\Windows\System\ovPbjte.exe
  2⤵
  PID:11076
- C:\Windows\System\nSxfHtU.exe
  C:\Windows\System\nSxfHtU.exe
  2⤵
  PID:11096
- C:\Windows\System\KfuJyov.exe
  C:\Windows\System\KfuJyov.exe
  2⤵
  PID:11132
- C:\Windows\System\vGSbvpZ.exe
  C:\Windows\System\vGSbvpZ.exe
  2⤵
  PID:11148
- C:\Windows\System\VWCXCBg.exe
  C:\Windows\System\VWCXCBg.exe
  2⤵
  PID:11164
- C:\Windows\System\VHnlUEE.exe
  C:\Windows\System\VHnlUEE.exe
  2⤵
  PID:11196
- C:\Windows\System\zrgTXZx.exe
  C:\Windows\System\zrgTXZx.exe
  2⤵
  PID:11232
- C:\Windows\System\XDcDZlk.exe
  C:\Windows\System\XDcDZlk.exe
  2⤵
  PID:9824
- C:\Windows\System\icJvSRw.exe
  C:\Windows\System\icJvSRw.exe
  2⤵
  PID:10276
- C:\Windows\System\fxfmmYu.exe
  C:\Windows\System\fxfmmYu.exe
  2⤵
  PID:10368
- C:\Windows\System\wJlsKyQ.exe
  C:\Windows\System\wJlsKyQ.exe
  2⤵
  PID:10420
- C:\Windows\System\wGBanKo.exe
  C:\Windows\System\wGBanKo.exe
  2⤵
  PID:10492
- C:\Windows\System\foRdbix.exe
  C:\Windows\System\foRdbix.exe
  2⤵
  PID:10576
- C:\Windows\System\DEyCKIR.exe
  C:\Windows\System\DEyCKIR.exe
  2⤵
  PID:10632
- C:\Windows\System\HTuwCOa.exe
  C:\Windows\System\HTuwCOa.exe
  2⤵
  PID:10708
- C:\Windows\System\PVkeoMO.exe
  C:\Windows\System\PVkeoMO.exe
  2⤵
  PID:10768
- C:\Windows\System\vUoEEuI.exe
  C:\Windows\System\vUoEEuI.exe
  2⤵
  PID:10820
- C:\Windows\System\PWYeVmQ.exe
  C:\Windows\System\PWYeVmQ.exe
  2⤵
  PID:10880
- C:\Windows\System\UDuUPyL.exe
  C:\Windows\System\UDuUPyL.exe
  2⤵
  PID:10940
- C:\Windows\System\scFHtUV.exe
  C:\Windows\System\scFHtUV.exe
  2⤵
  PID:11008
- C:\Windows\System\qtvQGna.exe
  C:\Windows\System\qtvQGna.exe
  2⤵
  PID:11088
- C:\Windows\System\tCgoGjg.exe
  C:\Windows\System\tCgoGjg.exe
  2⤵
  PID:11144
- C:\Windows\System\UaHKlfJ.exe
  C:\Windows\System\UaHKlfJ.exe
  2⤵
  PID:11208
- C:\Windows\System\ScRcymS.exe
  C:\Windows\System\ScRcymS.exe
  2⤵
  PID:10288
- C:\Windows\System\enfXihn.exe
  C:\Windows\System\enfXihn.exe
  2⤵
  PID:10320
- C:\Windows\System\vuzupmF.exe
  C:\Windows\System\vuzupmF.exe
  2⤵
  PID:10568
- C:\Windows\System\NfIFuvx.exe
  C:\Windows\System\NfIFuvx.exe
  2⤵
  PID:10656
- C:\Windows\System\YLMOoEG.exe
  C:\Windows\System\YLMOoEG.exe
  2⤵
  PID:10812
- C:\Windows\System\qXQKDKk.exe
  C:\Windows\System\qXQKDKk.exe
  2⤵
  PID:10980
- C:\Windows\System\oRWsJWt.exe
  C:\Windows\System\oRWsJWt.exe
  2⤵
  PID:11216
- C:\Windows\System\RHSPxbG.exe
  C:\Windows\System\RHSPxbG.exe
  2⤵
  PID:10524
- C:\Windows\System\ZRmeoYO.exe
  C:\Windows\System\ZRmeoYO.exe
  2⤵
  PID:10756
- C:\Windows\System\erYWahB.exe
  C:\Windows\System\erYWahB.exe
  2⤵
  PID:10912
- C:\Windows\System\UMYAXjz.exe
  C:\Windows\System\UMYAXjz.exe
  2⤵
  PID:11252
- C:\Windows\System\jswQSsJ.exe
  C:\Windows\System\jswQSsJ.exe
  2⤵
  PID:11276
- C:\Windows\System\YqNNJRZ.exe
  C:\Windows\System\YqNNJRZ.exe
  2⤵
  PID:11308
- C:\Windows\System\YjjoKEE.exe
  C:\Windows\System\YjjoKEE.exe
  2⤵
  PID:11344
- C:\Windows\System\JyFOAcG.exe
  C:\Windows\System\JyFOAcG.exe
  2⤵
  PID:11376
- C:\Windows\System\icYzwnt.exe
  C:\Windows\System\icYzwnt.exe
  2⤵
  PID:11392
- C:\Windows\System\wFWWgMX.exe
  C:\Windows\System\wFWWgMX.exe
  2⤵
  PID:11420
- C:\Windows\System\gQGwNch.exe
  C:\Windows\System\gQGwNch.exe
  2⤵
  PID:11448
- C:\Windows\System\jyNaXbX.exe
  C:\Windows\System\jyNaXbX.exe
  2⤵
  PID:11488
- C:\Windows\System\mAGmWtj.exe
  C:\Windows\System\mAGmWtj.exe
  2⤵
  PID:11504
- C:\Windows\System\hQBYTOr.exe
  C:\Windows\System\hQBYTOr.exe
  2⤵
  PID:11532
- C:\Windows\System\EhLYPit.exe
  C:\Windows\System\EhLYPit.exe
  2⤵
  PID:11560
- C:\Windows\System\CkTpghH.exe
  C:\Windows\System\CkTpghH.exe
  2⤵
  PID:11576
- C:\Windows\System\tgREFqz.exe
  C:\Windows\System\tgREFqz.exe
  2⤵
  PID:11604
- C:\Windows\System\RUFytsH.exe
  C:\Windows\System\RUFytsH.exe
  2⤵
  PID:11628
- C:\Windows\System\Rlchrgc.exe
  C:\Windows\System\Rlchrgc.exe
  2⤵
  PID:11660
- C:\Windows\System\BTuVred.exe
  C:\Windows\System\BTuVred.exe
  2⤵
  PID:11700
- C:\Windows\System\NrgUHKT.exe
  C:\Windows\System\NrgUHKT.exe
  2⤵
  PID:11728
- C:\Windows\System\dLOzfaG.exe
  C:\Windows\System\dLOzfaG.exe
  2⤵
  PID:11756
- C:\Windows\System\rEHSgvU.exe
  C:\Windows\System\rEHSgvU.exe
  2⤵
  PID:11788
- C:\Windows\System\XkXUwpV.exe
  C:\Windows\System\XkXUwpV.exe
  2⤵
  PID:11812
- C:\Windows\System\aExnBdx.exe
  C:\Windows\System\aExnBdx.exe
  2⤵
  PID:11840
- C:\Windows\System\ZAQiwnV.exe
