xmrig | 5401b5a7b7e4f05e38c98b6645143467903fac7cb04ba1364ead2e92d4df4dd0

Analysis

max time kernel
136s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
18/05/2024, 08:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
Size 2.6MB
Sample240518-krabqacd77
SHA256 5401b5a7b7e4f05e38c98b6645143467903fac7cb04ba1364ead2e92d4df4dd0
MD5 ba7a2a72c61c660c556c0bc9076f77b0
SHA1 b5ecff7d1728bf3798d2d51554bc903fc6684b46
SHA512 0af0e906d6d20b72ea990cd7bfc6f1b56e37aa41d6b791b5794d4dcfd51b61fda236fa2f0866c85097d40745f6dec5182c8555cbbd1af5f96666284e3bfbbdab
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2J:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/216-0-0x00007FF603BB0000-0x00007FF603FA6000-memory.dmp	xmrig
behavioral2/files/0x0008000000022f51-5.dat	xmrig
behavioral2/memory/664-12-0x00007FF69CB80000-0x00007FF69CF76000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fb-69.dat	xmrig
behavioral2/files/0x00070000000233fa-67.dat	xmrig
behavioral2/files/0x00070000000233ff-84.dat	xmrig
behavioral2/files/0x0007000000023406-111.dat	xmrig
behavioral2/memory/3752-117-0x00007FF755620000-0x00007FF755A16000-memory.dmp	xmrig
behavioral2/memory/876-139-0x00007FF7CB730000-0x00007FF7CBB26000-memory.dmp	xmrig
behavioral2/memory/2324-148-0x00007FF74AA40000-0x00007FF74AE36000-memory.dmp	xmrig
behavioral2/memory/224-151-0x00007FF62A2C0000-0x00007FF62A6B6000-memory.dmp	xmrig
behavioral2/memory/2152-152-0x00007FF6CF240000-0x00007FF6CF636000-memory.dmp	xmrig
behavioral2/memory/4848-187-0x00007FF6553F0000-0x00007FF6557E6000-memory.dmp	xmrig
behavioral2/memory/4632-204-0x00007FF7FB2F0000-0x00007FF7FB6E6000-memory.dmp	xmrig
behavioral2/memory/3720-203-0x00007FF6DB180000-0x00007FF6DB576000-memory.dmp	xmrig
behavioral2/memory/676-201-0x00007FF7B6E40000-0x00007FF7B7236000-memory.dmp	xmrig
behavioral2/files/0x000700000002340d-196.dat	xmrig
behavioral2/files/0x000700000002340c-194.dat	xmrig
behavioral2/files/0x000700000002340b-192.dat	xmrig
behavioral2/files/0x0008000000023408-190.dat	xmrig
behavioral2/files/0x00080000000233ef-188.dat	xmrig
behavioral2/files/0x0007000000023411-186.dat	xmrig
behavioral2/files/0x000700000002340a-184.dat	xmrig
behavioral2/memory/2332-183-0x00007FF6E6B10000-0x00007FF6E6F06000-memory.dmp	xmrig
behavioral2/files/0x0007000000023410-182.dat	xmrig
behavioral2/files/0x000700000002340f-181.dat	xmrig
behavioral2/files/0x000700000002340e-180.dat	xmrig
behavioral2/memory/1820-170-0x00007FF7661F0000-0x00007FF7665E6000-memory.dmp	xmrig
behavioral2/memory/1992-150-0x00007FF600590000-0x00007FF600986000-memory.dmp	xmrig
behavioral2/memory/1412-149-0x00007FF72C9F0000-0x00007FF72CDE6000-memory.dmp	xmrig
behavioral2/files/0x0008000000023409-146.dat	xmrig
behavioral2/files/0x0007000000023407-144.dat	xmrig
behavioral2/memory/4932-143-0x00007FF6D2170000-0x00007FF6D2566000-memory.dmp	xmrig
behavioral2/memory/2400-142-0x00007FF6F95F0000-0x00007FF6F99E6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023400-131.dat	xmrig
behavioral2/files/0x0007000000023405-129.dat	xmrig
behavioral2/files/0x0007000000023404-122.dat	xmrig
behavioral2/files/0x0007000000023402-120.dat	xmrig
behavioral2/files/0x0007000000023403-118.dat	xmrig
behavioral2/files/0x0007000000023401-115.dat	xmrig
behavioral2/memory/4928-112-0x00007FF607E30000-0x00007FF608226000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fc-109.dat	xmrig
behavioral2/files/0x00070000000233fd-105.dat	xmrig
behavioral2/memory/4488-95-0x00007FF7B1370000-0x00007FF7B1766000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fe-82.dat	xmrig
behavioral2/files/0x00070000000233f9-78.dat	xmrig
behavioral2/memory/1532-75-0x00007FF7BB210000-0x00007FF7BB606000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f7-63.dat	xmrig
behavioral2/memory/4380-60-0x00007FF7C7AC0000-0x00007FF7C7EB6000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f8-57.dat	xmrig
behavioral2/files/0x00070000000233f6-52.dat	xmrig
behavioral2/memory/5056-50-0x00007FF7AA3E0000-0x00007FF7AA7D6000-memory.dmp	xmrig
behavioral2/memory/3592-48-0x00007FF738250000-0x00007FF738646000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f5-54.dat	xmrig
behavioral2/memory/744-42-0x00007FF75B180000-0x00007FF75B576000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f3-38.dat	xmrig
behavioral2/files/0x00070000000233f4-31.dat	xmrig
behavioral2/files/0x00070000000233f2-27.dat	xmrig
behavioral2/memory/3584-23-0x00007FF72F540000-0x00007FF72F936000-memory.dmp	xmrig
behavioral2/memory/216-2070-0x00007FF603BB0000-0x00007FF603FA6000-memory.dmp	xmrig
behavioral2/memory/664-2071-0x00007FF69CB80000-0x00007FF69CF76000-memory.dmp	xmrig
behavioral2/memory/744-2073-0x00007FF75B180000-0x00007FF75B576000-memory.dmp	xmrig
behavioral2/memory/3592-2074-0x00007FF738250000-0x00007FF738646000-memory.dmp	xmrig
behavioral2/memory/4380-2075-0x00007FF7C7AC0000-0x00007FF7C7EB6000-memory.dmp	xmrig

