xmrig | 935d2625479788dd7c3a78a8db8801e51cd5ab196a118fa777fcb34d28434e36

Analysis

max time kernel
117s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 07:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
Size 1.6MB
Sample240613-jsdvvszepg
SHA256 935d2625479788dd7c3a78a8db8801e51cd5ab196a118fa777fcb34d28434e36
MD5 6ae155c6033c065a1d9659439e576870
SHA1 05fdbfd99d1aa90c78b15a8830042c7a8c529028
SHA512 3bf6a9374a858a7af1b5ff84edef558cfeba5e03e6e9b74dccdfc2db171b15f5ea358c841656b5a8049198714c2f3975d6db12541904e6c618f708632f66e282
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdxr:Lz071uv4BPMki8CnfLv3zQXtTEjr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/1344-100-0x00007FF60C0A0000-0x00007FF60C492000-memory.dmp	xmrig
behavioral2/memory/4548-157-0x00007FF78DCC0000-0x00007FF78E0B2000-memory.dmp	xmrig
behavioral2/memory/3164-171-0x00007FF6DC880000-0x00007FF6DCC72000-memory.dmp	xmrig
behavioral2/memory/4140-170-0x00007FF6A85B0000-0x00007FF6A89A2000-memory.dmp	xmrig
behavioral2/memory/1900-164-0x00007FF696740000-0x00007FF696B32000-memory.dmp	xmrig
behavioral2/memory/732-158-0x00007FF787180000-0x00007FF787572000-memory.dmp	xmrig
behavioral2/memory/4940-151-0x00007FF733910000-0x00007FF733D02000-memory.dmp	xmrig
behavioral2/memory/2416-145-0x00007FF68E0B0000-0x00007FF68E4A2000-memory.dmp	xmrig
behavioral2/memory/3452-139-0x00007FF7530E0000-0x00007FF7534D2000-memory.dmp	xmrig
behavioral2/memory/4544-138-0x00007FF7287D0000-0x00007FF728BC2000-memory.dmp	xmrig
behavioral2/memory/1564-132-0x00007FF73F0F0000-0x00007FF73F4E2000-memory.dmp	xmrig
behavioral2/memory/4972-126-0x00007FF786FB0000-0x00007FF7873A2000-memory.dmp	xmrig
behavioral2/memory/2104-125-0x00007FF6B7920000-0x00007FF6B7D12000-memory.dmp	xmrig
behavioral2/memory/4980-119-0x00007FF773EC0000-0x00007FF7742B2000-memory.dmp	xmrig
behavioral2/memory/2744-113-0x00007FF680E50000-0x00007FF681242000-memory.dmp	xmrig
behavioral2/memory/3628-112-0x00007FF784FE0000-0x00007FF7853D2000-memory.dmp	xmrig
behavioral2/memory/2836-99-0x00007FF6B7CA0000-0x00007FF6B8092000-memory.dmp	xmrig
behavioral2/memory/4532-93-0x00007FF70BE00000-0x00007FF70C1F2000-memory.dmp	xmrig
behavioral2/memory/3312-89-0x00007FF7D61B0000-0x00007FF7D65A2000-memory.dmp	xmrig
behavioral2/memory/1432-82-0x00007FF6E2090000-0x00007FF6E2482000-memory.dmp	xmrig
behavioral2/memory/1764-79-0x00007FF72EC40000-0x00007FF72F032000-memory.dmp	xmrig
behavioral2/memory/232-78-0x00007FF7D48F0000-0x00007FF7D4CE2000-memory.dmp	xmrig
behavioral2/memory/896-1993-0x00007FF791B70000-0x00007FF791F62000-memory.dmp	xmrig
behavioral2/memory/4392-1995-0x00007FF7815B0000-0x00007FF7819A2000-memory.dmp	xmrig
behavioral2/memory/896-2013-0x00007FF791B70000-0x00007FF791F62000-memory.dmp	xmrig
behavioral2/memory/232-2015-0x00007FF7D48F0000-0x00007FF7D4CE2000-memory.dmp	xmrig
behavioral2/memory/3628-2017-0x00007FF784FE0000-0x00007FF7853D2000-memory.dmp	xmrig
behavioral2/memory/1764-2021-0x00007FF72EC40000-0x00007FF72F032000-memory.dmp	xmrig
behavioral2/memory/2744-2019-0x00007FF680E50000-0x00007FF681242000-memory.dmp	xmrig
behavioral2/memory/1432-2023-0x00007FF6E2090000-0x00007FF6E2482000-memory.dmp	xmrig
behavioral2/memory/4532-2026-0x00007FF70BE00000-0x00007FF70C1F2000-memory.dmp	xmrig
behavioral2/memory/3312-2027-0x00007FF7D61B0000-0x00007FF7D65A2000-memory.dmp	xmrig
behavioral2/memory/4980-2029-0x00007FF773EC0000-0x00007FF7742B2000-memory.dmp	xmrig
behavioral2/memory/2416-2032-0x00007FF68E0B0000-0x00007FF68E4A2000-memory.dmp	xmrig
behavioral2/memory/4548-2045-0x00007FF78DCC0000-0x00007FF78E0B2000-memory.dmp	xmrig
behavioral2/memory/732-2051-0x00007FF787180000-0x00007FF787572000-memory.dmp	xmrig
behavioral2/memory/2104-2049-0x00007FF6B7920000-0x00007FF6B7D12000-memory.dmp	xmrig
behavioral2/memory/4544-2047-0x00007FF7287D0000-0x00007FF728BC2000-memory.dmp	xmrig
behavioral2/memory/3452-2043-0x00007FF7530E0000-0x00007FF7534D2000-memory.dmp	xmrig
behavioral2/memory/2836-2039-0x00007FF6B7CA0000-0x00007FF6B8092000-memory.dmp	xmrig
behavioral2/memory/4972-2036-0x00007FF786FB0000-0x00007FF7873A2000-memory.dmp	xmrig
behavioral2/memory/4940-2042-0x00007FF733910000-0x00007FF733D02000-memory.dmp	xmrig
behavioral2/memory/1344-2038-0x00007FF60C0A0000-0x00007FF60C492000-memory.dmp	xmrig
behavioral2/memory/1564-2034-0x00007FF73F0F0000-0x00007FF73F4E2000-memory.dmp	xmrig
behavioral2/memory/4140-2061-0x00007FF6A85B0000-0x00007FF6A89A2000-memory.dmp	xmrig
behavioral2/memory/3164-2058-0x00007FF6DC880000-0x00007FF6DCC72000-memory.dmp	xmrig
behavioral2/memory/1900-2053-0x00007FF696740000-0x00007FF696B32000-memory.dmp	xmrig
behavioral2/memory/4392-2366-0x00007FF7815B0000-0x00007FF7819A2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	4796	powershell.exe
5	4796	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4796	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
896	nluHyqU.exe
232	DXDpHvH.exe
3628	GCRsAoz.exe
2744	plyNpcL.exe
1764	mDpmKGD.exe
1432	syGAFrw.exe
3312	xCMagcJ.exe
4532	FHyQjtn.exe
4980	tTFMYRM.exe
2836	PSJgXMP.exe
1344	FGJaclf.exe
2104	wTvHulF.exe
4392	TlcwpIt.exe
4972	XtHdyGk.exe
1564	rqpuglS.exe
4544	EoMBTbu.exe
3452	RUNWQNE.exe
2416	BSbiLwG.exe
4940	dwyNZdl.exe
4548	KkRgsuI.exe
732	hAPqRJV.exe
1900	VwLmRCG.exe
4140	SEPsPuv.exe
3164	XEWyzHF.exe
5036	PZNtaZL.exe
744	ZxUEXng.exe
4660	krORkAP.exe
2972	cGRByVm.exe
2304	bPTMzbq.exe
4244	GHNryNp.exe
3412	cNROIlu.exe
3832	boYZmzj.exe
2400	FeZWEgm.exe
2348	eUtgJls.exe
2196	ldgSYOp.exe
4112	XbyexKv.exe
4592	wGNaeeS.exe
5080	cYcfyfG.exe
3032	sDdyZEJ.exe
2432	ewhMjdo.exe
4676	qinKtWl.exe
1196	OlbUpQe.exe
1904	wiGRtHS.exe
4488	zEQvHDi.exe
4448	UGRKxkf.exe
556	OiApZqm.exe
4340	rzvwquP.exe
4208	qvtvukl.exe
4252	CzhxQgD.exe
4100	vEqJmdm.exe
5040	HtLwMIL.exe
2464	taNhweO.exe
684	KOgjSOK.exe
3092	hQtoALS.exe
3344	BWBLyKB.exe
2100	nSBGdah.exe
2356	GTCDQTg.exe
3988	JpqwlbN.exe
3476	VwUUSKH.exe
584	kPJAMdA.exe
3612	fASFJuj.exe
3196	VlCAQdU.exe
4124	YJjbLTB.exe
3796	nhuzKts.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3560-0-0x00007FF706C40000-0x00007FF707032000-memory.dmp	upx
behavioral2/memory/896-6-0x00007FF791B70000-0x00007FF791F62000-memory.dmp	upx
behavioral2/files/0x00050000000232b2-5.dat	upx
behavioral2/files/0x0007000000023449-9.dat	upx
behavioral2/files/0x000700000002344a-20.dat	upx
behavioral2/files/0x000700000002344b-23.dat	upx
behavioral2/files/0x000700000002344d-36.dat	upx
behavioral2/files/0x000700000002344e-37.dat	upx
behavioral2/files/0x000700000002344f-43.dat	upx
behavioral2/files/0x0008000000023446-77.dat	upx
behavioral2/memory/1344-100-0x00007FF60C0A0000-0x00007FF60C492000-memory.dmp	upx
behavioral2/files/0x000700000002345c-142.dat	upx
behavioral2/memory/4548-157-0x00007FF78DCC0000-0x00007FF78E0B2000-memory.dmp	upx
behavioral2/memory/3164-171-0x00007FF6DC880000-0x00007FF6DCC72000-memory.dmp	upx
behavioral2/files/0x0007000000023466-199.dat	upx
behavioral2/files/0x0007000000023464-197.dat	upx
behavioral2/files/0x0007000000023465-194.dat	upx
behavioral2/files/0x0007000000023463-192.dat	upx
behavioral2/files/0x0007000000023462-187.dat	upx
behavioral2/files/0x0007000000023461-182.dat	upx
behavioral2/files/0x0007000000023460-177.dat	upx
behavioral2/files/0x000700000002345f-172.dat	upx
behavioral2/memory/4140-170-0x00007FF6A85B0000-0x00007FF6A89A2000-memory.dmp	upx
behavioral2/files/0x000700000002345e-165.dat	upx
behavioral2/memory/1900-164-0x00007FF696740000-0x00007FF696B32000-memory.dmp	upx
behavioral2/files/0x000700000002345d-159.dat	upx
behavioral2/memory/732-158-0x00007FF787180000-0x00007FF787572000-memory.dmp	upx
behavioral2/memory/4940-151-0x00007FF733910000-0x00007FF733D02000-memory.dmp	upx
behavioral2/files/0x000700000002345b-146.dat	upx
behavioral2/memory/2416-145-0x00007FF68E0B0000-0x00007FF68E4A2000-memory.dmp	upx
behavioral2/files/0x000700000002345a-140.dat	upx
behavioral2/memory/3452-139-0x00007FF7530E0000-0x00007FF7534D2000-memory.dmp	upx
behavioral2/memory/4544-138-0x00007FF7287D0000-0x00007FF728BC2000-memory.dmp	upx
behavioral2/files/0x0007000000023459-133.dat	upx
behavioral2/memory/1564-132-0x00007FF73F0F0000-0x00007FF73F4E2000-memory.dmp	upx
behavioral2/files/0x0007000000023458-127.dat	upx
behavioral2/memory/4972-126-0x00007FF786FB0000-0x00007FF7873A2000-memory.dmp	upx
behavioral2/memory/2104-125-0x00007FF6B7920000-0x00007FF6B7D12000-memory.dmp	upx
behavioral2/files/0x0008000000023453-120.dat	upx
behavioral2/memory/4980-119-0x00007FF773EC0000-0x00007FF7742B2000-memory.dmp	upx
behavioral2/files/0x0007000000023457-114.dat	upx
behavioral2/memory/2744-113-0x00007FF680E50000-0x00007FF681242000-memory.dmp	upx
behavioral2/memory/3628-112-0x00007FF784FE0000-0x00007FF7853D2000-memory.dmp	upx
behavioral2/files/0x0007000000023456-107.dat	upx
behavioral2/memory/4392-106-0x00007FF7815B0000-0x00007FF7819A2000-memory.dmp	upx
behavioral2/files/0x0008000000023454-101.dat	upx
behavioral2/memory/2836-99-0x00007FF6B7CA0000-0x00007FF6B8092000-memory.dmp	upx
behavioral2/files/0x0007000000023455-94.dat	upx
behavioral2/memory/4532-93-0x00007FF70BE00000-0x00007FF70C1F2000-memory.dmp	upx
behavioral2/memory/3312-89-0x00007FF7D61B0000-0x00007FF7D65A2000-memory.dmp	upx
behavioral2/files/0x0007000000023452-83.dat	upx
behavioral2/memory/1432-82-0x00007FF6E2090000-0x00007FF6E2482000-memory.dmp	upx
behavioral2/memory/1764-79-0x00007FF72EC40000-0x00007FF72F032000-memory.dmp	upx
behavioral2/memory/232-78-0x00007FF7D48F0000-0x00007FF7D4CE2000-memory.dmp	upx
behavioral2/files/0x0007000000023451-74.dat	upx
behavioral2/files/0x0007000000023450-72.dat	upx
behavioral2/files/0x000700000002344c-42.dat	upx
behavioral2/files/0x0008000000023448-18.dat	upx
behavioral2/memory/896-1993-0x00007FF791B70000-0x00007FF791F62000-memory.dmp	upx
