xmrig | 7a7829b8dd22bbb148d02e9af5c2c3b0c24d13bd3b70f79159058d90424b51ec

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 10:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
Size 1.6MB
Sample240527-m3dvdsha71
SHA256 7a7829b8dd22bbb148d02e9af5c2c3b0c24d13bd3b70f79159058d90424b51ec
MD5 00aa34137c5f5cb089937a6e890fd600
SHA1 1a7988faa4e5dacc6cf06cc0ebc3870e4f8e7da4
SHA512 b5f6bda3a8c7a7033d5e4daf57b09d5664b7441921634b31c8d865309920fbbcba5fb7dea92bf78cd7c4dadedaa730f87c54efa45b140f22c13530a6d15e806f
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbqoBQ0i1DFK8M5:Lz071uv4BPMkHC0IlnASEx/mi1DI8s
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 50 IoCs

miner

resource	yara_rule
behavioral2/memory/3656-167-0x00007FF7ED170000-0x00007FF7ED562000-memory.dmp	xmrig
behavioral2/memory/1388-166-0x00007FF6489D0000-0x00007FF648DC2000-memory.dmp	xmrig
behavioral2/memory/3948-165-0x00007FF7B1CC0000-0x00007FF7B20B2000-memory.dmp	xmrig
behavioral2/memory/4828-123-0x00007FF6384A0000-0x00007FF638892000-memory.dmp	xmrig
behavioral2/memory/4064-120-0x00007FF71BD70000-0x00007FF71C162000-memory.dmp	xmrig
behavioral2/memory/2624-117-0x00007FF66BED0000-0x00007FF66C2C2000-memory.dmp	xmrig
behavioral2/memory/1728-113-0x00007FF6D7C20000-0x00007FF6D8012000-memory.dmp	xmrig
behavioral2/memory/3664-107-0x00007FF726FD0000-0x00007FF7273C2000-memory.dmp	xmrig
behavioral2/memory/3084-106-0x00007FF761630000-0x00007FF761A22000-memory.dmp	xmrig
behavioral2/memory/5080-96-0x00007FF658860000-0x00007FF658C52000-memory.dmp	xmrig
behavioral2/memory/1068-90-0x00007FF622470000-0x00007FF622862000-memory.dmp	xmrig
behavioral2/memory/1236-89-0x00007FF6DAAD0000-0x00007FF6DAEC2000-memory.dmp	xmrig
behavioral2/memory/1796-83-0x00007FF78EF00000-0x00007FF78F2F2000-memory.dmp	xmrig
behavioral2/memory/2380-1202-0x00007FF70EEC0000-0x00007FF70F2B2000-memory.dmp	xmrig
behavioral2/memory/1136-2077-0x00007FF6A7E20000-0x00007FF6A8212000-memory.dmp	xmrig
behavioral2/memory/5104-2075-0x00007FF6B43D0000-0x00007FF6B47C2000-memory.dmp	xmrig
behavioral2/memory/5108-2079-0x00007FF7A1B40000-0x00007FF7A1F32000-memory.dmp	xmrig
behavioral2/memory/4104-2078-0x00007FF717540000-0x00007FF717932000-memory.dmp	xmrig
behavioral2/memory/1804-2080-0x00007FF7D3A70000-0x00007FF7D3E62000-memory.dmp	xmrig
behavioral2/memory/2760-2101-0x00007FF66FD00000-0x00007FF6700F2000-memory.dmp	xmrig
behavioral2/memory/1352-2102-0x00007FF6F35D0000-0x00007FF6F39C2000-memory.dmp	xmrig
behavioral2/memory/4828-2115-0x00007FF6384A0000-0x00007FF638892000-memory.dmp	xmrig
behavioral2/memory/4076-2117-0x00007FF647CE0000-0x00007FF6480D2000-memory.dmp	xmrig
behavioral2/memory/540-2116-0x00007FF726930000-0x00007FF726D22000-memory.dmp	xmrig
behavioral2/memory/2328-2118-0x00007FF7D4C90000-0x00007FF7D5082000-memory.dmp	xmrig
behavioral2/memory/1276-2119-0x00007FF7B9C30000-0x00007FF7BA022000-memory.dmp	xmrig
behavioral2/memory/1388-2121-0x00007FF6489D0000-0x00007FF648DC2000-memory.dmp	xmrig
behavioral2/memory/1136-2147-0x00007FF6A7E20000-0x00007FF6A8212000-memory.dmp	xmrig
behavioral2/memory/2380-2146-0x00007FF70EEC0000-0x00007FF70F2B2000-memory.dmp	xmrig
behavioral2/memory/5104-2149-0x00007FF6B43D0000-0x00007FF6B47C2000-memory.dmp	xmrig
behavioral2/memory/3664-2155-0x00007FF726FD0000-0x00007FF7273C2000-memory.dmp	xmrig
behavioral2/memory/4104-2153-0x00007FF717540000-0x00007FF717932000-memory.dmp	xmrig
behavioral2/memory/3084-2152-0x00007FF761630000-0x00007FF761A22000-memory.dmp	xmrig
behavioral2/memory/1068-2168-0x00007FF622470000-0x00007FF622862000-memory.dmp	xmrig
behavioral2/memory/1236-2173-0x00007FF6DAAD0000-0x00007FF6DAEC2000-memory.dmp	xmrig
behavioral2/memory/2760-2175-0x00007FF66FD00000-0x00007FF6700F2000-memory.dmp	xmrig
behavioral2/memory/1796-2172-0x00007FF78EF00000-0x00007FF78F2F2000-memory.dmp	xmrig
behavioral2/memory/5108-2170-0x00007FF7A1B40000-0x00007FF7A1F32000-memory.dmp	xmrig
behavioral2/memory/5080-2166-0x00007FF658860000-0x00007FF658C52000-memory.dmp	xmrig
behavioral2/memory/1728-2163-0x00007FF6D7C20000-0x00007FF6D8012000-memory.dmp	xmrig
behavioral2/memory/4064-2161-0x00007FF71BD70000-0x00007FF71C162000-memory.dmp	xmrig
behavioral2/memory/2624-2158-0x00007FF66BED0000-0x00007FF66C2C2000-memory.dmp	xmrig
behavioral2/memory/1804-2159-0x00007FF7D3A70000-0x00007FF7D3E62000-memory.dmp	xmrig
behavioral2/memory/1352-2199-0x00007FF6F35D0000-0x00007FF6F39C2000-memory.dmp	xmrig
behavioral2/memory/1276-2197-0x00007FF7B9C30000-0x00007FF7BA022000-memory.dmp	xmrig
behavioral2/memory/4076-2184-0x00007FF647CE0000-0x00007FF6480D2000-memory.dmp	xmrig
behavioral2/memory/3656-2181-0x00007FF7ED170000-0x00007FF7ED562000-memory.dmp	xmrig
behavioral2/memory/540-2186-0x00007FF726930000-0x00007FF726D22000-memory.dmp	xmrig
behavioral2/memory/2328-2179-0x00007FF7D4C90000-0x00007FF7D5082000-memory.dmp	xmrig
behavioral2/memory/4828-2372-0x00007FF6384A0000-0x00007FF638892000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
9	3476	powershell.exe
11	3476	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3476	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1388	yjJelYL.exe
2380	KytIMvm.exe
5104	pEMBsAF.exe
1136	zcusbPM.exe
4104	GcFGEiL.exe
5108	PZvlojp.exe
3084	dNgvDLk.exe
3664	jWCHbaL.exe
1796	BwwKYGe.exe
1236	rOMqhJr.exe
1068	UpkfJjG.exe
5080	nNUVShF.exe
1728	CYfFNWI.exe
2624	YVZmVDt.exe
4064	VNpvKDX.exe
1804	UlFrOJh.exe
4828	tcVfbUQ.exe
2760	jhTwqOO.exe
1352	DvNTMEU.exe
540	AtglBcu.exe
4076	JbnxYUb.exe
2328	dnwzcWC.exe
1276	oaolcpU.exe
3656	tDXnAMx.exe
1760	PtbvnoQ.exe
2996	KmjtaHZ.exe
4672	WraDFfO.exe
4408	VHnfouU.exe
1060	EnVytEL.exe
4708	yKEmwqg.exe
1264	KHfVunb.exe
820	lzHSPfN.exe
2084	ENxbrgK.exe
2280	OwWQEvy.exe
3372	ifvYelK.exe
2784	OFhcGcE.exe
3052	yhyqUcl.exe
2968	sSbXQkB.exe
4872	Bevykbc.exe
3516	TGuhrkU.exe
4996	DeoIDsx.exe
1852	NyNqvia.exe
4108	rTjUpBV.exe
3904	ROxFMVq.exe
1700	xKGxdoI.exe
4156	tqJgJvM.exe
2252	tIOOFqP.exe
3048	HdmEFDl.exe
4184	wTkwSUt.exe
4808	BTdhLNx.exe
3848	nvuYEUm.exe
4216	BXDpSqF.exe
4328	RHHsIjW.exe
3588	ZJpJlMt.exe
448	pHpmwlq.exe
5044	mHAmCpu.exe
1076	fyabkEo.exe
2064	OYAUGdd.exe
1320	PXzAnyM.exe
3804	BzjBXor.exe
1112	dwNmWwK.exe
3728	acYwnOL.exe
392	bFfYTqo.exe
868	jmvrZzh.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3948-0-0x00007FF7B1CC0000-0x00007FF7B20B2000-memory.dmp	upx
behavioral2/files/0x0008000000023402-5.dat	upx
behavioral2/files/0x0007000000023406-11.dat	upx
behavioral2/memory/1136-29-0x00007FF6A7E20000-0x00007FF6A8212000-memory.dmp	upx
behavioral2/files/0x0007000000023409-45.dat	upx
behavioral2/files/0x000700000002340e-55.dat	upx
behavioral2/files/0x0007000000023411-82.dat	upx
behavioral2/files/0x0008000000023414-95.dat	upx
behavioral2/memory/1804-100-0x00007FF7D3A70000-0x00007FF7D3E62000-memory.dmp	upx
behavioral2/files/0x0007000000023417-134.dat	upx
behavioral2/files/0x000700000002341a-144.dat	upx
behavioral2/files/0x0007000000023424-200.dat	upx
behavioral2/files/0x0007000000023422-198.dat	upx
behavioral2/files/0x0007000000023423-195.dat	upx
behavioral2/files/0x0007000000023421-193.dat	upx
behavioral2/files/0x0007000000023420-188.dat	upx
behavioral2/files/0x000700000002341f-183.dat	upx
behavioral2/files/0x000700000002341e-178.dat	upx
behavioral2/files/0x000700000002341d-173.dat	upx
behavioral2/files/0x000700000002341c-168.dat	upx
behavioral2/memory/3656-167-0x00007FF7ED170000-0x00007FF7ED562000-memory.dmp	upx
behavioral2/memory/1388-166-0x00007FF6489D0000-0x00007FF648DC2000-memory.dmp	upx
behavioral2/memory/3948-165-0x00007FF7B1CC0000-0x00007FF7B20B2000-memory.dmp	upx
behavioral2/files/0x000700000002341b-160.dat	upx
behavioral2/memory/1276-159-0x00007FF7B9C30000-0x00007FF7BA022000-memory.dmp	upx
behavioral2/memory/2328-153-0x00007FF7D4C90000-0x00007FF7D5082000-memory.dmp	upx
behavioral2/files/0x0007000000023419-148.dat	upx
behavioral2/memory/4076-147-0x00007FF647CE0000-0x00007FF6480D2000-memory.dmp	upx
behavioral2/files/0x0007000000023418-142.dat	upx
behavioral2/memory/540-141-0x00007FF726930000-0x00007FF726D22000-memory.dmp	upx
behavioral2/files/0x0008000000023413-136.dat	upx
behavioral2/memory/1352-133-0x00007FF6F35D0000-0x00007FF6F39C2000-memory.dmp	upx
behavioral2/memory/2760-129-0x00007FF66FD00000-0x00007FF6700F2000-memory.dmp	upx
behavioral2/files/0x0008000000023403-125.dat	upx
behavioral2/memory/4828-123-0x00007FF6384A0000-0x00007FF638892000-memory.dmp	upx
behavioral2/memory/4064-120-0x00007FF71BD70000-0x00007FF71C162000-memory.dmp	upx
behavioral2/files/0x0007000000023416-118.dat	upx
behavioral2/memory/2624-117-0x00007FF66BED0000-0x00007FF66C2C2000-memory.dmp	upx
behavioral2/memory/1728-113-0x00007FF6D7C20000-0x00007FF6D8012000-memory.dmp	upx
behavioral2/memory/3664-107-0x00007FF726FD0000-0x00007FF7273C2000-memory.dmp	upx
behavioral2/memory/3084-106-0x00007FF761630000-0x00007FF761A22000-memory.dmp	upx
behavioral2/files/0x0007000000023415-104.dat	upx
behavioral2/memory/5080-96-0x00007FF658860000-0x00007FF658C52000-memory.dmp	upx
behavioral2/files/0x0007000000023412-92.dat	upx
behavioral2/memory/1068-90-0x00007FF622470000-0x00007FF622862000-memory.dmp	upx
behavioral2/memory/1236-89-0x00007FF6DAAD0000-0x00007FF6DAEC2000-memory.dmp	upx
behavioral2/memory/1796-83-0x00007FF78EF00000-0x00007FF78F2F2000-memory.dmp	upx
behavioral2/files/0x0007000000023410-81.dat	upx
behavioral2/files/0x000700000002340f-78.dat	upx
behavioral2/files/0x000700000002340b-77.dat	upx
behavioral2/memory/5108-75-0x00007FF7A1B40000-0x00007FF7A1F32000-memory.dmp	upx
behavioral2/files/0x000700000002340d-72.dat	upx
behavioral2/files/0x000700000002340c-60.dat	upx
behavioral2/files/0x000700000002340a-46.dat	upx
behavioral2/memory/4104-44-0x00007FF717540000-0x00007FF717932000-memory.dmp	upx
behavioral2/files/0x0007000000023407-31.dat	upx
behavioral2/memory/5104-25-0x00007FF6B43D0000-0x00007FF6B47C2000-memory.dmp	upx
behavioral2/files/0x0007000000023408-33.dat	upx
behavioral2/memory/2380-14-0x00007FF70EEC0000-0x00007FF70F2B2000-memory.dmp	upx
behavioral2/memory/1388-10-0x00007FF6489D0000-0x00007FF648DC2000-memory.dmp	upx
behavioral2/memory/2380-1202-0x00007FF70EEC0000-0x00007FF70F2B2000-memory.dmp	upx
behavioral2/memory/1136-2077-0x00007FF6A7E20000-0x00007FF6A8212000-memory.dmp	upx
behavioral2/memory/5104-2075-0x00007FF6B43D0000-0x00007FF6B47C2000-memory.dmp	upx
