xmrig | b0ffef52d4f731bdb9a44641693ea1448915ef4c2f928fe84f7e42b755467725

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
Size 1.5MB
Sample240526-xth3vsgf51
SHA256 b0ffef52d4f731bdb9a44641693ea1448915ef4c2f928fe84f7e42b755467725
MD5 9c20cc397e93a8ee8c72dd6c350b5490
SHA1 a4d0d28ab39283d4fd32f2d70cffb6131f32f77b
SHA512 ebf0402000a1b8afe5fc296e7f9477b17d8390a35dd93b20d177171a4a380532eb2e52267d42a34b6633c7c3e5f817c29b9e9d92cee456497acc69cec02bc93b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjMt:Lz071uv4BPMki8Cnki2WGcNLP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 47 IoCs

miner

resource	yara_rule
behavioral2/memory/5100-229-0x00007FF647A20000-0x00007FF647E12000-memory.dmp	xmrig
behavioral2/memory/1140-234-0x00007FF6062B0000-0x00007FF6066A2000-memory.dmp	xmrig
behavioral2/memory/2072-239-0x00007FF6211D0000-0x00007FF6215C2000-memory.dmp	xmrig
behavioral2/memory/3124-245-0x00007FF6C5C60000-0x00007FF6C6052000-memory.dmp	xmrig
behavioral2/memory/1332-247-0x00007FF68F8C0000-0x00007FF68FCB2000-memory.dmp	xmrig
behavioral2/memory/4040-246-0x00007FF774AB0000-0x00007FF774EA2000-memory.dmp	xmrig
behavioral2/memory/1964-244-0x00007FF63EB10000-0x00007FF63EF02000-memory.dmp	xmrig
behavioral2/memory/4048-243-0x00007FF71A360000-0x00007FF71A752000-memory.dmp	xmrig
behavioral2/memory/1676-237-0x00007FF74A540000-0x00007FF74A932000-memory.dmp	xmrig
behavioral2/memory/4520-236-0x00007FF74FF00000-0x00007FF7502F2000-memory.dmp	xmrig
behavioral2/memory/4568-235-0x00007FF688D70000-0x00007FF689162000-memory.dmp	xmrig
behavioral2/memory/436-233-0x00007FF689220000-0x00007FF689612000-memory.dmp	xmrig
behavioral2/memory/3008-232-0x00007FF6414A0000-0x00007FF641892000-memory.dmp	xmrig
behavioral2/memory/4092-231-0x00007FF727F40000-0x00007FF728332000-memory.dmp	xmrig
behavioral2/memory/2560-230-0x00007FF712D10000-0x00007FF713102000-memory.dmp	xmrig
behavioral2/memory/3112-228-0x00007FF684770000-0x00007FF684B62000-memory.dmp	xmrig
behavioral2/memory/1104-227-0x00007FF6C7610000-0x00007FF6C7A02000-memory.dmp	xmrig
behavioral2/memory/1424-194-0x00007FF7AC170000-0x00007FF7AC562000-memory.dmp	xmrig
behavioral2/memory/1172-160-0x00007FF72E7E0000-0x00007FF72EBD2000-memory.dmp	xmrig
behavioral2/memory/1424-2981-0x00007FF7AC170000-0x00007FF7AC562000-memory.dmp	xmrig
behavioral2/memory/3112-2987-0x00007FF684770000-0x00007FF684B62000-memory.dmp	xmrig
behavioral2/memory/4568-2989-0x00007FF688D70000-0x00007FF689162000-memory.dmp	xmrig
behavioral2/memory/1332-2991-0x00007FF68F8C0000-0x00007FF68FCB2000-memory.dmp	xmrig
behavioral2/memory/5100-2993-0x00007FF647A20000-0x00007FF647E12000-memory.dmp	xmrig
behavioral2/memory/1140-2985-0x00007FF6062B0000-0x00007FF6066A2000-memory.dmp	xmrig
behavioral2/memory/4040-2983-0x00007FF774AB0000-0x00007FF774EA2000-memory.dmp	xmrig
behavioral2/memory/1104-2979-0x00007FF6C7610000-0x00007FF6C7A02000-memory.dmp	xmrig
behavioral2/memory/3124-2977-0x00007FF6C5C60000-0x00007FF6C6052000-memory.dmp	xmrig
behavioral2/memory/1172-2975-0x00007FF72E7E0000-0x00007FF72EBD2000-memory.dmp	xmrig
behavioral2/memory/2268-2973-0x00007FF642560000-0x00007FF642952000-memory.dmp	xmrig
behavioral2/memory/1676-3012-0x00007FF74A540000-0x00007FF74A932000-memory.dmp	xmrig
behavioral2/memory/4520-3016-0x00007FF74FF00000-0x00007FF7502F2000-memory.dmp	xmrig
behavioral2/memory/4092-3010-0x00007FF727F40000-0x00007FF728332000-memory.dmp	xmrig
behavioral2/memory/436-3008-0x00007FF689220000-0x00007FF689612000-memory.dmp	xmrig
behavioral2/memory/3008-3006-0x00007FF6414A0000-0x00007FF641892000-memory.dmp	xmrig
behavioral2/memory/1964-3002-0x00007FF63EB10000-0x00007FF63EF02000-memory.dmp	xmrig
behavioral2/memory/4048-2999-0x00007FF71A360000-0x00007FF71A752000-memory.dmp	xmrig
behavioral2/memory/2072-2997-0x00007FF6211D0000-0x00007FF6215C2000-memory.dmp	xmrig
behavioral2/memory/2560-2995-0x00007FF712D10000-0x00007FF713102000-memory.dmp	xmrig
behavioral2/memory/3184-3112-0x00007FF611E40000-0x00007FF612232000-memory.dmp	xmrig
behavioral2/memory/744-3115-0x00007FF6EB2F0000-0x00007FF6EB6E2000-memory.dmp	xmrig
behavioral2/memory/1148-3113-0x00007FF7C2550000-0x00007FF7C2942000-memory.dmp	xmrig
behavioral2/memory/1972-3111-0x00007FF6A4510000-0x00007FF6A4902000-memory.dmp	xmrig
behavioral2/memory/1972-3118-0x00007FF6A4510000-0x00007FF6A4902000-memory.dmp	xmrig
behavioral2/memory/744-3127-0x00007FF6EB2F0000-0x00007FF6EB6E2000-memory.dmp	xmrig
behavioral2/memory/3184-3132-0x00007FF611E40000-0x00007FF612232000-memory.dmp	xmrig
behavioral2/memory/1148-3148-0x00007FF7C2550000-0x00007FF7C2942000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2784	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2268	KcyfBJO.exe
1172	cfSlbQu.exe
3124	hHpATik.exe
4040	cOZnqan.exe
1424	qyVFcUC.exe
1104	IfODJGv.exe
3112	LQfmTpJ.exe
5100	aCvhzBC.exe
2560	zpJnDnx.exe
4092	GzCqXYB.exe
3008	fBYNyen.exe
1332	nvjnICk.exe
436	LZLzOpf.exe
1140	IMlvedx.exe
4568	AoCaRBM.exe
4520	urJZSsv.exe
1676	HVvYmvK.exe
1972	RpNhlKv.exe
2072	bPhKtNb.exe
3184	lWfJFJN.exe
1148	FDaRWaH.exe
744	oUhRYkl.exe
4048	FtIUjWP.exe
1964	ZulutUf.exe
4044	mMOvasa.exe
3708	wUOnoJg.exe
3904	FzWaWLk.exe
4572	atwjvXh.exe
4848	LXKDGbj.exe
3372	rOwANiZ.exe
4620	mdQPXxV.exe
2456	dXSxnhX.exe
1048	jvFxHKK.exe
3592	DIocEIF.exe
4444	qqjaXXt.exe
3632	koZDETq.exe
3016	JoynUlg.exe
4300	XyFonMt.exe
3816	QUEBDOR.exe
1516	GBvbEkl.exe
1744	MgCBeAp.exe
3152	xrMFqCG.exe
3596	YMYCQyx.exe
692	zCzJPDp.exe
1120	NwSPaMI.exe
2116	PhbsVeS.exe
1112	ctCgZlY.exe
2284	hSuvvOW.exe
1628	zLLxrfK.exe
1280	qCRRNsZ.exe
4912	mdsaEnA.exe
4388	FFtRSeN.exe
3340	BjshKfg.exe
3116	vWwPMrH.exe
3640	CXCcDYb.exe
4424	oDoWKwp.exe
4376	RPrkBlj.exe
4724	XckgTTQ.exe
4580	wKdyCJM.exe
3136	mXiPPYG.exe
4764	qBEKFxk.exe
3624	vjGsEwK.exe
3792	qxWWdQa.exe
3684	kQdmqHR.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3076-0-0x00007FF70C490000-0x00007FF70C882000-memory.dmp	upx
behavioral2/files/0x0007000000023436-26.dat	upx
behavioral2/files/0x0007000000023437-30.dat	upx
behavioral2/files/0x000700000002343b-52.dat	upx
behavioral2/files/0x0007000000023459-182.dat	upx
behavioral2/memory/5100-229-0x00007FF647A20000-0x00007FF647E12000-memory.dmp	upx
behavioral2/memory/1140-234-0x00007FF6062B0000-0x00007FF6066A2000-memory.dmp	upx
behavioral2/memory/2072-239-0x00007FF6211D0000-0x00007FF6215C2000-memory.dmp	upx
behavioral2/memory/3124-245-0x00007FF6C5C60000-0x00007FF6C6052000-memory.dmp	upx
behavioral2/memory/1332-247-0x00007FF68F8C0000-0x00007FF68FCB2000-memory.dmp	upx
behavioral2/memory/4040-246-0x00007FF774AB0000-0x00007FF774EA2000-memory.dmp	upx
behavioral2/memory/1964-244-0x00007FF63EB10000-0x00007FF63EF02000-memory.dmp	upx
behavioral2/memory/4048-243-0x00007FF71A360000-0x00007FF71A752000-memory.dmp	upx
behavioral2/memory/744-242-0x00007FF6EB2F0000-0x00007FF6EB6E2000-memory.dmp	upx
behavioral2/memory/1148-241-0x00007FF7C2550000-0x00007FF7C2942000-memory.dmp	upx
behavioral2/memory/3184-240-0x00007FF611E40000-0x00007FF612232000-memory.dmp	upx
behavioral2/memory/1972-238-0x00007FF6A4510000-0x00007FF6A4902000-memory.dmp	upx
behavioral2/memory/1676-237-0x00007FF74A540000-0x00007FF74A932000-memory.dmp	upx
behavioral2/memory/4520-236-0x00007FF74FF00000-0x00007FF7502F2000-memory.dmp	upx
behavioral2/memory/4568-235-0x00007FF688D70000-0x00007FF689162000-memory.dmp	upx
behavioral2/memory/436-233-0x00007FF689220000-0x00007FF689612000-memory.dmp	upx
behavioral2/memory/3008-232-0x00007FF6414A0000-0x00007FF641892000-memory.dmp	upx
behavioral2/memory/4092-231-0x00007FF727F40000-0x00007FF728332000-memory.dmp	upx
behavioral2/memory/2560-230-0x00007FF712D10000-0x00007FF713102000-memory.dmp	upx
behavioral2/memory/3112-228-0x00007FF684770000-0x00007FF684B62000-memory.dmp	upx
behavioral2/memory/1104-227-0x00007FF6C7610000-0x00007FF6C7A02000-memory.dmp	upx
behavioral2/memory/1424-194-0x00007FF7AC170000-0x00007FF7AC562000-memory.dmp	upx
behavioral2/files/0x0007000000023442-189.dat	upx
behavioral2/files/0x0007000000023441-186.dat	upx
behavioral2/files/0x000700000002345a-185.dat	upx
behavioral2/files/0x0007000000023440-183.dat	upx
behavioral2/files/0x0007000000023458-181.dat	upx
behavioral2/files/0x0007000000023455-174.dat	upx
behavioral2/files/0x0007000000023456-173.dat	upx
behavioral2/files/0x0007000000023454-170.dat	upx
behavioral2/files/0x0007000000023453-168.dat	upx
behavioral2/files/0x0007000000023452-161.dat	upx
behavioral2/memory/1172-160-0x00007FF72E7E0000-0x00007FF72EBD2000-memory.dmp	upx
behavioral2/files/0x0007000000023451-157.dat	upx
behavioral2/files/0x000700000002344f-153.dat	upx
behavioral2/files/0x000700000002344e-146.dat	upx
behavioral2/files/0x0007000000023457-177.dat	upx
behavioral2/files/0x000700000002343e-139.dat	upx
behavioral2/files/0x000700000002344d-133.dat	upx
behavioral2/files/0x000700000002344b-132.dat	upx
behavioral2/files/0x000700000002344c-131.dat	upx
behavioral2/files/0x0007000000023449-126.dat	upx
behavioral2/files/0x0007000000023448-125.dat	upx
behavioral2/files/0x0007000000023447-119.dat	upx
behavioral2/files/0x0007000000023446-114.dat	upx
behavioral2/files/0x0007000000023445-113.dat	upx
behavioral2/files/0x0007000000023444-112.dat	upx
behavioral2/files/0x0007000000023443-111.dat	upx
behavioral2/files/0x0007000000023450-156.dat	upx
behavioral2/files/0x000700000002343a-100.dat	upx
behavioral2/files/0x0007000000023439-94.dat	upx
behavioral2/files/0x0007000000023438-91.dat	upx
behavioral2/files/0x000700000002344a-127.dat	upx
behavioral2/files/0x000700000002343c-77.dat	upx
behavioral2/files/0x000700000002343f-67.dat	upx
behavioral2/files/0x000700000002343d-57.dat	upx
behavioral2/files/0x0007000000023435-44.dat	upx
behavioral2/files/0x0007000000023434-34.dat	upx
behavioral2/files/0x0007000000023432-24.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\YMYCQyx.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\HZWOdvd.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\oabkQRS.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\GnroNZZ.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\deNNUqB.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\yoUNNbN.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\wMHiFws.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\dABREjv.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\qercsdz.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\GiKvSwn.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\nPXnYmB.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\numLIDp.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\dFOsBvJ.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\xGbmNsy.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\krYFxSD.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\OOubunb.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\vVtgEtc.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\fdErlwI.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\djCSqcV.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\hiIqjUc.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\JEApQrj.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\cOZnqan.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\FUvlhvK.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\cmSjpZT.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\tPgBLZt.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\hAntJGY.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\vyLrfIw.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\qmiDboq.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\zjNSAuj.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\tDUFqTG.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\yYnjelS.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\BJnatPC.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\ZfHNPqv.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\LYCGeBM.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\AIhrFjQ.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\oOOmnlk.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\hmtCHmf.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\dkwunqF.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\pkFOXWV.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\yTouZJT.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\XIHnsdQ.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\zeJTYxU.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\VmyJvSB.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\jfAlxCQ.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\DisPxrX.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\ohIbcIA.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\LaUcnio.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\rrqCWNS.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\XHNkbYe.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\jmKOgoP.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\YUxUXxq.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\rcCyFwq.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\fynZfsO.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\PLhJqEn.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\KtAprHW.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\LxyHIkC.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\hLZKNqf.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\ypDzQBB.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\UkjfcDA.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\nCbLWkb.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\QOCjAwe.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\HnglyBT.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\BkVwCnF.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
