xmrig | 9aaedd28a1063d8bc7ad9ce7354d380f632ddca0ad9d7cc5241dce48fc5d7842

Analysis

max time kernel
108s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 22:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
Size 2.9MB
Sample240523-2wkrpacd57
SHA256 9aaedd28a1063d8bc7ad9ce7354d380f632ddca0ad9d7cc5241dce48fc5d7842
MD5 9e39cd2c243f403d37d6048fc25c8b90
SHA1 05adde4d2edab6913768c5ff18d711c394de023e
SHA512 4e3522582eb89fea2a11550b912ffdffa0a7b5a79beebdf716b307e50c0bcc6b10f3f5f137a0705abd1b6cb4984059d6ad8fde41a733ba912a32f1c60d151df7
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz3y:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1412-0-0x00007FF6286E0000-0x00007FF628AD6000-memory.dmp	xmrig
behavioral2/files/0x000b00000002340e-6.dat	xmrig
behavioral2/files/0x000700000002341b-9.dat	xmrig
behavioral2/files/0x000700000002341c-8.dat	xmrig
behavioral2/files/0x000700000002341e-27.dat	xmrig
behavioral2/files/0x0007000000023423-48.dat	xmrig
behavioral2/files/0x0007000000023428-85.dat	xmrig
behavioral2/memory/1404-92-0x00007FF714B50000-0x00007FF714F46000-memory.dmp	xmrig
behavioral2/files/0x000700000002342c-112.dat	xmrig
behavioral2/files/0x000700000002342e-119.dat	xmrig
behavioral2/memory/4100-122-0x00007FF694450000-0x00007FF694846000-memory.dmp	xmrig
behavioral2/memory/3372-125-0x00007FF6ECFA0000-0x00007FF6ED396000-memory.dmp	xmrig
behavioral2/files/0x000700000002342f-138.dat	xmrig
behavioral2/files/0x0007000000023431-142.dat	xmrig
behavioral2/files/0x0007000000023438-164.dat	xmrig
behavioral2/memory/3180-193-0x00007FF6BA8A0000-0x00007FF6BAC96000-memory.dmp	xmrig
behavioral2/memory/2184-197-0x00007FF7AC4F0000-0x00007FF7AC8E6000-memory.dmp	xmrig
behavioral2/memory/1372-199-0x00007FF6DB100000-0x00007FF6DB4F6000-memory.dmp	xmrig
behavioral2/memory/4404-198-0x00007FF7E7310000-0x00007FF7E7706000-memory.dmp	xmrig
behavioral2/memory/3492-196-0x00007FF681520000-0x00007FF681916000-memory.dmp	xmrig
behavioral2/memory/2956-195-0x00007FF6A9560000-0x00007FF6A9956000-memory.dmp	xmrig
behavioral2/memory/1492-194-0x00007FF6989F0000-0x00007FF698DE6000-memory.dmp	xmrig
behavioral2/memory/1940-192-0x00007FF6BB750000-0x00007FF6BBB46000-memory.dmp	xmrig
behavioral2/memory/3292-191-0x00007FF70E6C0000-0x00007FF70EAB6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023437-187.dat	xmrig
behavioral2/files/0x0007000000023436-185.dat	xmrig
behavioral2/files/0x0007000000023435-183.dat	xmrig
behavioral2/files/0x0007000000023434-181.dat	xmrig
behavioral2/files/0x0007000000023433-179.dat	xmrig
behavioral2/files/0x0007000000023432-177.dat	xmrig
behavioral2/memory/2424-176-0x00007FF7B8EE0000-0x00007FF7B92D6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023430-172.dat	xmrig
behavioral2/files/0x0008000000023429-170.dat	xmrig
behavioral2/files/0x0008000000023418-168.dat	xmrig
behavioral2/memory/5116-165-0x00007FF789E50000-0x00007FF78A246000-memory.dmp	xmrig
behavioral2/memory/3512-155-0x00007FF799CF0000-0x00007FF79A0E6000-memory.dmp	xmrig
behavioral2/memory/2356-131-0x00007FF6AA320000-0x00007FF6AA716000-memory.dmp	xmrig
behavioral2/memory/2596-126-0x00007FF787330000-0x00007FF787726000-memory.dmp	xmrig
behavioral2/memory/3936-124-0x00007FF6F1120000-0x00007FF6F1516000-memory.dmp	xmrig
behavioral2/memory/1864-123-0x00007FF769390000-0x00007FF769786000-memory.dmp	xmrig
behavioral2/memory/4552-121-0x00007FF778360000-0x00007FF778756000-memory.dmp	xmrig
behavioral2/files/0x000700000002342d-117.dat	xmrig
behavioral2/memory/1888-116-0x00007FF779D50000-0x00007FF77A146000-memory.dmp	xmrig
behavioral2/files/0x000800000002342a-114.dat	xmrig
behavioral2/memory/1124-111-0x00007FF69C360000-0x00007FF69C756000-memory.dmp	xmrig
behavioral2/memory/412-110-0x00007FF715AF0000-0x00007FF715EE6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023427-107.dat	xmrig
behavioral2/files/0x000700000002342b-105.dat	xmrig
behavioral2/files/0x0007000000023426-96.dat	xmrig
behavioral2/files/0x0007000000023425-94.dat	xmrig
behavioral2/files/0x0007000000023424-63.dat	xmrig
behavioral2/files/0x0007000000023422-60.dat	xmrig
behavioral2/files/0x0007000000023421-56.dat	xmrig
behavioral2/files/0x0007000000023420-54.dat	xmrig
behavioral2/files/0x000700000002341f-42.dat	xmrig
behavioral2/memory/5020-39-0x00007FF77E520000-0x00007FF77E916000-memory.dmp	xmrig
behavioral2/files/0x000700000002341d-37.dat	xmrig
behavioral2/memory/1492-2474-0x00007FF6989F0000-0x00007FF698DE6000-memory.dmp	xmrig
behavioral2/memory/5020-2475-0x00007FF77E520000-0x00007FF77E916000-memory.dmp	xmrig
behavioral2/memory/1124-2476-0x00007FF69C360000-0x00007FF69C756000-memory.dmp	xmrig
behavioral2/memory/412-2477-0x00007FF715AF0000-0x00007FF715EE6000-memory.dmp	xmrig
behavioral2/memory/1404-2478-0x00007FF714B50000-0x00007FF714F46000-memory.dmp	xmrig
behavioral2/memory/1888-2479-0x00007FF779D50000-0x00007FF77A146000-memory.dmp	xmrig
behavioral2/memory/2356-2486-0x00007FF6AA320000-0x00007FF6AA716000-memory.dmp	xmrig