behavioral2/memory/5108-2079-0x00007FF7A1B40000-0x00007FF7A1F32000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NxdadTg.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\GpVHpnH.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\JyFRkte.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\SNgONHm.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\QFUHdwY.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\kNaYXmX.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\CWeDNsD.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\hVaHFVN.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\WXoppKY.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\INHrbxw.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\sbiJIVu.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\pNzFEHm.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\CwSeyMd.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\BXDpSqF.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\ARdoCvE.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\pJaKdYx.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\VjqMRnx.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\HjxruaT.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\CDMjOBm.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\agDJQhm.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\qFJnGdP.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\SLPMoha.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\VxvsIES.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\cxUSkpH.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\kevRUEh.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\jiKHFBK.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\oGLJtIt.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\ilZSuqX.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\UHUsoFz.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\kjUCseF.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\PkiGOSA.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\zNubigT.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\YFLWrcK.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\bEUYbdh.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\MEvqjKV.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\nEkoaBW.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\oHQrbeV.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\iMEDekk.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\DpOclVS.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\PZvlojp.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\phzTIqt.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\LkFtQOl.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\munwCwX.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\qXRxWtY.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\yhyqUcl.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\IcnuEnv.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\qZJMqCl.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\aNdKrVq.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\HdmEFDl.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\fneyXJO.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\RewgsFr.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\tkNwhSd.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\ZZtNrPd.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\UrkMZrL.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\YBCjafH.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\UPcQgnQ.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\tqJgJvM.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\fyabkEo.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\wnPUkcK.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\suRSwkV.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\lZMQrNs.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\SLYhEfI.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\AZdjYJo.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
File created	C:\Windows\System\zEKreOj.exe	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3476	powershell.exe
3476	powershell.exe
3476	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
Token: SeDebugPrivilege	3476	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 3476	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	84
PID 3948 wrote to memory of 3476	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	84
PID 3948 wrote to memory of 1388	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	85
PID 3948 wrote to memory of 1388	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	85
PID 3948 wrote to memory of 2380	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	86
PID 3948 wrote to memory of 2380	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	86
PID 3948 wrote to memory of 5104	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	87
PID 3948 wrote to memory of 5104	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	87
PID 3948 wrote to memory of 1136	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	88
PID 3948 wrote to memory of 1136	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	88
PID 3948 wrote to memory of 3084	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	89
PID 3948 wrote to memory of 3084	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	89
PID 3948 wrote to memory of 4104	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	90
PID 3948 wrote to memory of 4104	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	90
PID 3948 wrote to memory of 5108	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	91
PID 3948 wrote to memory of 5108	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	91
PID 3948 wrote to memory of 3664	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	92
PID 3948 wrote to memory of 3664	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	92
PID 3948 wrote to memory of 1796	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	93
PID 3948 wrote to memory of 1796	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	93
PID 3948 wrote to memory of 1236	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	94
PID 3948 wrote to memory of 1236	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	94
PID 3948 wrote to memory of 1068	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	95
PID 3948 wrote to memory of 1068	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	95
PID 3948 wrote to memory of 5080	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	96
PID 3948 wrote to memory of 5080	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	96
PID 3948 wrote to memory of 1728	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	97
PID 3948 wrote to memory of 1728	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	97
PID 3948 wrote to memory of 2624	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	98
PID 3948 wrote to memory of 2624	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	98
PID 3948 wrote to memory of 4064	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	99
PID 3948 wrote to memory of 4064	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	99
PID 3948 wrote to memory of 1804	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	100
PID 3948 wrote to memory of 1804	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	100
PID 3948 wrote to memory of 4828	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	101
PID 3948 wrote to memory of 4828	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	101
PID 3948 wrote to memory of 2760	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	102
PID 3948 wrote to memory of 2760	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	102
PID 3948 wrote to memory of 1352	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	103
PID 3948 wrote to memory of 1352	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	103
PID 3948 wrote to memory of 540	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	104
PID 3948 wrote to memory of 540	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	104
PID 3948 wrote to memory of 4076	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	105
PID 3948 wrote to memory of 4076	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	105
PID 3948 wrote to memory of 2328	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	106
PID 3948 wrote to memory of 2328	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	106
PID 3948 wrote to memory of 1276	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	107
PID 3948 wrote to memory of 1276	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	107
PID 3948 wrote to memory of 3656	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	108
PID 3948 wrote to memory of 3656	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	108
PID 3948 wrote to memory of 1760	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	109
PID 3948 wrote to memory of 1760	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	109
PID 3948 wrote to memory of 2996	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	110
PID 3948 wrote to memory of 2996	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	110
PID 3948 wrote to memory of 4672	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	111
PID 3948 wrote to memory of 4672	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	111
PID 3948 wrote to memory of 4408	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	112
PID 3948 wrote to memory of 4408	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	112
PID 3948 wrote to memory of 1060	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	113
PID 3948 wrote to memory of 1060	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	113
PID 3948 wrote to memory of 4708	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	114
PID 3948 wrote to memory of 4708	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	114
PID 3948 wrote to memory of 1264	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	115
PID 3948 wrote to memory of 1264	3948	00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\00aa34137c5f5cb089937a6e890fd600_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3476
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3476" "2988" "2892" "2992" "0" "0" "2996" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:4140
- C:\Windows\System\yjJelYL.exe
  C:\Windows\System\yjJelYL.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\KytIMvm.exe
  C:\Windows\System\KytIMvm.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\pEMBsAF.exe
  C:\Windows\System\pEMBsAF.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\zcusbPM.exe
  C:\Windows\System\zcusbPM.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\dNgvDLk.exe
  C:\Windows\System\dNgvDLk.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\GcFGEiL.exe
  C:\Windows\System\GcFGEiL.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\PZvlojp.exe
  C:\Windows\System\PZvlojp.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\jWCHbaL.exe
  C:\Windows\System\jWCHbaL.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\BwwKYGe.exe
  C:\Windows\System\BwwKYGe.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\rOMqhJr.exe
  C:\Windows\System\rOMqhJr.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\UpkfJjG.exe
  C:\Windows\System\UpkfJjG.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\nNUVShF.exe
  C:\Windows\System\nNUVShF.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\CYfFNWI.exe
  C:\Windows\System\CYfFNWI.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\YVZmVDt.exe
  C:\Windows\System\YVZmVDt.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\VNpvKDX.exe
  C:\Windows\System\VNpvKDX.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\UlFrOJh.exe
  C:\Windows\System\UlFrOJh.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\tcVfbUQ.exe
  C:\Windows\System\tcVfbUQ.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\jhTwqOO.exe
  C:\Windows\System\jhTwqOO.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\DvNTMEU.exe
  C:\Windows\System\DvNTMEU.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\AtglBcu.exe
  C:\Windows\System\AtglBcu.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\JbnxYUb.exe
  C:\Windows\System\JbnxYUb.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\dnwzcWC.exe
  C:\Windows\System\dnwzcWC.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\oaolcpU.exe
  C:\Windows\System\oaolcpU.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\tDXnAMx.exe
  C:\Windows\System\tDXnAMx.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\PtbvnoQ.exe
  C:\Windows\System\PtbvnoQ.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\KmjtaHZ.exe