behavioral2/memory/4392-1995-0x00007FF7815B0000-0x00007FF7819A2000-memory.dmp	upx
behavioral2/memory/896-2013-0x00007FF791B70000-0x00007FF791F62000-memory.dmp	upx
behavioral2/memory/232-2015-0x00007FF7D48F0000-0x00007FF7D4CE2000-memory.dmp	upx
behavioral2/memory/3628-2017-0x00007FF784FE0000-0x00007FF7853D2000-memory.dmp	upx
behavioral2/memory/1764-2021-0x00007FF72EC40000-0x00007FF72F032000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\avYgjBf.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\fXsJkfK.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\JtZOODv.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\FnqdTsu.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\mBhwiLV.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\GHNryNp.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\cYcfyfG.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\hUlMxyE.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\UUKaHIs.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\MADSFXO.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\fXhrzCt.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\xNGnDAJ.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\gJbrZvK.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\XZdPxfr.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\NqZyiPS.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\ehhCFQi.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\ymPlYYZ.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\LdGlgXP.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\vEqJmdm.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\VMCKzMg.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\ViMrWUK.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\ZXkazQc.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\OOtOzey.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\RWRjcgs.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\yxsQXGj.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\ecVVRWd.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\GPLcVwd.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\gOZaEva.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\vkPaoQq.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\Kipkdrj.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\zDkXyBw.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\wAXxPtT.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\VBuVumE.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\DrljcDB.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\FXDQErX.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\PqeYyqh.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\VwkbLca.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\ZgNUcMa.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\sxOrfAs.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\euuRMVJ.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\KkRgsuI.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\DbXArvC.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\slJhLnB.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\OXPsQvA.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\qPDqeKr.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\lVGEPlh.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\EbOIZXc.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\mHKESeH.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\gvYjZFT.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\vMJodEI.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\jrVpSPX.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\OEGmdhk.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\fpTpFCZ.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\njbGTWb.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\THILCFp.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\WyMuGJM.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\oyqRgzc.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\dLBbpcD.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\gQWNbpc.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\aCBeNaQ.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\vceCAWX.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\nCmnXEO.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\DDQxTCr.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
File created	C:\Windows\System\pJmIkNP.exe	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4796	powershell.exe
4796	powershell.exe
4796	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4796	powershell.exe
Token: SeLockMemoryPrivilege	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 4796	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	83
PID 3560 wrote to memory of 4796	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	83
PID 3560 wrote to memory of 896	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	84
PID 3560 wrote to memory of 896	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	84
PID 3560 wrote to memory of 232	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	85
PID 3560 wrote to memory of 232	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	85
PID 3560 wrote to memory of 3628	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	86
PID 3560 wrote to memory of 3628	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	86
PID 3560 wrote to memory of 2744	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	87
PID 3560 wrote to memory of 2744	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	87
PID 3560 wrote to memory of 1764	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	88
PID 3560 wrote to memory of 1764	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	88
PID 3560 wrote to memory of 1432	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	89
PID 3560 wrote to memory of 1432	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	89
PID 3560 wrote to memory of 3312	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	90
PID 3560 wrote to memory of 3312	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	90
PID 3560 wrote to memory of 4532	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	91
PID 3560 wrote to memory of 4532	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	91
PID 3560 wrote to memory of 4980	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	92
PID 3560 wrote to memory of 4980	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	92
PID 3560 wrote to memory of 2836	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	93
PID 3560 wrote to memory of 2836	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	93
PID 3560 wrote to memory of 1344	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	94
PID 3560 wrote to memory of 1344	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	94
PID 3560 wrote to memory of 2104	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	95
PID 3560 wrote to memory of 2104	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	95
PID 3560 wrote to memory of 4392	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	96
PID 3560 wrote to memory of 4392	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	96
PID 3560 wrote to memory of 4972	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	97
PID 3560 wrote to memory of 4972	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	97
PID 3560 wrote to memory of 1564	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	98
PID 3560 wrote to memory of 1564	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	98
PID 3560 wrote to memory of 4544	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	99
PID 3560 wrote to memory of 4544	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	99
PID 3560 wrote to memory of 3452	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	100
PID 3560 wrote to memory of 3452	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	100
PID 3560 wrote to memory of 2416	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	101
PID 3560 wrote to memory of 2416	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	101
PID 3560 wrote to memory of 4940	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	102
PID 3560 wrote to memory of 4940	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	102
PID 3560 wrote to memory of 4548	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	103
PID 3560 wrote to memory of 4548	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	103
PID 3560 wrote to memory of 732	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	104
PID 3560 wrote to memory of 732	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	104
PID 3560 wrote to memory of 1900	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	105
PID 3560 wrote to memory of 1900	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	105
PID 3560 wrote to memory of 4140	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	106
PID 3560 wrote to memory of 4140	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	106
PID 3560 wrote to memory of 3164	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	107
PID 3560 wrote to memory of 3164	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	107
PID 3560 wrote to memory of 5036	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	108
PID 3560 wrote to memory of 5036	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	108
PID 3560 wrote to memory of 744	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	109
PID 3560 wrote to memory of 744	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	109
PID 3560 wrote to memory of 4660	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	110
