xmrig | 8565193f61cfdf43a83df72fcacd13741be58705bd3aa23874ebcfacf9808572

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 09:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
Size 2.8MB
Sample240527-lt91ssff2t
SHA256 8565193f61cfdf43a83df72fcacd13741be58705bd3aa23874ebcfacf9808572
MD5 d06f840f13a7c48a68102f3f3439df20
SHA1 0e558982a7fbfb0ade3941678c18154fb15c85ff
SHA512 8b7bee2a9d0b543fbd05f79016db2e420c39d4813d0f324c80d13c7c71dcd08b00de3d0a65d394ab27670ab288c88a425f8fc277c65a8173cb7000370ae43bc2
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBJ:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4244-0-0x00007FF7DA760000-0x00007FF7DAB56000-memory.dmp	xmrig
behavioral2/files/0x000700000002328e-6.dat	xmrig
behavioral2/files/0x000700000002342c-8.dat	xmrig
behavioral2/memory/5080-24-0x00007FF7D8280000-0x00007FF7D8676000-memory.dmp	xmrig
behavioral2/files/0x000700000002342e-25.dat	xmrig
behavioral2/files/0x0007000000023430-38.dat	xmrig
behavioral2/files/0x0007000000023431-60.dat	xmrig
behavioral2/files/0x0008000000023434-67.dat	xmrig
behavioral2/files/0x0009000000023425-72.dat	xmrig
behavioral2/files/0x0007000000023436-89.dat	xmrig
behavioral2/files/0x0007000000023437-102.dat	xmrig
behavioral2/files/0x000700000002343c-131.dat	xmrig
behavioral2/files/0x0007000000023444-171.dat	xmrig
behavioral2/files/0x0007000000023447-185.dat	xmrig
behavioral2/memory/3280-957-0x00007FF77C6B0000-0x00007FF77CAA6000-memory.dmp	xmrig
behavioral2/memory/2900-967-0x00007FF7B11C0000-0x00007FF7B15B6000-memory.dmp	xmrig
behavioral2/memory/316-956-0x00007FF6DE040000-0x00007FF6DE436000-memory.dmp	xmrig
behavioral2/memory/2680-978-0x00007FF642C30000-0x00007FF643026000-memory.dmp	xmrig
behavioral2/memory/1448-975-0x00007FF7E9F90000-0x00007FF7EA386000-memory.dmp	xmrig
behavioral2/memory/2792-984-0x00007FF6142E0000-0x00007FF6146D6000-memory.dmp	xmrig
behavioral2/memory/1160-989-0x00007FF709140000-0x00007FF709536000-memory.dmp	xmrig
behavioral2/memory/3752-986-0x00007FF6F62D0000-0x00007FF6F66C6000-memory.dmp	xmrig
behavioral2/memory/5084-983-0x00007FF619F30000-0x00007FF61A326000-memory.dmp	xmrig
behavioral2/memory/2968-973-0x00007FF79D690000-0x00007FF79DA86000-memory.dmp	xmrig
behavioral2/files/0x0007000000023449-190.dat	xmrig
behavioral2/files/0x0007000000023448-187.dat	xmrig
behavioral2/files/0x0007000000023446-181.dat	xmrig
behavioral2/files/0x0007000000023445-175.dat	xmrig
behavioral2/files/0x0007000000023443-165.dat	xmrig
behavioral2/files/0x0007000000023442-161.dat	xmrig
behavioral2/files/0x0007000000023441-155.dat	xmrig
behavioral2/files/0x0007000000023440-151.dat	xmrig
behavioral2/files/0x000700000002343f-145.dat	xmrig
behavioral2/files/0x000700000002343e-141.dat	xmrig
behavioral2/files/0x000700000002343d-136.dat	xmrig
behavioral2/files/0x000700000002343b-125.dat	xmrig
behavioral2/files/0x000700000002343a-121.dat	xmrig
behavioral2/files/0x0007000000023439-116.dat	xmrig
behavioral2/files/0x0007000000023438-110.dat	xmrig
behavioral2/memory/3568-101-0x00007FF744FA0000-0x00007FF745396000-memory.dmp	xmrig
behavioral2/memory/3920-98-0x00007FF66D8A0000-0x00007FF66DC96000-memory.dmp	xmrig
behavioral2/memory/3624-95-0x00007FF7C27E0000-0x00007FF7C2BD6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023435-93.dat	xmrig
behavioral2/memory/3196-92-0x00007FF639880000-0x00007FF639C76000-memory.dmp	xmrig
behavioral2/files/0x0008000000023433-90.dat	xmrig
behavioral2/memory/1892-88-0x00007FF60F300000-0x00007FF60F6F6000-memory.dmp	xmrig
behavioral2/memory/3656-84-0x00007FF6F0C90000-0x00007FF6F1086000-memory.dmp	xmrig
behavioral2/memory/1164-73-0x00007FF6EF150000-0x00007FF6EF546000-memory.dmp	xmrig
behavioral2/files/0x0007000000023432-71.dat	xmrig
behavioral2/memory/5000-70-0x00007FF6E5D90000-0x00007FF6E6186000-memory.dmp	xmrig
behavioral2/memory/2132-66-0x00007FF798C10000-0x00007FF799006000-memory.dmp	xmrig
behavioral2/files/0x000700000002342f-53.dat	xmrig
behavioral2/memory/3712-48-0x00007FF7DA0A0000-0x00007FF7DA496000-memory.dmp	xmrig
behavioral2/memory/4652-39-0x00007FF702B20000-0x00007FF702F16000-memory.dmp	xmrig
behavioral2/memory/876-31-0x00007FF680340000-0x00007FF680736000-memory.dmp	xmrig
behavioral2/files/0x000700000002342d-29.dat	xmrig
behavioral2/memory/4816-27-0x00007FF7A2680000-0x00007FF7A2A76000-memory.dmp	xmrig
behavioral2/files/0x000900000002341d-14.dat	xmrig
behavioral2/memory/4652-2185-0x00007FF702B20000-0x00007FF702F16000-memory.dmp	xmrig
behavioral2/memory/3712-2186-0x00007FF7DA0A0000-0x00007FF7DA496000-memory.dmp	xmrig
behavioral2/memory/3656-2187-0x00007FF6F0C90000-0x00007FF6F1086000-memory.dmp	xmrig
behavioral2/memory/4816-2188-0x00007FF7A2680000-0x00007FF7A2A76000-memory.dmp	xmrig
behavioral2/memory/5080-2189-0x00007FF7D8280000-0x00007FF7D8676000-memory.dmp	xmrig
behavioral2/memory/4652-2192-0x00007FF702B20000-0x00007FF702F16000-memory.dmp	xmrig