  C:\Windows\System\KmjtaHZ.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\WraDFfO.exe
  C:\Windows\System\WraDFfO.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\VHnfouU.exe
  C:\Windows\System\VHnfouU.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\EnVytEL.exe
  C:\Windows\System\EnVytEL.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\yKEmwqg.exe
  C:\Windows\System\yKEmwqg.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\KHfVunb.exe
  C:\Windows\System\KHfVunb.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\lzHSPfN.exe
  C:\Windows\System\lzHSPfN.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\ENxbrgK.exe
  C:\Windows\System\ENxbrgK.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\OwWQEvy.exe
  C:\Windows\System\OwWQEvy.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\ifvYelK.exe
  C:\Windows\System\ifvYelK.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\OFhcGcE.exe
  C:\Windows\System\OFhcGcE.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\yhyqUcl.exe
  C:\Windows\System\yhyqUcl.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\sSbXQkB.exe
  C:\Windows\System\sSbXQkB.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\Bevykbc.exe
  C:\Windows\System\Bevykbc.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\TGuhrkU.exe
  C:\Windows\System\TGuhrkU.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\DeoIDsx.exe
  C:\Windows\System\DeoIDsx.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\NyNqvia.exe
  C:\Windows\System\NyNqvia.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\rTjUpBV.exe
  C:\Windows\System\rTjUpBV.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\ROxFMVq.exe
  C:\Windows\System\ROxFMVq.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\xKGxdoI.exe
  C:\Windows\System\xKGxdoI.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\tqJgJvM.exe
  C:\Windows\System\tqJgJvM.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\tIOOFqP.exe
  C:\Windows\System\tIOOFqP.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\HdmEFDl.exe
  C:\Windows\System\HdmEFDl.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\wTkwSUt.exe
  C:\Windows\System\wTkwSUt.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\BTdhLNx.exe
  C:\Windows\System\BTdhLNx.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\nvuYEUm.exe
  C:\Windows\System\nvuYEUm.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\BXDpSqF.exe
  C:\Windows\System\BXDpSqF.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\RHHsIjW.exe
  C:\Windows\System\RHHsIjW.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\ZJpJlMt.exe
  C:\Windows\System\ZJpJlMt.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\pHpmwlq.exe
  C:\Windows\System\pHpmwlq.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\mHAmCpu.exe
  C:\Windows\System\mHAmCpu.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\fyabkEo.exe
  C:\Windows\System\fyabkEo.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\OYAUGdd.exe
  C:\Windows\System\OYAUGdd.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\PXzAnyM.exe
  C:\Windows\System\PXzAnyM.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\BzjBXor.exe
  C:\Windows\System\BzjBXor.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\dwNmWwK.exe
  C:\Windows\System\dwNmWwK.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\acYwnOL.exe
  C:\Windows\System\acYwnOL.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\bFfYTqo.exe
  C:\Windows\System\bFfYTqo.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\jmvrZzh.exe
  C:\Windows\System\jmvrZzh.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\qpgBEEV.exe
  C:\Windows\System\qpgBEEV.exe
  2⤵
  PID:5128
- C:\Windows\System\KKrjbBl.exe
  C:\Windows\System\KKrjbBl.exe
  2⤵
  PID:5156
- C:\Windows\System\rrlaYnL.exe
  C:\Windows\System\rrlaYnL.exe
  2⤵
  PID:5188
- C:\Windows\System\TnPkSuU.exe
  C:\Windows\System\TnPkSuU.exe
  2⤵
  PID:5216
- C:\Windows\System\mBhCROB.exe
  C:\Windows\System\mBhCROB.exe
  2⤵
  PID:5240
- C:\Windows\System\uxMpwfn.exe
  C:\Windows\System\uxMpwfn.exe
  2⤵
  PID:5268
- C:\Windows\System\BnoeaZN.exe
  C:\Windows\System\BnoeaZN.exe
  2⤵
  PID:5296
- C:\Windows\System\NEvHmHj.exe
  C:\Windows\System\NEvHmHj.exe
  2⤵
  PID:5328
- C:\Windows\System\BbEPIHj.exe
  C:\Windows\System\BbEPIHj.exe
  2⤵
  PID:5356
- C:\Windows\System\oOpluav.exe
  C:\Windows\System\oOpluav.exe
  2⤵
  PID:5388
- C:\Windows\System\xAtOZRG.exe
  C:\Windows\System\xAtOZRG.exe
  2⤵
  PID:5416
- C:\Windows\System\qQbDocS.exe
  C:\Windows\System\qQbDocS.exe
  2⤵
  PID:5444
- C:\Windows\System\tIXuNsz.exe
  C:\Windows\System\tIXuNsz.exe
  2⤵
  PID:5476
- C:\Windows\System\ZSADtAL.exe
  C:\Windows\System\ZSADtAL.exe
  2⤵
  PID:5500
- C:\Windows\System\mmMEfgH.exe
  C:\Windows\System\mmMEfgH.exe
  2⤵
  PID:5532
- C:\Windows\System\qmgJyka.exe
  C:\Windows\System\qmgJyka.exe
  2⤵
  PID:5560
- C:\Windows\System\oRIfDGu.exe
  C:\Windows\System\oRIfDGu.exe
  2⤵
  PID:5592
- C:\Windows\System\YLdTrkh.exe
  C:\Windows\System\YLdTrkh.exe
  2⤵
  PID:5620
- C:\Windows\System\sBQJsVF.exe
  C:\Windows\System\sBQJsVF.exe
  2⤵
  PID:5648
- C:\Windows\System\DEzTuqs.exe
  C:\Windows\System\DEzTuqs.exe
  2⤵
  PID:5676
- C:\Windows\System\OojPWWk.exe
  C:\Windows\System\OojPWWk.exe
  2⤵
  PID:5704
- C:\Windows\System\SLPMoha.exe
  C:\Windows\System\SLPMoha.exe
  2⤵
  PID:5732
- C:\Windows\System\bTicQCJ.exe
  C:\Windows\System\bTicQCJ.exe
  2⤵
  PID:5756
- C:\Windows\System\HTgPkNm.exe
  C:\Windows\System\HTgPkNm.exe
  2⤵
  PID:5784
- C:\Windows\System\VAfuBLW.exe
  C:\Windows\System\VAfuBLW.exe
  2⤵
  PID:5816
- C:\Windows\System\dJwNlWj.exe
  C:\Windows\System\dJwNlWj.exe
  2⤵
  PID:5844
- C:\Windows\System\lZMQrNs.exe
  C:\Windows\System\lZMQrNs.exe
  2⤵
  PID:5872
- C:\Windows\System\pSjHXDa.exe
  C:\Windows\System\pSjHXDa.exe
  2⤵
  PID:5904
- C:\Windows\System\UMRHeBz.exe
  C:\Windows\System\UMRHeBz.exe
  2⤵
  PID:5932
- C:\Windows\System\EzrtRBk.exe
  C:\Windows\System\EzrtRBk.exe
  2⤵
  PID:5960
- C:\Windows\System\DWCIolI.exe
  C:\Windows\System\DWCIolI.exe
  2⤵
  PID:5988
- C:\Windows\System\AcNqbFt.exe
  C:\Windows\System\AcNqbFt.exe
  2⤵
  PID:6016
- C:\Windows\System\uDqaBNb.exe
  C:\Windows\System\uDqaBNb.exe
  2⤵
  PID:6044
- C:\Windows\System\hxKJcOM.exe
  C:\Windows\System\hxKJcOM.exe
  2⤵
  PID:6068
- C:\Windows\System\gHCmrRY.exe
  C:\Windows\System\gHCmrRY.exe
  2⤵
  PID:6096
- C:\Windows\System\VDYodUT.exe
  C:\Windows\System\VDYodUT.exe
  2⤵
  PID:6128
- C:\Windows\System\FcmMBmI.exe
  C:\Windows\System\FcmMBmI.exe
  2⤵
  PID:3900
- C:\Windows\System\kSPvLPg.exe
  C:\Windows\System\kSPvLPg.exe
  2⤵
  PID:116
- C:\Windows\System\ItHdgXQ.exe
  C:\Windows\System\ItHdgXQ.exe
  2⤵
  PID:4668
- C:\Windows\System\wRpDjbv.exe
  C:\Windows\System\wRpDjbv.exe
  2⤵
  PID:3444
- C:\Windows\System\YXfXtPS.exe
  C:\Windows\System\YXfXtPS.exe
  2⤵
  PID:2832
- C:\Windows\System\ARdoCvE.exe
  C:\Windows\System\ARdoCvE.exe
  2⤵
  PID:5140
- C:\Windows\System\FBJLsnb.exe
  C:\Windows\System\FBJLsnb.exe
  2⤵
  PID:5208
- C:\Windows\System\xDkYTes.exe
  C:\Windows\System\xDkYTes.exe
  2⤵
  PID:5264
- C:\Windows\System\IioDGOG.exe
  C:\Windows\System\IioDGOG.exe
  2⤵
  PID:5344
- C:\Windows\System\qxyqaPG.exe
  C:\Windows\System\qxyqaPG.exe
  2⤵
  PID:5380
- C:\Windows\System\pcnkmPF.exe
  C:\Windows\System\pcnkmPF.exe
  2⤵
  PID:5460
- C:\Windows\System\ToaxQRr.exe
  C:\Windows\System\ToaxQRr.exe
  2⤵
  PID:5520
- C:\Windows\System\OQEYiCB.exe
  C:\Windows\System\OQEYiCB.exe
  2⤵
  PID:5584
- C:\Windows\System\thNhhcj.exe
  C:\Windows\System\thNhhcj.exe
  2⤵
  PID:5660
- C:\Windows\System\rZgvVvl.exe
  C:\Windows\System\rZgvVvl.exe
  2⤵
  PID:5720
- C:\Windows\System\mOrYwpK.exe
  C:\Windows\System\mOrYwpK.exe
  2⤵
  PID:5776
- C:\Windows\System\cGHZJVg.exe
  C:\Windows\System\cGHZJVg.exe
  2⤵
  PID:5828
- C:\Windows\System\FNhdJkM.exe
  C:\Windows\System\FNhdJkM.exe
  2⤵
  PID:5884
- C:\Windows\System\CWeDNsD.exe
  C:\Windows\System\CWeDNsD.exe
  2⤵
  PID:5924
- C:\Windows\System\YssvbEW.exe
  C:\Windows\System\YssvbEW.exe
  2⤵
  PID:1672
- C:\Windows\System\NrKEcVW.exe
  C:\Windows\System\NrKEcVW.exe
  2⤵
  PID:6036
- C:\Windows\System\OdanTsX.exe
  C:\Windows\System\OdanTsX.exe
  2⤵
  PID:1872
- C:\Windows\System\PbWTYBo.exe
  C:\Windows\System\PbWTYBo.exe
  2⤵
  PID:4316
- C:\Windows\System\OgjeUgd.exe
  C:\Windows\System\OgjeUgd.exe
  2⤵
  PID:3592
- C:\Windows\System\FFXoUjB.exe
  C:\Windows\System\FFXoUjB.exe
  2⤵
  PID:3616
- C:\Windows\System\ZLHZCEK.exe
  C:\Windows\System\ZLHZCEK.exe
  2⤵
  PID:5180
- C:\Windows\System\vFfvlMn.exe
  C:\Windows\System\vFfvlMn.exe
  2⤵
  PID:5316
- C:\Windows\System\bViCBYb.exe
  C:\Windows\System\bViCBYb.exe
  2⤵
  PID:2872
- C:\Windows\System\HnSfSWQ.exe
  C:\Windows\System\HnSfSWQ.exe
  2⤵
  PID:5552
- C:\Windows\System\dzFZszC.exe
  C:\Windows\System\dzFZszC.exe
  2⤵
  PID:5692
- C:\Windows\System\oXTpXBY.exe
  C:\Windows\System\oXTpXBY.exe
  2⤵
  PID:5808
- C:\Windows\System\phzTIqt.exe
  C:\Windows\System\phzTIqt.exe
  2⤵
  PID:5864
- C:\Windows\System\vDSrooh.exe
  C:\Windows\System\vDSrooh.exe
  2⤵
  PID:5976
- C:\Windows\System\JVxtKeI.exe
  C:\Windows\System\JVxtKeI.exe
  2⤵
  PID:4968
- C:\Windows\System\hUIUAdd.exe
  C:\Windows\System\hUIUAdd.exe
  2⤵
  PID:3872
- C:\Windows\System\uEQCfgK.exe
  C:\Windows\System\uEQCfgK.exe
  2⤵
  PID:1972
- C:\Windows\System\HaOULFh.exe
  C:\Windows\System\HaOULFh.exe
  2⤵
  PID:5312
- C:\Windows\System\tYRaYXJ.exe
  C:\Windows\System\tYRaYXJ.exe
  2⤵
  PID:5492
- C:\Windows\System\pcEciyF.exe
  C:\Windows\System\pcEciyF.exe
  2⤵
  PID:5632
- C:\Windows\System\aPNQRUn.exe
  C:\Windows\System\aPNQRUn.exe
  2⤵
  PID:5772
- C:\Windows\System\LQwtfkp.exe
  C:\Windows\System\LQwtfkp.exe
  2⤵
  PID:4716
- C:\Windows\System\YOMrAzl.exe
  C:\Windows\System\YOMrAzl.exe
  2⤵
  PID:6032
- C:\Windows\System\JurWoON.exe
  C:\Windows\System\JurWoON.exe
  2⤵
  PID:4984
- C:\Windows\System\kkUhMmd.exe
  C:\Windows\System\kkUhMmd.exe
  2⤵
  PID:4336
- C:\Windows\System\qyiiysF.exe
  C:\Windows\System\qyiiysF.exe
  2⤵
  PID:3628
- C:\Windows\System\kZrcRVH.exe
  C:\Windows\System\kZrcRVH.exe
  2⤵
  PID:5752
- C:\Windows\System\RIoONts.exe
  C:\Windows\System\RIoONts.exe
  2⤵
  PID:3028
- C:\Windows\System\bHwWsKg.exe
  C:\Windows\System\bHwWsKg.exe
  2⤵
  PID:4564
- C:\Windows\System\jCLqyXE.exe
  C:\Windows\System\jCLqyXE.exe
  2⤵
  PID:6176
- C:\Windows\System\RewgsFr.exe
  C:\Windows\System\RewgsFr.exe
  2⤵
  PID:6208
- C:\Windows\System\MsaUwvq.exe
  C:\Windows\System\MsaUwvq.exe
  2⤵
  PID:6228
- C:\Windows\System\thOWjKG.exe
  C:\Windows\System\thOWjKG.exe
  2⤵
  PID:6256
- C:\Windows\System\gPjFefF.exe
  C:\Windows\System\gPjFefF.exe
  2⤵
  PID:6272
- C:\Windows\System\rJSnFHn.exe
  C:\Windows\System\rJSnFHn.exe
  2⤵
  PID:6300
- C:\Windows\System\DnAKqDN.exe
  C:\Windows\System\DnAKqDN.exe
  2⤵
  PID:6328
- C:\Windows\System\PkiGOSA.exe
  C:\Windows\System\PkiGOSA.exe
  2⤵
  PID:6356
- C:\Windows\System\wiutBdd.exe
  C:\Windows\System\wiutBdd.exe
  2⤵
  PID:6384
- C:\Windows\System\EncwKKz.exe
  C:\Windows\System\EncwKKz.exe
  2⤵
  PID:6404
- C:\Windows\System\OZMLqcR.exe
  C:\Windows\System\OZMLqcR.exe
  2⤵
  PID:6420
- C:\Windows\System\lKskKhc.exe
  C:\Windows\System\lKskKhc.exe
  2⤵
  PID:6444
- C:\Windows\System\aklVLzg.exe
  C:\Windows\System\aklVLzg.exe
  2⤵
  PID:6480