Blocklisted process makes network request 7 IoCs

flow	pid	Process
10	3224	powershell.exe
12	3224	powershell.exe
14	3224	powershell.exe
15	3224	powershell.exe
17	3224	powershell.exe
18	3224	powershell.exe
19	3224	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3224	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1492	YVJdrXW.exe
5020	YQMGeBi.exe
1404	EmTayMX.exe
412	duuEErD.exe
1124	lxCflva.exe
1888	aqDObGM.exe
2956	MBRYqJI.exe
4552	hbNHTaD.exe
3492	soJQKqm.exe
4100	FFhSnaA.exe
1864	zMHbfNH.exe
3936	SFJjrKJ.exe
3372	wwYIQGP.exe
2596	wUwMuPs.exe
2356	lLpGBhk.exe
2184	WvXvrCE.exe
3512	XryrajB.exe
4404	fJTbuAO.exe
5116	NPVTdtB.exe
2424	NAXQXBE.exe
1372	tAeSYJG.exe
3292	VghrjZZ.exe
1940	rrzmAmz.exe
3180	lkdfAnm.exe
1908	XYRyMVz.exe
5000	nNOeHrv.exe
4040	gQhIEmU.exe
3536	bAAjYHL.exe
2576	mdPMQMO.exe
2040	joyelUu.exe
3572	JxJagUt.exe
3216	lOPDdWy.exe
548	kyYfjbO.exe
100	VPBboqM.exe
4468	hQRjudJ.exe
868	xaMeyfo.exe
2016	mZBtrRH.exe
388	hFPBMgE.exe
2948	FmpmVNT.exe
1424	nCTweBM.exe
2056	VKSKSmD.exe
4332	pHnqyAB.exe
1560	KNqPGCE.exe
576	hqxPbYx.exe
3088	oIawqZC.exe
3516	lommIzL.exe
4004	pTcrivb.exe
4124	nBgVdRV.exe
3692	FAhusgd.exe
4732	vRQKOgv.exe
4104	bjwkgno.exe
4396	rmrdZvE.exe
3876	vYDzmBQ.exe
4708	qPdOHku.exe
4564	YYmtZPl.exe
4276	DsTTwZL.exe
2660	ywegTZB.exe
5024	nzNYglt.exe
1052	SowPNEK.exe
4776	InwyYZP.exe
4156	BLVoMRH.exe
4508	UcLWlyY.exe
2588	LpBGMnw.exe
3280	YLgPCzL.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1412-0-0x00007FF6286E0000-0x00007FF628AD6000-memory.dmp	upx
behavioral2/files/0x000b00000002340e-6.dat	upx
behavioral2/files/0x000700000002341b-9.dat	upx
behavioral2/files/0x000700000002341c-8.dat	upx
behavioral2/files/0x000700000002341e-27.dat	upx
behavioral2/files/0x0007000000023423-48.dat	upx
behavioral2/files/0x0007000000023428-85.dat	upx
behavioral2/memory/1404-92-0x00007FF714B50000-0x00007FF714F46000-memory.dmp	upx
behavioral2/files/0x000700000002342c-112.dat	upx
behavioral2/files/0x000700000002342e-119.dat	upx
behavioral2/memory/4100-122-0x00007FF694450000-0x00007FF694846000-memory.dmp	upx
behavioral2/memory/3372-125-0x00007FF6ECFA0000-0x00007FF6ED396000-memory.dmp	upx
behavioral2/files/0x000700000002342f-138.dat	upx
behavioral2/files/0x0007000000023431-142.dat	upx
behavioral2/files/0x0007000000023438-164.dat	upx
behavioral2/memory/3180-193-0x00007FF6BA8A0000-0x00007FF6BAC96000-memory.dmp	upx
behavioral2/memory/2184-197-0x00007FF7AC4F0000-0x00007FF7AC8E6000-memory.dmp	upx
behavioral2/memory/1372-199-0x00007FF6DB100000-0x00007FF6DB4F6000-memory.dmp	upx
behavioral2/memory/4404-198-0x00007FF7E7310000-0x00007FF7E7706000-memory.dmp	upx
behavioral2/memory/3492-196-0x00007FF681520000-0x00007FF681916000-memory.dmp	upx
behavioral2/memory/2956-195-0x00007FF6A9560000-0x00007FF6A9956000-memory.dmp	upx
behavioral2/memory/1492-194-0x00007FF6989F0000-0x00007FF698DE6000-memory.dmp	upx
behavioral2/memory/1940-192-0x00007FF6BB750000-0x00007FF6BBB46000-memory.dmp	upx
behavioral2/memory/3292-191-0x00007FF70E6C0000-0x00007FF70EAB6000-memory.dmp	upx
behavioral2/files/0x0007000000023437-187.dat	upx
behavioral2/files/0x0007000000023436-185.dat	upx
behavioral2/files/0x0007000000023435-183.dat	upx
behavioral2/files/0x0007000000023434-181.dat	upx
behavioral2/files/0x0007000000023433-179.dat	upx
behavioral2/files/0x0007000000023432-177.dat	upx
behavioral2/memory/2424-176-0x00007FF7B8EE0000-0x00007FF7B92D6000-memory.dmp	upx
behavioral2/files/0x0007000000023430-172.dat	upx
behavioral2/files/0x0008000000023429-170.dat	upx
behavioral2/files/0x0008000000023418-168.dat	upx
behavioral2/memory/5116-165-0x00007FF789E50000-0x00007FF78A246000-memory.dmp	upx
behavioral2/memory/3512-155-0x00007FF799CF0000-0x00007FF79A0E6000-memory.dmp	upx
behavioral2/memory/2356-131-0x00007FF6AA320000-0x00007FF6AA716000-memory.dmp	upx
behavioral2/memory/2596-126-0x00007FF787330000-0x00007FF787726000-memory.dmp	upx
behavioral2/memory/3936-124-0x00007FF6F1120000-0x00007FF6F1516000-memory.dmp	upx
behavioral2/memory/1864-123-0x00007FF769390000-0x00007FF769786000-memory.dmp	upx
behavioral2/memory/4552-121-0x00007FF778360000-0x00007FF778756000-memory.dmp	upx
behavioral2/files/0x000700000002342d-117.dat	upx
behavioral2/memory/1888-116-0x00007FF779D50000-0x00007FF77A146000-memory.dmp	upx
behavioral2/files/0x000800000002342a-114.dat	upx
behavioral2/memory/1124-111-0x00007FF69C360000-0x00007FF69C756000-memory.dmp	upx
behavioral2/memory/412-110-0x00007FF715AF0000-0x00007FF715EE6000-memory.dmp	upx
behavioral2/files/0x0007000000023427-107.dat	upx
behavioral2/files/0x000700000002342b-105.dat	upx
behavioral2/files/0x0007000000023426-96.dat	upx
behavioral2/files/0x0007000000023425-94.dat	upx
behavioral2/files/0x0007000000023424-63.dat	upx
behavioral2/files/0x0007000000023422-60.dat	upx
behavioral2/files/0x0007000000023421-56.dat	upx
behavioral2/files/0x0007000000023420-54.dat	upx
behavioral2/files/0x000700000002341f-42.dat	upx
behavioral2/memory/5020-39-0x00007FF77E520000-0x00007FF77E916000-memory.dmp	upx
behavioral2/files/0x000700000002341d-37.dat	upx
behavioral2/memory/1492-2474-0x00007FF6989F0000-0x00007FF698DE6000-memory.dmp	upx
behavioral2/memory/5020-2475-0x00007FF77E520000-0x00007FF77E916000-memory.dmp	upx
behavioral2/memory/1124-2476-0x00007FF69C360000-0x00007FF69C756000-memory.dmp	upx
behavioral2/memory/412-2477-0x00007FF715AF0000-0x00007FF715EE6000-memory.dmp	upx
behavioral2/memory/1404-2478-0x00007FF714B50000-0x00007FF714F46000-memory.dmp	upx
behavioral2/memory/1888-2479-0x00007FF779D50000-0x00007FF77A146000-memory.dmp	upx
behavioral2/memory/2356-2486-0x00007FF6AA320000-0x00007FF6AA716000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NrVqdJX.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\xuKHkvg.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\JKEQNgB.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\iMFgnLg.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\GtydcjS.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\CTECeTU.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\JdJvdEx.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\vcjhQKz.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\ITTPMIW.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\nuFZvBF.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\FLCSrWF.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\HYkSaad.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\DhURUSN.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\wtBepKd.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\lsziWjg.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\ATgkkDB.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\oFpKZao.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\xioJBHo.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\GNeUBIM.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\NidrjEX.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\zdZAPHN.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\gCdjRpL.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\JeEpzwC.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\jGozsYh.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\zHXhdhs.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\gXUuhNe.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\tamzTTd.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\OwoqqdH.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\gonANbv.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\BhMepkT.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\sDuqTnM.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\ZndBQtx.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\XTNgoDT.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\DmmEqkS.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\UHuZpIc.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\rfpBTua.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\JhcFnXJ.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\gPWiBYH.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\soEOnGq.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\OJmWPwZ.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\VqVDhxU.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\jQNsfhT.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\mhQXdaK.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\WFoPZoK.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\HNNQHmN.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\dqZUQxt.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\xbMlSIQ.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\NjoKeAm.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\hINYmhE.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\KETYINN.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\TXZVxdJ.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\yMbtdPN.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\OZOrUDv.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\pAqIkQt.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\snkXQyh.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\Ccmtqka.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\KnKTrGc.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\nzuZRlI.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\CJyIXID.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\KmIgknV.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\vCpCBSz.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\dWyYZUL.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\lMcDmIo.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
File created	C:\Windows\System\paiveQy.exe	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3224	powershell.exe
3224	powershell.exe
3224	powershell.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
Token: SeDebugPrivilege	3224	powershell.exe
Token: SeCreateGlobalPrivilege	6548	dwm.exe
Token: SeChangeNotifyPrivilege	6548	dwm.exe
Token: 33	6548	dwm.exe
Token: SeIncBasePriorityPrivilege	6548	dwm.exe
Token: SeShutdownPrivilege	6548	dwm.exe
Token: SeCreatePagefilePrivilege	6548	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 3224	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	84
PID 1412 wrote to memory of 3224	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	84
PID 1412 wrote to memory of 1492	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	85
PID 1412 wrote to memory of 1492	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	85
PID 1412 wrote to memory of 5020	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	86
PID 1412 wrote to memory of 5020	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	86
PID 1412 wrote to memory of 1404	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	87
PID 1412 wrote to memory of 1404	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	87
PID 1412 wrote to memory of 1124	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	88
PID 1412 wrote to memory of 1124	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	88
PID 1412 wrote to memory of 412	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	89
PID 1412 wrote to memory of 412	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	89
PID 1412 wrote to memory of 1888	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	90
PID 1412 wrote to memory of 1888	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	90
PID 1412 wrote to memory of 2956	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	91
PID 1412 wrote to memory of 2956	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	91
PID 1412 wrote to memory of 4552	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	92
PID 1412 wrote to memory of 4552	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	92
PID 1412 wrote to memory of 3492	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	93
PID 1412 wrote to memory of 3492	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	93
PID 1412 wrote to memory of 4100	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	94
PID 1412 wrote to memory of 4100	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	94
PID 1412 wrote to memory of 1864	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	95