Blocklisted process makes network request 7 IoCs

flow	pid	Process
8	4068	powershell.exe
10	4068	powershell.exe
15	4068	powershell.exe
16	4068	powershell.exe
18	4068	powershell.exe
20	4068	powershell.exe
21	4068	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4068	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
5080	XkJIiPG.exe
4816	BGdMoKD.exe
876	IkFrGUz.exe
4652	gMeNKHU.exe
2132	GQoSNwp.exe
5000	OivaOSJ.exe
3712	KGKpizZ.exe
1164	EhITsVr.exe
3656	hakXHSN.exe
1892	tGtSGzn.exe
3196	mrBZNsQ.exe
3624	kDoPyBl.exe
3920	naNdIKU.exe
3568	wnPiQHC.exe
316	aYxJfLz.exe
3280	zAzupHC.exe
2900	ZQzDGSZ.exe
2968	NmLIQYO.exe
1448	qXeXwjh.exe
2680	ZvNtBac.exe
5084	XKBDRsW.exe
2792	xihUQMK.exe
3752	QgYcefa.exe
1160	JDSQYUL.exe
2620	XzMIeSD.exe
1420	RvacDSo.exe
3168	NJnSgNB.exe
3836	gJnfOwK.exe
3620	uSguBio.exe
4144	ibaOdYr.exe
1280	pjIXZzK.exe
2444	KausrPN.exe
3776	dMqMkmj.exe
2116	VzbXNZo.exe
220	HtJACUH.exe
1328	GFlqvFa.exe
3144	bQJkEfT.exe
4536	BhVehJD.exe
4480	EJdRgqI.exe
1208	AyDLDNA.exe
4772	zNfROzu.exe
8	GxYuigA.exe
4032	kVpYjto.exe
744	lopPWsz.exe
2272	iXSCXaV.exe
4324	PzLFfuA.exe
3572	pYkwnuU.exe
3128	czbugQE.exe
2224	eLspzCW.exe
4396	tvlnibW.exe
3556	BFLdagC.exe
4860	XpdwyFL.exe
4108	XrmPAsu.exe
2588	jIshjPA.exe
1452	UwdrklO.exe
1924	NJkcxoT.exe
4524	OmHXfDy.exe
4556	QCvAHrP.exe
4424	dXCteST.exe
3064	KdkEdbr.exe
3940	xztyhbo.exe
2408	NcoYpVt.exe
3740	YiYHdOI.exe
3492	nfmderu.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4244-0-0x00007FF7DA760000-0x00007FF7DAB56000-memory.dmp	upx
behavioral2/files/0x000700000002328e-6.dat	upx
behavioral2/files/0x000700000002342c-8.dat	upx
behavioral2/memory/5080-24-0x00007FF7D8280000-0x00007FF7D8676000-memory.dmp	upx
behavioral2/files/0x000700000002342e-25.dat	upx
behavioral2/files/0x0007000000023430-38.dat	upx
behavioral2/files/0x0007000000023431-60.dat	upx
behavioral2/files/0x0008000000023434-67.dat	upx
behavioral2/files/0x0009000000023425-72.dat	upx
behavioral2/files/0x0007000000023436-89.dat	upx
behavioral2/files/0x0007000000023437-102.dat	upx
behavioral2/files/0x000700000002343c-131.dat	upx
behavioral2/files/0x0007000000023444-171.dat	upx
behavioral2/files/0x0007000000023447-185.dat	upx
behavioral2/memory/3280-957-0x00007FF77C6B0000-0x00007FF77CAA6000-memory.dmp	upx
behavioral2/memory/2900-967-0x00007FF7B11C0000-0x00007FF7B15B6000-memory.dmp	upx
behavioral2/memory/316-956-0x00007FF6DE040000-0x00007FF6DE436000-memory.dmp	upx
behavioral2/memory/2680-978-0x00007FF642C30000-0x00007FF643026000-memory.dmp	upx
behavioral2/memory/1448-975-0x00007FF7E9F90000-0x00007FF7EA386000-memory.dmp	upx
behavioral2/memory/2792-984-0x00007FF6142E0000-0x00007FF6146D6000-memory.dmp	upx
behavioral2/memory/1160-989-0x00007FF709140000-0x00007FF709536000-memory.dmp	upx
behavioral2/memory/3752-986-0x00007FF6F62D0000-0x00007FF6F66C6000-memory.dmp	upx
behavioral2/memory/5084-983-0x00007FF619F30000-0x00007FF61A326000-memory.dmp	upx
behavioral2/memory/2968-973-0x00007FF79D690000-0x00007FF79DA86000-memory.dmp	upx
behavioral2/files/0x0007000000023449-190.dat	upx
behavioral2/files/0x0007000000023448-187.dat	upx
behavioral2/files/0x0007000000023446-181.dat	upx
behavioral2/files/0x0007000000023445-175.dat	upx
behavioral2/files/0x0007000000023443-165.dat	upx
behavioral2/files/0x0007000000023442-161.dat	upx
behavioral2/files/0x0007000000023441-155.dat	upx
behavioral2/files/0x0007000000023440-151.dat	upx
behavioral2/files/0x000700000002343f-145.dat	upx
behavioral2/files/0x000700000002343e-141.dat	upx
behavioral2/files/0x000700000002343d-136.dat	upx
behavioral2/files/0x000700000002343b-125.dat	upx
behavioral2/files/0x000700000002343a-121.dat	upx
behavioral2/files/0x0007000000023439-116.dat	upx
behavioral2/files/0x0007000000023438-110.dat	upx
behavioral2/memory/3568-101-0x00007FF744FA0000-0x00007FF745396000-memory.dmp	upx
behavioral2/memory/3920-98-0x00007FF66D8A0000-0x00007FF66DC96000-memory.dmp	upx
behavioral2/memory/3624-95-0x00007FF7C27E0000-0x00007FF7C2BD6000-memory.dmp	upx
behavioral2/files/0x0007000000023435-93.dat	upx
behavioral2/memory/3196-92-0x00007FF639880000-0x00007FF639C76000-memory.dmp	upx
behavioral2/files/0x0008000000023433-90.dat	upx
behavioral2/memory/1892-88-0x00007FF60F300000-0x00007FF60F6F6000-memory.dmp	upx
behavioral2/memory/3656-84-0x00007FF6F0C90000-0x00007FF6F1086000-memory.dmp	upx
behavioral2/memory/1164-73-0x00007FF6EF150000-0x00007FF6EF546000-memory.dmp	upx
behavioral2/files/0x0007000000023432-71.dat	upx
behavioral2/memory/5000-70-0x00007FF6E5D90000-0x00007FF6E6186000-memory.dmp	upx
behavioral2/memory/2132-66-0x00007FF798C10000-0x00007FF799006000-memory.dmp	upx
behavioral2/files/0x000700000002342f-53.dat	upx
behavioral2/memory/3712-48-0x00007FF7DA0A0000-0x00007FF7DA496000-memory.dmp	upx
behavioral2/memory/4652-39-0x00007FF702B20000-0x00007FF702F16000-memory.dmp	upx
behavioral2/memory/876-31-0x00007FF680340000-0x00007FF680736000-memory.dmp	upx
behavioral2/files/0x000700000002342d-29.dat	upx
behavioral2/memory/4816-27-0x00007FF7A2680000-0x00007FF7A2A76000-memory.dmp	upx
behavioral2/files/0x000900000002341d-14.dat	upx
behavioral2/memory/4652-2185-0x00007FF702B20000-0x00007FF702F16000-memory.dmp	upx
behavioral2/memory/3712-2186-0x00007FF7DA0A0000-0x00007FF7DA496000-memory.dmp	upx
behavioral2/memory/3656-2187-0x00007FF6F0C90000-0x00007FF6F1086000-memory.dmp	upx
behavioral2/memory/4816-2188-0x00007FF7A2680000-0x00007FF7A2A76000-memory.dmp	upx
behavioral2/memory/5080-2189-0x00007FF7D8280000-0x00007FF7D8676000-memory.dmp	upx
behavioral2/memory/4652-2192-0x00007FF702B20000-0x00007FF702F16000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\QXPLoSD.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\QckasEx.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\dtWjVlI.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\sMQMHfl.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\MFpYZMv.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\GUKuLas.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\GNdwFWl.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\GtEXazu.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\vUEtdVe.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\RzrGutu.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\CURPfOe.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\uLgbDsk.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\OhFHnEt.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\aAwgSqb.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\YsFQNCu.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\nPhQgbp.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\tZfinEU.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\ZGhxOwu.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\tGtSGzn.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\zvossPe.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\AiPBLPb.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\MzcTIPb.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\owGSPhE.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\KwmJEBd.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\oclrmgr.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\aPujCmU.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\BxvZLGL.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\vhYsQiB.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\YZvsiCG.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\tJmhVMV.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\ZUQhgxI.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\WtdWkjs.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\YvIRRqO.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\nGbtMES.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\UQgUWYw.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\gCUAaoG.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\WSINZRC.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\ByUlANO.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\DhsCItu.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\EaUMXCC.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\HKJdKtM.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\WBpXmxr.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\RwCCwQx.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\GghPgJu.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\guvIZAg.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\gLOnYyv.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\dweNDym.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\FdgExIv.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\FxiUZUv.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\KbnaoET.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\QOSDKoC.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\UxPbSXw.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\beWXzLu.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\wsoLrnB.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\bbxsRIh.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\vIIrXLu.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\FtuLIhH.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\QjxUpGw.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\SxhNcQK.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\wusbeQP.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\OZMSpWA.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\sgtYrfb.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\ixccMqB.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
File created	C:\Windows\System\DCfDRQT.exe	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4068	powershell.exe
4068	powershell.exe
4068	powershell.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
Token: SeDebugPrivilege	4068	powershell.exe
Token: SeCreateGlobalPrivilege	13108	dwm.exe
Token: SeChangeNotifyPrivilege	13108	dwm.exe
Token: 33	13108	dwm.exe
Token: SeIncBasePriorityPrivilege	13108	dwm.exe
Token: SeShutdownPrivilege	13108	dwm.exe
Token: SeCreatePagefilePrivilege	13108	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 4068	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	84
PID 4244 wrote to memory of 4068	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	84
PID 4244 wrote to memory of 5080	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	85
PID 4244 wrote to memory of 5080	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	85
PID 4244 wrote to memory of 4816	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	86
PID 4244 wrote to memory of 4816	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	86
PID 4244 wrote to memory of 876	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	87
PID 4244 wrote to memory of 876	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	87
PID 4244 wrote to memory of 4652	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	88
PID 4244 wrote to memory of 4652	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	88
PID 4244 wrote to memory of 2132	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	89
PID 4244 wrote to memory of 2132	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	89
PID 4244 wrote to memory of 5000	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	90
PID 4244 wrote to memory of 5000	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	90
PID 4244 wrote to memory of 3712	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	91
PID 4244 wrote to memory of 3712	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	91
PID 4244 wrote to memory of 1164	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	92
PID 4244 wrote to memory of 1164	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	92
PID 4244 wrote to memory of 3656	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	93
PID 4244 wrote to memory of 3656	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	93
PID 4244 wrote to memory of 1892	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	94
PID 4244 wrote to memory of 1892	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	94
PID 4244 wrote to memory of 3196	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	95
PID 4244 wrote to memory of 3196	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	95
PID 4244 wrote to memory of 3624	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	96