Blocklisted process makes network request 7 IoCs

flow	pid	Process
8	4444	powershell.exe
10	4444	powershell.exe
12	4444	powershell.exe
13	4444	powershell.exe
15	4444	powershell.exe
19	4444	powershell.exe
20	4444	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4444	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
664	UfPuNZI.exe
3584	jJnqQRk.exe
744	dhiIFCm.exe
1820	XXXhXZj.exe
3592	ydyoiVE.exe
5056	pswcjuC.exe
4380	jtCZJxU.exe
1532	ntoiJCE.exe
2332	RBWKoOh.exe
4488	TekXbyc.exe
4928	ianIfIL.exe
4848	GnqWQZO.exe
3752	lZBowMJ.exe
676	gmuPbME.exe
876	JKAxjxN.exe
2400	wAPTivn.exe
3720	ecyWRtf.exe
4932	HUkvdRk.exe
2324	sjWObsK.exe
1412	HQRrGMX.exe
1992	qwMfJhU.exe
224	KYlIaZw.exe
4632	BugTeeU.exe
2152	RKBpTYC.exe
3788	JXqOGPd.exe
3644	cKwjlcc.exe
1192	gDEsFZq.exe
3036	JSZEwID.exe
1948	lFEphjt.exe
4880	OkdVbFu.exe
1768	vGSxVis.exe
916	jmtcLjj.exe
3548	jAfVcbv.exe
3532	BuaFDqJ.exe
1156	SSBwKRb.exe
1568	uNSNUoc.exe
4908	PrVJpEI.exe
4212	wWarWCy.exe
2000	NbUXKYq.exe
4028	HLYWocy.exe
660	cFuENJh.exe
4876	RizvDYV.exe
5072	TYAHYlp.exe
4416	qroKmHX.exe
3144	nJtrAlZ.exe
3368	DRgdcrE.exe
1012	ohENhVC.exe
1112	iirnThx.exe
956	raSssxL.exe
4224	YPmpIPY.exe
560	yMUbdWd.exe
4696	GGKbbBT.exe
3172	DnsguxF.exe
1880	vfJaavE.exe
4120	anPYpLW.exe
1584	FlexuSs.exe
4432	QXdiMab.exe
3152	OttONRq.exe
4300	OgCBGQI.exe
1988	lmytGJl.exe
3596	vCtwVYs.exe
2148	CVoTSqu.exe
1732	eXxESLH.exe
1248	pMfUFrN.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/216-0-0x00007FF603BB0000-0x00007FF603FA6000-memory.dmp	upx
behavioral2/files/0x0008000000022f51-5.dat	upx
behavioral2/memory/664-12-0x00007FF69CB80000-0x00007FF69CF76000-memory.dmp	upx
behavioral2/files/0x00070000000233fb-69.dat	upx
behavioral2/files/0x00070000000233fa-67.dat	upx
behavioral2/files/0x00070000000233ff-84.dat	upx
behavioral2/files/0x0007000000023406-111.dat	upx
behavioral2/memory/3752-117-0x00007FF755620000-0x00007FF755A16000-memory.dmp	upx
behavioral2/memory/876-139-0x00007FF7CB730000-0x00007FF7CBB26000-memory.dmp	upx
behavioral2/memory/2324-148-0x00007FF74AA40000-0x00007FF74AE36000-memory.dmp	upx
behavioral2/memory/224-151-0x00007FF62A2C0000-0x00007FF62A6B6000-memory.dmp	upx
behavioral2/memory/2152-152-0x00007FF6CF240000-0x00007FF6CF636000-memory.dmp	upx
behavioral2/memory/4848-187-0x00007FF6553F0000-0x00007FF6557E6000-memory.dmp	upx
behavioral2/memory/4632-204-0x00007FF7FB2F0000-0x00007FF7FB6E6000-memory.dmp	upx
behavioral2/memory/3720-203-0x00007FF6DB180000-0x00007FF6DB576000-memory.dmp	upx
behavioral2/memory/676-201-0x00007FF7B6E40000-0x00007FF7B7236000-memory.dmp	upx
behavioral2/files/0x000700000002340d-196.dat	upx
behavioral2/files/0x000700000002340c-194.dat	upx
behavioral2/files/0x000700000002340b-192.dat	upx
behavioral2/files/0x0008000000023408-190.dat	upx
behavioral2/files/0x00080000000233ef-188.dat	upx
behavioral2/files/0x0007000000023411-186.dat	upx
behavioral2/files/0x000700000002340a-184.dat	upx
behavioral2/memory/2332-183-0x00007FF6E6B10000-0x00007FF6E6F06000-memory.dmp	upx
behavioral2/files/0x0007000000023410-182.dat	upx
behavioral2/files/0x000700000002340f-181.dat	upx
behavioral2/files/0x000700000002340e-180.dat	upx
behavioral2/memory/1820-170-0x00007FF7661F0000-0x00007FF7665E6000-memory.dmp	upx
behavioral2/memory/1992-150-0x00007FF600590000-0x00007FF600986000-memory.dmp	upx
behavioral2/memory/1412-149-0x00007FF72C9F0000-0x00007FF72CDE6000-memory.dmp	upx
behavioral2/files/0x0008000000023409-146.dat	upx
behavioral2/files/0x0007000000023407-144.dat	upx
behavioral2/memory/4932-143-0x00007FF6D2170000-0x00007FF6D2566000-memory.dmp	upx
behavioral2/memory/2400-142-0x00007FF6F95F0000-0x00007FF6F99E6000-memory.dmp	upx
behavioral2/files/0x0007000000023400-131.dat	upx
behavioral2/files/0x0007000000023405-129.dat	upx
behavioral2/files/0x0007000000023404-122.dat	upx
behavioral2/files/0x0007000000023402-120.dat	upx
behavioral2/files/0x0007000000023403-118.dat	upx
behavioral2/files/0x0007000000023401-115.dat	upx
behavioral2/memory/4928-112-0x00007FF607E30000-0x00007FF608226000-memory.dmp	upx
behavioral2/files/0x00070000000233fc-109.dat	upx
behavioral2/files/0x00070000000233fd-105.dat	upx
behavioral2/memory/4488-95-0x00007FF7B1370000-0x00007FF7B1766000-memory.dmp	upx
behavioral2/files/0x00070000000233fe-82.dat	upx
behavioral2/files/0x00070000000233f9-78.dat	upx
behavioral2/memory/1532-75-0x00007FF7BB210000-0x00007FF7BB606000-memory.dmp	upx
behavioral2/files/0x00070000000233f7-63.dat	upx
behavioral2/memory/4380-60-0x00007FF7C7AC0000-0x00007FF7C7EB6000-memory.dmp	upx
behavioral2/files/0x00070000000233f8-57.dat	upx
behavioral2/files/0x00070000000233f6-52.dat	upx
behavioral2/memory/5056-50-0x00007FF7AA3E0000-0x00007FF7AA7D6000-memory.dmp	upx
behavioral2/memory/3592-48-0x00007FF738250000-0x00007FF738646000-memory.dmp	upx
behavioral2/files/0x00070000000233f5-54.dat	upx
behavioral2/memory/744-42-0x00007FF75B180000-0x00007FF75B576000-memory.dmp	upx
behavioral2/files/0x00070000000233f3-38.dat	upx
behavioral2/files/0x00070000000233f4-31.dat	upx
behavioral2/files/0x00070000000233f2-27.dat	upx
behavioral2/memory/3584-23-0x00007FF72F540000-0x00007FF72F936000-memory.dmp	upx
behavioral2/memory/216-2070-0x00007FF603BB0000-0x00007FF603FA6000-memory.dmp	upx
behavioral2/memory/664-2071-0x00007FF69CB80000-0x00007FF69CF76000-memory.dmp	upx
behavioral2/memory/744-2073-0x00007FF75B180000-0x00007FF75B576000-memory.dmp	upx
behavioral2/memory/3592-2074-0x00007FF738250000-0x00007FF738646000-memory.dmp	upx
behavioral2/memory/4380-2075-0x00007FF7C7AC0000-0x00007FF7C7EB6000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\VQMSqrZ.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\bEzonLw.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\ZSFEetq.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\muaylAe.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\GrnZhwk.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\ytJTPXc.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\LpfJans.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\kkWAmhF.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\znzuRyv.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\cfMrOyD.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\LcHHsbj.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\CVclyRX.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\OqLEzXz.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\EchMAZU.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\nNnZFHm.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\VgZqkQK.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\PbMnInm.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\lqyXOBT.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\JXqOGPd.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\xoRggrZ.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\neBoWUn.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\rQjTSxl.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\URrOaAk.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\oEADlSl.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\HOkplfA.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\saDAKyJ.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\iirnThx.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\vQymvHR.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\banIGFm.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\MuEctFQ.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\uarRWtJ.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\HhdDsrP.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\fMuywjw.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\brgiIwY.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\gvyEfzg.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\aFzrIoN.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\FlexuSs.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\YrSjSHM.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\tLmQefQ.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\wqZVwub.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\PZCtvsF.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\lHypPrn.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\oysUZvd.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\QXGSgqB.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\DuBwloS.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\AiYnpMt.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\GuuLpyz.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\PGlYmjo.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\FYYwbNf.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\IxtnWFa.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\RXgNmyH.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\BuaFDqJ.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\anPYpLW.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\jRBgGnf.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\jZpfrcn.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\EPZjXlt.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\jAfVcbv.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\fsSnADd.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\TdldfPW.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\kGBkKvx.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\ppSagIT.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\AyNHcqh.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\zYKTVKe.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
File created	C:\Windows\System\gYLbrAy.exe	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4444	powershell.exe
4444	powershell.exe
4444	powershell.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
Token: SeDebugPrivilege	4444	powershell.exe
Token: SeLockMemoryPrivilege	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
Token: SeCreateGlobalPrivilege	12688	dwm.exe
Token: SeChangeNotifyPrivilege	12688	dwm.exe
Token: 33	12688	dwm.exe
Token: SeIncBasePriorityPrivilege	12688	dwm.exe
Token: SeShutdownPrivilege	12688	dwm.exe
Token: SeCreatePagefilePrivilege	12688	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 4444	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	84
PID 216 wrote to memory of 4444	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	84
PID 216 wrote to memory of 664	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	85
PID 216 wrote to memory of 664	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	85
PID 216 wrote to memory of 3584	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	86
PID 216 wrote to memory of 3584	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	86
PID 216 wrote to memory of 1820	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	87
PID 216 wrote to memory of 1820	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	87
PID 216 wrote to memory of 744	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	88
PID 216 wrote to memory of 744	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	88
PID 216 wrote to memory of 5056	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	89
PID 216 wrote to memory of 5056	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	89
PID 216 wrote to memory of 3592	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	90
PID 216 wrote to memory of 3592	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	90
PID 216 wrote to memory of 4380	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	91
PID 216 wrote to memory of 4380	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	91
PID 216 wrote to memory of 1532	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	92
PID 216 wrote to memory of 1532	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	92
PID 216 wrote to memory of 2332	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	93
PID 216 wrote to memory of 2332	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	93
PID 216 wrote to memory of 4488	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	94
PID 216 wrote to memory of 4488	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	94
PID 216 wrote to memory of 4928	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	95
PID 216 wrote to memory of 4928	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	95
PID 216 wrote to memory of 4848	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	96