  C:\Windows\System\ZAQiwnV.exe
  2⤵
  PID:11856
- C:\Windows\System\WPlcSPr.exe
  C:\Windows\System\WPlcSPr.exe
  2⤵
  PID:11884
- C:\Windows\System\ydGomSN.exe
  C:\Windows\System\ydGomSN.exe
  2⤵
  PID:11900
- C:\Windows\System\fxGuvsq.exe
  C:\Windows\System\fxGuvsq.exe
  2⤵
  PID:11936
- C:\Windows\System\mHiYehS.exe
  C:\Windows\System\mHiYehS.exe
  2⤵
  PID:11976
- C:\Windows\System\dXBLdhW.exe
  C:\Windows\System\dXBLdhW.exe
  2⤵
  PID:12008
- C:\Windows\System\YUUEdaX.exe
  C:\Windows\System\YUUEdaX.exe
  2⤵
  PID:12036
- C:\Windows\System\SWQfGFF.exe
  C:\Windows\System\SWQfGFF.exe
  2⤵
  PID:12064
- C:\Windows\System\oXzyVjt.exe
  C:\Windows\System\oXzyVjt.exe
  2⤵
  PID:12080
- C:\Windows\System\yfeqfee.exe
  C:\Windows\System\yfeqfee.exe
  2⤵
  PID:12120
- C:\Windows\System\fSlAbYF.exe
  C:\Windows\System\fSlAbYF.exe
  2⤵
  PID:12160
- C:\Windows\System\hFnmEYM.exe
  C:\Windows\System\hFnmEYM.exe
  2⤵
  PID:12188
- C:\Windows\System\GVhOFXS.exe
  C:\Windows\System\GVhOFXS.exe
  2⤵
  PID:12216
- C:\Windows\System\OXeVqXw.exe
  C:\Windows\System\OXeVqXw.exe
  2⤵
  PID:12236
- C:\Windows\System\LdspjnT.exe
  C:\Windows\System\LdspjnT.exe
  2⤵
  PID:12276
- C:\Windows\System\xMFoZLK.exe
  C:\Windows\System\xMFoZLK.exe
  2⤵
  PID:10660
- C:\Windows\System\mIgVNQQ.exe
  C:\Windows\System\mIgVNQQ.exe
  2⤵
  PID:11304
- C:\Windows\System\MyoAxoH.exe
  C:\Windows\System\MyoAxoH.exe
  2⤵
  PID:11372
- C:\Windows\System\cTUFTcO.exe
  C:\Windows\System\cTUFTcO.exe
  2⤵
  PID:11432
- C:\Windows\System\ZKtAxlv.exe
  C:\Windows\System\ZKtAxlv.exe
  2⤵
  PID:11496
- C:\Windows\System\sIikjpB.exe
  C:\Windows\System\sIikjpB.exe
  2⤵
  PID:11520
- C:\Windows\System\ofyLTmb.exe
  C:\Windows\System\ofyLTmb.exe
  2⤵
  PID:11568
- C:\Windows\System\jiBsFqb.exe
  C:\Windows\System\jiBsFqb.exe
  2⤵
  PID:11640
- C:\Windows\System\gibVBdJ.exe
  C:\Windows\System\gibVBdJ.exe
  2⤵
  PID:11772
- C:\Windows\System\hBkKHSl.exe
  C:\Windows\System\hBkKHSl.exe
  2⤵
  PID:11800
- C:\Windows\System\sisRzXu.exe
  C:\Windows\System\sisRzXu.exe
  2⤵
  PID:11868
- C:\Windows\System\cfotjbq.exe
  C:\Windows\System\cfotjbq.exe
  2⤵
  PID:11960
- C:\Windows\System\CbMirXG.exe
  C:\Windows\System\CbMirXG.exe
  2⤵
  PID:12028
- C:\Windows\System\ZwRgicR.exe
  C:\Windows\System\ZwRgicR.exe
  2⤵
  PID:12104
- C:\Windows\System\OPJyMFk.exe
  C:\Windows\System\OPJyMFk.exe
  2⤵
  PID:12108
- C:\Windows\System\uLqUbHY.exe
  C:\Windows\System\uLqUbHY.exe
  2⤵
  PID:12180
- C:\Windows\System\rHUetzQ.exe
  C:\Windows\System\rHUetzQ.exe
  2⤵
  PID:12256
- C:\Windows\System\sDVGdez.exe
  C:\Windows\System\sDVGdez.exe
  2⤵
  PID:10976
- C:\Windows\System\NLnvXwC.exe
  C:\Windows\System\NLnvXwC.exe
  2⤵
  PID:11292
- C:\Windows\System\MSvGTGJ.exe
  C:\Windows\System\MSvGTGJ.exe
  2⤵
  PID:11444
- C:\Windows\System\yPzicge.exe
  C:\Windows\System\yPzicge.exe
  2⤵
  PID:11544
- C:\Windows\System\gSbINHL.exe
  C:\Windows\System\gSbINHL.exe
  2⤵
  PID:11596
- C:\Windows\System\tWtKJhD.exe
  C:\Windows\System\tWtKJhD.exe
  2⤵
  PID:11672
- C:\Windows\System\oklGtYp.exe
  C:\Windows\System\oklGtYp.exe
  2⤵
  PID:11828
- C:\Windows\System\aHYTrCI.exe
  C:\Windows\System\aHYTrCI.exe
  2⤵
  PID:12100
- C:\Windows\System\uxspzsL.exe
  C:\Windows\System\uxspzsL.exe
  2⤵
  PID:12224
- C:\Windows\System\SxLdgNq.exe
  C:\Windows\System\SxLdgNq.exe
  2⤵
  PID:12300
- C:\Windows\System\MKfGtEw.exe
  C:\Windows\System\MKfGtEw.exe
  2⤵
  PID:12356
- C:\Windows\System\BgmUXsY.exe
  C:\Windows\System\BgmUXsY.exe
  2⤵
  PID:12384
- C:\Windows\System\tdBwnTd.exe
  C:\Windows\System\tdBwnTd.exe
  2⤵
  PID:12408
- C:\Windows\System\YQdTtzy.exe
  C:\Windows\System\YQdTtzy.exe
  2⤵
  PID:12444
- C:\Windows\System\dAaFJUq.exe
  C:\Windows\System\dAaFJUq.exe
  2⤵
  PID:12476
- C:\Windows\System\YiFSgIX.exe
  C:\Windows\System\YiFSgIX.exe
  2⤵
  PID:12508
- C:\Windows\System\OkxHnPB.exe
  C:\Windows\System\OkxHnPB.exe
  2⤵
  PID:12536
- C:\Windows\System\ePYaFYH.exe
  C:\Windows\System\ePYaFYH.exe
  2⤵
  PID:12552
- C:\Windows\System\iIXRZzh.exe
  C:\Windows\System\iIXRZzh.exe
  2⤵
  PID:12576
- C:\Windows\System\TiFzPlF.exe
  C:\Windows\System\TiFzPlF.exe
  2⤵
  PID:12600
- C:\Windows\System\iIlDazJ.exe
  C:\Windows\System\iIlDazJ.exe
  2⤵
  PID:12692
- C:\Windows\System\HOXIdJQ.exe
  C:\Windows\System\HOXIdJQ.exe
  2⤵
  PID:12708
- C:\Windows\System\xqEcosp.exe
  C:\Windows\System\xqEcosp.exe
  2⤵
  PID:12736
- C:\Windows\System\ljzpoah.exe