PID 4244 wrote to memory of 3624	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	96
PID 4244 wrote to memory of 3920	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	97
PID 4244 wrote to memory of 3920	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	97
PID 4244 wrote to memory of 3568	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	98
PID 4244 wrote to memory of 3568	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	98
PID 4244 wrote to memory of 316	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	99
PID 4244 wrote to memory of 316	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	99
PID 4244 wrote to memory of 3280	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	100
PID 4244 wrote to memory of 3280	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	100
PID 4244 wrote to memory of 2900	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	101
PID 4244 wrote to memory of 2900	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	101
PID 4244 wrote to memory of 2968	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	102
PID 4244 wrote to memory of 2968	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	102
PID 4244 wrote to memory of 1448	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	103
PID 4244 wrote to memory of 1448	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	103
PID 4244 wrote to memory of 2680	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	104
PID 4244 wrote to memory of 2680	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	104
PID 4244 wrote to memory of 5084	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	105
PID 4244 wrote to memory of 5084	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	105
PID 4244 wrote to memory of 2792	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	106
PID 4244 wrote to memory of 2792	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	106
PID 4244 wrote to memory of 3752	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	107
PID 4244 wrote to memory of 3752	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	107
PID 4244 wrote to memory of 1160	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	108
PID 4244 wrote to memory of 1160	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	108
PID 4244 wrote to memory of 2620	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	109
PID 4244 wrote to memory of 2620	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	109
PID 4244 wrote to memory of 1420	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	110
PID 4244 wrote to memory of 1420	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	110
PID 4244 wrote to memory of 3168	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	111
PID 4244 wrote to memory of 3168	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	111
PID 4244 wrote to memory of 3836	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	112
PID 4244 wrote to memory of 3836	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	112
PID 4244 wrote to memory of 3620	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	113
PID 4244 wrote to memory of 3620	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	113
PID 4244 wrote to memory of 4144	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	114
PID 4244 wrote to memory of 4144	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	114
PID 4244 wrote to memory of 1280	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	115
PID 4244 wrote to memory of 1280	4244	d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\d06f840f13a7c48a68102f3f3439df20_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4068
- C:\Windows\System\XkJIiPG.exe
  C:\Windows\System\XkJIiPG.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\BGdMoKD.exe
  C:\Windows\System\BGdMoKD.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\IkFrGUz.exe
  C:\Windows\System\IkFrGUz.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\gMeNKHU.exe
  C:\Windows\System\gMeNKHU.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\GQoSNwp.exe
  C:\Windows\System\GQoSNwp.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\OivaOSJ.exe
  C:\Windows\System\OivaOSJ.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\KGKpizZ.exe
  C:\Windows\System\KGKpizZ.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\EhITsVr.exe
  C:\Windows\System\EhITsVr.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\hakXHSN.exe
  C:\Windows\System\hakXHSN.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\tGtSGzn.exe
  C:\Windows\System\tGtSGzn.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\mrBZNsQ.exe
  C:\Windows\System\mrBZNsQ.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\kDoPyBl.exe
  C:\Windows\System\kDoPyBl.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\naNdIKU.exe
  C:\Windows\System\naNdIKU.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\wnPiQHC.exe
  C:\Windows\System\wnPiQHC.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\aYxJfLz.exe
  C:\Windows\System\aYxJfLz.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\zAzupHC.exe
  C:\Windows\System\zAzupHC.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\ZQzDGSZ.exe
  C:\Windows\System\ZQzDGSZ.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\NmLIQYO.exe
  C:\Windows\System\NmLIQYO.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\qXeXwjh.exe
  C:\Windows\System\qXeXwjh.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\ZvNtBac.exe
  C:\Windows\System\ZvNtBac.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\XKBDRsW.exe
  C:\Windows\System\XKBDRsW.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\xihUQMK.exe
  C:\Windows\System\xihUQMK.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\QgYcefa.exe
  C:\Windows\System\QgYcefa.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\JDSQYUL.exe
  C:\Windows\System\JDSQYUL.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\XzMIeSD.exe
  C:\Windows\System\XzMIeSD.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\RvacDSo.exe
  C:\Windows\System\RvacDSo.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\NJnSgNB.exe
  C:\Windows\System\NJnSgNB.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\gJnfOwK.exe
  C:\Windows\System\gJnfOwK.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\uSguBio.exe
  C:\Windows\System\uSguBio.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\ibaOdYr.exe
  C:\Windows\System\ibaOdYr.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\pjIXZzK.exe
  C:\Windows\System\pjIXZzK.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\KausrPN.exe
  C:\Windows\System\KausrPN.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\dMqMkmj.exe
  C:\Windows\System\dMqMkmj.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\VzbXNZo.exe
  C:\Windows\System\VzbXNZo.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\HtJACUH.exe
  C:\Windows\System\HtJACUH.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\GFlqvFa.exe
  C:\Windows\System\GFlqvFa.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\bQJkEfT.exe
  C:\Windows\System\bQJkEfT.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\BhVehJD.exe
  C:\Windows\System\BhVehJD.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\EJdRgqI.exe
  C:\Windows\System\EJdRgqI.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\AyDLDNA.exe
  C:\Windows\System\AyDLDNA.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\zNfROzu.exe
  C:\Windows\System\zNfROzu.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\GxYuigA.exe
  C:\Windows\System\GxYuigA.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\kVpYjto.exe
  C:\Windows\System\kVpYjto.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\lopPWsz.exe
  C:\Windows\System\lopPWsz.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\iXSCXaV.exe
  C:\Windows\System\iXSCXaV.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\PzLFfuA.exe
  C:\Windows\System\PzLFfuA.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\pYkwnuU.exe
  C:\Windows\System\pYkwnuU.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\czbugQE.exe
  C:\Windows\System\czbugQE.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\eLspzCW.exe
  C:\Windows\System\eLspzCW.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\tvlnibW.exe
  C:\Windows\System\tvlnibW.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\BFLdagC.exe
  C:\Windows\System\BFLdagC.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\XpdwyFL.exe
  C:\Windows\System\XpdwyFL.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\XrmPAsu.exe
  C:\Windows\System\XrmPAsu.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\jIshjPA.exe
  C:\Windows\System\jIshjPA.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\UwdrklO.exe
  C:\Windows\System\UwdrklO.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\NJkcxoT.exe
  C:\Windows\System\NJkcxoT.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\OmHXfDy.exe
  C:\Windows\System\OmHXfDy.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\QCvAHrP.exe
  C:\Windows\System\QCvAHrP.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\dXCteST.exe
  C:\Windows\System\dXCteST.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\KdkEdbr.exe
  C:\Windows\System\KdkEdbr.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\xztyhbo.exe
  C:\Windows\System\xztyhbo.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\NcoYpVt.exe
  C:\Windows\System\NcoYpVt.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\YiYHdOI.exe
  C:\Windows\System\YiYHdOI.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\nfmderu.exe
  C:\Windows\System\nfmderu.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\FMigfrJ.exe
  C:\Windows\System\FMigfrJ.exe
  2⤵
  PID:5148
- C:\Windows\System\OdLnhlB.exe
  C:\Windows\System\OdLnhlB.exe
  2⤵
  PID:5172
- C:\Windows\System\qrySNti.exe
  C:\Windows\System\qrySNti.exe
  2⤵
  PID:5200
- C:\Windows\System\OgueIAg.exe
  C:\Windows\System\OgueIAg.exe
  2⤵
  PID:5228
- C:\Windows\System\zrruFZH.exe
  C:\Windows\System\zrruFZH.exe
  2⤵
  PID:5264
- C:\Windows\System\vIWiJWz.exe
  C:\Windows\System\vIWiJWz.exe
  2⤵
  PID:5292
- C:\Windows\System\naSfJyc.exe
  C:\Windows\System\naSfJyc.exe
  2⤵
  PID:5320
- C:\Windows\System\LzBCgQS.exe
  C:\Windows\System\LzBCgQS.exe
  2⤵
  PID:5348
- C:\Windows\System\NRmOTCF.exe
  C:\Windows\System\NRmOTCF.exe
  2⤵
  PID:5376
- C:\Windows\System\YlsrOnp.exe
  C:\Windows\System\YlsrOnp.exe
  2⤵
  PID:5404
- C:\Windows\System\xHqXjOi.exe
  C:\Windows\System\xHqXjOi.exe
  2⤵
  PID:5432
- C:\Windows\System\LcBxaXO.exe
  C:\Windows\System\LcBxaXO.exe
  2⤵
  PID:5460
- C:\Windows\System\ytArKAB.exe
  C:\Windows\System\ytArKAB.exe
  2⤵
  PID:5488
- C:\Windows\System\iLDIMfY.exe
  C:\Windows\System\iLDIMfY.exe
  2⤵
  PID:5516
- C:\Windows\System\OqVwqMk.exe
  C:\Windows\System\OqVwqMk.exe
  2⤵
  PID:5540
- C:\Windows\System\TtyyXBz.exe
  C:\Windows\System\TtyyXBz.exe
  2⤵
  PID:5572
- C:\Windows\System\vBHwMlD.exe
  C:\Windows\System\vBHwMlD.exe
  2⤵
  PID:5600
- C:\Windows\System\cLjNuxZ.exe
  C:\Windows\System\cLjNuxZ.exe
  2⤵
  PID:5624
- C:\Windows\System\IJkNeoj.exe
  C:\Windows\System\IJkNeoj.exe
  2⤵
  PID:5656
- C:\Windows\System\ZanVvLV.exe
  C:\Windows\System\ZanVvLV.exe
  2⤵
  PID:5684
- C:\Windows\System\tGSbMes.exe
  C:\Windows\System\tGSbMes.exe
  2⤵
  PID:5708
- C:\Windows\System\SNEgJaG.exe
  C:\Windows\System\SNEgJaG.exe
  2⤵
  PID:5736
- C:\Windows\System\xSxoQdk.exe
  C:\Windows\System\xSxoQdk.exe
  2⤵
  PID:5764
- C:\Windows\System\bDFhOFX.exe
  C:\Windows\System\bDFhOFX.exe
  2⤵
  PID:5792
- C:\Windows\System\vUEtdVe.exe
  C:\Windows\System\vUEtdVe.exe
  2⤵
  PID:5820
- C:\Windows\System\DVkvxFU.exe
  C:\Windows\System\DVkvxFU.exe
  2⤵
  PID:5852
- C:\Windows\System\gMAqMqO.exe
  C:\Windows\System\gMAqMqO.exe
  2⤵
  PID:5880
- C:\Windows\System\PgdqxFu.exe
  C:\Windows\System\PgdqxFu.exe
  2⤵
  PID:5908
- C:\Windows\System\zfdNjme.exe
  C:\Windows\System\zfdNjme.exe
  2⤵
  PID:5936
- C:\Windows\System\FNPhFGr.exe
  C:\Windows\System\FNPhFGr.exe
  2⤵
  PID:5964
- C:\Windows\System\NGvnyuu.exe
  C:\Windows\System\NGvnyuu.exe
  2⤵
  PID:5992
- C:\Windows\System\jEuRlDC.exe
  C:\Windows\System\jEuRlDC.exe