File created	C:\Windows\System\UDwpZEW.exe	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2784	powershell.exe
2784	powershell.exe
2784	powershell.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
Token: SeDebugPrivilege	2784	powershell.exe
Token: SeCreateGlobalPrivilege	11832	dwm.exe
Token: SeChangeNotifyPrivilege	11832	dwm.exe
Token: 33	11832	dwm.exe
Token: SeIncBasePriorityPrivilege	11832	dwm.exe
Token: SeShutdownPrivilege	11832	dwm.exe
Token: SeCreatePagefilePrivilege	11832	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 2784	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	83
PID 3076 wrote to memory of 2784	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	83
PID 3076 wrote to memory of 2268	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	84
PID 3076 wrote to memory of 2268	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	84
PID 3076 wrote to memory of 1172	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	85
PID 3076 wrote to memory of 1172	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	85
PID 3076 wrote to memory of 3124	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	86
PID 3076 wrote to memory of 3124	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	86
PID 3076 wrote to memory of 4040	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	87
PID 3076 wrote to memory of 4040	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	87
PID 3076 wrote to memory of 1424	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	88
PID 3076 wrote to memory of 1424	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	88
PID 3076 wrote to memory of 1104	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	89
PID 3076 wrote to memory of 1104	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	89
PID 3076 wrote to memory of 3112	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	90
PID 3076 wrote to memory of 3112	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	90
PID 3076 wrote to memory of 5100	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	91
PID 3076 wrote to memory of 5100	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	91
PID 3076 wrote to memory of 2560	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	92
PID 3076 wrote to memory of 2560	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	92
PID 3076 wrote to memory of 4092	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	93
PID 3076 wrote to memory of 4092	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	93
PID 3076 wrote to memory of 3008	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	94
PID 3076 wrote to memory of 3008	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	94
PID 3076 wrote to memory of 4568	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	95
PID 3076 wrote to memory of 4568	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	95
PID 3076 wrote to memory of 1332	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	96
PID 3076 wrote to memory of 1332	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	96
PID 3076 wrote to memory of 436	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	97
PID 3076 wrote to memory of 436	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	97
PID 3076 wrote to memory of 1140	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	98
PID 3076 wrote to memory of 1140	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	98
PID 3076 wrote to memory of 4520	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	99
PID 3076 wrote to memory of 4520	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	99
PID 3076 wrote to memory of 1676	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	100
PID 3076 wrote to memory of 1676	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	100
PID 3076 wrote to memory of 1972	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	101
PID 3076 wrote to memory of 1972	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	101
PID 3076 wrote to memory of 2072	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	102
PID 3076 wrote to memory of 2072	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	102
PID 3076 wrote to memory of 3184	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	103
PID 3076 wrote to memory of 3184	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	103
PID 3076 wrote to memory of 1148	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	104
PID 3076 wrote to memory of 1148	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	104
PID 3076 wrote to memory of 744	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	105
PID 3076 wrote to memory of 744	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	105
PID 3076 wrote to memory of 4048	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	106
PID 3076 wrote to memory of 4048	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	106
PID 3076 wrote to memory of 1964	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	107
PID 3076 wrote to memory of 1964	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	107
PID 3076 wrote to memory of 4044	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	108
PID 3076 wrote to memory of 4044	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	108
PID 3076 wrote to memory of 3708	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	109
PID 3076 wrote to memory of 3708	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	109
PID 3076 wrote to memory of 3904	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	110
PID 3076 wrote to memory of 3904	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	110
PID 3076 wrote to memory of 4572	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	111
PID 3076 wrote to memory of 4572	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	111
PID 3076 wrote to memory of 4848	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	112
PID 3076 wrote to memory of 4848	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	112
PID 3076 wrote to memory of 3372	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	113
PID 3076 wrote to memory of 3372	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	113
PID 3076 wrote to memory of 4620	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	114
PID 3076 wrote to memory of 4620	3076	9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9c20cc397e93a8ee8c72dd6c350b5490_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2784
- C:\Windows\System\KcyfBJO.exe
  C:\Windows\System\KcyfBJO.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\cfSlbQu.exe
  C:\Windows\System\cfSlbQu.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\hHpATik.exe
  C:\Windows\System\hHpATik.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\cOZnqan.exe
  C:\Windows\System\cOZnqan.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\qyVFcUC.exe
  C:\Windows\System\qyVFcUC.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\IfODJGv.exe
  C:\Windows\System\IfODJGv.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\LQfmTpJ.exe
  C:\Windows\System\LQfmTpJ.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\aCvhzBC.exe
  C:\Windows\System\aCvhzBC.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\zpJnDnx.exe
  C:\Windows\System\zpJnDnx.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\GzCqXYB.exe
  C:\Windows\System\GzCqXYB.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\fBYNyen.exe
  C:\Windows\System\fBYNyen.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\AoCaRBM.exe
  C:\Windows\System\AoCaRBM.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\nvjnICk.exe
  C:\Windows\System\nvjnICk.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\LZLzOpf.exe
  C:\Windows\System\LZLzOpf.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\IMlvedx.exe
  C:\Windows\System\IMlvedx.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\urJZSsv.exe
  C:\Windows\System\urJZSsv.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\HVvYmvK.exe
  C:\Windows\System\HVvYmvK.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\RpNhlKv.exe
  C:\Windows\System\RpNhlKv.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\bPhKtNb.exe
  C:\Windows\System\bPhKtNb.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\lWfJFJN.exe
  C:\Windows\System\lWfJFJN.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\FDaRWaH.exe
  C:\Windows\System\FDaRWaH.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\oUhRYkl.exe
  C:\Windows\System\oUhRYkl.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\FtIUjWP.exe
  C:\Windows\System\FtIUjWP.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\ZulutUf.exe
  C:\Windows\System\ZulutUf.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\mMOvasa.exe
  C:\Windows\System\mMOvasa.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\wUOnoJg.exe
  C:\Windows\System\wUOnoJg.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\FzWaWLk.exe
  C:\Windows\System\FzWaWLk.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\atwjvXh.exe
  C:\Windows\System\atwjvXh.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\LXKDGbj.exe
  C:\Windows\System\LXKDGbj.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\rOwANiZ.exe
  C:\Windows\System\rOwANiZ.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\mdQPXxV.exe
  C:\Windows\System\mdQPXxV.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\dXSxnhX.exe
  C:\Windows\System\dXSxnhX.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\jvFxHKK.exe
  C:\Windows\System\jvFxHKK.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\DIocEIF.exe
  C:\Windows\System\DIocEIF.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\qqjaXXt.exe
  C:\Windows\System\qqjaXXt.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\koZDETq.exe
  C:\Windows\System\koZDETq.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\JoynUlg.exe
  C:\Windows\System\JoynUlg.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\XyFonMt.exe
  C:\Windows\System\XyFonMt.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\QUEBDOR.exe
  C:\Windows\System\QUEBDOR.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\GBvbEkl.exe
  C:\Windows\System\GBvbEkl.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\MgCBeAp.exe
  C:\Windows\System\MgCBeAp.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\xrMFqCG.exe
  C:\Windows\System\xrMFqCG.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\YMYCQyx.exe
  C:\Windows\System\YMYCQyx.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\zCzJPDp.exe
  C:\Windows\System\zCzJPDp.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\NwSPaMI.exe
  C:\Windows\System\NwSPaMI.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\PhbsVeS.exe
  C:\Windows\System\PhbsVeS.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\CXCcDYb.exe
  C:\Windows\System\CXCcDYb.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\XckgTTQ.exe
  C:\Windows\System\XckgTTQ.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\ctCgZlY.exe
  C:\Windows\System\ctCgZlY.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\hSuvvOW.exe
  C:\Windows\System\hSuvvOW.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\zLLxrfK.exe
  C:\Windows\System\zLLxrfK.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\qCRRNsZ.exe
  C:\Windows\System\qCRRNsZ.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\mdsaEnA.exe
  C:\Windows\System\mdsaEnA.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\FFtRSeN.exe
  C:\Windows\System\FFtRSeN.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\BjshKfg.exe
  C:\Windows\System\BjshKfg.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\vWwPMrH.exe
  C:\Windows\System\vWwPMrH.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\oDoWKwp.exe
  C:\Windows\System\oDoWKwp.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\RPrkBlj.exe
  C:\Windows\System\RPrkBlj.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\wKdyCJM.exe
  C:\Windows\System\wKdyCJM.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\mXiPPYG.exe
  C:\Windows\System\mXiPPYG.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\qBEKFxk.exe