PID 3560 wrote to memory of 4660	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	110
PID 3560 wrote to memory of 2972	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	111
PID 3560 wrote to memory of 2972	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	111
PID 3560 wrote to memory of 2304	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	112
PID 3560 wrote to memory of 2304	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	112
PID 3560 wrote to memory of 4244	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	113
PID 3560 wrote to memory of 4244	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	113
PID 3560 wrote to memory of 3412	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	114
PID 3560 wrote to memory of 3412	3560	6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6ae155c6033c065a1d9659439e576870_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4796
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4796" "3000" "2928" "3004" "0" "0" "3008" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:12924
- C:\Windows\System\nluHyqU.exe
  C:\Windows\System\nluHyqU.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\DXDpHvH.exe
  C:\Windows\System\DXDpHvH.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\GCRsAoz.exe
  C:\Windows\System\GCRsAoz.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\plyNpcL.exe
  C:\Windows\System\plyNpcL.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\mDpmKGD.exe
  C:\Windows\System\mDpmKGD.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\syGAFrw.exe
  C:\Windows\System\syGAFrw.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\xCMagcJ.exe
  C:\Windows\System\xCMagcJ.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\FHyQjtn.exe
  C:\Windows\System\FHyQjtn.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\tTFMYRM.exe
  C:\Windows\System\tTFMYRM.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\PSJgXMP.exe
  C:\Windows\System\PSJgXMP.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\FGJaclf.exe
  C:\Windows\System\FGJaclf.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\wTvHulF.exe
  C:\Windows\System\wTvHulF.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\TlcwpIt.exe
  C:\Windows\System\TlcwpIt.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\XtHdyGk.exe
  C:\Windows\System\XtHdyGk.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\rqpuglS.exe
  C:\Windows\System\rqpuglS.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\EoMBTbu.exe
  C:\Windows\System\EoMBTbu.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\RUNWQNE.exe
  C:\Windows\System\RUNWQNE.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\BSbiLwG.exe
  C:\Windows\System\BSbiLwG.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\dwyNZdl.exe
  C:\Windows\System\dwyNZdl.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\KkRgsuI.exe
  C:\Windows\System\KkRgsuI.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\hAPqRJV.exe
  C:\Windows\System\hAPqRJV.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\VwLmRCG.exe
  C:\Windows\System\VwLmRCG.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\SEPsPuv.exe
  C:\Windows\System\SEPsPuv.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\XEWyzHF.exe
  C:\Windows\System\XEWyzHF.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\PZNtaZL.exe
  C:\Windows\System\PZNtaZL.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\ZxUEXng.exe
  C:\Windows\System\ZxUEXng.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\krORkAP.exe
  C:\Windows\System\krORkAP.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\cGRByVm.exe
  C:\Windows\System\cGRByVm.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\bPTMzbq.exe
  C:\Windows\System\bPTMzbq.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\GHNryNp.exe
  C:\Windows\System\GHNryNp.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\cNROIlu.exe
  C:\Windows\System\cNROIlu.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\boYZmzj.exe
  C:\Windows\System\boYZmzj.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\FeZWEgm.exe
  C:\Windows\System\FeZWEgm.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\eUtgJls.exe
  C:\Windows\System\eUtgJls.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\ldgSYOp.exe
  C:\Windows\System\ldgSYOp.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\XbyexKv.exe
  C:\Windows\System\XbyexKv.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\wGNaeeS.exe
  C:\Windows\System\wGNaeeS.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\cYcfyfG.exe
  C:\Windows\System\cYcfyfG.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\sDdyZEJ.exe
  C:\Windows\System\sDdyZEJ.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\ewhMjdo.exe
  C:\Windows\System\ewhMjdo.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\qinKtWl.exe
  C:\Windows\System\qinKtWl.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\OlbUpQe.exe
  C:\Windows\System\OlbUpQe.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\wiGRtHS.exe
  C:\Windows\System\wiGRtHS.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\zEQvHDi.exe
  C:\Windows\System\zEQvHDi.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\UGRKxkf.exe
  C:\Windows\System\UGRKxkf.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\OiApZqm.exe
  C:\Windows\System\OiApZqm.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\rzvwquP.exe
  C:\Windows\System\rzvwquP.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\qvtvukl.exe
  C:\Windows\System\qvtvukl.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\CzhxQgD.exe
  C:\Windows\System\CzhxQgD.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\vEqJmdm.exe
  C:\Windows\System\vEqJmdm.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\HtLwMIL.exe
  C:\Windows\System\HtLwMIL.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\taNhweO.exe
  C:\Windows\System\taNhweO.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\KOgjSOK.exe
  C:\Windows\System\KOgjSOK.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\hQtoALS.exe
  C:\Windows\System\hQtoALS.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\BWBLyKB.exe
  C:\Windows\System\BWBLyKB.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\nSBGdah.exe
  C:\Windows\System\nSBGdah.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\GTCDQTg.exe
  C:\Windows\System\GTCDQTg.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\JpqwlbN.exe
  C:\Windows\System\JpqwlbN.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\VwUUSKH.exe
  C:\Windows\System\VwUUSKH.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\kPJAMdA.exe
  C:\Windows\System\kPJAMdA.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\fASFJuj.exe
  C:\Windows\System\fASFJuj.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\VlCAQdU.exe
  C:\Windows\System\VlCAQdU.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\YJjbLTB.exe
  C:\Windows\System\YJjbLTB.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\nhuzKts.exe
  C:\Windows\System\nhuzKts.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\uVidgIj.exe
  C:\Windows\System\uVidgIj.exe
  2⤵
  PID:1248
- C:\Windows\System\nrDzvew.exe
  C:\Windows\System\nrDzvew.exe
  2⤵
  PID:2436
- C:\Windows\System\eiToMnO.exe
  C:\Windows\System\eiToMnO.exe
  2⤵
  PID:1244
- C:\Windows\System\pTeGAri.exe
  C:\Windows\System\pTeGAri.exe
  2⤵
  PID:1628
- C:\Windows\System\cbhJJoi.exe
  C:\Windows\System\cbhJJoi.exe
  2⤵
  PID:4928
- C:\Windows\System\DcTZwPY.exe
  C:\Windows\System\DcTZwPY.exe
  2⤵
  PID:2992
- C:\Windows\System\VBuVumE.exe
  C:\Windows\System\VBuVumE.exe
  2⤵
  PID:2896
- C:\Windows\System\nmpCaKa.exe
  C:\Windows\System\nmpCaKa.exe
  2⤵
  PID:436
- C:\Windows\System\UnYpRez.exe
  C:\Windows\System\UnYpRez.exe
  2⤵
  PID:3532
- C:\Windows\System\PwplEsx.exe
  C:\Windows\System\PwplEsx.exe
  2⤵
  PID:2368
- C:\Windows\System\IzKbaqf.exe
  C:\Windows\System\IzKbaqf.exe
  2⤵
  PID:5048
- C:\Windows\System\TXlFMAv.exe
  C:\Windows\System\TXlFMAv.exe
  2⤵
  PID:5136
- C:\Windows\System\GFqDJXc.exe
  C:\Windows\System\GFqDJXc.exe
  2⤵
  PID:5152
- C:\Windows\System\KLfpzbM.exe
  C:\Windows\System\KLfpzbM.exe
  2⤵
  PID:5180
- C:\Windows\System\UEhLjPz.exe
  C:\Windows\System\UEhLjPz.exe
  2⤵
  PID:5200
- C:\Windows\System\DNAdGpU.exe
  C:\Windows\System\DNAdGpU.exe
  2⤵
  PID:5236
- C:\Windows\System\hbcxcLI.exe
  C:\Windows\System\hbcxcLI.exe
  2⤵
  PID:5268
- C:\Windows\System\UWUFwLW.exe
  C:\Windows\System\UWUFwLW.exe
  2⤵
  PID:5296
- C:\Windows\System\iavMtnx.exe
  C:\Windows\System\iavMtnx.exe
  2⤵
  PID:5332
- C:\Windows\System\EgdfIeS.exe
  C:\Windows\System\EgdfIeS.exe
  2⤵
  PID:5360
- C:\Windows\System\Nrilgef.exe
  C:\Windows\System\Nrilgef.exe
  2⤵
  PID:5380
- C:\Windows\System\CRbjjVn.exe
  C:\Windows\System\CRbjjVn.exe
  2⤵
  PID:5408
- C:\Windows\System\rDVRUBA.exe
  C:\Windows\System\rDVRUBA.exe
  2⤵
  PID:5432
- C:\Windows\System\sLNNDJc.exe
  C:\Windows\System\sLNNDJc.exe
  2⤵
  PID:5460
- C:\Windows\System\IawgqGg.exe
  C:\Windows\System\IawgqGg.exe
  2⤵
  PID:5488
- C:\Windows\System\VMCKzMg.exe
  C:\Windows\System\VMCKzMg.exe
  2⤵
  PID:5520
- C:\Windows\System\PUOXozL.exe
  C:\Windows\System\PUOXozL.exe
  2⤵
  PID:5544
- C:\Windows\System\MiswMdL.exe
  C:\Windows\System\MiswMdL.exe
  2⤵
  PID:5576
- C:\Windows\System\qSucorE.exe
  C:\Windows\System\qSucorE.exe
  2⤵
  PID:5600
- C:\Windows\System\aIMoPfb.exe
  C:\Windows\System\aIMoPfb.exe
  2⤵
  PID:5632
- C:\Windows\System\CKufNrQ.exe
  C:\Windows\System\CKufNrQ.exe
  2⤵
  PID:5660
- C:\Windows\System\gIINZUj.exe
  C:\Windows\System\gIINZUj.exe
  2⤵
  PID:5688