- C:\Windows\System\pCmnZhh.exe
  C:\Windows\System\pCmnZhh.exe
  2⤵
  PID:6512
- C:\Windows\System\JguyehP.exe
  C:\Windows\System\JguyehP.exe
  2⤵
  PID:6544
- C:\Windows\System\ZAlPTAv.exe
  C:\Windows\System\ZAlPTAv.exe
  2⤵
  PID:6564
- C:\Windows\System\cBssXEd.exe
  C:\Windows\System\cBssXEd.exe
  2⤵
  PID:6588
- C:\Windows\System\pKuzyij.exe
  C:\Windows\System\pKuzyij.exe
  2⤵
  PID:6624
- C:\Windows\System\ccSNvFp.exe
  C:\Windows\System\ccSNvFp.exe
  2⤵
  PID:6648
- C:\Windows\System\hWlvlqO.exe
  C:\Windows\System\hWlvlqO.exe
  2⤵
  PID:6676
- C:\Windows\System\TTBibvM.exe
  C:\Windows\System\TTBibvM.exe
  2⤵
  PID:6712
- C:\Windows\System\ftmQroX.exe
  C:\Windows\System\ftmQroX.exe
  2⤵
  PID:6732
- C:\Windows\System\XPQrTMX.exe
  C:\Windows\System\XPQrTMX.exe
  2⤵
  PID:6752
- C:\Windows\System\GDJHCph.exe
  C:\Windows\System\GDJHCph.exe
  2⤵
  PID:6780
- C:\Windows\System\yHvfsAr.exe
  C:\Windows\System\yHvfsAr.exe
  2⤵
  PID:6800
- C:\Windows\System\JnGZfYN.exe
  C:\Windows\System\JnGZfYN.exe
  2⤵
  PID:6820
- C:\Windows\System\eAzKXKt.exe
  C:\Windows\System\eAzKXKt.exe
  2⤵
  PID:6872
- C:\Windows\System\ilOAFTw.exe
  C:\Windows\System\ilOAFTw.exe
  2⤵
  PID:6892
- C:\Windows\System\rEPjtde.exe
  C:\Windows\System\rEPjtde.exe
  2⤵
  PID:6924
- C:\Windows\System\lUWzwnR.exe
  C:\Windows\System\lUWzwnR.exe
  2⤵
  PID:6948
- C:\Windows\System\EeOtcwA.exe
  C:\Windows\System\EeOtcwA.exe
  2⤵
  PID:6968
- C:\Windows\System\xgmTFZr.exe
  C:\Windows\System\xgmTFZr.exe
  2⤵
  PID:7016
- C:\Windows\System\njEzoFF.exe
  C:\Windows\System\njEzoFF.exe
  2⤵
  PID:7032
- C:\Windows\System\WfPGxQP.exe
  C:\Windows\System\WfPGxQP.exe
  2⤵
  PID:7056
- C:\Windows\System\cZGtvgF.exe
  C:\Windows\System\cZGtvgF.exe
  2⤵
  PID:7076
- C:\Windows\System\GCQfmad.exe
  C:\Windows\System\GCQfmad.exe
  2⤵
  PID:7104
- C:\Windows\System\SfxdPfh.exe
  C:\Windows\System\SfxdPfh.exe
  2⤵
  PID:7124
- C:\Windows\System\bEUYbdh.exe
  C:\Windows\System\bEUYbdh.exe
  2⤵
  PID:7144
- C:\Windows\System\vcCIeGy.exe
  C:\Windows\System\vcCIeGy.exe
  2⤵
  PID:7160
- C:\Windows\System\BQBTJlU.exe
  C:\Windows\System\BQBTJlU.exe
  2⤵
  PID:6088
- C:\Windows\System\QMqTAcz.exe
  C:\Windows\System\QMqTAcz.exe
  2⤵
  PID:1596
- C:\Windows\System\dUrilzL.exe
  C:\Windows\System\dUrilzL.exe
  2⤵
  PID:2528
- C:\Windows\System\VzXafYn.exe
  C:\Windows\System\VzXafYn.exe
  2⤵
  PID:1920
- C:\Windows\System\HahECUM.exe
  C:\Windows\System\HahECUM.exe
  2⤵
  PID:4452
- C:\Windows\System\hoPiIAH.exe
  C:\Windows\System\hoPiIAH.exe
  2⤵
  PID:6240
- C:\Windows\System\AmbNvvW.exe
  C:\Windows\System\AmbNvvW.exe
  2⤵
  PID:6352
- C:\Windows\System\mNRGyHL.exe
  C:\Windows\System\mNRGyHL.exe
  2⤵
  PID:6452
- C:\Windows\System\tCpLKDD.exe
  C:\Windows\System\tCpLKDD.exe
  2⤵
  PID:6488
- C:\Windows\System\QiMShxU.exe
  C:\Windows\System\QiMShxU.exe
  2⤵
  PID:6508
- C:\Windows\System\tkNwhSd.exe
  C:\Windows\System\tkNwhSd.exe
  2⤵
  PID:6620
- C:\Windows\System\OweNNFO.exe
  C:\Windows\System\OweNNFO.exe
  2⤵
  PID:6664
- C:\Windows\System\zNubigT.exe
  C:\Windows\System\zNubigT.exe
  2⤵
  PID:6744
- C:\Windows\System\DQcpPbX.exe
  C:\Windows\System\DQcpPbX.exe
  2⤵
  PID:6856
- C:\Windows\System\RXryDQG.exe
  C:\Windows\System\RXryDQG.exe
  2⤵
  PID:6900
- C:\Windows\System\cdGgNjf.exe
  C:\Windows\System\cdGgNjf.exe
  2⤵
  PID:6996
- C:\Windows\System\whKWeVG.exe
  C:\Windows\System\whKWeVG.exe
  2⤵
  PID:7072
- C:\Windows\System\VCpmyDV.exe
  C:\Windows\System\VCpmyDV.exe
  2⤵
  PID:7136
- C:\Windows\System\AOAcrKp.exe
  C:\Windows\System\AOAcrKp.exe
  2⤵
  PID:4912
- C:\Windows\System\VxvsIES.exe
  C:\Windows\System\VxvsIES.exe
  2⤵
  PID:3076
- C:\Windows\System\qLxPsrL.exe
  C:\Windows\System\qLxPsrL.exe
  2⤵
  PID:6196
- C:\Windows\System\pJaKdYx.exe
  C:\Windows\System\pJaKdYx.exe
  2⤵
  PID:6428
- C:\Windows\System\oFqbFOs.exe
  C:\Windows\System\oFqbFOs.exe
  2⤵
  PID:6616
- C:\Windows\System\thNgAAS.exe
  C:\Windows\System\thNgAAS.exe
  2⤵
  PID:6772
- C:\Windows\System\dlRBJms.exe
  C:\Windows\System\dlRBJms.exe
  2⤵
  PID:6760
- C:\Windows\System\XpYkjvS.exe
  C:\Windows\System\XpYkjvS.exe
  2⤵
  PID:7012
- C:\Windows\System\dEblrql.exe
  C:\Windows\System\dEblrql.exe
  2⤵
  PID:2120
- C:\Windows\System\TEtgTyc.exe
  C:\Windows\System\TEtgTyc.exe
  2⤵
  PID:6200
- C:\Windows\System\znIaKSk.exe
  C:\Windows\System\znIaKSk.exe
  2⤵
  PID:6608
- C:\Windows\System\pFsQvYk.exe
  C:\Windows\System\pFsQvYk.exe
  2⤵
  PID:6812
- C:\Windows\System\dGtOEcu.exe
  C:\Windows\System\dGtOEcu.exe
  2⤵
  PID:6168
- C:\Windows\System\NDQygAc.exe
  C:\Windows\System\NDQygAc.exe
  2⤵
  PID:1168
- C:\Windows\System\qOTeRZM.exe
  C:\Windows\System\qOTeRZM.exe
  2⤵
  PID:7028
- C:\Windows\System\bZPyhwy.exe
  C:\Windows\System\bZPyhwy.exe
  2⤵
  PID:7200
- C:\Windows\System\RSAXzDM.exe
  C:\Windows\System\RSAXzDM.exe
  2⤵
  PID:7216
- C:\Windows\System\LzUubAf.exe
  C:\Windows\System\LzUubAf.exe
  2⤵
  PID:7244
- C:\Windows\System\zdkZOtW.exe
  C:\Windows\System\zdkZOtW.exe
  2⤵
  PID:7264
- C:\Windows\System\QZrApSt.exe
  C:\Windows\System\QZrApSt.exe
  2⤵
  PID:7284
- C:\Windows\System\UdfYkjE.exe
  C:\Windows\System\UdfYkjE.exe
  2⤵
  PID:7328
- C:\Windows\System\CyfsXfK.exe
  C:\Windows\System\CyfsXfK.exe
  2⤵
  PID:7392
- C:\Windows\System\slRvdeH.exe
  C:\Windows\System\slRvdeH.exe
  2⤵
  PID:7420
- C:\Windows\System\eiSmnRJ.exe
  C:\Windows\System\eiSmnRJ.exe
  2⤵
  PID:7444
- C:\Windows\System\IcnuEnv.exe
  C:\Windows\System\IcnuEnv.exe
  2⤵
  PID:7484
- C:\Windows\System\bVPdyxy.exe
  C:\Windows\System\bVPdyxy.exe
  2⤵
  PID:7500
- C:\Windows\System\KXpdczr.exe
  C:\Windows\System\KXpdczr.exe
  2⤵
  PID:7520
- C:\Windows\System\jzCRQZa.exe
  C:\Windows\System\jzCRQZa.exe
  2⤵
  PID:7544
- C:\Windows\System\pOgPNPO.exe
  C:\Windows\System\pOgPNPO.exe
  2⤵
  PID:7568
- C:\Windows\System\JnrKVfe.exe
  C:\Windows\System\JnrKVfe.exe
  2⤵
  PID:7584
- C:\Windows\System\tfhDZkE.exe
  C:\Windows\System\tfhDZkE.exe
  2⤵
  PID:7608
- C:\Windows\System\sOOlARK.exe
  C:\Windows\System\sOOlARK.exe
  2⤵
  PID:7648
- C:\Windows\System\eQhoHep.exe
  C:\Windows\System\eQhoHep.exe
  2⤵
  PID:7668
- C:\Windows\System\WzxYLtd.exe
  C:\Windows\System\WzxYLtd.exe
  2⤵
  PID:7716
- C:\Windows\System\SWDRLML.exe
  C:\Windows\System\SWDRLML.exe
  2⤵
  PID:7764
- C:\Windows\System\oalHLFs.exe
  C:\Windows\System\oalHLFs.exe
  2⤵
  PID:7780
- C:\Windows\System\NcroMlB.exe
  C:\Windows\System\NcroMlB.exe
  2⤵
  PID:7800
- C:\Windows\System\DTBQccl.exe
  C:\Windows\System\DTBQccl.exe
  2⤵
  PID:7828
- C:\Windows\System\SNAFqOm.exe
  C:\Windows\System\SNAFqOm.exe
  2⤵
  PID:7876
- C:\Windows\System\NcxsMZl.exe
  C:\Windows\System\NcxsMZl.exe
  2⤵
  PID:7892
- C:\Windows\System\SEwyUeH.exe
  C:\Windows\System\SEwyUeH.exe
  2⤵
  PID:7912
- C:\Windows\System\nOoDYiv.exe
  C:\Windows\System\nOoDYiv.exe
  2⤵
  PID:7936
- C:\Windows\System\oJkwLQr.exe
  C:\Windows\System\oJkwLQr.exe
  2⤵
  PID:7956
- C:\Windows\System\zSKqGHJ.exe
  C:\Windows\System\zSKqGHJ.exe
  2⤵
  PID:7972
- C:\Windows\System\DDbTMdZ.exe
  C:\Windows\System\DDbTMdZ.exe
  2⤵
  PID:8004
- C:\Windows\System\PeGQiLK.exe
  C:\Windows\System\PeGQiLK.exe
  2⤵
  PID:8020
- C:\Windows\System\pzNRevY.exe
  C:\Windows\System\pzNRevY.exe
  2⤵
  PID:8040
- C:\Windows\System\DkWFNNz.exe
  C:\Windows\System\DkWFNNz.exe
  2⤵
  PID:8060
- C:\Windows\System\IxnHIzv.exe
  C:\Windows\System\IxnHIzv.exe
  2⤵
  PID:8092
- C:\Windows\System\pVoJUNr.exe
  C:\Windows\System\pVoJUNr.exe
  2⤵
  PID:8132
- C:\Windows\System\ioFEtwP.exe
  C:\Windows\System\ioFEtwP.exe
  2⤵
  PID:8152
- C:\Windows\System\Fjylicf.exe
  C:\Windows\System\Fjylicf.exe
  2⤵
  PID:7196
- C:\Windows\System\rZSybDJ.exe
  C:\Windows\System\rZSybDJ.exe
  2⤵
  PID:7232
- C:\Windows\System\SLYhEfI.exe
  C:\Windows\System\SLYhEfI.exe
  2⤵
  PID:7252
- C:\Windows\System\mGDHMhW.exe
  C:\Windows\System\mGDHMhW.exe
  2⤵
  PID:7368
- C:\Windows\System\YaGcIyR.exe
  C:\Windows\System\YaGcIyR.exe
  2⤵
  PID:7388
- C:\Windows\System\LCfQnjD.exe
  C:\Windows\System\LCfQnjD.exe
  2⤵
  PID:7460
- C:\Windows\System\xDLHeHI.exe
  C:\Windows\System\xDLHeHI.exe
  2⤵
  PID:7512
- C:\Windows\System\LMpKevk.exe
  C:\Windows\System\LMpKevk.exe
  2⤵
  PID:7560
- C:\Windows\System\ssHvqby.exe
  C:\Windows\System\ssHvqby.exe
  2⤵
  PID:7576
- C:\Windows\System\RXRHRDC.exe
  C:\Windows\System\RXRHRDC.exe
  2⤵
  PID:7640
- C:\Windows\System\ogGqtSH.exe
  C:\Windows\System\ogGqtSH.exe
  2⤵
  PID:7792
- C:\Windows\System\shlzejQ.exe
  C:\Windows\System\shlzejQ.exe
  2⤵
  PID:7868
- C:\Windows\System\DJSWSKk.exe
  C:\Windows\System\DJSWSKk.exe
  2⤵
  PID:7908
- C:\Windows\System\JAaZxWJ.exe
  C:\Windows\System\JAaZxWJ.exe
  2⤵
  PID:8032
- C:\Windows\System\jwHGoYJ.exe
  C:\Windows\System\jwHGoYJ.exe
  2⤵
  PID:8120
- C:\Windows\System\rzSDBIk.exe
  C:\Windows\System\rzSDBIk.exe
  2⤵
  PID:8144
- C:\Windows\System\pIRuIFd.exe
  C:\Windows\System\pIRuIFd.exe
  2⤵
  PID:7256
- C:\Windows\System\kddtaVj.exe
  C:\Windows\System\kddtaVj.exe
  2⤵
  PID:7532
- C:\Windows\System\kfKJlWy.exe
  C:\Windows\System\kfKJlWy.exe
  2⤵
  PID:7580
- C:\Windows\System\dyfEVIM.exe
  C:\Windows\System\dyfEVIM.exe
  2⤵
  PID:7820
- C:\Windows\System\XxukaSb.exe
  C:\Windows\System\XxukaSb.exe
  2⤵
  PID:7996
- C:\Windows\System\QhOOGVP.exe
  C:\Windows\System\QhOOGVP.exe
  2⤵
  PID:8112
- C:\Windows\System\cbbriKj.exe
  C:\Windows\System\cbbriKj.exe
  2⤵
  PID:6552
- C:\Windows\System\kevRUEh.exe
  C:\Windows\System\kevRUEh.exe
  2⤵
  PID:7920
- C:\Windows\System\kJNDUuk.exe
  C:\Windows\System\kJNDUuk.exe
  2⤵
  PID:8160
- C:\Windows\System\DMUwDUv.exe
  C:\Windows\System\DMUwDUv.exe
  2⤵
  PID:6400
- C:\Windows\System\yPcFCxi.exe
  C:\Windows\System\yPcFCxi.exe
  2⤵
  PID:8204
- C:\Windows\System\rajqDeM.exe
  C:\Windows\System\rajqDeM.exe
  2⤵
  PID:8228
- C:\Windows\System\ZZtNrPd.exe
  C:\Windows\System\ZZtNrPd.exe
  2⤵
  PID:8252
- C:\Windows\System\MEvqjKV.exe
  C:\Windows\System\MEvqjKV.exe
  2⤵
  PID:8292
- C:\Windows\System\OordoKu.exe
  C:\Windows\System\OordoKu.exe
  2⤵
  PID:8312
- C:\Windows\System\IKYgzIm.exe
  C:\Windows\System\IKYgzIm.exe
  2⤵
  PID:8328
- C:\Windows\System\nAErreI.exe
  C:\Windows\System\nAErreI.exe
  2⤵
  PID:8364
- C:\Windows\System\SltntRS.exe
  C:\Windows\System\SltntRS.exe
  2⤵
  PID:8396
- C:\Windows\System\iNBUVRf.exe
  C:\Windows\System\iNBUVRf.exe
  2⤵
  PID:8432
- C:\Windows\System\INHrbxw.exe
  C:\Windows\System\INHrbxw.exe
  2⤵
  PID:8452
- C:\Windows\System\AZdjYJo.exe
  C:\Windows\System\AZdjYJo.exe
  2⤵
  PID:8480
- C:\Windows\System\xurmWYD.exe
  C:\Windows\System\xurmWYD.exe
  2⤵
  PID:8512
- C:\Windows\System\Cicddtg.exe
  C:\Windows\System\Cicddtg.exe
  2⤵
  PID:8536
- C:\Windows\System\euupxka.exe
  C:\Windows\System\euupxka.exe
  2⤵
  PID:8552
- C:\Windows\System\xBxVczd.exe
  C:\Windows\System\xBxVczd.exe
  2⤵
  PID:8580
- C:\Windows\System\zEKreOj.exe
  C:\Windows\System\zEKreOj.exe
  2⤵
  PID:8596
- C:\Windows\System\CwfUAWn.exe
  C:\Windows\System\CwfUAWn.exe
  2⤵
  PID:8616
- C:\Windows\System\NpPDPhr.exe
  C:\Windows\System\NpPDPhr.exe
  2⤵
  PID:8636
- C:\Windows\System\uVelpFN.exe
  C:\Windows\System\uVelpFN.exe
  2⤵
  PID:8660
- C:\Windows\System\pYzDDhp.exe
  C:\Windows\System\pYzDDhp.exe
  2⤵
  PID:8728
- C:\Windows\System\fkWCbKO.exe
  C:\Windows\System\fkWCbKO.exe
  2⤵
  PID:8752
- C:\Windows\System\tNscLnh.exe
  C:\Windows\System\tNscLnh.exe
  2⤵