  C:\Windows\System\qBEKFxk.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\vjGsEwK.exe
  C:\Windows\System\vjGsEwK.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\qxWWdQa.exe
  C:\Windows\System\qxWWdQa.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\kQdmqHR.exe
  C:\Windows\System\kQdmqHR.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\yFmBBhk.exe
  C:\Windows\System\yFmBBhk.exe
  2⤵
  PID:3504
- C:\Windows\System\RCgncsC.exe
  C:\Windows\System\RCgncsC.exe
  2⤵
  PID:3508
- C:\Windows\System\TyQZjJe.exe
  C:\Windows\System\TyQZjJe.exe
  2⤵
  PID:1608
- C:\Windows\System\yoUNNbN.exe
  C:\Windows\System\yoUNNbN.exe
  2⤵
  PID:972
- C:\Windows\System\ZrBwzqt.exe
  C:\Windows\System\ZrBwzqt.exe
  2⤵
  PID:3528
- C:\Windows\System\hhzycoR.exe
  C:\Windows\System\hhzycoR.exe
  2⤵
  PID:3320
- C:\Windows\System\GnZUkzH.exe
  C:\Windows\System\GnZUkzH.exe
  2⤵
  PID:3800
- C:\Windows\System\kDkbIOQ.exe
  C:\Windows\System\kDkbIOQ.exe
  2⤵
  PID:3996
- C:\Windows\System\wMHiFws.exe
  C:\Windows\System\wMHiFws.exe
  2⤵
  PID:1852
- C:\Windows\System\AXdtWlw.exe
  C:\Windows\System\AXdtWlw.exe
  2⤵
  PID:1680
- C:\Windows\System\oQdjhtm.exe
  C:\Windows\System\oQdjhtm.exe
  2⤵
  PID:1108
- C:\Windows\System\UrNcHWo.exe
  C:\Windows\System\UrNcHWo.exe
  2⤵
  PID:2412
- C:\Windows\System\HjxDsHL.exe
  C:\Windows\System\HjxDsHL.exe
  2⤵
  PID:1644
- C:\Windows\System\kxizcal.exe
  C:\Windows\System\kxizcal.exe
  2⤵
  PID:3216
- C:\Windows\System\GvbshyW.exe
  C:\Windows\System\GvbshyW.exe
  2⤵
  PID:3208
- C:\Windows\System\sACzwXQ.exe
  C:\Windows\System\sACzwXQ.exe
  2⤵
  PID:4780
- C:\Windows\System\iWuBaKv.exe
  C:\Windows\System\iWuBaKv.exe
  2⤵
  PID:1116
- C:\Windows\System\jPbjrsL.exe
  C:\Windows\System\jPbjrsL.exe
  2⤵
  PID:64
- C:\Windows\System\krJGwvP.exe
  C:\Windows\System\krJGwvP.exe
  2⤵
  PID:1908
- C:\Windows\System\pLfkrvZ.exe
  C:\Windows\System\pLfkrvZ.exe
  2⤵
  PID:116
- C:\Windows\System\zxSoQtq.exe
  C:\Windows\System\zxSoQtq.exe
  2⤵
  PID:4924
- C:\Windows\System\evqEaEq.exe
  C:\Windows\System\evqEaEq.exe
  2⤵
  PID:4548
- C:\Windows\System\NVLhpbx.exe
  C:\Windows\System\NVLhpbx.exe
  2⤵
  PID:5072
- C:\Windows\System\AfSsnat.exe
  C:\Windows\System\AfSsnat.exe
  2⤵
  PID:4168
- C:\Windows\System\fAguUtJ.exe
  C:\Windows\System\fAguUtJ.exe
  2⤵
  PID:4412
- C:\Windows\System\ofxxYsg.exe
  C:\Windows\System\ofxxYsg.exe
  2⤵
  PID:4852
- C:\Windows\System\rSIeTco.exe
  C:\Windows\System\rSIeTco.exe
  2⤵
  PID:1096
- C:\Windows\System\fGMRDEa.exe
  C:\Windows\System\fGMRDEa.exe
  2⤵
  PID:4904
- C:\Windows\System\zOrgfNK.exe
  C:\Windows\System\zOrgfNK.exe
  2⤵
  PID:1528
- C:\Windows\System\draEsXE.exe
  C:\Windows\System\draEsXE.exe
  2⤵
  PID:3448
- C:\Windows\System\wUmXbkt.exe
  C:\Windows\System\wUmXbkt.exe
  2⤵
  PID:5052
- C:\Windows\System\LxyHIkC.exe
  C:\Windows\System\LxyHIkC.exe
  2⤵
  PID:3824
- C:\Windows\System\ovhLGal.exe
  C:\Windows\System\ovhLGal.exe
  2⤵
  PID:2144
- C:\Windows\System\jmvKhhL.exe
  C:\Windows\System\jmvKhhL.exe
  2⤵
  PID:1220
- C:\Windows\System\DUTLjze.exe
  C:\Windows\System\DUTLjze.exe
  2⤵
  PID:2256
- C:\Windows\System\DIpwWkm.exe
  C:\Windows\System\DIpwWkm.exe
  2⤵
  PID:5136
- C:\Windows\System\oOyUkSc.exe
  C:\Windows\System\oOyUkSc.exe
  2⤵
  PID:5156
- C:\Windows\System\XIHnsdQ.exe
  C:\Windows\System\XIHnsdQ.exe
  2⤵
  PID:5172
- C:\Windows\System\DrAgoBK.exe
  C:\Windows\System\DrAgoBK.exe
  2⤵
  PID:5192
- C:\Windows\System\fyRNdWV.exe
  C:\Windows\System\fyRNdWV.exe
  2⤵
  PID:5212
- C:\Windows\System\AHOGwLf.exe
  C:\Windows\System\AHOGwLf.exe
  2⤵
  PID:5232
- C:\Windows\System\kliridS.exe
  C:\Windows\System\kliridS.exe
  2⤵
  PID:5260
- C:\Windows\System\qNADVnY.exe
  C:\Windows\System\qNADVnY.exe
  2⤵
  PID:5280
- C:\Windows\System\vjckKOl.exe
  C:\Windows\System\vjckKOl.exe
  2⤵
  PID:5296
- C:\Windows\System\MUNriGd.exe
  C:\Windows\System\MUNriGd.exe
  2⤵
  PID:5328
- C:\Windows\System\QxotcVH.exe
  C:\Windows\System\QxotcVH.exe
  2⤵
  PID:5348
- C:\Windows\System\yclQeEZ.exe
  C:\Windows\System\yclQeEZ.exe
  2⤵
  PID:5368
- C:\Windows\System\eCkfiEY.exe
  C:\Windows\System\eCkfiEY.exe
  2⤵
  PID:5384
- C:\Windows\System\qBpUQXL.exe
  C:\Windows\System\qBpUQXL.exe
  2⤵
  PID:5400
- C:\Windows\System\OrwKdop.exe
  C:\Windows\System\OrwKdop.exe
  2⤵
  PID:5416
- C:\Windows\System\qKotnqF.exe
  C:\Windows\System\qKotnqF.exe
  2⤵
  PID:5436
- C:\Windows\System\UhKGCNO.exe
  C:\Windows\System\UhKGCNO.exe
  2⤵
  PID:5452
- C:\Windows\System\BFvjwcL.exe
  C:\Windows\System\BFvjwcL.exe
  2⤵
  PID:5476
- C:\Windows\System\MmaeQFU.exe
  C:\Windows\System\MmaeQFU.exe
  2⤵
  PID:5496
- C:\Windows\System\ZfFopGa.exe
  C:\Windows\System\ZfFopGa.exe
  2⤵
  PID:5516
- C:\Windows\System\QuOtlWT.exe
  C:\Windows\System\QuOtlWT.exe
  2⤵
  PID:5536
- C:\Windows\System\hLZKNqf.exe
  C:\Windows\System\hLZKNqf.exe
  2⤵
  PID:5560
- C:\Windows\System\awJUHvw.exe
  C:\Windows\System\awJUHvw.exe
  2⤵
  PID:5576
- C:\Windows\System\yCGYlhg.exe
  C:\Windows\System\yCGYlhg.exe
  2⤵
  PID:5596
- C:\Windows\System\zVEGPbS.exe
  C:\Windows\System\zVEGPbS.exe
  2⤵
  PID:5612
- C:\Windows\System\ZDPfKcp.exe
  C:\Windows\System\ZDPfKcp.exe
  2⤵
  PID:5628
- C:\Windows\System\RVrggTH.exe
  C:\Windows\System\RVrggTH.exe
  2⤵
  PID:5652
- C:\Windows\System\WWcxwnz.exe
  C:\Windows\System\WWcxwnz.exe
  2⤵
  PID:5672
- C:\Windows\System\fHYahZx.exe
  C:\Windows\System\fHYahZx.exe
  2⤵
  PID:5692
- C:\Windows\System\lgGWnUt.exe
  C:\Windows\System\lgGWnUt.exe
  2⤵
  PID:5708
- C:\Windows\System\JHZkRWw.exe
  C:\Windows\System\JHZkRWw.exe
  2⤵
  PID:5732
- C:\Windows\System\jApKzlt.exe
  C:\Windows\System\jApKzlt.exe
  2⤵
  PID:5752
- C:\Windows\System\HjkNrri.exe
  C:\Windows\System\HjkNrri.exe
  2⤵
  PID:5772
- C:\Windows\System\xbYTctZ.exe
  C:\Windows\System\xbYTctZ.exe
  2⤵
  PID:5796
- C:\Windows\System\TVRAvkW.exe
  C:\Windows\System\TVRAvkW.exe
  2⤵
  PID:5812
- C:\Windows\System\xKIAvUT.exe
  C:\Windows\System\xKIAvUT.exe
  2⤵
  PID:5832
- C:\Windows\System\jsXEkYf.exe
  C:\Windows\System\jsXEkYf.exe
  2⤵
  PID:5852
- C:\Windows\System\coxAXgZ.exe
  C:\Windows\System\coxAXgZ.exe
  2⤵
  PID:5868
- C:\Windows\System\dZOhwyA.exe
  C:\Windows\System\dZOhwyA.exe
  2⤵
  PID:5892
- C:\Windows\System\yKcCoBp.exe
  C:\Windows\System\yKcCoBp.exe
  2⤵
  PID:5908
- C:\Windows\System\koQtfnD.exe
  C:\Windows\System\koQtfnD.exe
  2⤵
  PID:5928
- C:\Windows\System\Uzlzjeq.exe
  C:\Windows\System\Uzlzjeq.exe
  2⤵
  PID:5948
- C:\Windows\System\dxNxEPh.exe
  C:\Windows\System\dxNxEPh.exe
  2⤵
  PID:5972
- C:\Windows\System\nPSjLep.exe
  C:\Windows\System\nPSjLep.exe
  2⤵
  PID:5992
- C:\Windows\System\cztQhXl.exe
  C:\Windows\System\cztQhXl.exe
  2⤵
  PID:6008
- C:\Windows\System\mIFvsMc.exe
  C:\Windows\System\mIFvsMc.exe
  2⤵
  PID:6032
- C:\Windows\System\ibLSsrx.exe
  C:\Windows\System\ibLSsrx.exe
  2⤵
  PID:6048
- C:\Windows\System\yNEeTnQ.exe
  C:\Windows\System\yNEeTnQ.exe
  2⤵
  PID:6072
- C:\Windows\System\wQUcqYc.exe
  C:\Windows\System\wQUcqYc.exe
  2⤵
  PID:6088
- C:\Windows\System\XLDbpRR.exe
  C:\Windows\System\XLDbpRR.exe
  2⤵
  PID:6112
- C:\Windows\System\nPPMvjf.exe
  C:\Windows\System\nPPMvjf.exe
  2⤵
  PID:6132
- C:\Windows\System\pSWRdsC.exe
  C:\Windows\System\pSWRdsC.exe
  2⤵
  PID:2356
- C:\Windows\System\sKlfMio.exe
  C:\Windows\System\sKlfMio.exe
  2⤵
  PID:1136
- C:\Windows\System\UFDzAhX.exe
  C:\Windows\System\UFDzAhX.exe
  2⤵
  PID:1748
- C:\Windows\System\GOLTsEK.exe
  C:\Windows\System\GOLTsEK.exe
  2⤵
  PID:5148
- C:\Windows\System\mNULQmk.exe
  C:\Windows\System\mNULQmk.exe
  2⤵
  PID:5164
- C:\Windows\System\DQvxwdq.exe
  C:\Windows\System\DQvxwdq.exe
  2⤵
  PID:5184
- C:\Windows\System\NkjMLJN.exe
  C:\Windows\System\NkjMLJN.exe
  2⤵
  PID:1864
- C:\Windows\System\rheVqkk.exe
  C:\Windows\System\rheVqkk.exe
  2⤵
  PID:880
- C:\Windows\System\KUwYBrc.exe
  C:\Windows\System\KUwYBrc.exe
  2⤵
  PID:3228
- C:\Windows\System\aecYdwf.exe
  C:\Windows\System\aecYdwf.exe
  2⤵
  PID:4696
- C:\Windows\System\lIVKfcL.exe
  C:\Windows\System\lIVKfcL.exe
  2⤵
  PID:5288
- C:\Windows\System\ZPZjZzj.exe
  C:\Windows\System\ZPZjZzj.exe
  2⤵
  PID:4036
- C:\Windows\System\FpKsPHn.exe
  C:\Windows\System\FpKsPHn.exe
  2⤵
  PID:1188
- C:\Windows\System\umFLasN.exe
  C:\Windows\System\umFLasN.exe
  2⤵
  PID:5376
- C:\Windows\System\BcUNvcY.exe
  C:\Windows\System\BcUNvcY.exe
  2⤵
  PID:5380
- C:\Windows\System\aqBkSFO.exe
  C:\Windows\System\aqBkSFO.exe
  2⤵
  PID:2596
- C:\Windows\System\iIVBYTu.exe
  C:\Windows\System\iIVBYTu.exe
  2⤵
  PID:3500
- C:\Windows\System\VyaWJBy.exe
  C:\Windows\System\VyaWJBy.exe
  2⤵
  PID:1068
- C:\Windows\System\cIzAnNH.exe
  C:\Windows\System\cIzAnNH.exe
  2⤵
  PID:3892
- C:\Windows\System\hhSxKVD.exe
  C:\Windows\System\hhSxKVD.exe
  2⤵
  PID:5428
- C:\Windows\System\VBSXOFD.exe
  C:\Windows\System\VBSXOFD.exe
  2⤵
  PID:4628
- C:\Windows\System\vYGeSEU.exe
  C:\Windows\System\vYGeSEU.exe
  2⤵
  PID:4068
- C:\Windows\System\QHPzphj.exe
  C:\Windows\System\QHPzphj.exe
  2⤵
  PID:5320
- C:\Windows\System\ZmpoBXa.exe
  C:\Windows\System\ZmpoBXa.exe
  2⤵
  PID:5360
- C:\Windows\System\NLAumAZ.exe
  C:\Windows\System\NLAumAZ.exe
  2⤵
  PID:5532
- C:\Windows\System\vLDHdTq.exe
  C:\Windows\System\vLDHdTq.exe
  2⤵
  PID:5764
- C:\Windows\System\LNtCFVF.exe
  C:\Windows\System\LNtCFVF.exe
  2⤵
  PID:456
- C:\Windows\System\knuwOjd.exe
  C:\Windows\System\knuwOjd.exe
  2⤵
  PID:6152
- C:\Windows\System\PcEFSKQ.exe
  C:\Windows\System\PcEFSKQ.exe
  2⤵
  PID:6172
- C:\Windows\System\pxHqkCG.exe
  C:\Windows\System\pxHqkCG.exe
  2⤵
  PID:6196
- C:\Windows\System\FMwIreT.exe
  C:\Windows\System\FMwIreT.exe
  2⤵
  PID:6220
- C:\Windows\System\zhDaHkS.exe
  C:\Windows\System\zhDaHkS.exe
  2⤵
  PID:6240
- C:\Windows\System\MhuouUG.exe
  C:\Windows\System\MhuouUG.exe
  2⤵
  PID:6260
- C:\Windows\System\zpyIrWg.exe
  C:\Windows\System\zpyIrWg.exe
  2⤵
  PID:6280
- C:\Windows\System\WduoqcB.exe
  C:\Windows\System\WduoqcB.exe
  2⤵
  PID:6296
- C:\Windows\System\dMrccxd.exe
  C:\Windows\System\dMrccxd.exe
  2⤵
  PID:6320
- C:\Windows\System\zeJTYxU.exe
  C:\Windows\System\zeJTYxU.exe
  2⤵
  PID:6336
- C:\Windows\System\jXSjxle.exe
  C:\Windows\System\jXSjxle.exe
  2⤵
  PID:6364
- C:\Windows\System\WJAESQf.exe
  C:\Windows\System\WJAESQf.exe
  2⤵
  PID:6380
- C:\Windows\System\vPhfaxb.exe
  C:\Windows\System\vPhfaxb.exe
  2⤵
  PID:6404
- C:\Windows\System\hBeRBpP.exe
  C:\Windows\System\hBeRBpP.exe
  2⤵
  PID:6420
- C:\Windows\System\PmtZQsq.exe
  C:\Windows\System\PmtZQsq.exe
  2⤵
  PID:6444
- C:\Windows\System\ULakqnw.exe
  C:\Windows\System\ULakqnw.exe
  2⤵
  PID:6460
- C:\Windows\System\KIIWZIp.exe
  C:\Windows\System\KIIWZIp.exe
  2⤵
  PID:6484
- C:\Windows\System\stFKPqQ.exe
  C:\Windows\System\stFKPqQ.exe
  2⤵
  PID:6500
- C:\Windows\System\QcgHRKu.exe
  C:\Windows\System\QcgHRKu.exe
  2⤵
  PID:6524
- C:\Windows\System\TRyGVON.exe
  C:\Windows\System\TRyGVON.exe
  2⤵
  PID:6540
- C:\Windows\System\bePghXN.exe
  C:\Windows\System\bePghXN.exe
  2⤵
  PID:6564
- C:\Windows\System\EMMmDPu.exe
  C:\Windows\System\EMMmDPu.exe
  2⤵
  PID:6580
- C:\Windows\System\MEByUTX.exe
  C:\Windows\System\MEByUTX.exe
  2⤵
  PID:6608
- C:\Windows\System\EBMDwMx.exe
  C:\Windows\System\EBMDwMx.exe
  2⤵
  PID:6624
- C:\Windows\System\qfShFxN.exe
  C:\Windows\System\qfShFxN.exe
  2⤵
  PID:6648
- C:\Windows\System\WYKACdk.exe
  C:\Windows\System\WYKACdk.exe
  2⤵
  PID:6668
- C:\Windows\System\LiJYsLN.exe
  C:\Windows\System\LiJYsLN.exe
  2⤵
  PID:6684
- C:\Windows\System\ohQLKJa.exe
  C:\Windows\System\ohQLKJa.exe
  2⤵
  PID:6704
- C:\Windows\System\xrVhdPg.exe
  C:\Windows\System\xrVhdPg.exe
  2⤵
  PID:6728
- C:\Windows\System\UYKECta.exe
  C:\Windows\System\UYKECta.exe
  2⤵
  PID:6748
- C:\Windows\System\uhDOaUf.exe
  C:\Windows\System\uhDOaUf.exe
  2⤵
  PID:6764
- C:\Windows\System\tghQcWH.exe
  C:\Windows\System\tghQcWH.exe
  2⤵
  PID:6792
- C:\Windows\System\wPmZGav.exe
  C:\Windows\System\wPmZGav.exe
  2⤵
  PID:6808
- C:\Windows\System\BTVlOHF.exe
  C:\Windows\System\BTVlOHF.exe
  2⤵
  PID:6828
- C:\Windows\System\jnyfPwZ.exe
  C:\Windows\System\jnyfPwZ.exe
  2⤵
  PID:6852
- C:\Windows\System\MzgWCyt.exe
  C:\Windows\System\MzgWCyt.exe
  2⤵
  PID:6872
- C:\Windows\System\cUMzYZZ.exe
  C:\Windows\System\cUMzYZZ.exe
  2⤵
  PID:6892
- C:\Windows\System\AkBfrfu.exe
  C:\Windows\System\AkBfrfu.exe
  2⤵
  PID:6920
- C:\Windows\System\ppGOJyI.exe
  C:\Windows\System\ppGOJyI.exe
  2⤵
  PID:6944
- C:\Windows\System\pLOeGAA.exe
  C:\Windows\System\pLOeGAA.exe
  2⤵
  PID:6960
- C:\Windows\System\hHsVLaP.exe
  C:\Windows\System\hHsVLaP.exe
  2⤵
  PID:6984
- C:\Windows\System\biaEwWx.exe
  C:\Windows\System\biaEwWx.exe
  2⤵
  PID:7004
- C:\Windows\System\jPIXqkB.exe
  C:\Windows\System\jPIXqkB.exe
  2⤵
  PID:7024
- C:\Windows\System\VmyJvSB.exe
  C:\Windows\System\VmyJvSB.exe