  2⤵
  PID:6020
- C:\Windows\System\YtZTnds.exe
  C:\Windows\System\YtZTnds.exe
  2⤵
  PID:6048
- C:\Windows\System\IEPTNXm.exe
  C:\Windows\System\IEPTNXm.exe
  2⤵
  PID:6076
- C:\Windows\System\CBEUYvN.exe
  C:\Windows\System\CBEUYvN.exe
  2⤵
  PID:6104
- C:\Windows\System\NeLKCog.exe
  C:\Windows\System\NeLKCog.exe
  2⤵
  PID:6132
- C:\Windows\System\YyFfsUu.exe
  C:\Windows\System\YyFfsUu.exe
  2⤵
  PID:2140
- C:\Windows\System\fPhxKEQ.exe
  C:\Windows\System\fPhxKEQ.exe
  2⤵
  PID:1228
- C:\Windows\System\YsAkCpY.exe
  C:\Windows\System\YsAkCpY.exe
  2⤵
  PID:3704
- C:\Windows\System\qKazXnP.exe
  C:\Windows\System\qKazXnP.exe
  2⤵
  PID:4776
- C:\Windows\System\irlxFvS.exe
  C:\Windows\System\irlxFvS.exe
  2⤵
  PID:848
- C:\Windows\System\ZAbKIcj.exe
  C:\Windows\System\ZAbKIcj.exe
  2⤵
  PID:5132
- C:\Windows\System\LYXUvIM.exe
  C:\Windows\System\LYXUvIM.exe
  2⤵
  PID:5196
- C:\Windows\System\jXGVimR.exe
  C:\Windows\System\jXGVimR.exe
  2⤵
  PID:5276
- C:\Windows\System\aMHRAqp.exe
  C:\Windows\System\aMHRAqp.exe
  2⤵
  PID:5336
- C:\Windows\System\MBKcsZO.exe
  C:\Windows\System\MBKcsZO.exe
  2⤵
  PID:5392
- C:\Windows\System\XCGfQRY.exe
  C:\Windows\System\XCGfQRY.exe
  2⤵
  PID:5456
- C:\Windows\System\FRfAPzj.exe
  C:\Windows\System\FRfAPzj.exe
  2⤵
  PID:5532
- C:\Windows\System\BZTJcSi.exe
  C:\Windows\System\BZTJcSi.exe
  2⤵
  PID:5588
- C:\Windows\System\GCIZvXp.exe
  C:\Windows\System\GCIZvXp.exe
  2⤵
  PID:5668
- C:\Windows\System\hFHYnMz.exe
  C:\Windows\System\hFHYnMz.exe
  2⤵
  PID:5732
- C:\Windows\System\fxJTSMe.exe
  C:\Windows\System\fxJTSMe.exe
  2⤵
  PID:5788
- C:\Windows\System\GezFsLe.exe
  C:\Windows\System\GezFsLe.exe
  2⤵
  PID:5872
- C:\Windows\System\xYltaAz.exe
  C:\Windows\System\xYltaAz.exe
  2⤵
  PID:5948
- C:\Windows\System\ZGVUtDg.exe
  C:\Windows\System\ZGVUtDg.exe
  2⤵
  PID:6008
- C:\Windows\System\BzShygL.exe
  C:\Windows\System\BzShygL.exe
  2⤵
  PID:6068
- C:\Windows\System\GWOxCWm.exe
  C:\Windows\System\GWOxCWm.exe
  2⤵
  PID:3948
- C:\Windows\System\rMJhSjQ.exe
  C:\Windows\System\rMJhSjQ.exe
  2⤵
  PID:1620
- C:\Windows\System\kywgzRd.exe
  C:\Windows\System\kywgzRd.exe
  2⤵
  PID:3340
- C:\Windows\System\ULmMHQQ.exe
  C:\Windows\System\ULmMHQQ.exe
  2⤵
  PID:5224
- C:\Windows\System\vGcyvRt.exe
  C:\Windows\System\vGcyvRt.exe
  2⤵
  PID:5388
- C:\Windows\System\ixkNJfi.exe
  C:\Windows\System\ixkNJfi.exe
  2⤵
  PID:5640
- C:\Windows\System\NORCcHi.exe
  C:\Windows\System\NORCcHi.exe
  2⤵
  PID:5760
- C:\Windows\System\IhCUpTc.exe
  C:\Windows\System\IhCUpTc.exe
  2⤵
  PID:5900
- C:\Windows\System\VJKGMXV.exe
  C:\Windows\System\VJKGMXV.exe
  2⤵
  PID:6172
- C:\Windows\System\fguHYWC.exe
  C:\Windows\System\fguHYWC.exe
  2⤵
  PID:6200
- C:\Windows\System\TtYeHDk.exe
  C:\Windows\System\TtYeHDk.exe
  2⤵
  PID:6228
- C:\Windows\System\qBuFtNG.exe
  C:\Windows\System\qBuFtNG.exe
  2⤵
  PID:6256
- C:\Windows\System\RefbukU.exe
  C:\Windows\System\RefbukU.exe
  2⤵
  PID:6284
- C:\Windows\System\Gfopoiu.exe
  C:\Windows\System\Gfopoiu.exe
  2⤵
  PID:6312
- C:\Windows\System\iUNUnRk.exe
  C:\Windows\System\iUNUnRk.exe
  2⤵
  PID:6332
- C:\Windows\System\PdymQIx.exe
  C:\Windows\System\PdymQIx.exe
  2⤵
  PID:6360
- C:\Windows\System\DqcIGql.exe
  C:\Windows\System\DqcIGql.exe
  2⤵
  PID:6388
- C:\Windows\System\ogUdZra.exe
  C:\Windows\System\ogUdZra.exe
  2⤵
  PID:6416
- C:\Windows\System\lGJNQSw.exe
  C:\Windows\System\lGJNQSw.exe
  2⤵
  PID:6444
- C:\Windows\System\omyxuhI.exe
  C:\Windows\System\omyxuhI.exe
  2⤵
  PID:6472
- C:\Windows\System\kMMqePZ.exe
  C:\Windows\System\kMMqePZ.exe
  2⤵
  PID:6500
- C:\Windows\System\OFqRRme.exe
  C:\Windows\System\OFqRRme.exe
  2⤵
  PID:6528
- C:\Windows\System\MtkSRAj.exe
  C:\Windows\System\MtkSRAj.exe
  2⤵
  PID:6556
- C:\Windows\System\YOCHMxH.exe
  C:\Windows\System\YOCHMxH.exe
  2⤵
  PID:6584
- C:\Windows\System\zcnXnfJ.exe
  C:\Windows\System\zcnXnfJ.exe
  2⤵
  PID:6612
- C:\Windows\System\XspKNhu.exe
  C:\Windows\System\XspKNhu.exe
  2⤵
  PID:6640
- C:\Windows\System\xjiIqbZ.exe
  C:\Windows\System\xjiIqbZ.exe
  2⤵
  PID:6668
- C:\Windows\System\ObMTQwf.exe
  C:\Windows\System\ObMTQwf.exe
  2⤵
  PID:6696
- C:\Windows\System\glTRJSt.exe
  C:\Windows\System\glTRJSt.exe
  2⤵
  PID:6728
- C:\Windows\System\BlSwWEP.exe
  C:\Windows\System\BlSwWEP.exe
  2⤵
  PID:6752
- C:\Windows\System\UCdmRLn.exe
  C:\Windows\System\UCdmRLn.exe
  2⤵
  PID:6784
- C:\Windows\System\JbBKVMS.exe
  C:\Windows\System\JbBKVMS.exe
  2⤵
  PID:6808
- C:\Windows\System\KsKYDgK.exe
  C:\Windows\System\KsKYDgK.exe
  2⤵
  PID:6832
- C:\Windows\System\qWHzCVj.exe
  C:\Windows\System\qWHzCVj.exe
  2⤵
  PID:6860
- C:\Windows\System\WqeLnlx.exe
  C:\Windows\System\WqeLnlx.exe
  2⤵
  PID:6888
- C:\Windows\System\ZUafUuP.exe
  C:\Windows\System\ZUafUuP.exe
  2⤵
  PID:6920
- C:\Windows\System\HUTNQve.exe
  C:\Windows\System\HUTNQve.exe
  2⤵
  PID:6948
- C:\Windows\System\phfYJMZ.exe
  C:\Windows\System\phfYJMZ.exe
  2⤵
  PID:6976
- C:\Windows\System\baGJcUE.exe
  C:\Windows\System\baGJcUE.exe
  2⤵
  PID:7004
- C:\Windows\System\dWfCVMO.exe
  C:\Windows\System\dWfCVMO.exe
  2⤵
  PID:7032
- C:\Windows\System\JriZKjf.exe
  C:\Windows\System\JriZKjf.exe
  2⤵
  PID:7060
- C:\Windows\System\DxlEDia.exe
  C:\Windows\System\DxlEDia.exe
  2⤵
  PID:7088
- C:\Windows\System\yNlAJoT.exe
  C:\Windows\System\yNlAJoT.exe
  2⤵
  PID:7116
- C:\Windows\System\eQskOXc.exe
  C:\Windows\System\eQskOXc.exe
  2⤵
  PID:7144
- C:\Windows\System\RNuCiDB.exe
  C:\Windows\System\RNuCiDB.exe
  2⤵
  PID:5924
- C:\Windows\System\kzFnXKt.exe
  C:\Windows\System\kzFnXKt.exe
  2⤵
  PID:6064
- C:\Windows\System\yQzKhsc.exe
  C:\Windows\System\yQzKhsc.exe
  2⤵
  PID:784
- C:\Windows\System\ESKEZSh.exe
  C:\Windows\System\ESKEZSh.exe
  2⤵
  PID:5308
- C:\Windows\System\PbCMZOr.exe
  C:\Windows\System\PbCMZOr.exe
  2⤵
  PID:5620
- C:\Windows\System\ByUlANO.exe
  C:\Windows\System\ByUlANO.exe
  2⤵
  PID:6164
- C:\Windows\System\XzHxlIw.exe
  C:\Windows\System\XzHxlIw.exe
  2⤵
  PID:6224
- C:\Windows\System\zAPmGgT.exe
  C:\Windows\System\zAPmGgT.exe
  2⤵
  PID:1080
- C:\Windows\System\PVqETQs.exe
  C:\Windows\System\PVqETQs.exe
  2⤵
  PID:6348
- C:\Windows\System\DyVvZAx.exe
  C:\Windows\System\DyVvZAx.exe
  2⤵
  PID:6408
- C:\Windows\System\KyWExPx.exe
  C:\Windows\System\KyWExPx.exe
  2⤵
  PID:6484
- C:\Windows\System\pCIINMw.exe
  C:\Windows\System\pCIINMw.exe
  2⤵
  PID:6540
- C:\Windows\System\mhgbtyz.exe
  C:\Windows\System\mhgbtyz.exe
  2⤵
  PID:6600
- C:\Windows\System\fQIupxO.exe
  C:\Windows\System\fQIupxO.exe
  2⤵
  PID:6660
- C:\Windows\System\MRpbWRw.exe
  C:\Windows\System\MRpbWRw.exe
  2⤵
  PID:6736
- C:\Windows\System\CPYUKLa.exe
  C:\Windows\System\CPYUKLa.exe
  2⤵
  PID:6800
- C:\Windows\System\QiCdqog.exe
  C:\Windows\System\QiCdqog.exe
  2⤵
  PID:6856
- C:\Windows\System\ltoYJAG.exe
  C:\Windows\System\ltoYJAG.exe
  2⤵
  PID:6932
- C:\Windows\System\PVlkPAg.exe
  C:\Windows\System\PVlkPAg.exe
  2⤵
  PID:6992
- C:\Windows\System\xlBLBpJ.exe
  C:\Windows\System\xlBLBpJ.exe
  2⤵
  PID:7044
- C:\Windows\System\DhsCItu.exe
  C:\Windows\System\DhsCItu.exe
  2⤵
  PID:7108
- C:\Windows\System\ldpLAYx.exe
  C:\Windows\System\ldpLAYx.exe
  2⤵
  PID:5984
- C:\Windows\System\jEmjXYu.exe
  C:\Windows\System\jEmjXYu.exe
  2⤵
  PID:4256
- C:\Windows\System\hLavmZp.exe
  C:\Windows\System\hLavmZp.exe
  2⤵
  PID:5584
- C:\Windows\System\upBmmNZ.exe
  C:\Windows\System\upBmmNZ.exe
  2⤵
  PID:6252
- C:\Windows\System\SwvtANl.exe
  C:\Windows\System\SwvtANl.exe
  2⤵
  PID:6400
- C:\Windows\System\UfuEIHG.exe
  C:\Windows\System\UfuEIHG.exe
  2⤵
  PID:4028
- C:\Windows\System\ZLUDbhq.exe
  C:\Windows\System\ZLUDbhq.exe
  2⤵
  PID:6628
- C:\Windows\System\Ixhzdze.exe
  C:\Windows\System\Ixhzdze.exe
  2⤵
  PID:6768
- C:\Windows\System\gmKcNAO.exe
  C:\Windows\System\gmKcNAO.exe
  2⤵
  PID:6904
- C:\Windows\System\pHICiDG.exe
  C:\Windows\System\pHICiDG.exe
  2⤵
  PID:7172
- C:\Windows\System\gEUPHZo.exe
  C:\Windows\System\gEUPHZo.exe
  2⤵
  PID:7200
- C:\Windows\System\WIhhtMF.exe
  C:\Windows\System\WIhhtMF.exe
  2⤵
  PID:7228
- C:\Windows\System\QoRiPCa.exe
  C:\Windows\System\QoRiPCa.exe
  2⤵
  PID:7256
- C:\Windows\System\HEvHSrJ.exe
  C:\Windows\System\HEvHSrJ.exe
  2⤵
  PID:7284
- C:\Windows\System\bmRbNGq.exe
  C:\Windows\System\bmRbNGq.exe
  2⤵
  PID:7312
- C:\Windows\System\flcIyJP.exe
  C:\Windows\System\flcIyJP.exe
  2⤵
  PID:7340
- C:\Windows\System\gaNPiaD.exe
  C:\Windows\System\gaNPiaD.exe
  2⤵
  PID:7368
- C:\Windows\System\JRNUQPJ.exe
  C:\Windows\System\JRNUQPJ.exe
  2⤵
  PID:7396
- C:\Windows\System\DOFDSuu.exe
  C:\Windows\System\DOFDSuu.exe
  2⤵
  PID:7424
- C:\Windows\System\jPJCsDf.exe
  C:\Windows\System\jPJCsDf.exe
  2⤵
  PID:7452
- C:\Windows\System\UUENuAe.exe
  C:\Windows\System\UUENuAe.exe
  2⤵
  PID:7480
- C:\Windows\System\tOSHBIn.exe
  C:\Windows\System\tOSHBIn.exe
  2⤵
  PID:7508
- C:\Windows\System\gbPpjOW.exe
  C:\Windows\System\gbPpjOW.exe
  2⤵
  PID:7536
- C:\Windows\System\pYyFiIs.exe
  C:\Windows\System\pYyFiIs.exe
  2⤵
  PID:7564
- C:\Windows\System\KsrQLBv.exe
  C:\Windows\System\KsrQLBv.exe
  2⤵
  PID:7592
- C:\Windows\System\HxabETJ.exe
  C:\Windows\System\HxabETJ.exe
  2⤵
  PID:7620
- C:\Windows\System\qtYHSoR.exe
  C:\Windows\System\qtYHSoR.exe
  2⤵
  PID:7648
- C:\Windows\System\ekWyQYB.exe
  C:\Windows\System\ekWyQYB.exe
  2⤵
  PID:7676
- C:\Windows\System\SvDGHCZ.exe
  C:\Windows\System\SvDGHCZ.exe
  2⤵
  PID:7704
- C:\Windows\System\GMkLDss.exe
  C:\Windows\System\GMkLDss.exe
  2⤵
  PID:7732
- C:\Windows\System\fPmgXEA.exe
  C:\Windows\System\fPmgXEA.exe
  2⤵
  PID:7760
- C:\Windows\System\qBAWKyj.exe
  C:\Windows\System\qBAWKyj.exe
  2⤵
  PID:7788
- C:\Windows\System\ZDwXQHF.exe
  C:\Windows\System\ZDwXQHF.exe
  2⤵
  PID:7816
- C:\Windows\System\VclwTys.exe
  C:\Windows\System\VclwTys.exe
  2⤵
  PID:7844
- C:\Windows\System\cDjQvue.exe
  C:\Windows\System\cDjQvue.exe
  2⤵
  PID:7872
- C:\Windows\System\MkmGySi.exe
  C:\Windows\System\MkmGySi.exe
  2⤵
  PID:7900
- C:\Windows\System\QSpBlSI.exe
  C:\Windows\System\QSpBlSI.exe
  2⤵
  PID:7928
- C:\Windows\System\LdcKJPq.exe
  C:\Windows\System\LdcKJPq.exe
  2⤵
  PID:7956
- C:\Windows\System\OwuUTLk.exe
  C:\Windows\System\OwuUTLk.exe
  2⤵
  PID:7984
- C:\Windows\System\lDPOpsa.exe
  C:\Windows\System\lDPOpsa.exe
  2⤵
  PID:8012
- C:\Windows\System\iRIdPgq.exe
  C:\Windows\System\iRIdPgq.exe
  2⤵
  PID:8040
- C:\Windows\System\dJTAEnI.exe
  C:\Windows\System\dJTAEnI.exe
  2⤵
  PID:8068
- C:\Windows\System\ZokCZRt.exe
  C:\Windows\System\ZokCZRt.exe
  2⤵
  PID:8096
- C:\Windows\System\bPUKDgT.exe
  C:\Windows\System\bPUKDgT.exe
  2⤵
  PID:8124
- C:\Windows\System\nVkwEsb.exe
  C:\Windows\System\nVkwEsb.exe
  2⤵
  PID:8152
- C:\Windows\System\uOFvzqm.exe
  C:\Windows\System\uOFvzqm.exe
  2⤵
  PID:8180
- C:\Windows\System\apIpafm.exe
  C:\Windows\System\apIpafm.exe
  2⤵
  PID:7156
- C:\Windows\System\mgmxJCm.exe
  C:\Windows\System\mgmxJCm.exe
  2⤵
  PID:5564
- C:\Windows\System\FoFiSpI.exe
  C:\Windows\System\FoFiSpI.exe
  2⤵
  PID:6376
- C:\Windows\System\buPTZWS.exe
  C:\Windows\System\buPTZWS.exe
  2⤵
  PID:6708
- C:\Windows\System\ZrGKOZe.exe
  C:\Windows\System\ZrGKOZe.exe
  2⤵
  PID:7020
- C:\Windows\System\UhxkIDD.exe
  C:\Windows\System\UhxkIDD.exe
  2⤵
  PID:7220
- C:\Windows\System\IEiniae.exe
  C:\Windows\System\IEiniae.exe
  2⤵
  PID:7276
- C:\Windows\System\EwOTzNg.exe
  C:\Windows\System\EwOTzNg.exe
  2⤵
  PID:7352
- C:\Windows\System\pidodeB.exe
  C:\Windows\System\pidodeB.exe
  2⤵
  PID:7412
- C:\Windows\System\RqMsGOV.exe
  C:\Windows\System\RqMsGOV.exe
  2⤵
  PID:7468
- C:\Windows\System\cXFIWxq.exe
  C:\Windows\System\cXFIWxq.exe
  2⤵
  PID:7524
- C:\Windows\System\sEDGAMk.exe
  C:\Windows\System\sEDGAMk.exe
  2⤵
  PID:7584
- C:\Windows\System\auGYRxU.exe
  C:\Windows\System\auGYRxU.exe
  2⤵
  PID:7636
- C:\Windows\System\SFZRuqG.exe
  C:\Windows\System\SFZRuqG.exe
  2⤵
  PID:7696
- C:\Windows\System\EILdNTj.exe
  C:\Windows\System\EILdNTj.exe
  2⤵
  PID:7752
- C:\Windows\System\wZIulah.exe
  C:\Windows\System\wZIulah.exe
  2⤵
  PID:7828
- C:\Windows\System\BSkVxtr.exe
  C:\Windows\System\BSkVxtr.exe
  2⤵
  PID:7888
- C:\Windows\System\jUlRPDY.exe