PID 1412 wrote to memory of 1864	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	95
PID 1412 wrote to memory of 3936	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	96
PID 1412 wrote to memory of 3936	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	96
PID 1412 wrote to memory of 3372	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	97
PID 1412 wrote to memory of 3372	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	97
PID 1412 wrote to memory of 2596	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	98
PID 1412 wrote to memory of 2596	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	98
PID 1412 wrote to memory of 2356	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	99
PID 1412 wrote to memory of 2356	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	99
PID 1412 wrote to memory of 2184	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	100
PID 1412 wrote to memory of 2184	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	100
PID 1412 wrote to memory of 3512	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	101
PID 1412 wrote to memory of 3512	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	101
PID 1412 wrote to memory of 4404	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	102
PID 1412 wrote to memory of 4404	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	102
PID 1412 wrote to memory of 5116	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	103
PID 1412 wrote to memory of 5116	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	103
PID 1412 wrote to memory of 2424	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	104
PID 1412 wrote to memory of 2424	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	104
PID 1412 wrote to memory of 1372	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	105
PID 1412 wrote to memory of 1372	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	105
PID 1412 wrote to memory of 3292	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	106
PID 1412 wrote to memory of 3292	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	106
PID 1412 wrote to memory of 1940	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	107
PID 1412 wrote to memory of 1940	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	107
PID 1412 wrote to memory of 3180	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	108
PID 1412 wrote to memory of 3180	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	108
PID 1412 wrote to memory of 1908	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	109
PID 1412 wrote to memory of 1908	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	109
PID 1412 wrote to memory of 5000	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	110
PID 1412 wrote to memory of 5000	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	110
PID 1412 wrote to memory of 4040	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	111
PID 1412 wrote to memory of 4040	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	111
PID 1412 wrote to memory of 3536	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	112
PID 1412 wrote to memory of 3536	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	112
PID 1412 wrote to memory of 2576	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	113
PID 1412 wrote to memory of 2576	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	113
PID 1412 wrote to memory of 2040	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	114
PID 1412 wrote to memory of 2040	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	114
PID 1412 wrote to memory of 3572	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	115
PID 1412 wrote to memory of 3572	1412	9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9e39cd2c243f403d37d6048fc25c8b90_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3224
- C:\Windows\System\YVJdrXW.exe
  C:\Windows\System\YVJdrXW.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\YQMGeBi.exe
  C:\Windows\System\YQMGeBi.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\EmTayMX.exe
  C:\Windows\System\EmTayMX.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\lxCflva.exe
  C:\Windows\System\lxCflva.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\duuEErD.exe
  C:\Windows\System\duuEErD.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\aqDObGM.exe
  C:\Windows\System\aqDObGM.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\MBRYqJI.exe
  C:\Windows\System\MBRYqJI.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\hbNHTaD.exe
  C:\Windows\System\hbNHTaD.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\soJQKqm.exe
  C:\Windows\System\soJQKqm.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\FFhSnaA.exe
  C:\Windows\System\FFhSnaA.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\zMHbfNH.exe
  C:\Windows\System\zMHbfNH.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\SFJjrKJ.exe
  C:\Windows\System\SFJjrKJ.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\wwYIQGP.exe
  C:\Windows\System\wwYIQGP.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\wUwMuPs.exe
  C:\Windows\System\wUwMuPs.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\lLpGBhk.exe
  C:\Windows\System\lLpGBhk.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\WvXvrCE.exe
  C:\Windows\System\WvXvrCE.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\XryrajB.exe
  C:\Windows\System\XryrajB.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\fJTbuAO.exe
  C:\Windows\System\fJTbuAO.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\NPVTdtB.exe
  C:\Windows\System\NPVTdtB.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\NAXQXBE.exe
  C:\Windows\System\NAXQXBE.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\tAeSYJG.exe
  C:\Windows\System\tAeSYJG.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\VghrjZZ.exe
  C:\Windows\System\VghrjZZ.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\rrzmAmz.exe
  C:\Windows\System\rrzmAmz.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\lkdfAnm.exe
  C:\Windows\System\lkdfAnm.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\XYRyMVz.exe
  C:\Windows\System\XYRyMVz.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\nNOeHrv.exe
  C:\Windows\System\nNOeHrv.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\gQhIEmU.exe
  C:\Windows\System\gQhIEmU.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\bAAjYHL.exe
  C:\Windows\System\bAAjYHL.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\mdPMQMO.exe
  C:\Windows\System\mdPMQMO.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\joyelUu.exe
  C:\Windows\System\joyelUu.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\JxJagUt.exe
  C:\Windows\System\JxJagUt.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\lOPDdWy.exe
  C:\Windows\System\lOPDdWy.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\kyYfjbO.exe
  C:\Windows\System\kyYfjbO.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\VPBboqM.exe
  C:\Windows\System\VPBboqM.exe
  2⤵
  - Executes dropped EXE
  PID:100
- C:\Windows\System\hQRjudJ.exe
  C:\Windows\System\hQRjudJ.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\xaMeyfo.exe
  C:\Windows\System\xaMeyfo.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\mZBtrRH.exe
  C:\Windows\System\mZBtrRH.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\hFPBMgE.exe
  C:\Windows\System\hFPBMgE.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\FmpmVNT.exe
  C:\Windows\System\FmpmVNT.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\nCTweBM.exe
  C:\Windows\System\nCTweBM.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\VKSKSmD.exe
  C:\Windows\System\VKSKSmD.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\pHnqyAB.exe
  C:\Windows\System\pHnqyAB.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\KNqPGCE.exe
  C:\Windows\System\KNqPGCE.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\hqxPbYx.exe
  C:\Windows\System\hqxPbYx.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\oIawqZC.exe
  C:\Windows\System\oIawqZC.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\lommIzL.exe
  C:\Windows\System\lommIzL.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\pTcrivb.exe
  C:\Windows\System\pTcrivb.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\nBgVdRV.exe
  C:\Windows\System\nBgVdRV.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\FAhusgd.exe
  C:\Windows\System\FAhusgd.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\vRQKOgv.exe
  C:\Windows\System\vRQKOgv.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\bjwkgno.exe
  C:\Windows\System\bjwkgno.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\rmrdZvE.exe
  C:\Windows\System\rmrdZvE.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\vYDzmBQ.exe
  C:\Windows\System\vYDzmBQ.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\qPdOHku.exe
  C:\Windows\System\qPdOHku.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\YYmtZPl.exe
  C:\Windows\System\YYmtZPl.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\DsTTwZL.exe
  C:\Windows\System\DsTTwZL.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\ywegTZB.exe
  C:\Windows\System\ywegTZB.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\nzNYglt.exe
  C:\Windows\System\nzNYglt.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\SowPNEK.exe
  C:\Windows\System\SowPNEK.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\InwyYZP.exe
  C:\Windows\System\InwyYZP.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\BLVoMRH.exe
  C:\Windows\System\BLVoMRH.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\UcLWlyY.exe
  C:\Windows\System\UcLWlyY.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\LpBGMnw.exe
  C:\Windows\System\LpBGMnw.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\sBhFnTB.exe
  C:\Windows\System\sBhFnTB.exe
  2⤵
  PID:1500
- C:\Windows\System\YLgPCzL.exe
  C:\Windows\System\YLgPCzL.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\xhWOHOD.exe
  C:\Windows\System\xhWOHOD.exe
  2⤵
  PID:2452
- C:\Windows\System\RZMniFR.exe
  C:\Windows\System\RZMniFR.exe
  2⤵
  PID:5052
- C:\Windows\System\NRUjwaw.exe
  C:\Windows\System\NRUjwaw.exe
  2⤵
  PID:2152
- C:\Windows\System\SnBxxgE.exe
  C:\Windows\System\SnBxxgE.exe
  2⤵
  PID:3716
- C:\Windows\System\gljOhsG.exe
  C:\Windows\System\gljOhsG.exe
  2⤵
  PID:1964
- C:\Windows\System\ErxobPb.exe
  C:\Windows\System\ErxobPb.exe
  2⤵
  PID:404
- C:\Windows\System\EeVeKww.exe
  C:\Windows\System\EeVeKww.exe
  2⤵
  PID:1388
- C:\Windows\System\AdIXSfn.exe
  C:\Windows\System\AdIXSfn.exe
  2⤵
  PID:1512
- C:\Windows\System\XmTOnQl.exe
  C:\Windows\System\XmTOnQl.exe
  2⤵
  PID:2604
- C:\Windows\System\DPNzYki.exe
  C:\Windows\System\DPNzYki.exe
  2⤵
  PID:756
- C:\Windows\System\WTIYZZd.exe
  C:\Windows\System\WTIYZZd.exe
  2⤵
  PID:1704
- C:\Windows\System\TcUgBWY.exe
  C:\Windows\System\TcUgBWY.exe
  2⤵
  PID:4364
- C:\Windows\System\DFuPUkS.exe
  C:\Windows\System\DFuPUkS.exe
  2⤵
  PID:1216
- C:\Windows\System\DCaCtKt.exe
  C:\Windows\System\DCaCtKt.exe
  2⤵
  PID:1120
- C:\Windows\System\KcjcJPF.exe
  C:\Windows\System\KcjcJPF.exe
  2⤵
  PID:4484
- C:\Windows\System\dYPsBYg.exe
  C:\Windows\System\dYPsBYg.exe
  2⤵
  PID:4056
- C:\Windows\System\BrYEQkh.exe
  C:\Windows\System\BrYEQkh.exe
  2⤵
  PID:3540
- C:\Windows\System\KZKHtkf.exe
  C:\Windows\System\KZKHtkf.exe
  2⤵
  PID:3408
- C:\Windows\System\HItNGTv.exe
  C:\Windows\System\HItNGTv.exe
  2⤵
  PID:1464
- C:\Windows\System\PYDcmkQ.exe
  C:\Windows\System\PYDcmkQ.exe
  2⤵
  PID:4740
- C:\Windows\System\QRTpNAG.exe
  C:\Windows\System\QRTpNAG.exe
  2⤵
  PID:1320
- C:\Windows\System\FkqWrOK.exe
  C:\Windows\System\FkqWrOK.exe
  2⤵
  PID:428
- C:\Windows\System\JjLPwpm.exe
  C:\Windows\System\JjLPwpm.exe
  2⤵
  PID:3748
- C:\Windows\System\QsvtWsf.exe
  C:\Windows\System\QsvtWsf.exe
  2⤵
  PID:5136
- C:\Windows\System\fcYoiFj.exe
  C:\Windows\System\fcYoiFj.exe
  2⤵
  PID:5172
- C:\Windows\System\CFTDApL.exe
  C:\Windows\System\CFTDApL.exe
  2⤵
  PID:5200
- C:\Windows\System\FBOLBjm.exe
  C:\Windows\System\FBOLBjm.exe
  2⤵
  PID:5248
- C:\Windows\System\ypmNPbj.exe