- C:\Windows\System\TLEXKLx.exe
  C:\Windows\System\TLEXKLx.exe
  2⤵
  PID:5716
- C:\Windows\System\udRFtja.exe
  C:\Windows\System\udRFtja.exe
  2⤵
  PID:5748
- C:\Windows\System\dLaiEkJ.exe
  C:\Windows\System\dLaiEkJ.exe
  2⤵
  PID:5772
- C:\Windows\System\GmpeVyq.exe
  C:\Windows\System\GmpeVyq.exe
  2⤵
  PID:5800
- C:\Windows\System\IeLbodb.exe
  C:\Windows\System\IeLbodb.exe
  2⤵
  PID:5828
- C:\Windows\System\aHgPVYG.exe
  C:\Windows\System\aHgPVYG.exe
  2⤵
  PID:5856
- C:\Windows\System\wtIvohm.exe
  C:\Windows\System\wtIvohm.exe
  2⤵
  PID:5888
- C:\Windows\System\AUTOmhg.exe
  C:\Windows\System\AUTOmhg.exe
  2⤵
  PID:5912
- C:\Windows\System\iobxkFz.exe
  C:\Windows\System\iobxkFz.exe
  2⤵
  PID:5944
- C:\Windows\System\HPRbBFw.exe
  C:\Windows\System\HPRbBFw.exe
  2⤵
  PID:5968
- C:\Windows\System\RuerxEp.exe
  C:\Windows\System\RuerxEp.exe
  2⤵
  PID:6000
- C:\Windows\System\qPDqeKr.exe
  C:\Windows\System\qPDqeKr.exe
  2⤵
  PID:6028
- C:\Windows\System\zWsdlhb.exe
  C:\Windows\System\zWsdlhb.exe
  2⤵
  PID:6056
- C:\Windows\System\teoRQnD.exe
  C:\Windows\System\teoRQnD.exe
  2⤵
  PID:6080
- C:\Windows\System\fZuTEmY.exe
  C:\Windows\System\fZuTEmY.exe
  2⤵
  PID:6108
- C:\Windows\System\DDQxTCr.exe
  C:\Windows\System\DDQxTCr.exe
  2⤵
  PID:6136
- C:\Windows\System\UfrngeX.exe
  C:\Windows\System\UfrngeX.exe
  2⤵
  PID:3572
- C:\Windows\System\BkMPvrA.exe
  C:\Windows\System\BkMPvrA.exe
  2⤵
  PID:2988
- C:\Windows\System\AtAbXHE.exe
  C:\Windows\System\AtAbXHE.exe
  2⤵
  PID:2500
- C:\Windows\System\RWRjcgs.exe
  C:\Windows\System\RWRjcgs.exe
  2⤵
  PID:2888
- C:\Windows\System\fIiYDjC.exe
  C:\Windows\System\fIiYDjC.exe
  2⤵
  PID:5092
- C:\Windows\System\kuMYlcf.exe
  C:\Windows\System\kuMYlcf.exe
  2⤵
  PID:3192
- C:\Windows\System\iEoRhMT.exe
  C:\Windows\System\iEoRhMT.exe
  2⤵
  PID:5172
- C:\Windows\System\jCFghyJ.exe
  C:\Windows\System\jCFghyJ.exe
  2⤵
  PID:5252
- C:\Windows\System\rmGniHf.exe
  C:\Windows\System\rmGniHf.exe
  2⤵
  PID:5308
- C:\Windows\System\Wwqwsow.exe
  C:\Windows\System\Wwqwsow.exe
  2⤵
  PID:5356
- C:\Windows\System\pJmIkNP.exe
  C:\Windows\System\pJmIkNP.exe
  2⤵
  PID:5420
- C:\Windows\System\JJUUbEf.exe
  C:\Windows\System\JJUUbEf.exe
  2⤵
  PID:5480
- C:\Windows\System\RBtJiMa.exe
  C:\Windows\System\RBtJiMa.exe
  2⤵
  PID:5532
- C:\Windows\System\yxyqHDY.exe
  C:\Windows\System\yxyqHDY.exe
  2⤵
  PID:5592
- C:\Windows\System\IGsHkmT.exe
  C:\Windows\System\IGsHkmT.exe
  2⤵
  PID:5676
- C:\Windows\System\VoFdAKg.exe
  C:\Windows\System\VoFdAKg.exe
  2⤵
  PID:1784
- C:\Windows\System\fOMpVsr.exe
  C:\Windows\System\fOMpVsr.exe
  2⤵
  PID:5768
- C:\Windows\System\bqnULGL.exe
  C:\Windows\System\bqnULGL.exe
  2⤵
  PID:1152
- C:\Windows\System\Kipkdrj.exe
  C:\Windows\System\Kipkdrj.exe
  2⤵
  PID:5880
- C:\Windows\System\KaFdvAB.exe
  C:\Windows\System\KaFdvAB.exe
  2⤵
  PID:5960
- C:\Windows\System\NqtEVDy.exe
  C:\Windows\System\NqtEVDy.exe
  2⤵
  PID:6020
- C:\Windows\System\MnXQbJE.exe
  C:\Windows\System\MnXQbJE.exe
  2⤵
  PID:6100
- C:\Windows\System\uZayODW.exe
  C:\Windows\System\uZayODW.exe
  2⤵
  PID:2456
- C:\Windows\System\gvYjZFT.exe
  C:\Windows\System\gvYjZFT.exe
  2⤵
  PID:4968
- C:\Windows\System\gZpkhdD.exe
  C:\Windows\System\gZpkhdD.exe
  2⤵
  PID:1088
- C:\Windows\System\mhuBTBa.exe
  C:\Windows\System\mhuBTBa.exe
  2⤵
  PID:5220
- C:\Windows\System\DmMzolF.exe
  C:\Windows\System\DmMzolF.exe
  2⤵
  PID:5352
- C:\Windows\System\XICdhNq.exe
  C:\Windows\System\XICdhNq.exe
  2⤵
  PID:5456
- C:\Windows\System\BTZOKTB.exe
  C:\Windows\System\BTZOKTB.exe
  2⤵
  PID:5588
- C:\Windows\System\pJEWTXr.exe
  C:\Windows\System\pJEWTXr.exe
  2⤵
  PID:5712
- C:\Windows\System\feeNFks.exe
  C:\Windows\System\feeNFks.exe
  2⤵
  PID:5816
- C:\Windows\System\FVVZpDg.exe
  C:\Windows\System\FVVZpDg.exe
  2⤵
  PID:5936
- C:\Windows\System\WPhGYPA.exe
  C:\Windows\System\WPhGYPA.exe
  2⤵
  PID:6076
- C:\Windows\System\PARXhwR.exe
  C:\Windows\System\PARXhwR.exe
  2⤵
  PID:4104
- C:\Windows\System\mAMfNxw.exe
  C:\Windows\System\mAMfNxw.exe
  2⤵
  PID:6152
- C:\Windows\System\LgIFsNU.exe
  C:\Windows\System\LgIFsNU.exe
  2⤵
  PID:6180
- C:\Windows\System\gpuEkUy.exe
  C:\Windows\System\gpuEkUy.exe
  2⤵
  PID:6208
- C:\Windows\System\DrljcDB.exe
  C:\Windows\System\DrljcDB.exe
  2⤵
  PID:6236
- C:\Windows\System\hUlMxyE.exe
  C:\Windows\System\hUlMxyE.exe
  2⤵
  PID:6264
- C:\Windows\System\UshbsfU.exe
  C:\Windows\System\UshbsfU.exe
  2⤵
  PID:6292
- C:\Windows\System\BTZsKuC.exe
  C:\Windows\System\BTZsKuC.exe
  2⤵
  PID:6320
- C:\Windows\System\XNFVIGx.exe
  C:\Windows\System\XNFVIGx.exe
  2⤵
  PID:6348
- C:\Windows\System\qNOulKK.exe
  C:\Windows\System\qNOulKK.exe
  2⤵
  PID:6376
- C:\Windows\System\uEohxjY.exe
  C:\Windows\System\uEohxjY.exe
  2⤵
  PID:6404
- C:\Windows\System\TkqEurx.exe
  C:\Windows\System\TkqEurx.exe
  2⤵
  PID:6432
- C:\Windows\System\DyZSMgA.exe
  C:\Windows\System\DyZSMgA.exe
  2⤵
  PID:6460
- C:\Windows\System\pMimKUK.exe
  C:\Windows\System\pMimKUK.exe
  2⤵
  PID:6488
- C:\Windows\System\fylVBCa.exe
  C:\Windows\System\fylVBCa.exe
  2⤵
  PID:6516
- C:\Windows\System\GMVmOAM.exe
  C:\Windows\System\GMVmOAM.exe
  2⤵
  PID:6544
- C:\Windows\System\pplCCtP.exe
  C:\Windows\System\pplCCtP.exe
  2⤵
  PID:6576
- C:\Windows\System\VvgqKaT.exe
  C:\Windows\System\VvgqKaT.exe
  2⤵
  PID:6604
- C:\Windows\System\lVGEPlh.exe
  C:\Windows\System\lVGEPlh.exe
  2⤵
  PID:6632
- C:\Windows\System\fspgaPv.exe
  C:\Windows\System\fspgaPv.exe
  2⤵
  PID:6656
- C:\Windows\System\mWrtTsT.exe
  C:\Windows\System\mWrtTsT.exe
  2⤵
  PID:6684
- C:\Windows\System\GrBRGBm.exe
  C:\Windows\System\GrBRGBm.exe
  2⤵
  PID:6716
- C:\Windows\System\tDCnPpG.exe
  C:\Windows\System\tDCnPpG.exe
  2⤵
  PID:6744
- C:\Windows\System\vMJodEI.exe
  C:\Windows\System\vMJodEI.exe
  2⤵
  PID:6780
- C:\Windows\System\TfERLWM.exe
  C:\Windows\System\TfERLWM.exe
  2⤵
  PID:6808
- C:\Windows\System\dVOqDHe.exe
  C:\Windows\System\dVOqDHe.exe
  2⤵
  PID:6840
- C:\Windows\System\fetmRXU.exe
  C:\Windows\System\fetmRXU.exe
  2⤵
  PID:6856
- C:\Windows\System\xNGnDAJ.exe
  C:\Windows\System\xNGnDAJ.exe
  2⤵
  PID:6880
- C:\Windows\System\WunXyeZ.exe
  C:\Windows\System\WunXyeZ.exe
  2⤵
  PID:6908
- C:\Windows\System\gfOFxgl.exe
  C:\Windows\System\gfOFxgl.exe
  2⤵
  PID:6940
- C:\Windows\System\iCObdhS.exe
  C:\Windows\System\iCObdhS.exe
  2⤵
  PID:6964
- C:\Windows\System\kTiOXkc.exe
  C:\Windows\System\kTiOXkc.exe
  2⤵
  PID:6996
- C:\Windows\System\IwVsWxo.exe
  C:\Windows\System\IwVsWxo.exe
  2⤵
  PID:7024
- C:\Windows\System\MjyFoYQ.exe
  C:\Windows\System\MjyFoYQ.exe
  2⤵
  PID:7048
- C:\Windows\System\TXHQjMS.exe
  C:\Windows\System\TXHQjMS.exe
  2⤵
  PID:7080
- C:\Windows\System\sJgBWpt.exe
  C:\Windows\System\sJgBWpt.exe
  2⤵
  PID:7104
- C:\Windows\System\DUZvKjl.exe
  C:\Windows\System\DUZvKjl.exe
  2⤵
  PID:7144
- C:\Windows\System\dWhYjUu.exe
  C:\Windows\System\dWhYjUu.exe
  2⤵
  PID:7164
- C:\Windows\System\jkFmvLv.exe
  C:\Windows\System\jkFmvLv.exe
  2⤵
  PID:5284
- C:\Windows\System\yxsQXGj.exe
  C:\Windows\System\yxsQXGj.exe
  2⤵
  PID:4076
- C:\Windows\System\uRrMErc.exe
  C:\Windows\System\uRrMErc.exe
  2⤵
  PID:3864
- C:\Windows\System\NAQkYMA.exe
  C:\Windows\System\NAQkYMA.exe
  2⤵
  PID:4692
- C:\Windows\System\ndOmeuC.exe
  C:\Windows\System\ndOmeuC.exe
  2⤵
  PID:3616
- C:\Windows\System\GoRYNeM.exe
  C:\Windows\System\GoRYNeM.exe
  2⤵
  PID:6200
- C:\Windows\System\DdoRBvY.exe
  C:\Windows\System\DdoRBvY.exe
  2⤵
  PID:6256
- C:\Windows\System\JUnIlwx.exe
  C:\Windows\System\JUnIlwx.exe
  2⤵
  PID:6284
- C:\Windows\System\CinLWcS.exe
  C:\Windows\System\CinLWcS.exe
  2⤵
  PID:6344
- C:\Windows\System\ADIjVPa.exe
  C:\Windows\System\ADIjVPa.exe
  2⤵
  PID:6400
- C:\Windows\System\SHQkdLh.exe
  C:\Windows\System\SHQkdLh.exe
  2⤵
  PID:6476
- C:\Windows\System\VwkbLca.exe
  C:\Windows\System\VwkbLca.exe
  2⤵
  PID:6512
- C:\Windows\System\wOlKVoE.exe
  C:\Windows\System\wOlKVoE.exe
  2⤵
  PID:6560
- C:\Windows\System\VglnqaN.exe
  C:\Windows\System\VglnqaN.exe
  2⤵
  PID:6624
- C:\Windows\System\yOIhEWl.exe
  C:\Windows\System\yOIhEWl.exe
  2⤵
  PID:6700
- C:\Windows\System\MmRxuiF.exe
  C:\Windows\System\MmRxuiF.exe
  2⤵
  PID:6732
- C:\Windows\System\dvDMCnC.exe
  C:\Windows\System\dvDMCnC.exe
  2⤵
  PID:6776
- C:\Windows\System\iKkxMGH.exe
  C:\Windows\System\iKkxMGH.exe
  2⤵
  PID:2200
- C:\Windows\System\slihzXh.exe
  C:\Windows\System\slihzXh.exe
  2⤵
  PID:6896
- C:\Windows\System\wFbbgvN.exe
  C:\Windows\System\wFbbgvN.exe
  2⤵
  PID:6932
- C:\Windows\System\FBVOuyF.exe
  C:\Windows\System\FBVOuyF.exe
  2⤵
  PID:6980
- C:\Windows\System\zPQEMMk.exe
  C:\Windows\System\zPQEMMk.exe
  2⤵
  PID:7016
- C:\Windows\System\avYgjBf.exe
  C:\Windows\System\avYgjBf.exe
  2⤵
  PID:7068
- C:\Windows\System\vBOBpcl.exe
  C:\Windows\System\vBOBpcl.exe
  2⤵
  PID:4452
- C:\Windows\System\arpZuiD.exe
  C:\Windows\System\arpZuiD.exe
  2⤵
  PID:1020
- C:\Windows\System\THILCFp.exe
  C:\Windows\System\THILCFp.exe
  2⤵
  PID:4144
- C:\Windows\System\gcaEwwG.exe
  C:\Windows\System\gcaEwwG.exe
  2⤵
  PID:5512
- C:\Windows\System\WTpdCnt.exe
  C:\Windows\System\WTpdCnt.exe
  2⤵
  PID:1584
- C:\Windows\System\Hhpwqvu.exe
  C:\Windows\System\Hhpwqvu.exe
  2⤵
  PID:6252
- C:\Windows\System\GpKKJLP.exe
  C:\Windows\System\GpKKJLP.exe
  2⤵
  PID:4816
- C:\Windows\System\VBJkkEC.exe
  C:\Windows\System\VBJkkEC.exe
  2⤵
  PID:6484
- C:\Windows\System\loHoouV.exe
  C:\Windows\System\loHoouV.exe
  2⤵
  PID:6616
- C:\Windows\System\MAJZqWf.exe
  C:\Windows\System\MAJZqWf.exe
  2⤵
  PID:4320
- C:\Windows\System\YBYeNEQ.exe