  C:\Windows\System\jUlRPDY.exe
  2⤵
  PID:7944
- C:\Windows\System\MaqaPiE.exe
  C:\Windows\System\MaqaPiE.exe
  2⤵
  PID:8004
- C:\Windows\System\aZOqsOf.exe
  C:\Windows\System\aZOqsOf.exe
  2⤵
  PID:8080
- C:\Windows\System\EAyBRZk.exe
  C:\Windows\System\EAyBRZk.exe
  2⤵
  PID:8140
- C:\Windows\System\tPbvgzw.exe
  C:\Windows\System\tPbvgzw.exe
  2⤵
  PID:7080
- C:\Windows\System\gAhsxyo.exe
  C:\Windows\System\gAhsxyo.exe
  2⤵
  PID:6324
- C:\Windows\System\BOhALvX.exe
  C:\Windows\System\BOhALvX.exe
  2⤵
  PID:7188
- C:\Windows\System\rNwfmZa.exe
  C:\Windows\System\rNwfmZa.exe
  2⤵
  PID:7328
- C:\Windows\System\IVTXaiI.exe
  C:\Windows\System\IVTXaiI.exe
  2⤵
  PID:7444
- C:\Windows\System\FIPSoIF.exe
  C:\Windows\System\FIPSoIF.exe
  2⤵
  PID:7576
- C:\Windows\System\jkoXEQG.exe
  C:\Windows\System\jkoXEQG.exe
  2⤵
  PID:7688
- C:\Windows\System\ppyEJNM.exe
  C:\Windows\System\ppyEJNM.exe
  2⤵
  PID:7804
- C:\Windows\System\YyMHfxc.exe
  C:\Windows\System\YyMHfxc.exe
  2⤵
  PID:7972
- C:\Windows\System\oGWOSKf.exe
  C:\Windows\System\oGWOSKf.exe
  2⤵
  PID:8052
- C:\Windows\System\yFhJNdD.exe
  C:\Windows\System\yFhJNdD.exe
  2⤵
  PID:7076
- C:\Windows\System\fLRdMyH.exe
  C:\Windows\System\fLRdMyH.exe
  2⤵
  PID:1868
- C:\Windows\System\ZxELaor.exe
  C:\Windows\System\ZxELaor.exe
  2⤵
  PID:8220
- C:\Windows\System\UADGSCO.exe
  C:\Windows\System\UADGSCO.exe
  2⤵
  PID:8248
- C:\Windows\System\xXCgdGO.exe
  C:\Windows\System\xXCgdGO.exe
  2⤵
  PID:8272
- C:\Windows\System\cXIcuwe.exe
  C:\Windows\System\cXIcuwe.exe
  2⤵
  PID:8304
- C:\Windows\System\GBPWMZZ.exe
  C:\Windows\System\GBPWMZZ.exe
  2⤵
  PID:8332
- C:\Windows\System\ANBLvCv.exe
  C:\Windows\System\ANBLvCv.exe
  2⤵
  PID:8360
- C:\Windows\System\IETWoAk.exe
  C:\Windows\System\IETWoAk.exe
  2⤵
  PID:8388
- C:\Windows\System\oLGjgVp.exe
  C:\Windows\System\oLGjgVp.exe
  2⤵
  PID:8416
- C:\Windows\System\RHIxVeV.exe
  C:\Windows\System\RHIxVeV.exe
  2⤵
  PID:8444
- C:\Windows\System\FUrvyQX.exe
  C:\Windows\System\FUrvyQX.exe
  2⤵
  PID:8472
- C:\Windows\System\guvIZAg.exe
  C:\Windows\System\guvIZAg.exe
  2⤵
  PID:8500
- C:\Windows\System\EBMCYQJ.exe
  C:\Windows\System\EBMCYQJ.exe
  2⤵
  PID:8528
- C:\Windows\System\RbWFZTg.exe
  C:\Windows\System\RbWFZTg.exe
  2⤵
  PID:8556
- C:\Windows\System\NjfjhHU.exe
  C:\Windows\System\NjfjhHU.exe
  2⤵
  PID:8584
- C:\Windows\System\aQrmFJd.exe
  C:\Windows\System\aQrmFJd.exe
  2⤵
  PID:8612
- C:\Windows\System\RaYHHeO.exe
  C:\Windows\System\RaYHHeO.exe
  2⤵
  PID:8640
- C:\Windows\System\pXgbRMO.exe
  C:\Windows\System\pXgbRMO.exe
  2⤵
  PID:8668
- C:\Windows\System\YsFQNCu.exe
  C:\Windows\System\YsFQNCu.exe
  2⤵
  PID:8696
- C:\Windows\System\sZNiqIq.exe
  C:\Windows\System\sZNiqIq.exe
  2⤵
  PID:8724
- C:\Windows\System\GjGqCqJ.exe
  C:\Windows\System\GjGqCqJ.exe
  2⤵
  PID:8752
- C:\Windows\System\NIHzvTV.exe
  C:\Windows\System\NIHzvTV.exe
  2⤵
  PID:8780
- C:\Windows\System\VqPVlzN.exe
  C:\Windows\System\VqPVlzN.exe
  2⤵
  PID:8848
- C:\Windows\System\ZEFmjgt.exe
  C:\Windows\System\ZEFmjgt.exe
  2⤵
  PID:8864
- C:\Windows\System\jVKyHfv.exe
  C:\Windows\System\jVKyHfv.exe
  2⤵
  PID:8888
- C:\Windows\System\XArBwaL.exe
  C:\Windows\System\XArBwaL.exe
  2⤵
  PID:8912
- C:\Windows\System\NFUjlGt.exe
  C:\Windows\System\NFUjlGt.exe
  2⤵
  PID:8980
- C:\Windows\System\RIWasbU.exe
  C:\Windows\System\RIWasbU.exe
  2⤵
  PID:9000
- C:\Windows\System\zxLJdec.exe
  C:\Windows\System\zxLJdec.exe
  2⤵
  PID:9020
- C:\Windows\System\wVcvGvY.exe
  C:\Windows\System\wVcvGvY.exe
  2⤵
  PID:9080
- C:\Windows\System\LEiEaRL.exe
  C:\Windows\System\LEiEaRL.exe
  2⤵
  PID:9112
- C:\Windows\System\QeiyOkZ.exe
  C:\Windows\System\QeiyOkZ.exe
  2⤵
  PID:9152
- C:\Windows\System\QUGPgJK.exe
  C:\Windows\System\QUGPgJK.exe
  2⤵
  PID:9212
- C:\Windows\System\vLyaRhq.exe
  C:\Windows\System\vLyaRhq.exe
  2⤵
  PID:1844
- C:\Windows\System\tdkjSVJ.exe
  C:\Windows\System\tdkjSVJ.exe
  2⤵
  PID:3728
- C:\Windows\System\jcQJDOY.exe
  C:\Windows\System\jcQJDOY.exe
  2⤵
  PID:6828
- C:\Windows\System\dzIZqeP.exe
  C:\Windows\System\dzIZqeP.exe
  2⤵
  PID:8260
- C:\Windows\System\JxeoLoo.exe
  C:\Windows\System\JxeoLoo.exe
  2⤵
  PID:8288
- C:\Windows\System\QDHjvsr.exe
  C:\Windows\System\QDHjvsr.exe
  2⤵
  PID:8324
- C:\Windows\System\gnlGdqw.exe
  C:\Windows\System\gnlGdqw.exe
  2⤵
  PID:8352
- C:\Windows\System\NKsEvmd.exe
  C:\Windows\System\NKsEvmd.exe
  2⤵
  PID:8376
- C:\Windows\System\KtIYTtM.exe
  C:\Windows\System\KtIYTtM.exe
  2⤵
  PID:8404
- C:\Windows\System\ukPPAOK.exe
  C:\Windows\System\ukPPAOK.exe
  2⤵
  PID:8432
- C:\Windows\System\onGDbUj.exe
  C:\Windows\System\onGDbUj.exe
  2⤵
  PID:2388
- C:\Windows\System\xnrqVuG.exe
  C:\Windows\System\xnrqVuG.exe
  2⤵
  PID:3256
- C:\Windows\System\NPmyoyD.exe
  C:\Windows\System\NPmyoyD.exe
  2⤵
  PID:5092
- C:\Windows\System\gxRFwmJ.exe
  C:\Windows\System\gxRFwmJ.exe
  2⤵
  PID:1960
- C:\Windows\System\bXKTnGT.exe
  C:\Windows\System\bXKTnGT.exe
  2⤵
  PID:5096
- C:\Windows\System\qLZYEqI.exe
  C:\Windows\System\qLZYEqI.exe
  2⤵
  PID:8716
- C:\Windows\System\UmlnSRH.exe
  C:\Windows\System\UmlnSRH.exe
  2⤵
  PID:2336
- C:\Windows\System\vGkNpSv.exe
  C:\Windows\System\vGkNpSv.exe
  2⤵
  PID:2644
- C:\Windows\System\hrLCsZO.exe
  C:\Windows\System\hrLCsZO.exe
  2⤵
  PID:8792
- C:\Windows\System\RPShtdU.exe
  C:\Windows\System\RPShtdU.exe
  2⤵
  PID:2780
- C:\Windows\System\kFCZjuP.exe
  C:\Windows\System\kFCZjuP.exe
  2⤵
  PID:8844
- C:\Windows\System\rWnFpLh.exe
  C:\Windows\System\rWnFpLh.exe
  2⤵
  PID:2360
- C:\Windows\System\AnELviB.exe
  C:\Windows\System\AnELviB.exe
  2⤵
  PID:4824
- C:\Windows\System\EaUMXCC.exe
  C:\Windows\System\EaUMXCC.exe
  2⤵
  PID:116
- C:\Windows\System\voFuDyn.exe
  C:\Windows\System\voFuDyn.exe
  2⤵
  PID:8316
- C:\Windows\System\eKWkFOg.exe
  C:\Windows\System\eKWkFOg.exe
  2⤵
  PID:8544
- C:\Windows\System\cVaIMfa.exe
  C:\Windows\System\cVaIMfa.exe
  2⤵
  PID:2496
- C:\Windows\System\bjHTPpV.exe
  C:\Windows\System\bjHTPpV.exe
  2⤵
  PID:1344
- C:\Windows\System\tcYSHJq.exe
  C:\Windows\System\tcYSHJq.exe
  2⤵
  PID:3156
- C:\Windows\System\aORFiVd.exe
  C:\Windows\System\aORFiVd.exe
  2⤵
  PID:9032
- C:\Windows\System\HPiBQHL.exe
  C:\Windows\System\HPiBQHL.exe
  2⤵
  PID:9204
- C:\Windows\System\osGbZPr.exe
  C:\Windows\System\osGbZPr.exe
  2⤵
  PID:9136
- C:\Windows\System\xTPBqXP.exe
  C:\Windows\System\xTPBqXP.exe
  2⤵
  PID:8428
- C:\Windows\System\UZThvTx.exe
  C:\Windows\System\UZThvTx.exe
  2⤵
  PID:8712
- C:\Windows\System\NloEsWt.exe
  C:\Windows\System\NloEsWt.exe
  2⤵
  PID:8908
- C:\Windows\System\wjiMuYY.exe
  C:\Windows\System\wjiMuYY.exe
  2⤵
  PID:9056
- C:\Windows\System\NPyWqhr.exe
  C:\Windows\System\NPyWqhr.exe
  2⤵
  PID:4296
- C:\Windows\System\bbxsRIh.exe
  C:\Windows\System\bbxsRIh.exe
  2⤵
  PID:1956
- C:\Windows\System\AYvPcAW.exe
  C:\Windows\System\AYvPcAW.exe
  2⤵
  PID:7308
- C:\Windows\System\BnNWySi.exe
  C:\Windows\System\BnNWySi.exe
  2⤵
  PID:8464
- C:\Windows\System\TmtkcLq.exe
  C:\Windows\System\TmtkcLq.exe
  2⤵
  PID:8632
- C:\Windows\System\ZMHGEAr.exe
  C:\Windows\System\ZMHGEAr.exe
  2⤵
  PID:3860
- C:\Windows\System\qvxMvgf.exe
  C:\Windows\System\qvxMvgf.exe
  2⤵
  PID:8816
- C:\Windows\System\kryMefC.exe
  C:\Windows\System\kryMefC.exe
  2⤵
  PID:8796
- C:\Windows\System\nyTkUsK.exe
  C:\Windows\System\nyTkUsK.exe
  2⤵
  PID:552
- C:\Windows\System\fMLyeIt.exe
  C:\Windows\System\fMLyeIt.exe
  2⤵
  PID:2328
- C:\Windows\System\fJENnmc.exe
  C:\Windows\System\fJENnmc.exe
  2⤵
  PID:8896
- C:\Windows\System\bwsGlau.exe
  C:\Windows\System\bwsGlau.exe
  2⤵
  PID:3092
- C:\Windows\System\JMYqEul.exe
  C:\Windows\System\JMYqEul.exe
  2⤵
  PID:9196
- C:\Windows\System\fcUWgPr.exe
  C:\Windows\System\fcUWgPr.exe
  2⤵
  PID:224
- C:\Windows\System\cqDQTkL.exe
  C:\Windows\System\cqDQTkL.exe
  2⤵
  PID:9224
- C:\Windows\System\GchcFKV.exe
  C:\Windows\System\GchcFKV.exe
  2⤵
  PID:9268
- C:\Windows\System\uUEVCta.exe
  C:\Windows\System\uUEVCta.exe
  2⤵
  PID:9320
- C:\Windows\System\MSMDBcu.exe
  C:\Windows\System\MSMDBcu.exe
  2⤵
  PID:9396
- C:\Windows\System\uiJYQCG.exe
  C:\Windows\System\uiJYQCG.exe
  2⤵
  PID:9452
- C:\Windows\System\xCeFudY.exe
  C:\Windows\System\xCeFudY.exe
  2⤵
  PID:9488
- C:\Windows\System\SktKnyJ.exe
  C:\Windows\System\SktKnyJ.exe
  2⤵
  PID:9540
- C:\Windows\System\RkVpdbH.exe
  C:\Windows\System\RkVpdbH.exe
  2⤵
  PID:9568
- C:\Windows\System\dbbIDsk.exe
  C:\Windows\System\dbbIDsk.exe
  2⤵
  PID:9596
- C:\Windows\System\qgtYNMr.exe
  C:\Windows\System\qgtYNMr.exe
  2⤵
  PID:9624
- C:\Windows\System\yasoKjw.exe
  C:\Windows\System\yasoKjw.exe
  2⤵
  PID:9640
- C:\Windows\System\adbOXyY.exe
  C:\Windows\System\adbOXyY.exe
  2⤵
  PID:9660
- C:\Windows\System\YoDItCB.exe
  C:\Windows\System\YoDItCB.exe
  2⤵
  PID:9688
- C:\Windows\System\uXSxcVV.exe
  C:\Windows\System\uXSxcVV.exe
  2⤵
  PID:9724
- C:\Windows\System\qEstlfq.exe
  C:\Windows\System\qEstlfq.exe
  2⤵
  PID:9764
- C:\Windows\System\pHUpMcJ.exe
  C:\Windows\System\pHUpMcJ.exe
  2⤵
  PID:9792
- C:\Windows\System\rGHfovF.exe
  C:\Windows\System\rGHfovF.exe
  2⤵
  PID:9808
- C:\Windows\System\ERiOSTh.exe
  C:\Windows\System\ERiOSTh.exe
  2⤵
  PID:9848
- C:\Windows\System\upYRcHR.exe
  C:\Windows\System\upYRcHR.exe
  2⤵
  PID:9864
- C:\Windows\System\ZpPxIym.exe
  C:\Windows\System\ZpPxIym.exe
  2⤵
  PID:9904
- C:\Windows\System\msOyeIF.exe
  C:\Windows\System\msOyeIF.exe
  2⤵
  PID:9932
- C:\Windows\System\mqxJbsU.exe
  C:\Windows\System\mqxJbsU.exe
  2⤵
  PID:9964
- C:\Windows\System\ZKTywvQ.exe
  C:\Windows\System\ZKTywvQ.exe
  2⤵
  PID:9984
- C:\Windows\System\HivnVdF.exe
  C:\Windows\System\HivnVdF.exe
  2⤵
  PID:10028
- C:\Windows\System\gKzMUqh.exe
  C:\Windows\System\gKzMUqh.exe
  2⤵
  PID:10056
- C:\Windows\System\qVHIhgy.exe
  C:\Windows\System\qVHIhgy.exe
  2⤵
  PID:10088
- C:\Windows\System\QOTLIYC.exe
  C:\Windows\System\QOTLIYC.exe
  2⤵
  PID:10128
- C:\Windows\System\CTuwUlw.exe
  C:\Windows\System\CTuwUlw.exe
  2⤵
  PID:10160
- C:\Windows\System\wTPzFrr.exe
  C:\Windows\System\wTPzFrr.exe
  2⤵
  PID:10212
- C:\Windows\System\WDvAFgc.exe
  C:\Windows\System\WDvAFgc.exe
  2⤵
  PID:10228
- C:\Windows\System\EBFjZGn.exe
  C:\Windows\System\EBFjZGn.exe
  2⤵
  PID:9236
- C:\Windows\System\meIVZkp.exe
  C:\Windows\System\meIVZkp.exe
  2⤵
  PID:9296
- C:\Windows\System\soprqNN.exe
  C:\Windows\System\soprqNN.exe
  2⤵
  PID:9348
- C:\Windows\System\wHEzAwp.exe
  C:\Windows\System\wHEzAwp.exe
  2⤵
  PID:9436
- C:\Windows\System\nWSjhzU.exe
  C:\Windows\System\nWSjhzU.exe
  2⤵
  PID:9496
- C:\Windows\System\xeLBxAb.exe
  C:\Windows\System\xeLBxAb.exe
  2⤵
  PID:9532
- C:\Windows\System\mpZBzuc.exe
  C:\Windows\System\mpZBzuc.exe
  2⤵
  PID:9632
- C:\Windows\System\SaZlTVN.exe
  C:\Windows\System\SaZlTVN.exe
  2⤵
  PID:9704
- C:\Windows\System\EMRHkks.exe
  C:\Windows\System\EMRHkks.exe
  2⤵
  PID:9800
- C:\Windows\System\gnZqZBF.exe
  C:\Windows\System\gnZqZBF.exe
  2⤵
  PID:9952
- C:\Windows\System\yJBnqTV.exe
  C:\Windows\System\yJBnqTV.exe
  2⤵
  PID:10012
- C:\Windows\System\QjfJlcX.exe
  C:\Windows\System\QjfJlcX.exe
  2⤵
  PID:10064
- C:\Windows\System\Tlhqlqo.exe
  C:\Windows\System\Tlhqlqo.exe
  2⤵
  PID:10080
- C:\Windows\System\OkAqmkw.exe
  C:\Windows\System\OkAqmkw.exe
  2⤵
  PID:10220
- C:\Windows\System\TLBBnQv.exe
  C:\Windows\System\TLBBnQv.exe
  2⤵
  PID:3780
- C:\Windows\System\Uxphxqm.exe
  C:\Windows\System\Uxphxqm.exe
  2⤵
  PID:9284
- C:\Windows\System\HKJdKtM.exe
  C:\Windows\System\HKJdKtM.exe
  2⤵
  PID:9368
- C:\Windows\System\UObpSTS.exe
  C:\Windows\System\UObpSTS.exe
  2⤵
  PID:9444
- C:\Windows\System\ZrDFuMw.exe
  C:\Windows\System\ZrDFuMw.exe
  2⤵
  PID:9480
- C:\Windows\System\RzrGutu.exe
  C:\Windows\System\RzrGutu.exe
  2⤵
  PID:9580
- C:\Windows\System\QICYSOb.exe
  C:\Windows\System\QICYSOb.exe
  2⤵
  PID:9612
- C:\Windows\System\bvYPKaI.exe
  C:\Windows\System\bvYPKaI.exe
  2⤵
  PID:9900
- C:\Windows\System\DKnvsXK.exe
  C:\Windows\System\DKnvsXK.exe
  2⤵
  PID:10072
- C:\Windows\System\FbGGYUP.exe
  C:\Windows\System\FbGGYUP.exe
  2⤵
  PID:10052
- C:\Windows\System\gcZCjjh.exe
  C:\Windows\System\gcZCjjh.exe
  2⤵
  PID:10144