  C:\Windows\System\ypmNPbj.exe
  2⤵
  PID:5288
- C:\Windows\System\AkoKZnr.exe
  C:\Windows\System\AkoKZnr.exe
  2⤵
  PID:5308
- C:\Windows\System\MKdYFFM.exe
  C:\Windows\System\MKdYFFM.exe
  2⤵
  PID:5332
- C:\Windows\System\RqMksKt.exe
  C:\Windows\System\RqMksKt.exe
  2⤵
  PID:5372
- C:\Windows\System\EqFApzC.exe
  C:\Windows\System\EqFApzC.exe
  2⤵
  PID:5392
- C:\Windows\System\ufqSqjo.exe
  C:\Windows\System\ufqSqjo.exe
  2⤵
  PID:5424
- C:\Windows\System\TedPaTy.exe
  C:\Windows\System\TedPaTy.exe
  2⤵
  PID:5472
- C:\Windows\System\UMYKbiG.exe
  C:\Windows\System\UMYKbiG.exe
  2⤵
  PID:5508
- C:\Windows\System\VTCcPUd.exe
  C:\Windows\System\VTCcPUd.exe
  2⤵
  PID:5548
- C:\Windows\System\aSQgilK.exe
  C:\Windows\System\aSQgilK.exe
  2⤵
  PID:5588
- C:\Windows\System\bEtngMn.exe
  C:\Windows\System\bEtngMn.exe
  2⤵
  PID:5628
- C:\Windows\System\aQajWod.exe
  C:\Windows\System\aQajWod.exe
  2⤵
  PID:5644
- C:\Windows\System\OXtmoQh.exe
  C:\Windows\System\OXtmoQh.exe
  2⤵
  PID:5660
- C:\Windows\System\aBKHyLb.exe
  C:\Windows\System\aBKHyLb.exe
  2⤵
  PID:5688
- C:\Windows\System\lAJCiyN.exe
  C:\Windows\System\lAJCiyN.exe
  2⤵
  PID:5736
- C:\Windows\System\WwUdkMN.exe
  C:\Windows\System\WwUdkMN.exe
  2⤵
  PID:5776
- C:\Windows\System\DfZApqf.exe
  C:\Windows\System\DfZApqf.exe
  2⤵
  PID:5796
- C:\Windows\System\mhQXdaK.exe
  C:\Windows\System\mhQXdaK.exe
  2⤵
  PID:5828
- C:\Windows\System\ewclbqX.exe
  C:\Windows\System\ewclbqX.exe
  2⤵
  PID:5852
- C:\Windows\System\NfQomEk.exe
  C:\Windows\System\NfQomEk.exe
  2⤵
  PID:5896
- C:\Windows\System\mPEBdMH.exe
  C:\Windows\System\mPEBdMH.exe
  2⤵
  PID:5936
- C:\Windows\System\RqjjOru.exe
  C:\Windows\System\RqjjOru.exe
  2⤵
  PID:5980
- C:\Windows\System\kUAwcCu.exe
  C:\Windows\System\kUAwcCu.exe
  2⤵
  PID:6012
- C:\Windows\System\BcLkxhq.exe
  C:\Windows\System\BcLkxhq.exe
  2⤵
  PID:6036
- C:\Windows\System\fdxOLGU.exe
  C:\Windows\System\fdxOLGU.exe
  2⤵
  PID:6084
- C:\Windows\System\PXQPyeG.exe
  C:\Windows\System\PXQPyeG.exe
  2⤵
  PID:6136
- C:\Windows\System\ouRVucU.exe
  C:\Windows\System\ouRVucU.exe
  2⤵
  PID:5132
- C:\Windows\System\DOgnKjH.exe
  C:\Windows\System\DOgnKjH.exe
  2⤵
  PID:5232
- C:\Windows\System\xtUjzQq.exe
  C:\Windows\System\xtUjzQq.exe
  2⤵
  PID:4524
- C:\Windows\System\OXrIzlP.exe
  C:\Windows\System\OXrIzlP.exe
  2⤵
  PID:5384
- C:\Windows\System\jJjrIdj.exe
  C:\Windows\System\jJjrIdj.exe
  2⤵
  PID:5456
- C:\Windows\System\LZDzDLo.exe
  C:\Windows\System\LZDzDLo.exe
  2⤵
  PID:5496
- C:\Windows\System\Cuucctv.exe
  C:\Windows\System\Cuucctv.exe
  2⤵
  PID:5580
- C:\Windows\System\usEJgCf.exe
  C:\Windows\System\usEJgCf.exe
  2⤵
  PID:5656
- C:\Windows\System\JYuGqzK.exe
  C:\Windows\System\JYuGqzK.exe
  2⤵
  PID:5712
- C:\Windows\System\WCvzwJR.exe
  C:\Windows\System\WCvzwJR.exe
  2⤵
  PID:5824
- C:\Windows\System\ACLPFSq.exe
  C:\Windows\System\ACLPFSq.exe
  2⤵
  PID:5884
- C:\Windows\System\DwTmGyD.exe
  C:\Windows\System\DwTmGyD.exe
  2⤵
  PID:5228
- C:\Windows\System\oyLvkTt.exe
  C:\Windows\System\oyLvkTt.exe
  2⤵
  PID:5960
- C:\Windows\System\XoKFhEV.exe
  C:\Windows\System\XoKFhEV.exe
  2⤵
  PID:5992
- C:\Windows\System\gGauBJY.exe
  C:\Windows\System\gGauBJY.exe
  2⤵
  PID:6028
- C:\Windows\System\gEjDLZL.exe
  C:\Windows\System\gEjDLZL.exe
  2⤵
  PID:6068
- C:\Windows\System\gNduUIE.exe
  C:\Windows\System\gNduUIE.exe
  2⤵
  PID:3788
- C:\Windows\System\bsOpEvl.exe
  C:\Windows\System\bsOpEvl.exe
  2⤵
  PID:5256
- C:\Windows\System\GuTEDBB.exe
  C:\Windows\System\GuTEDBB.exe
  2⤵
  PID:5356
- C:\Windows\System\aNDCfql.exe
  C:\Windows\System\aNDCfql.exe
  2⤵
  PID:5492
- C:\Windows\System\VEWbjep.exe
  C:\Windows\System\VEWbjep.exe
  2⤵
  PID:5528
- C:\Windows\System\NJsqxSO.exe
  C:\Windows\System\NJsqxSO.exe
  2⤵
  PID:5640
- C:\Windows\System\jRCkZft.exe
  C:\Windows\System\jRCkZft.exe
  2⤵
  PID:5872
- C:\Windows\System\luYsTXd.exe
  C:\Windows\System\luYsTXd.exe
  2⤵
  PID:964
- C:\Windows\System\rtUbqIk.exe
  C:\Windows\System\rtUbqIk.exe
  2⤵
  PID:3264
- C:\Windows\System\OWQIGhR.exe
  C:\Windows\System\OWQIGhR.exe
  2⤵
  PID:5636
- C:\Windows\System\kMAiaHC.exe
  C:\Windows\System\kMAiaHC.exe
  2⤵
  PID:5260
- C:\Windows\System\Qnacizs.exe
  C:\Windows\System\Qnacizs.exe
  2⤵
  PID:5316
- C:\Windows\System\YEyevLF.exe
  C:\Windows\System\YEyevLF.exe
  2⤵
  PID:6108
- C:\Windows\System\tszXOQE.exe
  C:\Windows\System\tszXOQE.exe
  2⤵
  PID:6148
- C:\Windows\System\BvOUWLm.exe
  C:\Windows\System\BvOUWLm.exe
  2⤵
  PID:6164
- C:\Windows\System\YfEwJVR.exe
  C:\Windows\System\YfEwJVR.exe
  2⤵
  PID:6180
- C:\Windows\System\LRFHaQm.exe
  C:\Windows\System\LRFHaQm.exe
  2⤵
  PID:6224
- C:\Windows\System\eNvPoTS.exe
  C:\Windows\System\eNvPoTS.exe
  2⤵
  PID:6272
- C:\Windows\System\EFJtgoV.exe
  C:\Windows\System\EFJtgoV.exe
  2⤵
  PID:6300
- C:\Windows\System\AsvGIqs.exe
  C:\Windows\System\AsvGIqs.exe
  2⤵
  PID:6328
- C:\Windows\System\mzmwCzB.exe
  C:\Windows\System\mzmwCzB.exe
  2⤵
  PID:6344
- C:\Windows\System\OKddmeD.exe
  C:\Windows\System\OKddmeD.exe
  2⤵
  PID:6384
- C:\Windows\System\Pwipwrm.exe
  C:\Windows\System\Pwipwrm.exe
  2⤵
  PID:6420
- C:\Windows\System\YgVeaUW.exe
  C:\Windows\System\YgVeaUW.exe
  2⤵
  PID:6444
- C:\Windows\System\JzYHLYW.exe
  C:\Windows\System\JzYHLYW.exe
  2⤵
  PID:6472
- C:\Windows\System\FVKIZBL.exe
  C:\Windows\System\FVKIZBL.exe
  2⤵
  PID:6500
- C:\Windows\System\bHmTRQg.exe
  C:\Windows\System\bHmTRQg.exe
  2⤵
  PID:6536
- C:\Windows\System\cZtlrXo.exe
  C:\Windows\System\cZtlrXo.exe
  2⤵
  PID:6584
- C:\Windows\System\xiKrWBH.exe
  C:\Windows\System\xiKrWBH.exe
  2⤵
  PID:6604
- C:\Windows\System\yCQCkGt.exe
  C:\Windows\System\yCQCkGt.exe
  2⤵
  PID:6652
- C:\Windows\System\iPEzTrL.exe
  C:\Windows\System\iPEzTrL.exe
  2⤵
  PID:6688
- C:\Windows\System\BcOjlMF.exe
  C:\Windows\System\BcOjlMF.exe
  2⤵
  PID:6712
- C:\Windows\System\zjQZMmZ.exe
  C:\Windows\System\zjQZMmZ.exe
  2⤵
  PID:6740
- C:\Windows\System\qUClpnx.exe
  C:\Windows\System\qUClpnx.exe
  2⤵
  PID:6772
- C:\Windows\System\mkffPkQ.exe
  C:\Windows\System\mkffPkQ.exe
  2⤵
  PID:6808
- C:\Windows\System\rVrQJbN.exe
  C:\Windows\System\rVrQJbN.exe
  2⤵
  PID:6828
- C:\Windows\System\oOCbUfh.exe
  C:\Windows\System\oOCbUfh.exe
  2⤵
  PID:6860
- C:\Windows\System\TSPXpjw.exe
  C:\Windows\System\TSPXpjw.exe
  2⤵
  PID:6884
- C:\Windows\System\nzBzCyo.exe
  C:\Windows\System\nzBzCyo.exe
  2⤵
  PID:6912
- C:\Windows\System\pOKoOyi.exe
  C:\Windows\System\pOKoOyi.exe
  2⤵
  PID:6928
- C:\Windows\System\apjILgc.exe
  C:\Windows\System\apjILgc.exe
  2⤵
  PID:6956
- C:\Windows\System\srapeIu.exe
  C:\Windows\System\srapeIu.exe
  2⤵
  PID:6996
- C:\Windows\System\hVnGZrv.exe
  C:\Windows\System\hVnGZrv.exe
  2⤵
  PID:7020
- C:\Windows\System\wltWEbh.exe
  C:\Windows\System\wltWEbh.exe
  2⤵
  PID:7056
- C:\Windows\System\GvWmApI.exe
  C:\Windows\System\GvWmApI.exe
  2⤵
  PID:7080
- C:\Windows\System\WailpMZ.exe
  C:\Windows\System\WailpMZ.exe
  2⤵
  PID:7108
- C:\Windows\System\DRBYvHQ.exe
  C:\Windows\System\DRBYvHQ.exe
  2⤵
  PID:7132
- C:\Windows\System\rCrlmCE.exe
  C:\Windows\System\rCrlmCE.exe
  2⤵
  PID:7164
- C:\Windows\System\OLjPQfN.exe
  C:\Windows\System\OLjPQfN.exe
  2⤵
  PID:5948
- C:\Windows\System\wTLGChj.exe
  C:\Windows\System\wTLGChj.exe
  2⤵
  PID:6256
- C:\Windows\System\yFVnVCt.exe
  C:\Windows\System\yFVnVCt.exe
  2⤵
  PID:6296
- C:\Windows\System\BwsKUZV.exe
  C:\Windows\System\BwsKUZV.exe
  2⤵
  PID:6336
- C:\Windows\System\RVYmBZf.exe
  C:\Windows\System\RVYmBZf.exe
  2⤵
  PID:6404
- C:\Windows\System\ZGwhvzV.exe
  C:\Windows\System\ZGwhvzV.exe
  2⤵
  PID:6468
- C:\Windows\System\fbhgPgK.exe
  C:\Windows\System\fbhgPgK.exe
  2⤵
  PID:6520
- C:\Windows\System\bUNqjcy.exe
  C:\Windows\System\bUNqjcy.exe
  2⤵
  PID:6636
- C:\Windows\System\dPTccRa.exe
  C:\Windows\System\dPTccRa.exe
  2⤵
  PID:6696
- C:\Windows\System\QKKNxXW.exe
  C:\Windows\System\QKKNxXW.exe
  2⤵
  PID:6736
- C:\Windows\System\mxmUxCH.exe
  C:\Windows\System\mxmUxCH.exe
  2⤵
  PID:6824
- C:\Windows\System\dWgAlXe.exe
  C:\Windows\System\dWgAlXe.exe
  2⤵
  PID:6896
- C:\Windows\System\PanmJhO.exe
  C:\Windows\System\PanmJhO.exe
  2⤵
  PID:6924
- C:\Windows\System\lAjkOcW.exe
  C:\Windows\System\lAjkOcW.exe
  2⤵
  PID:7028
- C:\Windows\System\yHZCMuk.exe
  C:\Windows\System\yHZCMuk.exe
  2⤵
  PID:7092
- C:\Windows\System\aMWByzF.exe
  C:\Windows\System\aMWByzF.exe
  2⤵
  PID:7152
- C:\Windows\System\WgYZOuK.exe
  C:\Windows\System\WgYZOuK.exe
  2⤵
  PID:6200
- C:\Windows\System\rfyDMea.exe
  C:\Windows\System\rfyDMea.exe
  2⤵
  PID:3904
- C:\Windows\System\vMFdMqW.exe
  C:\Windows\System\vMFdMqW.exe
  2⤵
  PID:2864
- C:\Windows\System\daBsBwd.exe
  C:\Windows\System\daBsBwd.exe
  2⤵
  PID:6568
- C:\Windows\System\rroitxz.exe
  C:\Windows\System\rroitxz.exe
  2⤵
  PID:6816
- C:\Windows\System\jAWZpOW.exe
  C:\Windows\System\jAWZpOW.exe
  2⤵
  PID:7048
- C:\Windows\System\PhBWQQV.exe
  C:\Windows\System\PhBWQQV.exe
  2⤵
  PID:4292
- C:\Windows\System\uISyyRu.exe
  C:\Windows\System\uISyyRu.exe
  2⤵
  PID:6232
- C:\Windows\System\qQhYzBc.exe
  C:\Windows\System\qQhYzBc.exe
  2⤵
  PID:6732
- C:\Windows\System\HbKQJeC.exe
  C:\Windows\System\HbKQJeC.exe
  2⤵
  PID:6216
- C:\Windows\System\vpphvYQ.exe
  C:\Windows\System\vpphvYQ.exe
  2⤵
  PID:6456
- C:\Windows\System\bgyTCLK.exe
  C:\Windows\System\bgyTCLK.exe
  2⤵
  PID:7188
- C:\Windows\System\iiKMjWP.exe
  C:\Windows\System\iiKMjWP.exe
  2⤵
  PID:7216
- C:\Windows\System\kcBKyui.exe
  C:\Windows\System\kcBKyui.exe
  2⤵
  PID:7256
- C:\Windows\System\DUWUBys.exe
  C:\Windows\System\DUWUBys.exe
  2⤵
  PID:7308
- C:\Windows\System\sUxxNom.exe
  C:\Windows\System\sUxxNom.exe
  2⤵
  PID:7328
- C:\Windows\System\qDnFqsQ.exe
  C:\Windows\System\qDnFqsQ.exe
  2⤵
  PID:7364
- C:\Windows\System\Pttdppm.exe
  C:\Windows\System\Pttdppm.exe
  2⤵
  PID:7400
- C:\Windows\System\zBeqcON.exe
  C:\Windows\System\zBeqcON.exe
  2⤵
  PID:7428
- C:\Windows\System\BfsqAcv.exe
  C:\Windows\System\BfsqAcv.exe
  2⤵
  PID:7464
- C:\Windows\System\yPcheqX.exe
  C:\Windows\System\yPcheqX.exe
  2⤵
  PID:7496
- C:\Windows\System\dDqDJfO.exe
  C:\Windows\System\dDqDJfO.exe
  2⤵
  PID:7528
- C:\Windows\System\lwzZEiG.exe
  C:\Windows\System\lwzZEiG.exe
  2⤵
  PID:7560
- C:\Windows\System\mERnrnj.exe
  C:\Windows\System\mERnrnj.exe
  2⤵
  PID:7592
- C:\Windows\System\FEfLliM.exe
  C:\Windows\System\FEfLliM.exe
  2⤵
  PID:7612
- C:\Windows\System\iFGQVJd.exe
  C:\Windows\System\iFGQVJd.exe
  2⤵
  PID:7648
- C:\Windows\System\gPWiBYH.exe
  C:\Windows\System\gPWiBYH.exe
  2⤵
  PID:7680
- C:\Windows\System\qRlbvcP.exe
  C:\Windows\System\qRlbvcP.exe
  2⤵
  PID:7724
- C:\Windows\System\llxuQTr.exe
  C:\Windows\System\llxuQTr.exe
  2⤵
  PID:7760
- C:\Windows\System\PggHNZN.exe
  C:\Windows\System\PggHNZN.exe
  2⤵
  PID:7792
- C:\Windows\System\qtfswSF.exe
  C:\Windows\System\qtfswSF.exe
  2⤵
  PID:7816
- C:\Windows\System\jlzoseK.exe
  C:\Windows\System\jlzoseK.exe
  2⤵
  PID:7836
- C:\Windows\System\jJLZkpw.exe
  C:\Windows\System\jJLZkpw.exe
  2⤵
  PID:7852
- C:\Windows\System\KLYaayK.exe
  C:\Windows\System\KLYaayK.exe
  2⤵
  PID:7876
- C:\Windows\System\EyFGuZd.exe
  C:\Windows\System\EyFGuZd.exe
  2⤵
  PID:7920
- C:\Windows\System\lcFAuzz.exe
  C:\Windows\System\lcFAuzz.exe
  2⤵
  PID:7952
- C:\Windows\System\kiBvqUV.exe
  C:\Windows\System\kiBvqUV.exe
  2⤵
  PID:7980
- C:\Windows\System\epejUbY.exe
  C:\Windows\System\epejUbY.exe
  2⤵
  PID:8004
- C:\Windows\System\kuXlOTo.exe
  C:\Windows\System\kuXlOTo.exe
  2⤵
  PID:8056
- C:\Windows\System\YDsTUEI.exe
  C:\Windows\System\YDsTUEI.exe
  2⤵
  PID:8088
- C:\Windows\System\YKhcZgf.exe
  C:\Windows\System\YKhcZgf.exe
  2⤵
  PID:8116
- C:\Windows\System\PhJmhso.exe
  C:\Windows\System\PhJmhso.exe
  2⤵
  PID:8156
- C:\Windows\System\vghUXzx.exe
  C:\Windows\System\vghUXzx.exe
  2⤵
  PID:8176
- C:\Windows\System\YSjZyTL.exe
  C:\Windows\System\YSjZyTL.exe
  2⤵
  PID:7064
- C:\Windows\System\gwOMlop.exe
  C:\Windows\System\gwOMlop.exe
  2⤵
  PID:7252
- C:\Windows\System\lMCCNKm.exe