  PID:8784
- C:\Windows\System\MdRHabG.exe
  C:\Windows\System\MdRHabG.exe
  2⤵
  PID:8816
- C:\Windows\System\wVMySyX.exe
  C:\Windows\System\wVMySyX.exe
  2⤵
  PID:8832
- C:\Windows\System\nZZKxMh.exe
  C:\Windows\System\nZZKxMh.exe
  2⤵
  PID:8860
- C:\Windows\System\JOQxCUt.exe
  C:\Windows\System\JOQxCUt.exe
  2⤵
  PID:8884
- C:\Windows\System\PPjLyoT.exe
  C:\Windows\System\PPjLyoT.exe
  2⤵
  PID:8900
- C:\Windows\System\rRQzXFY.exe
  C:\Windows\System\rRQzXFY.exe
  2⤵
  PID:8920
- C:\Windows\System\RvVpIQy.exe
  C:\Windows\System\RvVpIQy.exe
  2⤵
  PID:8948
- C:\Windows\System\xhKoFIz.exe
  C:\Windows\System\xhKoFIz.exe
  2⤵
  PID:8972
- C:\Windows\System\vtKvNIV.exe
  C:\Windows\System\vtKvNIV.exe
  2⤵
  PID:9032
- C:\Windows\System\WgnoedI.exe
  C:\Windows\System\WgnoedI.exe
  2⤵
  PID:9048
- C:\Windows\System\qVzCYWG.exe
  C:\Windows\System\qVzCYWG.exe
  2⤵
  PID:9092
- C:\Windows\System\rNkXOSg.exe
  C:\Windows\System\rNkXOSg.exe
  2⤵
  PID:9116
- C:\Windows\System\GEWtgVm.exe
  C:\Windows\System\GEWtgVm.exe
  2⤵
  PID:9136
- C:\Windows\System\XJxsekF.exe
  C:\Windows\System\XJxsekF.exe
  2⤵
  PID:9168
- C:\Windows\System\CWNMFzQ.exe
  C:\Windows\System\CWNMFzQ.exe
  2⤵
  PID:9196
- C:\Windows\System\tTShtyx.exe
  C:\Windows\System\tTShtyx.exe
  2⤵
  PID:7656
- C:\Windows\System\jmkoTMb.exe
  C:\Windows\System\jmkoTMb.exe
  2⤵
  PID:8276
- C:\Windows\System\NOiiwJy.exe
  C:\Windows\System\NOiiwJy.exe
  2⤵
  PID:8272
- C:\Windows\System\vvoqzCN.exe
  C:\Windows\System\vvoqzCN.exe
  2⤵
  PID:8496
- C:\Windows\System\hVaHFVN.exe
  C:\Windows\System\hVaHFVN.exe
  2⤵
  PID:8528
- C:\Windows\System\LvpHkJx.exe
  C:\Windows\System\LvpHkJx.exe
  2⤵
  PID:8572
- C:\Windows\System\yslMNyq.exe
  C:\Windows\System\yslMNyq.exe
  2⤵
  PID:8604
- C:\Windows\System\aOGxjqW.exe
  C:\Windows\System\aOGxjqW.exe
  2⤵
  PID:8696
- C:\Windows\System\vTFgjei.exe
  C:\Windows\System\vTFgjei.exe
  2⤵
  PID:8656
- C:\Windows\System\HJecIQh.exe
  C:\Windows\System\HJecIQh.exe
  2⤵
  PID:8776
- C:\Windows\System\pzoeExE.exe
  C:\Windows\System\pzoeExE.exe
  2⤵
  PID:8840
- C:\Windows\System\fneyXJO.exe
  C:\Windows\System\fneyXJO.exe
  2⤵
  PID:8968
- C:\Windows\System\NRLxizQ.exe
  C:\Windows\System\NRLxizQ.exe
  2⤵
  PID:9024
- C:\Windows\System\NhBXlUF.exe
  C:\Windows\System\NhBXlUF.exe
  2⤵
  PID:9076
- C:\Windows\System\ZSDWTUV.exe
  C:\Windows\System\ZSDWTUV.exe
  2⤵
  PID:9184
- C:\Windows\System\TxtMoWA.exe
  C:\Windows\System\TxtMoWA.exe
  2⤵
  PID:8240
- C:\Windows\System\XgvtXDQ.exe
  C:\Windows\System\XgvtXDQ.exe
  2⤵
  PID:8464
- C:\Windows\System\YZCqqXV.exe
  C:\Windows\System\YZCqqXV.exe
  2⤵
  PID:2924
- C:\Windows\System\bHlclfV.exe
  C:\Windows\System\bHlclfV.exe
  2⤵
  PID:8504
- C:\Windows\System\vGETYfp.exe
  C:\Windows\System\vGETYfp.exe
  2⤵
  PID:8632
- C:\Windows\System\yelzajy.exe
  C:\Windows\System\yelzajy.exe
  2⤵
  PID:8796
- C:\Windows\System\TrYyjFL.exe
  C:\Windows\System\TrYyjFL.exe
  2⤵
  PID:8876
- C:\Windows\System\HxSfhwq.exe
  C:\Windows\System\HxSfhwq.exe
  2⤵
  PID:8940
- C:\Windows\System\KNbTonW.exe
  C:\Windows\System\KNbTonW.exe
  2⤵
  PID:1564
- C:\Windows\System\BvvyXWQ.exe
  C:\Windows\System\BvvyXWQ.exe
  2⤵
  PID:8712
- C:\Windows\System\ohwjwNU.exe
  C:\Windows\System\ohwjwNU.exe
  2⤵
  PID:8984
- C:\Windows\System\UrkMZrL.exe
  C:\Windows\System\UrkMZrL.exe
  2⤵
  PID:9232
- C:\Windows\System\zxqWLoS.exe
  C:\Windows\System\zxqWLoS.exe
  2⤵
  PID:9248
- C:\Windows\System\SKeJBbU.exe
  C:\Windows\System\SKeJBbU.exe
  2⤵
  PID:9268
- C:\Windows\System\YGwKPAA.exe
  C:\Windows\System\YGwKPAA.exe
  2⤵
  PID:9292
- C:\Windows\System\BWdpfqv.exe
  C:\Windows\System\BWdpfqv.exe
  2⤵
  PID:9308
- C:\Windows\System\aJZsxYd.exe
  C:\Windows\System\aJZsxYd.exe
  2⤵
  PID:9344
- C:\Windows\System\UDVUOGW.exe
  C:\Windows\System\UDVUOGW.exe
  2⤵
  PID:9388
- C:\Windows\System\jebaQLe.exe
  C:\Windows\System\jebaQLe.exe
  2⤵
  PID:9416
- C:\Windows\System\cuvwYJL.exe
  C:\Windows\System\cuvwYJL.exe
  2⤵
  PID:9440
- C:\Windows\System\PJrSZei.exe
  C:\Windows\System\PJrSZei.exe
  2⤵
  PID:9456
- C:\Windows\System\hLkrspZ.exe
  C:\Windows\System\hLkrspZ.exe
  2⤵
  PID:9476
- C:\Windows\System\uNIVQcp.exe
  C:\Windows\System\uNIVQcp.exe
  2⤵
  PID:9580
- C:\Windows\System\bzFSMbM.exe
  C:\Windows\System\bzFSMbM.exe
  2⤵
  PID:9596
- C:\Windows\System\AurdwWm.exe
  C:\Windows\System\AurdwWm.exe
  2⤵
  PID:9672
- C:\Windows\System\ySwjYMo.exe
  C:\Windows\System\ySwjYMo.exe
  2⤵
  PID:9692
- C:\Windows\System\VjqMRnx.exe
  C:\Windows\System\VjqMRnx.exe
  2⤵
  PID:9708
- C:\Windows\System\owJuwcj.exe
  C:\Windows\System\owJuwcj.exe
  2⤵
  PID:9728
- C:\Windows\System\DOLfdYw.exe
  C:\Windows\System\DOLfdYw.exe
  2⤵
  PID:9752
- C:\Windows\System\DqBvhXj.exe
  C:\Windows\System\DqBvhXj.exe
  2⤵
  PID:9768
- C:\Windows\System\zuLgwFR.exe
  C:\Windows\System\zuLgwFR.exe
  2⤵
  PID:9788
- C:\Windows\System\lTHnndy.exe
  C:\Windows\System\lTHnndy.exe
  2⤵
  PID:9804
- C:\Windows\System\ldVVvAj.exe
  C:\Windows\System\ldVVvAj.exe
  2⤵
  PID:9844
- C:\Windows\System\PxedpOK.exe
  C:\Windows\System\PxedpOK.exe
  2⤵
  PID:9908
- C:\Windows\System\RuQLkZR.exe
  C:\Windows\System\RuQLkZR.exe
  2⤵
  PID:9928
- C:\Windows\System\PAXXOGZ.exe
  C:\Windows\System\PAXXOGZ.exe
  2⤵
  PID:10004
- C:\Windows\System\Goxekzf.exe
  C:\Windows\System\Goxekzf.exe
  2⤵
  PID:10064
- C:\Windows\System\cxbsiLk.exe
  C:\Windows\System\cxbsiLk.exe
  2⤵
  PID:10084
- C:\Windows\System\gbKcKhs.exe
  C:\Windows\System\gbKcKhs.exe
  2⤵
  PID:10108
- C:\Windows\System\VxywJFB.exe
  C:\Windows\System\VxywJFB.exe
  2⤵
  PID:10140
- C:\Windows\System\UOhDpsG.exe
  C:\Windows\System\UOhDpsG.exe
  2⤵
  PID:10164
- C:\Windows\System\hmQGBkK.exe
  C:\Windows\System\hmQGBkK.exe
  2⤵
  PID:10180
- C:\Windows\System\QKIVHiK.exe
  C:\Windows\System\QKIVHiK.exe
  2⤵
  PID:10204
- C:\Windows\System\eWDnPIt.exe
  C:\Windows\System\eWDnPIt.exe
  2⤵
  PID:10220
- C:\Windows\System\RuhdLpo.exe
  C:\Windows\System\RuhdLpo.exe
  2⤵
  PID:8780
- C:\Windows\System\emahyuZ.exe
  C:\Windows\System\emahyuZ.exe
  2⤵
  PID:9340
- C:\Windows\System\EGbDtkf.exe
  C:\Windows\System\EGbDtkf.exe
  2⤵
  PID:9400
- C:\Windows\System\drGFnff.exe
  C:\Windows\System\drGFnff.exe
  2⤵
  PID:9324
- C:\Windows\System\ZlUwpCF.exe
  C:\Windows\System\ZlUwpCF.exe
  2⤵
  PID:9356
- C:\Windows\System\rfTxPcZ.exe
  C:\Windows\System\rfTxPcZ.exe
  2⤵
  PID:9332
- C:\Windows\System\LAYwUSd.exe
  C:\Windows\System\LAYwUSd.exe
  2⤵
  PID:9564
- C:\Windows\System\PvjMHPa.exe
  C:\Windows\System\PvjMHPa.exe
  2⤵
  PID:9516
- C:\Windows\System\CvxxbFA.exe
  C:\Windows\System\CvxxbFA.exe
  2⤵
  PID:9548
- C:\Windows\System\RvFHStw.exe
  C:\Windows\System\RvFHStw.exe
  2⤵
  PID:9764
- C:\Windows\System\nptxWgU.exe
  C:\Windows\System\nptxWgU.exe
  2⤵
  PID:9796
- C:\Windows\System\nEkoaBW.exe
  C:\Windows\System\nEkoaBW.exe
  2⤵
  PID:9636
- C:\Windows\System\oHQrbeV.exe
  C:\Windows\System\oHQrbeV.exe
  2⤵
  PID:9828
- C:\Windows\System\jYdnPLU.exe
  C:\Windows\System\jYdnPLU.exe
  2⤵
  PID:9824
- C:\Windows\System\fAnxeHV.exe
  C:\Windows\System\fAnxeHV.exe
  2⤵
  PID:9924
- C:\Windows\System\cGfAZnN.exe
  C:\Windows\System\cGfAZnN.exe
  2⤵
  PID:10076
- C:\Windows\System\eIftXqM.exe
  C:\Windows\System\eIftXqM.exe
  2⤵
  PID:10100
- C:\Windows\System\MssfSLw.exe
  C:\Windows\System\MssfSLw.exe
  2⤵
  PID:10176
- C:\Windows\System\iGAfYIF.exe
  C:\Windows\System\iGAfYIF.exe
  2⤵
  PID:8828
- C:\Windows\System\qmmYMnj.exe
  C:\Windows\System\qmmYMnj.exe
  2⤵
  PID:9336
- C:\Windows\System\UiGfAED.exe
  C:\Windows\System\UiGfAED.exe
  2⤵
  PID:9472
- C:\Windows\System\sbiJIVu.exe
  C:\Windows\System\sbiJIVu.exe
  2⤵
  PID:9556
- C:\Windows\System\oKKrgCv.exe
  C:\Windows\System\oKKrgCv.exe
  2⤵
  PID:9468
- C:\Windows\System\qGmmGZq.exe
  C:\Windows\System\qGmmGZq.exe
  2⤵
  PID:9536
- C:\Windows\System\WqvwUDK.exe
  C:\Windows\System\WqvwUDK.exe
  2⤵
  PID:9572
- C:\Windows\System\NxdadTg.exe
  C:\Windows\System\NxdadTg.exe
  2⤵
  PID:9664
- C:\Windows\System\qtXaeal.exe
  C:\Windows\System\qtXaeal.exe
  2⤵
  PID:10148
- C:\Windows\System\tAqcPhW.exe
  C:\Windows\System\tAqcPhW.exe
  2⤵
  PID:10232
- C:\Windows\System\aSCQWVi.exe
  C:\Windows\System\aSCQWVi.exe
  2⤵
  PID:9280
- C:\Windows\System\ydTIEgi.exe
  C:\Windows\System\ydTIEgi.exe
  2⤵
  PID:9508
- C:\Windows\System\mMeKASB.exe
  C:\Windows\System\mMeKASB.exe
  2⤵
  PID:9632
- C:\Windows\System\mgcKQWa.exe
  C:\Windows\System\mgcKQWa.exe
  2⤵
  PID:10252
- C:\Windows\System\bMQAxyl.exe
  C:\Windows\System\bMQAxyl.exe
  2⤵
  PID:10300
- C:\Windows\System\GpjRXOV.exe
  C:\Windows\System\GpjRXOV.exe
  2⤵
  PID:10340
- C:\Windows\System\atbZApM.exe
  C:\Windows\System\atbZApM.exe
  2⤵
  PID:10364
- C:\Windows\System\XyJFfLl.exe
  C:\Windows\System\XyJFfLl.exe
  2⤵
  PID:10384
- C:\Windows\System\PwRTVsN.exe
  C:\Windows\System\PwRTVsN.exe
  2⤵
  PID:10404
- C:\Windows\System\tWHrrIf.exe
  C:\Windows\System\tWHrrIf.exe
  2⤵
  PID:10448
- C:\Windows\System\aMklFJG.exe
  C:\Windows\System\aMklFJG.exe
  2⤵
  PID:10468
- C:\Windows\System\GxavsoW.exe
  C:\Windows\System\GxavsoW.exe
  2⤵
  PID:10496
- C:\Windows\System\KeCbSCd.exe
  C:\Windows\System\KeCbSCd.exe
  2⤵
  PID:10512
- C:\Windows\System\YFYIBin.exe
  C:\Windows\System\YFYIBin.exe
  2⤵
  PID:10544
- C:\Windows\System\fhUeMah.exe
  C:\Windows\System\fhUeMah.exe
  2⤵
  PID:10600
- C:\Windows\System\vnaWBfC.exe
  C:\Windows\System\vnaWBfC.exe
  2⤵
  PID:10624
- C:\Windows\System\vdUVSZx.exe
  C:\Windows\System\vdUVSZx.exe
  2⤵
  PID:10648
- C:\Windows\System\NzSkoDJ.exe
  C:\Windows\System\NzSkoDJ.exe
  2⤵
  PID:10668
- C:\Windows\System\iTfYNYp.exe
  C:\Windows\System\iTfYNYp.exe
  2⤵
  PID:10696
- C:\Windows\System\dEVKvZV.exe
  C:\Windows\System\dEVKvZV.exe
  2⤵
  PID:10756
- C:\Windows\System\jpckrKe.exe
  C:\Windows\System\jpckrKe.exe
  2⤵
  PID:10776
- C:\Windows\System\HjxruaT.exe
  C:\Windows\System\HjxruaT.exe
  2⤵
  PID:10800
- C:\Windows\System\IfwUdzl.exe
  C:\Windows\System\IfwUdzl.exe
  2⤵
  PID:10852
- C:\Windows\System\jZlqzWL.exe
  C:\Windows\System\jZlqzWL.exe
  2⤵
  PID:10872
- C:\Windows\System\RGbjivd.exe
  C:\Windows\System\RGbjivd.exe
  2⤵
  PID:10896
- C:\Windows\System\JSlBMYW.exe
  C:\Windows\System\JSlBMYW.exe
  2⤵
  PID:10936
- C:\Windows\System\oONURdl.exe
  C:\Windows\System\oONURdl.exe
  2⤵
  PID:10956
- C:\Windows\System\iLuhQRh.exe
  C:\Windows\System\iLuhQRh.exe
  2⤵
  PID:10980
- C:\Windows\System\MZWrRJw.exe
  C:\Windows\System\MZWrRJw.exe
  2⤵
  PID:11004
- C:\Windows\System\iMEDekk.exe
  C:\Windows\System\iMEDekk.exe
  2⤵
  PID:11040
- C:\Windows\System\xQJjfuz.exe
  C:\Windows\System\xQJjfuz.exe
  2⤵
  PID:11064
- C:\Windows\System\yQTVbGD.exe
  C:\Windows\System\yQTVbGD.exe
  2⤵
  PID:11084
- C:\Windows\System\EpzhFMa.exe
  C:\Windows\System\EpzhFMa.exe
  2⤵
  PID:11112
- C:\Windows\System\KMiifGz.exe
  C:\Windows\System\KMiifGz.exe
  2⤵
  PID:11160
- C:\Windows\System\bzFKxpj.exe
  C:\Windows\System\bzFKxpj.exe
  2⤵
  PID:11176
- C:\Windows\System\kJsExaR.exe
  C:\Windows\System\kJsExaR.exe
  2⤵
  PID:11196
- C:\Windows\System\vLTDULo.exe
  C:\Windows\System\vLTDULo.exe
  2⤵
  PID:11212
- C:\Windows\System\DmXfVDy.exe
  C:\Windows\System\DmXfVDy.exe
  2⤵
  PID:11236
- C:\Windows\System\SxgPTWT.exe
  C:\Windows\System\SxgPTWT.exe
  2⤵
  PID:11256
- C:\Windows\System\cCJfxLm.exe
  C:\Windows\System\cCJfxLm.exe
  2⤵
  PID:10216