PID 216 wrote to memory of 4848	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	96
PID 216 wrote to memory of 3752	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	97
PID 216 wrote to memory of 3752	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	97
PID 216 wrote to memory of 676	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	98
PID 216 wrote to memory of 676	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	98
PID 216 wrote to memory of 876	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	99
PID 216 wrote to memory of 876	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	99
PID 216 wrote to memory of 1992	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	100
PID 216 wrote to memory of 1992	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	100
PID 216 wrote to memory of 2400	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	101
PID 216 wrote to memory of 2400	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	101
PID 216 wrote to memory of 3720	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	102
PID 216 wrote to memory of 3720	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	102
PID 216 wrote to memory of 4932	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	103
PID 216 wrote to memory of 4932	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	103
PID 216 wrote to memory of 2324	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	104
PID 216 wrote to memory of 2324	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	104
PID 216 wrote to memory of 1412	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	105
PID 216 wrote to memory of 1412	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	105
PID 216 wrote to memory of 224	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	106
PID 216 wrote to memory of 224	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	106
PID 216 wrote to memory of 4632	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	107
PID 216 wrote to memory of 4632	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	107
PID 216 wrote to memory of 2152	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	108
PID 216 wrote to memory of 2152	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	108
PID 216 wrote to memory of 3788	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	109
PID 216 wrote to memory of 3788	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	109
PID 216 wrote to memory of 3644	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	110
PID 216 wrote to memory of 3644	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	110
PID 216 wrote to memory of 1192	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	111
PID 216 wrote to memory of 1192	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	111
PID 216 wrote to memory of 3036	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	112
PID 216 wrote to memory of 3036	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	112
PID 216 wrote to memory of 1948	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	113
PID 216 wrote to memory of 1948	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	113
PID 216 wrote to memory of 4880	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	114
PID 216 wrote to memory of 4880	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	114
PID 216 wrote to memory of 1768	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	115
PID 216 wrote to memory of 1768	216	ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\ba7a2a72c61c660c556c0bc9076f77b0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4444
- C:\Windows\System\UfPuNZI.exe
  C:\Windows\System\UfPuNZI.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\jJnqQRk.exe
  C:\Windows\System\jJnqQRk.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\XXXhXZj.exe
  C:\Windows\System\XXXhXZj.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\dhiIFCm.exe
  C:\Windows\System\dhiIFCm.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\pswcjuC.exe
  C:\Windows\System\pswcjuC.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\ydyoiVE.exe
  C:\Windows\System\ydyoiVE.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\jtCZJxU.exe
  C:\Windows\System\jtCZJxU.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\ntoiJCE.exe
  C:\Windows\System\ntoiJCE.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\RBWKoOh.exe
  C:\Windows\System\RBWKoOh.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\TekXbyc.exe
  C:\Windows\System\TekXbyc.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\ianIfIL.exe
  C:\Windows\System\ianIfIL.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\GnqWQZO.exe
  C:\Windows\System\GnqWQZO.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\lZBowMJ.exe
  C:\Windows\System\lZBowMJ.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\gmuPbME.exe
  C:\Windows\System\gmuPbME.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\JKAxjxN.exe
  C:\Windows\System\JKAxjxN.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\qwMfJhU.exe
  C:\Windows\System\qwMfJhU.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\wAPTivn.exe
  C:\Windows\System\wAPTivn.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\ecyWRtf.exe
  C:\Windows\System\ecyWRtf.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\HUkvdRk.exe
  C:\Windows\System\HUkvdRk.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\sjWObsK.exe
  C:\Windows\System\sjWObsK.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\HQRrGMX.exe
  C:\Windows\System\HQRrGMX.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\KYlIaZw.exe
  C:\Windows\System\KYlIaZw.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\BugTeeU.exe
  C:\Windows\System\BugTeeU.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\RKBpTYC.exe
  C:\Windows\System\RKBpTYC.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\JXqOGPd.exe
  C:\Windows\System\JXqOGPd.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\cKwjlcc.exe
  C:\Windows\System\cKwjlcc.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\gDEsFZq.exe
  C:\Windows\System\gDEsFZq.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\JSZEwID.exe
  C:\Windows\System\JSZEwID.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\lFEphjt.exe
  C:\Windows\System\lFEphjt.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\OkdVbFu.exe
  C:\Windows\System\OkdVbFu.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\vGSxVis.exe
  C:\Windows\System\vGSxVis.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\jmtcLjj.exe
  C:\Windows\System\jmtcLjj.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\jAfVcbv.exe
  C:\Windows\System\jAfVcbv.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\BuaFDqJ.exe
  C:\Windows\System\BuaFDqJ.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\SSBwKRb.exe
  C:\Windows\System\SSBwKRb.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\uNSNUoc.exe
  C:\Windows\System\uNSNUoc.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\PrVJpEI.exe
  C:\Windows\System\PrVJpEI.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\wWarWCy.exe
  C:\Windows\System\wWarWCy.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\NbUXKYq.exe
  C:\Windows\System\NbUXKYq.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\HLYWocy.exe
  C:\Windows\System\HLYWocy.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\cFuENJh.exe
  C:\Windows\System\cFuENJh.exe
  2⤵
  - Executes dropped EXE
  PID:660
- C:\Windows\System\RizvDYV.exe
  C:\Windows\System\RizvDYV.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\TYAHYlp.exe
  C:\Windows\System\TYAHYlp.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\qroKmHX.exe
  C:\Windows\System\qroKmHX.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\nJtrAlZ.exe
  C:\Windows\System\nJtrAlZ.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\DRgdcrE.exe
  C:\Windows\System\DRgdcrE.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\ohENhVC.exe
  C:\Windows\System\ohENhVC.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\iirnThx.exe
  C:\Windows\System\iirnThx.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\raSssxL.exe
  C:\Windows\System\raSssxL.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\YPmpIPY.exe
  C:\Windows\System\YPmpIPY.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\yMUbdWd.exe
  C:\Windows\System\yMUbdWd.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\GGKbbBT.exe
  C:\Windows\System\GGKbbBT.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\DnsguxF.exe
  C:\Windows\System\DnsguxF.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\vfJaavE.exe
  C:\Windows\System\vfJaavE.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\anPYpLW.exe
  C:\Windows\System\anPYpLW.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\FlexuSs.exe
  C:\Windows\System\FlexuSs.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\QXdiMab.exe
  C:\Windows\System\QXdiMab.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\OttONRq.exe
  C:\Windows\System\OttONRq.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\OgCBGQI.exe
  C:\Windows\System\OgCBGQI.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\lmytGJl.exe
  C:\Windows\System\lmytGJl.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\vCtwVYs.exe
  C:\Windows\System\vCtwVYs.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\CVoTSqu.exe
  C:\Windows\System\CVoTSqu.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\eXxESLH.exe
  C:\Windows\System\eXxESLH.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\pMfUFrN.exe
  C:\Windows\System\pMfUFrN.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\DKCWuPd.exe
  C:\Windows\System\DKCWuPd.exe
  2⤵
  PID:5016
- C:\Windows\System\JiMCniK.exe
  C:\Windows\System\JiMCniK.exe
  2⤵
  PID:4840
- C:\Windows\System\RrXzCXD.exe
  C:\Windows\System\RrXzCXD.exe
  2⤵
  PID:3340
- C:\Windows\System\nNWJIJN.exe
  C:\Windows\System\nNWJIJN.exe
  2⤵
  PID:3284
- C:\Windows\System\onEybag.exe
  C:\Windows\System\onEybag.exe
  2⤵
  PID:3656
- C:\Windows\System\tPppufz.exe
  C:\Windows\System\tPppufz.exe
  2⤵
  PID:2232
- C:\Windows\System\vBgjaun.exe
  C:\Windows\System\vBgjaun.exe
  2⤵
  PID:4052
- C:\Windows\System\yiQlqaG.exe
  C:\Windows\System\yiQlqaG.exe
  2⤵
  PID:4204
- C:\Windows\System\EueWolB.exe
  C:\Windows\System\EueWolB.exe
  2⤵
  PID:772
- C:\Windows\System\ZOQOdYI.exe
  C:\Windows\System\ZOQOdYI.exe
  2⤵
  PID:2764
- C:\Windows\System\MzXNwmO.exe
  C:\Windows\System\MzXNwmO.exe
  2⤵
  PID:3864
- C:\Windows\System\dagcLOC.exe
  C:\Windows\System\dagcLOC.exe
  2⤵
  PID:4964
- C:\Windows\System\BfoLEjB.exe
  C:\Windows\System\BfoLEjB.exe
  2⤵
  PID:2668
- C:\Windows\System\yxyQuTF.exe
  C:\Windows\System\yxyQuTF.exe
  2⤵
  PID:3988
- C:\Windows\System\OfVaRiZ.exe
  C:\Windows\System\OfVaRiZ.exe
  2⤵
  PID:2068
- C:\Windows\System\ocrOCzb.exe
  C:\Windows\System\ocrOCzb.exe
  2⤵
  PID:2596
- C:\Windows\System\ZvHaZwg.exe
  C:\Windows\System\ZvHaZwg.exe
  2⤵
  PID:4856
- C:\Windows\System\JmQLxQf.exe
  C:\Windows\System\JmQLxQf.exe
  2⤵
  PID:1848
- C:\Windows\System\oNyNcLX.exe
  C:\Windows\System\oNyNcLX.exe
  2⤵
  PID:2692
- C:\Windows\System\OLrBFxB.exe
  C:\Windows\System\OLrBFxB.exe
  2⤵
  PID:4496
- C:\Windows\System\fxoSbhY.exe
  C:\Windows\System\fxoSbhY.exe
  2⤵
  PID:2900
- C:\Windows\System\mXNIwTo.exe
  C:\Windows\System\mXNIwTo.exe
  2⤵
  PID:2056
- C:\Windows\System\HcDlOzJ.exe
  C:\Windows\System\HcDlOzJ.exe
  2⤵
  PID:5020
- C:\Windows\System\qXOeemy.exe
  C:\Windows\System\qXOeemy.exe
  2⤵
  PID:2424
- C:\Windows\System\aOHvljb.exe
  C:\Windows\System\aOHvljb.exe
  2⤵
  PID:5060
- C:\Windows\System\sxqMGKm.exe
  C:\Windows\System\sxqMGKm.exe
  2⤵
  PID:4460
- C:\Windows\System\RhlDIan.exe
  C:\Windows\System\RhlDIan.exe
  2⤵
  PID:364
- C:\Windows\System\ejgGCBo.exe
  C:\Windows\System\ejgGCBo.exe
  2⤵
  PID:5128
- C:\Windows\System\inIXTli.exe
  C:\Windows\System\inIXTli.exe
  2⤵
  PID:5168
- C:\Windows\System\uxhqgkF.exe
  C:\Windows\System\uxhqgkF.exe
  2⤵
  PID:5220
- C:\Windows\System\RcDhhrt.exe
  C:\Windows\System\RcDhhrt.exe
  2⤵
  PID:5264
- C:\Windows\System\mkbwYHG.exe
  C:\Windows\System\mkbwYHG.exe
  2⤵
  PID:5288
- C:\Windows\System\TTAlJWf.exe
  C:\Windows\System\TTAlJWf.exe
  2⤵
  PID:5308