- C:\Windows\System\wDNycGV.exe
  C:\Windows\System\wDNycGV.exe
  2⤵
  PID:9240
- C:\Windows\System\sfEWDNs.exe
  C:\Windows\System\sfEWDNs.exe
  2⤵
  PID:9592
- C:\Windows\System\SSQRUHt.exe
  C:\Windows\System\SSQRUHt.exe
  2⤵
  PID:9668
- C:\Windows\System\GwCYVWn.exe
  C:\Windows\System\GwCYVWn.exe
  2⤵
  PID:10112
- C:\Windows\System\KzBIUlK.exe
  C:\Windows\System\KzBIUlK.exe
  2⤵
  PID:9424
- C:\Windows\System\fDdFNSI.exe
  C:\Windows\System\fDdFNSI.exe
  2⤵
  PID:5108
- C:\Windows\System\mToexjO.exe
  C:\Windows\System\mToexjO.exe
  2⤵
  PID:9972
- C:\Windows\System\sCDIzni.exe
  C:\Windows\System\sCDIzni.exe
  2⤵
  PID:3068
- C:\Windows\System\CkYYRCC.exe
  C:\Windows\System\CkYYRCC.exe
  2⤵
  PID:9608
- C:\Windows\System\LntPiJk.exe
  C:\Windows\System\LntPiJk.exe
  2⤵
  PID:10264
- C:\Windows\System\scPsBZH.exe
  C:\Windows\System\scPsBZH.exe
  2⤵
  PID:10296
- C:\Windows\System\bnDQexP.exe
  C:\Windows\System\bnDQexP.exe
  2⤵
  PID:10312
- C:\Windows\System\ZFooVwc.exe
  C:\Windows\System\ZFooVwc.exe
  2⤵
  PID:10340
- C:\Windows\System\IZYZGeL.exe
  C:\Windows\System\IZYZGeL.exe
  2⤵
  PID:10380
- C:\Windows\System\fnUtGJg.exe
  C:\Windows\System\fnUtGJg.exe
  2⤵
  PID:10400
- C:\Windows\System\cIoDavk.exe
  C:\Windows\System\cIoDavk.exe
  2⤵
  PID:10432
- C:\Windows\System\YzvYMJw.exe
  C:\Windows\System\YzvYMJw.exe
  2⤵
  PID:10452
- C:\Windows\System\JpMCssm.exe
  C:\Windows\System\JpMCssm.exe
  2⤵
  PID:10472
- C:\Windows\System\IlHxORb.exe
  C:\Windows\System\IlHxORb.exe
  2⤵
  PID:10500
- C:\Windows\System\UrxWNdP.exe
  C:\Windows\System\UrxWNdP.exe
  2⤵
  PID:10536
- C:\Windows\System\bTYSZeO.exe
  C:\Windows\System\bTYSZeO.exe
  2⤵
  PID:10576
- C:\Windows\System\LbaAUTO.exe
  C:\Windows\System\LbaAUTO.exe
  2⤵
  PID:10604
- C:\Windows\System\ZFPUPvk.exe
  C:\Windows\System\ZFPUPvk.exe
  2⤵
  PID:10620
- C:\Windows\System\wuWulRU.exe
  C:\Windows\System\wuWulRU.exe
  2⤵
  PID:10636
- C:\Windows\System\RHFLpoM.exe
  C:\Windows\System\RHFLpoM.exe
  2⤵
  PID:10688
- C:\Windows\System\kADnKiF.exe
  C:\Windows\System\kADnKiF.exe
  2⤵
  PID:10716
- C:\Windows\System\glytzzf.exe
  C:\Windows\System\glytzzf.exe
  2⤵
  PID:10744
- C:\Windows\System\XErfQnp.exe
  C:\Windows\System\XErfQnp.exe
  2⤵
  PID:10772
- C:\Windows\System\NvKieLt.exe
  C:\Windows\System\NvKieLt.exe
  2⤵
  PID:10800
- C:\Windows\System\WWrOsdi.exe
  C:\Windows\System\WWrOsdi.exe
  2⤵
  PID:10828
- C:\Windows\System\TVyLhLy.exe
  C:\Windows\System\TVyLhLy.exe
  2⤵
  PID:10856
- C:\Windows\System\eEZXOiJ.exe
  C:\Windows\System\eEZXOiJ.exe
  2⤵
  PID:10884
- C:\Windows\System\QXPLoSD.exe
  C:\Windows\System\QXPLoSD.exe
  2⤵
  PID:10900
- C:\Windows\System\YQkNgGm.exe
  C:\Windows\System\YQkNgGm.exe
  2⤵
  PID:10920
- C:\Windows\System\BpOHiAj.exe
  C:\Windows\System\BpOHiAj.exe
  2⤵
  PID:10952
- C:\Windows\System\LQaVfbh.exe
  C:\Windows\System\LQaVfbh.exe
  2⤵
  PID:10984
- C:\Windows\System\fDqpnEM.exe
  C:\Windows\System\fDqpnEM.exe
  2⤵
  PID:11032
- C:\Windows\System\vRbprvP.exe
  C:\Windows\System\vRbprvP.exe
  2⤵
  PID:11060
- C:\Windows\System\WHeQsEI.exe
  C:\Windows\System\WHeQsEI.exe
  2⤵
  PID:11088
- C:\Windows\System\CKbyYbB.exe
  C:\Windows\System\CKbyYbB.exe
  2⤵
  PID:11104
- C:\Windows\System\KqUObwa.exe
  C:\Windows\System\KqUObwa.exe
  2⤵
  PID:11132
- C:\Windows\System\LogBmbn.exe
  C:\Windows\System\LogBmbn.exe
  2⤵
  PID:11172
- C:\Windows\System\htVxDwH.exe
  C:\Windows\System\htVxDwH.exe
  2⤵
  PID:11200
- C:\Windows\System\mbPWhmR.exe
  C:\Windows\System\mbPWhmR.exe
  2⤵
  PID:11232
- C:\Windows\System\NbrTCgG.exe
  C:\Windows\System\NbrTCgG.exe
  2⤵
  PID:11260
- C:\Windows\System\ZdyhvYI.exe
  C:\Windows\System\ZdyhvYI.exe
  2⤵
  PID:10288
- C:\Windows\System\DHALARm.exe
  C:\Windows\System\DHALARm.exe
  2⤵
  PID:10364
- C:\Windows\System\jBJDOGe.exe
  C:\Windows\System\jBJDOGe.exe
  2⤵
  PID:10416
- C:\Windows\System\BsqOmSG.exe
  C:\Windows\System\BsqOmSG.exe
  2⤵
  PID:10468
- C:\Windows\System\VeEFWyL.exe
  C:\Windows\System\VeEFWyL.exe
  2⤵
  PID:10556
- C:\Windows\System\aEeJXTq.exe
  C:\Windows\System\aEeJXTq.exe
  2⤵
  PID:10632
- C:\Windows\System\FFreNYR.exe
  C:\Windows\System\FFreNYR.exe
  2⤵
  PID:10668
- C:\Windows\System\IjamBCs.exe
  C:\Windows\System\IjamBCs.exe
  2⤵
  PID:10756
- C:\Windows\System\MVQSuVh.exe
  C:\Windows\System\MVQSuVh.exe
  2⤵
  PID:9828
- C:\Windows\System\UNsFLLw.exe
  C:\Windows\System\UNsFLLw.exe
  2⤵
  PID:10848
- C:\Windows\System\QLfAejb.exe
  C:\Windows\System\QLfAejb.exe
  2⤵
  PID:10968
- C:\Windows\System\IXluYwT.exe
  C:\Windows\System\IXluYwT.exe
  2⤵
  PID:10976
- C:\Windows\System\KVnTRsV.exe
  C:\Windows\System\KVnTRsV.exe
  2⤵
  PID:11080
- C:\Windows\System\JWnTrpp.exe
  C:\Windows\System\JWnTrpp.exe
  2⤵
  PID:11144
- C:\Windows\System\TNguxGy.exe
  C:\Windows\System\TNguxGy.exe
  2⤵
  PID:11212
- C:\Windows\System\SFrtDLB.exe
  C:\Windows\System\SFrtDLB.exe
  2⤵
  PID:10248
- C:\Windows\System\QVpKMZq.exe
  C:\Windows\System\QVpKMZq.exe
  2⤵
  PID:10388
- C:\Windows\System\iSIGjAa.exe
  C:\Windows\System\iSIGjAa.exe
  2⤵
  PID:10588
- C:\Windows\System\iTVGDzt.exe
  C:\Windows\System\iTVGDzt.exe
  2⤵
  PID:10616
- C:\Windows\System\kqIGqde.exe
  C:\Windows\System\kqIGqde.exe
  2⤵
  PID:10820
- C:\Windows\System\WcIYyLx.exe
  C:\Windows\System\WcIYyLx.exe
  2⤵
  PID:11020
- C:\Windows\System\SLVcqNU.exe
  C:\Windows\System\SLVcqNU.exe
  2⤵
  PID:11120
- C:\Windows\System\tpVINSU.exe
  C:\Windows\System\tpVINSU.exe
  2⤵
  PID:10408
- C:\Windows\System\kQThSFt.exe
  C:\Windows\System\kQThSFt.exe
  2⤵
  PID:10812
- C:\Windows\System\RwIhjOE.exe
  C:\Windows\System\RwIhjOE.exe
  2⤵
  PID:11072
- C:\Windows\System\gBeiXiR.exe
  C:\Windows\System\gBeiXiR.exe
  2⤵
  PID:10728
- C:\Windows\System\ttxEKws.exe
  C:\Windows\System\ttxEKws.exe
  2⤵
  PID:10560
- C:\Windows\System\NgMjMyN.exe
  C:\Windows\System\NgMjMyN.exe
  2⤵
  PID:11280
- C:\Windows\System\WzBjPAb.exe
  C:\Windows\System\WzBjPAb.exe
  2⤵
  PID:11312
- C:\Windows\System\FkUmwka.exe
  C:\Windows\System\FkUmwka.exe
  2⤵
  PID:11340
- C:\Windows\System\syzXJOA.exe
  C:\Windows\System\syzXJOA.exe
  2⤵
  PID:11368
- C:\Windows\System\EVkcSUI.exe
  C:\Windows\System\EVkcSUI.exe
  2⤵
  PID:11384
- C:\Windows\System\pyPBIXi.exe
  C:\Windows\System\pyPBIXi.exe
  2⤵
  PID:11424
- C:\Windows\System\QHjRVac.exe
  C:\Windows\System\QHjRVac.exe
  2⤵
  PID:11452
- C:\Windows\System\UDhiKPw.exe
  C:\Windows\System\UDhiKPw.exe
  2⤵
  PID:11480
- C:\Windows\System\EyiEkNQ.exe
  C:\Windows\System\EyiEkNQ.exe
  2⤵
  PID:11508
- C:\Windows\System\drGVHxo.exe
  C:\Windows\System\drGVHxo.exe
  2⤵
  PID:11536
- C:\Windows\System\PvXdmaZ.exe
  C:\Windows\System\PvXdmaZ.exe
  2⤵
  PID:11564
- C:\Windows\System\ygMNSol.exe
  C:\Windows\System\ygMNSol.exe
  2⤵
  PID:11580
- C:\Windows\System\WPfVPSh.exe
  C:\Windows\System\WPfVPSh.exe
  2⤵
  PID:11608
- C:\Windows\System\DLsPYEM.exe
  C:\Windows\System\DLsPYEM.exe
  2⤵
  PID:11644
- C:\Windows\System\zXZfcWN.exe
  C:\Windows\System\zXZfcWN.exe
  2⤵
  PID:11672
- C:\Windows\System\vSTKxHP.exe
  C:\Windows\System\vSTKxHP.exe
  2⤵
  PID:11700
- C:\Windows\System\tMzqHKj.exe
  C:\Windows\System\tMzqHKj.exe
  2⤵
  PID:11720
- C:\Windows\System\ERobXOU.exe
  C:\Windows\System\ERobXOU.exe
  2⤵
  PID:11736
- C:\Windows\System\DuKwzrL.exe
  C:\Windows\System\DuKwzrL.exe
  2⤵
  PID:11784
- C:\Windows\System\onXZJxI.exe
  C:\Windows\System\onXZJxI.exe
  2⤵
  PID:11816
- C:\Windows\System\KQENzkC.exe
  C:\Windows\System\KQENzkC.exe
  2⤵
  PID:11844
- C:\Windows\System\cCccSta.exe
  C:\Windows\System\cCccSta.exe
  2⤵
  PID:11864
- C:\Windows\System\cxctRwr.exe
  C:\Windows\System\cxctRwr.exe
  2⤵
  PID:11888
- C:\Windows\System\ScZPLss.exe
  C:\Windows\System\ScZPLss.exe
  2⤵
  PID:11928
- C:\Windows\System\mPFclEk.exe
  C:\Windows\System\mPFclEk.exe
  2⤵
  PID:11956
- C:\Windows\System\cOXEKka.exe
  C:\Windows\System\cOXEKka.exe
  2⤵
  PID:11972
- C:\Windows\System\XDYGSdI.exe
  C:\Windows\System\XDYGSdI.exe
  2⤵
  PID:12012
- C:\Windows\System\ytWwPQf.exe
  C:\Windows\System\ytWwPQf.exe
  2⤵
  PID:12036
- C:\Windows\System\CAhNHyt.exe
  C:\Windows\System\CAhNHyt.exe
  2⤵
  PID:12056
- C:\Windows\System\wEOhdrs.exe
  C:\Windows\System\wEOhdrs.exe
  2⤵
  PID:12096
- C:\Windows\System\LjTgCWe.exe
  C:\Windows\System\LjTgCWe.exe
  2⤵
  PID:12124
- C:\Windows\System\SUNYzgP.exe
  C:\Windows\System\SUNYzgP.exe
  2⤵
  PID:12152
- C:\Windows\System\thtXrBi.exe
  C:\Windows\System\thtXrBi.exe
  2⤵
  PID:12180
- C:\Windows\System\XMsvQzc.exe
  C:\Windows\System\XMsvQzc.exe
  2⤵
  PID:12196
- C:\Windows\System\kRapnKK.exe
  C:\Windows\System\kRapnKK.exe
  2⤵
  PID:12224
- C:\Windows\System\BUadLuo.exe
  C:\Windows\System\BUadLuo.exe
  2⤵
  PID:12264
- C:\Windows\System\YaCEuwG.exe
  C:\Windows\System\YaCEuwG.exe
  2⤵
  PID:11196
- C:\Windows\System\XTmMrfS.exe
  C:\Windows\System\XTmMrfS.exe
  2⤵
  PID:11380
- C:\Windows\System\JbXOMUL.exe
  C:\Windows\System\JbXOMUL.exe
  2⤵
  PID:11396
- C:\Windows\System\UZrVDsE.exe
  C:\Windows\System\UZrVDsE.exe
  2⤵
  PID:11548
- C:\Windows\System\XNoOmpu.exe
  C:\Windows\System\XNoOmpu.exe
  2⤵
  PID:11624
- C:\Windows\System\zRCZkZk.exe
  C:\Windows\System\zRCZkZk.exe
  2⤵
  PID:11684
- C:\Windows\System\zHQAWhq.exe
  C:\Windows\System\zHQAWhq.exe
  2⤵
  PID:11780
- C:\Windows\System\fCmHjBB.exe
  C:\Windows\System\fCmHjBB.exe
  2⤵
  PID:11832
- C:\Windows\System\sMTVlQi.exe
  C:\Windows\System\sMTVlQi.exe
  2⤵
  PID:11880
- C:\Windows\System\EFavluH.exe
  C:\Windows\System\EFavluH.exe
  2⤵
  PID:11944
- C:\Windows\System\tsVsuZp.exe
  C:\Windows\System\tsVsuZp.exe
  2⤵
  PID:11988
- C:\Windows\System\WeTFOBS.exe
  C:\Windows\System\WeTFOBS.exe
  2⤵
  PID:12108
- C:\Windows\System\FHwTbWD.exe
  C:\Windows\System\FHwTbWD.exe
  2⤵
  PID:12172
- C:\Windows\System\iyURTxS.exe
  C:\Windows\System\iyURTxS.exe
  2⤵
  PID:2812
- C:\Windows\System\fqqDbRq.exe
  C:\Windows\System\fqqDbRq.exe
  2⤵
  PID:9312
- C:\Windows\System\KOjAJqp.exe
  C:\Windows\System\KOjAJqp.exe
  2⤵
  PID:3512
- C:\Windows\System\SgdORHK.exe
  C:\Windows\System\SgdORHK.exe
  2⤵
  PID:11352
- C:\Windows\System\kWXkYsI.exe
  C:\Windows\System\kWXkYsI.exe
  2⤵
  PID:11596
- C:\Windows\System\flfeAeN.exe
  C:\Windows\System\flfeAeN.exe
  2⤵
  PID:11728
- C:\Windows\System\DLbtizC.exe
  C:\Windows\System\DLbtizC.exe
  2⤵
  PID:11952
- C:\Windows\System\PscoSKb.exe
  C:\Windows\System\PscoSKb.exe
  2⤵
  PID:12084
- C:\Windows\System\hzxqDXN.exe
  C:\Windows\System\hzxqDXN.exe
  2⤵
  PID:3132
- C:\Windows\System\MWVNdcc.exe
  C:\Windows\System\MWVNdcc.exe
  2⤵
  PID:11356
- C:\Windows\System\MfqxGEM.exe
  C:\Windows\System\MfqxGEM.exe
  2⤵
  PID:11680
- C:\Windows\System\kOcUXpF.exe
  C:\Windows\System\kOcUXpF.exe
  2⤵
  PID:12164
- C:\Windows\System\mZnLBBK.exe
  C:\Windows\System\mZnLBBK.exe
  2⤵
  PID:11592
- C:\Windows\System\XmBPAnz.exe
  C:\Windows\System\XmBPAnz.exe
  2⤵
  PID:11304
- C:\Windows\System\oSCDxke.exe
  C:\Windows\System\oSCDxke.exe
  2⤵
  PID:12304
- C:\Windows\System\RjfeBUK.exe
  C:\Windows\System\RjfeBUK.exe
  2⤵
  PID:12332
- C:\Windows\System\uXRMqBG.exe
  C:\Windows\System\uXRMqBG.exe
  2⤵
  PID:12348
- C:\Windows\System\zbssoTJ.exe
  C:\Windows\System\zbssoTJ.exe
  2⤵
  PID:12388
- C:\Windows\System\FlASftv.exe
  C:\Windows\System\FlASftv.exe
  2⤵
  PID:12416
- C:\Windows\System\RDCOKrh.exe
  C:\Windows\System\RDCOKrh.exe
  2⤵
  PID:12448
- C:\Windows\System\zQoruTC.exe
  C:\Windows\System\zQoruTC.exe
  2⤵
  PID:12464
- C:\Windows\System\ynQaWVe.exe
  C:\Windows\System\ynQaWVe.exe
  2⤵
  PID:12500
- C:\Windows\System\yThkdLC.exe
  C:\Windows\System\yThkdLC.exe
  2⤵
  PID:12532
- C:\Windows\System\jArAPyL.exe
  C:\Windows\System\jArAPyL.exe
  2⤵
  PID:12560
- C:\Windows\System\VtyRdLE.exe
  C:\Windows\System\VtyRdLE.exe
  2⤵
  PID:12576
- C:\Windows\System\NfjrSmQ.exe
  C:\Windows\System\NfjrSmQ.exe
  2⤵
  PID:12604
- C:\Windows\System\gsIgxJP.exe
  C:\Windows\System\gsIgxJP.exe
  2⤵
  PID:12632
- C:\Windows\System\wluzhqR.exe
  C:\Windows\System\wluzhqR.exe
  2⤵
  PID:12652
- C:\Windows\System\yGOdHcD.exe
  C:\Windows\System\yGOdHcD.exe
  2⤵
  PID:12716
- C:\Windows\System\SswQrTO.exe
  C:\Windows\System\SswQrTO.exe
  2⤵
  PID:12736