  2⤵
  PID:7040
- C:\Windows\System\VweJkHw.exe
  C:\Windows\System\VweJkHw.exe
  2⤵
  PID:7064
- C:\Windows\System\HVLIVht.exe
  C:\Windows\System\HVLIVht.exe
  2⤵
  PID:7080
- C:\Windows\System\jLsmGKw.exe
  C:\Windows\System\jLsmGKw.exe
  2⤵
  PID:7104
- C:\Windows\System\mRGLBmM.exe
  C:\Windows\System\mRGLBmM.exe
  2⤵
  PID:7124
- C:\Windows\System\JvyNtOD.exe
  C:\Windows\System\JvyNtOD.exe
  2⤵
  PID:7144
- C:\Windows\System\xabtDNQ.exe
  C:\Windows\System\xabtDNQ.exe
  2⤵
  PID:7164
- C:\Windows\System\plydUqK.exe
  C:\Windows\System\plydUqK.exe
  2⤵
  PID:4640
- C:\Windows\System\gwZGWHF.exe
  C:\Windows\System\gwZGWHF.exe
  2⤵
  PID:6056
- C:\Windows\System\Masvaoz.exe
  C:\Windows\System\Masvaoz.exe
  2⤵
  PID:6104
- C:\Windows\System\cpTQJVU.exe
  C:\Windows\System\cpTQJVU.exe
  2⤵
  PID:2328
- C:\Windows\System\tdJslhg.exe
  C:\Windows\System\tdJslhg.exe
  2⤵
  PID:5464
- C:\Windows\System\oKsgYqT.exe
  C:\Windows\System\oKsgYqT.exe
  2⤵
  PID:5248
- C:\Windows\System\AIhrFjQ.exe
  C:\Windows\System\AIhrFjQ.exe
  2⤵
  PID:3444
- C:\Windows\System\ZwQoGxf.exe
  C:\Windows\System\ZwQoGxf.exe
  2⤵
  PID:4928
- C:\Windows\System\yelycup.exe
  C:\Windows\System\yelycup.exe
  2⤵
  PID:3944
- C:\Windows\System\ypDzQBB.exe
  C:\Windows\System\ypDzQBB.exe
  2⤵
  PID:5584
- C:\Windows\System\lFghLsU.exe
  C:\Windows\System\lFghLsU.exe
  2⤵
  PID:5660
- C:\Windows\System\EGYiwug.exe
  C:\Windows\System\EGYiwug.exe
  2⤵
  PID:3352
- C:\Windows\System\SfUuzbc.exe
  C:\Windows\System\SfUuzbc.exe
  2⤵
  PID:5720
- C:\Windows\System\EQZeQCd.exe
  C:\Windows\System\EQZeQCd.exe
  2⤵
  PID:5748
- C:\Windows\System\ROKvjIV.exe
  C:\Windows\System\ROKvjIV.exe
  2⤵
  PID:3212
- C:\Windows\System\RtrIAvD.exe
  C:\Windows\System\RtrIAvD.exe
  2⤵
  PID:5828
- C:\Windows\System\mGpgImJ.exe
  C:\Windows\System\mGpgImJ.exe
  2⤵
  PID:5864
- C:\Windows\System\vqMBuOv.exe
  C:\Windows\System\vqMBuOv.exe
  2⤵
  PID:6216
- C:\Windows\System\VpFnLGu.exe
  C:\Windows\System\VpFnLGu.exe
  2⤵
  PID:6256
- C:\Windows\System\jQEXIhR.exe
  C:\Windows\System\jQEXIhR.exe
  2⤵
  PID:6292
- C:\Windows\System\LTFXjLm.exe
  C:\Windows\System\LTFXjLm.exe
  2⤵
  PID:6356
- C:\Windows\System\KMXkFxU.exe
  C:\Windows\System\KMXkFxU.exe
  2⤵
  PID:6468
- C:\Windows\System\hPiAVZU.exe
  C:\Windows\System\hPiAVZU.exe
  2⤵
  PID:6604
- C:\Windows\System\wBjqSXp.exe
  C:\Windows\System\wBjqSXp.exe
  2⤵
  PID:6028
- C:\Windows\System\zjNSAuj.exe
  C:\Windows\System\zjNSAuj.exe
  2⤵
  PID:7172
- C:\Windows\System\VawtiCx.exe
  C:\Windows\System\VawtiCx.exe
  2⤵
  PID:7196
- C:\Windows\System\QrXztme.exe
  C:\Windows\System\QrXztme.exe
  2⤵
  PID:7216
- C:\Windows\System\oteUbWK.exe
  C:\Windows\System\oteUbWK.exe
  2⤵
  PID:7236
- C:\Windows\System\RIpNCMv.exe
  C:\Windows\System\RIpNCMv.exe
  2⤵
  PID:7260
- C:\Windows\System\jnwIDYS.exe
  C:\Windows\System\jnwIDYS.exe
  2⤵
  PID:7280
- C:\Windows\System\QIKwFwQ.exe
  C:\Windows\System\QIKwFwQ.exe
  2⤵
  PID:7300
- C:\Windows\System\PNkMzUQ.exe
  C:\Windows\System\PNkMzUQ.exe
  2⤵
  PID:7320
- C:\Windows\System\VVRMmdJ.exe
  C:\Windows\System\VVRMmdJ.exe
  2⤵
  PID:7340
- C:\Windows\System\DTPBKgy.exe
  C:\Windows\System\DTPBKgy.exe
  2⤵
  PID:7364
- C:\Windows\System\osSHcCL.exe
  C:\Windows\System\osSHcCL.exe
  2⤵
  PID:7388
- C:\Windows\System\KCMWVyE.exe
  C:\Windows\System\KCMWVyE.exe
  2⤵
  PID:7408
- C:\Windows\System\ffqgkUn.exe
  C:\Windows\System\ffqgkUn.exe
  2⤵
  PID:7428
- C:\Windows\System\rzowheI.exe
  C:\Windows\System\rzowheI.exe
  2⤵
  PID:7444
- C:\Windows\System\qwxVKxq.exe
  C:\Windows\System\qwxVKxq.exe
  2⤵
  PID:7464
- C:\Windows\System\HgXPhko.exe
  C:\Windows\System\HgXPhko.exe
  2⤵
  PID:7480
- C:\Windows\System\aVmMfKS.exe
  C:\Windows\System\aVmMfKS.exe
  2⤵
  PID:7496
- C:\Windows\System\pfFPpKT.exe
  C:\Windows\System\pfFPpKT.exe
  2⤵
  PID:7520
- C:\Windows\System\dCBLsFx.exe
  C:\Windows\System\dCBLsFx.exe
  2⤵
  PID:7536
- C:\Windows\System\JWzPPnH.exe
  C:\Windows\System\JWzPPnH.exe
  2⤵
  PID:7560
- C:\Windows\System\xPwYGCF.exe
  C:\Windows\System\xPwYGCF.exe
  2⤵
  PID:7576
- C:\Windows\System\rtBXdOc.exe
  C:\Windows\System\rtBXdOc.exe
  2⤵
  PID:7600
- C:\Windows\System\btXcijx.exe
  C:\Windows\System\btXcijx.exe
  2⤵
  PID:7620
- C:\Windows\System\TgGaIkT.exe
  C:\Windows\System\TgGaIkT.exe
  2⤵
  PID:7640
- C:\Windows\System\ZSwYWLe.exe
  C:\Windows\System\ZSwYWLe.exe
  2⤵
  PID:7660
- C:\Windows\System\zzzJjEp.exe
  C:\Windows\System\zzzJjEp.exe
  2⤵
  PID:7680
- C:\Windows\System\IjPjMiv.exe
  C:\Windows\System\IjPjMiv.exe
  2⤵
  PID:7700
- C:\Windows\System\bMSyqKA.exe
  C:\Windows\System\bMSyqKA.exe
  2⤵
  PID:7720
- C:\Windows\System\NTutSUU.exe
  C:\Windows\System\NTutSUU.exe
  2⤵
  PID:7744
- C:\Windows\System\VnyjVHb.exe
  C:\Windows\System\VnyjVHb.exe
  2⤵
  PID:7764
- C:\Windows\System\OoPjyEy.exe
  C:\Windows\System\OoPjyEy.exe
  2⤵
  PID:7784
- C:\Windows\System\yOwwAei.exe
  C:\Windows\System\yOwwAei.exe
  2⤵
  PID:7800
- C:\Windows\System\PDpUyTu.exe
  C:\Windows\System\PDpUyTu.exe
  2⤵
  PID:7824
- C:\Windows\System\OijSuwu.exe
  C:\Windows\System\OijSuwu.exe
  2⤵
  PID:7840
- C:\Windows\System\CUuatta.exe
  C:\Windows\System\CUuatta.exe
  2⤵
  PID:7860
- C:\Windows\System\cnrWGSx.exe
  C:\Windows\System\cnrWGSx.exe
  2⤵
  PID:7880
- C:\Windows\System\mOoLOhh.exe
  C:\Windows\System\mOoLOhh.exe
  2⤵
  PID:7900
- C:\Windows\System\XgEHhgP.exe
  C:\Windows\System\XgEHhgP.exe
  2⤵
  PID:7916
- C:\Windows\System\LLZPJOc.exe
  C:\Windows\System\LLZPJOc.exe
  2⤵
  PID:7940
- C:\Windows\System\TJHSKkL.exe
  C:\Windows\System\TJHSKkL.exe
  2⤵
  PID:7960
- C:\Windows\System\IhjozgS.exe
  C:\Windows\System\IhjozgS.exe
  2⤵
  PID:7980
- C:\Windows\System\IMVvpMG.exe
  C:\Windows\System\IMVvpMG.exe
  2⤵
  PID:8000
- C:\Windows\System\OSnMwye.exe
  C:\Windows\System\OSnMwye.exe
  2⤵
  PID:8020
- C:\Windows\System\KUepIJJ.exe
  C:\Windows\System\KUepIJJ.exe
  2⤵
  PID:8040
- C:\Windows\System\zkDawiG.exe
  C:\Windows\System\zkDawiG.exe
  2⤵
  PID:8060
- C:\Windows\System\rZmjHGw.exe
  C:\Windows\System\rZmjHGw.exe
  2⤵
  PID:8088
- C:\Windows\System\cvTZIpt.exe
  C:\Windows\System\cvTZIpt.exe
  2⤵
  PID:8104
- C:\Windows\System\jyftqeA.exe
  C:\Windows\System\jyftqeA.exe
  2⤵
  PID:8128
- C:\Windows\System\YdYEweV.exe
  C:\Windows\System\YdYEweV.exe
  2⤵
  PID:8148
- C:\Windows\System\OOubunb.exe
  C:\Windows\System\OOubunb.exe
  2⤵
  PID:8168
- C:\Windows\System\pseUOdZ.exe
  C:\Windows\System\pseUOdZ.exe
  2⤵
  PID:8188
- C:\Windows\System\XHNkbYe.exe
  C:\Windows\System\XHNkbYe.exe
  2⤵
  PID:3256
- C:\Windows\System\OmAOiYf.exe
  C:\Windows\System\OmAOiYf.exe
  2⤵
  PID:6904
- C:\Windows\System\gTaowic.exe
  C:\Windows\System\gTaowic.exe
  2⤵
  PID:4972
- C:\Windows\System\KclqQVS.exe
  C:\Windows\System\KclqQVS.exe
  2⤵
  PID:6972
- C:\Windows\System\FKZNuZw.exe
  C:\Windows\System\FKZNuZw.exe
  2⤵
  PID:7116
- C:\Windows\System\msYcOYD.exe
  C:\Windows\System\msYcOYD.exe
  2⤵
  PID:5604
- C:\Windows\System\TnimNLP.exe
  C:\Windows\System\TnimNLP.exe
  2⤵
  PID:5316
- C:\Windows\System\oGEPKvB.exe
  C:\Windows\System\oGEPKvB.exe
  2⤵
  PID:5844
- C:\Windows\System\aQXEAlL.exe
  C:\Windows\System\aQXEAlL.exe
  2⤵
  PID:6184
- C:\Windows\System\hMXWwGZ.exe
  C:\Windows\System\hMXWwGZ.exe
  2⤵
  PID:5916
- C:\Windows\System\mUlWlJD.exe
  C:\Windows\System\mUlWlJD.exe
  2⤵
  PID:5940
- C:\Windows\System\yeRUKue.exe
  C:\Windows\System\yeRUKue.exe
  2⤵
  PID:6440
- C:\Windows\System\cbsUkST.exe
  C:\Windows\System\cbsUkST.exe
  2⤵
  PID:6496
- C:\Windows\System\XsIkhvY.exe
  C:\Windows\System\XsIkhvY.exe
  2⤵
  PID:6576
- C:\Windows\System\ZqPmhUE.exe
  C:\Windows\System\ZqPmhUE.exe
  2⤵
  PID:6632
- C:\Windows\System\dYGWuOP.exe
  C:\Windows\System\dYGWuOP.exe
  2⤵
  PID:6016
- C:\Windows\System\eFGVsrL.exe
  C:\Windows\System\eFGVsrL.exe
  2⤵
  PID:6660
- C:\Windows\System\dlERlVx.exe
  C:\Windows\System\dlERlVx.exe
  2⤵
  PID:6452
- C:\Windows\System\FVinmlS.exe
  C:\Windows\System\FVinmlS.exe
  2⤵
  PID:6124
- C:\Windows\System\kfTyhNf.exe
  C:\Windows\System\kfTyhNf.exe
  2⤵
  PID:5000
- C:\Windows\System\PkdVevg.exe
  C:\Windows\System\PkdVevg.exe
  2⤵
  PID:6760
- C:\Windows\System\tsreQqC.exe
  C:\Windows\System\tsreQqC.exe
  2⤵
  PID:8208
- C:\Windows\System\gZmEjzg.exe
  C:\Windows\System\gZmEjzg.exe
  2⤵
  PID:8228
- C:\Windows\System\cMCnYMv.exe
  C:\Windows\System\cMCnYMv.exe
  2⤵
  PID:8248
- C:\Windows\System\UhQAkRE.exe
  C:\Windows\System\UhQAkRE.exe
  2⤵
  PID:8264
- C:\Windows\System\gxVCrWH.exe
  C:\Windows\System\gxVCrWH.exe
  2⤵
  PID:8292
- C:\Windows\System\yGwEBwF.exe
  C:\Windows\System\yGwEBwF.exe
  2⤵
  PID:8312
- C:\Windows\System\XcCqLPc.exe
  C:\Windows\System\XcCqLPc.exe
  2⤵
  PID:8672
- C:\Windows\System\CwmKKbJ.exe
  C:\Windows\System\CwmKKbJ.exe
  2⤵
  PID:8696
- C:\Windows\System\gFbfnox.exe
  C:\Windows\System\gFbfnox.exe
  2⤵
  PID:8712
- C:\Windows\System\ncJHvIQ.exe
  C:\Windows\System\ncJHvIQ.exe
  2⤵
  PID:8736
- C:\Windows\System\NKivhjJ.exe
  C:\Windows\System\NKivhjJ.exe
  2⤵
  PID:8752
- C:\Windows\System\qtcxNYx.exe
  C:\Windows\System\qtcxNYx.exe
  2⤵
  PID:8776
- C:\Windows\System\WQPBOGo.exe
  C:\Windows\System\WQPBOGo.exe
  2⤵
  PID:8792
- C:\Windows\System\GWWgoJg.exe
  C:\Windows\System\GWWgoJg.exe
  2⤵
  PID:8816
- C:\Windows\System\nzQzjZp.exe
  C:\Windows\System\nzQzjZp.exe
  2⤵
  PID:8836
- C:\Windows\System\icMGaDa.exe
  C:\Windows\System\icMGaDa.exe
  2⤵
  PID:8856
- C:\Windows\System\kjDTDFo.exe
  C:\Windows\System\kjDTDFo.exe
  2⤵
  PID:8880
- C:\Windows\System\LCdQwfK.exe
  C:\Windows\System\LCdQwfK.exe
  2⤵
  PID:8904
- C:\Windows\System\suVyJzH.exe
  C:\Windows\System\suVyJzH.exe
  2⤵
  PID:8924
- C:\Windows\System\isHUvgl.exe
  C:\Windows\System\isHUvgl.exe
  2⤵
  PID:8944
- C:\Windows\System\BkVwCnF.exe
  C:\Windows\System\BkVwCnF.exe
  2⤵
  PID:8968
- C:\Windows\System\tgmCeIZ.exe
  C:\Windows\System\tgmCeIZ.exe
  2⤵
  PID:8984
- C:\Windows\System\dUIhFTt.exe
  C:\Windows\System\dUIhFTt.exe
  2⤵
  PID:9008
- C:\Windows\System\mKbVEPY.exe
  C:\Windows\System\mKbVEPY.exe
  2⤵
  PID:9028
- C:\Windows\System\PgeuIxi.exe
  C:\Windows\System\PgeuIxi.exe
  2⤵
  PID:9048
- C:\Windows\System\BKzTCzD.exe
  C:\Windows\System\BKzTCzD.exe
  2⤵
  PID:9068
- C:\Windows\System\auriPnr.exe
  C:\Windows\System\auriPnr.exe
  2⤵
  PID:9088
- C:\Windows\System\cDfqRKw.exe
  C:\Windows\System\cDfqRKw.exe
  2⤵
  PID:9112
- C:\Windows\System\apSVygD.exe
  C:\Windows\System\apSVygD.exe
  2⤵
  PID:9136
- C:\Windows\System\zkexaUl.exe
  C:\Windows\System\zkexaUl.exe
  2⤵
  PID:9156
- C:\Windows\System\qJDRQsN.exe
  C:\Windows\System\qJDRQsN.exe
  2⤵
  PID:9176
- C:\Windows\System\CoFLJzJ.exe
  C:\Windows\System\CoFLJzJ.exe
  2⤵
  PID:9196
- C:\Windows\System\uediQhY.exe
  C:\Windows\System\uediQhY.exe
  2⤵
  PID:7224
- C:\Windows\System\miINQJA.exe
  C:\Windows\System\miINQJA.exe
  2⤵
  PID:7208
- C:\Windows\System\UkjfcDA.exe
  C:\Windows\System\UkjfcDA.exe
  2⤵
  PID:7012
- C:\Windows\System\DQFQsFp.exe
  C:\Windows\System\DQFQsFp.exe
  2⤵
  PID:7088
- C:\Windows\System\yuTkLoZ.exe
  C:\Windows\System\yuTkLoZ.exe
  2⤵
  PID:5036
- C:\Windows\System\WNNwvlV.exe
  C:\Windows\System\WNNwvlV.exe
  2⤵
  PID:7516
- C:\Windows\System\adcDXRj.exe
  C:\Windows\System\adcDXRj.exe
  2⤵
  PID:7572
- C:\Windows\System\bPmSyjh.exe
  C:\Windows\System\bPmSyjh.exe
  2⤵
  PID:2584
- C:\Windows\System\LeAMJWz.exe
  C:\Windows\System\LeAMJWz.exe
  2⤵
  PID:7872
- C:\Windows\System\QDXbIBT.exe
  C:\Windows\System\QDXbIBT.exe
  2⤵
  PID:5460
- C:\Windows\System\hBeJggd.exe
  C:\Windows\System\hBeJggd.exe
  2⤵
  PID:2204
- C:\Windows\System\JcuJpZW.exe
  C:\Windows\System\JcuJpZW.exe
  2⤵
  PID:6400
- C:\Windows\System\TcOajKi.exe
  C:\Windows\System\TcOajKi.exe
  2⤵
  PID:6436
- C:\Windows\System\EzDAKlO.exe
  C:\Windows\System\EzDAKlO.exe
  2⤵
  PID:6096
- C:\Windows\System\mGvZYUo.exe
  C:\Windows\System\mGvZYUo.exe
  2⤵
  PID:6520
- C:\Windows\System\btlREkN.exe
  C:\Windows\System\btlREkN.exe
  2⤵
  PID:6772
- C:\Windows\System\ekbSdqr.exe
  C:\Windows\System\ekbSdqr.exe
  2⤵
  PID:6824
- C:\Windows\System\AgXMnEF.exe
  C:\Windows\System\AgXMnEF.exe
  2⤵
  PID:8216
- C:\Windows\System\FUvlhvK.exe
  C:\Windows\System\FUvlhvK.exe
  2⤵
  PID:8308
- C:\Windows\System\ppKLihX.exe
  C:\Windows\System\ppKLihX.exe
  2⤵
  PID:7312
- C:\Windows\System\BpPpQJY.exe
  C:\Windows\System\BpPpQJY.exe
  2⤵
  PID:7728
- C:\Windows\System\mZwKrwI.exe
  C:\Windows\System\mZwKrwI.exe
  2⤵
  PID:7472
- C:\Windows\System\WvqZvci.exe
  C:\Windows\System\WvqZvci.exe
  2⤵
  PID:7648
- C:\Windows\System\ZgnTVmB.exe
  C:\Windows\System\ZgnTVmB.exe
  2⤵
  PID:7948
- C:\Windows\System\WtovUOX.exe
  C:\Windows\System\WtovUOX.exe
  2⤵
  PID:8048
- C:\Windows\System\vFUXAsf.exe
  C:\Windows\System\vFUXAsf.exe
  2⤵
  PID:5220
- C:\Windows\System\KWOntxf.exe