- C:\Windows\System\NASHBuT.exe
  C:\Windows\System\NASHBuT.exe
  2⤵
  PID:9492
- C:\Windows\System\FQdzqFw.exe
  C:\Windows\System\FQdzqFw.exe
  2⤵
  PID:10288
- C:\Windows\System\QlLzthW.exe
  C:\Windows\System\QlLzthW.exe
  2⤵
  PID:10308
- C:\Windows\System\JKYhwwR.exe
  C:\Windows\System\JKYhwwR.exe
  2⤵
  PID:10460
- C:\Windows\System\OVieaOR.exe
  C:\Windows\System\OVieaOR.exe
  2⤵
  PID:10584
- C:\Windows\System\HlSsvnV.exe
  C:\Windows\System\HlSsvnV.exe
  2⤵
  PID:10536
- C:\Windows\System\qZJMqCl.exe
  C:\Windows\System\qZJMqCl.exe
  2⤵
  PID:10692
- C:\Windows\System\KwzEnlu.exe
  C:\Windows\System\KwzEnlu.exe
  2⤵
  PID:10664
- C:\Windows\System\YwdCjbI.exe
  C:\Windows\System\YwdCjbI.exe
  2⤵
  PID:10792
- C:\Windows\System\yVZJgvI.exe
  C:\Windows\System\yVZJgvI.exe
  2⤵
  PID:10820
- C:\Windows\System\pSKzUei.exe
  C:\Windows\System\pSKzUei.exe
  2⤵
  PID:10868
- C:\Windows\System\TpfsvPl.exe
  C:\Windows\System\TpfsvPl.exe
  2⤵
  PID:10948
- C:\Windows\System\cSEVoLM.exe
  C:\Windows\System\cSEVoLM.exe
  2⤵
  PID:11000
- C:\Windows\System\cCvlBBA.exe
  C:\Windows\System\cCvlBBA.exe
  2⤵
  PID:11092
- C:\Windows\System\jxfoScE.exe
  C:\Windows\System\jxfoScE.exe
  2⤵
  PID:11124
- C:\Windows\System\IicNWHI.exe
  C:\Windows\System\IicNWHI.exe
  2⤵
  PID:11204
- C:\Windows\System\zxxpPLU.exe
  C:\Windows\System\zxxpPLU.exe
  2⤵
  PID:10284
- C:\Windows\System\oyZgOXi.exe
  C:\Windows\System\oyZgOXi.exe
  2⤵
  PID:10572
- C:\Windows\System\pWZLleN.exe
  C:\Windows\System\pWZLleN.exe
  2⤵
  PID:10580
- C:\Windows\System\giLCcmJ.exe
  C:\Windows\System\giLCcmJ.exe
  2⤵
  PID:10832
- C:\Windows\System\RbyLdvH.exe
  C:\Windows\System\RbyLdvH.exe
  2⤵
  PID:10048
- C:\Windows\System\hvkCZQG.exe
  C:\Windows\System\hvkCZQG.exe
  2⤵
  PID:10976
- C:\Windows\System\VVeYSne.exe
  C:\Windows\System\VVeYSne.exe
  2⤵
  PID:3244
- C:\Windows\System\ozsJlCu.exe
  C:\Windows\System\ozsJlCu.exe
  2⤵
  PID:11220
- C:\Windows\System\XbPcQNP.exe
  C:\Windows\System\XbPcQNP.exe
  2⤵
  PID:10396
- C:\Windows\System\ysolOQr.exe
  C:\Windows\System\ysolOQr.exe
  2⤵
  PID:11060
- C:\Windows\System\pmCyIDr.exe
  C:\Windows\System\pmCyIDr.exe
  2⤵
  PID:11108
- C:\Windows\System\GpVHpnH.exe
  C:\Windows\System\GpVHpnH.exe
  2⤵
  PID:11192
- C:\Windows\System\DcqhAUL.exe
  C:\Windows\System\DcqhAUL.exe
  2⤵
  PID:11276
- C:\Windows\System\EfvBgGX.exe
  C:\Windows\System\EfvBgGX.exe
  2⤵
  PID:11300
- C:\Windows\System\AkfOPcA.exe
  C:\Windows\System\AkfOPcA.exe
  2⤵
  PID:11348
- C:\Windows\System\nWLMqdo.exe
  C:\Windows\System\nWLMqdo.exe
  2⤵
  PID:11364
- C:\Windows\System\fGATVYR.exe
  C:\Windows\System\fGATVYR.exe
  2⤵
  PID:11384
- C:\Windows\System\JOpEhEs.exe
  C:\Windows\System\JOpEhEs.exe
  2⤵
  PID:11400
- C:\Windows\System\qxZhxdS.exe
  C:\Windows\System\qxZhxdS.exe
  2⤵
  PID:11444
- C:\Windows\System\vstxRTg.exe
  C:\Windows\System\vstxRTg.exe
  2⤵
  PID:11464
- C:\Windows\System\SxBxCVO.exe
  C:\Windows\System\SxBxCVO.exe
  2⤵
  PID:11484
- C:\Windows\System\pauoFEG.exe
  C:\Windows\System\pauoFEG.exe
  2⤵
  PID:11504
- C:\Windows\System\AzlYLbT.exe
  C:\Windows\System\AzlYLbT.exe
  2⤵
  PID:11528
- C:\Windows\System\QfWCuQU.exe
  C:\Windows\System\QfWCuQU.exe
  2⤵
  PID:11572
- C:\Windows\System\YLkBvAx.exe
  C:\Windows\System\YLkBvAx.exe
  2⤵
  PID:11604
- C:\Windows\System\VNtmCtw.exe
  C:\Windows\System\VNtmCtw.exe
  2⤵
  PID:11644
- C:\Windows\System\lHyHQNW.exe
  C:\Windows\System\lHyHQNW.exe
  2⤵
  PID:11664
- C:\Windows\System\JyFRkte.exe
  C:\Windows\System\JyFRkte.exe
  2⤵
  PID:11700
- C:\Windows\System\XtesTGs.exe
  C:\Windows\System\XtesTGs.exe
  2⤵
  PID:11724
- C:\Windows\System\IubPrqA.exe
  C:\Windows\System\IubPrqA.exe
  2⤵
  PID:11740
- C:\Windows\System\FmeDHMb.exe
  C:\Windows\System\FmeDHMb.exe
  2⤵
  PID:11764
- C:\Windows\System\yerxqhO.exe
  C:\Windows\System\yerxqhO.exe
  2⤵
  PID:11780
- C:\Windows\System\vpAOJiX.exe
  C:\Windows\System\vpAOJiX.exe
  2⤵
  PID:11836
- C:\Windows\System\DUMSBqD.exe
  C:\Windows\System\DUMSBqD.exe
  2⤵
  PID:11868
- C:\Windows\System\YyFkTGh.exe
  C:\Windows\System\YyFkTGh.exe
  2⤵
  PID:11892
- C:\Windows\System\wsliHHP.exe
  C:\Windows\System\wsliHHP.exe
  2⤵
  PID:11916
- C:\Windows\System\rTLzIWP.exe
  C:\Windows\System\rTLzIWP.exe
  2⤵
  PID:11936
- C:\Windows\System\VWgOxBN.exe
  C:\Windows\System\VWgOxBN.exe
  2⤵
  PID:11956
- C:\Windows\System\OPIgaDJ.exe
  C:\Windows\System\OPIgaDJ.exe
  2⤵
  PID:11976
- C:\Windows\System\jiKHFBK.exe
  C:\Windows\System\jiKHFBK.exe
  2⤵
  PID:12000
- C:\Windows\System\mPLQkaT.exe
  C:\Windows\System\mPLQkaT.exe
  2⤵
  PID:12032
- C:\Windows\System\CYNwKMP.exe
  C:\Windows\System\CYNwKMP.exe
  2⤵
  PID:12060
- C:\Windows\System\LyBsKNR.exe
  C:\Windows\System\LyBsKNR.exe
  2⤵
  PID:12104
- C:\Windows\System\PppXwOo.exe
  C:\Windows\System\PppXwOo.exe
  2⤵
  PID:12124
- C:\Windows\System\xKujCIX.exe
  C:\Windows\System\xKujCIX.exe
  2⤵
  PID:12148
- C:\Windows\System\KemxgeQ.exe
  C:\Windows\System\KemxgeQ.exe
  2⤵
  PID:12168
- C:\Windows\System\PpKiazS.exe
  C:\Windows\System\PpKiazS.exe
  2⤵
  PID:12216
- C:\Windows\System\BPjUuvt.exe
  C:\Windows\System\BPjUuvt.exe
  2⤵
  PID:12264
- C:\Windows\System\veiTBje.exe
  C:\Windows\System\veiTBje.exe
  2⤵
  PID:11288
- C:\Windows\System\jqbfgRS.exe
  C:\Windows\System\jqbfgRS.exe
  2⤵
  PID:11356
- C:\Windows\System\XytehZN.exe
  C:\Windows\System\XytehZN.exe
  2⤵
  PID:10644
- C:\Windows\System\mmqTHAy.exe
  C:\Windows\System\mmqTHAy.exe
  2⤵
  PID:11452
- C:\Windows\System\NwXqWbJ.exe
  C:\Windows\System\NwXqWbJ.exe
  2⤵
  PID:1540
- C:\Windows\System\fZysnWa.exe
  C:\Windows\System\fZysnWa.exe
  2⤵
  PID:11520
- C:\Windows\System\ZliiPPk.exe
  C:\Windows\System\ZliiPPk.exe
  2⤵
  PID:3316
- C:\Windows\System\mzklUra.exe
  C:\Windows\System\mzklUra.exe
  2⤵
  PID:11600
- C:\Windows\System\GktYiBk.exe
  C:\Windows\System\GktYiBk.exe
  2⤵
  PID:11676
- C:\Windows\System\ZsPcmrj.exe
  C:\Windows\System\ZsPcmrj.exe
  2⤵
  PID:11776
- C:\Windows\System\RTpNFuf.exe
  C:\Windows\System\RTpNFuf.exe
  2⤵
  PID:11796
- C:\Windows\System\pNLejHz.exe
  C:\Windows\System\pNLejHz.exe
  2⤵
  PID:11900
- C:\Windows\System\ecqIHjD.exe
  C:\Windows\System\ecqIHjD.exe
  2⤵
  PID:11924
- C:\Windows\System\SgBPIzK.exe
  C:\Windows\System\SgBPIzK.exe
  2⤵
  PID:11992
- C:\Windows\System\vgcwlfF.exe
  C:\Windows\System\vgcwlfF.exe
  2⤵
  PID:12052
- C:\Windows\System\QJVbmAD.exe
  C:\Windows\System\QJVbmAD.exe
  2⤵
  PID:12056
- C:\Windows\System\EUjIJgA.exe
  C:\Windows\System\EUjIJgA.exe
  2⤵
  PID:12212
- C:\Windows\System\zLAYlcN.exe
  C:\Windows\System\zLAYlcN.exe
  2⤵
  PID:4000
- C:\Windows\System\YBCjafH.exe
  C:\Windows\System\YBCjafH.exe
  2⤵
  PID:11324
- C:\Windows\System\SjZjEeP.exe
  C:\Windows\System\SjZjEeP.exe
  2⤵
  PID:11500
- C:\Windows\System\DpOclVS.exe
  C:\Windows\System\DpOclVS.exe
  2⤵
  PID:11944
- C:\Windows\System\LkFtQOl.exe
  C:\Windows\System\LkFtQOl.exe
  2⤵
  PID:11968
- C:\Windows\System\MmnkHeB.exe
  C:\Windows\System\MmnkHeB.exe
  2⤵
  PID:12044
- C:\Windows\System\YxRyjhD.exe
  C:\Windows\System\YxRyjhD.exe
  2⤵
  PID:12092
- C:\Windows\System\SmHMphA.exe
  C:\Windows\System\SmHMphA.exe
  2⤵
  PID:11268
- C:\Windows\System\yQxpSfb.exe
  C:\Windows\System\yQxpSfb.exe
  2⤵
  PID:11548
- C:\Windows\System\PfplnaS.exe
  C:\Windows\System\PfplnaS.exe
  2⤵
  PID:11860
- C:\Windows\System\GAvhnYT.exe
  C:\Windows\System\GAvhnYT.exe
  2⤵
  PID:12080
- C:\Windows\System\rBVIyNQ.exe
  C:\Windows\System\rBVIyNQ.exe
  2⤵
  PID:11824
- C:\Windows\System\Ewpmdrq.exe
  C:\Windows\System\Ewpmdrq.exe
  2⤵
  PID:1924
- C:\Windows\System\pNzFEHm.exe
  C:\Windows\System\pNzFEHm.exe
  2⤵
  PID:12308
- C:\Windows\System\VIpAwho.exe
  C:\Windows\System\VIpAwho.exe
  2⤵
  PID:12344
- C:\Windows\System\AIavJqy.exe
  C:\Windows\System\AIavJqy.exe
  2⤵
  PID:12376
- C:\Windows\System\caYAtAu.exe
  C:\Windows\System\caYAtAu.exe
  2⤵
  PID:12416
- C:\Windows\System\ftIQZFr.exe
  C:\Windows\System\ftIQZFr.exe
  2⤵
  PID:12436
- C:\Windows\System\EkZcAko.exe
  C:\Windows\System\EkZcAko.exe
  2⤵
  PID:12460
- C:\Windows\System\tcRimAh.exe
  C:\Windows\System\tcRimAh.exe
  2⤵
  PID:12484
- C:\Windows\System\kmDoRYl.exe
  C:\Windows\System\kmDoRYl.exe
  2⤵
  PID:12520
- C:\Windows\System\UrylrsY.exe
  C:\Windows\System\UrylrsY.exe
  2⤵
  PID:12548
- C:\Windows\System\PZpLKGX.exe
  C:\Windows\System\PZpLKGX.exe
  2⤵
  PID:12572
- C:\Windows\System\KdjChhJ.exe
  C:\Windows\System\KdjChhJ.exe
  2⤵
  PID:12588
- C:\Windows\System\DBlHtWS.exe
  C:\Windows\System\DBlHtWS.exe
  2⤵
  PID:12620
- C:\Windows\System\qGnnLsg.exe
  C:\Windows\System\qGnnLsg.exe
  2⤵
  PID:12640
- C:\Windows\System\uRyyfdJ.exe
  C:\Windows\System\uRyyfdJ.exe
  2⤵
  PID:12676
- C:\Windows\System\zHApJRY.exe
  C:\Windows\System\zHApJRY.exe
  2⤵
  PID:12716
- C:\Windows\System\fZkrooG.exe
  C:\Windows\System\fZkrooG.exe
  2⤵
  PID:12752
- C:\Windows\System\VutIflH.exe
  C:\Windows\System\VutIflH.exe
  2⤵
  PID:12776
- C:\Windows\System\DDvdkAc.exe
  C:\Windows\System\DDvdkAc.exe
  2⤵
  PID:12792
- C:\Windows\System\qDfwHcj.exe
  C:\Windows\System\qDfwHcj.exe
  2⤵
  PID:12816
- C:\Windows\System\FXEuDSg.exe
  C:\Windows\System\FXEuDSg.exe
  2⤵
  PID:12832
- C:\Windows\System\msUJwsO.exe
  C:\Windows\System\msUJwsO.exe
  2⤵
  PID:12852
- C:\Windows\System\WmdVLZA.exe
  C:\Windows\System\WmdVLZA.exe
  2⤵
  PID:12880
- C:\Windows\System\ZVKCkut.exe
  C:\Windows\System\ZVKCkut.exe
  2⤵
  PID:12908
- C:\Windows\System\erTWokf.exe
  C:\Windows\System\erTWokf.exe
  2⤵
  PID:12956
- C:\Windows\System\uKpUKWC.exe
  C:\Windows\System\uKpUKWC.exe
  2⤵
  PID:12992
- C:\Windows\System\PzgISwZ.exe
  C:\Windows\System\PzgISwZ.exe
  2⤵
  PID:13016
- C:\Windows\System\uEnmvlJ.exe
  C:\Windows\System\uEnmvlJ.exe
  2⤵
  PID:13044
- C:\Windows\System\dsxQTpW.exe
  C:\Windows\System\dsxQTpW.exe
  2⤵
  PID:13100
- C:\Windows\System\hhbiTuE.exe
  C:\Windows\System\hhbiTuE.exe
  2⤵
  PID:13116
- C:\Windows\System\lOzllXV.exe
  C:\Windows\System\lOzllXV.exe
  2⤵
  PID:13156
- C:\Windows\System\axBBKhl.exe
  C:\Windows\System\axBBKhl.exe
  2⤵
  PID:13176
- C:\Windows\System\ucoLHpL.exe
  C:\Windows\System\ucoLHpL.exe
  2⤵
  PID:13216
- C:\Windows\System\EjFmQcf.exe
  C:\Windows\System\EjFmQcf.exe
  2⤵
  PID:13240
- C:\Windows\System\vPMyCVJ.exe
  C:\Windows\System\vPMyCVJ.exe
  2⤵
  PID:13260
- C:\Windows\System\fEJHlKd.exe
  C:\Windows\System\fEJHlKd.exe
  2⤵
  PID:13284
- C:\Windows\System\UaWxOsS.exe
  C:\Windows\System\UaWxOsS.exe
  2⤵
  PID:13304
- C:\Windows\System\XRxmhSc.exe
  C:\Windows\System\XRxmhSc.exe
  2⤵
  PID:12300
- C:\Windows\System\fLQILkq.exe
  C:\Windows\System\fLQILkq.exe
  2⤵
  PID:12336
- C:\Windows\System\IMmYDPQ.exe
  C:\Windows\System\IMmYDPQ.exe
  2⤵
  PID:12392
- C:\Windows\System\QZMlfOT.exe
  C:\Windows\System\QZMlfOT.exe
  2⤵
  PID:12448
- C:\Windows\System\HTMaGzT.exe
  C:\Windows\System\HTMaGzT.exe
  2⤵
  PID:12516
- C:\Windows\System\kRodQqA.exe
  C:\Windows\System\kRodQqA.exe
  2⤵
  PID:12540
- C:\Windows\System\CDMjOBm.exe
  C:\Windows\System\CDMjOBm.exe
  2⤵
  PID:12964
- C:\Windows\System\tfUtzot.exe
  C:\Windows\System\tfUtzot.exe
  2⤵
  PID:13172
- C:\Windows\System\ODKRoUl.exe
  C:\Windows\System\ODKRoUl.exe
  2⤵
  PID:13236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_ugyf0dgi.wd0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ugyf0dgi.wd0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