  C:\Windows\System\lMCCNKm.exe
  2⤵
  PID:7316
- C:\Windows\System\ETilxEv.exe
  C:\Windows\System\ETilxEv.exe
  2⤵
  PID:7444
- C:\Windows\System\ieisTsP.exe
  C:\Windows\System\ieisTsP.exe
  2⤵
  PID:7480
- C:\Windows\System\bhhGGNQ.exe
  C:\Windows\System\bhhGGNQ.exe
  2⤵
  PID:7544
- C:\Windows\System\WKowxDW.exe
  C:\Windows\System\WKowxDW.exe
  2⤵
  PID:7636
- C:\Windows\System\eBqZStp.exe
  C:\Windows\System\eBqZStp.exe
  2⤵
  PID:7664
- C:\Windows\System\JgSgodW.exe
  C:\Windows\System\JgSgodW.exe
  2⤵
  PID:7784
- C:\Windows\System\kGSApSH.exe
  C:\Windows\System\kGSApSH.exe
  2⤵
  PID:7860
- C:\Windows\System\yvSknZF.exe
  C:\Windows\System\yvSknZF.exe
  2⤵
  PID:7908
- C:\Windows\System\VihDxsh.exe
  C:\Windows\System\VihDxsh.exe
  2⤵
  PID:7976
- C:\Windows\System\LsOAfkY.exe
  C:\Windows\System\LsOAfkY.exe
  2⤵
  PID:8076
- C:\Windows\System\wqIbPpY.exe
  C:\Windows\System\wqIbPpY.exe
  2⤵
  PID:8168
- C:\Windows\System\gTPxkgK.exe
  C:\Windows\System\gTPxkgK.exe
  2⤵
  PID:7236
- C:\Windows\System\SnQGiBl.exe
  C:\Windows\System\SnQGiBl.exe
  2⤵
  PID:7296
- C:\Windows\System\LxIWRXu.exe
  C:\Windows\System\LxIWRXu.exe
  2⤵
  PID:7492
- C:\Windows\System\LvplszW.exe
  C:\Windows\System\LvplszW.exe
  2⤵
  PID:7624
- C:\Windows\System\IQxYgWy.exe
  C:\Windows\System\IQxYgWy.exe
  2⤵
  PID:8048
- C:\Windows\System\NWKhtjH.exe
  C:\Windows\System\NWKhtjH.exe
  2⤵
  PID:8188
- C:\Windows\System\EcZQuQN.exe
  C:\Windows\System\EcZQuQN.exe
  2⤵
  PID:7868
- C:\Windows\System\uyLJxDP.exe
  C:\Windows\System\uyLJxDP.exe
  2⤵
  PID:8020
- C:\Windows\System\MJGQHVS.exe
  C:\Windows\System\MJGQHVS.exe
  2⤵
  PID:7536
- C:\Windows\System\bFLkiJQ.exe
  C:\Windows\System\bFLkiJQ.exe
  2⤵
  PID:8204
- C:\Windows\System\RyQKtCM.exe
  C:\Windows\System\RyQKtCM.exe
  2⤵
  PID:8248
- C:\Windows\System\lMTYaoR.exe
  C:\Windows\System\lMTYaoR.exe
  2⤵
  PID:8288
- C:\Windows\System\redhyHX.exe
  C:\Windows\System\redhyHX.exe
  2⤵
  PID:8312
- C:\Windows\System\MfmsxMZ.exe
  C:\Windows\System\MfmsxMZ.exe
  2⤵
  PID:8348
- C:\Windows\System\ipESmhB.exe
  C:\Windows\System\ipESmhB.exe
  2⤵
  PID:8380
- C:\Windows\System\EjxnxMe.exe
  C:\Windows\System\EjxnxMe.exe
  2⤵
  PID:8412
- C:\Windows\System\gGPOHkC.exe
  C:\Windows\System\gGPOHkC.exe
  2⤵
  PID:8436
- C:\Windows\System\IyddRnh.exe
  C:\Windows\System\IyddRnh.exe
  2⤵
  PID:8480
- C:\Windows\System\LgMVwXw.exe
  C:\Windows\System\LgMVwXw.exe
  2⤵
  PID:8496
- C:\Windows\System\ZCVluRk.exe
  C:\Windows\System\ZCVluRk.exe
  2⤵
  PID:8536
- C:\Windows\System\vIWiXHq.exe
  C:\Windows\System\vIWiXHq.exe
  2⤵
  PID:8556
- C:\Windows\System\WawvDtJ.exe
  C:\Windows\System\WawvDtJ.exe
  2⤵
  PID:8592
- C:\Windows\System\qGieqtw.exe
  C:\Windows\System\qGieqtw.exe
  2⤵
  PID:8620
- C:\Windows\System\tkdsPOD.exe
  C:\Windows\System\tkdsPOD.exe
  2⤵
  PID:8636
- C:\Windows\System\pTwnWfp.exe
  C:\Windows\System\pTwnWfp.exe
  2⤵
  PID:8668
- C:\Windows\System\AOesYmC.exe
  C:\Windows\System\AOesYmC.exe
  2⤵
  PID:8692
- C:\Windows\System\YAzBbOj.exe
  C:\Windows\System\YAzBbOj.exe
  2⤵
  PID:8712
- C:\Windows\System\SqOpdJB.exe
  C:\Windows\System\SqOpdJB.exe
  2⤵
  PID:8748
- C:\Windows\System\rxcHPuq.exe
  C:\Windows\System\rxcHPuq.exe
  2⤵
  PID:8788
- C:\Windows\System\fOHHjql.exe
  C:\Windows\System\fOHHjql.exe
  2⤵
  PID:8812
- C:\Windows\System\rQCaaAl.exe
  C:\Windows\System\rQCaaAl.exe
  2⤵
  PID:8832
- C:\Windows\System\HSNsABV.exe
  C:\Windows\System\HSNsABV.exe
  2⤵
  PID:8872
- C:\Windows\System\UsMWvBv.exe
  C:\Windows\System\UsMWvBv.exe
  2⤵
  PID:8900
- C:\Windows\System\ooWXWmY.exe
  C:\Windows\System\ooWXWmY.exe
  2⤵
  PID:8920
- C:\Windows\System\xIHEdNS.exe
  C:\Windows\System\xIHEdNS.exe
  2⤵
  PID:8956
- C:\Windows\System\NJmYRlX.exe
  C:\Windows\System\NJmYRlX.exe
  2⤵
  PID:8984
- C:\Windows\System\WuDCzqo.exe
  C:\Windows\System\WuDCzqo.exe
  2⤵
  PID:9008
- C:\Windows\System\MGAxtFi.exe
  C:\Windows\System\MGAxtFi.exe
  2⤵
  PID:9040
- C:\Windows\System\svTSwhR.exe
  C:\Windows\System\svTSwhR.exe
  2⤵
  PID:9056
- C:\Windows\System\ZsKxNXh.exe
  C:\Windows\System\ZsKxNXh.exe
  2⤵
  PID:9084
- C:\Windows\System\nAkDqBi.exe
  C:\Windows\System\nAkDqBi.exe
  2⤵
  PID:9120
- C:\Windows\System\RrLxnxc.exe
  C:\Windows\System\RrLxnxc.exe
  2⤵
  PID:9152
- C:\Windows\System\DotgOPM.exe
  C:\Windows\System\DotgOPM.exe
  2⤵
  PID:9180
- C:\Windows\System\xwZDhRR.exe
  C:\Windows\System\xwZDhRR.exe
  2⤵
  PID:9196
- C:\Windows\System\MrMQfSG.exe
  C:\Windows\System\MrMQfSG.exe
  2⤵
  PID:7740
- C:\Windows\System\lTTTMkA.exe
  C:\Windows\System\lTTTMkA.exe
  2⤵
  PID:8236
- C:\Windows\System\YRljehw.exe
  C:\Windows\System\YRljehw.exe
  2⤵
  PID:8340
- C:\Windows\System\JDsWTaE.exe
  C:\Windows\System\JDsWTaE.exe
  2⤵
  PID:8372
- C:\Windows\System\TBWPKYG.exe
  C:\Windows\System\TBWPKYG.exe
  2⤵
  PID:8464
- C:\Windows\System\nvnmJpo.exe
  C:\Windows\System\nvnmJpo.exe
  2⤵
  PID:8564
- C:\Windows\System\gtMbGjB.exe
  C:\Windows\System\gtMbGjB.exe
  2⤵
  PID:8608
- C:\Windows\System\cHTciTy.exe
  C:\Windows\System\cHTciTy.exe
  2⤵
  PID:8648
- C:\Windows\System\TetdDld.exe
  C:\Windows\System\TetdDld.exe
  2⤵
  PID:8680
- C:\Windows\System\Ofkynxi.exe
  C:\Windows\System\Ofkynxi.exe
  2⤵
  PID:8780
- C:\Windows\System\fRxYsIY.exe
  C:\Windows\System\fRxYsIY.exe
  2⤵
  PID:8864
- C:\Windows\System\bauJJYU.exe
  C:\Windows\System\bauJJYU.exe
  2⤵
  PID:8940
- C:\Windows\System\sjClLpR.exe
  C:\Windows\System\sjClLpR.exe
  2⤵
  PID:9000
- C:\Windows\System\xqPwNqY.exe
  C:\Windows\System\xqPwNqY.exe
  2⤵
  PID:9076
- C:\Windows\System\NyxZuFM.exe
  C:\Windows\System\NyxZuFM.exe
  2⤵
  PID:9144
- C:\Windows\System\rSZaTLK.exe
  C:\Windows\System\rSZaTLK.exe
  2⤵
  PID:9172
- C:\Windows\System\ZdLAdBe.exe
  C:\Windows\System\ZdLAdBe.exe
  2⤵
  PID:8224
- C:\Windows\System\bUjJlYY.exe
  C:\Windows\System\bUjJlYY.exe
  2⤵
  PID:8368
- C:\Windows\System\StaXjGC.exe
  C:\Windows\System\StaXjGC.exe
  2⤵
  PID:8584
- C:\Windows\System\eaMSWYz.exe
  C:\Windows\System\eaMSWYz.exe
  2⤵
  PID:8760
- C:\Windows\System\YjtFmmt.exe
  C:\Windows\System\YjtFmmt.exe
  2⤵
  PID:8896
- C:\Windows\System\hWStniM.exe
  C:\Windows\System\hWStniM.exe
  2⤵
  PID:9036
- C:\Windows\System\zKwqZcc.exe
  C:\Windows\System\zKwqZcc.exe
  2⤵
  PID:9104
- C:\Windows\System\HPpaiqu.exe
  C:\Windows\System\HPpaiqu.exe
  2⤵
  PID:8428
- C:\Windows\System\jNppvSH.exe
  C:\Windows\System\jNppvSH.exe
  2⤵
  PID:8688
- C:\Windows\System\lIkrhIK.exe
  C:\Windows\System\lIkrhIK.exe
  2⤵
  PID:8992
- C:\Windows\System\ALvpKvO.exe
  C:\Windows\System\ALvpKvO.exe
  2⤵
  PID:8796
- C:\Windows\System\qNhmEWc.exe
  C:\Windows\System\qNhmEWc.exe
  2⤵
  PID:7372
- C:\Windows\System\hMxkoVi.exe
  C:\Windows\System\hMxkoVi.exe
  2⤵
  PID:9244
- C:\Windows\System\dzZcsiP.exe
  C:\Windows\System\dzZcsiP.exe
  2⤵
  PID:9284
- C:\Windows\System\qLFDgcz.exe
  C:\Windows\System\qLFDgcz.exe
  2⤵
  PID:9312
- C:\Windows\System\QXElRzO.exe
  C:\Windows\System\QXElRzO.exe
  2⤵
  PID:9340
- C:\Windows\System\iEvnbPJ.exe
  C:\Windows\System\iEvnbPJ.exe
  2⤵
  PID:9364
- C:\Windows\System\uTJlhhh.exe
  C:\Windows\System\uTJlhhh.exe
  2⤵
  PID:9384
- C:\Windows\System\sytqjuB.exe
  C:\Windows\System\sytqjuB.exe
  2⤵
  PID:9400
- C:\Windows\System\oTdLktK.exe
  C:\Windows\System\oTdLktK.exe
  2⤵
  PID:9440
- C:\Windows\System\ykJQHKZ.exe
  C:\Windows\System\ykJQHKZ.exe
  2⤵
  PID:9468
- C:\Windows\System\EDorbhr.exe
  C:\Windows\System\EDorbhr.exe
  2⤵
  PID:9484
- C:\Windows\System\HafvaDK.exe
  C:\Windows\System\HafvaDK.exe
  2⤵
  PID:9528
- C:\Windows\System\ElpJkVo.exe
  C:\Windows\System\ElpJkVo.exe
  2⤵
  PID:9552
- C:\Windows\System\ksSHcpL.exe
  C:\Windows\System\ksSHcpL.exe
  2⤵
  PID:9580
- C:\Windows\System\CDnVosW.exe
  C:\Windows\System\CDnVosW.exe
  2⤵
  PID:9600
- C:\Windows\System\qUupLMU.exe
  C:\Windows\System\qUupLMU.exe
  2⤵
  PID:9632
- C:\Windows\System\BSWVUTc.exe
  C:\Windows\System\BSWVUTc.exe
  2⤵
  PID:9672
- C:\Windows\System\TvxkVRf.exe
  C:\Windows\System\TvxkVRf.exe
  2⤵
  PID:9696
- C:\Windows\System\QaHjBpd.exe
  C:\Windows\System\QaHjBpd.exe
  2⤵
  PID:9720
- C:\Windows\System\CvDwZAC.exe
  C:\Windows\System\CvDwZAC.exe
  2⤵
  PID:9748
- C:\Windows\System\EenAvIT.exe
  C:\Windows\System\EenAvIT.exe
  2⤵
  PID:9788
- C:\Windows\System\UKQHfEE.exe
  C:\Windows\System\UKQHfEE.exe
  2⤵
  PID:9804
- C:\Windows\System\NjENBKn.exe
  C:\Windows\System\NjENBKn.exe
  2⤵
  PID:9820
- C:\Windows\System\zFytUbF.exe
  C:\Windows\System\zFytUbF.exe
  2⤵
  PID:9864
- C:\Windows\System\EPzqcSf.exe
  C:\Windows\System\EPzqcSf.exe
  2⤵
  PID:9892
- C:\Windows\System\iUnDdpV.exe
  C:\Windows\System\iUnDdpV.exe
  2⤵
  PID:9936
- C:\Windows\System\apewwCi.exe
  C:\Windows\System\apewwCi.exe
  2⤵
  PID:9972
- C:\Windows\System\FxTECmd.exe
  C:\Windows\System\FxTECmd.exe
  2⤵
  PID:10012
- C:\Windows\System\tkpxAkP.exe
  C:\Windows\System\tkpxAkP.exe
  2⤵
  PID:10048
- C:\Windows\System\wcFVWGT.exe
  C:\Windows\System\wcFVWGT.exe
  2⤵
  PID:10064
- C:\Windows\System\CYbpcoT.exe
  C:\Windows\System\CYbpcoT.exe
  2⤵
  PID:10092
- C:\Windows\System\TprVkfl.exe
  C:\Windows\System\TprVkfl.exe
  2⤵
  PID:10116
- C:\Windows\System\VysDCTk.exe
  C:\Windows\System\VysDCTk.exe
  2⤵
  PID:10148
- C:\Windows\System\hipSZwC.exe
  C:\Windows\System\hipSZwC.exe
  2⤵
  PID:10188
- C:\Windows\System\dZMyXTI.exe
  C:\Windows\System\dZMyXTI.exe
  2⤵
  PID:10204
- C:\Windows\System\izPugrp.exe
  C:\Windows\System\izPugrp.exe
  2⤵
  PID:9164
- C:\Windows\System\zQfSMaw.exe
  C:\Windows\System\zQfSMaw.exe
  2⤵
  PID:9272
- C:\Windows\System\cuGeumR.exe
  C:\Windows\System\cuGeumR.exe
  2⤵
  PID:9336
- C:\Windows\System\nKUHORY.exe
  C:\Windows\System\nKUHORY.exe
  2⤵
  PID:9392
- C:\Windows\System\oCyDJER.exe
  C:\Windows\System\oCyDJER.exe
  2⤵
  PID:9420
- C:\Windows\System\VlaEGav.exe
  C:\Windows\System\VlaEGav.exe
  2⤵
  PID:9544
- C:\Windows\System\vXJCWQf.exe
  C:\Windows\System\vXJCWQf.exe
  2⤵
  PID:9588
- C:\Windows\System\falGvmN.exe
  C:\Windows\System\falGvmN.exe
  2⤵
  PID:9648
- C:\Windows\System\JKuQEnj.exe
  C:\Windows\System\JKuQEnj.exe
  2⤵
  PID:9732
- C:\Windows\System\bQSctOO.exe
  C:\Windows\System\bQSctOO.exe
  2⤵
  PID:9796
- C:\Windows\System\blXllPB.exe
  C:\Windows\System\blXllPB.exe
  2⤵
  PID:9844
- C:\Windows\System\QZJtuOZ.exe
  C:\Windows\System\QZJtuOZ.exe
  2⤵
  PID:9928
- C:\Windows\System\ndvhFij.exe
  C:\Windows\System\ndvhFij.exe
  2⤵
  PID:10000
- C:\Windows\System\ZoImViC.exe
  C:\Windows\System\ZoImViC.exe
  2⤵
  PID:10076
- C:\Windows\System\CnOSELg.exe
  C:\Windows\System\CnOSELg.exe
  2⤵
  PID:10144
- C:\Windows\System\CLvsgyv.exe
  C:\Windows\System\CLvsgyv.exe
  2⤵
  PID:9324
- C:\Windows\System\PCeNEdk.exe
  C:\Windows\System\PCeNEdk.exe
  2⤵
  PID:9412
- C:\Windows\System\OcrGtYq.exe
  C:\Windows\System\OcrGtYq.exe
  2⤵
  PID:9576
- C:\Windows\System\TqUBOjJ.exe
  C:\Windows\System\TqUBOjJ.exe
  2⤵
  PID:9668
- C:\Windows\System\GXruIEC.exe
  C:\Windows\System\GXruIEC.exe
  2⤵
  PID:9812
- C:\Windows\System\jBSPIHX.exe
  C:\Windows\System\jBSPIHX.exe
  2⤵
  PID:9952
- C:\Windows\System\uhYraoc.exe
  C:\Windows\System\uhYraoc.exe
  2⤵
  PID:10100
- C:\Windows\System\kdSoXMd.exe
  C:\Windows\System\kdSoXMd.exe
  2⤵
  PID:9424
- C:\Windows\System\DhvRxVR.exe
  C:\Windows\System\DhvRxVR.exe
  2⤵
  PID:9760
- C:\Windows\System\HqDeHxb.exe
  C:\Windows\System\HqDeHxb.exe
  2⤵
  PID:10036
- C:\Windows\System\UMSLboV.exe
  C:\Windows\System\UMSLboV.exe
  2⤵
  PID:10244
- C:\Windows\System\QhqLitp.exe
  C:\Windows\System\QhqLitp.exe
  2⤵
  PID:10260
- C:\Windows\System\pXzdnFl.exe
  C:\Windows\System\pXzdnFl.exe
  2⤵
  PID:10300
- C:\Windows\System\uXxaDnZ.exe
  C:\Windows\System\uXxaDnZ.exe
  2⤵
  PID:10316
- C:\Windows\System\EYfUYXU.exe
  C:\Windows\System\EYfUYXU.exe
  2⤵
  PID:10356
- C:\Windows\System\nyVHckV.exe
  C:\Windows\System\nyVHckV.exe
  2⤵
  PID:10384
- C:\Windows\System\ypadcBM.exe
  C:\Windows\System\ypadcBM.exe
  2⤵
  PID:10408
- C:\Windows\System\TLPqGeq.exe
  C:\Windows\System\TLPqGeq.exe
  2⤵
  PID:10432
- C:\Windows\System\soTxbCv.exe