  C:\Windows\System\KWOntxf.exe
  2⤵
  PID:6328
- C:\Windows\System\NzOwlOz.exe
  C:\Windows\System\NzOwlOz.exe
  2⤵
  PID:8196
- C:\Windows\System\WRRxGDs.exe
  C:\Windows\System\WRRxGDs.exe
  2⤵
  PID:7772
- C:\Windows\System\PjYIGgC.exe
  C:\Windows\System\PjYIGgC.exe
  2⤵
  PID:6956
- C:\Windows\System\ylCgInj.exe
  C:\Windows\System\ylCgInj.exe
  2⤵
  PID:7384
- C:\Windows\System\FqMKAEu.exe
  C:\Windows\System\FqMKAEu.exe
  2⤵
  PID:7584
- C:\Windows\System\NwBbvXp.exe
  C:\Windows\System\NwBbvXp.exe
  2⤵
  PID:7692
- C:\Windows\System\PdTcDjf.exe
  C:\Windows\System\PdTcDjf.exe
  2⤵
  PID:7820
- C:\Windows\System\gQqNOom.exe
  C:\Windows\System\gQqNOom.exe
  2⤵
  PID:7924
- C:\Windows\System\JJuxmSr.exe
  C:\Windows\System\JJuxmSr.exe
  2⤵
  PID:7992
- C:\Windows\System\yybsakJ.exe
  C:\Windows\System\yybsakJ.exe
  2⤵
  PID:8452
- C:\Windows\System\dfNWGph.exe
  C:\Windows\System\dfNWGph.exe
  2⤵
  PID:5572
- C:\Windows\System\WcZWnJz.exe
  C:\Windows\System\WcZWnJz.exe
  2⤵
  PID:9388
- C:\Windows\System\GrcJwHD.exe
  C:\Windows\System\GrcJwHD.exe
  2⤵
  PID:9408
- C:\Windows\System\LCVZitH.exe
  C:\Windows\System\LCVZitH.exe
  2⤵
  PID:9436
- C:\Windows\System\zEkPdrB.exe
  C:\Windows\System\zEkPdrB.exe
  2⤵
  PID:9468
- C:\Windows\System\VcYinMI.exe
  C:\Windows\System\VcYinMI.exe
  2⤵
  PID:9488
- C:\Windows\System\WdhsNlT.exe
  C:\Windows\System\WdhsNlT.exe
  2⤵
  PID:9512
- C:\Windows\System\BIlXCnE.exe
  C:\Windows\System\BIlXCnE.exe
  2⤵
  PID:9528
- C:\Windows\System\EVAopEH.exe
  C:\Windows\System\EVAopEH.exe
  2⤵
  PID:9548
- C:\Windows\System\dkSKnRw.exe
  C:\Windows\System\dkSKnRw.exe
  2⤵
  PID:9572
- C:\Windows\System\uTmqIfV.exe
  C:\Windows\System\uTmqIfV.exe
  2⤵
  PID:9592
- C:\Windows\System\ZdeodDG.exe
  C:\Windows\System\ZdeodDG.exe
  2⤵
  PID:9612
- C:\Windows\System\ZUNksbT.exe
  C:\Windows\System\ZUNksbT.exe
  2⤵
  PID:9632
- C:\Windows\System\MPNHrDG.exe
  C:\Windows\System\MPNHrDG.exe
  2⤵
  PID:9652
- C:\Windows\System\cGkIitN.exe
  C:\Windows\System\cGkIitN.exe
  2⤵
  PID:9676
- C:\Windows\System\IgPHibW.exe
  C:\Windows\System\IgPHibW.exe
  2⤵
  PID:9700
- C:\Windows\System\dKTbNZR.exe
  C:\Windows\System\dKTbNZR.exe
  2⤵
  PID:9720
- C:\Windows\System\pXpLzIt.exe
  C:\Windows\System\pXpLzIt.exe
  2⤵
  PID:9740
- C:\Windows\System\YlOmfSD.exe
  C:\Windows\System\YlOmfSD.exe
  2⤵
  PID:9768
- C:\Windows\System\eTRTsyA.exe
  C:\Windows\System\eTRTsyA.exe
  2⤵
  PID:9788
- C:\Windows\System\GQhBITt.exe
  C:\Windows\System\GQhBITt.exe
  2⤵
  PID:9816
- C:\Windows\System\XcRUyIK.exe
  C:\Windows\System\XcRUyIK.exe
  2⤵
  PID:9836
- C:\Windows\System\gToAJll.exe
  C:\Windows\System\gToAJll.exe
  2⤵
  PID:9856
- C:\Windows\System\omKfdRm.exe
  C:\Windows\System\omKfdRm.exe
  2⤵
  PID:9876
- C:\Windows\System\nWtIxXp.exe
  C:\Windows\System\nWtIxXp.exe
  2⤵
  PID:9904
- C:\Windows\System\WLjrzSb.exe
  C:\Windows\System\WLjrzSb.exe
  2⤵
  PID:9928
- C:\Windows\System\fmSJMIJ.exe
  C:\Windows\System\fmSJMIJ.exe
  2⤵
  PID:9948
- C:\Windows\System\Qgcduuh.exe
  C:\Windows\System\Qgcduuh.exe
  2⤵
  PID:9976
- C:\Windows\System\WcpWVED.exe
  C:\Windows\System\WcpWVED.exe
  2⤵
  PID:9996
- C:\Windows\System\mHYhFcE.exe
  C:\Windows\System\mHYhFcE.exe
  2⤵
  PID:10016
- C:\Windows\System\RhQqKAr.exe
  C:\Windows\System\RhQqKAr.exe
  2⤵
  PID:10036
- C:\Windows\System\neufODF.exe
  C:\Windows\System\neufODF.exe
  2⤵
  PID:10060
- C:\Windows\System\geQfJsE.exe
  C:\Windows\System\geQfJsE.exe
  2⤵
  PID:10084
- C:\Windows\System\CyzKdia.exe
  C:\Windows\System\CyzKdia.exe
  2⤵
  PID:10104
- C:\Windows\System\IAHzduf.exe
  C:\Windows\System\IAHzduf.exe
  2⤵
  PID:10128
- C:\Windows\System\RIUSUZo.exe
  C:\Windows\System\RIUSUZo.exe
  2⤵
  PID:10144
- C:\Windows\System\nCbLWkb.exe
  C:\Windows\System\nCbLWkb.exe
  2⤵
  PID:10164
- C:\Windows\System\UnSNvXG.exe
  C:\Windows\System\UnSNvXG.exe
  2⤵
  PID:10184
- C:\Windows\System\PrUngcd.exe
  C:\Windows\System\PrUngcd.exe
  2⤵
  PID:10204
- C:\Windows\System\rmXyVhe.exe
  C:\Windows\System\rmXyVhe.exe
  2⤵
  PID:10220
- C:\Windows\System\gFhndDO.exe
  C:\Windows\System\gFhndDO.exe
  2⤵
  PID:8496
- C:\Windows\System\TOPEcES.exe
  C:\Windows\System\TOPEcES.exe
  2⤵
  PID:5888
- C:\Windows\System\OcTZVsy.exe
  C:\Windows\System\OcTZVsy.exe
  2⤵
  PID:6276
- C:\Windows\System\eIKuyXd.exe
  C:\Windows\System\eIKuyXd.exe
  2⤵
  PID:8580
- C:\Windows\System\jrnhJDK.exe
  C:\Windows\System\jrnhJDK.exe
  2⤵
  PID:5004
- C:\Windows\System\LrndbOO.exe
  C:\Windows\System\LrndbOO.exe
  2⤵
  PID:7184
- C:\Windows\System\nLqgRza.exe
  C:\Windows\System\nLqgRza.exe
  2⤵
  PID:7292
- C:\Windows\System\mIBxLmU.exe
  C:\Windows\System\mIBxLmU.exe
  2⤵
  PID:6888
- C:\Windows\System\dUTRiCg.exe
  C:\Windows\System\dUTRiCg.exe
  2⤵
  PID:8692
- C:\Windows\System\DclJjfK.exe
  C:\Windows\System\DclJjfK.exe
  2⤵
  PID:8788
- C:\Windows\System\IkRraDs.exe
  C:\Windows\System\IkRraDs.exe
  2⤵
  PID:8844
- C:\Windows\System\NENVAFJ.exe
  C:\Windows\System\NENVAFJ.exe
  2⤵
  PID:8892
- C:\Windows\System\SHDQLhc.exe
  C:\Windows\System\SHDQLhc.exe
  2⤵
  PID:8992
- C:\Windows\System\mNWSiDK.exe
  C:\Windows\System\mNWSiDK.exe
  2⤵
  PID:9044
- C:\Windows\System\CXrBklt.exe
  C:\Windows\System\CXrBklt.exe
  2⤵
  PID:10256
- C:\Windows\System\dABREjv.exe
  C:\Windows\System\dABREjv.exe
  2⤵
  PID:10280
- C:\Windows\System\VPfzcbD.exe
  C:\Windows\System\VPfzcbD.exe
  2⤵
  PID:10304
- C:\Windows\System\qCzqjGj.exe
  C:\Windows\System\qCzqjGj.exe
  2⤵
  PID:10324
- C:\Windows\System\VgnLrFz.exe
  C:\Windows\System\VgnLrFz.exe
  2⤵
  PID:10348
- C:\Windows\System\ZVkppKo.exe
  C:\Windows\System\ZVkppKo.exe
  2⤵
  PID:10364
- C:\Windows\System\HQYDDoq.exe
  C:\Windows\System\HQYDDoq.exe
  2⤵
  PID:10388
- C:\Windows\System\PCDySws.exe
  C:\Windows\System\PCDySws.exe
  2⤵
  PID:10412
- C:\Windows\System\afowMCJ.exe
  C:\Windows\System\afowMCJ.exe
  2⤵
  PID:10436
- C:\Windows\System\NXbnUkm.exe
  C:\Windows\System\NXbnUkm.exe
  2⤵
  PID:10452
- C:\Windows\System\bNDqFVv.exe
  C:\Windows\System\bNDqFVv.exe
  2⤵
  PID:10476
- C:\Windows\System\amIurkq.exe
  C:\Windows\System\amIurkq.exe
  2⤵
  PID:10496
- C:\Windows\System\sRQYlZd.exe
  C:\Windows\System\sRQYlZd.exe
  2⤵
  PID:10516
- C:\Windows\System\wQcwFmH.exe
  C:\Windows\System\wQcwFmH.exe
  2⤵
  PID:10540
- C:\Windows\System\dnJrznw.exe
  C:\Windows\System\dnJrznw.exe
  2⤵
  PID:10556
- C:\Windows\System\kmqmPYF.exe
  C:\Windows\System\kmqmPYF.exe
  2⤵
  PID:10580
- C:\Windows\System\dHkeHIL.exe
  C:\Windows\System\dHkeHIL.exe
  2⤵
  PID:10608
- C:\Windows\System\JfStFQQ.exe
  C:\Windows\System\JfStFQQ.exe
  2⤵
  PID:10628
- C:\Windows\System\pJatTJV.exe
  C:\Windows\System\pJatTJV.exe
  2⤵
  PID:10648
- C:\Windows\System\hIUNfFx.exe
  C:\Windows\System\hIUNfFx.exe
  2⤵
  PID:10668
- C:\Windows\System\YNKmNMZ.exe
  C:\Windows\System\YNKmNMZ.exe
  2⤵
  PID:10692
- C:\Windows\System\HVDnwrC.exe
  C:\Windows\System\HVDnwrC.exe
  2⤵
  PID:10716
- C:\Windows\System\pBEjPhm.exe
  C:\Windows\System\pBEjPhm.exe
  2⤵
  PID:10736
- C:\Windows\System\bFJWoVz.exe
  C:\Windows\System\bFJWoVz.exe
  2⤵
  PID:10756
- C:\Windows\System\aVaiqBn.exe
  C:\Windows\System\aVaiqBn.exe
  2⤵
  PID:10776
- C:\Windows\System\EnrCdMw.exe
  C:\Windows\System\EnrCdMw.exe
  2⤵
  PID:10800
- C:\Windows\System\cMpnNFs.exe
  C:\Windows\System\cMpnNFs.exe
  2⤵
  PID:10820
- C:\Windows\System\bNQqRWZ.exe
  C:\Windows\System\bNQqRWZ.exe
  2⤵
  PID:10844
- C:\Windows\System\kavgGme.exe
  C:\Windows\System\kavgGme.exe
  2⤵
  PID:10864
- C:\Windows\System\QGUyNqh.exe
  C:\Windows\System\QGUyNqh.exe
  2⤵
  PID:10884
- C:\Windows\System\oOOmnlk.exe
  C:\Windows\System\oOOmnlk.exe
  2⤵
  PID:10904
- C:\Windows\System\HQcUDks.exe
  C:\Windows\System\HQcUDks.exe
  2⤵
  PID:10924
- C:\Windows\System\wNlQbLt.exe
  C:\Windows\System\wNlQbLt.exe
  2⤵
  PID:10940
- C:\Windows\System\QzRhpjt.exe
  C:\Windows\System\QzRhpjt.exe
  2⤵
  PID:10964
- C:\Windows\System\aIAqaeg.exe
  C:\Windows\System\aIAqaeg.exe
  2⤵
  PID:10984
- C:\Windows\System\swSFSWu.exe
  C:\Windows\System\swSFSWu.exe
  2⤵
  PID:11000
- C:\Windows\System\GnSKKLh.exe
  C:\Windows\System\GnSKKLh.exe
  2⤵
  PID:11024
- C:\Windows\System\NkjzaVl.exe
  C:\Windows\System\NkjzaVl.exe
  2⤵
  PID:11040
- C:\Windows\System\vNwMnHi.exe
  C:\Windows\System\vNwMnHi.exe
  2⤵
  PID:11068
- C:\Windows\System\vntsnbP.exe
  C:\Windows\System\vntsnbP.exe
  2⤵
  PID:11088
- C:\Windows\System\pbAmhJU.exe
  C:\Windows\System\pbAmhJU.exe
  2⤵
  PID:11108
- C:\Windows\System\tKYJNLl.exe
  C:\Windows\System\tKYJNLl.exe
  2⤵
  PID:11128
- C:\Windows\System\eUAIBlm.exe
  C:\Windows\System\eUAIBlm.exe
  2⤵
  PID:11148
- C:\Windows\System\TdcgXEi.exe
  C:\Windows\System\TdcgXEi.exe
  2⤵
  PID:11172
- C:\Windows\System\rjzswyp.exe
  C:\Windows\System\rjzswyp.exe
  2⤵
  PID:11196
- C:\Windows\System\CrJGBTI.exe
  C:\Windows\System\CrJGBTI.exe
  2⤵
  PID:11216
- C:\Windows\System\nFervJw.exe
  C:\Windows\System\nFervJw.exe
  2⤵
  PID:11244
- C:\Windows\System\jGmrTsb.exe
  C:\Windows\System\jGmrTsb.exe
  2⤵
  PID:9104
- C:\Windows\System\JLrUMne.exe
  C:\Windows\System\JLrUMne.exe
  2⤵
  PID:9184
- C:\Windows\System\Eubeehy.exe
  C:\Windows\System\Eubeehy.exe
  2⤵
  PID:6860
- C:\Windows\System\vnIbLAc.exe
  C:\Windows\System\vnIbLAc.exe
  2⤵
  PID:7460
- C:\Windows\System\ZKtUrJR.exe
  C:\Windows\System\ZKtUrJR.exe
  2⤵
  PID:6396
- C:\Windows\System\zZBaiqR.exe
  C:\Windows\System\zZBaiqR.exe
  2⤵
  PID:8200
- C:\Windows\System\xqTgQfP.exe
  C:\Windows\System\xqTgQfP.exe
  2⤵
  PID:8256
- C:\Windows\System\cqtXXLx.exe
  C:\Windows\System\cqtXXLx.exe
  2⤵
  PID:7060
- C:\Windows\System\AIbLGYN.exe
  C:\Windows\System\AIbLGYN.exe
  2⤵
  PID:8080
- C:\Windows\System\RrSnGNL.exe
  C:\Windows\System\RrSnGNL.exe
  2⤵
  PID:8480
- C:\Windows\System\RHfkTbI.exe
  C:\Windows\System\RHfkTbI.exe
  2⤵
  PID:9304
- C:\Windows\System\ADDlHMa.exe
  C:\Windows\System\ADDlHMa.exe
  2⤵
  PID:9340
- C:\Windows\System\lTESDMy.exe
  C:\Windows\System\lTESDMy.exe
  2⤵
  PID:1144
- C:\Windows\System\EvBefCo.exe
  C:\Windows\System\EvBefCo.exe
  2⤵
  PID:9424
- C:\Windows\System\vUCFiDx.exe
  C:\Windows\System\vUCFiDx.exe
  2⤵
  PID:11268
- C:\Windows\System\HZWOdvd.exe
  C:\Windows\System\HZWOdvd.exe
  2⤵
  PID:11288
- C:\Windows\System\dpDzMxj.exe
  C:\Windows\System\dpDzMxj.exe
  2⤵
  PID:11316
- C:\Windows\System\IPlANbC.exe
  C:\Windows\System\IPlANbC.exe
  2⤵
  PID:11336
- C:\Windows\System\BTjVJvq.exe
  C:\Windows\System\BTjVJvq.exe
  2⤵
  PID:11356
- C:\Windows\System\GoXwLVo.exe
  C:\Windows\System\GoXwLVo.exe
  2⤵
  PID:11376
- C:\Windows\System\jfAlxCQ.exe
  C:\Windows\System\jfAlxCQ.exe
  2⤵
  PID:11396
- C:\Windows\System\GoglZQG.exe
  C:\Windows\System\GoglZQG.exe
  2⤵
  PID:11424
- C:\Windows\System\ASUWUNl.exe
  C:\Windows\System\ASUWUNl.exe
  2⤵
  PID:11440
- C:\Windows\System\RbzvqGV.exe
  C:\Windows\System\RbzvqGV.exe
  2⤵
  PID:11460
- C:\Windows\System\egpFELZ.exe
  C:\Windows\System\egpFELZ.exe
  2⤵
  PID:11476
- C:\Windows\System\XhCIlml.exe
  C:\Windows\System\XhCIlml.exe
  2⤵
  PID:11492
- C:\Windows\System\HSKlrRp.exe
  C:\Windows\System\HSKlrRp.exe
  2⤵
  PID:11508
- C:\Windows\System\lvRIhcA.exe
  C:\Windows\System\lvRIhcA.exe
  2⤵
  PID:11524
- C:\Windows\System\McdXDle.exe
  C:\Windows\System\McdXDle.exe
  2⤵
  PID:11548
- C:\Windows\System\EaDAlbU.exe
  C:\Windows\System\EaDAlbU.exe
  2⤵
  PID:11564
- C:\Windows\System\uDTdDhi.exe
  C:\Windows\System\uDTdDhi.exe
  2⤵
  PID:11588
- C:\Windows\System\VduUEUv.exe
  C:\Windows\System\VduUEUv.exe
  2⤵
  PID:11612
- C:\Windows\System\SqBdgbd.exe
  C:\Windows\System\SqBdgbd.exe
  2⤵
  PID:11628
- C:\Windows\System\FpHemXe.exe
  C:\Windows\System\FpHemXe.exe
  2⤵
  PID:11652
- C:\Windows\System\bFhIQrJ.exe
  C:\Windows\System\bFhIQrJ.exe
  2⤵
  PID:11676
- C:\Windows\System\eSJdnex.exe
  C:\Windows\System\eSJdnex.exe
  2⤵
  PID:11700
- C:\Windows\System\vLIAyyC.exe
  C:\Windows\System\vLIAyyC.exe
  2⤵
  PID:11716
- C:\Windows\System\USEDuOi.exe
  C:\Windows\System\USEDuOi.exe
  2⤵
  PID:11740
- C:\Windows\System\YdfZaXg.exe
  C:\Windows\System\YdfZaXg.exe
  2⤵
  PID:11764
- C:\Windows\System\fmuTPXg.exe
  C:\Windows\System\fmuTPXg.exe
  2⤵
  PID:11784
- C:\Windows\System\KQinSvT.exe
  C:\Windows\System\KQinSvT.exe
  2⤵
  PID:11804
- C:\Windows\System\LJNGfkz.exe
  C:\Windows\System\LJNGfkz.exe
  2⤵
  PID:11828
- C:\Windows\System\mhVugTD.exe
  C:\Windows\System\mhVugTD.exe
  2⤵
  PID:11848
- C:\Windows\System\PdjMXUm.exe
  C:\Windows\System\PdjMXUm.exe
  2⤵
  PID:11872
- C:\Windows\System\CetFLtG.exe
  C:\Windows\System\CetFLtG.exe
  2⤵
  PID:11888
- C:\Windows\System\VrLlZju.exe
  C:\Windows\System\VrLlZju.exe
  2⤵
  PID:11908
- C:\Windows\System\nPXnYmB.exe
  C:\Windows\System\nPXnYmB.exe
  2⤵
  PID:11924
- C:\Windows\System\ELuAdzD.exe
  C:\Windows\System\ELuAdzD.exe