- C:\Windows\System\wRCzrmc.exe
  C:\Windows\System\wRCzrmc.exe
  2⤵
  PID:5328
- C:\Windows\System\kHwYwuH.exe
  C:\Windows\System\kHwYwuH.exe
  2⤵
  PID:5348
- C:\Windows\System\kysTUFr.exe
  C:\Windows\System\kysTUFr.exe
  2⤵
  PID:5368
- C:\Windows\System\dQFLpNj.exe
  C:\Windows\System\dQFLpNj.exe
  2⤵
  PID:5388
- C:\Windows\System\DBEljGo.exe
  C:\Windows\System\DBEljGo.exe
  2⤵
  PID:5428
- C:\Windows\System\banIGFm.exe
  C:\Windows\System\banIGFm.exe
  2⤵
  PID:5480
- C:\Windows\System\cpPffjJ.exe
  C:\Windows\System\cpPffjJ.exe
  2⤵
  PID:5516
- C:\Windows\System\AwiAYkG.exe
  C:\Windows\System\AwiAYkG.exe
  2⤵
  PID:5556
- C:\Windows\System\uBZeNGz.exe
  C:\Windows\System\uBZeNGz.exe
  2⤵
  PID:5572
- C:\Windows\System\tMZrooq.exe
  C:\Windows\System\tMZrooq.exe
  2⤵
  PID:5620
- C:\Windows\System\fsSnADd.exe
  C:\Windows\System\fsSnADd.exe
  2⤵
  PID:5652
- C:\Windows\System\LpfJans.exe
  C:\Windows\System\LpfJans.exe
  2⤵
  PID:5672
- C:\Windows\System\yToxGCS.exe
  C:\Windows\System\yToxGCS.exe
  2⤵
  PID:5704
- C:\Windows\System\OmTronN.exe
  C:\Windows\System\OmTronN.exe
  2⤵
  PID:5740
- C:\Windows\System\MBXSTYO.exe
  C:\Windows\System\MBXSTYO.exe
  2⤵
  PID:5816
- C:\Windows\System\UvwErwg.exe
  C:\Windows\System\UvwErwg.exe
  2⤵
  PID:5832
- C:\Windows\System\IZjpykM.exe
  C:\Windows\System\IZjpykM.exe
  2⤵
  PID:5880
- C:\Windows\System\YrSjSHM.exe
  C:\Windows\System\YrSjSHM.exe
  2⤵
  PID:5912
- C:\Windows\System\nGaTyrU.exe
  C:\Windows\System\nGaTyrU.exe
  2⤵
  PID:5956
- C:\Windows\System\lDIzqkx.exe
  C:\Windows\System\lDIzqkx.exe
  2⤵
  PID:6004
- C:\Windows\System\fWzaInP.exe
  C:\Windows\System\fWzaInP.exe
  2⤵
  PID:6028
- C:\Windows\System\WkHmjss.exe
  C:\Windows\System\WkHmjss.exe
  2⤵
  PID:6056
- C:\Windows\System\TXSUzuE.exe
  C:\Windows\System\TXSUzuE.exe
  2⤵
  PID:6096
- C:\Windows\System\ShzaFWO.exe
  C:\Windows\System\ShzaFWO.exe
  2⤵
  PID:6120
- C:\Windows\System\RoJvejG.exe
  C:\Windows\System\RoJvejG.exe
  2⤵
  PID:3840
- C:\Windows\System\plRwRTj.exe
  C:\Windows\System\plRwRTj.exe
  2⤵
  PID:5152
- C:\Windows\System\PhSnLGk.exe
  C:\Windows\System\PhSnLGk.exe
  2⤵
  PID:5140
- C:\Windows\System\EqQERRR.exe
  C:\Windows\System\EqQERRR.exe
  2⤵
  PID:5196
- C:\Windows\System\IxtnWFa.exe
  C:\Windows\System\IxtnWFa.exe
  2⤵
  PID:5272
- C:\Windows\System\klwuvhf.exe
  C:\Windows\System\klwuvhf.exe
  2⤵
  PID:5424
- C:\Windows\System\OqLEzXz.exe
  C:\Windows\System\OqLEzXz.exe
  2⤵
  PID:5344
- C:\Windows\System\ilZnlUJ.exe
  C:\Windows\System\ilZnlUJ.exe
  2⤵
  PID:5412
- C:\Windows\System\orIlMAl.exe
  C:\Windows\System\orIlMAl.exe
  2⤵
  PID:5584
- C:\Windows\System\wKVaaCA.exe
  C:\Windows\System\wKVaaCA.exe
  2⤵
  PID:5640
- C:\Windows\System\NvqUAMQ.exe
  C:\Windows\System\NvqUAMQ.exe
  2⤵
  PID:5692
- C:\Windows\System\JQecjYm.exe
  C:\Windows\System\JQecjYm.exe
  2⤵
  PID:5760
- C:\Windows\System\gyqzAsJ.exe
  C:\Windows\System\gyqzAsJ.exe
  2⤵
  PID:5904
- C:\Windows\System\KmfrtWB.exe
  C:\Windows\System\KmfrtWB.exe
  2⤵
  PID:5996
- C:\Windows\System\UlPcTHO.exe
  C:\Windows\System\UlPcTHO.exe
  2⤵
  PID:6080
- C:\Windows\System\KQjtecQ.exe
  C:\Windows\System\KQjtecQ.exe
  2⤵
  PID:6132
- C:\Windows\System\AEfcLDU.exe
  C:\Windows\System\AEfcLDU.exe
  2⤵
  PID:2760
- C:\Windows\System\EjCWIKq.exe
  C:\Windows\System\EjCWIKq.exe
  2⤵
  PID:5180
- C:\Windows\System\UuLQFNp.exe
  C:\Windows\System\UuLQFNp.exe
  2⤵
  PID:4220
- C:\Windows\System\qxKfIgk.exe
  C:\Windows\System\qxKfIgk.exe
  2⤵
  PID:5304
- C:\Windows\System\XyevHVh.exe
  C:\Windows\System\XyevHVh.exe
  2⤵
  PID:5400
- C:\Windows\System\XcChdSo.exe
  C:\Windows\System\XcChdSo.exe
  2⤵
  PID:5736
- C:\Windows\System\RXgNmyH.exe
  C:\Windows\System\RXgNmyH.exe
  2⤵
  PID:5840
- C:\Windows\System\IsLbEtN.exe
  C:\Windows\System\IsLbEtN.exe
  2⤵
  PID:6116
- C:\Windows\System\aCsRlQb.exe
  C:\Windows\System\aCsRlQb.exe
  2⤵
  PID:1808
- C:\Windows\System\qazUPnT.exe
  C:\Windows\System\qazUPnT.exe
  2⤵
  PID:5316
- C:\Windows\System\SoOpxSa.exe
  C:\Windows\System\SoOpxSa.exe
  2⤵
  PID:5688
- C:\Windows\System\ppSagIT.exe
  C:\Windows\System\ppSagIT.exe
  2⤵
  PID:5260
- C:\Windows\System\GQWiLML.exe
  C:\Windows\System\GQWiLML.exe
  2⤵
  PID:5812
- C:\Windows\System\poDCbJU.exe
  C:\Windows\System\poDCbJU.exe
  2⤵
  PID:5364
- C:\Windows\System\piivBJW.exe
  C:\Windows\System\piivBJW.exe
  2⤵
  PID:6184
- C:\Windows\System\mXhHVuP.exe
  C:\Windows\System\mXhHVuP.exe
  2⤵
  PID:6204
- C:\Windows\System\hcGSOUF.exe
  C:\Windows\System\hcGSOUF.exe
  2⤵
  PID:6236
- C:\Windows\System\HBJTvdI.exe
  C:\Windows\System\HBJTvdI.exe
  2⤵
  PID:6272
- C:\Windows\System\CdoTGap.exe
  C:\Windows\System\CdoTGap.exe
  2⤵
  PID:6292
- C:\Windows\System\QleQRcP.exe
  C:\Windows\System\QleQRcP.exe
  2⤵
  PID:6336
- C:\Windows\System\sIbWnra.exe
  C:\Windows\System\sIbWnra.exe
  2⤵
  PID:6356
- C:\Windows\System\PGlYmjo.exe
  C:\Windows\System\PGlYmjo.exe
  2⤵
  PID:6388
- C:\Windows\System\WZcclnW.exe
  C:\Windows\System\WZcclnW.exe
  2⤵
  PID:6412
- C:\Windows\System\FQCHxMe.exe
  C:\Windows\System\FQCHxMe.exe
  2⤵
  PID:6456
- C:\Windows\System\RryNzPr.exe
  C:\Windows\System\RryNzPr.exe
  2⤵
  PID:6476
- C:\Windows\System\QblNQIQ.exe
  C:\Windows\System\QblNQIQ.exe
  2⤵
  PID:6496
- C:\Windows\System\OYTPlpU.exe
  C:\Windows\System\OYTPlpU.exe
  2⤵
  PID:6532
- C:\Windows\System\Ryhlhvc.exe
  C:\Windows\System\Ryhlhvc.exe
  2⤵
  PID:6560
- C:\Windows\System\dEzMChJ.exe
  C:\Windows\System\dEzMChJ.exe
  2⤵
  PID:6588
- C:\Windows\System\NquDMFd.exe
  C:\Windows\System\NquDMFd.exe
  2⤵
  PID:6604
- C:\Windows\System\OeBUCGg.exe
  C:\Windows\System\OeBUCGg.exe
  2⤵
  PID:6644
- C:\Windows\System\IJfWdvG.exe
  C:\Windows\System\IJfWdvG.exe
  2⤵
  PID:6660
- C:\Windows\System\zqJlaWS.exe
  C:\Windows\System\zqJlaWS.exe
  2⤵
  PID:6676
- C:\Windows\System\MkpooYo.exe
  C:\Windows\System\MkpooYo.exe
  2⤵
  PID:6696
- C:\Windows\System\AyNHcqh.exe
  C:\Windows\System\AyNHcqh.exe
  2⤵
  PID:6736
- C:\Windows\System\lEEaHbt.exe
  C:\Windows\System\lEEaHbt.exe
  2⤵
  PID:6780
- C:\Windows\System\NaQLBLc.exe
  C:\Windows\System\NaQLBLc.exe
  2⤵
  PID:6816
- C:\Windows\System\ixDwVJj.exe
  C:\Windows\System\ixDwVJj.exe
  2⤵
  PID:6840
- C:\Windows\System\vQymvHR.exe
  C:\Windows\System\vQymvHR.exe
  2⤵
  PID:6868
- C:\Windows\System\bsaGUzT.exe
  C:\Windows\System\bsaGUzT.exe
  2⤵
  PID:6900
- C:\Windows\System\mrPRffY.exe
  C:\Windows\System\mrPRffY.exe
  2⤵
  PID:6924
- C:\Windows\System\XiGADZQ.exe
  C:\Windows\System\XiGADZQ.exe
  2⤵
  PID:6952
- C:\Windows\System\kkWAmhF.exe
  C:\Windows\System\kkWAmhF.exe
  2⤵
  PID:6968
- C:\Windows\System\xLDSDXh.exe
  C:\Windows\System\xLDSDXh.exe
  2⤵
  PID:6984
- C:\Windows\System\DzqOpFE.exe
  C:\Windows\System\DzqOpFE.exe
  2⤵
  PID:7000
- C:\Windows\System\FaHlHdl.exe
  C:\Windows\System\FaHlHdl.exe
  2⤵
  PID:7040
- C:\Windows\System\LANvXgE.exe
  C:\Windows\System\LANvXgE.exe
  2⤵
  PID:7080
- C:\Windows\System\EchMAZU.exe
  C:\Windows\System\EchMAZU.exe
  2⤵
  PID:7108
- C:\Windows\System\ljXZGpr.exe
  C:\Windows\System\ljXZGpr.exe
  2⤵
  PID:7152
- C:\Windows\System\XxSIICD.exe
  C:\Windows\System\XxSIICD.exe
  2⤵
  PID:6156
- C:\Windows\System\iGajOVC.exe
  C:\Windows\System\iGajOVC.exe
  2⤵
  PID:6220
- C:\Windows\System\ndeMYvj.exe
  C:\Windows\System\ndeMYvj.exe
  2⤵
  PID:6260
- C:\Windows\System\wOjKYTd.exe
  C:\Windows\System\wOjKYTd.exe
  2⤵
  PID:6352
- C:\Windows\System\VQMSqrZ.exe
  C:\Windows\System\VQMSqrZ.exe
  2⤵
  PID:6464
- C:\Windows\System\KzxUfcB.exe
  C:\Windows\System\KzxUfcB.exe
  2⤵
  PID:6512
- C:\Windows\System\ZSmydYn.exe
  C:\Windows\System\ZSmydYn.exe
  2⤵
  PID:6596
- C:\Windows\System\merBWrF.exe
  C:\Windows\System\merBWrF.exe
  2⤵
  PID:6652
- C:\Windows\System\xoRggrZ.exe
  C:\Windows\System\xoRggrZ.exe
  2⤵
  PID:6744
- C:\Windows\System\uarRWtJ.exe
  C:\Windows\System\uarRWtJ.exe
  2⤵
  PID:6796
- C:\Windows\System\AhmXCyx.exe
  C:\Windows\System\AhmXCyx.exe
  2⤵
  PID:6856
- C:\Windows\System\avvQokV.exe
  C:\Windows\System\avvQokV.exe
  2⤵
  PID:6948
- C:\Windows\System\ilnhVNt.exe
  C:\Windows\System\ilnhVNt.exe
  2⤵
  PID:7060
- C:\Windows\System\fMdrMFV.exe
  C:\Windows\System\fMdrMFV.exe
  2⤵
  PID:7092
- C:\Windows\System\QXEuWZV.exe
  C:\Windows\System\QXEuWZV.exe
  2⤵
  PID:7136
- C:\Windows\System\ZNcrAbR.exe
  C:\Windows\System\ZNcrAbR.exe
  2⤵
  PID:6324
- C:\Windows\System\mCTzsrW.exe
  C:\Windows\System\mCTzsrW.exe
  2⤵
  PID:6520
- C:\Windows\System\GKSmAQf.exe
  C:\Windows\System\GKSmAQf.exe
  2⤵
  PID:6672
- C:\Windows\System\kiuHcOZ.exe
  C:\Windows\System\kiuHcOZ.exe
  2⤵
  PID:6772
- C:\Windows\System\gDTsFef.exe
  C:\Windows\System\gDTsFef.exe
  2⤵
  PID:6936
- C:\Windows\System\EHprHlh.exe
  C:\Windows\System\EHprHlh.exe
  2⤵
  PID:6148
- C:\Windows\System\XgcoObv.exe
  C:\Windows\System\XgcoObv.exe
  2⤵
  PID:6576
- C:\Windows\System\QuDqGVM.exe
  C:\Windows\System\QuDqGVM.exe
  2⤵
  PID:6688
- C:\Windows\System\ddLnVSc.exe
  C:\Windows\System\ddLnVSc.exe
  2⤵
  PID:7160
- C:\Windows\System\OmWuSTk.exe
  C:\Windows\System\OmWuSTk.exe
  2⤵
  PID:6712
- C:\Windows\System\fOdkGpR.exe
  C:\Windows\System\fOdkGpR.exe
  2⤵
  PID:7176
- C:\Windows\System\wJqhcMh.exe
  C:\Windows\System\wJqhcMh.exe
  2⤵
  PID:7204
- C:\Windows\System\RBbKMsg.exe
  C:\Windows\System\RBbKMsg.exe
  2⤵
  PID:7232
- C:\Windows\System\idUQdpq.exe
  C:\Windows\System\idUQdpq.exe
  2⤵
  PID:7268
- C:\Windows\System\FYYwbNf.exe
  C:\Windows\System\FYYwbNf.exe
  2⤵
  PID:7288
- C:\Windows\System\tErYThK.exe
  C:\Windows\System\tErYThK.exe
  2⤵
  PID:7316
- C:\Windows\System\giOwybg.exe
  C:\Windows\System\giOwybg.exe
  2⤵
  PID:7344
- C:\Windows\System\gZcXyVX.exe
  C:\Windows\System\gZcXyVX.exe
  2⤵
  PID:7372
- C:\Windows\System\igUibFU.exe
  C:\Windows\System\igUibFU.exe
  2⤵
  PID:7400
- C:\Windows\System\URrOaAk.exe
  C:\Windows\System\URrOaAk.exe
  2⤵
  PID:7428
- C:\Windows\System\XoJfgVW.exe
  C:\Windows\System\XoJfgVW.exe
  2⤵
  PID:7472
- C:\Windows\System\kGTJdxO.exe
  C:\Windows\System\kGTJdxO.exe
  2⤵
  PID:7504
- C:\Windows\System\JSscKdr.exe
  C:\Windows\System\JSscKdr.exe
  2⤵
  PID:7528
- C:\Windows\System\kpFsCmc.exe
  C:\Windows\System\kpFsCmc.exe
  2⤵
  PID:7544
- C:\Windows\System\jsrPWkv.exe
  C:\Windows\System\jsrPWkv.exe
  2⤵
  PID:7584
- C:\Windows\System\yvtxtXe.exe
  C:\Windows\System\yvtxtXe.exe
  2⤵
  PID:7612
- C:\Windows\System\LQSxcwE.exe
  C:\Windows\System\LQSxcwE.exe
  2⤵
  PID:7632
- C:\Windows\System\WqfwQel.exe
  C:\Windows\System\WqfwQel.exe
  2⤵
  PID:7656
- C:\Windows\System\LNiSDbV.exe
  C:\Windows\System\LNiSDbV.exe
  2⤵
  PID:7684
- C:\Windows\System\eDuITob.exe
  C:\Windows\System\eDuITob.exe
  2⤵
  PID:7720
- C:\Windows\System\CCGRYew.exe
  C:\Windows\System\CCGRYew.exe
  2⤵
  PID:7740
- C:\Windows\System\YDhqLUV.exe
  C:\Windows\System\YDhqLUV.exe
  2⤵
  PID:7768
- C:\Windows\System\jDMInzq.exe
  C:\Windows\System\jDMInzq.exe
  2⤵
  PID:7796
- C:\Windows\System\oSoVEyT.exe
  C:\Windows\System\oSoVEyT.exe
  2⤵
  PID:7824
- C:\Windows\System\kOhwuwg.exe
  C:\Windows\System\kOhwuwg.exe
  2⤵
  PID:7856
- C:\Windows\System\oysUZvd.exe
  C:\Windows\System\oysUZvd.exe
  2⤵
  PID:7888
- C:\Windows\System\neBoWUn.exe
  C:\Windows\System\neBoWUn.exe
  2⤵
  PID:7908
- C:\Windows\System\ToUbwOQ.exe
  C:\Windows\System\ToUbwOQ.exe
  2⤵
  PID:7944
- C:\Windows\System\AlrBbEM.exe
  C:\Windows\System\AlrBbEM.exe
  2⤵
  PID:7976
- C:\Windows\System\THxOGkR.exe
  C:\Windows\System\THxOGkR.exe
  2⤵
  PID:8004
- C:\Windows\System\CMVRhTq.exe
  C:\Windows\System\CMVRhTq.exe
  2⤵
  PID:8020
- C:\Windows\System\IzYgzVB.exe
  C:\Windows\System\IzYgzVB.exe
  2⤵
  PID:8040
- C:\Windows\System\AfQwhGM.exe
  C:\Windows\System\AfQwhGM.exe
  2⤵
  PID:8076
- C:\Windows\System\XSBSrHT.exe
  C:\Windows\System\XSBSrHT.exe
  2⤵
  PID:8104
- C:\Windows\System\OlBzPzZ.exe
  C:\Windows\System\OlBzPzZ.exe
  2⤵
  PID:8120
- C:\Windows\System\cFkTtQY.exe
  C:\Windows\System\cFkTtQY.exe
  2⤵
  PID:8160
- C:\Windows\System\kIvigTe.exe
  C:\Windows\System\kIvigTe.exe
  2⤵
  PID:8188
- C:\Windows\System\uMIdljY.exe
  C:\Windows\System\uMIdljY.exe
  2⤵
  PID:7216
- C:\Windows\System\rQjTSxl.exe
  C:\Windows\System\rQjTSxl.exe
  2⤵
  PID:7244
- C:\Windows\System\ahjAXbw.exe