  C:\Windows\System\ljzpoah.exe
  2⤵
  PID:12752
- C:\Windows\System\LNDkxcp.exe
  C:\Windows\System\LNDkxcp.exe
  2⤵
  PID:12772
- C:\Windows\System\MFQUoez.exe
  C:\Windows\System\MFQUoez.exe
  2⤵
  PID:12804
- C:\Windows\System\HtuWjpX.exe
  C:\Windows\System\HtuWjpX.exe
  2⤵
  PID:12832
- C:\Windows\System\lSueGHb.exe
  C:\Windows\System\lSueGHb.exe
  2⤵
  PID:12864
- C:\Windows\System\ZLsNADA.exe
  C:\Windows\System\ZLsNADA.exe
  2⤵
  PID:12892
- C:\Windows\System\KNLciVB.exe
  C:\Windows\System\KNLciVB.exe
  2⤵
  PID:12916
- C:\Windows\System\eXaHYRj.exe
  C:\Windows\System\eXaHYRj.exe
  2⤵
  PID:12952
- C:\Windows\System\mGqYbgE.exe
  C:\Windows\System\mGqYbgE.exe
  2⤵
  PID:12976
- C:\Windows\System\dtlflek.exe
  C:\Windows\System\dtlflek.exe
  2⤵
  PID:12992
- C:\Windows\System\hnsJoPW.exe
  C:\Windows\System\hnsJoPW.exe
  2⤵
  PID:13024
- C:\Windows\System\uBngcnv.exe
  C:\Windows\System\uBngcnv.exe
  2⤵
  PID:13060
- C:\Windows\System\bKfduiS.exe
  C:\Windows\System\bKfduiS.exe
  2⤵
  PID:13096
- C:\Windows\System\KYQsgbL.exe
  C:\Windows\System\KYQsgbL.exe
  2⤵
  PID:13128
- C:\Windows\System\FElupul.exe
  C:\Windows\System\FElupul.exe
  2⤵
  PID:13156
- C:\Windows\System\EIRyaKG.exe
  C:\Windows\System\EIRyaKG.exe
  2⤵
  PID:13184
- C:\Windows\System\FpookQh.exe
  C:\Windows\System\FpookQh.exe
  2⤵
  PID:13224
- C:\Windows\System\FDXuFkN.exe
  C:\Windows\System\FDXuFkN.exe
  2⤵
  PID:13260
- C:\Windows\System\BLCMZmN.exe
  C:\Windows\System\BLCMZmN.exe
  2⤵
  PID:13292
- C:\Windows\System\MuzMjEO.exe
  C:\Windows\System\MuzMjEO.exe
  2⤵
  PID:12048
- C:\Windows\System\BkcSbcc.exe
  C:\Windows\System\BkcSbcc.exe
  2⤵
  PID:11272
- C:\Windows\System\qgjYfpM.exe
  C:\Windows\System\qgjYfpM.exe
  2⤵
  PID:11404
- C:\Windows\System\hWqMdvQ.exe
  C:\Windows\System\hWqMdvQ.exe
  2⤵
  PID:12348
- C:\Windows\System\GBaXTis.exe
  C:\Windows\System\GBaXTis.exe
  2⤵
  PID:12472
- C:\Windows\System\MAImryc.exe
  C:\Windows\System\MAImryc.exe
  2⤵
  PID:12500
- C:\Windows\System\SKfJTqq.exe
  C:\Windows\System\SKfJTqq.exe
  2⤵
  PID:12560
- C:\Windows\System\xqJvGNR.exe
  C:\Windows\System\xqJvGNR.exe
  2⤵
  PID:12680
- C:\Windows\System\KsnHoQy.exe
  C:\Windows\System\KsnHoQy.exe
  2⤵
  PID:12704
- C:\Windows\System\iAyyuDk.exe
  C:\Windows\System\iAyyuDk.exe
  2⤵
  PID:12784
- C:\Windows\System\DgxiXdb.exe
  C:\Windows\System\DgxiXdb.exe
  2⤵
  PID:12860
- C:\Windows\System\Myaxjja.exe
  C:\Windows\System\Myaxjja.exe
  2⤵
  PID:12928
- C:\Windows\System\RtJAmHJ.exe
  C:\Windows\System\RtJAmHJ.exe
  2⤵
  PID:12984
- C:\Windows\System\YQjagiR.exe
  C:\Windows\System\YQjagiR.exe
  2⤵
  PID:13004
- C:\Windows\System\fDMVonG.exe
  C:\Windows\System\fDMVonG.exe
  2⤵
  PID:13116
- C:\Windows\System\FKMrOAG.exe
  C:\Windows\System\FKMrOAG.exe
  2⤵
  PID:13152
- C:\Windows\System\zWDUIVl.exe
  C:\Windows\System\zWDUIVl.exe
  2⤵
  PID:13300
- C:\Windows\System\fQXfksv.exe
  C:\Windows\System\fQXfksv.exe
  2⤵
  PID:13276
- C:\Windows\System\UkZyGaR.exe
  C:\Windows\System\UkZyGaR.exe
  2⤵
  PID:11872
- C:\Windows\System\bzCHmna.exe
  C:\Windows\System\bzCHmna.exe
  2⤵
  PID:12420
- C:\Windows\System\LpVSeCz.exe
  C:\Windows\System\LpVSeCz.exe
  2⤵
  PID:12584
- C:\Windows\System\zKlJwET.exe
  C:\Windows\System\zKlJwET.exe
  2⤵
  PID:12748
- C:\Windows\System\dPaCNln.exe
  C:\Windows\System\dPaCNln.exe
  2⤵
  PID:12828
- C:\Windows\System\QAbqVlg.exe
  C:\Windows\System\QAbqVlg.exe
  2⤵
  PID:13084
- C:\Windows\System\fWhuhsZ.exe
  C:\Windows\System\fWhuhsZ.exe
  2⤵
  PID:13144
- C:\Windows\System\loOqhPq.exe
  C:\Windows\System\loOqhPq.exe
  2⤵
  PID:11620
- C:\Windows\System\hhNJYzg.exe
  C:\Windows\System\hhNJYzg.exe
  2⤵
  PID:12524
- C:\Windows\System\FIxSzIT.exe
  C:\Windows\System\FIxSzIT.exe
  2⤵
  PID:11996
- C:\Windows\System\fhNdwFH.exe
  C:\Windows\System\fhNdwFH.exe
  2⤵
  PID:12840
- C:\Windows\System\zGSokyO.exe
  C:\Windows\System\zGSokyO.exe
  2⤵
  PID:12196
- C:\Windows\System\XCGxHYv.exe
  C:\Windows\System\XCGxHYv.exe
  2⤵
  PID:13320
- C:\Windows\System\DZHRhdy.exe
  C:\Windows\System\DZHRhdy.exe
  2⤵
  PID:13352
- C:\Windows\System\avpNTLm.exe
  C:\Windows\System\avpNTLm.exe
  2⤵
  PID:13388
- C:\Windows\System\WmzrYjp.exe
  C:\Windows\System\WmzrYjp.exe
  2⤵
  PID:13416
- C:\Windows\System\ZfsvsKx.exe
  C:\Windows\System\ZfsvsKx.exe
  2⤵
  PID:13432
- C:\Windows\System\hDxBIjV.exe
  C:\Windows\System\hDxBIjV.exe
  2⤵
  PID:13452