  C:\Windows\System\soTxbCv.exe
  2⤵
  PID:10468
- C:\Windows\System\wfIhZZl.exe
  C:\Windows\System\wfIhZZl.exe
  2⤵
  PID:10496
- C:\Windows\System\kxJtXuA.exe
  C:\Windows\System\kxJtXuA.exe
  2⤵
  PID:10524
- C:\Windows\System\MMFjkuP.exe
  C:\Windows\System\MMFjkuP.exe
  2⤵
  PID:10552
- C:\Windows\System\zWtAPAv.exe
  C:\Windows\System\zWtAPAv.exe
  2⤵
  PID:10580
- C:\Windows\System\pbUdCII.exe
  C:\Windows\System\pbUdCII.exe
  2⤵
  PID:10596
- C:\Windows\System\XoABuhq.exe
  C:\Windows\System\XoABuhq.exe
  2⤵
  PID:10616
- C:\Windows\System\kKAXBfv.exe
  C:\Windows\System\kKAXBfv.exe
  2⤵
  PID:10664
- C:\Windows\System\IpbtgcF.exe
  C:\Windows\System\IpbtgcF.exe
  2⤵
  PID:10680
- C:\Windows\System\odDaXeq.exe
  C:\Windows\System\odDaXeq.exe
  2⤵
  PID:10720
- C:\Windows\System\brEGfLP.exe
  C:\Windows\System\brEGfLP.exe
  2⤵
  PID:10748
- C:\Windows\System\NhSZxNV.exe
  C:\Windows\System\NhSZxNV.exe
  2⤵
  PID:10776
- C:\Windows\System\hYjmSFf.exe
  C:\Windows\System\hYjmSFf.exe
  2⤵
  PID:10804
- C:\Windows\System\GCkznje.exe
  C:\Windows\System\GCkznje.exe
  2⤵
  PID:10820
- C:\Windows\System\TvHIqpS.exe
  C:\Windows\System\TvHIqpS.exe
  2⤵
  PID:10848
- C:\Windows\System\WIhWSbY.exe
  C:\Windows\System\WIhWSbY.exe
  2⤵
  PID:10888
- C:\Windows\System\ORJyUPk.exe
  C:\Windows\System\ORJyUPk.exe
  2⤵
  PID:10916
- C:\Windows\System\rsdtrrQ.exe
  C:\Windows\System\rsdtrrQ.exe
  2⤵
  PID:10944
- C:\Windows\System\BVyKpey.exe
  C:\Windows\System\BVyKpey.exe
  2⤵
  PID:10960
- C:\Windows\System\RFFGUFa.exe
  C:\Windows\System\RFFGUFa.exe
  2⤵
  PID:11000
- C:\Windows\System\gdhtcqL.exe
  C:\Windows\System\gdhtcqL.exe
  2⤵
  PID:11028
- C:\Windows\System\ZbskMli.exe
  C:\Windows\System\ZbskMli.exe
  2⤵
  PID:11044
- C:\Windows\System\kiljiUu.exe
  C:\Windows\System\kiljiUu.exe
  2⤵
  PID:11072
- C:\Windows\System\JPAINnn.exe
  C:\Windows\System\JPAINnn.exe
  2⤵
  PID:11112
- C:\Windows\System\DplNSKO.exe
  C:\Windows\System\DplNSKO.exe
  2⤵
  PID:11136
- C:\Windows\System\gTDiFHZ.exe
  C:\Windows\System\gTDiFHZ.exe
  2⤵
  PID:11168
- C:\Windows\System\YxIkuDf.exe
  C:\Windows\System\YxIkuDf.exe
  2⤵
  PID:11196
- C:\Windows\System\hXPJeHf.exe
  C:\Windows\System\hXPJeHf.exe
  2⤵
  PID:11224
- C:\Windows\System\xVyGAhI.exe
  C:\Windows\System\xVyGAhI.exe
  2⤵
  PID:11252
- C:\Windows\System\jzQFScZ.exe
  C:\Windows\System\jzQFScZ.exe
  2⤵
  PID:9376
- C:\Windows\System\jLZzxra.exe
  C:\Windows\System\jLZzxra.exe
  2⤵
  PID:10296
- C:\Windows\System\xPucZMu.exe
  C:\Windows\System\xPucZMu.exe
  2⤵
  PID:10392
- C:\Windows\System\ZanTtrr.exe
  C:\Windows\System\ZanTtrr.exe
  2⤵
  PID:10420
- C:\Windows\System\fUzVKxO.exe
  C:\Windows\System\fUzVKxO.exe
  2⤵
  PID:10516
- C:\Windows\System\NfLblSH.exe
  C:\Windows\System\NfLblSH.exe
  2⤵
  PID:10564
- C:\Windows\System\GYDpshY.exe
  C:\Windows\System\GYDpshY.exe
  2⤵
  PID:10592
- C:\Windows\System\TbzASET.exe
  C:\Windows\System\TbzASET.exe
  2⤵
  PID:10712
- C:\Windows\System\ILykUUw.exe
  C:\Windows\System\ILykUUw.exe
  2⤵
  PID:10760
- C:\Windows\System\sFOXTlr.exe
  C:\Windows\System\sFOXTlr.exe
  2⤵
  PID:10812
- C:\Windows\System\CNWQZbc.exe
  C:\Windows\System\CNWQZbc.exe
  2⤵
  PID:10884
- C:\Windows\System\YDvXiqn.exe
  C:\Windows\System\YDvXiqn.exe
  2⤵
  PID:10940
- C:\Windows\System\GzFCzjD.exe
  C:\Windows\System\GzFCzjD.exe
  2⤵
  PID:10972
- C:\Windows\System\PpbEdoP.exe
  C:\Windows\System\PpbEdoP.exe
  2⤵
  PID:11040
- C:\Windows\System\hJVokOP.exe
  C:\Windows\System\hJVokOP.exe
  2⤵
  PID:11108
- C:\Windows\System\WWwIZly.exe
  C:\Windows\System\WWwIZly.exe
  2⤵
  PID:11212
- C:\Windows\System\yQPBnCG.exe
  C:\Windows\System\yQPBnCG.exe
  2⤵
  PID:11260
- C:\Windows\System\yMHAnIh.exe
  C:\Windows\System\yMHAnIh.exe
  2⤵
  PID:10536
- C:\Windows\System\YFdxvdF.exe
  C:\Windows\System\YFdxvdF.exe
  2⤵
  PID:10548
- C:\Windows\System\GHKaApk.exe
  C:\Windows\System\GHKaApk.exe
  2⤵
  PID:10672
- C:\Windows\System\kwMghXt.exe
  C:\Windows\System\kwMghXt.exe
  2⤵
  PID:10956
- C:\Windows\System\BxRDVoM.exe
  C:\Windows\System\BxRDVoM.exe
  2⤵
  PID:11016
- C:\Windows\System\melRSFJ.exe
  C:\Windows\System\melRSFJ.exe
  2⤵
  PID:11244
- C:\Windows\System\BZLBGfX.exe
  C:\Windows\System\BZLBGfX.exe
  2⤵
  PID:10424
- C:\Windows\System\doraWzc.exe
  C:\Windows\System\doraWzc.exe
  2⤵
  PID:10692
- C:\Windows\System\sIAWbbA.exe
  C:\Windows\System\sIAWbbA.exe
  2⤵
  PID:11156
- C:\Windows\System\PULZYqN.exe
  C:\Windows\System\PULZYqN.exe
  2⤵
  PID:10980
- C:\Windows\System\FQhPuSc.exe
  C:\Windows\System\FQhPuSc.exe
  2⤵
  PID:11272
- C:\Windows\System\ktCGdNu.exe
  C:\Windows\System\ktCGdNu.exe
  2⤵
  PID:11300
- C:\Windows\System\qJphcPH.exe
  C:\Windows\System\qJphcPH.exe
  2⤵
  PID:11328
- C:\Windows\System\HnTVMOK.exe
  C:\Windows\System\HnTVMOK.exe
  2⤵
  PID:11356
- C:\Windows\System\IPJUQid.exe
  C:\Windows\System\IPJUQid.exe
  2⤵
  PID:11384
- C:\Windows\System\NufRLPo.exe
  C:\Windows\System\NufRLPo.exe
  2⤵
  PID:11412
- C:\Windows\System\xjGkrqj.exe
  C:\Windows\System\xjGkrqj.exe
  2⤵
  PID:11440
- C:\Windows\System\dQgFSgg.exe
  C:\Windows\System\dQgFSgg.exe
  2⤵
  PID:11468
- C:\Windows\System\UzDsLpM.exe
  C:\Windows\System\UzDsLpM.exe
  2⤵
  PID:11496
- C:\Windows\System\Iqihrlr.exe
  C:\Windows\System\Iqihrlr.exe
  2⤵
  PID:11524
- C:\Windows\System\yJLocMD.exe
  C:\Windows\System\yJLocMD.exe
  2⤵
  PID:11552
- C:\Windows\System\jqmeqEn.exe
  C:\Windows\System\jqmeqEn.exe
  2⤵
  PID:11580
- C:\Windows\System\dCpvupO.exe
  C:\Windows\System\dCpvupO.exe
  2⤵
  PID:11608
- C:\Windows\System\wYRwgjr.exe
  C:\Windows\System\wYRwgjr.exe
  2⤵
  PID:11636
- C:\Windows\System\YNXpeSL.exe
  C:\Windows\System\YNXpeSL.exe
  2⤵
  PID:11664
- C:\Windows\System\ixnDcDo.exe
  C:\Windows\System\ixnDcDo.exe
  2⤵
  PID:11692
- C:\Windows\System\VjqrLIh.exe
  C:\Windows\System\VjqrLIh.exe
  2⤵
  PID:11720
- C:\Windows\System\GpPdWxD.exe
  C:\Windows\System\GpPdWxD.exe
  2⤵
  PID:11748
- C:\Windows\System\kwruUvT.exe
  C:\Windows\System\kwruUvT.exe
  2⤵
  PID:11776
- C:\Windows\System\HzeiodI.exe
  C:\Windows\System\HzeiodI.exe
  2⤵
  PID:11804
- C:\Windows\System\DmEZZKX.exe
  C:\Windows\System\DmEZZKX.exe
  2⤵
  PID:11832
- C:\Windows\System\yuoLPuk.exe
  C:\Windows\System\yuoLPuk.exe
  2⤵
  PID:11868
- C:\Windows\System\EsnpEwo.exe
  C:\Windows\System\EsnpEwo.exe
  2⤵
  PID:11908
- C:\Windows\System\CkRGNlu.exe
  C:\Windows\System\CkRGNlu.exe
  2⤵
  PID:11932
- C:\Windows\System\wuBvvfQ.exe
  C:\Windows\System\wuBvvfQ.exe
  2⤵
  PID:11988
- C:\Windows\System\FyRcMop.exe
  C:\Windows\System\FyRcMop.exe
  2⤵
  PID:12008
- C:\Windows\System\ECOOEmX.exe
  C:\Windows\System\ECOOEmX.exe
  2⤵
  PID:12048
- C:\Windows\System\aupUwAh.exe
  C:\Windows\System\aupUwAh.exe
  2⤵
  PID:12076
- C:\Windows\System\SWnOJEg.exe
  C:\Windows\System\SWnOJEg.exe
  2⤵
  PID:12104
- C:\Windows\System\BsrcXdu.exe
  C:\Windows\System\BsrcXdu.exe
  2⤵
  PID:12136
- C:\Windows\System\nQgvFMI.exe
  C:\Windows\System\nQgvFMI.exe
  2⤵
  PID:12172
- C:\Windows\System\KAzCHkV.exe
  C:\Windows\System\KAzCHkV.exe
  2⤵
  PID:12208
- C:\Windows\System\gjfMfZN.exe
  C:\Windows\System\gjfMfZN.exe
  2⤵
  PID:12240
- C:\Windows\System\TdhABms.exe
  C:\Windows\System\TdhABms.exe
  2⤵
  PID:11296
- C:\Windows\System\HMCCuTf.exe
  C:\Windows\System\HMCCuTf.exe
  2⤵
  PID:11368
- C:\Windows\System\JBrmrBK.exe
  C:\Windows\System\JBrmrBK.exe
  2⤵
  PID:11408
- C:\Windows\System\ucsmHWG.exe
  C:\Windows\System\ucsmHWG.exe
  2⤵
  PID:11492
- C:\Windows\System\GmNPqjQ.exe
  C:\Windows\System\GmNPqjQ.exe
  2⤵
  PID:11564
- C:\Windows\System\MtSefSe.exe
  C:\Windows\System\MtSefSe.exe
  2⤵
  PID:11660
- C:\Windows\System\WajMBoq.exe
  C:\Windows\System\WajMBoq.exe
  2⤵
  PID:11716
- C:\Windows\System\vTwsdBW.exe
  C:\Windows\System\vTwsdBW.exe
  2⤵
  PID:11772
- C:\Windows\System\ofQBnWs.exe
  C:\Windows\System\ofQBnWs.exe
  2⤵
  PID:1660
- C:\Windows\System\wTEFczy.exe
  C:\Windows\System\wTEFczy.exe
  2⤵
  PID:11844
- C:\Windows\System\GSrBwcM.exe
  C:\Windows\System\GSrBwcM.exe
  2⤵
  PID:11920
- C:\Windows\System\UkxFeMg.exe
  C:\Windows\System\UkxFeMg.exe
  2⤵
  PID:11980
- C:\Windows\System\mSgmBkF.exe
  C:\Windows\System\mSgmBkF.exe
  2⤵
  PID:12028
- C:\Windows\System\lYzSblj.exe
  C:\Windows\System\lYzSblj.exe
  2⤵
  PID:12068
- C:\Windows\System\QmLLdDx.exe
  C:\Windows\System\QmLLdDx.exe
  2⤵
  PID:12128
- C:\Windows\System\lhhljxy.exe
  C:\Windows\System\lhhljxy.exe
  2⤵
  PID:12196
- C:\Windows\System\kmLUKBi.exe
  C:\Windows\System\kmLUKBi.exe
  2⤵
  PID:12232
- C:\Windows\System\yjayOxx.exe
  C:\Windows\System\yjayOxx.exe
  2⤵
  PID:11456
- C:\Windows\System\vZqjLBV.exe
  C:\Windows\System\vZqjLBV.exe
  2⤵
  PID:11688
- C:\Windows\System\xAhQCrb.exe
  C:\Windows\System\xAhQCrb.exe
  2⤵
  PID:3460
- C:\Windows\System\CAGgEQk.exe
  C:\Windows\System\CAGgEQk.exe
  2⤵
  PID:11976
- C:\Windows\System\ghqfzro.exe
  C:\Windows\System\ghqfzro.exe
  2⤵
  PID:12256
- C:\Windows\System\TphXWSR.exe
  C:\Windows\System\TphXWSR.exe
  2⤵
  PID:11628
- C:\Windows\System\HVaJHTX.exe
  C:\Windows\System\HVaJHTX.exe
  2⤵
  PID:11888
- C:\Windows\System\biUfEef.exe
  C:\Windows\System\biUfEef.exe
  2⤵
  PID:11404
- C:\Windows\System\SZAORtS.exe
  C:\Windows\System\SZAORtS.exe
  2⤵
  PID:11536
- C:\Windows\System\snkXQyh.exe
  C:\Windows\System\snkXQyh.exe
  2⤵
  PID:2372
- C:\Windows\System\DxLQQQz.exe
  C:\Windows\System\DxLQQQz.exe
  2⤵
  PID:12328
- C:\Windows\System\TzzMrFi.exe
  C:\Windows\System\TzzMrFi.exe
  2⤵
  PID:12384
- C:\Windows\System\bEZdOWp.exe
  C:\Windows\System\bEZdOWp.exe
  2⤵
  PID:12408
- C:\Windows\System\YABTzQb.exe
  C:\Windows\System\YABTzQb.exe
  2⤵
  PID:12428
- C:\Windows\System\YSGdUlf.exe
  C:\Windows\System\YSGdUlf.exe
  2⤵
  PID:12456
- C:\Windows\System\Saauygs.exe
  C:\Windows\System\Saauygs.exe
  2⤵
  PID:12492
- C:\Windows\System\ARktssF.exe
  C:\Windows\System\ARktssF.exe
  2⤵
  PID:12508
- C:\Windows\System\DTUtfvM.exe
  C:\Windows\System\DTUtfvM.exe
  2⤵
  PID:12544
- C:\Windows\System\rSCkFQH.exe
  C:\Windows\System\rSCkFQH.exe
  2⤵
  PID:12576
- C:\Windows\System\xkeDgvj.exe
  C:\Windows\System\xkeDgvj.exe
  2⤵
  PID:12592
- C:\Windows\System\MdXDcaT.exe
  C:\Windows\System\MdXDcaT.exe
  2⤵
  PID:12624
- C:\Windows\System\EcZEtHy.exe
  C:\Windows\System\EcZEtHy.exe
  2⤵
  PID:12668
- C:\Windows\System\lZhfmhB.exe
  C:\Windows\System\lZhfmhB.exe
  2⤵
  PID:12692
- C:\Windows\System\LJjGmXS.exe
  C:\Windows\System\LJjGmXS.exe
  2⤵
  PID:12716
- C:\Windows\System\GnSqgle.exe
  C:\Windows\System\GnSqgle.exe
  2⤵
  PID:12752
- C:\Windows\System\pkquwIQ.exe
  C:\Windows\System\pkquwIQ.exe
  2⤵
  PID:12780
- C:\Windows\System\NCcGHpS.exe
  C:\Windows\System\NCcGHpS.exe
  2⤵
  PID:12812
- C:\Windows\System\okQYQZu.exe
  C:\Windows\System\okQYQZu.exe
  2⤵
  PID:12840
- C:\Windows\System\jmdCeKm.exe
  C:\Windows\System\jmdCeKm.exe
  2⤵
  PID:12864
- C:\Windows\System\hdXOdDt.exe
  C:\Windows\System\hdXOdDt.exe
  2⤵
  PID:12892
- C:\Windows\System\SgbxBfg.exe
  C:\Windows\System\SgbxBfg.exe
  2⤵
  PID:12912
- C:\Windows\System\TaCCVWh.exe
  C:\Windows\System\TaCCVWh.exe
  2⤵
  PID:12952
- C:\Windows\System\hznqFCP.exe
  C:\Windows\System\hznqFCP.exe
  2⤵
  PID:12968
- C:\Windows\System\cihIHHp.exe
  C:\Windows\System\cihIHHp.exe
  2⤵
  PID:12992
- C:\Windows\System\wcotcVh.exe
  C:\Windows\System\wcotcVh.exe
  2⤵
  PID:13016
- C:\Windows\System\CldhqRN.exe
  C:\Windows\System\CldhqRN.exe
  2⤵
  PID:13048
- C:\Windows\System\khisiVY.exe
  C:\Windows\System\khisiVY.exe
  2⤵
  PID:13092
- C:\Windows\System\TxSuqsY.exe
  C:\Windows\System\TxSuqsY.exe
  2⤵
  PID:13116
- C:\Windows\System\LVSzoSI.exe
  C:\Windows\System\LVSzoSI.exe
  2⤵
  PID:13140
- C:\Windows\System\eUFoJQc.exe
  C:\Windows\System\eUFoJQc.exe
  2⤵
  PID:13164
- C:\Windows\System\VVEthPd.exe
  C:\Windows\System\VVEthPd.exe
  2⤵
  PID:13200
- C:\Windows\System\ZvjbUam.exe
  C:\Windows\System\ZvjbUam.exe
  2⤵
  PID:13224
- C:\Windows\System\rYrkbwD.exe
  C:\Windows\System\rYrkbwD.exe
  2⤵
  PID:13260
- C:\Windows\System\RrzfkWb.exe
  C:\Windows\System\RrzfkWb.exe
  2⤵
  PID:13280