  C:\Windows\System\ahjAXbw.exe
  2⤵
  PID:7340
- C:\Windows\System\kbmYeIb.exe
  C:\Windows\System\kbmYeIb.exe
  2⤵
  PID:7412
- C:\Windows\System\kjCbzVQ.exe
  C:\Windows\System\kjCbzVQ.exe
  2⤵
  PID:7448
- C:\Windows\System\lNpHrAv.exe
  C:\Windows\System\lNpHrAv.exe
  2⤵
  PID:7520
- C:\Windows\System\jRBgGnf.exe
  C:\Windows\System\jRBgGnf.exe
  2⤵
  PID:7596
- C:\Windows\System\LDKMoGM.exe
  C:\Windows\System\LDKMoGM.exe
  2⤵
  PID:7652
- C:\Windows\System\bEzonLw.exe
  C:\Windows\System\bEzonLw.exe
  2⤵
  PID:7712
- C:\Windows\System\ApgKjXK.exe
  C:\Windows\System\ApgKjXK.exe
  2⤵
  PID:7756
- C:\Windows\System\jZpfrcn.exe
  C:\Windows\System\jZpfrcn.exe
  2⤵
  PID:7836
- C:\Windows\System\PeEweqw.exe
  C:\Windows\System\PeEweqw.exe
  2⤵
  PID:7896
- C:\Windows\System\EsWFlaI.exe
  C:\Windows\System\EsWFlaI.exe
  2⤵
  PID:7920
- C:\Windows\System\AsMThIc.exe
  C:\Windows\System\AsMThIc.exe
  2⤵
  PID:7996
- C:\Windows\System\pMvdjIE.exe
  C:\Windows\System\pMvdjIE.exe
  2⤵
  PID:8068
- C:\Windows\System\jixGEou.exe
  C:\Windows\System\jixGEou.exe
  2⤵
  PID:8116
- C:\Windows\System\VfixveV.exe
  C:\Windows\System\VfixveV.exe
  2⤵
  PID:8176
- C:\Windows\System\LNRqdQv.exe
  C:\Windows\System\LNRqdQv.exe
  2⤵
  PID:7336
- C:\Windows\System\GUHckpX.exe
  C:\Windows\System\GUHckpX.exe
  2⤵
  PID:7424
- C:\Windows\System\QgGPoyj.exe
  C:\Windows\System\QgGPoyj.exe
  2⤵
  PID:7556
- C:\Windows\System\ROJSDFm.exe
  C:\Windows\System\ROJSDFm.exe
  2⤵
  PID:7732
- C:\Windows\System\MSkHFKY.exe
  C:\Windows\System\MSkHFKY.exe
  2⤵
  PID:7820
- C:\Windows\System\sTUDrfN.exe
  C:\Windows\System\sTUDrfN.exe
  2⤵
  PID:3984
- C:\Windows\System\mdDEdQZ.exe
  C:\Windows\System\mdDEdQZ.exe
  2⤵
  PID:8140
- C:\Windows\System\nRkDdMx.exe
  C:\Windows\System\nRkDdMx.exe
  2⤵
  PID:7328
- C:\Windows\System\tgJSPMO.exe
  C:\Windows\System\tgJSPMO.exe
  2⤵
  PID:7700
- C:\Windows\System\gxIlYZZ.exe
  C:\Windows\System\gxIlYZZ.exe
  2⤵
  PID:7780
- C:\Windows\System\raklFvT.exe
  C:\Windows\System\raklFvT.exe
  2⤵
  PID:7188
- C:\Windows\System\UPpBQhx.exe
  C:\Windows\System\UPpBQhx.exe
  2⤵
  PID:8220
- C:\Windows\System\UwQcbXo.exe
  C:\Windows\System\UwQcbXo.exe
  2⤵
  PID:8248
- C:\Windows\System\rCNNqsG.exe
  C:\Windows\System\rCNNqsG.exe
  2⤵
  PID:8272
- C:\Windows\System\nOhhFiA.exe
  C:\Windows\System\nOhhFiA.exe
  2⤵
  PID:8312
- C:\Windows\System\RLeEPvI.exe
  C:\Windows\System\RLeEPvI.exe
  2⤵
  PID:8336
- C:\Windows\System\hIDaSUA.exe
  C:\Windows\System\hIDaSUA.exe
  2⤵
  PID:8360
- C:\Windows\System\BEKnVTO.exe
  C:\Windows\System\BEKnVTO.exe
  2⤵
  PID:8388
- C:\Windows\System\KAtzSoq.exe
  C:\Windows\System\KAtzSoq.exe
  2⤵
  PID:8416
- C:\Windows\System\uJuITWD.exe
  C:\Windows\System\uJuITWD.exe
  2⤵
  PID:8444
- C:\Windows\System\dBjPeGF.exe
  C:\Windows\System\dBjPeGF.exe
  2⤵
  PID:8464
- C:\Windows\System\hwCpqff.exe
  C:\Windows\System\hwCpqff.exe
  2⤵
  PID:8496
- C:\Windows\System\VqLwucN.exe
  C:\Windows\System\VqLwucN.exe
  2⤵
  PID:8520
- C:\Windows\System\KPUDoTo.exe
  C:\Windows\System\KPUDoTo.exe
  2⤵
  PID:8556
- C:\Windows\System\TVgVlvg.exe
  C:\Windows\System\TVgVlvg.exe
  2⤵
  PID:8584
- C:\Windows\System\pWImNzg.exe
  C:\Windows\System\pWImNzg.exe
  2⤵
  PID:8640
- C:\Windows\System\EVNaAyv.exe
  C:\Windows\System\EVNaAyv.exe
  2⤵
  PID:8656
- C:\Windows\System\txLKWam.exe
  C:\Windows\System\txLKWam.exe
  2⤵
  PID:8684
- C:\Windows\System\BXaCNAv.exe
  C:\Windows\System\BXaCNAv.exe
  2⤵
  PID:8708
- C:\Windows\System\zhKkEuX.exe
  C:\Windows\System\zhKkEuX.exe
  2⤵
  PID:8732
- C:\Windows\System\HWCymIx.exe
  C:\Windows\System\HWCymIx.exe
  2⤵
  PID:8760
- C:\Windows\System\XhjojAS.exe
  C:\Windows\System\XhjojAS.exe
  2⤵
  PID:8780
- C:\Windows\System\kHavIou.exe
  C:\Windows\System\kHavIou.exe
  2⤵
  PID:8820
- C:\Windows\System\WsFSToq.exe
  C:\Windows\System\WsFSToq.exe
  2⤵
  PID:8840
- C:\Windows\System\nGZvqxR.exe
  C:\Windows\System\nGZvqxR.exe
  2⤵
  PID:8868
- C:\Windows\System\dAqCahv.exe
  C:\Windows\System\dAqCahv.exe
  2⤵
  PID:8912
- C:\Windows\System\hffCRLC.exe
  C:\Windows\System\hffCRLC.exe
  2⤵
  PID:8936
- C:\Windows\System\fMZHQNf.exe
  C:\Windows\System\fMZHQNf.exe
  2⤵
  PID:8972
- C:\Windows\System\GOwMKWb.exe
  C:\Windows\System\GOwMKWb.exe
  2⤵
  PID:8996
- C:\Windows\System\ZSFEetq.exe
  C:\Windows\System\ZSFEetq.exe
  2⤵
  PID:9024
- C:\Windows\System\bkftphE.exe
  C:\Windows\System\bkftphE.exe
  2⤵
  PID:9052
- C:\Windows\System\nrBVLRz.exe
  C:\Windows\System\nrBVLRz.exe
  2⤵
  PID:9076
- C:\Windows\System\QXGSgqB.exe
  C:\Windows\System\QXGSgqB.exe
  2⤵
  PID:9100
- C:\Windows\System\nwRpiJY.exe
  C:\Windows\System\nwRpiJY.exe
  2⤵
  PID:9136
- C:\Windows\System\MwNGGss.exe
  C:\Windows\System\MwNGGss.exe
  2⤵
  PID:9164
- C:\Windows\System\TtSzoPC.exe
  C:\Windows\System\TtSzoPC.exe
  2⤵
  PID:9200
- C:\Windows\System\vDHZnvv.exe
  C:\Windows\System\vDHZnvv.exe
  2⤵
  PID:8048
- C:\Windows\System\rpfwccf.exe
  C:\Windows\System\rpfwccf.exe
  2⤵
  PID:8204
- C:\Windows\System\ntGxaOr.exe
  C:\Windows\System\ntGxaOr.exe
  2⤵
  PID:8324
- C:\Windows\System\WXRgxFd.exe
  C:\Windows\System\WXRgxFd.exe
  2⤵
  PID:1376
- C:\Windows\System\VGLEkfS.exe
  C:\Windows\System\VGLEkfS.exe
  2⤵
  PID:8492
- C:\Windows\System\rYZritf.exe
  C:\Windows\System\rYZritf.exe
  2⤵
  PID:8528
- C:\Windows\System\RAgpEdH.exe
  C:\Windows\System\RAgpEdH.exe
  2⤵
  PID:8568
- C:\Windows\System\MPzkPOX.exe
  C:\Windows\System\MPzkPOX.exe
  2⤵
  PID:1540
- C:\Windows\System\qWytUNQ.exe
  C:\Windows\System\qWytUNQ.exe
  2⤵
  PID:8696
- C:\Windows\System\BTMgmJb.exe
  C:\Windows\System\BTMgmJb.exe
  2⤵
  PID:8804
- C:\Windows\System\VHEOIFb.exe
  C:\Windows\System\VHEOIFb.exe
  2⤵
  PID:8860
- C:\Windows\System\ThPapTZ.exe
  C:\Windows\System\ThPapTZ.exe
  2⤵
  PID:8932
- C:\Windows\System\wnKerla.exe
  C:\Windows\System\wnKerla.exe
  2⤵
  PID:9008
- C:\Windows\System\mnIcMPk.exe
  C:\Windows\System\mnIcMPk.exe
  2⤵
  PID:9068
- C:\Windows\System\euWzUiS.exe
  C:\Windows\System\euWzUiS.exe
  2⤵
  PID:9128
- C:\Windows\System\jhsnjCl.exe
  C:\Windows\System\jhsnjCl.exe
  2⤵
  PID:9124
- C:\Windows\System\JHEhgIb.exe
  C:\Windows\System\JHEhgIb.exe
  2⤵
  PID:8264
- C:\Windows\System\uZkfCGA.exe
  C:\Windows\System\uZkfCGA.exe
  2⤵
  PID:8304
- C:\Windows\System\nNnZFHm.exe
  C:\Windows\System\nNnZFHm.exe
  2⤵
  PID:7972
- C:\Windows\System\XGBJfIQ.exe
  C:\Windows\System\XGBJfIQ.exe
  2⤵
  PID:8744
- C:\Windows\System\VXChGve.exe
  C:\Windows\System\VXChGve.exe
  2⤵
  PID:8964
- C:\Windows\System\CpfSCSY.exe
  C:\Windows\System\CpfSCSY.exe
  2⤵
  PID:8320
- C:\Windows\System\UCeIyVs.exe
  C:\Windows\System\UCeIyVs.exe
  2⤵
  PID:8772
- C:\Windows\System\sUTFMQs.exe
  C:\Windows\System\sUTFMQs.exe
  2⤵
  PID:4528
- C:\Windows\System\HhdDsrP.exe
  C:\Windows\System\HhdDsrP.exe
  2⤵
  PID:8856
- C:\Windows\System\myWKGuh.exe
  C:\Windows\System\myWKGuh.exe
  2⤵
  PID:9248
- C:\Windows\System\HCKUKUU.exe
  C:\Windows\System\HCKUKUU.exe
  2⤵
  PID:9284
- C:\Windows\System\UrVciQi.exe
  C:\Windows\System\UrVciQi.exe
  2⤵
  PID:9312
- C:\Windows\System\PeAQWRE.exe
  C:\Windows\System\PeAQWRE.exe
  2⤵
  PID:9332
- C:\Windows\System\TRbsrjV.exe
  C:\Windows\System\TRbsrjV.exe
  2⤵
  PID:9360
- C:\Windows\System\zvzsoWu.exe
  C:\Windows\System\zvzsoWu.exe
  2⤵
  PID:9416
- C:\Windows\System\UlPgQyO.exe
  C:\Windows\System\UlPgQyO.exe
  2⤵
  PID:9440
- C:\Windows\System\TjMmbVv.exe
  C:\Windows\System\TjMmbVv.exe
  2⤵
  PID:9492
- C:\Windows\System\kySBgDE.exe
  C:\Windows\System\kySBgDE.exe
  2⤵
  PID:9508
- C:\Windows\System\nggwlxN.exe
  C:\Windows\System\nggwlxN.exe
  2⤵
  PID:9540
- C:\Windows\System\pGSfbxd.exe
  C:\Windows\System\pGSfbxd.exe
  2⤵
  PID:9564
- C:\Windows\System\ZtmtnNy.exe
  C:\Windows\System\ZtmtnNy.exe
  2⤵
  PID:9584
- C:\Windows\System\VgZqkQK.exe
  C:\Windows\System\VgZqkQK.exe
  2⤵
  PID:9616
- C:\Windows\System\HrLZKyr.exe
  C:\Windows\System\HrLZKyr.exe
  2⤵
  PID:9644
- C:\Windows\System\muaylAe.exe
  C:\Windows\System\muaylAe.exe
  2⤵
  PID:9668
- C:\Windows\System\OpgdyTT.exe
  C:\Windows\System\OpgdyTT.exe
  2⤵
  PID:9696
- C:\Windows\System\PbMnInm.exe
  C:\Windows\System\PbMnInm.exe
  2⤵
  PID:9728
- C:\Windows\System\cUfEnDZ.exe
  C:\Windows\System\cUfEnDZ.exe
  2⤵
  PID:9744
- C:\Windows\System\ODBDxkj.exe
  C:\Windows\System\ODBDxkj.exe
  2⤵
  PID:9772
- C:\Windows\System\oyKsCUJ.exe
  C:\Windows\System\oyKsCUJ.exe
  2⤵
  PID:9792
- C:\Windows\System\GrnZhwk.exe
  C:\Windows\System\GrnZhwk.exe
  2⤵
  PID:9816
- C:\Windows\System\fuiAQgg.exe
  C:\Windows\System\fuiAQgg.exe
  2⤵
  PID:9840
- C:\Windows\System\XMnlSTG.exe
  C:\Windows\System\XMnlSTG.exe
  2⤵
  PID:9864
- C:\Windows\System\KsQTAvC.exe
  C:\Windows\System\KsQTAvC.exe
  2⤵
  PID:9880
- C:\Windows\System\KdGRtEi.exe
  C:\Windows\System\KdGRtEi.exe
  2⤵
  PID:9896
- C:\Windows\System\DiqGYLe.exe
  C:\Windows\System\DiqGYLe.exe
  2⤵
  PID:9924
- C:\Windows\System\ShRHqAR.exe
  C:\Windows\System\ShRHqAR.exe
  2⤵
  PID:9960
- C:\Windows\System\LglNXGR.exe
  C:\Windows\System\LglNXGR.exe
  2⤵
  PID:9992
- C:\Windows\System\cwHcqgl.exe
  C:\Windows\System\cwHcqgl.exe
  2⤵
  PID:10016
- C:\Windows\System\XCpKVqT.exe
  C:\Windows\System\XCpKVqT.exe
  2⤵
  PID:10048
- C:\Windows\System\maPmicN.exe
  C:\Windows\System\maPmicN.exe
  2⤵
  PID:10072
- C:\Windows\System\KluUFNz.exe
  C:\Windows\System\KluUFNz.exe
  2⤵
  PID:10112
- C:\Windows\System\gjtkIge.exe
  C:\Windows\System\gjtkIge.exe
  2⤵
  PID:10156
- C:\Windows\System\moSaCDW.exe
  C:\Windows\System\moSaCDW.exe
  2⤵
  PID:10208
- C:\Windows\System\HPFWDqN.exe
  C:\Windows\System\HPFWDqN.exe
  2⤵
  PID:9220
- C:\Windows\System\HUYWWNB.exe
  C:\Windows\System\HUYWWNB.exe
  2⤵
  PID:9228
- C:\Windows\System\IZEBWsv.exe
  C:\Windows\System\IZEBWsv.exe
  2⤵
  PID:9344
- C:\Windows\System\bVujfIm.exe
  C:\Windows\System\bVujfIm.exe
  2⤵
  PID:9384
- C:\Windows\System\VbIEFFm.exe
  C:\Windows\System\VbIEFFm.exe
  2⤵
  PID:9536
- C:\Windows\System\rhhFbUC.exe
  C:\Windows\System\rhhFbUC.exe
  2⤵
  PID:9608
- C:\Windows\System\LrbBkoA.exe
  C:\Windows\System\LrbBkoA.exe
  2⤵
  PID:9720
- C:\Windows\System\cBITlpq.exe
  C:\Windows\System\cBITlpq.exe
  2⤵
  PID:9736
- C:\Windows\System\FZXoLkP.exe
  C:\Windows\System\FZXoLkP.exe
  2⤵
  PID:9764
- C:\Windows\System\qylujIg.exe
  C:\Windows\System\qylujIg.exe
  2⤵
  PID:9912
- C:\Windows\System\zYKTVKe.exe
  C:\Windows\System\zYKTVKe.exe
  2⤵
  PID:9956
- C:\Windows\System\YRfOXYF.exe
  C:\Windows\System\YRfOXYF.exe
  2⤵
  PID:10008
- C:\Windows\System\sJFrrJB.exe
  C:\Windows\System\sJFrrJB.exe
  2⤵
  PID:10104
- C:\Windows\System\WxElsas.exe
  C:\Windows\System\WxElsas.exe
  2⤵
  PID:10148
- C:\Windows\System\uvbJDnF.exe
  C:\Windows\System\uvbJDnF.exe
  2⤵
  PID:9232
- C:\Windows\System\fMuywjw.exe
  C:\Windows\System\fMuywjw.exe
  2⤵
  PID:9500
- C:\Windows\System\RYLRerF.exe
  C:\Windows\System\RYLRerF.exe
  2⤵
  PID:9592
- C:\Windows\System\hWddGIv.exe
  C:\Windows\System\hWddGIv.exe
  2⤵
  PID:9848
- C:\Windows\System\lJUneRw.exe
  C:\Windows\System\lJUneRw.exe
  2⤵
  PID:9940
- C:\Windows\System\LWBGJIK.exe
  C:\Windows\System\LWBGJIK.exe
  2⤵
  PID:10056
- C:\Windows\System\OqpooqN.exe
  C:\Windows\System\OqpooqN.exe
  2⤵
  PID:9268
- C:\Windows\System\pzNYPRE.exe
  C:\Windows\System\pzNYPRE.exe
  2⤵
  PID:9784
- C:\Windows\System\TvjqCFB.exe
  C:\Windows\System\TvjqCFB.exe
  2⤵
  PID:10220
- C:\Windows\System\MgloNKl.exe
  C:\Windows\System\MgloNKl.exe
  2⤵
  PID:9304
- C:\Windows\System\ZqmOmcK.exe
  C:\Windows\System\ZqmOmcK.exe
  2⤵
  PID:10092
- C:\Windows\System\fkHqqDX.exe
  C:\Windows\System\fkHqqDX.exe
  2⤵
  PID:10268
- C:\Windows\System\eHDaEzS.exe
  C:\Windows\System\eHDaEzS.exe
  2⤵
  PID:10296
- C:\Windows\System\rjNkVHe.exe
  C:\Windows\System\rjNkVHe.exe
  2⤵
  PID:10332
- C:\Windows\System\HaTsqhV.exe
  C:\Windows\System\HaTsqhV.exe
  2⤵
  PID:10364
- C:\Windows\System\eJUTbet.exe
  C:\Windows\System\eJUTbet.exe
  2⤵
  PID:10380
- C:\Windows\System\kDIvcfY.exe
  C:\Windows\System\kDIvcfY.exe
  2⤵
  PID:10408
- C:\Windows\System\fKlioVT.exe
  C:\Windows\System\fKlioVT.exe
  2⤵
  PID:10440
- C:\Windows\System\BIkLLIB.exe
  C:\Windows\System\BIkLLIB.exe
  2⤵
  PID:10468
- C:\Windows\System\OQVRgSE.exe