- C:\Windows\System\SKZmIyR.exe
  C:\Windows\System\SKZmIyR.exe
  2⤵
  PID:13488
- C:\Windows\System\oAIyDNh.exe
  C:\Windows\System\oAIyDNh.exe
  2⤵
  PID:13512
- C:\Windows\System\TIGuwVw.exe
  C:\Windows\System\TIGuwVw.exe
  2⤵
  PID:13532
- C:\Windows\System\TDrqiDE.exe
  C:\Windows\System\TDrqiDE.exe
  2⤵
  PID:13568
- C:\Windows\System\rcPkaIM.exe
  C:\Windows\System\rcPkaIM.exe
  2⤵
  PID:13600
- C:\Windows\System\TccJkpd.exe
  C:\Windows\System\TccJkpd.exe
  2⤵
  PID:13628
- C:\Windows\System\NCnHbef.exe
  C:\Windows\System\NCnHbef.exe
  2⤵
  PID:13648
- C:\Windows\System\nqadLFG.exe
  C:\Windows\System\nqadLFG.exe
  2⤵
  PID:13680
- C:\Windows\System\gaPVGni.exe
  C:\Windows\System\gaPVGni.exe
  2⤵
  PID:13712
- C:\Windows\System\gxAaiUX.exe
  C:\Windows\System\gxAaiUX.exe
  2⤵
  PID:13728
- C:\Windows\System\hjyweLF.exe
  C:\Windows\System\hjyweLF.exe
  2⤵
  PID:13756
- C:\Windows\System\GHJBWaR.exe
  C:\Windows\System\GHJBWaR.exe
  2⤵
  PID:13792
- C:\Windows\System\mSMWXyq.exe
  C:\Windows\System\mSMWXyq.exe
  2⤵
  PID:13812
- C:\Windows\System\oaphWXq.exe
  C:\Windows\System\oaphWXq.exe
  2⤵
  PID:13852
- C:\Windows\System\aecDEZy.exe
  C:\Windows\System\aecDEZy.exe
  2⤵
  PID:13872
- C:\Windows\System\idVdUEZ.exe
  C:\Windows\System\idVdUEZ.exe
  2⤵
  PID:13908
- C:\Windows\System\ooxJBov.exe
  C:\Windows\System\ooxJBov.exe
  2⤵
  PID:13944
- C:\Windows\System\fnZKdQX.exe
  C:\Windows\System\fnZKdQX.exe
  2⤵
  PID:13972
- C:\Windows\System\QsKrwdu.exe
  C:\Windows\System\QsKrwdu.exe
  2⤵
  PID:13996
- C:\Windows\System\zYWRvGX.exe
  C:\Windows\System\zYWRvGX.exe
  2⤵
  PID:14024
- C:\Windows\System\rAfkSle.exe
  C:\Windows\System\rAfkSle.exe
  2⤵
  PID:14064
- C:\Windows\System\rTIJDTx.exe
  C:\Windows\System\rTIJDTx.exe
  2⤵
  PID:14092
- C:\Windows\System\JECQWNx.exe
  C:\Windows\System\JECQWNx.exe
  2⤵
  PID:14108
- C:\Windows\System\uHxsBgF.exe
  C:\Windows\System\uHxsBgF.exe
  2⤵
  PID:14136
- C:\Windows\System\rRTLdYr.exe
  C:\Windows\System\rRTLdYr.exe
  2⤵
  PID:14164
- C:\Windows\System\ZwWgRdW.exe
  C:\Windows\System\ZwWgRdW.exe
  2⤵
  PID:14180
- C:\Windows\System\pVovqVt.exe
  C:\Windows\System\pVovqVt.exe
  2⤵
  PID:14220
- C:\Windows\System\fOuIglm.exe
  C:\Windows\System\fOuIglm.exe
  2⤵
  PID:14256
- C:\Windows\System\XZYteBk.exe
  C:\Windows\System\XZYteBk.exe
  2⤵
  PID:14288
- C:\Windows\System\DEvkHGe.exe
  C:\Windows\System\DEvkHGe.exe
  2⤵
  PID:14304
- C:\Windows\System\kKTHcpr.exe
  C:\Windows\System\kKTHcpr.exe
  2⤵
  PID:14332
- C:\Windows\System\xZInfnR.exe
  C:\Windows\System\xZInfnR.exe
  2⤵
  PID:13384
- C:\Windows\System\UWJeJsw.exe
  C:\Windows\System\UWJeJsw.exe
  2⤵
  PID:13428
- C:\Windows\System\MynPVyq.exe
  C:\Windows\System\MynPVyq.exe
  2⤵
  PID:13500
- C:\Windows\System\wFwrCkr.exe
  C:\Windows\System\wFwrCkr.exe
  2⤵
  PID:13548
- C:\Windows\System\XWWJhil.exe
  C:\Windows\System\XWWJhil.exe
  2⤵
  PID:13620
- C:\Windows\System\KEQGhCH.exe
  C:\Windows\System\KEQGhCH.exe
  2⤵
  PID:2308
- C:\Windows\System\XfYSpbk.exe
  C:\Windows\System\XfYSpbk.exe
  2⤵
  PID:13676
- C:\Windows\System\vYnkSyG.exe
  C:\Windows\System\vYnkSyG.exe
  2⤵
  PID:13744
- C:\Windows\System\hfEfmOt.exe
  C:\Windows\System\hfEfmOt.exe
  2⤵
  PID:13808
- C:\Windows\System\gBNzUgN.exe
  C:\Windows\System\gBNzUgN.exe
  2⤵
  PID:13892
- C:\Windows\System\BeqUWUa.exe
  C:\Windows\System\BeqUWUa.exe
  2⤵
  PID:12768
- C:\Windows\System\FmBmmQC.exe
  C:\Windows\System\FmBmmQC.exe
  2⤵
  PID:14012
- C:\Windows\System\pKyboUQ.exe
  C:\Windows\System\pKyboUQ.exe
  2⤵
  PID:14076
- C:\Windows\System\bBhCOFE.exe
  C:\Windows\System\bBhCOFE.exe
  2⤵
  PID:14152
- C:\Windows\System\HKaZXDb.exe
  C:\Windows\System\HKaZXDb.exe
  2⤵
  PID:14204
- C:\Windows\System\YGfgCxe.exe
  C:\Windows\System\YGfgCxe.exe
  2⤵
  PID:14264
- C:\Windows\System\KDlRETZ.exe
  C:\Windows\System\KDlRETZ.exe
  2⤵
  PID:14316
- C:\Windows\System\HwNniFB.exe
  C:\Windows\System\HwNniFB.exe
  2⤵
  PID:13528
- C:\Windows\System\lEEZUay.exe
  C:\Windows\System\lEEZUay.exe
  2⤵
  PID:3940
- C:\Windows\System\xUYZfTO.exe
  C:\Windows\System\xUYZfTO.exe
  2⤵
  PID:13724
- C:\Windows\System\yxZDRSl.exe
  C:\Windows\System\yxZDRSl.exe
  2⤵
  PID:13840
- C:\Windows\System\LNjmyry.exe
  C:\Windows\System\LNjmyry.exe
  2⤵
  PID:14144
- C:\Windows\System\VbFHfSU.exe
  C:\Windows\System\VbFHfSU.exe
  2⤵
  PID:14192
- C:\Windows\System\JGCwUMi.exe
  C:\Windows\System\JGCwUMi.exe
  2⤵
  PID:13616