  C:\Windows\System\YBYeNEQ.exe
  2⤵
  PID:6872
- C:\Windows\System\VCzCuhZ.exe
  C:\Windows\System\VCzCuhZ.exe
  2⤵
  PID:6960
- C:\Windows\System\LbeMkui.exe
  C:\Windows\System\LbeMkui.exe
  2⤵
  PID:7096
- C:\Windows\System\YxGnZIF.exe
  C:\Windows\System\YxGnZIF.exe
  2⤵
  PID:1920
- C:\Windows\System\AkGnqrH.exe
  C:\Windows\System\AkGnqrH.exe
  2⤵
  PID:6016
- C:\Windows\System\VBAanHm.exe
  C:\Windows\System\VBAanHm.exe
  2⤵
  PID:6428
- C:\Windows\System\FSYyRLU.exe
  C:\Windows\System\FSYyRLU.exe
  2⤵
  PID:6680
- C:\Windows\System\OjpESAX.exe
  C:\Windows\System\OjpESAX.exe
  2⤵
  PID:2168
- C:\Windows\System\ytNbJhg.exe
  C:\Windows\System\ytNbJhg.exe
  2⤵
  PID:7180
- C:\Windows\System\svOeUAN.exe
  C:\Windows\System\svOeUAN.exe
  2⤵
  PID:7208
- C:\Windows\System\LrzBodr.exe
  C:\Windows\System\LrzBodr.exe
  2⤵
  PID:7236
- C:\Windows\System\SJtvQKY.exe
  C:\Windows\System\SJtvQKY.exe
  2⤵
  PID:7264
- C:\Windows\System\JBXgKrB.exe
  C:\Windows\System\JBXgKrB.exe
  2⤵
  PID:7292
- C:\Windows\System\GtzMAyr.exe
  C:\Windows\System\GtzMAyr.exe
  2⤵
  PID:7316
- C:\Windows\System\YWBQTof.exe
  C:\Windows\System\YWBQTof.exe
  2⤵
  PID:7348
- C:\Windows\System\xFdrMWT.exe
  C:\Windows\System\xFdrMWT.exe
  2⤵
  PID:7376
- C:\Windows\System\dEiSKRC.exe
  C:\Windows\System\dEiSKRC.exe
  2⤵
  PID:7404
- C:\Windows\System\bKeCloe.exe
  C:\Windows\System\bKeCloe.exe
  2⤵
  PID:7428
- C:\Windows\System\MmOwpmF.exe
  C:\Windows\System\MmOwpmF.exe
  2⤵
  PID:7460
- C:\Windows\System\BmJcfel.exe
  C:\Windows\System\BmJcfel.exe
  2⤵
  PID:7488
- C:\Windows\System\PjxZlfJ.exe
  C:\Windows\System\PjxZlfJ.exe
  2⤵
  PID:7516
- C:\Windows\System\rTbyXMf.exe
  C:\Windows\System\rTbyXMf.exe
  2⤵
  PID:7544
- C:\Windows\System\TnVnmRn.exe
  C:\Windows\System\TnVnmRn.exe
  2⤵
  PID:7572
- C:\Windows\System\ZAFMEML.exe
  C:\Windows\System\ZAFMEML.exe
  2⤵
  PID:7596
- C:\Windows\System\gMQbVgM.exe
  C:\Windows\System\gMQbVgM.exe
  2⤵
  PID:7672
- C:\Windows\System\JGuuNJy.exe
  C:\Windows\System\JGuuNJy.exe
  2⤵
  PID:7692
- C:\Windows\System\IwHTudy.exe
  C:\Windows\System\IwHTudy.exe
  2⤵
  PID:7712
- C:\Windows\System\ZQmtRjA.exe
  C:\Windows\System\ZQmtRjA.exe
  2⤵
  PID:7748
- C:\Windows\System\bwSJucN.exe
  C:\Windows\System\bwSJucN.exe
  2⤵
  PID:7776
- C:\Windows\System\AbNXWde.exe
  C:\Windows\System\AbNXWde.exe
  2⤵
  PID:7796
- C:\Windows\System\RuItELZ.exe
  C:\Windows\System\RuItELZ.exe
  2⤵
  PID:7820
- C:\Windows\System\COhgSwa.exe
  C:\Windows\System\COhgSwa.exe
  2⤵
  PID:7844
- C:\Windows\System\VSwKzLL.exe
  C:\Windows\System\VSwKzLL.exe
  2⤵
  PID:7900
- C:\Windows\System\FkPEIqT.exe
  C:\Windows\System\FkPEIqT.exe
  2⤵
  PID:7940
- C:\Windows\System\cGyAxYs.exe
  C:\Windows\System\cGyAxYs.exe
  2⤵
  PID:7988
- C:\Windows\System\SxlVgKt.exe
  C:\Windows\System\SxlVgKt.exe
  2⤵
  PID:8016
- C:\Windows\System\KNBLxyL.exe
  C:\Windows\System\KNBLxyL.exe
  2⤵
  PID:8032
- C:\Windows\System\WyMuGJM.exe
  C:\Windows\System\WyMuGJM.exe
  2⤵
  PID:8056
- C:\Windows\System\YSEbIVb.exe
  C:\Windows\System\YSEbIVb.exe
  2⤵
  PID:8080
- C:\Windows\System\jOKIOCJ.exe
  C:\Windows\System\jOKIOCJ.exe
  2⤵
  PID:8100
- C:\Windows\System\XBnyUJC.exe
  C:\Windows\System\XBnyUJC.exe
  2⤵
  PID:8124
- C:\Windows\System\IHIdEcU.exe
  C:\Windows\System\IHIdEcU.exe
  2⤵
  PID:8144
- C:\Windows\System\DUeyyBb.exe
  C:\Windows\System\DUeyyBb.exe
  2⤵
  PID:8184
- C:\Windows\System\TPfcFHH.exe
  C:\Windows\System\TPfcFHH.exe
  2⤵
  PID:1560
- C:\Windows\System\JkVpxme.exe
  C:\Windows\System\JkVpxme.exe
  2⤵
  PID:6540
- C:\Windows\System\SSoftKp.exe
  C:\Windows\System\SSoftKp.exe
  2⤵
  PID:7196
- C:\Windows\System\nziGlQA.exe
  C:\Windows\System\nziGlQA.exe
  2⤵
  PID:7248
- C:\Windows\System\oyqRgzc.exe
  C:\Windows\System\oyqRgzc.exe
  2⤵
  PID:7308
- C:\Windows\System\xNuvGLj.exe
  C:\Windows\System\xNuvGLj.exe
  2⤵
  PID:7340
- C:\Windows\System\ZjHIstj.exe
  C:\Windows\System\ZjHIstj.exe
  2⤵
  PID:7392
- C:\Windows\System\RddLBLj.exe
  C:\Windows\System\RddLBLj.exe
  2⤵
  PID:7424
- C:\Windows\System\noWcJIk.exe
  C:\Windows\System\noWcJIk.exe
  2⤵
  PID:1436
- C:\Windows\System\QODaXVV.exe
  C:\Windows\System\QODaXVV.exe
  2⤵
  PID:1988
- C:\Windows\System\ACGVeXL.exe
  C:\Windows\System\ACGVeXL.exe
  2⤵
  PID:632
- C:\Windows\System\gJbrZvK.exe
  C:\Windows\System\gJbrZvK.exe
  2⤵
  PID:7584
- C:\Windows\System\qAWsoef.exe
  C:\Windows\System\qAWsoef.exe
  2⤵
  PID:760
- C:\Windows\System\TtZjAXu.exe
  C:\Windows\System\TtZjAXu.exe
  2⤵
  PID:7680
- C:\Windows\System\JUUJAie.exe
  C:\Windows\System\JUUJAie.exe
  2⤵
  PID:7736
- C:\Windows\System\laLfkTz.exe
  C:\Windows\System\laLfkTz.exe
  2⤵
  PID:7784
- C:\Windows\System\tfYIkcc.exe
  C:\Windows\System\tfYIkcc.exe
  2⤵
  PID:7792
- C:\Windows\System\TIasIuv.exe
  C:\Windows\System\TIasIuv.exe
  2⤵
  PID:7912
- C:\Windows\System\pkkLzjw.exe
  C:\Windows\System\pkkLzjw.exe
  2⤵
  PID:7964
- C:\Windows\System\VWHKDIW.exe
  C:\Windows\System\VWHKDIW.exe
  2⤵
  PID:8068
- C:\Windows\System\qyhyiVw.exe
  C:\Windows\System\qyhyiVw.exe
  2⤵
  PID:8120
- C:\Windows\System\ITJtGFS.exe
  C:\Windows\System\ITJtGFS.exe
  2⤵
  PID:8180
- C:\Windows\System\WVuoSAi.exe
  C:\Windows\System\WVuoSAi.exe
  2⤵
  PID:6316
- C:\Windows\System\nNCCbzV.exe
  C:\Windows\System\nNCCbzV.exe
  2⤵
  PID:7332
- C:\Windows\System\cMPfNbS.exe
  C:\Windows\System\cMPfNbS.exe
  2⤵
  PID:7364
- C:\Windows\System\UjOOulA.exe
  C:\Windows\System\UjOOulA.exe
  2⤵
  PID:7420
- C:\Windows\System\JQdcRFw.exe
  C:\Windows\System\JQdcRFw.exe
  2⤵
  PID:7504
- C:\Windows\System\SRlYcVO.exe
  C:\Windows\System\SRlYcVO.exe
  2⤵
  PID:1064
- C:\Windows\System\krSXtDS.exe
  C:\Windows\System\krSXtDS.exe
  2⤵
  PID:4580
- C:\Windows\System\vUelYIA.exe
  C:\Windows\System\vUelYIA.exe
  2⤵
  PID:7768
- C:\Windows\System\xIizbgq.exe
  C:\Windows\System\xIizbgq.exe
  2⤵
  PID:7928
- C:\Windows\System\dZZYcUS.exe
  C:\Windows\System\dZZYcUS.exe
  2⤵
  PID:8052
- C:\Windows\System\DiPoBiv.exe
  C:\Windows\System\DiPoBiv.exe
  2⤵
  PID:5932
- C:\Windows\System\msBUjrh.exe
  C:\Windows\System\msBUjrh.exe
  2⤵
  PID:7416
- C:\Windows\System\gpupEPI.exe
  C:\Windows\System\gpupEPI.exe
  2⤵
  PID:4996
- C:\Windows\System\cZLKwJx.exe
  C:\Windows\System\cZLKwJx.exe
  2⤵
  PID:7664
- C:\Windows\System\YJQYXcp.exe
  C:\Windows\System\YJQYXcp.exe
  2⤵
  PID:8220
- C:\Windows\System\slowVwo.exe
  C:\Windows\System\slowVwo.exe
  2⤵
  PID:8244
- C:\Windows\System\RIBcByS.exe
  C:\Windows\System\RIBcByS.exe
  2⤵
  PID:8260
- C:\Windows\System\iOexBCC.exe
  C:\Windows\System\iOexBCC.exe
  2⤵
  PID:8312
- C:\Windows\System\gSfzQsm.exe
  C:\Windows\System\gSfzQsm.exe
  2⤵
  PID:8332
- C:\Windows\System\IQwvFSz.exe
  C:\Windows\System\IQwvFSz.exe
  2⤵
  PID:8352
- C:\Windows\System\mFODflF.exe
  C:\Windows\System\mFODflF.exe
  2⤵
  PID:8388
- C:\Windows\System\WDxIRdQ.exe
  C:\Windows\System\WDxIRdQ.exe
  2⤵
  PID:8416
- C:\Windows\System\WEExNYn.exe
  C:\Windows\System\WEExNYn.exe
  2⤵
  PID:8448
- C:\Windows\System\mFkVXax.exe
  C:\Windows\System\mFkVXax.exe
  2⤵
  PID:8468
- C:\Windows\System\ViMrWUK.exe
  C:\Windows\System\ViMrWUK.exe
  2⤵
  PID:8504
- C:\Windows\System\ecVVRWd.exe
  C:\Windows\System\ecVVRWd.exe
  2⤵
  PID:8544
- C:\Windows\System\dmkJvtz.exe
  C:\Windows\System\dmkJvtz.exe
  2⤵
  PID:8568
- C:\Windows\System\GeAhnbI.exe
  C:\Windows\System\GeAhnbI.exe
  2⤵
  PID:8588
- C:\Windows\System\aCyIRSo.exe
  C:\Windows\System\aCyIRSo.exe
  2⤵
  PID:8612
- C:\Windows\System\GlFwRZA.exe
  C:\Windows\System\GlFwRZA.exe
  2⤵
  PID:8632
- C:\Windows\System\IZRNCes.exe
  C:\Windows\System\IZRNCes.exe
  2⤵
  PID:8648
- C:\Windows\System\aCOPXsT.exe
  C:\Windows\System\aCOPXsT.exe
  2⤵
  PID:8680
- C:\Windows\System\zDkXyBw.exe
  C:\Windows\System\zDkXyBw.exe
  2⤵
  PID:8720
- C:\Windows\System\hbIAKxa.exe
  C:\Windows\System\hbIAKxa.exe
  2⤵
  PID:8756
- C:\Windows\System\ehXaQBI.exe
  C:\Windows\System\ehXaQBI.exe
  2⤵
  PID:8796
- C:\Windows\System\udpOqBB.exe
  C:\Windows\System\udpOqBB.exe
  2⤵
  PID:8812
- C:\Windows\System\KADMuaH.exe
  C:\Windows\System\KADMuaH.exe
  2⤵
  PID:8836
- C:\Windows\System\MBnYqch.exe
  C:\Windows\System\MBnYqch.exe
  2⤵
  PID:8856
- C:\Windows\System\CtdpLxI.exe
  C:\Windows\System\CtdpLxI.exe
  2⤵
  PID:8904
- C:\Windows\System\DsLXipG.exe
  C:\Windows\System\DsLXipG.exe
  2⤵
  PID:8928
- C:\Windows\System\lNFYgaC.exe
  C:\Windows\System\lNFYgaC.exe
  2⤵
  PID:8964
- C:\Windows\System\EAJhGii.exe
  C:\Windows\System\EAJhGii.exe
  2⤵
  PID:8992
- C:\Windows\System\XoksaUb.exe
  C:\Windows\System\XoksaUb.exe
  2⤵
  PID:9020
- C:\Windows\System\vbdeUaB.exe
  C:\Windows\System\vbdeUaB.exe
  2⤵
  PID:9044
- C:\Windows\System\mjmjdMC.exe
  C:\Windows\System\mjmjdMC.exe
  2⤵
  PID:9064
- C:\Windows\System\LNIMfAo.exe
  C:\Windows\System\LNIMfAo.exe
  2⤵
  PID:9080
- C:\Windows\System\HUhtQvT.exe
  C:\Windows\System\HUhtQvT.exe
  2⤵
  PID:9112
- C:\Windows\System\wwZLrND.exe
  C:\Windows\System\wwZLrND.exe
  2⤵
  PID:9132
- C:\Windows\System\ZookHki.exe
  C:\Windows\System\ZookHki.exe
  2⤵
  PID:9148
- C:\Windows\System\ANTLjzX.exe
  C:\Windows\System\ANTLjzX.exe
  2⤵
  PID:9192
- C:\Windows\System\TahNQGf.exe
  C:\Windows\System\TahNQGf.exe
  2⤵
  PID:9212
- C:\Windows\System\xcKrDrM.exe
  C:\Windows\System\xcKrDrM.exe
  2⤵
  PID:3512
- C:\Windows\System\QeZfMib.exe
  C:\Windows\System\QeZfMib.exe
  2⤵
  PID:8216
- C:\Windows\System\SdnqRos.exe
  C:\Windows\System\SdnqRos.exe
  2⤵
  PID:1572
- C:\Windows\System\tgTvnum.exe
  C:\Windows\System\tgTvnum.exe
  2⤵
  PID:8412
- C:\Windows\System\vqEEBjO.exe
  C:\Windows\System\vqEEBjO.exe