  C:\Windows\System\OQVRgSE.exe
  2⤵
  PID:10492
- C:\Windows\System\zSDEKqW.exe
  C:\Windows\System\zSDEKqW.exe
  2⤵
  PID:10516
- C:\Windows\System\hgWjCnX.exe
  C:\Windows\System\hgWjCnX.exe
  2⤵
  PID:10548
- C:\Windows\System\chdtYEf.exe
  C:\Windows\System\chdtYEf.exe
  2⤵
  PID:10576
- C:\Windows\System\suGwksV.exe
  C:\Windows\System\suGwksV.exe
  2⤵
  PID:10604
- C:\Windows\System\ynmJjrj.exe
  C:\Windows\System\ynmJjrj.exe
  2⤵
  PID:10636
- C:\Windows\System\HTfKgom.exe
  C:\Windows\System\HTfKgom.exe
  2⤵
  PID:10672
- C:\Windows\System\mQFUUEt.exe
  C:\Windows\System\mQFUUEt.exe
  2⤵
  PID:10692
- C:\Windows\System\oEADlSl.exe
  C:\Windows\System\oEADlSl.exe
  2⤵
  PID:10716
- C:\Windows\System\WCRgAQt.exe
  C:\Windows\System\WCRgAQt.exe
  2⤵
  PID:10732
- C:\Windows\System\ESKBbNT.exe
  C:\Windows\System\ESKBbNT.exe
  2⤵
  PID:10768
- C:\Windows\System\mZWSFBs.exe
  C:\Windows\System\mZWSFBs.exe
  2⤵
  PID:10796
- C:\Windows\System\lbXOJEB.exe
  C:\Windows\System\lbXOJEB.exe
  2⤵
  PID:10820
- C:\Windows\System\dfwCOCc.exe
  C:\Windows\System\dfwCOCc.exe
  2⤵
  PID:10844
- C:\Windows\System\fXNCxdv.exe
  C:\Windows\System\fXNCxdv.exe
  2⤵
  PID:10860
- C:\Windows\System\NEpAAuG.exe
  C:\Windows\System\NEpAAuG.exe
  2⤵
  PID:10888
- C:\Windows\System\phjBOop.exe
  C:\Windows\System\phjBOop.exe
  2⤵
  PID:10924
- C:\Windows\System\UlZsHmv.exe
  C:\Windows\System\UlZsHmv.exe
  2⤵
  PID:10956
- C:\Windows\System\oODsSbk.exe
  C:\Windows\System\oODsSbk.exe
  2⤵
  PID:10980
- C:\Windows\System\zsVMWob.exe
  C:\Windows\System\zsVMWob.exe
  2⤵
  PID:11016
- C:\Windows\System\HOkplfA.exe
  C:\Windows\System\HOkplfA.exe
  2⤵
  PID:11052
- C:\Windows\System\Imhvgfh.exe
  C:\Windows\System\Imhvgfh.exe
  2⤵
  PID:11080
- C:\Windows\System\DxJtUDI.exe
  C:\Windows\System\DxJtUDI.exe
  2⤵
  PID:11112
- C:\Windows\System\QpzJpoK.exe
  C:\Windows\System\QpzJpoK.exe
  2⤵
  PID:11136
- C:\Windows\System\BrXchpw.exe
  C:\Windows\System\BrXchpw.exe
  2⤵
  PID:11164
- C:\Windows\System\YAiGKEU.exe
  C:\Windows\System\YAiGKEU.exe
  2⤵
  PID:11196
- C:\Windows\System\IpIpLgz.exe
  C:\Windows\System\IpIpLgz.exe
  2⤵
  PID:11224
- C:\Windows\System\uRFPhGm.exe
  C:\Windows\System\uRFPhGm.exe
  2⤵
  PID:11248
- C:\Windows\System\owTAHVE.exe
  C:\Windows\System\owTAHVE.exe
  2⤵
  PID:9932
- C:\Windows\System\ytJTPXc.exe
  C:\Windows\System\ytJTPXc.exe
  2⤵
  PID:10280
- C:\Windows\System\GSxCySB.exe
  C:\Windows\System\GSxCySB.exe
  2⤵
  PID:10320
- C:\Windows\System\BpIXWFf.exe
  C:\Windows\System\BpIXWFf.exe
  2⤵
  PID:10372
- C:\Windows\System\CCPMprE.exe
  C:\Windows\System\CCPMprE.exe
  2⤵
  PID:10488
- C:\Windows\System\ziulNra.exe
  C:\Windows\System\ziulNra.exe
  2⤵
  PID:10500
- C:\Windows\System\piDnSPm.exe
  C:\Windows\System\piDnSPm.exe
  2⤵
  PID:10628
- C:\Windows\System\jJjgnqZ.exe
  C:\Windows\System\jJjgnqZ.exe
  2⤵
  PID:10724
- C:\Windows\System\ZXLAyGp.exe
  C:\Windows\System\ZXLAyGp.exe
  2⤵
  PID:10780
- C:\Windows\System\EGvINgc.exe
  C:\Windows\System\EGvINgc.exe
  2⤵
  PID:10836
- C:\Windows\System\rksxncF.exe
  C:\Windows\System\rksxncF.exe
  2⤵
  PID:10872
- C:\Windows\System\FmDBkMF.exe
  C:\Windows\System\FmDBkMF.exe
  2⤵
  PID:10948
- C:\Windows\System\brgiIwY.exe
  C:\Windows\System\brgiIwY.exe
  2⤵
  PID:11044
- C:\Windows\System\skOznFu.exe
  C:\Windows\System\skOznFu.exe
  2⤵
  PID:11104
- C:\Windows\System\zrAlHvz.exe
  C:\Windows\System\zrAlHvz.exe
  2⤵
  PID:11152
- C:\Windows\System\ARvPATm.exe
  C:\Windows\System\ARvPATm.exe
  2⤵
  PID:11208
- C:\Windows\System\QipuHfB.exe
  C:\Windows\System\QipuHfB.exe
  2⤵
  PID:10360
- C:\Windows\System\zcdpaQi.exe
  C:\Windows\System\zcdpaQi.exe
  2⤵
  PID:10308
- C:\Windows\System\LcHHsbj.exe
  C:\Windows\System\LcHHsbj.exe
  2⤵
  PID:10524
- C:\Windows\System\gvyEfzg.exe
  C:\Windows\System\gvyEfzg.exe
  2⤵
  PID:10560
- C:\Windows\System\JJkPeKy.exe
  C:\Windows\System\JJkPeKy.exe
  2⤵
  PID:10832
- C:\Windows\System\OuHlMAG.exe
  C:\Windows\System\OuHlMAG.exe
  2⤵
  PID:11004
- C:\Windows\System\EPZjXlt.exe
  C:\Windows\System\EPZjXlt.exe
  2⤵
  PID:11120
- C:\Windows\System\wlLaTSw.exe
  C:\Windows\System\wlLaTSw.exe
  2⤵
  PID:11232
- C:\Windows\System\jmRACzL.exe
  C:\Windows\System\jmRACzL.exe
  2⤵
  PID:2816
- C:\Windows\System\rfbrcMp.exe
  C:\Windows\System\rfbrcMp.exe
  2⤵
  PID:10972
- C:\Windows\System\gOBYxrI.exe
  C:\Windows\System\gOBYxrI.exe
  2⤵
  PID:11204
- C:\Windows\System\CyabUpF.exe
  C:\Windows\System\CyabUpF.exe
  2⤵
  PID:11132
- C:\Windows\System\vRVQIqf.exe
  C:\Windows\System\vRVQIqf.exe
  2⤵
  PID:11272
- C:\Windows\System\DYCeONh.exe
  C:\Windows\System\DYCeONh.exe
  2⤵
  PID:11304
- C:\Windows\System\CVclyRX.exe
  C:\Windows\System\CVclyRX.exe
  2⤵
  PID:11324
- C:\Windows\System\yhovnQt.exe
  C:\Windows\System\yhovnQt.exe
  2⤵
  PID:11360
- C:\Windows\System\vbnuVvI.exe
  C:\Windows\System\vbnuVvI.exe
  2⤵
  PID:11384
- C:\Windows\System\aFzrIoN.exe
  C:\Windows\System\aFzrIoN.exe
  2⤵
  PID:11404
- C:\Windows\System\weKVyXm.exe
  C:\Windows\System\weKVyXm.exe
  2⤵
  PID:11444
- C:\Windows\System\gMOeclQ.exe
  C:\Windows\System\gMOeclQ.exe
  2⤵
  PID:11472
- C:\Windows\System\xqyEAVO.exe
  C:\Windows\System\xqyEAVO.exe
  2⤵
  PID:11508
- C:\Windows\System\AJugZDv.exe
  C:\Windows\System\AJugZDv.exe
  2⤵
  PID:11540
- C:\Windows\System\DuBwloS.exe
  C:\Windows\System\DuBwloS.exe
  2⤵
  PID:11556
- C:\Windows\System\MuEctFQ.exe
  C:\Windows\System\MuEctFQ.exe
  2⤵
  PID:11584
- C:\Windows\System\XNztlBV.exe
  C:\Windows\System\XNztlBV.exe
  2⤵
  PID:11612
- C:\Windows\System\sdrPrWo.exe
  C:\Windows\System\sdrPrWo.exe
  2⤵
  PID:11640
- C:\Windows\System\NGpwbgI.exe
  C:\Windows\System\NGpwbgI.exe
  2⤵
  PID:11680
- C:\Windows\System\FcuImNy.exe
  C:\Windows\System\FcuImNy.exe
  2⤵
  PID:11704
- C:\Windows\System\znzuRyv.exe
  C:\Windows\System\znzuRyv.exe
  2⤵
  PID:11736
- C:\Windows\System\JDZGcJl.exe
  C:\Windows\System\JDZGcJl.exe
  2⤵
  PID:11764
- C:\Windows\System\tXjjiXl.exe
  C:\Windows\System\tXjjiXl.exe
  2⤵
  PID:11800
- C:\Windows\System\yCfTvYM.exe
  C:\Windows\System\yCfTvYM.exe
  2⤵
  PID:11832
- C:\Windows\System\yYhmRek.exe
  C:\Windows\System\yYhmRek.exe
  2⤵
  PID:11860
- C:\Windows\System\eFOfmsU.exe
  C:\Windows\System\eFOfmsU.exe
  2⤵
  PID:11888
- C:\Windows\System\TdldfPW.exe
  C:\Windows\System\TdldfPW.exe
  2⤵
  PID:11932
- C:\Windows\System\twfpXOL.exe
  C:\Windows\System\twfpXOL.exe
  2⤵
  PID:11972
- C:\Windows\System\gJMgbQA.exe
  C:\Windows\System\gJMgbQA.exe
  2⤵
  PID:11988
- C:\Windows\System\omFDQSv.exe
  C:\Windows\System\omFDQSv.exe
  2⤵
  PID:12028
- C:\Windows\System\dXdKdum.exe
  C:\Windows\System\dXdKdum.exe
  2⤵
  PID:12056
- C:\Windows\System\XyLisnI.exe
  C:\Windows\System\XyLisnI.exe
  2⤵
  PID:12072
- C:\Windows\System\RbsWqQz.exe
  C:\Windows\System\RbsWqQz.exe
  2⤵
  PID:12100
- C:\Windows\System\ChdDRMm.exe
  C:\Windows\System\ChdDRMm.exe
  2⤵
  PID:12128
- C:\Windows\System\dCyEbpO.exe
  C:\Windows\System\dCyEbpO.exe
  2⤵
  PID:12168
- C:\Windows\System\zcYWXqX.exe
  C:\Windows\System\zcYWXqX.exe
  2⤵
  PID:12184
- C:\Windows\System\AataBMd.exe
  C:\Windows\System\AataBMd.exe
  2⤵
  PID:12200
- C:\Windows\System\mrIkmpb.exe
  C:\Windows\System\mrIkmpb.exe
  2⤵
  PID:12240
- C:\Windows\System\ZqAdeRR.exe
  C:\Windows\System\ZqAdeRR.exe
  2⤵
  PID:10804
- C:\Windows\System\xwUabHV.exe
  C:\Windows\System\xwUabHV.exe
  2⤵
  PID:11296
- C:\Windows\System\bSTvVjR.exe
  C:\Windows\System\bSTvVjR.exe
  2⤵
  PID:11332
- C:\Windows\System\QwHLAZE.exe
  C:\Windows\System\QwHLAZE.exe
  2⤵
  PID:11424
- C:\Windows\System\wfuzZHd.exe
  C:\Windows\System\wfuzZHd.exe
  2⤵
  PID:11500
- C:\Windows\System\JTRkJhi.exe
  C:\Windows\System\JTRkJhi.exe
  2⤵
  PID:11552
- C:\Windows\System\ZlHhCoR.exe
  C:\Windows\System\ZlHhCoR.exe
  2⤵
  PID:11572
- C:\Windows\System\PZCtvsF.exe
  C:\Windows\System\PZCtvsF.exe
  2⤵
  PID:11636
- C:\Windows\System\fFBxLht.exe
  C:\Windows\System\fFBxLht.exe
  2⤵
  PID:11728
- C:\Windows\System\BRaDsrz.exe
  C:\Windows\System\BRaDsrz.exe
  2⤵
  PID:11792
- C:\Windows\System\JDjEppd.exe
  C:\Windows\System\JDjEppd.exe
  2⤵
  PID:11884
- C:\Windows\System\QXwdNeD.exe
  C:\Windows\System\QXwdNeD.exe
  2⤵
  PID:11964
- C:\Windows\System\bCgQasJ.exe
  C:\Windows\System\bCgQasJ.exe
  2⤵
  PID:12064
- C:\Windows\System\iKqdhds.exe
  C:\Windows\System\iKqdhds.exe
  2⤵
  PID:4920
- C:\Windows\System\QpHhjMv.exe
  C:\Windows\System\QpHhjMv.exe
  2⤵
  PID:2216
- C:\Windows\System\EKxEVQr.exe
  C:\Windows\System\EKxEVQr.exe
  2⤵
  PID:4040
- C:\Windows\System\WuozNFP.exe
  C:\Windows\System\WuozNFP.exe
  2⤵
  PID:12220
- C:\Windows\System\QSzWGMe.exe
  C:\Windows\System\QSzWGMe.exe
  2⤵
  PID:11292
- C:\Windows\System\cfMrOyD.exe
  C:\Windows\System\cfMrOyD.exe
  2⤵
  PID:11380
- C:\Windows\System\kGBkKvx.exe
  C:\Windows\System\kGBkKvx.exe
  2⤵
  PID:11688
- C:\Windows\System\gYLbrAy.exe
  C:\Windows\System\gYLbrAy.exe
  2⤵
  PID:11776
- C:\Windows\System\pUoDoCB.exe
  C:\Windows\System\pUoDoCB.exe
  2⤵
  PID:12040
- C:\Windows\System\AiYnpMt.exe
  C:\Windows\System\AiYnpMt.exe
  2⤵
  PID:12124
- C:\Windows\System\pPFIhkb.exe
  C:\Windows\System\pPFIhkb.exe
  2⤵
  PID:12280
- C:\Windows\System\JoJTLBP.exe
  C:\Windows\System\JoJTLBP.exe
  2⤵
  PID:11320
- C:\Windows\System\xRZrIhm.exe
  C:\Windows\System\xRZrIhm.exe
  2⤵
  PID:11868
- C:\Windows\System\WcEHhDe.exe
  C:\Windows\System\WcEHhDe.exe
  2⤵
  PID:12084
- C:\Windows\System\HMvjsZD.exe
  C:\Windows\System\HMvjsZD.exe
  2⤵
  PID:11456
- C:\Windows\System\BCwvQBd.exe
  C:\Windows\System\BCwvQBd.exe
  2⤵
  PID:11848
- C:\Windows\System\kEkFOYs.exe
  C:\Windows\System\kEkFOYs.exe
  2⤵
  PID:12292
- C:\Windows\System\QvfJrUy.exe
  C:\Windows\System\QvfJrUy.exe
  2⤵
  PID:12308
- C:\Windows\System\qMDbsth.exe
  C:\Windows\System\qMDbsth.exe
  2⤵
  PID:12332
- C:\Windows\System\pUUxQZH.exe
  C:\Windows\System\pUUxQZH.exe
  2⤵
  PID:12360
- C:\Windows\System\NCmnZvD.exe
  C:\Windows\System\NCmnZvD.exe
  2⤵
  PID:12388
- C:\Windows\System\FUgOzJY.exe
  C:\Windows\System\FUgOzJY.exe
  2⤵
  PID:12412
- C:\Windows\System\UxXYaXp.exe
  C:\Windows\System\UxXYaXp.exe
  2⤵
  PID:12448
- C:\Windows\System\vBbAAea.exe
  C:\Windows\System\vBbAAea.exe
  2⤵
  PID:12488
- C:\Windows\System\YfKdxUz.exe
  C:\Windows\System\YfKdxUz.exe
  2⤵
  PID:12516
- C:\Windows\System\TOVFekb.exe
  C:\Windows\System\TOVFekb.exe
  2⤵
  PID:12552
- C:\Windows\System\jZrwzAB.exe
  C:\Windows\System\jZrwzAB.exe
  2⤵
  PID:12584
- C:\Windows\System\gVeuCDp.exe
  C:\Windows\System\gVeuCDp.exe
  2⤵
  PID:12608
- C:\Windows\System\DZEBYlD.exe
  C:\Windows\System\DZEBYlD.exe
  2⤵
  PID:12636
- C:\Windows\System\rbWzezF.exe
  C:\Windows\System\rbWzezF.exe
  2⤵
  PID:12664
- C:\Windows\System\ygITRMk.exe
  C:\Windows\System\ygITRMk.exe
  2⤵
  PID:12692
- C:\Windows\System\EoVDhpm.exe
  C:\Windows\System\EoVDhpm.exe
  2⤵
  PID:12720
- C:\Windows\System\lHypPrn.exe
  C:\Windows\System\lHypPrn.exe
  2⤵
  PID:12748
- C:\Windows\System\xYevudz.exe
  C:\Windows\System\xYevudz.exe
  2⤵
  PID:12776
- C:\Windows\System\JLXsgLW.exe
  C:\Windows\System\JLXsgLW.exe
  2⤵
  PID:12816
- C:\Windows\System\ykwDbxj.exe
  C:\Windows\System\ykwDbxj.exe
  2⤵
  PID:12840
- C:\Windows\System\CXNXiGE.exe
  C:\Windows\System\CXNXiGE.exe
  2⤵
  PID:12860
- C:\Windows\System\dISbvKk.exe
  C:\Windows\System\dISbvKk.exe
  2⤵
  PID:12900
- C:\Windows\System\ikHCjtG.exe
  C:\Windows\System\ikHCjtG.exe
  2⤵
  PID:12928
- C:\Windows\System\yxQHEeF.exe
  C:\Windows\System\yxQHEeF.exe
  2⤵
  PID:12968
- C:\Windows\System\qnoGiej.exe
  C:\Windows\System\qnoGiej.exe
  2⤵
  PID:12984
- C:\Windows\System\saDAKyJ.exe
  C:\Windows\System\saDAKyJ.exe
  2⤵
  PID:13012
- C:\Windows\System\GpkuCvv.exe
  C:\Windows\System\GpkuCvv.exe
  2⤵
  PID:13040
- C:\Windows\System\xCMWKfv.exe
  C:\Windows\System\xCMWKfv.exe
  2⤵
  PID:13060
- C:\Windows\System\aImKria.exe
  C:\Windows\System\aImKria.exe
  2⤵
  PID:13096
- C:\Windows\System\piGwbSS.exe
  C:\Windows\System\piGwbSS.exe
  2⤵
  PID:13112
- C:\Windows\System\EsSWoll.exe
  C:\Windows\System\EsSWoll.exe
  2⤵
  PID:13144
- C:\Windows\System\tLmQefQ.exe
  C:\Windows\System\tLmQefQ.exe
  2⤵
  PID:13180
- C:\Windows\System\AusUdBk.exe
  C:\Windows\System\AusUdBk.exe
  2⤵
  PID:13204