  2⤵
  PID:11944
- C:\Windows\System\CxLTGzw.exe
  C:\Windows\System\CxLTGzw.exe
  2⤵
  PID:11964
- C:\Windows\System\fMTCbsX.exe
  C:\Windows\System\fMTCbsX.exe
  2⤵
  PID:11980
- C:\Windows\System\RTzsXbh.exe
  C:\Windows\System\RTzsXbh.exe
  2⤵
  PID:12000
- C:\Windows\System\VXkyEje.exe
  C:\Windows\System\VXkyEje.exe
  2⤵
  PID:12024
- C:\Windows\System\MggMoCR.exe
  C:\Windows\System\MggMoCR.exe
  2⤵
  PID:12040
- C:\Windows\System\KDcoPSC.exe
  C:\Windows\System\KDcoPSC.exe
  2⤵
  PID:12064
- C:\Windows\System\icbHQnj.exe
  C:\Windows\System\icbHQnj.exe
  2⤵
  PID:12096
- C:\Windows\System\BZehckm.exe
  C:\Windows\System\BZehckm.exe
  2⤵
  PID:12116
- C:\Windows\System\oEXqQyZ.exe
  C:\Windows\System\oEXqQyZ.exe
  2⤵
  PID:12144
- C:\Windows\System\iqNDyOn.exe
  C:\Windows\System\iqNDyOn.exe
  2⤵
  PID:12160
- C:\Windows\System\algPfli.exe
  C:\Windows\System\algPfli.exe
  2⤵
  PID:12180
- C:\Windows\System\APBrmOq.exe
  C:\Windows\System\APBrmOq.exe
  2⤵
  PID:12196
- C:\Windows\System\KlZnUPe.exe
  C:\Windows\System\KlZnUPe.exe
  2⤵
  PID:12220
- C:\Windows\System\USdSmXs.exe
  C:\Windows\System\USdSmXs.exe
  2⤵
  PID:12240
- C:\Windows\System\fynZfsO.exe
  C:\Windows\System\fynZfsO.exe
  2⤵
  PID:12260
- C:\Windows\System\pqQAsHt.exe
  C:\Windows\System\pqQAsHt.exe
  2⤵
  PID:9484
- C:\Windows\System\pCEuOJG.exe
  C:\Windows\System\pCEuOJG.exe
  2⤵
  PID:9584
- C:\Windows\System\iwubGqu.exe
  C:\Windows\System\iwubGqu.exe
  2⤵
  PID:9628
- C:\Windows\System\CeSOPbI.exe
  C:\Windows\System\CeSOPbI.exe
  2⤵
  PID:9684
- C:\Windows\System\mDrSZMe.exe
  C:\Windows\System\mDrSZMe.exe
  2⤵
  PID:1596
- C:\Windows\System\OcLHzXE.exe
  C:\Windows\System\OcLHzXE.exe
  2⤵
  PID:8272
- C:\Windows\System\KGJCjQM.exe
  C:\Windows\System\KGJCjQM.exe
  2⤵
  PID:9912
- C:\Windows\System\wtINgiq.exe
  C:\Windows\System\wtINgiq.exe
  2⤵
  PID:8028
- C:\Windows\System\CsuFoAQ.exe
  C:\Windows\System\CsuFoAQ.exe
  2⤵
  PID:10048
- C:\Windows\System\xhNHvWq.exe
  C:\Windows\System\xhNHvWq.exe
  2⤵
  PID:10124
- C:\Windows\System\ebPQpyn.exe
  C:\Windows\System\ebPQpyn.exe
  2⤵
  PID:10180
- C:\Windows\System\yBzAlWl.exe
  C:\Windows\System\yBzAlWl.exe
  2⤵
  PID:8804
- C:\Windows\System\LMocWsT.exe
  C:\Windows\System\LMocWsT.exe
  2⤵
  PID:8868
- C:\Windows\System\ByBiaRI.exe
  C:\Windows\System\ByBiaRI.exe
  2⤵
  PID:8548
- C:\Windows\System\KyoxTdk.exe
  C:\Windows\System\KyoxTdk.exe
  2⤵
  PID:1196
- C:\Windows\System\SywLKDU.exe
  C:\Windows\System\SywLKDU.exe
  2⤵
  PID:6804
- C:\Windows\System\mdLPPuG.exe
  C:\Windows\System\mdLPPuG.exe
  2⤵
  PID:8832
- C:\Windows\System\pLUjHZn.exe
  C:\Windows\System\pLUjHZn.exe
  2⤵
  PID:12300
- C:\Windows\System\lULdYEe.exe
  C:\Windows\System\lULdYEe.exe
  2⤵
  PID:12316
- C:\Windows\System\TMUNppj.exe
  C:\Windows\System\TMUNppj.exe
  2⤵
  PID:12336
- C:\Windows\System\DisPxrX.exe
  C:\Windows\System\DisPxrX.exe
  2⤵
  PID:12360
- C:\Windows\System\xSbzrHO.exe
  C:\Windows\System\xSbzrHO.exe
  2⤵
  PID:12376
- C:\Windows\System\xELKakB.exe
  C:\Windows\System\xELKakB.exe
  2⤵
  PID:12396
- C:\Windows\System\bWwtkvs.exe
  C:\Windows\System\bWwtkvs.exe
  2⤵
  PID:12416
- C:\Windows\System\lUYHZay.exe
  C:\Windows\System\lUYHZay.exe
  2⤵
  PID:12436
- C:\Windows\System\xoDdHqf.exe
  C:\Windows\System\xoDdHqf.exe
  2⤵
  PID:12464
- C:\Windows\System\vtmHfIP.exe
  C:\Windows\System\vtmHfIP.exe
  2⤵
  PID:12484
- C:\Windows\System\iJkgcnk.exe
  C:\Windows\System\iJkgcnk.exe
  2⤵
  PID:12500
- C:\Windows\System\bfIAkfA.exe
  C:\Windows\System\bfIAkfA.exe
  2⤵
  PID:12524
- C:\Windows\System\oAMQiva.exe
  C:\Windows\System\oAMQiva.exe
  2⤵
  PID:12552
- C:\Windows\System\GzFnubL.exe
  C:\Windows\System\GzFnubL.exe
  2⤵
  PID:12568
- C:\Windows\System\jgzZycA.exe
  C:\Windows\System\jgzZycA.exe
  2⤵
  PID:12592
- C:\Windows\System\SCMAdyG.exe
  C:\Windows\System\SCMAdyG.exe
  2⤵
  PID:12608
- C:\Windows\System\hmtCHmf.exe
  C:\Windows\System\hmtCHmf.exe
  2⤵
  PID:12624
- C:\Windows\System\EFKzDAH.exe
  C:\Windows\System\EFKzDAH.exe
  2⤵
  PID:12644
- C:\Windows\System\GGaWGjO.exe
  C:\Windows\System\GGaWGjO.exe
  2⤵
  PID:12660
- C:\Windows\System\zJFaJuQ.exe
  C:\Windows\System\zJFaJuQ.exe
  2⤵
  PID:12676
- C:\Windows\System\CFOwVhg.exe
  C:\Windows\System\CFOwVhg.exe
  2⤵
  PID:12692
- C:\Windows\System\lWKUSdr.exe
  C:\Windows\System\lWKUSdr.exe
  2⤵
  PID:12712
- C:\Windows\System\JydkRaF.exe
  C:\Windows\System\JydkRaF.exe
  2⤵
  PID:12728
- C:\Windows\System\aBWzefU.exe
  C:\Windows\System\aBWzefU.exe
  2⤵
  PID:12752
- C:\Windows\System\sMvXxUO.exe
  C:\Windows\System\sMvXxUO.exe
  2⤵
  PID:12772
- C:\Windows\System\kmktrer.exe
  C:\Windows\System\kmktrer.exe
  2⤵
  PID:12792
- C:\Windows\System\JWPJPGW.exe
  C:\Windows\System\JWPJPGW.exe
  2⤵
  PID:12816
- C:\Windows\System\ZCuQfua.exe
  C:\Windows\System\ZCuQfua.exe
  2⤵
  PID:12840
- C:\Windows\System\PbSLANI.exe
  C:\Windows\System\PbSLANI.exe
  2⤵
  PID:12860
- C:\Windows\System\AzpaDFi.exe
  C:\Windows\System\AzpaDFi.exe
  2⤵
  PID:12880
- C:\Windows\System\EFTWgwn.exe
  C:\Windows\System\EFTWgwn.exe
  2⤵
  PID:12904
- C:\Windows\System\tDUFqTG.exe
  C:\Windows\System\tDUFqTG.exe
  2⤵
  PID:12928
- C:\Windows\System\RzLvzxU.exe
  C:\Windows\System\RzLvzxU.exe
  2⤵
  PID:12944
- C:\Windows\System\igGeUls.exe
  C:\Windows\System\igGeUls.exe
  2⤵
  PID:12968
- C:\Windows\System\kGDmKfm.exe
  C:\Windows\System\kGDmKfm.exe
  2⤵
  PID:12988
- C:\Windows\System\QkFRYku.exe
  C:\Windows\System\QkFRYku.exe
  2⤵
  PID:13012
- C:\Windows\System\SbAOewl.exe
  C:\Windows\System\SbAOewl.exe
  2⤵
  PID:13032
- C:\Windows\System\ptfTZuc.exe
  C:\Windows\System\ptfTZuc.exe
  2⤵
  PID:11212
- C:\Windows\System\VyhalCM.exe
  C:\Windows\System\VyhalCM.exe
  2⤵
  PID:13224
- C:\Windows\System\hxElLfx.exe
  C:\Windows\System\hxElLfx.exe
  2⤵
  PID:13276
- C:\Windows\System\IVhVtnf.exe
  C:\Windows\System\IVhVtnf.exe
  2⤵
  PID:7356
- C:\Windows\System\eKDjPxk.exe
  C:\Windows\System\eKDjPxk.exe
  2⤵
  PID:10004
- C:\Windows\System\BhySsYx.exe
  C:\Windows\System\BhySsYx.exe
  2⤵
  PID:12104
- C:\Windows\System\pDGYUAw.exe
  C:\Windows\System\pDGYUAw.exe
  2⤵
  PID:10816
- C:\Windows\System\SZRfWNU.exe
  C:\Windows\System\SZRfWNU.exe
  2⤵
  PID:10200
- C:\Windows\System\pKthvjJ.exe
  C:\Windows\System\pKthvjJ.exe
  2⤵
  PID:6120
- C:\Windows\System\KXexjqd.exe
  C:\Windows\System\KXexjqd.exe
  2⤵
  PID:9544
- C:\Windows\System\QLePiCn.exe
  C:\Windows\System\QLePiCn.exe
  2⤵
  PID:11452
- C:\Windows\System\peGJzHH.exe
  C:\Windows\System\peGJzHH.exe
  2⤵
  PID:11756
- C:\Windows\System\YMAKyov.exe
  C:\Windows\System\YMAKyov.exe
  2⤵
  PID:12652
- C:\Windows\System\yVfMzJZ.exe
  C:\Windows\System\yVfMzJZ.exe
  2⤵
  PID:7056
- C:\Windows\System\rNUZxhi.exe
  C:\Windows\System\rNUZxhi.exe
  2⤵
  PID:7556
- C:\Windows\System\qehDobu.exe
  C:\Windows\System\qehDobu.exe
  2⤵
  PID:3348
- C:\Windows\System\LaUcnio.exe
  C:\Windows\System\LaUcnio.exe
  2⤵
  PID:9604
- C:\Windows\System\lGoHVzM.exe
  C:\Windows\System\lGoHVzM.exe
  2⤵
  PID:9648
- C:\Windows\System\zrYiwqC.exe
  C:\Windows\System\zrYiwqC.exe
  2⤵
  PID:12372
- C:\Windows\System\vvrmgsI.exe
  C:\Windows\System\vvrmgsI.exe
  2⤵
  PID:12788
- C:\Windows\System\NbmgoYd.exe
  C:\Windows\System\NbmgoYd.exe
  2⤵
  PID:9568
- C:\Windows\System\zFcbRXL.exe
  C:\Windows\System\zFcbRXL.exe
  2⤵
  PID:996
- C:\Windows\System\qmldJso.exe
  C:\Windows\System\qmldJso.exe
  2⤵
  PID:10640
- C:\Windows\System\yFtpDLw.exe
  C:\Windows\System\yFtpDLw.exe
  2⤵
  PID:11816
- C:\Windows\System\AMpsZdt.exe
  C:\Windows\System\AMpsZdt.exe
  2⤵
  PID:7656
- C:\Windows\System\QkofArJ.exe
  C:\Windows\System\QkofArJ.exe
  2⤵
  PID:3780
- C:\Windows\System\DPMPWqC.exe
  C:\Windows\System\DPMPWqC.exe
  2⤵
  PID:12308
- C:\Windows\System\RiutvHx.exe
  C:\Windows\System\RiutvHx.exe
  2⤵
  PID:12940
- C:\Windows\System\fNULeRN.exe
  C:\Windows\System\fNULeRN.exe
  2⤵
  PID:12956
- C:\Windows\System\TwTxDcy.exe
  C:\Windows\System\TwTxDcy.exe
  2⤵
  PID:12852
- C:\Windows\System\RoDtEBk.exe
  C:\Windows\System\RoDtEBk.exe
  2⤵
  PID:12700
- C:\Windows\System\kCjwlae.exe
  C:\Windows\System\kCjwlae.exe
  2⤵
  PID:12496
- C:\Windows\System\lrAcixj.exe
  C:\Windows\System\lrAcixj.exe
  2⤵
  PID:12408
- C:\Windows\System\irqtBBH.exe
  C:\Windows\System\irqtBBH.exe
  2⤵
  PID:8960
- C:\Windows\System\uEQnPRB.exe
  C:\Windows\System\uEQnPRB.exe
  2⤵
  PID:10024
- C:\Windows\System\otnEIpD.exe
  C:\Windows\System\otnEIpD.exe
  2⤵
  PID:9728
- C:\Windows\System\QsHNDKC.exe
  C:\Windows\System\QsHNDKC.exe
  2⤵
  PID:10676
- C:\Windows\System\ygRfqPt.exe
  C:\Windows\System\ygRfqPt.exe
  2⤵
  PID:9972
- C:\Windows\System\azxhbcD.exe
  C:\Windows\System\azxhbcD.exe
  2⤵
  PID:8936
- C:\Windows\System\KcTsETl.exe
  C:\Windows\System\KcTsETl.exe
  2⤵
  PID:12272
- C:\Windows\System\Uinggcn.exe
  C:\Windows\System\Uinggcn.exe
  2⤵
  PID:8072
- C:\Windows\System\iOvdjuo.exe
  C:\Windows\System\iOvdjuo.exe
  2⤵
  PID:12564
- C:\Windows\System\sDsSdiN.exe
  C:\Windows\System\sDsSdiN.exe
  2⤵
  PID:9256
- C:\Windows\System\XKDnSsl.exe
  C:\Windows\System\XKDnSsl.exe
  2⤵
  PID:13288
- C:\Windows\System\tOtajFn.exe
  C:\Windows\System\tOtajFn.exe
  2⤵
  PID:8348
- C:\Windows\System\qVQDMKf.exe
  C:\Windows\System\qVQDMKf.exe
  2⤵
  PID:11284
- C:\Windows\System\Fbmneqr.exe
  C:\Windows\System\Fbmneqr.exe
  2⤵
  PID:9832
- C:\Windows\System\vrHUaVn.exe
  C:\Windows\System\vrHUaVn.exe
  2⤵
  PID:10196
- C:\Windows\System\UhWcllE.exe
  C:\Windows\System\UhWcllE.exe
  2⤵
  PID:10572
- C:\Windows\System\QUhApst.exe
  C:\Windows\System\QUhApst.exe
  2⤵
  PID:11404
- C:\Windows\System\MatFjek.exe
  C:\Windows\System\MatFjek.exe
  2⤵
  PID:11372
- C:\Windows\System\yJYWBmE.exe
  C:\Windows\System\yJYWBmE.exe
  2⤵
  PID:11644
- C:\Windows\System\lduLyfE.exe
  C:\Windows\System\lduLyfE.exe
  2⤵
  PID:10292
- C:\Windows\System\yQLRhIk.exe
  C:\Windows\System\yQLRhIk.exe
  2⤵
  PID:13088
- C:\Windows\System\fYFdOET.exe
  C:\Windows\System\fYFdOET.exe
  2⤵
  PID:4248
- C:\Windows\System\vvQiEjf.exe
  C:\Windows\System\vvQiEjf.exe
  2⤵
  PID:13044
- C:\Windows\System\vAkRLYZ.exe
  C:\Windows\System\vAkRLYZ.exe
  2⤵
  PID:7732
- C:\Windows\System\pkFOXWV.exe
  C:\Windows\System\pkFOXWV.exe
  2⤵
  PID:12428
- C:\Windows\System\jcOsoVZ.exe
  C:\Windows\System\jcOsoVZ.exe
  2⤵
  PID:11972
- C:\Windows\System\dFdHgJy.exe
  C:\Windows\System\dFdHgJy.exe
  2⤵
  PID:9352
- C:\Windows\System\WPkdjVh.exe
  C:\Windows\System\WPkdjVh.exe
  2⤵
  PID:7276
- C:\Windows\System\GcKwTek.exe
  C:\Windows\System\GcKwTek.exe
  2⤵
  PID:3520
- C:\Windows\System\ETsPONK.exe
  C:\Windows\System\ETsPONK.exe
  2⤵
  PID:4684
- C:\Windows\System\ZWiYvsj.exe
  C:\Windows\System\ZWiYvsj.exe
  2⤵
  PID:13300
- C:\Windows\System\YxrhBEt.exe
  C:\Windows\System\YxrhBEt.exe
  2⤵
  PID:10296
- C:\Windows\System\BPSTUfh.exe
  C:\Windows\System\BPSTUfh.exe
  2⤵
  PID:3280
- C:\Windows\System\WmCpcyw.exe
  C:\Windows\System\WmCpcyw.exe
  2⤵
  PID:5408
- C:\Windows\System\PRnFpgI.exe
  C:\Windows\System\PRnFpgI.exe
  2⤵
  PID:9736
- C:\Windows\System\rUDRFsD.exe
  C:\Windows\System\rUDRFsD.exe
  2⤵
  PID:11328
- C:\Windows\System\PiflXOi.exe
  C:\Windows\System\PiflXOi.exe
  2⤵
  PID:10336
- C:\Windows\System\OeDxCOE.exe
  C:\Windows\System\OeDxCOE.exe
  2⤵
  PID:10052
- C:\Windows\System\DfsiJGP.exe
  C:\Windows\System\DfsiJGP.exe
  2⤵
  PID:5784
- C:\Windows\System\trXRTGR.exe
  C:\Windows\System\trXRTGR.exe
  2⤵
  PID:11104
- C:\Windows\System\PLhJqEn.exe
  C:\Windows\System\PLhJqEn.exe
  2⤵
  PID:13260
- C:\Windows\System\aukpXts.exe
  C:\Windows\System\aukpXts.exe
  2⤵
  PID:11308
- C:\Windows\System\wHYIuEU.exe
  C:\Windows\System\wHYIuEU.exe
  2⤵
  PID:13196
- C:\Windows\System\sesnSDA.exe
  C:\Windows\System\sesnSDA.exe
  2⤵
  PID:12328
- C:\Windows\System\COanqAg.exe
  C:\Windows\System\COanqAg.exe
  2⤵
  PID:9264
- C:\Windows\System\QgiqhqA.exe
  C:\Windows\System\QgiqhqA.exe
  2⤵
  PID:12576
- C:\Windows\System\rbTslXe.exe
  C:\Windows\System\rbTslXe.exe
  2⤵
  PID:7456
- C:\Windows\System\ojdHySy.exe
  C:\Windows\System\ojdHySy.exe
  2⤵
  PID:10660
- C:\Windows\System\xcqKPTd.exe
  C:\Windows\System\xcqKPTd.exe
  2⤵
  PID:5344
- C:\Windows\System\rJmJSpJ.exe
  C:\Windows\System\rJmJSpJ.exe
  2⤵
  PID:7232
- C:\Windows\System\XOJfDzr.exe
  C:\Windows\System\XOJfDzr.exe
  2⤵
  PID:8956
- C:\Windows\System\CdYbzgY.exe
  C:\Windows\System\CdYbzgY.exe
  2⤵
  PID:3384
- C:\Windows\System\ZlgPhed.exe
  C:\Windows\System\ZlgPhed.exe
  2⤵
  PID:10272
- C:\Windows\System\YLWqsew.exe
  C:\Windows\System\YLWqsew.exe
  2⤵
  PID:9580
- C:\Windows\System\itojjTf.exe
  C:\Windows\System\itojjTf.exe
  2⤵
  PID:8124
- C:\Windows\System\BXigfWy.exe
  C:\Windows\System\BXigfWy.exe
  2⤵
  PID:11572
- C:\Windows\System\sQixcNL.exe
  C:\Windows\System\sQixcNL.exe
  2⤵
  PID:10772