  2⤵
  PID:8436
- C:\Windows\System\hGtOBAn.exe
  C:\Windows\System\hGtOBAn.exe
  2⤵
  PID:8496
- C:\Windows\System\HDdNMns.exe
  C:\Windows\System\HDdNMns.exe
  2⤵
  PID:8560
- C:\Windows\System\XZdPxfr.exe
  C:\Windows\System\XZdPxfr.exe
  2⤵
  PID:8668
- C:\Windows\System\ElDeMRk.exe
  C:\Windows\System\ElDeMRk.exe
  2⤵
  PID:8700
- C:\Windows\System\JAoDyZG.exe
  C:\Windows\System\JAoDyZG.exe
  2⤵
  PID:8748
- C:\Windows\System\OEGmdhk.exe
  C:\Windows\System\OEGmdhk.exe
  2⤵
  PID:8792
- C:\Windows\System\rbZfGKH.exe
  C:\Windows\System\rbZfGKH.exe
  2⤵
  PID:8852
- C:\Windows\System\ZXkazQc.exe
  C:\Windows\System\ZXkazQc.exe
  2⤵
  PID:8960
- C:\Windows\System\mCtNaIW.exe
  C:\Windows\System\mCtNaIW.exe
  2⤵
  PID:9016
- C:\Windows\System\LFPPHca.exe
  C:\Windows\System\LFPPHca.exe
  2⤵
  PID:9060
- C:\Windows\System\pHddnqL.exe
  C:\Windows\System\pHddnqL.exe
  2⤵
  PID:9168
- C:\Windows\System\PoGYYjG.exe
  C:\Windows\System\PoGYYjG.exe
  2⤵
  PID:9204
- C:\Windows\System\dIxvfJS.exe
  C:\Windows\System\dIxvfJS.exe
  2⤵
  PID:8196
- C:\Windows\System\hAzMiqJ.exe
  C:\Windows\System\hAzMiqJ.exe
  2⤵
  PID:8328
- C:\Windows\System\hJnGUCb.exe
  C:\Windows\System\hJnGUCb.exe
  2⤵
  PID:8580
- C:\Windows\System\yfuYhpM.exe
  C:\Windows\System\yfuYhpM.exe
  2⤵
  PID:8692
- C:\Windows\System\OwDugMp.exe
  C:\Windows\System\OwDugMp.exe
  2⤵
  PID:8716
- C:\Windows\System\BdwSFsW.exe
  C:\Windows\System\BdwSFsW.exe
  2⤵
  PID:8924
- C:\Windows\System\yDHXwpu.exe
  C:\Windows\System\yDHXwpu.exe
  2⤵
  PID:8884
- C:\Windows\System\mSUMJUr.exe
  C:\Windows\System\mSUMJUr.exe
  2⤵
  PID:9200
- C:\Windows\System\DWzYTDN.exe
  C:\Windows\System\DWzYTDN.exe
  2⤵
  PID:6824
- C:\Windows\System\RaDBbhC.exe
  C:\Windows\System\RaDBbhC.exe
  2⤵
  PID:8500
- C:\Windows\System\CDLUjOK.exe
  C:\Windows\System\CDLUjOK.exe
  2⤵
  PID:8736
- C:\Windows\System\RiZxwiG.exe
  C:\Windows\System\RiZxwiG.exe
  2⤵
  PID:8848
- C:\Windows\System\XskEWRl.exe
  C:\Windows\System\XskEWRl.exe
  2⤵
  PID:9224
- C:\Windows\System\TNLPNmm.exe
  C:\Windows\System\TNLPNmm.exe
  2⤵
  PID:9268
- C:\Windows\System\EQPsNpb.exe
  C:\Windows\System\EQPsNpb.exe
  2⤵
  PID:9296
- C:\Windows\System\LrjgyKD.exe
  C:\Windows\System\LrjgyKD.exe
  2⤵
  PID:9316
- C:\Windows\System\aTLmfML.exe
  C:\Windows\System\aTLmfML.exe
  2⤵
  PID:9340
- C:\Windows\System\fXsJkfK.exe
  C:\Windows\System\fXsJkfK.exe
  2⤵
  PID:9372
- C:\Windows\System\nbLCTRk.exe
  C:\Windows\System\nbLCTRk.exe
  2⤵
  PID:9392
- C:\Windows\System\lMidrse.exe
  C:\Windows\System\lMidrse.exe
  2⤵
  PID:9412
- C:\Windows\System\EqVjbdA.exe
  C:\Windows\System\EqVjbdA.exe
  2⤵
  PID:9436
- C:\Windows\System\XOmDlEz.exe
  C:\Windows\System\XOmDlEz.exe
  2⤵
  PID:9468
- C:\Windows\System\qUhSnpB.exe
  C:\Windows\System\qUhSnpB.exe
  2⤵
  PID:9540
- C:\Windows\System\EbOIZXc.exe
  C:\Windows\System\EbOIZXc.exe
  2⤵
  PID:9556
- C:\Windows\System\lKRzrpq.exe
  C:\Windows\System\lKRzrpq.exe
  2⤵
  PID:9588
- C:\Windows\System\AKFcIlA.exe
  C:\Windows\System\AKFcIlA.exe
  2⤵
  PID:9612
- C:\Windows\System\lwpWHgh.exe
  C:\Windows\System\lwpWHgh.exe
  2⤵
  PID:9640
- C:\Windows\System\jAOFFSD.exe
  C:\Windows\System\jAOFFSD.exe
  2⤵
  PID:9672
- C:\Windows\System\NENNlRS.exe
  C:\Windows\System\NENNlRS.exe
  2⤵
  PID:9692
- C:\Windows\System\HubLtbe.exe
  C:\Windows\System\HubLtbe.exe
  2⤵
  PID:9712
- C:\Windows\System\wzKAoCX.exe
  C:\Windows\System\wzKAoCX.exe
  2⤵
  PID:9744
- C:\Windows\System\MgpYMVs.exe
  C:\Windows\System\MgpYMVs.exe
  2⤵
  PID:9784
- C:\Windows\System\bePclqk.exe
  C:\Windows\System\bePclqk.exe
  2⤵
  PID:9804
- C:\Windows\System\tFEnwak.exe
  C:\Windows\System\tFEnwak.exe
  2⤵
  PID:9824
- C:\Windows\System\BCsGVlM.exe
  C:\Windows\System\BCsGVlM.exe
  2⤵
  PID:9844
- C:\Windows\System\sTWhzoe.exe
  C:\Windows\System\sTWhzoe.exe
  2⤵
  PID:9888
- C:\Windows\System\tqJohhW.exe
  C:\Windows\System\tqJohhW.exe
  2⤵
  PID:9932
- C:\Windows\System\oCfvwBg.exe
  C:\Windows\System\oCfvwBg.exe
  2⤵
  PID:9952
- C:\Windows\System\EpjlBgC.exe
  C:\Windows\System\EpjlBgC.exe
  2⤵
  PID:9968
- C:\Windows\System\ZgNUcMa.exe
  C:\Windows\System\ZgNUcMa.exe
  2⤵
  PID:9988
- C:\Windows\System\zsaVgpb.exe
  C:\Windows\System\zsaVgpb.exe
  2⤵
  PID:10008
- C:\Windows\System\VgxwIbv.exe
  C:\Windows\System\VgxwIbv.exe
  2⤵
  PID:10044
- C:\Windows\System\VsYFcvN.exe
  C:\Windows\System\VsYFcvN.exe
  2⤵
  PID:10060
- C:\Windows\System\FXDQErX.exe
  C:\Windows\System\FXDQErX.exe
  2⤵
  PID:10080
- C:\Windows\System\oEBaarT.exe
  C:\Windows\System\oEBaarT.exe
  2⤵
  PID:10144
- C:\Windows\System\PbOWrsy.exe
  C:\Windows\System\PbOWrsy.exe
  2⤵
  PID:10188
- C:\Windows\System\LCKOCqe.exe
  C:\Windows\System\LCKOCqe.exe
  2⤵
  PID:10212
- C:\Windows\System\ktZsppl.exe
  C:\Windows\System\ktZsppl.exe
  2⤵
  PID:10228
- C:\Windows\System\AHvKFlX.exe
  C:\Windows\System\AHvKFlX.exe
  2⤵
  PID:1376
- C:\Windows\System\ZilbXLB.exe
  C:\Windows\System\ZilbXLB.exe
  2⤵
  PID:9276
- C:\Windows\System\wWstLLm.exe
  C:\Windows\System\wWstLLm.exe
  2⤵
  PID:9312
- C:\Windows\System\UVRnJZD.exe
  C:\Windows\System\UVRnJZD.exe
  2⤵
  PID:9348
- C:\Windows\System\MuTLsfS.exe
  C:\Windows\System\MuTLsfS.exe
  2⤵
  PID:9404
- C:\Windows\System\YmmqJDX.exe
  C:\Windows\System\YmmqJDX.exe
  2⤵
  PID:9460
- C:\Windows\System\PIEGBAp.exe
  C:\Windows\System\PIEGBAp.exe
  2⤵
  PID:9532
- C:\Windows\System\LNXvQJk.exe
  C:\Windows\System\LNXvQJk.exe
  2⤵
  PID:9600
- C:\Windows\System\DsPVEug.exe
  C:\Windows\System\DsPVEug.exe
  2⤵
  PID:9728
- C:\Windows\System\pPGXSVV.exe
  C:\Windows\System\pPGXSVV.exe
  2⤵
  PID:9776
- C:\Windows\System\wPJYIWU.exe
  C:\Windows\System\wPJYIWU.exe
  2⤵
  PID:9860
- C:\Windows\System\suBRIea.exe
  C:\Windows\System\suBRIea.exe
  2⤵
  PID:9868
- C:\Windows\System\VaAZARA.exe
  C:\Windows\System\VaAZARA.exe
  2⤵
  PID:9948
- C:\Windows\System\lnLctSR.exe
  C:\Windows\System\lnLctSR.exe
  2⤵
  PID:10004
- C:\Windows\System\fKukNOE.exe
  C:\Windows\System\fKukNOE.exe
  2⤵
  PID:10056
- C:\Windows\System\VVaamRj.exe
  C:\Windows\System\VVaamRj.exe
  2⤵
  PID:10164
- C:\Windows\System\PpGwoBg.exe
  C:\Windows\System\PpGwoBg.exe
  2⤵
  PID:10204
- C:\Windows\System\wAXxPtT.exe
  C:\Windows\System\wAXxPtT.exe
  2⤵
  PID:8428
- C:\Windows\System\KSoQAaq.exe
  C:\Windows\System\KSoQAaq.exe
  2⤵
  PID:9260
- C:\Windows\System\GqcRWdM.exe
  C:\Windows\System\GqcRWdM.exe
  2⤵
  PID:828
- C:\Windows\System\SeoORpC.exe
  C:\Windows\System\SeoORpC.exe
  2⤵
  PID:4952
- C:\Windows\System\xxjlnRY.exe
  C:\Windows\System\xxjlnRY.exe
  2⤵
  PID:9688
- C:\Windows\System\qFQLPem.exe
  C:\Windows\System\qFQLPem.exe
  2⤵
  PID:9780
- C:\Windows\System\BnKvUpb.exe
  C:\Windows\System\BnKvUpb.exe
  2⤵
  PID:9880
- C:\Windows\System\PoqIOFa.exe
  C:\Windows\System\PoqIOFa.exe
  2⤵
  PID:10116
- C:\Windows\System\jrVpSPX.exe
  C:\Windows\System\jrVpSPX.exe
  2⤵
  PID:10184
- C:\Windows\System\fVDXXlJ.exe
  C:\Windows\System\fVDXXlJ.exe
  2⤵
  PID:9248
- C:\Windows\System\SMgHyLg.exe
  C:\Windows\System\SMgHyLg.exe
  2⤵
  PID:2024
- C:\Windows\System\ELTdAlx.exe
  C:\Windows\System\ELTdAlx.exe
  2⤵
  PID:9940
- C:\Windows\System\YunkHjf.exe
  C:\Windows\System\YunkHjf.exe
  2⤵
  PID:9996
- C:\Windows\System\hxtbIMc.exe
  C:\Windows\System\hxtbIMc.exe
  2⤵
  PID:10224
- C:\Windows\System\aZjNcrV.exe
  C:\Windows\System\aZjNcrV.exe
  2⤵
  PID:10264
- C:\Windows\System\jOOaZSd.exe
  C:\Windows\System\jOOaZSd.exe
  2⤵
  PID:10288
- C:\Windows\System\UodxaIv.exe
  C:\Windows\System\UodxaIv.exe
  2⤵
  PID:10332
- C:\Windows\System\DxSyFmM.exe
  C:\Windows\System\DxSyFmM.exe
  2⤵
  PID:10360
- C:\Windows\System\perzDTL.exe
  C:\Windows\System\perzDTL.exe
  2⤵
  PID:10388
- C:\Windows\System\fwToSeF.exe
  C:\Windows\System\fwToSeF.exe
  2⤵
  PID:10412
- C:\Windows\System\UXgoujT.exe
  C:\Windows\System\UXgoujT.exe
  2⤵
  PID:10440
- C:\Windows\System\ZPDwGQA.exe
  C:\Windows\System\ZPDwGQA.exe
  2⤵
  PID:10460
- C:\Windows\System\dLBbpcD.exe
  C:\Windows\System\dLBbpcD.exe
  2⤵
  PID:10480
- C:\Windows\System\OXPsQvA.exe
  C:\Windows\System\OXPsQvA.exe
  2⤵
  PID:10500
- C:\Windows\System\TfaiqMb.exe
  C:\Windows\System\TfaiqMb.exe
  2⤵
  PID:10528
- C:\Windows\System\ppuSNPD.exe
  C:\Windows\System\ppuSNPD.exe
  2⤵
  PID:10568
- C:\Windows\System\GWUErwP.exe
  C:\Windows\System\GWUErwP.exe
  2⤵
  PID:10620
- C:\Windows\System\mHKESeH.exe
  C:\Windows\System\mHKESeH.exe
  2⤵
  PID:10648
- C:\Windows\System\nwNeOBU.exe
  C:\Windows\System\nwNeOBU.exe
  2⤵
  PID:10664
- C:\Windows\System\qlMgMKC.exe
  C:\Windows\System\qlMgMKC.exe
  2⤵
  PID:10696
- C:\Windows\System\OOtOzey.exe
  C:\Windows\System\OOtOzey.exe
  2⤵
  PID:10728
- C:\Windows\System\JlmGUNs.exe
  C:\Windows\System\JlmGUNs.exe
  2⤵
  PID:10748
- C:\Windows\System\jNoGAbP.exe
  C:\Windows\System\jNoGAbP.exe
  2⤵
  PID:10780
- C:\Windows\System\LqDOciO.exe
  C:\Windows\System\LqDOciO.exe
  2⤵
  PID:10804
- C:\Windows\System\iDXFbuy.exe
  C:\Windows\System\iDXFbuy.exe
  2⤵
  PID:10820
- C:\Windows\System\sxOrfAs.exe
  C:\Windows\System\sxOrfAs.exe
  2⤵
  PID:10840
- C:\Windows\System\PGSdWYE.exe
  C:\Windows\System\PGSdWYE.exe
  2⤵
  PID:10860
- C:\Windows\System\DbXArvC.exe
  C:\Windows\System\DbXArvC.exe
  2⤵
  PID:10896
- C:\Windows\System\GUGZmFq.exe
  C:\Windows\System\GUGZmFq.exe
  2⤵
  PID:10928
- C:\Windows\System\GWAwCok.exe
  C:\Windows\System\GWAwCok.exe
  2⤵
  PID:10952
- C:\Windows\System\rnwRsVq.exe
  C:\Windows\System\rnwRsVq.exe
  2⤵
  PID:11036
- C:\Windows\System\GPLcVwd.exe
  C:\Windows\System\GPLcVwd.exe
  2⤵
  PID:11056
- C:\Windows\System\YvfXTXL.exe