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:13108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_fnxxkrci.0pz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fnxxkrci.0pz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

BGdMoKD.exe

Path C:\Windows\System\BGdMoKD.exe
Size 2.8MB
SHA256 f91a1a995f9cfb5de1af9cbf9b87d5a75ca7c4868a1e9ee835155d84f56d481b
MD5 83d5f2db379c787bc69c445be37cb72c
SHA1 cfc57f604d06a8f71023510a1f615c3cc27926bf
SHA512 76f45431eab239abab6158ae547d701dc8bc404de001f82f3dd65b0fa5790537e5ba74acd0d73648fba92fe8430acf622f64832493b9e1129f8b35660692ebcb
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBt:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rh
MD5 SHA1 SHA512 SSDEEP

Submit Download

EhITsVr.exe

Path C:\Windows\System\EhITsVr.exe
Size 2.8MB
SHA256 c2b4a4c2b1559482f041009b1c76aac39873a3c852346873dacf85864f8b87c5
MD5 a9d6f10e9c93f637d67fedef1977370a
SHA1 34100b10236307b289dae2387fb097ccef0abf95
SHA512 f43837fe85c9a6fa1a7190073adca470ee931c4ad042077a8febd21ec023dab0b995af1691e0158c0ea99e0a4997d30765d7aae79a9983b8f683f6e2d465b45a
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBJ:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

GQoSNwp.exe

Path C:\Windows\System\GQoSNwp.exe
Size 2.8MB
SHA256 aef2a9b83637588214e54a78a879d9cdb28e586266e871cd2999e69598faa29b
MD5 c12245efd811606b57072e5478491a1f
SHA1 13b57ca61ba4daea822e42ded741813ab0c0907f
SHA512 92f070d76f76f0aea1caea2328d78ac77d6a709c2d4a9211e65806a58cbcf867f3660497e8c84a32edef163f5a177b4e7b74e68a7cd94c5220d4e520a6391149
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBJ:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RV
MD5 SHA1 SHA512 SSDEEP

Submit Download

IkFrGUz.exe

Path C:\Windows\System\IkFrGUz.exe
Size 2.8MB
SHA256 2e13998b5083b472b8b3c6a0b0a3e4fc6408a4ef7ea55cb8f4f4be791087945b
MD5 af1bc1065e8eefd07af76071e30ca36c
SHA1 1cef81f9f8460a43940cd6ba9513d04753dc761c
SHA512 6476b220a7c5b5ed5d810875fbffb89634c31c9634db0a547225ce110f431a3d3daeb35dc13bed27e88c675b84033c4bfce773e7070202356c25aa294d565445
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXB8:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RY
MD5 SHA1 SHA512 SSDEEP

Submit Download

JDSQYUL.exe

Path C:\Windows\System\JDSQYUL.exe
Size 2.8MB
SHA256 a601a050b44c8720c89aca8e22a0f6e3c8e142a904ed3f329e1d4a60a275566b
MD5 e9493485c096b402c83939313728bc57
SHA1 35a01623ac14d833894d47d0315cac349d5c48e7
SHA512 38586e92280c731b0e89950c5553a1a067d6d03d87f4c36d479c8cb58d70e621400f51f103e80d9e9b1cba0c99fbb118961018bec5c79a9446991af38ec464bd
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBb:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R/
MD5 SHA1 SHA512 SSDEEP

Submit Download

KGKpizZ.exe

Path C:\Windows\System\KGKpizZ.exe
Size 2.8MB
SHA256 108cb9446d2185cd34ace2b16e973ef9d77848b926ac8f7f148cbe6ca815ffd3
MD5 3d38315814241176b68ed0609ecf12c3
SHA1 cdfdcc0ec2110ab2837c848ec8794a5bcf0b1bbe
SHA512 f2fddec6f2b53f8a0869a8880a0d7288a019f939e1c55f24d280ef4abdca36359559964d547781de3175a8e479706468513a136fb7eccb5b306fa3e997ff5509
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBT:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R/
MD5 SHA1 SHA512 SSDEEP

Submit Download

KausrPN.exe

Path C:\Windows\System\KausrPN.exe
Size 2.9MB
SHA256 1a82b7e52d01d33680aba257500b20f2ff926fe7f9fef08534486bbe15cbb7fa
MD5 4aee99ef6110abdde209c5aa293b9363
SHA1 60f37b79cb3aa327d4142fb8af3c4a2d1ded1f4a
SHA512 8554d161168cd1d9ca6969c762fb22d6e43bb4feb00fb697d14f21df6c6eb63457665291b9be24768faa48185d4a232ae080716df4b7e3afaa62cf64dee12e7f
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXB7:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rv
MD5 SHA1 SHA512 SSDEEP

Submit Download

NJnSgNB.exe

Path C:\Windows\System\NJnSgNB.exe
Size 2.8MB
SHA256 902b891b90366de53fbf8e8ceb40451b656353b33ecef501206b6c27ad460738
MD5 6fd3594a6b984df8ea4699371ef37df6
SHA1 74dad0cca9bacecda9910559e8740997f26e2434
SHA512 b9b942049654d458f7daec124258a93fcfb43423b4819a53fa42734064b0c3cbd14fe99577cc5b8a7380aba7a03145fcebfea43215e65cfda49524f678e79dde
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBv:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rr
MD5 SHA1 SHA512 SSDEEP

Submit Download

NmLIQYO.exe

Path C:\Windows\System\NmLIQYO.exe
Size 2.8MB
SHA256 e5ca7de8d261734c04be77e77567ea55b7e69e4db03c8c994129b9f8d14cfaac
MD5 4d341035f5e6084b19a7aa1c8eafe95a
SHA1 e7d3b8695aec01fa8bae7c515ed6ca5dcb533e6f
SHA512 523f2d7f9bc5eb5e762e1f4df89340c68b3a4d9f90024ba379f1c62567ffa49f1ef0ff73fa8ad2cd9f53ca808fe4063c081388f7799c266ed4f375949bebd43e
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBX:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RD
MD5 SHA1 SHA512 SSDEEP

Submit Download

OivaOSJ.exe

Path C:\Windows\System\OivaOSJ.exe
Size 2.8MB
SHA256 2bdd5ea6fef2190eafa0b1766bf05ac0f348804a05f711c4617b76237f1d0f1d
MD5 d24f1956d75818c64628a4c34a78fcf0
SHA1 bf9479fc59b39124e4ab626c00b8673728cc2a5c
SHA512 f2a34d2360cd5c4377eaf2f6cc28afa4737ac4dd51599ca18865ca7f122f2e86dbac01c2d7b445c6e4c8612f381d9d967a900fca1164f9786d7626e2a0238b0b
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBK:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Re
MD5 SHA1 SHA512 SSDEEP

Submit Download

PwlAqfY.exe

Path C:\Windows\System\PwlAqfY.exe
Size 8B
SHA256 ada8e0c66fd35906bd1beeda81d420b6e5f6b475841d10e62bd6374afbeacb69
MD5 69a2459cf267ca53a07e1000877ec5f5
SHA1 6180fdab39e41b082a5f032106ea0881035fc630
SHA512 856cc19353d1aa3d8ce28f9d4a1fe10bf85ecb48b19883b3993f89b4192a7bd4dbaf2f158bd3e246dfcbb6a46252185b62c3e867aadc7a9e5bf0721b6b86c55b
MD5 SHA1 SHA512

Submit Download

QgYcefa.exe

Path C:\Windows\System\QgYcefa.exe
Size 2.8MB
SHA256 36e4aeff501b91e7d601de3c87d0ed4fc07f478e77cafa3d98d81a25a47b667f
MD5 9b97386f4ab8b994b52590ce1bab645c
SHA1 a7d7a7707f6ebca2077c63b04ac2cf369abcc7d0
SHA512 2790b145c1f17401ffc320ab2755c538a9cb303b40dc761741ccbf9c01e08534e697acbbf73b2532a13c25b19cab8ceba5b92a9f38854b7f0bb5dd19ce33a751
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBx:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rl
MD5 SHA1 SHA512 SSDEEP

Submit Download

RvacDSo.exe

Path C:\Windows\System\RvacDSo.exe
Size 2.8MB
SHA256 019e7371731344de7e32defcdcd27da8ddcc2a8cf147ac7e4f1a203ca10bbaae
MD5 5edef840676042c54ae59f8e742ac56e
SHA1 df548c1a53c67700f9054397424d4d9d2c5a4ead
SHA512 b8710cc18e430be46505141c4aec2ae5fd3df66aeec1eee2e061cc69305b6264d87ad2b38a56c1339b2240467da411b3dacbb4481c5cb457966036e9c557e6e8
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBN:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

XKBDRsW.exe

Path C:\Windows\System\XKBDRsW.exe
Size 2.8MB
SHA256 57238d39a70d2dd00c77e43f93013d5df5ac2a1716ace707914846d6384c384f
MD5 f69bc7dad347e761a26609d41fa66b14
SHA1 aecd3a397b532bc1cb0e0f8ce05637d783d1dbbf
SHA512 a20fd02dd030973efd5a96653559c78b037f177eda04dd9f649783589ea06f367149a217418d4e97f460420b729711fe885323e7691e045e67061f2b68371a8c
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBT:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rn
MD5 SHA1 SHA512 SSDEEP

Submit Download

XkJIiPG.exe

Path C:\Windows\System\XkJIiPG.exe
Size 2.8MB
SHA256 f4942abc3b4b2bd15b149cc6a769d8038c536d1f387df29080a4187f84e2cd8a
MD5 b337fe8bf24b0d9886e286df64ba1fe8
SHA1 473dbc54e3945ebf3f0e0cdff4522093dbaac230
SHA512 8c428d226559ee6336b3862c51fce39cd466a89315a296fdf7450129a2ae7f16402630362765c88fe4767982377d75e0838955322ff9d0be162d5828a91a6a00
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBn:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RL
MD5 SHA1 SHA512 SSDEEP

Submit Download

XzMIeSD.exe

Path C:\Windows\System\XzMIeSD.exe
Size 2.8MB
SHA256 54e36023777d0030fd647455c7b9b884ea8e9d4185ecf3e2c4c2d5f1f72b4171
MD5 15f93eea95aeff04e195efdc99c8cc2c
SHA1 4d7d9e39e082071268adb42de0c3a6edfc68eaf8
SHA512 655a3fc085cc6312425aedf1f907b0f60d2d3ce1f1f50a44b3bb197dcd64f5c26929907545f3cde41b5e926e08b71b72db96cb2b389c38d707fd229abb1fe2cb
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBV:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R5
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZQzDGSZ.exe

Path C:\Windows\System\ZQzDGSZ.exe
Size 2.8MB
SHA256 746618bc131fb3730dc712178915282b3904fa3c6e37034d3ca2c08ce6168e04
MD5 f059d3710c47c253c30b482a3eb09bf9
SHA1 a27395755920fa353f09fa8816faa125161a81f9
SHA512 f6bef1f72106d9bb4f56bbcc3a1a63999eec48b6bd714dadc42a8c4795b5ef2cef538077597832b67f43029682a6d19673124d2347b6ddc14d0f2dc1e070cde8
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBV:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R5
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZvNtBac.exe

Path C:\Windows\System\ZvNtBac.exe
Size 2.8MB
SHA256 152fca464bf4f1885c7f1637443b45d66e8761e9ce1805a510ac84ac946ac8d7
MD5 22cec0b9b677b559c98f17aaa66691d9
SHA1 0b807e6bbfa3f8040cae9fe8514fab0b555dc7b3
SHA512 1b70c2b5089a8b4dd4800077048964bfe4616d559b658c196fc700563d3e3fa02cf9c056ed21b1efd899b236e6c82f93f8abff7c58a158892de707ba6e496253
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBd:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rx
MD5 SHA1 SHA512 SSDEEP

Submit Download

aYxJfLz.exe

Path C:\Windows\System\aYxJfLz.exe
Size 2.8MB
SHA256 354d8d2d7f4420179feaf06ae145b055cb98c7489d54f6c3c8ad436e1c064bb9
MD5 b565500e69757b60ac9b603a65672a77
SHA1 97b90f5d42d9be2268fac3f511bb09d2573775f7
SHA512 4df0680c0baa9aac9a62bdcdfd878dbce8779edafaa304fd5ff5a7659c721c5b7f168e79fb4ac8f20984abe778b5a16380c2d6cc2f7e705aab7c8d8213467314
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBt:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rh
MD5 SHA1 SHA512 SSDEEP

Submit Download

dMqMkmj.exe

Path C:\Windows\System\dMqMkmj.exe
Size 2.9MB
SHA256 b378955e5dab1441b84956bab9c6f614ddcc80c68aec0cb3f23033494f36cd0d
MD5 98881fbd61d839e3cf6972f328a88d1a
SHA1 c74ac7f625767ec2d5e83525e86dac59d32127b1
SHA512 49306d6e064445611ef6d8bb126a7c85600cc364f4fa9326e7ec83dc74eb5dee59d305ff46e4743c2cc69fe26f62af0ac6dad4780283dddb841b2e6532a39667
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXB/:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rr
MD5 SHA1 SHA512 SSDEEP

Submit Download

gJnfOwK.exe

Path C:\Windows\System\gJnfOwK.exe
Size 2.8MB
SHA256 cb68f2ed2425f6f2007a9b0fab1829b27cc7fd027e5f95f69320cb9060a1834c
MD5 ee6ad83089979c74b5fbcf7d35412b22
SHA1 9009037b0b4e90766c102aedba2640341c89ee6e
SHA512 40510149197381f593ab14396538468e2e371902004b3d77110656e8835428e71011ce5eb50328e4aa4027edd2995d9ac77d05ff45f15f0f210f79ab69020967
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBa:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Ru
MD5 SHA1 SHA512 SSDEEP