C:\Windows\system32\WerFaultSecure.exe
C:\Windows\system32\WerFaultSecure.exe -u -p 2160 -s 2204
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BHFfIPa.exe

Filesize
2.1MB

MD5
a32234fab5a2441bb008e4cbd78bc0c6

SHA1
ffd23661cb9a53648320cc49cb8caa337b465ba4

SHA256
e3fc41714b16a893a3e574fcce8dfdead64b526d85efb8490eb086d0a2c0d408

SHA512
8665996eff5ad2149c9cdc49d7dec275c3619964c10b33d1d92f683f59fe8855b770c5906dd7f19e64ec3deeeabb07e0950f95179db21b2ac33324524d92c2f7

Download Submit
C:\Windows\System\DEJqzDD.exe

Filesize
2.1MB

MD5
ad4e5518d53a2e1edea98b854b4b5674

SHA1
93ca083e1eed4618524557518e22507c0c81ba2f

SHA256
a538cc973574786f788b55e96fd91f12353379f2e55f45f642407e19a894be9e

SHA512
3de6647da37a96e5abf92ff88a323888e9fb00ee80684beede973a7cc10de7f469415545f53b61b27d0607f8e3f6de31f5f30ed8d8eb87e44d65d1ae93c4e785

Download Submit
C:\Windows\System\FDFdMbE.exe

Filesize
2.1MB

MD5
bcbec3af61125bfaa8426694e3a67a7e

SHA1
4ffbd465ce4c1dda9f233b5a2beacb04659f26df

SHA256
559a0731b3055b008c6468a60d9b822587482ef4d08aee06371ba12342d6d16a

SHA512
570aada6fbd6a7b3b9983184e00b6f6cfad989875dce29b0d0ea278e55a75d1b4fa6d4ed1511da9171c7dc61e3bfb43d61632dd4edaa08461b368c832d2872ed

Download Submit
C:\Windows\System\IdfWhNA.exe

Filesize
2.1MB

MD5
8502ab915f820f7055e69424cd851777

SHA1
a01e40d3e0a5a793c1c79b6d161c88e49b21bfae

SHA256
fb3d82443cd7d453a9271db975f3d59285038a1481b9fa7208d86fb220c715e8

SHA512
e03a4ce01fa499eabe5650d3edac4cd2d3271491497fd16ec2e3600eeca968b0b70a85386649b5a517c1569b9e5309a8f3cefaa2c519843b1ef6b0390f61ad5f

Download Submit
C:\Windows\System\InoiTSn.exe

Filesize
2.1MB

MD5
3a233866b5c2741e1ca8bf49f402cec0

SHA1
e0ae913d1b7ff0ca82e3bacec177234f1bb5289a

SHA256
fc57091106c5ebdb7e32d4203cd28318c4ce0a7ecf67546c9dd2ffaab7965528

SHA512
793aa812c32048952fda13333b4df5e3f1e4c3507c994842bef6309f169c7850fcac46d06892a14fa821878529abc1bd3ba6b8a18ef18f8315e1033d54b50eb5

Download Submit
C:\Windows\System\JegLiCg.exe

Filesize
2.1MB

MD5
62de67d0203fb1a1f768947aa8da52b5

SHA1
8ac2593f095a8ef25b4fceb63ea6554a30b26206

SHA256
8828474be2d36e8846484709b822d9920c85f79cace5006eae733b423ba4e22f

SHA512
8c9f85fa170f895b09d60e67e69863ed7aabea111e4ab29f44c3aaed45c2e49a19bb4face62af4fa229affecf638ca2839fc60e4d714ae4fee9798c61ab95639

Download Submit
C:\Windows\System\NWDaCTX.exe

Filesize
2.1MB

MD5
40980586761b2ed451df412b7785173d

SHA1
4d8fb0c965a7d47eb48820ee84147ac860d5a199

SHA256
26d25b6013f0bf28042befc1374f5c41d7484e2c0d9c25dd4e35e7cc00e6e83f

SHA512
d61007bb9758352e05ceee536351c96331008cff14da08711287aedeea83de652d24ea1035e3a45f9542b9bfc852a94455c641728961de12685dbd64eb53533d

Download Submit
C:\Windows\System\OGFviCu.exe

Filesize
2.1MB

MD5
41a59eb43e0cdb2a239ef98f8d96edc6

SHA1
36b137471584112fe33da01c92adad10583d5ce5

SHA256
d869a3d0890b5ecb1879013642ce8f619e4ace93ec37a5ea313057daa19ff70d

SHA512
78bafed8eae943308bf4172d1cab139fe2b537388739836cb9d63b0f4867e0d9e15d7fd62e55e011d9c12b05d8b5b4fe4dd674554067e1b4fcdaaf9816208e36

Download Submit
C:\Windows\System\QUULfEC.exe

Filesize
2.1MB

MD5
09a1260741f1f61eec3b9f927b4b9ef2

SHA1
d77da640e6d26f070ffb73f67080403daeafcfec

SHA256
758531b6ab749df0c60bdfa10afca38a8da9beeb079ef805ace20b97fab4baca

SHA512
847104f957ac23a32bdca0a16ca0718c3ca88a62c3969a93fa45427a02eb16b38423ab828153e5140973b04e5be497cf89e301879eaee007aa0260d6c076d619

Download Submit
C:\Windows\System\TEOeGwr.exe

Filesize
2.1MB

MD5
762ba1328cc6773f3deba00e4f39b298

SHA1
27adf5bf21c3db14a4d47df21717e7244721ebd4

SHA256
cd3e22912118bde13d973aa4cac8d64a859494c2d68d5ac84ec5af4cfdcfbe95

SHA512
35a2fc20a78f2a0b197ba17626cf03d7d396c54d50274ce350cf641bbd38c1c91544de3f4e69d74465a49dc30a357a70e9e2c72d6329ead7c4bbe242623b1a48

Download Submit
C:\Windows\System\VzXuPQj.exe

Filesize
2.1MB

MD5
e33d35f36b444491cb396d0c8f669304

SHA1
a15e62a4e5f06c4ea1434733595d967b1a5a1613

SHA256
f2661b2950c30b93e709b7c995ab804cfa0f94fd7b67cfcc1ae271be705098d7

SHA512
2fcc8caa233357fa664cce0c1b9a41651ac823a74971ad6ee23b65b4723b3824dbe3e767bbb417175d7109a358fb06ae627cb2e5699c5549004731201f28ef09

Download Submit
C:\Windows\System\WqysfLF.exe

Filesize
2.1MB

MD5
2e989dc10080fa2fc55657f24811f9de

SHA1
d10ecabbba8aa59301cdbf718175e718c755c77e

SHA256
628a0d6e2a07fb4cc43fb2bc0d87007bc0ed38c475f86b4346e1e499be2634f8

SHA512
5d76c03cf753e157064bbb2a923e14fda4b59850c6809efe8886427a0e473a9bac083a9904e212afda66e4e67a4a6c8ae3ed596d586660df858afdff42917c5a