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:11832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_pws2vbet.1xt.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pws2vbet.1xt.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

AoCaRBM.exe

Path C:\Windows\System\AoCaRBM.exe
Size 1.5MB
SHA256 afc0c77cf223f82458e0ec3dd253fd009a9f1ea45224814eaafd3b309eca86db
MD5 d491dff875d552b6fadab903251679d3
SHA1 643551dc0cb4f210b97f7b34eefd02e0c18da247
SHA512 aab4d69e48800716f63169e694f46d9846177008ad9b9a0d982b3b4b5b08f932686efc339a2f9252ad59809697cf9d1e55f528e7dcb476d475e825d5fe803be9
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjMX:Lz071uv4BPMki8Cnki2WGcNL1
MD5 SHA1 SHA512 SSDEEP

Submit Download

DIocEIF.exe

Path C:\Windows\System\DIocEIF.exe
Size 1.5MB
SHA256 19fa3aedfeb1ad5b1ff7d41ef176ec27eaa202e66023f829b60374ca2dfb0c52
MD5 6c118c4b64fbc6e4764999c65392a56a
SHA1 24a0b3b72e79fa74a82cf2e59f11d033e3e68d2b
SHA512 dff7ccfc141b252ff574a56d8dd9f398be90146a32e297325e48dbc26980083e727987b3c37e27bce7c13cf2bcd16e1c189a2d8ed9a50dabc4bd27e387d7c9ef
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjMz:Lz071uv4BPMki8Cnki2WGcNLt
MD5 SHA1 SHA512 SSDEEP

Submit Download

FDaRWaH.exe

Path C:\Windows\System\FDaRWaH.exe
Size 1.5MB
SHA256 3bc1d535743a8e3d391a67cf180b37993021b9090f6d7d547ccfb575b9f787f0
MD5 fb6f6a55bb64ac4c3e56d7e9f0b82663
SHA1 3ee8b9ca1c4622645735aa162b3cf9282bdf422c
SHA512 ddb323e9fc28bd03ffc1dd3d8a1e3f09aed9c88f16a157bded8986ed027712de87ca906bbae598dbe56b85e65ec27a348ea9fc2011e2e4f52705b9b92b6d0179
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjM1:Lz071uv4BPMki8Cnki2WGcNL3
MD5 SHA1 SHA512 SSDEEP

Submit Download

FtIUjWP.exe

Path C:\Windows\System\FtIUjWP.exe
Size 1.5MB
SHA256 81c77ed92ea0acdd659bf8e13345a28221ac2f43911ecc9d58a8a5cea9bad2b7
MD5 30fcab803a288d46f8af98e398461135
SHA1 3449bc0e0ed7b8b36d1e096cfcff3ddeabda22fc
SHA512 c10c7e63eeaa75700ac2b18eaead2f989b0cf147975f57fa4b66f7451c781610390abf0573674c8992bf6ac19217a53f66f34df7749647f456297452ddc6e1c6
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjMd:Lz071uv4BPMki8Cnki2WGcNLT
MD5 SHA1 SHA512 SSDEEP

Submit Download

FzWaWLk.exe

Path C:\Windows\System\FzWaWLk.exe
Size 1.5MB
SHA256 70fd74e596807d2968363a32e5a3f2c5c2b7518465fcdeaaf768f737e483cae3
MD5 f02e97a82e2785c3b61767c3234f2ffb
SHA1 04a8d202c9b31ca12a296b358060307a46cefe2d
SHA512 35f53c141a9639bfe1f82f661ea14afef9fb0596b0d88a12d7d2e85756f2d6fc16c189c3fcbcfe9d66fb408051487bafa727d54771945d9363855d860e4f2e8f
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjMv:Lz071uv4BPMki8Cnki2WGcNLh
MD5 SHA1 SHA512 SSDEEP

Submit Download

GBvbEkl.exe

Path C:\Windows\System\GBvbEkl.exe
Size 1.5MB
SHA256 2229c8d896ec490d4b05cc244b37909ce05e55bc4f8321cf79daced57b6421bb
MD5 4e315fff87c29346660781678408841a
SHA1 d386e85c88035dbe9918ff78af4f81310212f2d9
SHA512 6559d2aff4e3b65e66c0f6d4c3922281714a9e05c8b30e14869e2dbe5e6012dbd9e4143ea081256e571ca156c6ca30915a43fb0563ccb49d5eb4628d93c6cd24
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjMH:Lz071uv4BPMki8Cnki2WGcNLF
MD5 SHA1 SHA512 SSDEEP

Submit Download

GzCqXYB.exe

Path C:\Windows\System\GzCqXYB.exe
Size 1.5MB
SHA256 378cd667a090c1be9980d9d8e1507efead2f819b203ae9791cc61d9b8c58f56f
MD5 1d12656f4338ec372b841953e49ac8e9
SHA1 3c2c8fc6d9fc00714093ca9f80d20b1ed02b5f76
SHA512 7b4e111d8714b7e2ee311c06f4dcffa24c0e33fe022e8f0a10ebbaa0aa1d14ce50df8f548a57eadac795955a54da62d404d7c992974e929b865e31dbe5665cde
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjM5:Lz071uv4BPMki8Cnki2WGcNLT
MD5 SHA1 SHA512 SSDEEP

Submit Download

HVvYmvK.exe

Path C:\Windows\System\HVvYmvK.exe
Size 1.5MB
SHA256 9f8dfeba9426ed0811eca26fa297089f1aa31a908571e0ad51cace2e367d64ed
MD5 2610a1c38d6eca62525c65a90218ee85
SHA1 6685b7cbd94405487373e3fe93923c92e25a20d6
SHA512 f5c64ab0b1c1dceea1a176bedd3559896714305b4eaf1790d4d59d3763215b07ce1fd04a7a0c1347d45e280c91de485767fa557e09ae086434edb8098a94d466
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjMU:Lz071uv4BPMki8Cnki2WGcNLy
MD5 SHA1 SHA512 SSDEEP

Submit Download

IMlvedx.exe

Path C:\Windows\System\IMlvedx.exe
Size 1.5MB
SHA256 644702cccf32f1f986b5c67157e53ae54d57f3e0e7ad760666c94f3cf827301f
MD5 ec680f928d116fc154036255568936b0
SHA1 9077482221287b88f80a4ca8e5ff2a7fa3114e4a
SHA512 8a6a11f9b2e7e3305fb2b1648ce234dac0eb0764ba4ebf7e84787144b18b408cb61f30784bfabd9d4031a30ce5d6e6f4c2cc1da8998465fb26dd0e06fa7834d4
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjMi:Lz071uv4BPMki8Cnki2WGcNLE
MD5 SHA1 SHA512 SSDEEP

Submit Download

IfODJGv.exe

Path C:\Windows\System\IfODJGv.exe
Size 1.5MB
SHA256 37fbd0f0f5d61019be58db2b2258f4b1928211eb15f62b641906c89329c56c47
MD5 d4410b8c7feda38a37c565adae6ed8fb
SHA1 cae40c3d2ae428396294d72412cec3366ba27a46
SHA512 d5420e4b3280a67dc7f6b05657d219c71abd2c99c5afc614e6b74b89ddc589acd978f5223b06efda5b9b30b496e64dee74e0e0f99c1362f4360828cb1f879e2e
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjMf:Lz071uv4BPMki8Cnki2WGcNLF
MD5 SHA1 SHA512 SSDEEP

Submit Download

JoynUlg.exe

Path C:\Windows\System\JoynUlg.exe
Size 1.5MB
SHA256 b8103ce1c4846d9ef16f3ab25b771e0b9562e0d1422bceeeaf89462dcb26946e
MD5 e8bfc3e616ef166f9ee6637386452aa6
SHA1 88513aa6f2c21f458f54e8a7f6d5978bd267e683
SHA512 27a2765ebea25cead6cb6a8637f5fb977a0b011dba200a173df2711ea1caa2eee2e6406f624fa5e33fb7cfc2e6af0e858a3ec5acf1b4187b990c5d122258d508
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjMAG:Lz071uv4BPMki8Cnki2WGcNLn
MD5 SHA1 SHA512 SSDEEP

Submit Download

KcyfBJO.exe

Path C:\Windows\System\KcyfBJO.exe
Size 1.5MB
SHA256 62b39e63441fd6cc7428d2f365ccb55293fc1a6e67ea7ac41df5021062e1962e
MD5 4b2287e50e8844da2c2876346d3a461f
SHA1 32e7d56ef4ee3550294ce65fdcfef074fe6d0c9b
SHA512 a94b484cdd28dc95b89355da13ec164fac616ad9394e1174bd44956b756ff67a6f4940e708ed66d17d580cea9555f0081491f5be5c669f1a230a369981012467
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjM9:Lz071uv4BPMki8Cnki2WGcNLP
MD5 SHA1 SHA512 SSDEEP

Submit Download

LQfmTpJ.exe

Path C:\Windows\System\LQfmTpJ.exe
Size 1.5MB
SHA256 f387c544be776170ce3089b3f38d48851c822f6e86a965360c93611195d691f8
MD5 456db9287fb5cc4ac6656e0ed3a54f47
SHA1 4fcae0831538ef2a26a98a9479f6773f3c4737b4
SHA512 91661edd3067d7c293bd7cab498e15d72edf09262f833e4cd90f8da062f4a061708ae9daa52241794ba725fd56fec6fba2c06183c6766e9da941944dffc54d16
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjMV:Lz071uv4BPMki8Cnki2WGcNL/
MD5 SHA1 SHA512 SSDEEP

Submit Download

LXKDGbj.exe

Path C:\Windows\System\LXKDGbj.exe
Size 1.5MB
SHA256 6fea1d52fd163ceb666d666ae148aaad32e4e143be4fc0e3d55160ca16ab7252
MD5 e66d8bb9e1ea2c0e289da8197518a859
SHA1 74d5d59be2876d7e55a6469fe55de333b18e01b5
SHA512 487dd7570684e53d1d9e9adbd6b6264e7ac952a46e7f084ba07e98efb3162ded562005c1e90ce5b21e716c8121551c35738f879bdaa02cb3a6e7bdd76f2053f4
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjMj:Lz071uv4BPMki8Cnki2WGcNLh
MD5 SHA1 SHA512 SSDEEP

Submit Download

LZLzOpf.exe

Path C:\Windows\System\LZLzOpf.exe
Size 1.5MB
SHA256 09ec7ff2ccf6c563d27ce0b97cdbb6ef97d32a83f2cd22e050d182712784e424
MD5 1fb9c952059b42994563d7dc974a8a4d
SHA1 15dddd8e75289f61be58aaff5880fcef711326aa
SHA512 92ee098f513700163c887ebee71b36c9c11a75a78c62ea0e8de2c7fdc8afa70c9119874a4ec20281335a02f42f0f47dd7b2935d0eb8d8d50750820749ddc120f
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjM+:Lz071uv4BPMki8Cnki2WGcNLc
MD5 SHA1 SHA512 SSDEEP

Submit Download

MgCBeAp.exe

Path C:\Windows\System\MgCBeAp.exe
Size 1.5MB
SHA256 7823a0446ef5c23ff83ce8beba2e763ab88f964037a18bc76191bff6a12c1e98
MD5 ac8e12e6e59041134f4c7c17d64a9c0e
SHA1 b5dffe45f054b9c6a10211e06b3a1e843f77c551
SHA512 41919287c4588e428ed4fd0d236bcdbf624767482e7cda0c1687c12352cfb64073423094f5401256b00df3aa09aa39237956b25951e1562cec492f8363492136
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjM5:Lz071uv4BPMki8Cnki2WGcNLb
MD5 SHA1 SHA512 SSDEEP

Submit Download

QUEBDOR.exe

Path C:\Windows\System\QUEBDOR.exe
Size 1.5MB
SHA256 ff03c3638a83bc2107fc77fda46f72d89e6ab8377839b0ea79c6c7eacf2d1d4d
MD5 15ec97d0d2ca013076c63e2687197c96
SHA1 8a16d76dd3742cb2a5b8e43ed9e730851b6773c2
SHA512 d0d42b4f2b1fec3d848cf9c448e7cbdc0068bd7b0d67175896c56651b87f3d8f7cb1f1d968aeb29bdd9ca477ff02a458a5d569e403a8800ce06c7ed66c239334
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjMu0w:Lz071uv4BPMki8Cnki2WGcNL2
MD5 SHA1 SHA512 SSDEEP

Submit Download

RpNhlKv.exe

Path C:\Windows\System\RpNhlKv.exe
Size 1.5MB
SHA256 209b9131848b46be83652660e032417f091a86f4ddbcb57504326fde0e00cdbe
MD5 434a2af03f02e63d9e3c6ac99e04a38d
SHA1 dd8ce6ac90e15b354a59093607a79ac1a18c7702
SHA512 9507b239a41f18d24c1ffba0eeadb827cb48a67f8906642a93e12d82dcbbc0dfdbbb2f43b97b8ec8a6b71c8d236d7e9f1eeb9f6dc5660668c1b6e08b80a0fb94
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjMn:Lz071uv4BPMki8Cnki2WGcNLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

XyFonMt.exe

Path C:\Windows\System\XyFonMt.exe
Size 1.5MB
SHA256 98d8d0e9b23f2dcdd041eb514c71d7ba7928ffff297b532f0112d13d7df3bb45
MD5 92991b234f8b139f958d0284f66e73f2
SHA1 c0ea19c796338cc42272871bfae11b474a31ad3d
SHA512 28961e70443e3976ee940401bb6eac3caadc4543fa0660e151fccaa4ac4178f2232ef9b2eb8b4fd3ca9a4064297eaf20739b42ec642afccde2e4ae22ff2d4f72
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjMN:Lz071uv4BPMki8Cnki2WGcNLr
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZulutUf.exe

Path C:\Windows\System\ZulutUf.exe
Size 1.5MB
SHA256 52a4951954df01bce93c58216af91f3b91de0a5f8f6e179b902214b8e3cb5745
MD5 a7474f0749096f578a33aefd5ba61dfb
SHA1 5dd0d9a0234b4fa205810ce0ea6045b296882de3
SHA512 f249ca9dc0b3d1c27900f67717bf96eea31bd4de3b5b875a13a045262aa10c52ab73e50a04c0d411c86d4bd8784a21b74c6148146d2687884af9908d1b0d846c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjMj:Lz071uv4BPMki8Cnki2WGcNLp
MD5 SHA1 SHA512 SSDEEP

Submit Download

aCvhzBC.exe

Path C:\Windows\System\aCvhzBC.exe
Size 1.5MB
SHA256 017698a44b05ba9c7e483c44eecd16c567819d58e0fe74acc8210257cafdb49b
MD5 6ddfefe274a5ff5b573ed16f9104e5cc
SHA1 902d3207a772622297c46323e5ee3f9a864b363e
SHA512 3ac983d2958dcfdc9bc4040c1ac2de29f1902a117eb8ee4b4a9b141d8af1d74a9158f618e6785cd829ce9ddf74d28de97f1a8777c71470cc0ac189c46645e679
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjM5:Lz071uv4BPMki8Cnki2WGcNLP
MD5 SHA1 SHA512 SSDEEP

Submit Download

atwjvXh.exe

Path C:\Windows\System\atwjvXh.exe
Size 1.5MB
SHA256 a934cb1374a848e5455105be5cb02d18c1c2040b96bc218dd26153ceb21c7f42
MD5 f2f0c30958ba2fcb57cd2c95b94f04ff
SHA1 a6e5a5a0ba1d78e0aa8c3862532915cb5edf7f83
SHA512 d9d52c5218d4e22b97045311b646fe5a52be4a6b50f2eca48b9cd26a4d52cdaa2f7cd3fe9b61c138f087b8692dd9eb2dfe9b68108ce1ac91b75abcd9a9071459
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjMA:Lz071uv4BPMki8Cnki2WGcNLW
MD5 SHA1 SHA512 SSDEEP

Submit Download

bPhKtNb.exe

Path C:\Windows\System\bPhKtNb.exe
Size 1.5MB
SHA256 83e175427f42cf02294757682127b067f6495466b2da2b7f812fe837a0c06fd2
MD5 713569c585c5bc606ca68e8a47a6e6d2
SHA1 48374566dc8d54b144a3fbf9a7d111e00062c31d
SHA512 e406b91bffcf8787edc1b35e5dff3cbb6e4178d8daf5bf0bf5278ab95909bd8b99a99cb3053bb6d23cecde15e70d3a5cfffbed7e2f030e5a2285540ad44c63d0
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjM7:Lz071uv4BPMki8Cnki2WGcNLt
MD5 SHA1 SHA512 SSDEEP

Submit Download

cOZnqan.exe

Path C:\Windows\System\cOZnqan.exe
Size 1.5MB
SHA256 494aa1de587c5c34f39febb965dc1642429dd9bcdc3ca42c06229240f4b0073c
MD5 185a6f0fe803fe69c4ee5f73040c3b93
SHA1 674ec4dbec00bf3f8c274401e1be36d3609b5edc
SHA512 1233455d65b580c867341433a50231c47949abb1922bc0b6c5593b9d057ad99db837f88e5582cd3b3497e7c23ebf24677f926dde3345892fe5132f50f49a77dc
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjM7:Lz071uv4BPMki8Cnki2WGcNLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

cfSlbQu.exe

Path C:\Windows\System\cfSlbQu.exe
Size 1.5MB
SHA256 9fc077b41c290906fa87c07d709e6212f5defa76d324c0a56b20d226275d9d68
MD5 0d8d335d8bc899853aafea0d8dc30cb0
SHA1 831f25384d288dd15680d3294849f254c87132eb
SHA512 12bb43724f4d66b9d6f1cb983453c114ce1803d756713d026bf7dce253f9f08f23eb2dfceeefc862f44503a85e32dbf178f9f7373f0e51c0d9d10a67b52c1c0e
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjM3:Lz071uv4BPMki8Cnki2WGcNLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

dXSxnhX.exe

Path C:\Windows\System\dXSxnhX.exe
Size 1.5MB
SHA256 f97bc2c1ca35212fd049a065a74a0f078f5fcf26fa23141518ff7388ff932c5d
MD5 dbd896c92a4523e2d6d8755b0c38dfd6
SHA1 bd917ed02944c115343500722dbc386e3631fee9
SHA512 cd633fa65388f93a76aaa1f7b0763d7196c0236802363dcc253c2adfa1674e90402a36c9848693e2baca8e9341f2c903318e02e088056488e690ecd5f512282b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjMWO:Lz071uv4BPMki8Cnki2WGcNLP
MD5 SHA1 SHA512 SSDEEP