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_u153dx4f.vbg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u153dx4f.vbg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

EmTayMX.exe

Path C:\Windows\System\EmTayMX.exe
Size 2.9MB
SHA256 f95b6e3a458021a455b5a17988547b340128c17ae157d2d6cca9036ad255b40e
MD5 47ff9665e33869188e45c6f9ed0da9f7
SHA1 ad63b0d7d7a387459648fb770c29462fa756e60a
SHA512 9bf8942bb0d5a65df7abab7de98a40c8ca46774c86d377a4d077e785b72e8b1081cd8829f78b1434210ac43ee611ad296c82c110183f74518061e8a161bb0b6c
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz3C:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RP
MD5 SHA1 SHA512 SSDEEP

Submit Download

FFhSnaA.exe

Path C:\Windows\System\FFhSnaA.exe
Size 2.9MB
SHA256 a2c32b6e647b86f5d4ce4517c7886159aa239281a8ae52f4980357e90ce90421
MD5 1ad778ae5b4a6580a6eae25d8bd4936c
SHA1 cb195ee35c396ba8fece7b5925a291f8a4710fb2
SHA512 71b67af60729185460b481bdc9d59cc0ec153f8f5a4ff987f45212aa2906a20046583a3ffc5099a1b66dd633296b3be6941cacb10d4a3228940fb1cf0f9d8f6f
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz32:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R5
MD5 SHA1 SHA512 SSDEEP

Submit Download

JxJagUt.exe

Path C:\Windows\System\JxJagUt.exe
Size 2.9MB
SHA256 38fa96e04051dfdebc932ab39e7f677bfb80346d8a7baef449ab99ddf6811b4d
MD5 4676840f48c7f3f514cabd32d2a33cfe
SHA1 81a25b470860a1190d3556f47fbaa2b9775b0ebe
SHA512 051dd9024f333f401770dccdfee6b2d57704ab092021b8fe0a693b00a9befefd1d3703a794f8770ee220781f44f0dc797a3e279c9fb13a0b276b38a944bcaf36
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz3r:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R6
MD5 SHA1 SHA512 SSDEEP

Submit Download

MBRYqJI.exe

Path C:\Windows\System\MBRYqJI.exe
Size 2.9MB
SHA256 a598c69565f5e5fac91519c656129fcc88245ffc37ba71cecb02b5ae5154e87e
MD5 8690ad948ea7b90d2a6a7c7a966d4cf7
SHA1 ff6fe327c8619e4250b97c82605e4f562a5c6c7e
SHA512 5e9c497baa95a6cf70133b3fd3dc9365417b2d5ee5d94afa250b47cd6f2aef9786e0a723cd2982f9e1a773fa6598ba42762aeca04ab5c2877ef14c5eca40b4b8
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz3Y:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rh
MD5 SHA1 SHA512 SSDEEP

Submit Download

NAXQXBE.exe

Path C:\Windows\System\NAXQXBE.exe
Size 2.9MB
SHA256 ea7db754ecd8ffef17bc0549e2cb568bd7f0612802a0d0457c55b3980d6f4a01
MD5 5b359ff0045b46a144c025a10fdf765c
SHA1 9afa00a86690208ab3ed5be9054f744af293642f
SHA512 dc5915e42483b2242fc1b0bb5f6e934265978c314f93a31217ef4d0873507c00e765deb29a255169e19625e981050adec16145ed84d362d8c9865bc579dfc423
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz3q:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RR
MD5 SHA1 SHA512 SSDEEP

Submit Download

NPVTdtB.exe

Path C:\Windows\System\NPVTdtB.exe
Size 2.9MB
SHA256 37fb04ea5249910ffa8226c7de3a768302ce5b1c9f64b64839005d30301e180e
MD5 5df565ada20e4bfbb27f272ea3ba8f04
SHA1 78f4c5cc2c50547dc8d3171a2dda203c069d5f2d
SHA512 b6dc01d5b01b9c10cdc564c82c46e6bd1e653c743c123f1bba098245fe8a11da373f1299d87bfdfe85077b9605054ff4d920a48032bb8fb8f932bde0e87e2eae
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz3p:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rw
MD5 SHA1 SHA512 SSDEEP

Submit Download

SFJjrKJ.exe

Path C:\Windows\System\SFJjrKJ.exe
Size 2.9MB
SHA256 52033eaa50bb02880170f7604e2bd3f7fdfd665b6bd9992fc1702293fa3f0a59
MD5 54f4acc0456b324dc3750909d13f5dc7
SHA1 e7d92941d3deca7bea091ebc54e52c5ac9416e71
SHA512 19badf44561accbacd59439447e375e832afb00ce6f830d4d530ce76db96610334f39f05ed337dc4c2c062b35411bf540894d9b363941e22791aac46a4167ba3
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz3i:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RB
MD5 SHA1 SHA512 SSDEEP

Submit Download

VghrjZZ.exe

Path C:\Windows\System\VghrjZZ.exe
Size 2.9MB
SHA256 c287230fcc0b914efa4e01b6cba0e9b104d0e213c8ffb2dd69a70bd655f25f62
MD5 851c064e98eda44e03ac31f07c22f5a0
SHA1 bfd7275649cf7097a2d77e7432494bd73110e55a
SHA512 a0da29fdd318ccfec43bcd45d7894669e149ae985e18be328137e542092152af11bc00f6f021b836bde9be7018482b048e26d8d915764738cc59b5dc8cce8d89
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz3/:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R0
MD5 SHA1 SHA512 SSDEEP

Submit Download

WvXvrCE.exe

Path C:\Windows\System\WvXvrCE.exe
Size 2.9MB
SHA256 72073a86fa51aef3a73c7bc49a236509998b18a0b4ba4858a811119d0563e5e4
MD5 d41aff67d9ac1af6dc5fa82c8e696897
SHA1 ae621dc108b46f6e62bdaaf1b47ea5ae54cfa8b1
SHA512 3d6e5a0374e095501eb801110b27696f2fa099d85d88798f05d6ced58c42e95dd051970375b4267b8aee98f18f8d340241f5943938dc904ab0fb1272cb02ca45
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz3O:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R5
MD5 SHA1 SHA512 SSDEEP

Submit Download

XYRyMVz.exe

Path C:\Windows\System\XYRyMVz.exe
Size 2.9MB
SHA256 3576d85d34586497672be5de22d74cd488c3c285c3195be897be2a5354e272e5
MD5 e56fec8710dd50fd6df0ad48b23a911e
SHA1 4447186a8c9a4e18c2e9d75cfb4ff2b60d8c1ad5
SHA512 33bc29dc3cc4cc65f37aa30898f819cc82c3e37dd4aa8afcab2c15731a2056a9dc3c5e17c4b9cdc76e3c4aa4280a0ca145552839e3c502dc9a198d2295601417
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz3+:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RD
MD5 SHA1 SHA512 SSDEEP

Submit Download

XryrajB.exe

Path C:\Windows\System\XryrajB.exe
Size 2.9MB
SHA256 8a53a4d92093910a61b32ea48cbbef185c5dc291ed569b2d6547a9c15b9cc190
MD5 d022a2d3d0750b298748749dea18eef2
SHA1 dcaf70c580427a10d0856fcc717332f7ae08157c
SHA512 cbbfc5f49abc738bee3f12ece54acbfeb8bc45abbadc6109b2b925b50c4a3e92a8531c18d4b104b2b89b9f8c217b33bc0e44c3ac31cb0d1b6fd303317c44d2ee
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz3y:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rn
MD5 SHA1 SHA512 SSDEEP

Submit Download

YQMGeBi.exe

Path C:\Windows\System\YQMGeBi.exe
Size 2.9MB
SHA256 f0d72ba57b1ae94aaa2bae7c83c6bf3aed0c69ca154271cb565a536962bcef93
MD5 2a4fe983f175d3972c44c49af1dece27
SHA1 5a4d0279e6083ddb5f946efed3d8b47219a344e6
SHA512 7ebdb4ae64cb0e086e4d6f02b9ab29f4722de01d7b12f57a09fe8dbceabc0c720b85cfeaf170c57f1c771e30683f16bab3e54f7cd17732c47f80573bb3864732
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz3d:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RS
MD5 SHA1 SHA512 SSDEEP

Submit Download

YVJdrXW.exe

Path C:\Windows\System\YVJdrXW.exe
Size 2.9MB
SHA256 b52187436509115d721e0fda84732af5aceb155cb3671c1ab9be6983bb37ee74
MD5 c5306516bcc90a64b2cc312db106d7cf
SHA1 e7d261fcdb91bc75e03856642305c166c35c56d4
SHA512 77760ac7e3a914fcb3b088fe990dbafe6d627e4ee20b6b6f8c673ca4978852bbd61644f73a33526f60b92cca679231caa5d9bacf14b9895faf6092767512c82b
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz3b:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Ri
MD5 SHA1 SHA512 SSDEEP

Submit Download

aqDObGM.exe

Path C:\Windows\System\aqDObGM.exe
Size 2.9MB
SHA256 134d04fd1adb053a3c7376597375d14bacb7e1b420e323ae8970eec702b4f544
MD5 7daefe441177dea9b3b893e2ba6b228f
SHA1 f87f8bf7bb0fc10cfa40b0ccaea057a8d2eab192
SHA512 77152c1f6181044e1cd5000dedfb0d4a9280af1847db1c6640d163867a437b5304d3fefe588388dfe4b3537c730693c4a3521fcdde726d10e4ee0be0e1292b73
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz3a:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RR
MD5 SHA1 SHA512 SSDEEP

Submit Download

bAAjYHL.exe

Path C:\Windows\System\bAAjYHL.exe
Size 2.9MB
SHA256 83301ef195f319dd367d78734f6dd6aff6546272190f1380a517c35dc6dc9b61
MD5 8d6120bedc8958e0001068cf33cb29d1
SHA1 672fb6afff1ca1fa61fbf7fd3902a7992633ed99
SHA512 94064d0bcf32ac91830b3fc3d44e69c2ffbaa1e0aec1148d0bceb625ccd60dd86c26f01b7ad2ed21d003abfa887993ebc3a9fb6677333fbb5a1d1c3736da5568
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz3w:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rr
MD5 SHA1 SHA512 SSDEEP

Submit Download

dkfXtNc.exe

Path C:\Windows\System\dkfXtNc.exe
Size 8B
SHA256 945d12760562a76bb5610a082b9c7801a49c6c9de534141d0c528ee6828f8992
MD5 9962fa9c120fa4be5b0a3f7a74dbcadf
SHA1 b6f88aa1c093b2340de068ac2ff30cce108e3fc6
SHA512 b2eeefcd3c65dccb02eb4079fd8fe88b36ae6927cd8ddb4de7afd16b396b895522c8feb1cc1373ad7adcb7732e1d37129de60c1aaea95865a3c1e13ac02b6cac
MD5 SHA1 SHA512

Submit Download

duuEErD.exe

Path C:\Windows\System\duuEErD.exe
Size 2.9MB
SHA256 df7501d3a677c1ea61ee204bd2ac912cfbd691d9e4d202f0421b9d0920ccfb8b
MD5 f15395993d30cbdb6e02fbaf17fa503b
SHA1 bad1c4f510710dd485f2c9f52943078f1fff3b70
SHA512 12e8f73e1eec0c1658b3ce9758c305f287a7622297ee4a35afc8bb38f734113b5b3e9ad45e43790707ed414e85f7b14593de9649f3242cb3e7abef64e0bfdd65
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz3D:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Ry
MD5 SHA1 SHA512 SSDEEP

Submit Download

fJTbuAO.exe

Path C:\Windows\System\fJTbuAO.exe
Size 2.9MB
SHA256 725ca071625165cb98a57c740c1b81684646cf2eaf5704c8814fa10c78b56f44
MD5 60619be550396657bde18fa13c864427
SHA1 cf89c184dc4b35782f0ad9d09eadceee5d5a6cd0
SHA512 5b92a9078634ab378ec10c00d27fb0d3309c98b46021d3178cf164284ad33e10b78bc75649ecff2769416c49658de839a26c5cc186d7468a6a85b913e5157668
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz3a:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rh
MD5 SHA1 SHA512 SSDEEP

Submit Download

gQhIEmU.exe

Path C:\Windows\System\gQhIEmU.exe
Size 2.9MB
SHA256 0a4d5ac4422fc9269f3acaa72359381c240f72fe591abfa8de5f1b6d18c350ca
MD5 1e41150b3164611b2e86f332e91b0505
SHA1 44b88b9a2cc15fa9d17ef96fcc97ef94cf09d988
SHA512 24242bbc18476707f24a7ea8c2aab1591f7d13551e7e8300da932b959510944d459945ba1b605182535f1567c9d1422412b4f34db06469f0df6a0dae73f56e36
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz3Z:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RA
MD5 SHA1 SHA512 SSDEEP

Submit Download

hbNHTaD.exe

Path C:\Windows\System\hbNHTaD.exe
Size 2.9MB
SHA256 840adb578e30ef451141827cb1381e9b8d1222e362b44e974c192f590a7fa587
MD5 293b0c0f556e251b21cbd5ee2bca4a03
SHA1 2960eed9eb5079ca7dec75b1a345dcfd0a14fc73
SHA512 6286a394af98cd703a2615c65b7654ff04cf9e3b2124118dbce335590f0376d9b7cb33b0856b0fe2cefe8dac28a2c6aa105036eddfb24bcef644a6c75c804549
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz3m:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R5
MD5 SHA1 SHA512 SSDEEP