Download Submit
C:\Windows\System\XWtOqlM.exe

Filesize
2.1MB

MD5
88870d9f388f997d07dcecce53af5ca7

SHA1
14c92af6d25b94d3e6118771b78320ca4770e623

SHA256
9cf4d0e42a3b212824326ed39fad43cee483ce8bd2617ef3c344f263b4118384

SHA512
f63ec3bac5d58b83ce9ccee5ee100c483f952bb005afa87c056ddd0395beecd1cdd4919eda7957d87765ff49cba22743bc38e338c1ee8af5f9b38fe84d593c87

Download Submit
C:\Windows\System\XgELRHr.exe

Filesize
2.1MB

MD5
33843b3e17e0a920c0da3c0f76c98c82

SHA1
43d5b7f166c17808964e77d57b385c99df40c49b

SHA256
9b799de5853f26caf368c56da1d814f957f194d455ef95a90ac3d3786966b492

SHA512
ddb0794a0d877106d09e891cb138583ce41082782e74e2782a0997dfd8f2d64a75fd80cf3fe7b1db651aeb026543a1064967aeda613e69d60c5cb5b766590f2c

Download Submit
C:\Windows\System\YpPwKhJ.exe

Filesize
2.1MB

MD5
9a1691513b2132519273cd53dd7b0be6

SHA1
aa2d1ae7ec4188842fa6b7fc284847006f1b62ec

SHA256
5c956ce8717868051a963b270690db653d5159c2b9e430f78fa43ae7bd6d2ede

SHA512
c6296be6d7c31d52096d5a758ec719ebae5d6fb3a94664b0a3b9a44bff30f2f9764d9ebbd83f61e57022dec12d17f6bfc86970bd97b06f516ce4942c5a4f74fa

Download Submit
C:\Windows\System\YvmYjjX.exe

Filesize
2.1MB

MD5
fbafdbc7a4ed765a77b41fa1fc6ffa03

SHA1
bcb568c778cd12d4ca325a827d6659c6f692cc47

SHA256
5c6f11448d636eddbec5829f4a3f17db353b59f8e71d8cd17e88158773c1d163

SHA512
637e912c81d13bfa1d124d965cc7a69503f1a1af18e193ba6869825d0e09799c8f38368263218f53b02bcab1e2ac07475ff085f6537375e186ce4617221a2ec9

Download Submit
C:\Windows\System\ZnLxPFT.exe

Filesize
2.1MB

MD5
f19b8141adb4036650aa3e419dd1e99a

SHA1
d41683ef5f02db129c3bd896860d18d6d454e589

SHA256
0c71f3b7e1f9c43219785669bf7b612516951dc7909d769ad1117dfad9091a88

SHA512
f4505703d1e6360c8fd8ae26f4b5e01e7cf00783f39507dabb3ed08b115b020987cd1cbd953e127150f86cbf1147b02d0709e562a44e5c3ce233793b6c481816

Download Submit
C:\Windows\System\amunQpH.exe

Filesize
2.1MB

MD5
75410e938044e0b4d33e100ef973ddd5

SHA1
ada9f707ccd4721de51664724a228de71eddeb66

SHA256
f8e6c1f9076855a48577888b41e68c035d420faf4f188aa160488abc06367268

SHA512
f85b8549fb151a9b2808568544bf4deabd98dc67720e6c5434db3a06b6957b09f55d041994780a7251c578a265ae46ea44f97f4a671f60d569917671b0e83e5c

Download Submit
C:\Windows\System\bRhUuBq.exe

Filesize
2.1MB

MD5
eb3e23e65f68de98de957ee2ae5c4772

SHA1
8822bec293cc2ec863c3973971c74a7ff53158b4

SHA256
9ffb9452f996740ff5673bcf6e3d53154f50f4d136bc278442350005d7dc47c7

SHA512
63571a51a8872ec23b2c22a3dc5d0f5dcc266724941ec3738281d933625a7b8d1feef5a42099025dbc36364577f3151ff4e4cfd6e8356675f4ade31542636919

Download Submit
C:\Windows\System\dSIScHz.exe

Filesize
2.1MB

MD5
6aaa4f0fa83d2a12645eb954c832db91

SHA1
6da5b7203ea2ba5b3f2b195192d06e4c1bba31cd

SHA256
5d7fb3230b28e6b1384bfd090989598e5300924e511607eab26e14cf20c8b523

SHA512
77052c9bb4bc2882ddef6db0a15aafa33522ed889126c972a2ab456065bf08d31636d7342b42588c1fd167c2d9cd7f32a715e7eade6c582fba9df8a6c9c1f1d9

Download Submit
C:\Windows\System\doggvMv.exe

Filesize
2.1MB

MD5
9b039fb4f9fd9c97ea0c3de08233f0da

SHA1
32907972bdc515a691dc6175f3419a37bd35ecd6

SHA256
81a054126890cc2ba6a470375f9863e02aa60e870658c839f18924fd3290dd90

SHA512
e66ace534cb6df157b2f278ec99eed2c8ce0e890e53638d899e90f4c8ae7750a7d1a87f9495aade6b5a8d2031ad86b93d7440b86e02a8d4828125509a07d727f

Download Submit
C:\Windows\System\eoBKfwc.exe

Filesize
2.1MB

MD5
17d0bb616ac2daac475a36fadbb4cc03

SHA1
21a13fde1c352636aab147507b1ed33fcec19c41

SHA256
07f200c748f188f952e53c25547e7028ab11d0c03e368f7b187ddbeee21880f2

SHA512
8dc8e39ee1506754f85260792534112470fec1a1a7d2866accaafdcd0fea46fb12274c884980f95ad6e2eea9a046a89aba0fcf7cb845c8d21c9bb206f06ae564

Download Submit
C:\Windows\System\fxcrCJQ.exe

Filesize
2.1MB

MD5
415ef40105deaf7247dc617eff18b181

SHA1
e8a2464cfdc6afefafd39d5810a4976811f0ef9e

SHA256
5c666056960e1c8c254b185b1d8c005b8d45c04644e00c4abb9ff10cd66b76ac

SHA512
8eaf99ca9f4ac875196da7a1b1750c3eb7c635a45238783e45b38dec10e38f20b8c00b61907386c348a210ce91a9b683aa2bce07a85e9412c2781202e6046a42

Download Submit
C:\Windows\System\hKnFNjQ.exe

Filesize
2.1MB

MD5
f797412ca6af53cd8083b48fee8e23da

SHA1
9504b7c44c15fdee15cac93f230af96516488c01

SHA256
e0f9c1691a50848dd474c491946f112ff27bc8896c0fd91f423fb2b544f83f5e

SHA512
07f23e21bb263f4adc483029a6ebfeb174a8d63fc353e5c72fe4da4b852feb6f9b09d4f2cf2b0a5dee455d7c4b8f90ca550857810f9e2ea11c478eeab696cc30

Download Submit
C:\Windows\System\imBIQQx.exe

Filesize
2.1MB

MD5
fb3b037c8a0de2bb9cb5e58aa88dede2

SHA1
5af5dcf2324dd49f4286e049887b7883b662cba7

SHA256
8b04177abb522918030c77d622c8b5f94cee638f5e871d5081e7f9c8dbba749e

SHA512
7e0cd316a8979031e5d76d56b9b27ec9192351d3f2ed21e747f4d9cf3d0a793a63a0bad869d7e02a33d6502837beaa14ded497e85786bbeb0ac909e660e0bf3d