Submit Download

fBYNyen.exe

Path C:\Windows\System\fBYNyen.exe
Size 1.5MB
SHA256 852fa3e9c66f625ddb215c24caf1719ba4a6b3e89ddd3e42fe7b22279ffc91a1
MD5 66af603756880f9d87daaa04aaf6a8e7
SHA1 77e102fbf3ee7e8291e9f9a91c25d68b4b99ed81
SHA512 d3ac8332936a7c442b0bc66ae6e436b5cf03a8b117c40c858e94d17b507d5edaa19783ee23d0f0d48d7bbff87cac15ee94cef7925e7d0fc19eb11e71ee6fbf35
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjM2:Lz071uv4BPMki8Cnki2WGcNL8
MD5 SHA1 SHA512 SSDEEP

Submit Download

hHpATik.exe

Path C:\Windows\System\hHpATik.exe
Size 1.5MB
SHA256 7628cacab3e197b960ab3ade535ad53c890dc8c8255116ad19f072d06e653ff2
MD5 b6b9cf2c902aef46db29085f5ff637e8
SHA1 e3aa4ef677b795dacc9ae1745a26aa19fbf1926f
SHA512 ec253771de4e2d3758f5026719e52f04d3ff2b8e74756a639f2c443212acc40812dcfacf18f46993d7f7fa5fe4416eb51403619515aa72a3e6c9e97ea06fdd16
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjMS:Lz071uv4BPMki8Cnki2WGcNLM
MD5 SHA1 SHA512 SSDEEP

Submit Download

jvFxHKK.exe

Path C:\Windows\System\jvFxHKK.exe
Size 1.5MB
SHA256 092bd042104bbea20f2a80d60e1c3988fef05e8a26313c7bc26d4f66bbae378b
MD5 66ae39f3adfedd5ae66377321c49e352
SHA1 59e63c398891eb39788b2dcfffa13d60e07954ae
SHA512 f34c20659b1b186eceb4d81df3afd31c5611fd8af4bfabb424a5fe9021ec46af4f69df38a76bdcc66d4f4366c60f5e3fa20d35763a4fdb9b039232de3412827e
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjMA:Lz071uv4BPMki8Cnki2WGcNLu
MD5 SHA1 SHA512 SSDEEP

Submit Download

koZDETq.exe

Path C:\Windows\System\koZDETq.exe
Size 1.5MB
SHA256 7e0a8f33ebde3e2e3a1716c65e5559609b265cd50571de7ef2a70f59e966e564
MD5 e379beafffef70f91e2f4ec38ca4cb21
SHA1 d3d0417915fec8d441850d277b8eafc14e13e1b3
SHA512 ac3613ec5faa56d7322ebce03e9393e00e8be6fb51f8e36654a5b6fa1ee56fee2c29ef04394358f02e3f11bb7258ad5bfdde1a295fe61cb76c257f8185d57e46
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjMG:Lz071uv4BPMki8Cnki2WGcNLI
MD5 SHA1 SHA512 SSDEEP

Submit Download

lWfJFJN.exe

Path C:\Windows\System\lWfJFJN.exe
Size 1.5MB
SHA256 f77ec04d091d157775e5018be33aff3ef6b30ae3a5d853cb74825fcac52e20b2
MD5 4fab92c62d159fb5aee3f9e2859e2b58
SHA1 4579f1ce661214e09ed43cbc1d9b47002134bb31
SHA512 6304c88da3c320982259e8d9e2b74197839d1d2e4e260805248bf3ba1c1d8fb469d5212ddc2934944e30f472c403beb6eb160d65382d344588dc7faa7fe50720
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjMM:Lz071uv4BPMki8Cnki2WGcNLG
MD5 SHA1 SHA512 SSDEEP

Submit Download

mMOvasa.exe

Path C:\Windows\System\mMOvasa.exe
Size 1.5MB
SHA256 d99b1850557f5f4fbdce64b5b24d577dd21adad79b5a2089629a700ba68df809
MD5 3201b48039c76ae996521fe07774bfdc
SHA1 615cfd5dc5dd6ba3c9721b8a36073a8b6b791960
SHA512 cba87e5c2e171cc5c153cdf1b9efb00b35194ece9d0fc4ad9b3e2843851b0e7444daae1208ee1721a9ad3fbe4e571963bf360e2ed429d11050cb69adc4ee3b37
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjML:Lz071uv4BPMki8Cnki2WGcNLV
MD5 SHA1 SHA512 SSDEEP

Submit Download

mdQPXxV.exe

Path C:\Windows\System\mdQPXxV.exe
Size 1.5MB
SHA256 71add7deb1f39f9f0d327400d53e1fad6dc0a0e66e74af52fb99a316d31cad97
MD5 e919753650104393ca6b741e45ce9969
SHA1 fdad6f7f334fd65d07d6a87e0ea76b7733c3a095
SHA512 2781b1da788184c2d93e4c59e9917984e02952f25b6570df1b1df8a716840ff8262f2f4dcaab72505427c3cfbcae7d8a9c892ab0fcc828b5450cec1efe84a3be
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjM/:Lz071uv4BPMki8Cnki2WGcNLt
MD5 SHA1 SHA512 SSDEEP

Submit Download

nWxXJhh.exe

Path C:\Windows\System\nWxXJhh.exe
Size 8B
SHA256 5a695799bf8f73300a4f9c4a59fd25b209a2457abf1051a262d540e520557456
MD5 2adac273ce248e8d242a4b12f749bb46
SHA1 300bd2c60c669d978305195f11eaf26c73d9e457
SHA512 011941b215532355e8e4d21af78180da68d2fe04927118ebe818ec14ec4bfb6a7a2d9aaa01fdfd0cd2c6dc84968b5f642ccf10cc92c29aa0e1d06bcf6f120232
MD5 SHA1 SHA512

Submit Download

nvjnICk.exe

Path C:\Windows\System\nvjnICk.exe
Size 1.5MB
SHA256 d59b07bcf760e8bf5e1e9cd97d4e3e55d066dfbc571598e530a3f0d7f4ebf9ce
MD5 9d66b4902500c3e311b0e5942b8e661e
SHA1 0fe60d85ce74f6eea29977e594ceab17f8aff4bc
SHA512 8378357f37330ecddb3c0cd44b00e84ae53412d96464b8e5945a8801cd1931b966b849279a9754ebdd3dfa6360d9e54fe24fe046062063c19487addbc5c52a41
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjMI:Lz071uv4BPMki8Cnki2WGcNLK
MD5 SHA1 SHA512 SSDEEP

Submit Download

oUhRYkl.exe

Path C:\Windows\System\oUhRYkl.exe
Size 1.5MB
SHA256 74ea95121f8521591ea2014310922ae04554e15534c9e2def14083f225cadefd
MD5 e9317fc36480241a1f47255c4822cd3a
SHA1 b9000006603f867287b9d0e35e63bc9098477273
SHA512 13332253a18cbb5a87bc60a037c0cf1734288cb5be3011f78f8428157cdfe304fe80ab239e714664b8dad1fdc54a42b6d220a9bbbc9823c99c0517ab0a61296d
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjMG:Lz071uv4BPMki8Cnki2WGcNL4
MD5 SHA1 SHA512 SSDEEP

Submit Download

qqjaXXt.exe

Path C:\Windows\System\qqjaXXt.exe
Size 1.5MB
SHA256 d71eb436de30e186378c27a10e967274ddcc707d582efad6059771a1e62dff99
MD5 2dfc5deec1bec86dbed8ca3d8687ed2a
SHA1 d13e6a32222a911d6071b5ec2bfc0eacc00c71f2
SHA512 1ee1bbef54d6b1912fa9841aac65962233af873abf34539c90d5e07c3b4965cd88c2cc3a2f449565195d370c54794bd72f73818e74b39049b57dab753835fae6
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjMp:Lz071uv4BPMki8Cnki2WGcNLX
MD5 SHA1 SHA512 SSDEEP

Submit Download

qyVFcUC.exe

Path C:\Windows\System\qyVFcUC.exe
Size 1.5MB
SHA256 5a357ea01ef441133f4b8ef5c89b6686effd6c6e8bde8839cecfba8945c80692
MD5 371a2418d3f51675141b965a51d46803
SHA1 8d5997a3970f0b93ac15adc3e1ad517b3a9be759
SHA512 fb287792b71f962382e044e723193e6f5f7c654b5b0e3f5ddfd27ec2cc3a49c29037d9b94e1572ff6a7a7f941eb08e7f44f0e2cffe7d9f1c7f2449e614034923
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjML:Lz071uv4BPMki8Cnki2WGcNLF
MD5 SHA1 SHA512 SSDEEP

Submit Download

rOwANiZ.exe

Path C:\Windows\System\rOwANiZ.exe
Size 1.5MB
SHA256 b2d1704b99dc9c8161fc0af65cb12e0cd831dc0f5a012b7bcf77e60749b5a0b4
MD5 df30a98fa23c50afe71df75be7deec86
SHA1 c47ae519aa45f4ea5cc98b112d8505f4017c7479
SHA512 a914c78df4dd50538af989bc7f995281af342f270c4bb2bbae380ce2e35b85861e6024376cb42c99d3e53749d46ac347d1a17194d79e3691115fc276d011d843
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjMW:Lz071uv4BPMki8Cnki2WGcNLo
MD5 SHA1 SHA512 SSDEEP

Submit Download

urJZSsv.exe

Path C:\Windows\System\urJZSsv.exe
Size 1.5MB
SHA256 c4f235d9da079a15636a49f72829c2790387072c4c34f97eb2fc0ae4ca04fa8a
MD5 de7bc81260007eddb4de44300b7e6178
SHA1 7294840e2d6d3c7db65e932804d8994be22a642a
SHA512 b95035ef5fbe10010c5c62df19832ce86de3c1dc9c67d433621a448ee5a408028bce539968ea8613397c071b7bc4fdef5b703b1eefa411f2fc1e0dbe6ce8380c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjMS:Lz071uv4BPMki8Cnki2WGcNLE
MD5 SHA1 SHA512 SSDEEP

Submit Download

wUOnoJg.exe

Path C:\Windows\System\wUOnoJg.exe
Size 1.5MB
SHA256 cc1cd9831b684abfd9c954b34f5b5924b9c591aea47a859478959d14c6056dfb
MD5 ebeb6448933b748b0d0d4056204efed5
SHA1 47b3a3501810577186fc80007082024fab803925
SHA512 771a52965bbda1a37a58d78795421bf73a2f471faf0f5ebfbc61f56d5308b2e76fff609bb8ee4641cd229418c971ea4a0968ccc559efc3f2c6c4f05748759d88
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjMC:Lz071uv4BPMki8Cnki2WGcNL4
MD5 SHA1 SHA512 SSDEEP

Submit Download

xrMFqCG.exe

Path C:\Windows\System\xrMFqCG.exe
Size 1.5MB
SHA256 e0a3a924c7ee632436a5c098770434c592af0c6ad4620c820ba795394d4f6a74
MD5 5bdea5de20f4c6808b3e98d1530a20d9
SHA1 6b294335aaa9c222f9479828b1e8bc8e48d7fc10
SHA512 288fe5b35734c63bbf5d2b2d07886315a2064bbb675e11871e068d064c78c61e071131936de5f2a15cde49a2b2fbffaf19ae4abd1e326ab93ad89a6328a2e515
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjMf:Lz071uv4BPMki8Cnki2WGcNL1
MD5 SHA1 SHA512 SSDEEP

Submit Download

zpJnDnx.exe

Path C:\Windows\System\zpJnDnx.exe
Size 1.5MB
SHA256 ec7257ab55b7dbd343f046cf1c67e92aa994a496280833c1479556f8e6e197bd
MD5 e8dc6f8f8cd3815d27b733cf6341b0e8
SHA1 4c3986ab1e885b48623757a362569953cdbc51f2
SHA512 b5e1f0bcdfccc428f234c54c653e9799c3c1fa379a6c2093438d16125ed68c2dc2aaf2e7be843b34c5a55d2eea6fc8ef03b7488f294778b89090a3140d23f18a
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCUjM6:Lz071uv4BPMki8Cnki2WGcNLc
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/436-233-0x00007FF689220000-0x00007FF689612000-memory.dmp

Download

memory/436-3008-0x00007FF689220000-0x00007FF689612000-memory.dmp

Download

memory/744-3127-0x00007FF6EB2F0000-0x00007FF6EB6E2000-memory.dmp

Download

memory/744-3115-0x00007FF6EB2F0000-0x00007FF6EB6E2000-memory.dmp

Download

memory/744-242-0x00007FF6EB2F0000-0x00007FF6EB6E2000-memory.dmp

Download

memory/1104-2979-0x00007FF6C7610000-0x00007FF6C7A02000-memory.dmp

Download

memory/1104-227-0x00007FF6C7610000-0x00007FF6C7A02000-memory.dmp

Download

memory/1140-234-0x00007FF6062B0000-0x00007FF6066A2000-memory.dmp

Download

memory/1140-2985-0x00007FF6062B0000-0x00007FF6066A2000-memory.dmp

Download

memory/1148-3148-0x00007FF7C2550000-0x00007FF7C2942000-memory.dmp

Download

memory/1148-241-0x00007FF7C2550000-0x00007FF7C2942000-memory.dmp

Download

memory/1148-3113-0x00007FF7C2550000-0x00007FF7C2942000-memory.dmp

Download

memory/1172-2975-0x00007FF72E7E0000-0x00007FF72EBD2000-memory.dmp

Download

memory/1172-160-0x00007FF72E7E0000-0x00007FF72EBD2000-memory.dmp

Download

memory/1332-2991-0x00007FF68F8C0000-0x00007FF68FCB2000-memory.dmp

Download

memory/1332-247-0x00007FF68F8C0000-0x00007FF68FCB2000-memory.dmp

Download

memory/1424-2981-0x00007FF7AC170000-0x00007FF7AC562000-memory.dmp

Download

memory/1424-194-0x00007FF7AC170000-0x00007FF7AC562000-memory.dmp

Download

memory/1676-3012-0x00007FF74A540000-0x00007FF74A932000-memory.dmp

Download

memory/1676-237-0x00007FF74A540000-0x00007FF74A932000-memory.dmp

Download

memory/1964-3002-0x00007FF63EB10000-0x00007FF63EF02000-memory.dmp

Download

memory/1964-244-0x00007FF63EB10000-0x00007FF63EF02000-memory.dmp

Download

memory/1972-238-0x00007FF6A4510000-0x00007FF6A4902000-memory.dmp

Download

memory/1972-3118-0x00007FF6A4510000-0x00007FF6A4902000-memory.dmp

Download

memory/1972-3111-0x00007FF6A4510000-0x00007FF6A4902000-memory.dmp

Download

memory/2072-2997-0x00007FF6211D0000-0x00007FF6215C2000-memory.dmp

Download

memory/2072-239-0x00007FF6211D0000-0x00007FF6215C2000-memory.dmp

Download

memory/2268-16-0x00007FF642560000-0x00007FF642952000-memory.dmp

Download

memory/2268-2973-0x00007FF642560000-0x00007FF642952000-memory.dmp

Download

memory/2560-230-0x00007FF712D10000-0x00007FF713102000-memory.dmp

Download

memory/2560-2995-0x00007FF712D10000-0x00007FF713102000-memory.dmp

Download

memory/2784-2933-0x00007FF84DBE0000-0x00007FF84E6A1000-memory.dmp

Download

memory/2784-17-0x00007FF84DBE3000-0x00007FF84DBE5000-memory.dmp

Download

memory/2784-260-0x000001ADD0F90000-0x000001ADD0FB2000-memory.dmp

Download

memory/2784-53-0x00007FF84DBE0000-0x00007FF84E6A1000-memory.dmp

Download

memory/2784-116-0x00007FF84DBE0000-0x00007FF84E6A1000-memory.dmp

Download

memory/3008-232-0x00007FF6414A0000-0x00007FF641892000-memory.dmp

Download

memory/3008-3006-0x00007FF6414A0000-0x00007FF641892000-memory.dmp

Download

memory/3076-1-0x000001848F060000-0x000001848F070000-memory.dmp

Download

memory/3076-0-0x00007FF70C490000-0x00007FF70C882000-memory.dmp

Download

memory/3112-228-0x00007FF684770000-0x00007FF684B62000-memory.dmp

Download

memory/3112-2987-0x00007FF684770000-0x00007FF684B62000-memory.dmp

Download

memory/3124-245-0x00007FF6C5C60000-0x00007FF6C6052000-memory.dmp

Download

memory/3124-2977-0x00007FF6C5C60000-0x00007FF6C6052000-memory.dmp

Download

memory/3184-240-0x00007FF611E40000-0x00007FF612232000-memory.dmp

Download

memory/3184-3112-0x00007FF611E40000-0x00007FF612232000-memory.dmp

Download

memory/3184-3132-0x00007FF611E40000-0x00007FF612232000-memory.dmp

Download

memory/4040-2983-0x00007FF774AB0000-0x00007FF774EA2000-memory.dmp

Download

memory/4040-246-0x00007FF774AB0000-0x00007FF774EA2000-memory.dmp

Download

memory/4048-2999-0x00007FF71A360000-0x00007FF71A752000-memory.dmp

Download

memory/4048-243-0x00007FF71A360000-0x00007FF71A752000-memory.dmp

Download

memory/4092-231-0x00007FF727F40000-0x00007FF728332000-memory.dmp

Download

memory/4092-3010-0x00007FF727F40000-0x00007FF728332000-memory.dmp

Download

memory/4520-236-0x00007FF74FF00000-0x00007FF7502F2000-memory.dmp

Download

memory/4520-3016-0x00007FF74FF00000-0x00007FF7502F2000-memory.dmp

Download

memory/4568-235-0x00007FF688D70000-0x00007FF689162000-memory.dmp

Download

memory/4568-2989-0x00007FF688D70000-0x00007FF689162000-memory.dmp

Download

memory/5100-229-0x00007FF647A20000-0x00007FF647E12000-memory.dmp

Download

memory/5100-2993-0x00007FF647A20000-0x00007FF647E12000-memory.dmp

Download