AtglBcu.exe

Path C:\Windows\System\AtglBcu.exe
Size 1.6MB
SHA256 a1c204100a80493eb35a054c10e34595fd0926dbbe40b58e2b726a88f346a86e
MD5 959e4066e90e7f5b9fbfa6f05a5b9cfc
SHA1 de4b51e2d7d03fed9a6021a45d37cebc2c155324
SHA512 2d9f660128cbfa7cde9bd814848a32b4b4f2ec6bc2fec0172094f360092b40dd50dcc9001aaed82b975894c7feb3241c748fa5564fc0f95a7764aae3b0afe2bf
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbqoBQ0i1DFK8Mq:Lz071uv4BPMkHC0IlnASEx/mi1DI8x
MD5 SHA1 SHA512 SSDEEP

Submit Download

BwwKYGe.exe

Path C:\Windows\System\BwwKYGe.exe
Size 1.6MB
SHA256 6e3ac83153afb1da8de74befc63c3f36be957324d3b42850f7620c5987800841
MD5 dd3b0587ae9dcf5b885e45bb21a24c9d
SHA1 d4c4a94b41327f8d0a885cf107170b9f6bbc1318
SHA512 64061aff9e6e43004513b0b4966dc26e82e9d8717f18a2a94ee3e6d8c8c1e1df37448fe0df4075321b8561a259b006ca0ef4e81dba1dc42913e759380b67c187
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbqoBQ0i1DFK8MP:Lz071uv4BPMkHC0IlnASEx/mi1DI8O
MD5 SHA1 SHA512 SSDEEP

Submit Download

CYfFNWI.exe

Path C:\Windows\System\CYfFNWI.exe
Size 1.6MB
SHA256 94261d29518fb91eb943e20d3902bf0b787cac40696a52cc42c6d5320d1c6741
MD5 34edf9e437b5ea8beb6555c1c1f50b03
SHA1 d2f67e798ee28a9456f73efffdbd81016b66595f
SHA512 34848a2e1658fdc24fcbe1a3685d9eac154647c5152b96585aafd5288090348100f7fa15b133fa66b3706daf4607dc2f6bc5e7f376ade18c57cf768c95336d79
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbqoBQ0i1DFK8M2:Lz071uv4BPMkHC0IlnASEx/mi1DI8j
MD5 SHA1 SHA512 SSDEEP

Submit Download

DvNTMEU.exe

Path C:\Windows\System\DvNTMEU.exe
Size 1.6MB
SHA256 3b09fc3363fff9891379d3c241fbfb4035cbec54dc69c4f8c171a14c17d7ce86
MD5 b4f8098eb69131dcb1769042a906d8b3
SHA1 a49273669c449d74125f0f346a1bdabd6f3f101e
SHA512 d5301dff2aa1ea99b08153a363880ea05eef875a6c8c11f46510b400553f5c91299a3e1f35c6c845dae6aeaaf596862eff624289bf2aa22d03d354a9d7e60f1b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbqoBQ0i1DFK8MP:Lz071uv4BPMkHC0IlnASEx/mi1DI82
MD5 SHA1 SHA512 SSDEEP

Submit Download

ENxbrgK.exe

Path C:\Windows\System\ENxbrgK.exe
Size 1.6MB
SHA256 46936ae1e797b42b55a8b8134e6b4bf4b170448f3a3f496f704f508f6ecc4fc5
MD5 bbdf95c0fe064605ea3285c57f4e35cb
SHA1 d55cf90a3b514ca27742c384bfaf8cd03637f167
SHA512 9c29c4aec21cc3854135306af837e0e1cd37b1bb2ac68969209dccf26007dfea3fd4f28bcf0a7ee322f73204ecac1165cf0b462ceddb5df69fafdf62e575ce9c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbqoBQ0i1DFK8Me:Lz071uv4BPMkHC0IlnASEx/mi1DI8/
MD5 SHA1 SHA512 SSDEEP

Submit Download

EnVytEL.exe

Path C:\Windows\System\EnVytEL.exe
Size 1.6MB
SHA256 38043556c286c379f2fabde3814fb56259f15d6f18ac7effb9d31013507a5b38
MD5 8947dfbcc6f5b955ffc991e71bc73425
SHA1 7a1bd0394acb00894022d132b8c2a15f06e768cb
SHA512 359dcaa5b38a7770510f0150f3b6f73c601424aec6a5be298a9cf601617223b13553cbbf92c82af1ede87831f64aaec1f78643bf53a929baf1cc10d13ae58f4a
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbqoBQ0i1DFK8Mu:Lz071uv4BPMkHC0IlnASEx/mi1DI87
MD5 SHA1 SHA512 SSDEEP

Submit Download

GcFGEiL.exe

Path C:\Windows\System\GcFGEiL.exe
Size 1.6MB
SHA256 11c55674116b75610fe71176d9a7bf23efdb2dc287e5a562657bf1d33b8be27c
MD5 437ffbc41dfc6b5c03833a257ae6d107
SHA1 5cffb81e7d6940fe7533898e44adedd56925bd94
SHA512 a28b40fff7042cbe9b47f51f84fdbbd1e33ed822e260beaae79db821efad0425e9256bae5b3836169a2e36dc57f75260c3723008e8970466c7b3c24442537db8
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbqoBQ0i1DFK8M/:Lz071uv4BPMkHC0IlnASEx/mi1DI8c
MD5 SHA1 SHA512 SSDEEP

Submit Download

JbnxYUb.exe

Path C:\Windows\System\JbnxYUb.exe
Size 1.6MB
SHA256 533b4ea4ae9c3fa7a437f9e1a8f24de7956ddd2fee823d84513de13c433a8a71
MD5 ac8f00b28ecf059ba49b9ff169fdd300
SHA1 40b4c6a4af8f1d6bbff51e981be444aedeb3f61f
SHA512 1bfd56c4aef52f35bb31e45ae72639519c9984674d46843e6840d130d53f1f67cc7531da94ee90f07fbc3f0ad5f0d11cc41e370b43205d05d21112d25cd09379
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbqoBQ0i1DFK8Ma:Lz071uv4BPMkHC0IlnASEx/mi1DI8j
MD5 SHA1 SHA512 SSDEEP

Submit Download

KHfVunb.exe

Path C:\Windows\System\KHfVunb.exe
Size 1.6MB
SHA256 63ddda67821099217c12b1a83a306890d72cbb7008c5f4020838b46e7ae8f2ef
MD5 9839468a9f2e4162f4fc780c3f82367c
SHA1 c40f0a4d35f09304df908f5050c3af64a564f4de
SHA512 23931edabcac3ecba8cc92dcd314222cc1b0580937b7c19d9c6efdef7d6ad8983e2c6281826b390ff652c1f1ace2e8217c04283a64586a09667e6a91475e4d4b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbqoBQ0i1DFK8Mp:Lz071uv4BPMkHC0IlnASEx/mi1DI8k
MD5 SHA1 SHA512 SSDEEP

Submit Download

KmjtaHZ.exe

Path C:\Windows\System\KmjtaHZ.exe
Size 1.6MB
SHA256 46fcbc7e02bc1cc7f3ef98ba76cec5cfbb2ad48c92751e8d321065307e02927a
MD5 407c974b0b1eca113f09d1b88b573fb1
SHA1 6b2b0e96d8aff927428b2ec3269d2da190634321
SHA512 88c25afb0cade97a2d02dca8611ca8341f9c9d5e180e902777c1e241e89a1e05b4cbdf808cab6f98adb6c2602ea8cbf9cd018add0feff39809c4b8b218aa446e
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbqoBQ0i1DFK8Mj:Lz071uv4BPMkHC0IlnASEx/mi1DI80
MD5 SHA1 SHA512 SSDEEP

Submit Download

KytIMvm.exe

Path C:\Windows\System\KytIMvm.exe
Size 1.6MB
SHA256 d410990700657d4aed74d9f8aa2ee7b69962dc784af189951d55f4eb32b90464
MD5 ec625e1592365b2cc0d1bb069b6de704
SHA1 1c639dc287b3f3cda1873b55d89c86f33225aa37
SHA512 d82e3979d9393a6bf84cb363347ed402a810faf591f02357c62d00be20ccb786734ade52536663636e5488f2b7b7346169b31da6e0e0aa1fa12e65484904e7d1
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbqoBQ0i1DFK8M5:Lz071uv4BPMkHC0IlnASEx/mi1DI82
MD5 SHA1 SHA512 SSDEEP

Submit Download

PZvlojp.exe

Path C:\Windows\System\PZvlojp.exe
Size 1.6MB
SHA256 305bd2ae4de191d7d562d0d15acb12eda4f4c7ff087060dd90a994ea03993510
MD5 9174ae8b18a1c3aef2b2649c207e0d73
SHA1 8f96a8c397e44c86a418c1d6679148bc45ea3de1
SHA512 5a4df4ede22f75e31f1bb7cc76507a6badcbf20eaec8a46d6ff36589c948db9211cc3215f9f2a7474a7df38f8d0fde7de34ea583b20505fbd08baec16230a3bf
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbqoBQ0i1DFK8M1:Lz071uv4BPMkHC0IlnASEx/mi1DI8s
MD5 SHA1 SHA512 SSDEEP

Submit Download

PtbvnoQ.exe

Path C:\Windows\System\PtbvnoQ.exe
Size 1.6MB
SHA256 3fed17053076dc739e983355f7a38f482fc47cf3d0173867b27392ca3de0c042
MD5 8fa38f9859d1765cc77e4ac71abd5ef6
SHA1 a5e45db958d587486fec9fa93369e887b1fe554f
SHA512 94e3726271e2b3c7c9f95089a57844d1109be265b39997dc47011b6e202f991df4e4f9cc5c7e811747f1fffcb9c83b15fd607ea568d7eb5d6d97681201601f5c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbqoBQ0i1DFK8Mn:Lz071uv4BPMkHC0IlnASEx/mi1DI8q
MD5 SHA1 SHA512 SSDEEP

Submit Download

UlFrOJh.exe

Path C:\Windows\System\UlFrOJh.exe
Size 1.6MB
SHA256 a7186d8c9c2281acd00e026e7ea60684989eab530a75e34b166ea37456301a87
MD5 34b77ac49f19a2806eb41aecd5bd8196
SHA1 5dc99eca9d11d49b2cea6ac30d4dd04a3c110f53
SHA512 1c44670e4dabb1c8db08b80ba119d0bf2922624e8e3bd556df96539d2d4b764b632770b2d6e7d0a9d6ee06dd250c38e569a9530c0834d948b806356aed941bd2
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbqoBQ0i1DFK8MY:Lz071uv4BPMkHC0IlnASEx/mi1DI8/
MD5 SHA1 SHA512 SSDEEP

Submit Download

UpkfJjG.exe

Path C:\Windows\System\UpkfJjG.exe
Size 1.6MB
SHA256 0c0314dc588260c5ebfced396b79f6224391d6a2ce39096e771370aec18ed94b
MD5 720003517016c090d02e985b6fa3ba90
SHA1 3694ef5d673e1b06360422e49884edd13b0ed271
SHA512 d48e9634e8f8fe37eee244e6eeffefab81151e946f2101e4e0c5a022e31fe611bb798ba0856a1c26ad4c190ee67aa0430a7544167f8b50fc895cf9d875bfdfe9
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbqoBQ0i1DFK8MH:Lz071uv4BPMkHC0IlnASEx/mi1DI86
MD5 SHA1 SHA512 SSDEEP

Submit Download

VHnfouU.exe

Path C:\Windows\System\VHnfouU.exe
Size 1.6MB
SHA256 9c1bd458d720033a76ba183c70a37adab248be0b4e0270850959fbaf3b3baffd
MD5 28b8496e71698f7b1e0f5d62a11f3d0d
SHA1 6212d08bd415ee9df85f3b50b0ed26b3a79789c1
SHA512 4016418a0efe0b99592f9068e025f2c11366ae4a7ff33abe21ebb6838e07799edee7a41623b85f457c90fd82d90605f26b4cc98c2c466416eaddced6039b62a3
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbqoBQ0i1DFK8Mn:Lz071uv4BPMkHC0IlnASEx/mi1DI8Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

VNpvKDX.exe

Path C:\Windows\System\VNpvKDX.exe
Size 1.6MB
SHA256 e71088fa79bb55994beff10225b4e5c447af4b10c8563c1c925f1ca80cacd4e2
MD5 27a0530b869e28978a8525ef43a9254d
SHA1 e171fd3f8545e51d3a155321a2c15d34749cdb59
SHA512 d670cb0cd544eafb9b0f17bbf9249cd92256a8ca285f3e69bff3ba68a51b8227bed448baffabad857779947c6aff10ddfc1ccb5ef8379dedc83baf0d5988a18c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbqoBQ0i1DFK8Mw:Lz071uv4BPMkHC0IlnASEx/mi1DI8p
MD5 SHA1 SHA512 SSDEEP

Submit Download

WraDFfO.exe

Path C:\Windows\System\WraDFfO.exe
Size 1.6MB
SHA256 4cf5089b70e3f45ef5a08b583ab3a6abb66ad679b6894bd7a05282c8b282f5f3
MD5 8f19a7e1e0b307ba948dc12ceea66163
SHA1 43df1847d304cc1ae1aac0d77d6c78670d1fa116
SHA512 ac25876c103a97af9711fce614fd589a5b0a48651c8c2e4c8cb939fb04e9855e83229e046d741458a89935cf6e079f411bc9af6adfc381c79ba559979df7005f
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbqoBQ0i1DFK8Md:Lz071uv4BPMkHC0IlnASEx/mi1DI8E
MD5 SHA1 SHA512 SSDEEP

Submit Download

YVZmVDt.exe

Path C:\Windows\System\YVZmVDt.exe
Size 1.6MB
SHA256 aeba4620e7b5a22ac304f79795182a538ce3733cfbebdb0baaa85bb3904cd074
MD5 bebf85ac1168319624741c15c321f240
SHA1 f61b8b63854e40d1ea7cdebe135a9a6a164d5a70
SHA512 49116813e45078eee77b668ff291f474e43ee1e071823a21179a7fa836ae0a4a26893896b9d0ee2e47f06e5879ab256b40450a5e05dc66e21c09299ceb8bb07c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbqoBQ0i1DFK8Mv:Lz071uv4BPMkHC0IlnASEx/mi1DI8o
MD5 SHA1 SHA512 SSDEEP

Submit Download

dNgvDLk.exe

Path C:\Windows\System\dNgvDLk.exe
Size 1.6MB
SHA256 d5b5f6a53012cce51f963ef6b08ba061d0cbf9447f5761ab1639a6e6b73b7761
MD5 ff40af957f84580dbda45263a990b3d4
SHA1 f61397aa35ffc0a86c74d3fbb0492900297f04bf
SHA512 c8f8097104b88f96ad843013d51a7262063a760ce00527d96d850a63757cd9c272dcf4daee713cc83571b7d1709730a7ffa6eccb6491aeb46bf465a6bc4b0cb1
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbqoBQ0i1DFK8Mh:Lz071uv4BPMkHC0IlnASEx/mi1DI8g
MD5 SHA1 SHA512 SSDEEP

Submit Download

dnwzcWC.exe

Path C:\Windows\System\dnwzcWC.exe
Size 1.6MB
SHA256 36b51e57e39ccef78a084da9f5fb0245d1d7a56c8c6e73b9c15fcb7f4735ae57
MD5 3b8e261efaa732b11ed4b27ce814a5e4
SHA1 3c0588569ccc6d252eaaf6d4181270520902bab6
SHA512 18aca7a8092ac112bc421fd8001acf272907261d42610c958d10bc7ca4686dde0a95f5fe01458e820c0c81ea36e7d5785771f37fb131e3f1f778cea63559be3f
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbqoBQ0i1DFK8Me:Lz071uv4BPMkHC0IlnASEx/mi1DI8x
MD5 SHA1 SHA512 SSDEEP

Submit Download

jWCHbaL.exe

Path C:\Windows\System\jWCHbaL.exe
Size 1.6MB
SHA256 0f318d68f62c2202fd5fe51e022af654ea77c1701600e58c6238849a743c939b
MD5 0c345febd25b3ff364f1021f616460ac
SHA1 a0a4407372a4c6817ef537ae38c6a6e802a4a8a5
SHA512 0c5b83559bc4cc62fbfd0f04b8c5167059a08165ebcb1bf7c7a06cfa58581d60d8df65d905928be8b1c403191e8ee09c254c5d1f50dd5ccaf3165fb1f11b86bc
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbqoBQ0i1DFK8M/:Lz071uv4BPMkHC0IlnASEx/mi1DI8E
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhTwqOO.exe