Download Submit
C:\Windows\System\kRbQRVs.exe

Filesize
2.1MB

MD5
06d562159e07e9ad46b67c8354710350

SHA1
14ea4c40ceb4d6bfcc7425adfa8d168616de7ee2

SHA256
69f1df79bdd1be99e4a0f98aa695050ed29c62d3a192928596ed8adea0c01e4e

SHA512
3aea974a17782d797987c370ab1762d883d310c597c6e6cdd2dd3970eeec96685d954186d81ff22ba8b218c8d5c7e815b3037e349454dae19c531c8787b91641

Download Submit
C:\Windows\System\lDspCur.exe

Filesize
2.1MB

MD5
ba59a48c212110a1f8cf903a657eeaec

SHA1
c3ece4832bb6d35346a08c25dc5b1f9a2d055dc8

SHA256
d8a84502a17c5ff6135fe30a6e429bdde5b043b811dde9940cc73054ba5b4e05

SHA512
5d2ea68e8a0a4e828901416bdd67be7329d45ad99d636e14dc463a807b95439c9ccf1c7383bde83962b3acf0f3f2db1d788bbfdd94391095aa73d70809b60006

Download Submit
C:\Windows\System\mJXFhrf.exe

Filesize
2.1MB

MD5
ba7b8dc5582bc3aff9444eed588a2702

SHA1
12b75565ade0d479fba6f6b90dcf1d7a224442d3

SHA256
71be1626bae9c3998afeae20988b3d205e5e5b81b0dba9cd5301a061840992e7

SHA512
2faf4378e60b379561942a580008cd728c50c64e96419fcf8be9d0afaa492ccc12f4b3cc930cd7a8baa1e64fa9212274742898bc77d7ed7b89f0a033f7875b9a

Download Submit
C:\Windows\System\sgxopbb.exe

Filesize
2.1MB

MD5
af48582b83541f4851252b5a532484c8

SHA1
02dd16e4c399dddf0430f61dd65e5344a8a13427

SHA256
d03c041aba5e057b5c567a6b387140ab01ae68875fd74aab199d688e633c1202

SHA512
9de46e8fdb7ab82670ba5b6dc0872284e37fcc06fa1a2f81c32511b1ea75ebe9166482ec1df0e18e06227d8f609d341769fae517e1319e563b9b8a3a6efbf6e5

Download Submit
C:\Windows\System\shZRfkl.exe

Filesize
2.1MB

MD5
5ea059f1cc0489c88adfc5b34fea76b6

SHA1
1ce03804faf73eca47093f21bacaef73ab1753f4

SHA256
c6ebe41d04e2cfd27f5b749b06e6f9d74ea8d84a91a49a373bb421cbcf753f92

SHA512
3deabb379dfc97f01ac90b1f46fdf77b721c52b50a8d55ddaddb1614947dc791a2a7ce7521600b1050ca928dd790d35ae914a65f48f90ae1fe9ebcf7a1c96bdc

Download Submit
C:\Windows\System\tNTbLmg.exe

Filesize
2.1MB

MD5
c3ac58e471b9ec31561592840badeda4

SHA1
4ffef42bfc83c2c22bed6fbde38649cb43380a3d

SHA256
8c1a6f86b6950c3696c028e665d72a451e17eaa7d22a2450a493969f203a9a7a

SHA512
96631dea2f5108d7cc17b7afd9539fc4f0137e8abbf44d1ce9744f289b22d7ad746494b498f12efd65b073715b29fad242c33d9e1dd306e307e2e41dd1a1713a

Download Submit
C:\Windows\System\uAYKRKq.exe

Filesize
2.1MB

MD5
2653affc8a3c8a4cbef22a85a086d955

SHA1
4ab243e1aba5d32c32b1e8e7ef766cbdf91ecafb

SHA256
f2aea6801038615f2db3f875559053731760d85801036b58f3e30b5392651e30

SHA512
5097d2e185c4f595855dfbf70954e243838774c18b98ca9f564101b08c3a9f2d137446b9523b653950eb7ea40135f68376fb1816b837a26a7c42398c9af195b9

Download Submit
C:\Windows\System\wGajJvM.exe

Filesize
2.1MB

MD5
363b847c617b1874036ae35a4ce5c78f

SHA1
eb30d67975cd10f283b0a70c53cf2dd10b6c2b6d

SHA256
e32f69baf4abd7e484e88a76f2899cdf704730e2e7149692634178b24de4b061

SHA512
0cb967374dc3afdbbc0b101ad843dccd0b8ddd8f241b0d8d77cd7b6da30db81917976ea8420e82ca1a056e70d894cc7bb51c0e208ab809bdacde30e0f5df1fca

Download Submit
C:\Windows\System\xpbwKoM.exe

Filesize
2.1MB

MD5
4e400743566781dcfef882a4fabdcfa6

SHA1
45997df6207f99ba568f9969195efb3721694e10

SHA256
0621e1a54db39f73dfd6d7de0282afbe98882233c474e979d9af83458c85161b

SHA512
69d1ed548987256dbd974db17b1d8bdd2452553f10a75af6347f78bdd81fc18fb40482f36b7ac780e53d2cf1a5c2a36222a35d8af7fc080e93b77e5bd207f271

Download Submit
C:\Windows\System\xxEeAsm.exe

Filesize
2.1MB

MD5
8d88b4566c5bca195f90b2ab538ce2ad

SHA1
feb7939b5be75b2a6010d111efc3553a6cd9f9e9

SHA256
62a378999b7061ef33ad901abc06bdef39b4dbd03e295b6e78389273aa261e41

SHA512
b0c59b967b39597841eeb746560cc4dfcbeb1893d54e563cfba1bdd58ba8e418b20d4241b8cc1a494771e93ce783a5516e4b72ffe996c6ded70d4c2f31f8e633