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:12688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_uwwfaqzy.cor.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uwwfaqzy.cor.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

BuaFDqJ.exe

Path C:\Windows\System\BuaFDqJ.exe
Size 2.6MB
SHA256 119d937a67bbb2e64d7b0293df6831bdaa0c1a29122c8a5c422731dd0d1ac03a
MD5 e05c2284babdfca1ad8f7d73a7b441a7
SHA1 eb39333e0fd5b246aec95c1139fc5a78042d9f34
SHA512 bb74d40a6c50676a22dd511c060aa469b8ead660a338b474e094ff455f83ed991cc94c586a60b7482eb238ea2f614b78a88d86b9d0cf60a8a01145c6820f77ba
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2r:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rl
MD5 SHA1 SHA512 SSDEEP

Submit Download

BugTeeU.exe

Path C:\Windows\System\BugTeeU.exe
Size 2.6MB
SHA256 4e688195fdd465f0782026ded80d43cc1cfbeadc550b3517fff6e320c59be543
MD5 b44332dcbcb03d9cdeb3481085090fbb
SHA1 e9b28982fb1811a86888c07cab038f1b417cdf23
SHA512 01ba70a143f1420bb22212ab91d8f0e2431ffd70d1f5f83d390cf7eb8937203da0bc2c46dffe7c8546a1d30f19f09dc20c653a51d70c27ec6e2aec65ef923c65
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2U:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Re
MD5 SHA1 SHA512 SSDEEP

Submit Download

GnqWQZO.exe

Path C:\Windows\System\GnqWQZO.exe
Size 2.6MB
SHA256 6261b7f36c0963052aa19aebe753bc6201205dc601c762c48141a2703f4c4913
MD5 99191f8ab41fc3f841c08f5ad33085ef
SHA1 f0d306d528f8d11b42c1ff08cac482545c7dc760
SHA512 c1472a033812eec5ea1a369f0751a0957ab32225fa253952a4def43ab61d652763f87c270ae2f3195555c50f379feb4e49bec2d1a56357702f643042729ef144
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2k:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Re
MD5 SHA1 SHA512 SSDEEP

Submit Download

HQRrGMX.exe

Path C:\Windows\System\HQRrGMX.exe
Size 2.6MB
SHA256 d88deeba8db6d7bf9baeb78ccbd2bdc41fa3e2afbb06c84bf574c144470ffe2c
MD5 2ee1c3b812b7fee009c96e1bbfb03bf7
SHA1 03a979a017e8b77a94e1280bf885d892af7cbc52
SHA512 462e512381695bd652ba39e44c2de4b5f6b5e08f4eb6cceb6080866f7b7aad9c17fa9187568e502f496ab0f0d6203a594385f4a136324e37ea11dc6eda8e1b4a
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2k:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RK
MD5 SHA1 SHA512 SSDEEP

Submit Download

HUkvdRk.exe

Path C:\Windows\System\HUkvdRk.exe
Size 2.6MB
SHA256 bbaa8aec133965f64f77c323ed3a0dbd43d251ad7504b9bd2ee01f7531a7693d
MD5 55846b5607443453c1e88d0d29b76ff5
SHA1 0cc5491d9d1adc7c574d3991dd5c61193df2e196
SHA512 1093f831498b9fd0a497c459e1d815c0deab3be9f9b37106b886984dd02194439dc1b569d89377b7635d92b1ba0ff5473b443ef36fce43366f24af691e52037c
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2r:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RB
MD5 SHA1 SHA512 SSDEEP

Submit Download

JKAxjxN.exe

Path C:\Windows\System\JKAxjxN.exe
Size 2.6MB
SHA256 cbe699b3c7d3bf15c1a8edf75a5d3b13c36741f80a77a3328d03957a333ababd
MD5 753bd02e8df6038be68d9818bef2192a
SHA1 d4fbc4a5734194e622be835e9a9e06f4ee441714
SHA512 e258dd329da0eb09921016887d3f24879e0a87b50e2d3d45b75b1a846a5fdc9a08cf84ec292713bad2e0c394a593d5f8ce87daddf9b52cfe9c117853646a982c
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2D:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RN
MD5 SHA1 SHA512 SSDEEP

Submit Download

JSZEwID.exe

Path C:\Windows\System\JSZEwID.exe
Size 2.6MB
SHA256 4ba704c199b92a3abef4b823ac88aabcdb5e3ea97a375433b325de53a76f4f4f
MD5 c5f0bd02146cd6bfc35eebef9e0ffe73
SHA1 be23a93adb061de9b9e085dc1e6303a506e7eaa3
SHA512 f732ece0d5b9b21d43cd419366d36d14625a6630ae80b9ace297a4af36aee8176d02bb1fb62963fee9b7d431edbae4249226ef93701c21859e40d89bb0719dba
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2Q:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R6
MD5 SHA1 SHA512 SSDEEP

Submit Download

JXqOGPd.exe

Path C:\Windows\System\JXqOGPd.exe
Size 2.6MB
SHA256 b1092ee9793251fffdbbb35a134b87b5cdf06ef019700bb841acfcd1d61ae51c
MD5 3b939141c3d457f980336bf7a8ed30c8
SHA1 2eadb9b57ecad9b6a662e874f1c041f0c4fc5af3
SHA512 97285a98492f169ffb0f1c1180eef258764b805d9c23022379aff8e866fa492e29e4a8aa7afbe31c49a1d10098216f32f2d71a9f14e45a10597ec5fe664980e2
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R26:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

KYlIaZw.exe

Path C:\Windows\System\KYlIaZw.exe
Size 2.6MB
SHA256 65c3f09e579dc2ffd977444e433382aa8fbf2223337d2cd3383b0c6835e545f3
MD5 354ab284ad08641525e07838fbf07c89
SHA1 eff0f6b91d8ecf8a5684dbb422249198d35e78ca
SHA512 dae405b61b408d4c87fa8683d58db58fdc16fabd82b18ab847b8d0056179e2561179e8e3ad30e15e6dbbe8dbd04e45177beffd3b9da87d3db06729d3282b09a0
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2C:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R8
MD5 SHA1 SHA512 SSDEEP

Submit Download

OkdVbFu.exe

Path C:\Windows\System\OkdVbFu.exe
Size 2.6MB
SHA256 e2497f24b64f141c42fc36c7741c03794ca8d6c499cb3c76c3df50d6638618b9
MD5 ba4955cd32762ce8cf72344ecdd1fb67
SHA1 b2c0997967729a716f078ba12c0385c08c5f92e5
SHA512 a44b2a4303065e8297e0c282e45d991d2b038948180e858bd5fc32d9b643160a09e789177d76eb2c6e1b65ef8d414b273f304f02942cb0ed731766f3867a93f3
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2d:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RX
MD5 SHA1 SHA512 SSDEEP

Submit Download

RBWKoOh.exe

Path C:\Windows\System\RBWKoOh.exe
Size 2.6MB
SHA256 4f6727f680147715db33d227bba565b89bde84bfb9a86d404c3db1d785d8710c
MD5 6de9b55fe79809a84edf23616329c8eb
SHA1 1e7bd33f77ab72efa46d6083891e6e098153bdfb
SHA512 238922d51a061a58257d3ef1952ac760703f70a69383edc94e543ccb94ae98aa2ac2981cdbd6bc9a945a819967b57bec72a7aba1f8b6d169ad7014ebb2c6f020
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2Z:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RX
MD5 SHA1 SHA512 SSDEEP

Submit Download

RKBpTYC.exe

Path C:\Windows\System\RKBpTYC.exe
Size 2.6MB
SHA256 a21ab9777a9747a0290944cbf4b15011b158a2f26854f285b524df7eddedc98d
MD5 e68ad263da6724f2f60c94915787e420
SHA1 4b9a9f89cebfbe28808b7ead70aa3671c8273a4e
SHA512 fb9e51f71bc9dbd460d43affa8a0964cba7be3a2089120992a2da88ae45e539ebdfb7dd142ae9a13eb8719c79fd781ab2a85e5280850eec7abd4e00d8d5962e9
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R21:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R3
MD5 SHA1 SHA512 SSDEEP

Submit Download

TekXbyc.exe

Path C:\Windows\System\TekXbyc.exe
Size 2.6MB
SHA256 2645b0ab87a116205102921d1de389f3053fd7f9684b5f4148a86c657f066499
MD5 c821fe518bbfdf28581753ae0c6530c2
SHA1 9059c40eae6291332bef0622051adad827bac899
SHA512 6688b7ba7aeadf0e6458685a6850e4e0ba2cb14b9d4dceaf2ef272b5b92ca7b5bea5dad0ee4536fe5f3f0f516228a4f40811b10ab1c1cddfde560d1cb6b4e7c7
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2d:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rz
MD5 SHA1 SHA512 SSDEEP

Submit Download

UfPuNZI.exe

Path C:\Windows\System\UfPuNZI.exe
Size 2.6MB
SHA256 0f4226d56d7505db2401c5a329395c83026044b5821393c20b5e0dc4019ae375
MD5 643f5621b31e414cfae6e209255d85b4
SHA1 5d47957695341d5b2ca7afb8303b4f7bf71eb190
SHA512 5080bb46056a43d21d7b20b726693e9d4d6118014623e1c55fe8c498c5d1b7104c281eaa308f40e212817581538780355a6d770519f69ee0f2ac49965ac144a9
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2b:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RF
MD5 SHA1 SHA512 SSDEEP

Submit Download

XXXhXZj.exe

Path C:\Windows\System\XXXhXZj.exe
Size 2.6MB
SHA256 a93aa00aa3bf232d0baf76bca0de6dc1aa90247f039b1a4e23a28bd946bb5218
MD5 9b4c8f988c9ea283b701015e0c6c702c
SHA1 1ab353e355f46a2a3054e7ecdc09cc7b6c1e9fb9
SHA512 02ee14b21bb095a4da7e46e7d2bdfb85ae6e342fe7163cc0122160ecaed1cd1307560b3fada0a297db859c790d0248af0ed03826a06907136dc0b7288e99be55
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R21:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rf
MD5 SHA1 SHA512 SSDEEP

Submit Download

cKwjlcc.exe

Path C:\Windows\System\cKwjlcc.exe
Size 2.6MB
SHA256 8e83a93dc20cfefa2e215d600c2fd801c94e57a16e3c4f3015ecb3450037993e
MD5 4d77cc5a92f775d9fa3b5ada7cb15bf2
SHA1 db2715a91327cd6676ea188f49bb9648ab8aa3e0
SHA512 4454ea409ed28a1f0b03dda1103dd261ebd6906bd04ff871c23aa5a6d41ef8dd693657e81be9a020f65f011ff9d9569ac7ec580c45b6b97eb625e518f639c883
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2b:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RN
MD5 SHA1 SHA512 SSDEEP

Submit Download

dhiIFCm.exe

Path C:\Windows\System\dhiIFCm.exe
Size 2.6MB
SHA256 fc9065467ca444bc125526be7b46c7d0cfc7adc46316463ef29c8d983977c2e9
MD5 eff1e33bebe9dbe4be36947d42544645
SHA1 4005f0ec99724e6f9328b0481da61009256c0329
SHA512 2ef899b87aec8dbdfb92cafb62603be274efc8d215f18806d59e6464cd869e6fb61cdae569eb3c1f6cd6dd496ebd82b5f6e9807415622b9d153356e9928b35b4
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R20:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Ri
MD5 SHA1 SHA512 SSDEEP

Submit Download

ecyWRtf.exe

Path C:\Windows\System\ecyWRtf.exe
Size 2.6MB
SHA256 b340f0609c17c414e467cea4f215f6d1fa27dcfcd8a08f079146556cc762c270
MD5 6c7554399924d69d47be43c35b4cb534
SHA1 5131358c30d00e798cabcdfae3f40da91e1b5dfc
SHA512 488e698d4ebcb085b2ce48d508ba8996c05dbb81d0efeff2a399475febded4b4e19bfbdae38cda7f7bfefad60c77347c94a30742c36629bcf7ac2f30b84c4c9f
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2D:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

gDEsFZq.exe

Path C:\Windows\System\gDEsFZq.exe
Size 2.6MB
SHA256 62428c1cbf3618f61f19649c4b192df8ecaa2e5d82c24d290e7611c8662a1aca
MD5 3f113b8fc95fb88f9f88b704c712e2b3
SHA1 625cd0fd32c9f68e7d68a4d714ad4a817d9e46a3
SHA512 b21b8f0fb555cc1be097e6e234434ebaa5de17296c19620c170e7c54e4a03a18db756b0e93443328f422d0c72f8a999ba5728567d5d9491952cdf77d97427bdd
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2a:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RE
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmuPbME.exe

Path C:\Windows\System\gmuPbME.exe
Size 2.6MB
SHA256 8b9f9bc928e8b6ffb438dfff67099c09d1529ee3ea6304e509b94abdbfdf810a
MD5 03817ae747005663acec08a6243a5496
SHA1 9b73d2e7977945484f803b3335a206eef8099c4e
SHA512 35bf1f1e0967d867774481c360aac2be962974668665848b746ed80b0e8b7436604e888df1bf213f0fd5fdb304281eb0cc09873836a444f4010984177324991f
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2R:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R7
MD5 SHA1 SHA512 SSDEEP

Submit Download

ianIfIL.exe

Path C:\Windows\System\ianIfIL.exe
Size 2.6MB
SHA256 796b2e43fb29ce873f0433f56322c4a6facecf5584615ae47ce09e3012a772e8
MD5 b1130d3d3def846f0df23698bbdd8d3a
SHA1 e5a9f12cbfcd3f6cc299b35811d59747343faa74
SHA512 dc13d3a096b317bc0950d0570428e506884096f94628bfc3530bd97572876445e9d5260a63c14421e0993c8ebe2355b01342134e24583d10615d9dbf4910cb52
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2X:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RB
MD5 SHA1 SHA512 SSDEEP