  C:\Windows\System\YvfXTXL.exe
  2⤵
  PID:11104
- C:\Windows\System\baqdLDT.exe
  C:\Windows\System\baqdLDT.exe
  2⤵
  PID:11160
- C:\Windows\System\lXAsndu.exe
  C:\Windows\System\lXAsndu.exe
  2⤵
  PID:11256
- C:\Windows\System\pOZOzxa.exe
  C:\Windows\System\pOZOzxa.exe
  2⤵
  PID:9820
- C:\Windows\System\KwoZbkw.exe
  C:\Windows\System\KwoZbkw.exe
  2⤵
  PID:10256
- C:\Windows\System\BMovVqH.exe
  C:\Windows\System\BMovVqH.exe
  2⤵
  PID:9288
- C:\Windows\System\djVFoGv.exe
  C:\Windows\System\djVFoGv.exe
  2⤵
  PID:10308
- C:\Windows\System\hvhztNF.exe
  C:\Windows\System\hvhztNF.exe
  2⤵
  PID:10376
- C:\Windows\System\LoMMIuw.exe
  C:\Windows\System\LoMMIuw.exe
  2⤵
  PID:10380
- C:\Windows\System\mmdDbSM.exe
  C:\Windows\System\mmdDbSM.exe
  2⤵
  PID:10424
- C:\Windows\System\sooDqIc.exe
  C:\Windows\System\sooDqIc.exe
  2⤵
  PID:10452
- C:\Windows\System\ovpEwJE.exe
  C:\Windows\System\ovpEwJE.exe
  2⤵
  PID:10476
- C:\Windows\System\KcQkeWa.exe
  C:\Windows\System\KcQkeWa.exe
  2⤵
  PID:10588
- C:\Windows\System\KxjooJy.exe
  C:\Windows\System\KxjooJy.exe
  2⤵
  PID:10556
- C:\Windows\System\NqZyiPS.exe
  C:\Windows\System\NqZyiPS.exe
  2⤵
  PID:10616
- C:\Windows\System\QNmYaUg.exe
  C:\Windows\System\QNmYaUg.exe
  2⤵
  PID:10692
- C:\Windows\System\PTEmPvg.exe
  C:\Windows\System\PTEmPvg.exe
  2⤵
  PID:10760
- C:\Windows\System\PRzBPyo.exe
  C:\Windows\System\PRzBPyo.exe
  2⤵
  PID:10796
- C:\Windows\System\jpUhbQm.exe
  C:\Windows\System\jpUhbQm.exe
  2⤵
  PID:10876
- C:\Windows\System\KmxZhei.exe
  C:\Windows\System\KmxZhei.exe
  2⤵
  PID:10856
- C:\Windows\System\mHWHelq.exe
  C:\Windows\System\mHWHelq.exe
  2⤵
  PID:11016
- C:\Windows\System\CiKuUGG.exe
  C:\Windows\System\CiKuUGG.exe
  2⤵
  PID:11152
- C:\Windows\System\VBaYDXq.exe
  C:\Windows\System\VBaYDXq.exe
  2⤵
  PID:10284
- C:\Windows\System\JtZOODv.exe
  C:\Windows\System\JtZOODv.exe
  2⤵
  PID:10252
- C:\Windows\System\KSHMmQU.exe
  C:\Windows\System\KSHMmQU.exe
  2⤵
  PID:10472
- C:\Windows\System\EDUooqJ.exe
  C:\Windows\System\EDUooqJ.exe
  2⤵
  PID:11184
- C:\Windows\System\kjeyuCh.exe
  C:\Windows\System\kjeyuCh.exe
  2⤵
  PID:11248
- C:\Windows\System\DgIZZSK.exe
  C:\Windows\System\DgIZZSK.exe
  2⤵
  PID:10788
- C:\Windows\System\gOZaEva.exe
  C:\Windows\System\gOZaEva.exe
  2⤵
  PID:10904
- C:\Windows\System\guXaXaP.exe
  C:\Windows\System\guXaXaP.exe
  2⤵
  PID:10948
- C:\Windows\System\SghIgMp.exe
  C:\Windows\System\SghIgMp.exe
  2⤵
  PID:2948
- C:\Windows\System\QteKVRt.exe
  C:\Windows\System\QteKVRt.exe
  2⤵
  PID:11072
- C:\Windows\System\BmhrTGL.exe
  C:\Windows\System\BmhrTGL.exe
  2⤵
  PID:10324
- C:\Windows\System\gQWNbpc.exe
  C:\Windows\System\gQWNbpc.exe
  2⤵
  PID:11064
- C:\Windows\System\vGIEqln.exe
  C:\Windows\System\vGIEqln.exe
  2⤵
  PID:11032
- C:\Windows\System\sgCTiau.exe
  C:\Windows\System\sgCTiau.exe
  2⤵
  PID:11284
- C:\Windows\System\MtmRHgS.exe
  C:\Windows\System\MtmRHgS.exe
  2⤵
  PID:11320
- C:\Windows\System\NpPMDyP.exe
  C:\Windows\System\NpPMDyP.exe
  2⤵
  PID:11348
- C:\Windows\System\bqwunUl.exe
  C:\Windows\System\bqwunUl.exe
  2⤵
  PID:11380
- C:\Windows\System\ehhCFQi.exe
  C:\Windows\System\ehhCFQi.exe
  2⤵
  PID:11408
- C:\Windows\System\aCBeNaQ.exe
  C:\Windows\System\aCBeNaQ.exe
  2⤵
  PID:11464
- C:\Windows\System\pwdfevY.exe
  C:\Windows\System\pwdfevY.exe
  2⤵
  PID:11488
- C:\Windows\System\LSqUVvS.exe
  C:\Windows\System\LSqUVvS.exe
  2⤵
  PID:11504
- C:\Windows\System\oLXBdKS.exe
  C:\Windows\System\oLXBdKS.exe
  2⤵
  PID:11548
- C:\Windows\System\tEvixVs.exe
  C:\Windows\System\tEvixVs.exe
  2⤵
  PID:11568
- C:\Windows\System\vkPaoQq.exe
  C:\Windows\System\vkPaoQq.exe
  2⤵
  PID:11592
- C:\Windows\System\vceCAWX.exe
  C:\Windows\System\vceCAWX.exe
  2⤵
  PID:11608
- C:\Windows\System\MBKOMbb.exe
  C:\Windows\System\MBKOMbb.exe
  2⤵
  PID:11632
- C:\Windows\System\OtBWgIA.exe
  C:\Windows\System\OtBWgIA.exe
  2⤵
  PID:11652
- C:\Windows\System\JpbqjYn.exe
  C:\Windows\System\JpbqjYn.exe
  2⤵
  PID:11668
- C:\Windows\System\aJoYnII.exe
  C:\Windows\System\aJoYnII.exe
  2⤵
  PID:11692
- C:\Windows\System\WTsWeFS.exe
  C:\Windows\System\WTsWeFS.exe
  2⤵
  PID:11728
- C:\Windows\System\nCmnXEO.exe
  C:\Windows\System\nCmnXEO.exe
  2⤵
  PID:11748
- C:\Windows\System\UtTFBmk.exe
  C:\Windows\System\UtTFBmk.exe
  2⤵
  PID:11780
- C:\Windows\System\imCUEWd.exe
  C:\Windows\System\imCUEWd.exe
  2⤵
  PID:11840
- C:\Windows\System\QdCuYzy.exe
  C:\Windows\System\QdCuYzy.exe
  2⤵
  PID:11876
- C:\Windows\System\ScGHniG.exe
  C:\Windows\System\ScGHniG.exe
  2⤵
  PID:11892
- C:\Windows\System\XkLqKkM.exe
  C:\Windows\System\XkLqKkM.exe
  2⤵
  PID:11944
- C:\Windows\System\udZTiTJ.exe
  C:\Windows\System\udZTiTJ.exe
  2⤵
  PID:11960
- C:\Windows\System\qqWxMgC.exe
  C:\Windows\System\qqWxMgC.exe
  2⤵
  PID:11980
- C:\Windows\System\aPnlJgj.exe
  C:\Windows\System\aPnlJgj.exe
  2⤵
  PID:12008
- C:\Windows\System\msQpDWV.exe
  C:\Windows\System\msQpDWV.exe
  2⤵
  PID:12032
- C:\Windows\System\TOhwMFy.exe
  C:\Windows\System\TOhwMFy.exe
  2⤵
  PID:12052
- C:\Windows\System\uITTgOj.exe
  C:\Windows\System\uITTgOj.exe
  2⤵
  PID:12068
- C:\Windows\System\XAJkqGE.exe
  C:\Windows\System\XAJkqGE.exe
  2⤵
  PID:12092
- C:\Windows\System\cGjbcIZ.exe
  C:\Windows\System\cGjbcIZ.exe
  2⤵
  PID:12112
- C:\Windows\System\aHjHJvN.exe
  C:\Windows\System\aHjHJvN.exe
  2⤵
  PID:12136
- C:\Windows\System\EPTvnOx.exe
  C:\Windows\System\EPTvnOx.exe
  2⤵
  PID:12168
- C:\Windows\System\AxcFzoq.exe
  C:\Windows\System\AxcFzoq.exe
  2⤵
  PID:12188
- C:\Windows\System\IKqGEOQ.exe
  C:\Windows\System\IKqGEOQ.exe
  2⤵
  PID:12240
- C:\Windows\System\fpTpFCZ.exe
  C:\Windows\System\fpTpFCZ.exe
  2⤵
  PID:12284
- C:\Windows\System\qmaxnLq.exe
  C:\Windows\System\qmaxnLq.exe
  2⤵
  PID:10660
- C:\Windows\System\mwuWuax.exe
  C:\Windows\System\mwuWuax.exe
  2⤵
  PID:11268
- C:\Windows\System\znXiUec.exe
  C:\Windows\System\znXiUec.exe
  2⤵
  PID:11344
- C:\Windows\System\jdSIheg.exe
  C:\Windows\System\jdSIheg.exe
  2⤵
  PID:11396
- C:\Windows\System\xblfGgP.exe
  C:\Windows\System\xblfGgP.exe
  2⤵
  PID:11524
- C:\Windows\System\ANMUpQG.exe
  C:\Windows\System\ANMUpQG.exe
  2⤵
  PID:11560
- C:\Windows\System\avyKIHg.exe
  C:\Windows\System\avyKIHg.exe
  2⤵
  PID:11600
- C:\Windows\System\emJCZwE.exe
  C:\Windows\System\emJCZwE.exe
  2⤵
  PID:11676
- C:\Windows\System\PqeYyqh.exe
  C:\Windows\System\PqeYyqh.exe
  2⤵
  PID:11744
- C:\Windows\System\LYegNKC.exe
  C:\Windows\System\LYegNKC.exe
  2⤵
  PID:1304
- C:\Windows\System\FnqdTsu.exe
  C:\Windows\System\FnqdTsu.exe
  2⤵
  PID:11772
- C:\Windows\System\slJhLnB.exe
  C:\Windows\System\slJhLnB.exe
  2⤵
  PID:11848
- C:\Windows\System\yDqIBoj.exe
  C:\Windows\System\yDqIBoj.exe
  2⤵
  PID:11888
- C:\Windows\System\zRPhvsb.exe
  C:\Windows\System\zRPhvsb.exe
  2⤵
  PID:11940
- C:\Windows\System\OswjPjx.exe
  C:\Windows\System\OswjPjx.exe
  2⤵
  PID:11988
- C:\Windows\System\jCvYTkd.exe
  C:\Windows\System\jCvYTkd.exe
  2⤵
  PID:12076
- C:\Windows\System\zzbAxkb.exe
  C:\Windows\System\zzbAxkb.exe
  2⤵
  PID:2692
- C:\Windows\System\EPhRxqA.exe
  C:\Windows\System\EPhRxqA.exe
  2⤵
  PID:12264
- C:\Windows\System\GPRDwMG.exe
  C:\Windows\System\GPRDwMG.exe
  2⤵
  PID:12280
- C:\Windows\System\KPZQeME.exe
  C:\Windows\System\KPZQeME.exe
  2⤵
  PID:11316
- C:\Windows\System\hDeYWty.exe
  C:\Windows\System\hDeYWty.exe
  2⤵
  PID:2012
- C:\Windows\System\JgPUxqK.exe
  C:\Windows\System\JgPUxqK.exe
  2⤵
  PID:11832
- C:\Windows\System\yhjWwFE.exe
  C:\Windows\System\yhjWwFE.exe
  2⤵
  PID:11920
- C:\Windows\System\WODLlQa.exe
  C:\Windows\System\WODLlQa.exe
  2⤵
  PID:11924
- C:\Windows\System\McWxpxo.exe
  C:\Windows\System\McWxpxo.exe
  2⤵
  PID:12208
- C:\Windows\System\dFEUDkx.exe
  C:\Windows\System\dFEUDkx.exe
  2⤵
  PID:11460
- C:\Windows\System\LwNdPOd.exe
  C:\Windows\System\LwNdPOd.exe
  2⤵
  PID:11400
- C:\Windows\System\mBhwiLV.exe
  C:\Windows\System\mBhwiLV.exe
  2⤵
  PID:11820
- C:\Windows\System\nfMtwTb.exe
  C:\Windows\System\nfMtwTb.exe
  2⤵
  PID:11956
- C:\Windows\System\dAZVrKk.exe
  C:\Windows\System\dAZVrKk.exe
  2⤵
  PID:12248
- C:\Windows\System\stzIIRS.exe
  C:\Windows\System\stzIIRS.exe
  2⤵
  PID:12292
- C:\Windows\System\HEuhXSL.exe
  C:\Windows\System\HEuhXSL.exe
  2⤵
  PID:12316
- C:\Windows\System\hrZJmKG.exe
  C:\Windows\System\hrZJmKG.exe
  2⤵
  PID:12392
- C:\Windows\System\oaWHfnF.exe
  C:\Windows\System\oaWHfnF.exe
  2⤵
  PID:12416
- C:\Windows\System\pfTTXCk.exe
  C:\Windows\System\pfTTXCk.exe
  2⤵
  PID:12440
- C:\Windows\System\KhkFAPy.exe
  C:\Windows\System\KhkFAPy.exe
  2⤵
  PID:12460
- C:\Windows\System\oDuvjCp.exe
  C:\Windows\System\oDuvjCp.exe
  2⤵
  PID:12480
- C:\Windows\System\ddSMbDD.exe
  C:\Windows\System\ddSMbDD.exe
  2⤵
  PID:12500
- C:\Windows\System\CWJeETI.exe
  C:\Windows\System\CWJeETI.exe
  2⤵
  PID:12516
- C:\Windows\System\YToPdOe.exe
  C:\Windows\System\YToPdOe.exe
  2⤵
  PID:12540
- C:\Windows\System\jHnCdfW.exe
  C:\Windows\System\jHnCdfW.exe
  2⤵
  PID:12560
- C:\Windows\System\rIPYAak.exe
  C:\Windows\System\rIPYAak.exe
  2⤵
  PID:12608
- C:\Windows\System\wGMsVqc.exe
  C:\Windows\System\wGMsVqc.exe
  2⤵
  PID:12640
- C:\Windows\System\MADSFXO.exe
  C:\Windows\System\MADSFXO.exe
  2⤵
  PID:12660
- C:\Windows\System\vKemvGx.exe
  C:\Windows\System\vKemvGx.exe
  2⤵
  PID:12708
- C:\Windows\System\bkuIxyA.exe
  C:\Windows\System\bkuIxyA.exe
  2⤵
  PID:12740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_yhp1psjk.0ph.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yhp1psjk.0ph.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