Download Submit
memory/396-144-0x00007FF6DA610000-0x00007FF6DA964000-memory.dmp

Filesize
3.3MB

Download
memory/396-2175-0x00007FF6DA610000-0x00007FF6DA964000-memory.dmp

Filesize
3.3MB

Download
memory/1300-146-0x00007FF7B88B0000-0x00007FF7B8C04000-memory.dmp

Filesize
3.3MB

Download
memory/1300-2185-0x00007FF7B88B0000-0x00007FF7B8C04000-memory.dmp

Filesize
3.3MB

Download
memory/1308-150-0x00007FF7890F0000-0x00007FF789444000-memory.dmp

Filesize
3.3MB

Download
memory/1308-2180-0x00007FF7890F0000-0x00007FF789444000-memory.dmp

Filesize
3.3MB

Download
memory/1320-0-0x00007FF688550000-0x00007FF6888A4000-memory.dmp

Filesize
3.3MB

Download
memory/1320-1659-0x00007FF688550000-0x00007FF6888A4000-memory.dmp

Filesize
3.3MB

Download
memory/1320-1-0x0000026C9BEC0000-0x0000026C9BED0000-memory.dmp

Filesize
64KB

Download
memory/1644-149-0x00007FF6F67C0000-0x00007FF6F6B14000-memory.dmp

Filesize
3.3MB

Download
memory/1644-2179-0x00007FF6F67C0000-0x00007FF6F6B14000-memory.dmp

Filesize
3.3MB

Download
memory/1848-30-0x00007FF7E6B90000-0x00007FF7E6EE4000-memory.dmp

Filesize
3.3MB

Download
memory/1848-2152-0x00007FF7E6B90000-0x00007FF7E6EE4000-memory.dmp

Filesize
3.3MB

Download
memory/1848-2168-0x00007FF7E6B90000-0x00007FF7E6EE4000-memory.dmp

Filesize
3.3MB

Download
memory/2008-2172-0x00007FF6FBA60000-0x00007FF6FBDB4000-memory.dmp

Filesize
3.3MB

Download
memory/2008-34-0x00007FF6FBA60000-0x00007FF6FBDB4000-memory.dmp

Filesize
3.3MB

Download
memory/2172-153-0x00007FF7CCCA0000-0x00007FF7CCFF4000-memory.dmp

Filesize
3.3MB

Download
memory/2172-2170-0x00007FF7CCCA0000-0x00007FF7CCFF4000-memory.dmp

Filesize
3.3MB

Download
memory/2328-2192-0x00007FF625CA0000-0x00007FF625FF4000-memory.dmp

Filesize
3.3MB

Download
memory/2328-172-0x00007FF625CA0000-0x00007FF625FF4000-memory.dmp

Filesize
3.3MB

Download
memory/2352-148-0x00007FF608D00000-0x00007FF609054000-memory.dmp

Filesize
3.3MB

Download
memory/2352-2178-0x00007FF608D00000-0x00007FF609054000-memory.dmp

Filesize
3.3MB

Download
memory/2724-76-0x00007FF67E6F0000-0x00007FF67EA44000-memory.dmp

Filesize
3.3MB

Download
memory/2724-2154-0x00007FF67E6F0000-0x00007FF67EA44000-memory.dmp

Filesize
3.3MB

Download
memory/2724-2174-0x00007FF67E6F0000-0x00007FF67EA44000-memory.dmp

Filesize
3.3MB

Download
memory/3052-108-0x00007FF65A520000-0x00007FF65A874000-memory.dmp

Filesize
3.3MB

Download
memory/3052-2187-0x00007FF65A520000-0x00007FF65A874000-memory.dmp

Filesize
3.3MB

Download
memory/3092-157-0x00007FF7BB6E0000-0x00007FF7BBA34000-memory.dmp

Filesize
3.3MB

Download
memory/3092-2184-0x00007FF7BB6E0000-0x00007FF7BBA34000-memory.dmp

Filesize
3.3MB

Download
memory/3208-2182-0x00007FF751820000-0x00007FF751B74000-memory.dmp

Filesize
3.3MB

Download
memory/3208-2155-0x00007FF751820000-0x00007FF751B74000-memory.dmp

Filesize
3.3MB

Download
memory/3208-83-0x00007FF751820000-0x00007FF751B74000-memory.dmp

Filesize
3.3MB

Download
memory/3388-155-0x00007FF77BE60000-0x00007FF77C1B4000-memory.dmp

Filesize
3.3MB

Download
memory/3388-2186-0x00007FF77BE60000-0x00007FF77C1B4000-memory.dmp

Filesize
3.3MB

Download
memory/3392-2153-0x00007FF709CA0000-0x00007FF709FF4000-memory.dmp

Filesize
3.3MB

Download
memory/3392-58-0x00007FF709CA0000-0x00007FF709FF4000-memory.dmp

Filesize
3.3MB

Download
memory/3392-2171-0x00007FF709CA0000-0x00007FF709FF4000-memory.dmp

Filesize
3.3MB

Download
memory/3652-2176-0x00007FF703270000-0x00007FF7035C4000-memory.dmp

Filesize
3.3MB

Download
memory/3652-156-0x00007FF703270000-0x00007FF7035C4000-memory.dmp

Filesize
3.3MB

Download
memory/4148-154-0x00007FF701A60000-0x00007FF701DB4000-memory.dmp

Filesize
3.3MB

Download
memory/4148-2173-0x00007FF701A60000-0x00007FF701DB4000-memory.dmp

Filesize
3.3MB

Download
memory/4324-158-0x00007FF69CE20000-0x00007FF69D174000-memory.dmp

Filesize
3.3MB

Download
memory/4324-2189-0x00007FF69CE20000-0x00007FF69D174000-memory.dmp

Filesize
3.3MB

Download
memory/4348-2193-0x00007FF6F4100000-0x00007FF6F4454000-memory.dmp

Filesize
3.3MB

Download
memory/4348-179-0x00007FF6F4100000-0x00007FF6F4454000-memory.dmp

Filesize
3.3MB

Download
memory/4368-2177-0x00007FF7C1670000-0x00007FF7C19C4000-memory.dmp

Filesize
3.3MB

Download
memory/4368-145-0x00007FF7C1670000-0x00007FF7C19C4000-memory.dmp

Filesize
3.3MB

Download
memory/4400-1662-0x00007FF6852F0000-0x00007FF685644000-memory.dmp

Filesize
3.3MB

Download
memory/4400-13-0x00007FF6852F0000-0x00007FF685644000-memory.dmp

Filesize
3.3MB

Download
memory/4400-2166-0x00007FF6852F0000-0x00007FF685644000-memory.dmp

Filesize
3.3MB

Download
memory/4436-152-0x00007FF73BCA0000-0x00007FF73BFF4000-memory.dmp

Filesize
3.3MB

Download
memory/4436-2169-0x00007FF73BCA0000-0x00007FF73BFF4000-memory.dmp

Filesize
3.3MB

Download
memory/4456-2188-0x00007FF6928B0000-0x00007FF692C04000-memory.dmp

Filesize
3.3MB

Download
memory/4456-131-0x00007FF6928B0000-0x00007FF692C04000-memory.dmp

Filesize
3.3MB

Download
memory/4556-151-0x00007FF68F1A0000-0x00007FF68F4F4000-memory.dmp

Filesize
3.3MB

Download
memory/4556-2181-0x00007FF68F1A0000-0x00007FF68F4F4000-memory.dmp

Filesize
3.3MB

Download
memory/4580-2156-0x00007FF71F0C0000-0x00007FF71F414000-memory.dmp

Filesize
3.3MB

Download
memory/4580-189-0x00007FF71F0C0000-0x00007FF71F414000-memory.dmp

Filesize
3.3MB

Download
memory/4580-2194-0x00007FF71F0C0000-0x00007FF71F414000-memory.dmp

Filesize
3.3MB

Download
memory/4768-2183-0x00007FF65D7A0000-0x00007FF65DAF4000-memory.dmp

Filesize
3.3MB

Download
memory/4768-124-0x00007FF65D7A0000-0x00007FF65DAF4000-memory.dmp

Filesize
3.3MB

Download
memory/4916-2167-0x00007FF7D3EA0000-0x00007FF7D41F4000-memory.dmp

Filesize
3.3MB

Download
memory/4916-15-0x00007FF7D3EA0000-0x00007FF7D41F4000-memory.dmp

Filesize
3.3MB

Download
memory/4920-2191-0x00007FF648F30000-0x00007FF649284000-memory.dmp

Filesize
3.3MB

Download
memory/4920-125-0x00007FF648F30000-0x00007FF649284000-memory.dmp

Filesize
3.3MB

Download
memory/4928-2190-0x00007FF761E70000-0x00007FF7621C4000-memory.dmp

Filesize
3.3MB

Download
memory/4928-147-0x00007FF761E70000-0x00007FF7621C4000-memory.dmp

Filesize
3.3MB

Download