Submit Download

gMeNKHU.exe

Path C:\Windows\System\gMeNKHU.exe
Size 2.8MB
SHA256 9e366534da48339a9df6b09ade0ceb1139f54e3c7865b1aecb9379362454ebbc
MD5 8610a6e25d499a9b809fae3104d4483c
SHA1 abf77a67b785d321cb1c5c0a4edd2c24d4765e61
SHA512 cf6bbc9fccdc18d1d41834ad93fe20d4f75f99cdc68a7d0ff85179b2cb7825421f4d5c4146a938607e290e05a21e4b3e02756a2fcbf4815aebfd78fc3c14a679
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBd:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rx
MD5 SHA1 SHA512 SSDEEP

Submit Download

hakXHSN.exe

Path C:\Windows\System\hakXHSN.exe
Size 2.8MB
SHA256 d11c3d9d4492fe885a7cf7741bcf36e6d0336fe0e89a3a580a299f944299a747
MD5 b0756f88302b27d37c1d63cef39a8684
SHA1 26b1ac2236196e851d346e5bc354bd4c2b32248f
SHA512 f255f153bed0265f9af826abcfa890764867743003e517ebd4c04ce9c9f2c698a945bf389d3eaa898b8e3181e351aa794406a48286f5f82ae752e6d703bc7f61
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBl:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rx
MD5 SHA1 SHA512 SSDEEP

Submit Download

ibaOdYr.exe

Path C:\Windows\System\ibaOdYr.exe
Size 2.9MB
SHA256 7fb4df00b6e9e12488295e7fa287d78bfd5d8a269a414c6b3011d1258f5071f4
MD5 5f37e0bc8c54fd3e70da8615b848bf0c
SHA1 a3240c7602e0489e06ce1538d875d532c992abee
SHA512 d20bacd834491d206223581807e4fdef66d64be11130612b87a77847ee7210145af99d6cff03e8cc0efc1f8b89939bd9ba31b091547aaa7208e25a3061a68908
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXB+:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rq
MD5 SHA1 SHA512 SSDEEP

Submit Download

kDoPyBl.exe

Path C:\Windows\System\kDoPyBl.exe
Size 2.8MB
SHA256 d6fd7ced1b4d81523d3309df00a8fe2225b218351d281d625b5b0a5c3647353d
MD5 921d1093c331ff88bec5e7c1d5c31154
SHA1 32c3e8538277a64cb679072479d0c765daeb5f37
SHA512 4d104f7a83a3dd589bf9584b44cd88399f87861d791669fedb0ae75be392c041849d7ff75c1ae64f2404061872c1b9eea66626b0be9e23904144ead8f8bd1a7e
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBy:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rm
MD5 SHA1 SHA512 SSDEEP

Submit Download

mrBZNsQ.exe

Path C:\Windows\System\mrBZNsQ.exe
Size 2.8MB
SHA256 6953177b233c3b06607142ead8fd5eae170fca84ca35bb034e5fea7df744c563
MD5 3804fa775f7b106187fd50a4e11d663f
SHA1 e6aa7e5cdf961419bf75e084910173cd4f9876be
SHA512 63bccb9981894ae2d4729afb3ab22be59c2065589312bfd3aca0d9e6cd085af8388cc73299bd0c7badb0761752e5c1c1b40927092a12764cf46dd5a5de7c641e
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBA:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RM
MD5 SHA1 SHA512 SSDEEP

Submit Download

naNdIKU.exe

Path C:\Windows\System\naNdIKU.exe
Size 2.8MB
SHA256 e0c1ff0e6d738bffe9b0b862c3a23be5d59d63fcd5edf6416286c6f8a614af3b
MD5 f0e97bc06fbeacb5717e04f23ccf72df
SHA1 bf95601ad0011555490f59c3a1726e124eaffe08
SHA512 e25954bc1998e3fff936311a869bfab51b125ce54d8f75c94f656ec6e3549c6bcbb9d4cb45dc3f63d15ae8c878c02d38fa9fb696422190f7ff835a352875961e
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBY:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RM
MD5 SHA1 SHA512 SSDEEP

Submit Download

pjIXZzK.exe

Path C:\Windows\System\pjIXZzK.exe
Size 2.9MB
SHA256 0866742d3f9814e362ee15090bbe1cc8d67604293d830b263ecb9e449187e5a8
MD5 debd3993128048624541e6f98acf4772
SHA1 4bfc351fe1dc1b8d1e7bee80032483537f5a2990
SHA512 d6704f44a1b3e74baed1692f803f3292c19c931db338a5566910c43c1e249f5acba7f9bb6b1ae4288d8be3b539c51706ee75529b4c0ccf3d87814064ce02d1b2
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBr:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rv
MD5 SHA1 SHA512 SSDEEP

Submit Download

qXeXwjh.exe

Path C:\Windows\System\qXeXwjh.exe
Size 2.8MB
SHA256 b04efd8c0ad0311453192cee4ddc13fbd400dfb1d089dbdd46addace5a15329f
MD5 481722781eb7c74b58ff59969e7b0a5a
SHA1 d2defbd56178765c75ccf3ec3098f4837973b5a1
SHA512 5214607e89937a7005ba21ae7c6c4af570fa61c80b10df7d1ef3e1ad874948ef8f639f2a6964ea42ce684248b3d21ebfd2681ef7e41b1fad038a8b1ece3b804e
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBJ:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

tGtSGzn.exe

Path C:\Windows\System\tGtSGzn.exe
Size 2.8MB
SHA256 271e476bdc2333b8eeb84b8057945849b77854928ceca1e44aa65473d1db03ef
MD5 a6ceb00b61279fbfe223ba989cb91201
SHA1 2d8eb0d28ea8df2147c797b8c8e88d9e2d105214
SHA512 965c014cc599991b423e3ee9fa80298fb00c059285023945da3408594a3ff4bf0b0a814871159386eddc17b78f4b5b330c8cd917682b7f3397491be595d51414
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBX:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rr
MD5 SHA1 SHA512 SSDEEP

Submit Download

uSguBio.exe

Path C:\Windows\System\uSguBio.exe
Size 2.9MB
SHA256 3a1779a7ffce8c197eb46cc51ea0e4b8251c510ed7aa83892f5ddf80c1bc83d3
MD5 15ccc08a16a329df3435b14c5d9dead8
SHA1 80e181113c53954e53808db8472af5aa0ba2b316
SHA512 db36fb39e7de1faaaa29a92dbf4e666dc2d86ef6036668f6da16e92437b92a095abbc6bf20aa8182a1da2b75406974f4eb100a276902ebcdb31307c46cc8f6e1
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBK:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RW
MD5 SHA1 SHA512 SSDEEP

Submit Download

wnPiQHC.exe

Path C:\Windows\System\wnPiQHC.exe
Size 2.8MB
SHA256 6b24ff13c0a2091f8b85d2c8b2d6b05c32f5c53c00ebff8a65fed00226110cd0
MD5 be8979d89586eb70dcb8522f2173eb4a
SHA1 50336e259b86f812553b43c25255ad40ae224c56
SHA512 2992e2781c344f35faaaae459134af9211a45e0d0d2c4cdb877d67f8dcc7feab647ba76ee057ac96bc6e4ce0479a17b00e76086e6d464e0badeb165fc21df534
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXB1:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rx
MD5 SHA1 SHA512 SSDEEP

Submit Download

xihUQMK.exe

Path C:\Windows\System\xihUQMK.exe
Size 2.8MB
SHA256 a2eca22296affa6e4516ff288273861093c9d67d50bde083c20fe3c9b79cd87a
MD5 7f1bbaa480f30839bd832865079bddf9
SHA1 3465b0fafd349769dd97edd1c1107204c0c27f04
SHA512 58b9373a268ccfb5e34aec12ebb92e39dd76f0616dba0976d8312bbb73d465520c42781f910655e4d4f53721a28b75161b1b67294d401b70f70f6874ca556bb7
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBx:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RN
MD5 SHA1 SHA512 SSDEEP

Submit Download

zAzupHC.exe

Path C:\Windows\System\zAzupHC.exe
Size 2.8MB
SHA256 82c529748b3924657271e8aeb6cca58afc5a23bdee341092c182aff0b4184b73
MD5 467bb1a5554a571ce7029d0a0538f54a
SHA1 23967c96730ded03119242aee8aa52c8e0be9ad8
SHA512 382767ecfe10158fbf98a0855bd2594023212f8156826a3a85f2eb83c44c2c247d853d0b2e8ce594abbf87051b76f407a70577d1a0bd030291fa74d1f59f261c
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBA:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/316-956-0x00007FF6DE040000-0x00007FF6DE436000-memory.dmp

Download

memory/316-2197-0x00007FF6DE040000-0x00007FF6DE436000-memory.dmp

Download

memory/876-31-0x00007FF680340000-0x00007FF680736000-memory.dmp

Download

memory/876-2190-0x00007FF680340000-0x00007FF680736000-memory.dmp

Download

memory/1160-989-0x00007FF709140000-0x00007FF709536000-memory.dmp

Download

memory/1160-2211-0x00007FF709140000-0x00007FF709536000-memory.dmp

Download

memory/1164-73-0x00007FF6EF150000-0x00007FF6EF546000-memory.dmp

Download

memory/1164-2195-0x00007FF6EF150000-0x00007FF6EF546000-memory.dmp

Download

memory/1448-2210-0x00007FF7E9F90000-0x00007FF7EA386000-memory.dmp

Download

memory/1448-975-0x00007FF7E9F90000-0x00007FF7EA386000-memory.dmp

Download

memory/1892-88-0x00007FF60F300000-0x00007FF60F6F6000-memory.dmp

Download

memory/1892-2207-0x00007FF60F300000-0x00007FF60F6F6000-memory.dmp

Download

memory/2132-66-0x00007FF798C10000-0x00007FF799006000-memory.dmp

Download

memory/2132-2191-0x00007FF798C10000-0x00007FF799006000-memory.dmp

Download

memory/2680-978-0x00007FF642C30000-0x00007FF643026000-memory.dmp

Download

memory/2680-2204-0x00007FF642C30000-0x00007FF643026000-memory.dmp

Download

memory/2792-2202-0x00007FF6142E0000-0x00007FF6146D6000-memory.dmp

Download

memory/2792-984-0x00007FF6142E0000-0x00007FF6146D6000-memory.dmp

Download

memory/2900-967-0x00007FF7B11C0000-0x00007FF7B15B6000-memory.dmp

Download

memory/2900-2209-0x00007FF7B11C0000-0x00007FF7B15B6000-memory.dmp

Download

memory/2968-2203-0x00007FF79D690000-0x00007FF79DA86000-memory.dmp

Download

memory/2968-973-0x00007FF79D690000-0x00007FF79DA86000-memory.dmp

Download

memory/3196-92-0x00007FF639880000-0x00007FF639C76000-memory.dmp

Download

memory/3196-2206-0x00007FF639880000-0x00007FF639C76000-memory.dmp

Download

memory/3280-957-0x00007FF77C6B0000-0x00007FF77CAA6000-memory.dmp

Download

memory/3280-2198-0x00007FF77C6B0000-0x00007FF77CAA6000-memory.dmp

Download

memory/3568-101-0x00007FF744FA0000-0x00007FF745396000-memory.dmp

Download

memory/3568-2196-0x00007FF744FA0000-0x00007FF745396000-memory.dmp

Download

memory/3624-95-0x00007FF7C27E0000-0x00007FF7C2BD6000-memory.dmp

Download

memory/3624-2200-0x00007FF7C27E0000-0x00007FF7C2BD6000-memory.dmp

Download

memory/3656-2205-0x00007FF6F0C90000-0x00007FF6F1086000-memory.dmp

Download

memory/3656-84-0x00007FF6F0C90000-0x00007FF6F1086000-memory.dmp

Download

memory/3656-2187-0x00007FF6F0C90000-0x00007FF6F1086000-memory.dmp

Download

memory/3712-2186-0x00007FF7DA0A0000-0x00007FF7DA496000-memory.dmp

Download

memory/3712-2193-0x00007FF7DA0A0000-0x00007FF7DA496000-memory.dmp

Download

memory/3712-48-0x00007FF7DA0A0000-0x00007FF7DA496000-memory.dmp

Download

memory/3752-986-0x00007FF6F62D0000-0x00007FF6F66C6000-memory.dmp

Download

memory/3752-2208-0x00007FF6F62D0000-0x00007FF6F66C6000-memory.dmp

Download

memory/3920-2199-0x00007FF66D8A0000-0x00007FF66DC96000-memory.dmp

Download

memory/3920-98-0x00007FF66D8A0000-0x00007FF66DC96000-memory.dmp

Download

memory/4068-431-0x000002B8E81C0000-0x000002B8E8966000-memory.dmp

Download

memory/4068-61-0x00007FFFA3D00000-0x00007FFFA47C1000-memory.dmp

Download

memory/4068-40-0x000002B8E6140000-0x000002B8E6162000-memory.dmp

Download

memory/4068-2183-0x00007FFFA3D03000-0x00007FFFA3D05000-memory.dmp

Download

memory/4068-22-0x00007FFFA3D00000-0x00007FFFA47C1000-memory.dmp

Download

memory/4068-2184-0x00007FFFA3D00000-0x00007FFFA47C1000-memory.dmp

Download

memory/4068-3-0x00007FFFA3D03000-0x00007FFFA3D05000-memory.dmp

Download

memory/4244-1-0x000001ACBDF30000-0x000001ACBDF40000-memory.dmp

Download

memory/4244-0-0x00007FF7DA760000-0x00007FF7DAB56000-memory.dmp

Download

memory/4652-2192-0x00007FF702B20000-0x00007FF702F16000-memory.dmp

Download

memory/4652-39-0x00007FF702B20000-0x00007FF702F16000-memory.dmp

Download

memory/4652-2185-0x00007FF702B20000-0x00007FF702F16000-memory.dmp

Download

memory/4816-2188-0x00007FF7A2680000-0x00007FF7A2A76000-memory.dmp

Download

memory/4816-27-0x00007FF7A2680000-0x00007FF7A2A76000-memory.dmp

Download

memory/5000-70-0x00007FF6E5D90000-0x00007FF6E6186000-memory.dmp

Download

memory/5000-2194-0x00007FF6E5D90000-0x00007FF6E6186000-memory.dmp

Download

memory/5080-24-0x00007FF7D8280000-0x00007FF7D8676000-memory.dmp

Download

memory/5080-2189-0x00007FF7D8280000-0x00007FF7D8676000-memory.dmp

Download

memory/5084-983-0x00007FF619F30000-0x00007FF61A326000-memory.dmp

Download

memory/5084-2201-0x00007FF619F30000-0x00007FF61A326000-memory.dmp

Download