Submit Download

jAfVcbv.exe

Path C:\Windows\System\jAfVcbv.exe
Size 2.6MB
SHA256 72c06b912aa04d6465461b19f2ee33e1a6be271f3b904101936645bc8ed716f9
MD5 ee04e29a71a1194a0f19d5dd77ce22ca
SHA1 e3c5eaefb73f0679f2589eb900ad33667893bba7
SHA512 e25312603ac8f71c886adc2b259b452713cec0d690d29842f977a79a2511821d18567d61dd373cbc3720ee26adca6f5b9f8319d7af08ac5d4e6622593084ba3b
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2q:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RU
MD5 SHA1 SHA512 SSDEEP

Submit Download

jJnqQRk.exe

Path C:\Windows\System\jJnqQRk.exe
Size 2.6MB
SHA256 2f8c8c03255ce776a3c8346c7ee65f040a376c593684ff6e52532032b7a76b03
MD5 cddf0131cd295559963f14e4ae93f833
SHA1 00092a6dfe6154e6f69530ed8946fb38f08d1223
SHA512 40891f4915d4834f4abaae99f98c1de50c130ed92025c4bfbd57203c2c73fbf5c7a92b8cce84a956d999186f16721d4b5d00e2a26aab77b32887dcb926b88941
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2Z:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

jmtcLjj.exe

Path C:\Windows\System\jmtcLjj.exe
Size 2.6MB
SHA256 4569d306946858ee94e3dd903d2b10b5936775d97d5a4445dbe6bac7e030ebec
MD5 ac4f62bf4d6affa1ea6e44e2263d2b0d
SHA1 651686ad0626fbecb9b3db728da51357db80657c
SHA512 5cf25f3d55a529d4e278770597f8587f673e2cd6eb2fef15d5d557cb284b55856ac2adaa285618d95069a3c60db123bc93f511a642181a20a8745a85a94ac9f1
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2Z:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

jtCZJxU.exe

Path C:\Windows\System\jtCZJxU.exe
Size 2.6MB
SHA256 c78a149ac49849f4e8e23dac72f102e1b278e84aac9d73571483bd97ec293d36
MD5 04761bcd72f3963f3e6f29dab9752fca
SHA1 95a1de5ebd808eefaac294a55db633cef8a0441f
SHA512 32dc2d564ceee95a9477fe2a0abc725e92f7c8d9fb3a1487805aaee136aa021307b076ac66471b0f2774cc55ef6310177372fca5a94e02ed2ad20fda79cb23e5
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2+:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RU
MD5 SHA1 SHA512 SSDEEP

Submit Download

lFEphjt.exe

Path C:\Windows\System\lFEphjt.exe
Size 2.6MB
SHA256 4ebc7d32d29002d4d2d7982c76f5b433d253d8f86c2fae433018b8a293ee88f0
MD5 48a3884b7e7cc41194f900f6c472f6f6
SHA1 dbe6f08528d3ac668f62af50e3f964ddc32ebe1c
SHA512 ac58a2ceceafdc4c7eb6f99002748c631c76fb02afbe52f13253c81863eb72f8983b88768ee766727e650ea1747dc7791a5cf415f2fb3f34dcb2123ef95bf19b
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2k:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R6
MD5 SHA1 SHA512 SSDEEP

Submit Download

lZBowMJ.exe

Path C:\Windows\System\lZBowMJ.exe
Size 2.6MB
SHA256 10030e137505ab3b93a0eb22da5e9bc7dec6ada71251d9624437260ad4b83910
MD5 0748cb29d50cdaf5ec2a8a90d15a0297
SHA1 051745b26694e291adc6ac5a7e3e6281faf6fb02
SHA512 37cd2705277b1b71b40001f17a9c647db20421de7a01a3746eb747b127eb93e0f75061d8382c2dac17f31f44edc1a7e7b3f56236358c98ab4eba118d3f83b22f
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R24:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rm
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntoiJCE.exe

Path C:\Windows\System\ntoiJCE.exe
Size 2.6MB
SHA256 8fd60a22910a2736db82df6c93808f85d88429ca3608572bd8ab1814e11e9ed5
MD5 74ad5019d8ddfb4fd8a91ebdc18b2efa
SHA1 3e3bc12fafda696015399e43ff83703bf9b9da02
SHA512 7d95aad27d94740d346ec1a06fa103d288a93acece7a111a7d96f6fa8e37647c7e0e1b4b56ee045cdb4d5f696651e1df06e9debbd07af749c5fffaed1e556499
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R25:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RT
MD5 SHA1 SHA512 SSDEEP

Submit Download

pswcjuC.exe

Path C:\Windows\System\pswcjuC.exe
Size 2.6MB
SHA256 1ca5a81bf855d44ce4836f7344e35b4c5358ca1b5fc3757b6adaf38dc8d1ffcf
MD5 2adc2177a5b5385ff169c6cf6bf4a7c9
SHA1 8aabf0788b9185ee4cac92467e7cbef77c724923
SHA512 a4800820a4d75a588766818e37c353a2a9edd756b47d19c11f432a5b69bbb17b99c998554c35b72c8d12425c423b31bc71a487be1aba72af6478c80c9a1633b9
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2h:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rf
MD5 SHA1 SHA512 SSDEEP

Submit Download

qwMfJhU.exe

Path C:\Windows\System\qwMfJhU.exe
Size 2.6MB
SHA256 9c7acc5168a89d8258377e3cd92c263193348da9265b8a82f13a6a32808793ce
MD5 133e5778a0997690524aaaf936deb91c
SHA1 ae1cc30a9f75fd43d3ca3e7cb134998c9f0ff57d
SHA512 14962d0cba9e8393ae9e9df09279e1ca5697dafccadc21c08e45e5e6a1ae1ccbdfdb6982728974d2fbfdccb72a8bc3aa5c17893a4797d1bcdff65b96c6a67e26
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2R:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RP
MD5 SHA1 SHA512 SSDEEP

Submit Download

sjWObsK.exe

Path C:\Windows\System\sjWObsK.exe
Size 2.6MB
SHA256 45a0b8bd1894fa6ca580ee202ad19821049e8da17aca7b883ec7e096fa62a54b
MD5 4f792ed804c875611eb79b4214d10a3a
SHA1 b438f7f3c4deccd65cc700cfc42b0d8c7c366bfb
SHA512 e7e77f9abacadbb1393aafa0bb095a6f8b5c4ca0f0288fc24a0b3e9bac0dcea7587cbfe49d8928a0986a44f31c199e4494eb0c2710cdda070b8705c7cb94dc2a
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2j:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RN
MD5 SHA1 SHA512 SSDEEP

Submit Download

vGSxVis.exe

Path C:\Windows\System\vGSxVis.exe
Size 2.6MB
SHA256 571829983c7afef6b9b7aab50a739e99a4b3ea42047ec79d5afa6a8cd50bdfb1
MD5 7815e0b5ddde4a1f46e7f8ac655b50e3
SHA1 f7dd36a003f1f81917b6396c83cd0061f357b0b6
SHA512 20251249fd2438e6df629ea12ac5d1c241c56b3bbf16bfceab166aab703dd41646892b8511d901c289dfc76ea33532d870f4b2b000238dd3eb49a229a634e650
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2j:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RN
MD5 SHA1 SHA512 SSDEEP

Submit Download

wAPTivn.exe

Path C:\Windows\System\wAPTivn.exe
Size 2.6MB
SHA256 fd3fca05faab3a9ce4d4c9fd877d31bd6c63557173bdbe7524ff955e30f38b14
MD5 e86345a574874a0324afc1120a860d99
SHA1 c955ef4d29bae9b32e6565a2fb8716539a6107a6
SHA512 d3e9d76fb85a1a15152294d7316e46f31abba5a057736a3dfca93fccb86b37934d3616afb705836268d23c0378f32d8e7d0412469875ae53b70628e12b404ae6
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R25:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RP
MD5 SHA1 SHA512 SSDEEP

Submit Download

ydyoiVE.exe

Path C:\Windows\System\ydyoiVE.exe
Size 2.6MB
SHA256 cc529cfa3a779b44f66cbf5755ad815736e35ba6baca2218417d1bea0b56ae05
MD5 d1abde858a693f4576752cb6228cd1d2
SHA1 a73b37a1df7294bf4186d71528c86f5d49597efe
SHA512 ad6dfbc19460f3d8a81c34563affa31b99311a490d1a7ec89902cb1ab355d65b0e3297fc216b13cde33719ed8cf4b960d1b39189e5c40b5d8865dbe6ca4c0fc4
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2W:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/216-1-0x00000165B7120000-0x00000165B7130000-memory.dmp

Download

memory/216-2070-0x00007FF603BB0000-0x00007FF603FA6000-memory.dmp

Download

memory/216-0-0x00007FF603BB0000-0x00007FF603FA6000-memory.dmp

Download

memory/224-151-0x00007FF62A2C0000-0x00007FF62A6B6000-memory.dmp

Download

memory/224-2093-0x00007FF62A2C0000-0x00007FF62A6B6000-memory.dmp

Download

memory/664-12-0x00007FF69CB80000-0x00007FF69CF76000-memory.dmp

Download

memory/664-2071-0x00007FF69CB80000-0x00007FF69CF76000-memory.dmp

Download

memory/664-2078-0x00007FF69CB80000-0x00007FF69CF76000-memory.dmp

Download

memory/676-2088-0x00007FF7B6E40000-0x00007FF7B7236000-memory.dmp

Download

memory/676-201-0x00007FF7B6E40000-0x00007FF7B7236000-memory.dmp

Download

memory/744-2073-0x00007FF75B180000-0x00007FF75B576000-memory.dmp

Download

memory/744-2080-0x00007FF75B180000-0x00007FF75B576000-memory.dmp

Download

memory/744-42-0x00007FF75B180000-0x00007FF75B576000-memory.dmp

Download

memory/876-139-0x00007FF7CB730000-0x00007FF7CBB26000-memory.dmp

Download

memory/876-2100-0x00007FF7CB730000-0x00007FF7CBB26000-memory.dmp

Download

memory/1412-2094-0x00007FF72C9F0000-0x00007FF72CDE6000-memory.dmp

Download

memory/1412-149-0x00007FF72C9F0000-0x00007FF72CDE6000-memory.dmp

Download

memory/1532-2081-0x00007FF7BB210000-0x00007FF7BB606000-memory.dmp

Download

memory/1532-75-0x00007FF7BB210000-0x00007FF7BB606000-memory.dmp

Download

memory/1820-170-0x00007FF7661F0000-0x00007FF7665E6000-memory.dmp

Download

memory/1820-2082-0x00007FF7661F0000-0x00007FF7665E6000-memory.dmp

Download

memory/1992-150-0x00007FF600590000-0x00007FF600986000-memory.dmp

Download

memory/1992-2095-0x00007FF600590000-0x00007FF600986000-memory.dmp

Download

memory/2152-2092-0x00007FF6CF240000-0x00007FF6CF636000-memory.dmp

Download

memory/2152-152-0x00007FF6CF240000-0x00007FF6CF636000-memory.dmp

Download

memory/2324-148-0x00007FF74AA40000-0x00007FF74AE36000-memory.dmp

Download

memory/2324-2098-0x00007FF74AA40000-0x00007FF74AE36000-memory.dmp

Download

memory/2332-183-0x00007FF6E6B10000-0x00007FF6E6F06000-memory.dmp

Download

memory/2332-2084-0x00007FF6E6B10000-0x00007FF6E6F06000-memory.dmp

Download

memory/2400-2099-0x00007FF6F95F0000-0x00007FF6F99E6000-memory.dmp

Download

memory/2400-142-0x00007FF6F95F0000-0x00007FF6F99E6000-memory.dmp

Download

memory/3584-23-0x00007FF72F540000-0x00007FF72F936000-memory.dmp

Download

memory/3584-2079-0x00007FF72F540000-0x00007FF72F936000-memory.dmp

Download

memory/3584-2076-0x00007FF72F540000-0x00007FF72F936000-memory.dmp

Download

memory/3592-2074-0x00007FF738250000-0x00007FF738646000-memory.dmp

Download

memory/3592-48-0x00007FF738250000-0x00007FF738646000-memory.dmp

Download

memory/3592-2087-0x00007FF738250000-0x00007FF738646000-memory.dmp

Download

memory/3720-203-0x00007FF6DB180000-0x00007FF6DB576000-memory.dmp

Download

memory/3720-2097-0x00007FF6DB180000-0x00007FF6DB576000-memory.dmp

Download

memory/3752-2090-0x00007FF755620000-0x00007FF755A16000-memory.dmp

Download

memory/3752-117-0x00007FF755620000-0x00007FF755A16000-memory.dmp

Download

memory/4380-2075-0x00007FF7C7AC0000-0x00007FF7C7EB6000-memory.dmp

Download

memory/4380-2085-0x00007FF7C7AC0000-0x00007FF7C7EB6000-memory.dmp

Download

memory/4380-60-0x00007FF7C7AC0000-0x00007FF7C7EB6000-memory.dmp

Download

memory/4444-14-0x00007FF841563000-0x00007FF841565000-memory.dmp

Download

memory/4444-13-0x000001895AB10000-0x000001895AB20000-memory.dmp

Download

memory/4444-128-0x000001895C8C0000-0x000001895C8E2000-memory.dmp

Download

memory/4444-2072-0x00007FF841563000-0x00007FF841565000-memory.dmp

Download

memory/4444-249-0x00000189777A0000-0x0000018977F46000-memory.dmp

Download

memory/4488-2089-0x00007FF7B1370000-0x00007FF7B1766000-memory.dmp

Download

memory/4488-95-0x00007FF7B1370000-0x00007FF7B1766000-memory.dmp

Download

memory/4632-2101-0x00007FF7FB2F0000-0x00007FF7FB6E6000-memory.dmp

Download

memory/4632-204-0x00007FF7FB2F0000-0x00007FF7FB6E6000-memory.dmp

Download

memory/4848-187-0x00007FF6553F0000-0x00007FF6557E6000-memory.dmp

Download

memory/4848-2091-0x00007FF6553F0000-0x00007FF6557E6000-memory.dmp

Download

memory/4928-112-0x00007FF607E30000-0x00007FF608226000-memory.dmp

Download

memory/4928-2086-0x00007FF607E30000-0x00007FF608226000-memory.dmp

Download

memory/4932-143-0x00007FF6D2170000-0x00007FF6D2566000-memory.dmp

Download

memory/4932-2096-0x00007FF6D2170000-0x00007FF6D2566000-memory.dmp

Download

memory/5056-2083-0x00007FF7AA3E0000-0x00007FF7AA7D6000-memory.dmp

Download

memory/5056-2077-0x00007FF7AA3E0000-0x00007FF7AA7D6000-memory.dmp

Download

memory/5056-50-0x00007FF7AA3E0000-0x00007FF7AA7D6000-memory.dmp

Download