Submit Download

joyelUu.exe

Path C:\Windows\System\joyelUu.exe
Size 2.9MB
SHA256 1c15349e3f2537d75978d41d23d5acd1fc2dd8884dc3ce1171707ebdbcc73e7e
MD5 2a3c360b058cc5499b6f4ed3ddbe2739
SHA1 34a3d3d9205dad0a3c1555ca96b8db96988ba1af
SHA512 155158dd570065df9c742f2407f87301f2e23e41f59413d83587948096682bddd2cb6c11840d30a31a3ea84bce3ce63604b9b2efc1768a509a348f4a595e0f6d
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz34:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RL
MD5 SHA1 SHA512 SSDEEP

Submit Download

lLpGBhk.exe

Path C:\Windows\System\lLpGBhk.exe
Size 2.9MB
SHA256 6b4b4424bf19347fdac726b769989377fc9a16074cb759b3581f05c6d1de7b37
MD5 062b36faaa612b52ae8fae8cad9c1442
SHA1 1ddeb5bbdf60bce259156752e358306cc577940d
SHA512 6dfb5e5c36c0fa511c95e7396d4d52048bff9b77086ac113bd2122e1eaf935907d7a5127af66b5ed69b959f35f9b3726caa34aa5798dc67994d0ed3a40d3cfc4
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz3B:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

lOPDdWy.exe

Path C:\Windows\System\lOPDdWy.exe
Size 2.9MB
SHA256 4d3d71c8d24e198f70ce4282b885a657918e9fd60d003c6dccb6d812d56ebeb2
MD5 25802a383f350c2c985abc334742ca5a
SHA1 24ef93f7ff42a8e27f11871837e40e21d9f4ff57
SHA512 b89a8c1e18b1c38a1939b2829c87d2d56687ced1f9892151ab9692689d732dcbbd90c4ab3654c62732e400bb7475bce8caacdc2a354447ae60dc76af0dc15319
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz3D:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rc
MD5 SHA1 SHA512 SSDEEP

Submit Download

lkdfAnm.exe

Path C:\Windows\System\lkdfAnm.exe
Size 2.9MB
SHA256 dd3f810c52f1153c050b1ff0946a9b3d7cdac375a159c7f9839affc0920a129a
MD5 68d5d0b601a0afb91fc72bca2ce0b2ff
SHA1 f8667263f596b26e307cee49e6e2e77534544cc7
SHA512 e0f4976917be625f4f0e250aa0b9e4d87e49c651cb68ff52fa65f0c714053c7cff5130c1082f8bde53b84df48662e6a8257a5af22a628960a1f9af684f50740c
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz3F:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Ru
MD5 SHA1 SHA512 SSDEEP

Submit Download

lxCflva.exe

Path C:\Windows\System\lxCflva.exe
Size 2.9MB
SHA256 47245fc402c9d0aaaa6215d1cb2742007dd5da5a0d5b31c1330e15bf6e9143ff
MD5 594dc620f017e2e47566806c0bff875a
SHA1 c6a06984d111d44eb4d537e8cf983feec50dfca9
SHA512 c7636e8bdd18f3cc43df449325ef488656e3c8ac6481d36fd082d710c39e7a9d20e2d9fe6f0b21ecec96ece53f6edc04929d11def0f236250975cd128ecc2b93
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz3/:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

mdPMQMO.exe

Path C:\Windows\System\mdPMQMO.exe
Size 2.9MB
SHA256 087e91fbb2b21f882176b1fe4b7ed03396fac4799a969f8b60f92772dcbb083b
MD5 a8f568ea0e4589d8f42870a6a25320dd
SHA1 59cbd67616221c9fafd0a15f507d02172eed516d
SHA512 6b6cfa1bc288ad7e203dcb9a5500754414093d26accf0368e9ddfa862566bebb21b8834c2d3219c7a5e5836ecdd1070713b83897f9fb87d8ed8bf9bdfa2a0670
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz3D:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Re
MD5 SHA1 SHA512 SSDEEP

Submit Download

nNOeHrv.exe

Path C:\Windows\System\nNOeHrv.exe
Size 2.9MB
SHA256 7d4dc531e310b437b99541d29ed4c6397cb7b72b31adfe892eaca443eb13d3ec
MD5 e48deec65edc11b8047e48761a853d58
SHA1 59098f169d101080a64bf9945c16facb789ce2e8
SHA512 ee13a2fd49240893e442a0dd0971f2be8a8314eca018b20c6ff1e207906cd6f0361b16b291500531f1fe5c6f2149f5094dbc03fb0405eec26313728db8f4bf33
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz3l:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R2
MD5 SHA1 SHA512 SSDEEP

Submit Download

rrzmAmz.exe

Path C:\Windows\System\rrzmAmz.exe
Size 2.9MB
SHA256 e3a385af01fdf3e81e86bda354ce813062ce9edb3a6692768d108bb1560a44e1
MD5 ce5af7b0087437c35a017309768d52e7
SHA1 9dd14a1a1991ce24ec2395fa1b9b5de9134e7f4d
SHA512 f7f56a09b0bce2fbeca9e0d9d47ebdeac89566efb20265aa17e3035880966c59fee5e971822932f7f36578891ca2cbe0201219856f8835c7fb9f8b602cc16e30
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz3E:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R1
MD5 SHA1 SHA512 SSDEEP

Submit Download

soJQKqm.exe

Path C:\Windows\System\soJQKqm.exe
Size 2.9MB
SHA256 d9e46d9bda54cec502fe5d74b5eeee7e949fe33fe68bae1627936ca5e41b9c01
MD5 c83c57768aeb841e87d4c3662fa059ba
SHA1 06791ac849e3509fbbe7bbb19a2ab1ef471c600c
SHA512 a5b184ca50e2fe1650e649e391745b4290ef3c0993f4cf68fbbd18139d6364c373eb884005daf37ec5a529750893a64a773eaa21ebf49c11f077ff085bccfc24
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz3H:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rq
MD5 SHA1 SHA512 SSDEEP

Submit Download

tAeSYJG.exe

Path C:\Windows\System\tAeSYJG.exe
Size 2.9MB
SHA256 34c45142f5b07753b1049c29c31464ae0dbce39137113ea41d83b20d291859cf
MD5 3f1da0ea3a9ff5f53f97f9f782384b07
SHA1 0e0d2cb113a3d9eff66b064fb344d9ab0b560a57
SHA512 686e49eeada503aa95aa4c41356d0850fbce930c62cbe7436ebf68da569fcdd5d5071fd55431ed33b95b871544ed478f19f4d95b105d40a67d3eebcced4c211c
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz34:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rd
MD5 SHA1 SHA512 SSDEEP

Submit Download

wUwMuPs.exe

Path C:\Windows\System\wUwMuPs.exe
Size 2.9MB
SHA256 03618a9b5ba86058deaf71b83524e2e0b23f301cc724da89345c3b9d12c6cc81
MD5 ebda43043175af2ea0006015f307d063
SHA1 95add714a70f0015b0adbd2334ab42b41657d5f3
SHA512 c659f7f790523e4c84649e5da1460f41b72de31787bea10f00ceed6060a5d09c40511b6bdd92350ca068d7094da0967f19906e9d4bc178fccb3eed773cbee78a
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz3p:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Ra
MD5 SHA1 SHA512 SSDEEP

Submit Download

wwYIQGP.exe

Path C:\Windows\System\wwYIQGP.exe
Size 2.9MB
SHA256 9bfb2dd64639c678d99022627460cf35dca8ad75dc3485827761d1c936c9c241
MD5 77fa49d7f55c02dc305d81f0ed382b37
SHA1 f9bd909f9ee80568b4c4053804595a2fce024397
SHA512 0024b7f1a4480e17f22dcdfa2dd32766ae5d612befecea7d5024e08947925a2486b0012cb895a6b42cd5ade116b7320404272bed580ea7f4e4b1645096b54b40
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz3H:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Re
MD5 SHA1 SHA512 SSDEEP

Submit Download

zMHbfNH.exe

Path C:\Windows\System\zMHbfNH.exe
Size 2.9MB
SHA256 f31d8af3723a421dbe851186df8f246af7848e5b13b302ebedcfc22180c0e70b
MD5 17b7e69a53c229cd84c263b788421007
SHA1 0d43767083e5c2a18fe4e64c8432713ad7c2ff00
SHA512 b01deb6041d517813a73219d340a228b2c75cf0b857cf51eb8e45273614fb20dba4755307cfe9a47f4cffe8bd156d80752d75a4f71ac96926ad783dd8bbc3326
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz3x:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/412-2477-0x00007FF715AF0000-0x00007FF715EE6000-memory.dmp

Download

memory/412-110-0x00007FF715AF0000-0x00007FF715EE6000-memory.dmp

Download

memory/1124-111-0x00007FF69C360000-0x00007FF69C756000-memory.dmp

Download

memory/1124-2476-0x00007FF69C360000-0x00007FF69C756000-memory.dmp

Download

memory/1372-199-0x00007FF6DB100000-0x00007FF6DB4F6000-memory.dmp

Download

memory/1372-2491-0x00007FF6DB100000-0x00007FF6DB4F6000-memory.dmp

Download

memory/1404-92-0x00007FF714B50000-0x00007FF714F46000-memory.dmp

Download

memory/1404-2478-0x00007FF714B50000-0x00007FF714F46000-memory.dmp

Download

memory/1412-1-0x000002A5CBA50000-0x000002A5CBA60000-memory.dmp

Download

memory/1412-0-0x00007FF6286E0000-0x00007FF628AD6000-memory.dmp

Download

memory/1492-2474-0x00007FF6989F0000-0x00007FF698DE6000-memory.dmp

Download

memory/1492-194-0x00007FF6989F0000-0x00007FF698DE6000-memory.dmp

Download

memory/1864-2480-0x00007FF769390000-0x00007FF769786000-memory.dmp

Download

memory/1864-123-0x00007FF769390000-0x00007FF769786000-memory.dmp

Download

memory/1888-116-0x00007FF779D50000-0x00007FF77A146000-memory.dmp

Download

memory/1888-2479-0x00007FF779D50000-0x00007FF77A146000-memory.dmp

Download

memory/1940-2497-0x00007FF6BB750000-0x00007FF6BBB46000-memory.dmp

Download

memory/1940-192-0x00007FF6BB750000-0x00007FF6BBB46000-memory.dmp

Download

memory/2184-197-0x00007FF7AC4F0000-0x00007FF7AC8E6000-memory.dmp

Download

memory/2184-2489-0x00007FF7AC4F0000-0x00007FF7AC8E6000-memory.dmp

Download

memory/2356-2486-0x00007FF6AA320000-0x00007FF6AA716000-memory.dmp

Download

memory/2356-131-0x00007FF6AA320000-0x00007FF6AA716000-memory.dmp

Download

memory/2424-2496-0x00007FF7B8EE0000-0x00007FF7B92D6000-memory.dmp

Download

memory/2424-176-0x00007FF7B8EE0000-0x00007FF7B92D6000-memory.dmp

Download

memory/2596-126-0x00007FF787330000-0x00007FF787726000-memory.dmp

Download

memory/2596-2488-0x00007FF787330000-0x00007FF787726000-memory.dmp

Download

memory/2956-2482-0x00007FF6A9560000-0x00007FF6A9956000-memory.dmp

Download

memory/2956-195-0x00007FF6A9560000-0x00007FF6A9956000-memory.dmp

Download

memory/3180-193-0x00007FF6BA8A0000-0x00007FF6BAC96000-memory.dmp

Download

memory/3180-2493-0x00007FF6BA8A0000-0x00007FF6BAC96000-memory.dmp

Download

memory/3224-2472-0x00007FFF04090000-0x00007FFF04B51000-memory.dmp

Download

memory/3224-80-0x000001C34D780000-0x000001C34D7A2000-memory.dmp

Download

memory/3224-2473-0x00007FFF04093000-0x00007FFF04095000-memory.dmp

Download

memory/3224-34-0x00007FFF04090000-0x00007FFF04B51000-memory.dmp

Download

memory/3224-5-0x00007FFF04093000-0x00007FFF04095000-memory.dmp

Download

memory/3224-251-0x000001C366750000-0x000001C366EF6000-memory.dmp

Download

memory/3224-65-0x00007FFF04090000-0x00007FFF04B51000-memory.dmp

Download

memory/3292-2490-0x00007FF70E6C0000-0x00007FF70EAB6000-memory.dmp

Download

memory/3292-191-0x00007FF70E6C0000-0x00007FF70EAB6000-memory.dmp

Download

memory/3372-125-0x00007FF6ECFA0000-0x00007FF6ED396000-memory.dmp

Download

memory/3372-2487-0x00007FF6ECFA0000-0x00007FF6ED396000-memory.dmp

Download

memory/3492-196-0x00007FF681520000-0x00007FF681916000-memory.dmp

Download

memory/3492-2481-0x00007FF681520000-0x00007FF681916000-memory.dmp

Download

memory/3512-2494-0x00007FF799CF0000-0x00007FF79A0E6000-memory.dmp

Download

memory/3512-155-0x00007FF799CF0000-0x00007FF79A0E6000-memory.dmp

Download

memory/3936-2485-0x00007FF6F1120000-0x00007FF6F1516000-memory.dmp

Download

memory/3936-124-0x00007FF6F1120000-0x00007FF6F1516000-memory.dmp

Download

memory/4100-2484-0x00007FF694450000-0x00007FF694846000-memory.dmp

Download

memory/4100-122-0x00007FF694450000-0x00007FF694846000-memory.dmp

Download

memory/4404-2495-0x00007FF7E7310000-0x00007FF7E7706000-memory.dmp

Download

memory/4404-198-0x00007FF7E7310000-0x00007FF7E7706000-memory.dmp

Download

memory/4552-2483-0x00007FF778360000-0x00007FF778756000-memory.dmp

Download

memory/4552-121-0x00007FF778360000-0x00007FF778756000-memory.dmp

Download

memory/5020-39-0x00007FF77E520000-0x00007FF77E916000-memory.dmp

Download

memory/5020-2475-0x00007FF77E520000-0x00007FF77E916000-memory.dmp

Download

memory/5116-165-0x00007FF789E50000-0x00007FF78A246000-memory.dmp

Download

memory/5116-2492-0x00007FF789E50000-0x00007FF78A246000-memory.dmp

Download