Path C:\Windows\System\jhTwqOO.exe
Size 1.6MB
SHA256 dbfd86106b9ad5bf28b9c8ac2bab36c64fae97b87d452573860174700b9d6d17
MD5 c223b10b66d724157f58a4b8e53d2ff5
SHA1 22a3fe3dfaccf211fa7f7704378a909d556c4a4a
SHA512 b3d8875944b7912fd0f1a93cf6fd806342587c16d76213c563cfc57c8b8d5b2d9ff67811506fce27f65d4521e0c7dec8182236c57378eb93383cc4fdccde42bd
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbqoBQ0i1DFK8Mw:Lz071uv4BPMkHC0IlnASEx/mi1DI8H
MD5 SHA1 SHA512 SSDEEP

Submit Download

lzHSPfN.exe

Path C:\Windows\System\lzHSPfN.exe
Size 1.6MB
SHA256 d4abe70209675bbb851aff9f772ad109ed9c1e775bf2def86a4662678db4377c
MD5 dc97bee1b61f36010219fd1846b014c3
SHA1 9427ee41cbe5e98c2ba3cef64414d827873d0262
SHA512 e0d042ef3344273bbf2d9d119109dfa382528eed795669eab0014468454ef29658568def11f5122f2d1a30bec56e01dbc9fd6a1a4dce48e5897d84ccb1151927
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbqoBQ0i1DFK8MS:Lz071uv4BPMkHC0IlnASEx/mi1DI8x
MD5 SHA1 SHA512 SSDEEP

Submit Download

nNUVShF.exe

Path C:\Windows\System\nNUVShF.exe
Size 1.6MB
SHA256 f302eb827261c7b8f2f9b47a6883ed5361acde2c894b75a342367170f4e5b686
MD5 afd36ffa33be0f68b128316eb7884d63
SHA1 4bf16751caee8519b8fc8306fb7261377e430c8e
SHA512 35ab7ed8ef563ef81bfd6acd0a05c7a0bc6db3ab4d0eb302fc48d63c010ee7459aa9228ab2ed8fef097e7fdba57a354eaf97909f73d011c38149c0739176b52a
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbqoBQ0i1DFK8M9:Lz071uv4BPMkHC0IlnASEx/mi1DI8e
MD5 SHA1 SHA512 SSDEEP

Submit Download

oaolcpU.exe

Path C:\Windows\System\oaolcpU.exe
Size 1.6MB
SHA256 b37dcf6f5b0da751ac2fb38785843e3b9af5b9f707a55bbb32470227ed93fe44
MD5 b3d976ceb89101040aa210b3bcdb0332
SHA1 f8f1a3db31909a02f43fd0b8e2fff98f38759059
SHA512 b4936555c772bdc103786f6dfc487ea4c25cfe9699bfecf7398aebb0164f65b26ee4407460274a90f9bc39ca3fd9f9685558203db90eb360abb9dddd6054f04d
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbqoBQ0i1DFK8M8:Lz071uv4BPMkHC0IlnASEx/mi1DI89
MD5 SHA1 SHA512 SSDEEP

Submit Download

pEMBsAF.exe

Path C:\Windows\System\pEMBsAF.exe
Size 1.6MB
SHA256 2a7176c8908ce4e30f6836f19c48dcc525dddb1d01d29d6ab88c30fe75def135
MD5 0a0516c32d72a5713e3a61448c541ef6
SHA1 acf70407766fbedfe90039d3a8deb3f54a39f9b0
SHA512 9abefd682c5f1942c1c6944e6b8321b323dc445be8a7f79a7a56e9ece8952f6ded4a75181b50129db86eaa9c6360cd23c65d278eb7791ad65046ddabe26f320c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbqoBQ0i1DFK8Mj:Lz071uv4BPMkHC0IlnASEx/mi1DI8e
MD5 SHA1 SHA512 SSDEEP

Submit Download

rOMqhJr.exe

Path C:\Windows\System\rOMqhJr.exe
Size 1.6MB
SHA256 fba79bdba5cb7f4ea933dd23103b21c236c4d4c60196e8b74d09f5c87101064b
MD5 8d925b2747e45dc21445deb5ee24ba51
SHA1 a19f32c013a8cc6fe66c548969e33d8718c730a5
SHA512 a81b2c8dd12d26f354a8dcee9a580f0a411c97179d955a35b14243f4ff3934cf315e9abce3c8e238ff3703710671fe9b2bb7e5f4f0e0a8dd8b4d7735c61a3940
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbqoBQ0i1DFK8MG:Lz071uv4BPMkHC0IlnASEx/mi1DI8R
MD5 SHA1 SHA512 SSDEEP

Submit Download

tDXnAMx.exe

Path C:\Windows\System\tDXnAMx.exe
Size 1.6MB
SHA256 e189eb6168ba1c6e39577de097d983e082e7d6aa2efaa98a378d21f84929584b
MD5 9eaf20c722b29b9a100bc1d1cf93104f
SHA1 61f37e0c4f0e2a72792ae0679e992f5aeeac8f46
SHA512 c9254b24d3ed47634bb97609e809146e5022b4c194ed6e4abddb3ceef59ece4c4d0b419171cca805f4ed52b02767ad512cfa2c1f1809359f86449581085aca57
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbqoBQ0i1DFK8MI:Lz071uv4BPMkHC0IlnASEx/mi1DI8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

tcVfbUQ.exe

Path C:\Windows\System\tcVfbUQ.exe
Size 1.6MB
SHA256 a66b8948a63f714a4d13122964df93520d652d3e956d1221a4a2453f92c4671c
MD5 e8466b4541c9cc17192ac5fde48142ea
SHA1 14196d88ae91e65edd722a23b836a5d11cf08cc0
SHA512 f55893544f2be2aa7bc3c02eba1922bc26322f24bd7950ede4fa0db35eda38c16df741ebd99383b9f6c8c5525bfab2dac6fd554011c547eb396c63a1946d5fee
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbqoBQ0i1DFK8Me:Lz071uv4BPMkHC0IlnASEx/mi1DI87
MD5 SHA1 SHA512 SSDEEP

Submit Download

yKEmwqg.exe

Path C:\Windows\System\yKEmwqg.exe
Size 1.6MB
SHA256 2890ae888958f069e33e32ac1fbadded7fc4228f3e3663712c5344d0adcd1566
MD5 22fdd0656fcac293217fa63b7d089831
SHA1 565d9942a3a4af848f60d592fa7603a0f2253464
SHA512 895d6ef605503b7f51dedb23c50f22ae82d638cfd46b69c1dfe2591f068cee673c390e356445819f90f688a4d1b8c78c5565c55d173a659be06633ebd2bfeb1e
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbqoBQ0i1DFK8M5:Lz071uv4BPMkHC0IlnASEx/mi1DI8C
MD5 SHA1 SHA512 SSDEEP

Submit Download

yjJelYL.exe

Path C:\Windows\System\yjJelYL.exe
Size 1.6MB
SHA256 534b8d1e0d9189e3e68a73ae625260e48f1763d5833a277797e56bfd27803bd9
MD5 0ad3789bf888ffcf3ad5f5046c740b86
SHA1 ddf37a625135f7bb3d3e8a31ec987bfe31148132
SHA512 5a58cfe1d550b5b96c9d39ff09e66e7c765259b8fb299ad3278380a84d0920c1d23f04433869b248fa70c77a05dd401e6d665199d2a9b4e40762d0bed96066f3
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbqoBQ0i1DFK8M2:Lz071uv4BPMkHC0IlnASEx/mi1DI83
MD5 SHA1 SHA512 SSDEEP

Submit Download

yoPNwTM.exe

Path C:\Windows\System\yoPNwTM.exe
Size 8B
SHA256 76bc446e18daed4e6417440c778e757728762c893f014de08ffa5f0fe98668bd
MD5 68703642e5faeaf00b4b9f791a04a7f5
SHA1 2e8f5d51bda54b6b227caed2cb4535020c7a482c
SHA512 0c1919485a30576b5fdf963204dc04b356f524c23dfb4ffaecdbb8a8ea4a0993cf3ac05bee011edf07b5b637ac7455499983eac22f5cdd87cd869e7a046115a5
MD5 SHA1 SHA512

Submit Download

zcusbPM.exe

Path C:\Windows\System\zcusbPM.exe
Size 1.6MB
SHA256 7198ef28166f045bc7db624beaa7a69cd768329e894d6ab16cc30b36a077f958
MD5 518134c533caef6d5adb56d2db01a288
SHA1 05d4dee86abbcc06a7aa841b3dd3b6a4427a7237
SHA512 771eb2de556206219ac04bf69ebb1b1c4fbaf04192adb5aaf504648ab2a38e4cc4d68dc48014a8ca59b3490b75a8c9a940e29926702e25759ec7fab4c0c5bd47
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbqoBQ0i1DFK8MN:Lz071uv4BPMkHC0IlnASEx/mi1DI8C
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/540-141-0x00007FF726930000-0x00007FF726D22000-memory.dmp

Download

memory/540-2116-0x00007FF726930000-0x00007FF726D22000-memory.dmp

Download

memory/540-2186-0x00007FF726930000-0x00007FF726D22000-memory.dmp

Download

memory/1068-2168-0x00007FF622470000-0x00007FF622862000-memory.dmp

Download

memory/1068-90-0x00007FF622470000-0x00007FF622862000-memory.dmp

Download

memory/1136-2077-0x00007FF6A7E20000-0x00007FF6A8212000-memory.dmp

Download

memory/1136-2147-0x00007FF6A7E20000-0x00007FF6A8212000-memory.dmp

Download

memory/1136-29-0x00007FF6A7E20000-0x00007FF6A8212000-memory.dmp

Download

memory/1236-2173-0x00007FF6DAAD0000-0x00007FF6DAEC2000-memory.dmp

Download

memory/1236-89-0x00007FF6DAAD0000-0x00007FF6DAEC2000-memory.dmp

Download

memory/1276-159-0x00007FF7B9C30000-0x00007FF7BA022000-memory.dmp

Download

memory/1276-2197-0x00007FF7B9C30000-0x00007FF7BA022000-memory.dmp

Download

memory/1276-2119-0x00007FF7B9C30000-0x00007FF7BA022000-memory.dmp

Download

memory/1352-133-0x00007FF6F35D0000-0x00007FF6F39C2000-memory.dmp

Download

memory/1352-2102-0x00007FF6F35D0000-0x00007FF6F39C2000-memory.dmp

Download

memory/1352-2199-0x00007FF6F35D0000-0x00007FF6F39C2000-memory.dmp

Download

memory/1388-166-0x00007FF6489D0000-0x00007FF648DC2000-memory.dmp

Download

memory/1388-10-0x00007FF6489D0000-0x00007FF648DC2000-memory.dmp

Download

memory/1388-2121-0x00007FF6489D0000-0x00007FF648DC2000-memory.dmp

Download

memory/1728-113-0x00007FF6D7C20000-0x00007FF6D8012000-memory.dmp

Download

memory/1728-2163-0x00007FF6D7C20000-0x00007FF6D8012000-memory.dmp

Download

memory/1796-2172-0x00007FF78EF00000-0x00007FF78F2F2000-memory.dmp

Download

memory/1796-83-0x00007FF78EF00000-0x00007FF78F2F2000-memory.dmp

Download

memory/1804-2159-0x00007FF7D3A70000-0x00007FF7D3E62000-memory.dmp

Download

memory/1804-2080-0x00007FF7D3A70000-0x00007FF7D3E62000-memory.dmp

Download

memory/1804-100-0x00007FF7D3A70000-0x00007FF7D3E62000-memory.dmp

Download

memory/2328-2179-0x00007FF7D4C90000-0x00007FF7D5082000-memory.dmp

Download

memory/2328-153-0x00007FF7D4C90000-0x00007FF7D5082000-memory.dmp

Download

memory/2328-2118-0x00007FF7D4C90000-0x00007FF7D5082000-memory.dmp

Download

memory/2380-1202-0x00007FF70EEC0000-0x00007FF70F2B2000-memory.dmp

Download

memory/2380-14-0x00007FF70EEC0000-0x00007FF70F2B2000-memory.dmp

Download

memory/2380-2146-0x00007FF70EEC0000-0x00007FF70F2B2000-memory.dmp

Download

memory/2624-117-0x00007FF66BED0000-0x00007FF66C2C2000-memory.dmp

Download

memory/2624-2158-0x00007FF66BED0000-0x00007FF66C2C2000-memory.dmp

Download

memory/2760-129-0x00007FF66FD00000-0x00007FF6700F2000-memory.dmp

Download

memory/2760-2175-0x00007FF66FD00000-0x00007FF6700F2000-memory.dmp

Download

memory/2760-2101-0x00007FF66FD00000-0x00007FF6700F2000-memory.dmp

Download

memory/3084-2152-0x00007FF761630000-0x00007FF761A22000-memory.dmp

Download

memory/3084-106-0x00007FF761630000-0x00007FF761A22000-memory.dmp

Download

memory/3476-2064-0x00007FFD4F1B3000-0x00007FFD4F1B5000-memory.dmp

Download

memory/3476-68-0x0000020ACF920000-0x0000020ACF942000-memory.dmp

Download

memory/3476-450-0x0000020AD0880000-0x0000020AD1026000-memory.dmp

Download

memory/3476-16-0x00007FFD4F1B3000-0x00007FFD4F1B5000-memory.dmp

Download

memory/3476-15-0x0000020ACFA10000-0x0000020ACFA20000-memory.dmp

Download

memory/3656-2181-0x00007FF7ED170000-0x00007FF7ED562000-memory.dmp

Download

memory/3656-167-0x00007FF7ED170000-0x00007FF7ED562000-memory.dmp

Download

memory/3664-107-0x00007FF726FD0000-0x00007FF7273C2000-memory.dmp

Download

memory/3664-2155-0x00007FF726FD0000-0x00007FF7273C2000-memory.dmp

Download

memory/3948-0-0x00007FF7B1CC0000-0x00007FF7B20B2000-memory.dmp

Download

memory/3948-165-0x00007FF7B1CC0000-0x00007FF7B20B2000-memory.dmp

Download

memory/3948-1-0x0000011381B30000-0x0000011381B40000-memory.dmp

Download

memory/4064-120-0x00007FF71BD70000-0x00007FF71C162000-memory.dmp

Download

memory/4064-2161-0x00007FF71BD70000-0x00007FF71C162000-memory.dmp

Download

memory/4076-2117-0x00007FF647CE0000-0x00007FF6480D2000-memory.dmp

Download

memory/4076-147-0x00007FF647CE0000-0x00007FF6480D2000-memory.dmp

Download

memory/4076-2184-0x00007FF647CE0000-0x00007FF6480D2000-memory.dmp

Download

memory/4104-2153-0x00007FF717540000-0x00007FF717932000-memory.dmp

Download

memory/4104-44-0x00007FF717540000-0x00007FF717932000-memory.dmp

Download

memory/4104-2078-0x00007FF717540000-0x00007FF717932000-memory.dmp

Download

memory/4828-2115-0x00007FF6384A0000-0x00007FF638892000-memory.dmp

Download

memory/4828-123-0x00007FF6384A0000-0x00007FF638892000-memory.dmp

Download

memory/4828-2372-0x00007FF6384A0000-0x00007FF638892000-memory.dmp

Download

memory/5080-2166-0x00007FF658860000-0x00007FF658C52000-memory.dmp

Download

memory/5080-96-0x00007FF658860000-0x00007FF658C52000-memory.dmp

Download

memory/5104-25-0x00007FF6B43D0000-0x00007FF6B47C2000-memory.dmp

Download

memory/5104-2149-0x00007FF6B43D0000-0x00007FF6B47C2000-memory.dmp

Download

memory/5104-2075-0x00007FF6B43D0000-0x00007FF6B47C2000-memory.dmp

Download

memory/5108-2170-0x00007FF7A1B40000-0x00007FF7A1F32000-memory.dmp

Download

memory/5108-75-0x00007FF7A1B40000-0x00007FF7A1F32000-memory.dmp

Download

memory/5108-2079-0x00007FF7A1B40000-0x00007FF7A1F32000-memory.dmp

Download