BSbiLwG.exe

Path C:\Windows\System\BSbiLwG.exe
Size 1.6MB
SHA256 a49a135fe7fae4b87b699ae6f744bebadb5941aeeab0c10b6944a01e258a101a
MD5 775635c68d704842e05e487c2fce6137
SHA1 14213c54c7e5b1df880bd13eef4cf1846cb78787
SHA512 c66bcf9f81a7aa5f6be563a46dd272afdbc6198343a6bdcdac5cf7802c69dd09b79ebb7764651ee95e9429db6fc87c3c6dda7852cddad8f53e5c163363a028ef
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdxr:Lz071uv4BPMki8CnfLv3zQXtTEjr
MD5 SHA1 SHA512 SSDEEP

Submit Download

DXDpHvH.exe

Path C:\Windows\System\DXDpHvH.exe
Size 1.6MB
SHA256 0f35cec8d9e42d46d2508137b49d98c9e23027dd80a1497cf4213604ebcda1fb
MD5 2c906ea125ebe7511c74f12748633274
SHA1 0e35859297dcf5675dd1054fdc76abfdd6b8106f
SHA512 ec934c0615502c0dabc895bb668423bba3208fc80b477e0c93f75a1380053cd5149c712542de1f83d2122af560c5f61b3048a8af06ecc0e58f60d75b79fedc47
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdxl:Lz071uv4BPMki8CnfLv3zQXtTEjl
MD5 SHA1 SHA512 SSDEEP

Submit Download

EoMBTbu.exe

Path C:\Windows\System\EoMBTbu.exe
Size 1.6MB
SHA256 6f53193d6288dc95784dbc4fff61b4fdb63323f647157a19d2011c7c996629b2
MD5 b1bcb5408af7a0a57b2d9576f7209235
SHA1 3f70ec3575caa4f58966cd7b5e4a7beebce4fc8d
SHA512 2365f1a99c6ca3f8c2918008e8aaf8d5935d4672fcd397f704332dfaeb6a3cbf44b054a1c7881d16ff7e11cc38157906245194c962d9bef375ba4a5afda62758
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdxl:Lz071uv4BPMki8CnfLv3zQXtTEjl
MD5 SHA1 SHA512 SSDEEP

Submit Download

FGJaclf.exe

Path C:\Windows\System\FGJaclf.exe
Size 1.6MB
SHA256 510603bd5bee7c9622aad0d3c8e54a307cdb44ab986c3e9ce16a0606b1926cd7
MD5 c22f987190c52a2ae15a5b869bb58bf8
SHA1 c8b0790e73b2ce2d83798f4529b756d6c44b477b
SHA512 fca7591ee3df36a69127a679ef43a5effc8788aed76893c48d173601970b5d4188b0349467acfef14da69240f13eaf3a0935617f7223c9833b67d6653b2dad46
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdxF:Lz071uv4BPMki8CnfLv3zQXtTEjF
MD5 SHA1 SHA512 SSDEEP

Submit Download

FHyQjtn.exe

Path C:\Windows\System\FHyQjtn.exe
Size 1.6MB
SHA256 3108eda389e882b089682bc9dec7a9afd5d0e6202cf34483acece56953f7ac0e
MD5 3a2da208a6e9f9117a55cf92b2d87f00
SHA1 20eaa26e615c15e105545533c790571c51059285
SHA512 2df3c981167272ef90ebee9d99a29974aed2549b56f1a45cc2a2d651be858c7ca8886ddb9cdeae80b00c9d0f0b9ccb1faa80c64cd79116c892b3f9bdc2788662
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdxK:Lz071uv4BPMki8CnfLv3zQXtTEjK
MD5 SHA1 SHA512 SSDEEP

Submit Download

FeZWEgm.exe

Path C:\Windows\System\FeZWEgm.exe
Size 1.6MB
SHA256 37c0b9ac9e387f4fb1d37910e065da05b73682d739b8586f1c463641c4aa238a
MD5 9a10ed26d9637d9b66a31b382be2c4f5
SHA1 e223ad8a4d410f3b779a22d59a680226a28851d2
SHA512 6c2c2f6cd76f4aa47af9829184aa154b5ac16d0e1457da92fd79d11c0e4ed15d5e5e94d1d87b60c6d7d26cd907bb639c47b530e8e91bd456a54af5c569b8fea2
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdxh:Lz071uv4BPMki8CnfLv3zQXtTEjh
MD5 SHA1 SHA512 SSDEEP

Submit Download

GCRsAoz.exe

Path C:\Windows\System\GCRsAoz.exe
Size 1.6MB
SHA256 b9624dd6572ef22b3a08ebf9267d3fa20cf76d91b17d193aa7ea6f9b635f9d36
MD5 3e7d64802c7a539c83935f5764fc1080
SHA1 d457c4b6b4ff79b65407e078ddc838b3440de670
SHA512 831a340621b611c99d872e8edee88a5fff8dc6da8b51b12162bff92fb5cfac80056b35da7e9ea02b5a09652666d6884b7d13260ae9589f7bce623f2ade8f4b55
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdxF:Lz071uv4BPMki8CnfLv3zQXtTEjF
MD5 SHA1 SHA512 SSDEEP

Submit Download

GHNryNp.exe

Path C:\Windows\System\GHNryNp.exe
Size 1.6MB
SHA256 83bf16698f2f471b11341aa90a1ca2a18370ae2f4f5ee62c1dbaf4d6ab4abebd
MD5 56f69119b173240bd7309c29f05fb3e7
SHA1 06a8c8f7ff09e6248cf17ca757b86cbdd9ee6cb3
SHA512 4fd2b444c7b27b0a6a64fe51ed533ab9c851677e15e96fcc76c22ebc6607ad917815f4437c273608d146544d08357b6b97b534ae006ab9513e38089427bef2aa
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdx1:Lz071uv4BPMki8CnfLv3zQXtTEj1
MD5 SHA1 SHA512 SSDEEP

Submit Download

KkRgsuI.exe

Path C:\Windows\System\KkRgsuI.exe
Size 1.6MB
SHA256 c529a9a4aff02814127e99af243016e626bfd0bd00e576a10f07391470211e24
MD5 5e27fd548ca3862290c63438981de9b3
SHA1 4dd2ca18d9d487d440bb4678e898b46c99895eff
SHA512 d2d2b48576f90bc9845826f5966e871a2fbbddc4a3e094baa50e65912c7715bb889121a79784d77410f33dc2c55f80c0c28dbf4670b10dc3b78e75ba064701a5
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdxZ:Lz071uv4BPMki8CnfLv3zQXtTEjZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

PSJgXMP.exe

Path C:\Windows\System\PSJgXMP.exe
Size 1.6MB
SHA256 53b7084240e437ebeade8cae5e6f8c30f0789d5c27c37ca79e6de662b7c202b7
MD5 c19096bdc9e0bcfa2f12e1ff01fcf1d0
SHA1 e280188d17f9fc12e14e1eba8f0e370c70b52968
SHA512 b8cc376df2db2784c28bf231a8b2b1ee0d23bdebdc10088aa9191288a405d39b4a63b81507f576fc02024ff4099b82d8861810faab34ddd94499747e0a9d7d76
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdx1:Lz071uv4BPMki8CnfLv3zQXtTEj1
MD5 SHA1 SHA512 SSDEEP

Submit Download

PZNtaZL.exe

Path C:\Windows\System\PZNtaZL.exe
Size 1.6MB
SHA256 779eccdf281952cdc76ae95a876dd801b04bd77d45268736e6c0e8d97183b7b5
MD5 5302869ae17410c61dbb612c1f41fa80
SHA1 806cdf2c0c4d8be61a81798200b801c99780b72a
SHA512 42d2480dbb6c75d0fbac9f3ec342957cc7e392062c1a90ee83f8455366c1c68955f9b4d6c97447fee8b812037497f956eb15a62c875c551a00a2e5a9e5f636bd
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdxB:Lz071uv4BPMki8CnfLv3zQXtTEjB
MD5 SHA1 SHA512 SSDEEP

Submit Download

RUNWQNE.exe

Path C:\Windows\System\RUNWQNE.exe
Size 1.6MB
SHA256 3be4c064e48e3fa316e899cffc03cbb4c5ba6d76810a6ccc18e9bc65443493c4
MD5 00f723636fc865ba97d0486966008068
SHA1 2a69e72bb214e0e60a544e0ff4c2ddc840009fa4
SHA512 1569781aadf5a04822158e67cdba68d4d7e86652423eebe029c4cfefa5074ee7e24c63322da9726fb7ddc24d5c89daf9f3710eb2bee13086af6b8d0613161db6
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdxB:Lz071uv4BPMki8CnfLv3zQXtTEjB
MD5 SHA1 SHA512 SSDEEP

Submit Download

SEPsPuv.exe

Path C:\Windows\System\SEPsPuv.exe
Size 1.6MB
SHA256 d87d33dfb9d1dfab2852d67ab33f4730760165ddbef8b33769e686a77cf4f963
MD5 a53545fc65e74e97ac9c685ab5a1a4a3
SHA1 bb3875402afa8eae41f8775ad4c3a1fb4740ff58
SHA512 1c7a4016f78b25769670cca3bf94d7f9d79f0507c4ce11bb65328220be3fc4268f54d2f9f3cb346fe5a5f58a61b03d8a1a4609872ef6457f1a7e8f9bfa9a8a15
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdxX:Lz071uv4BPMki8CnfLv3zQXtTEjX
MD5 SHA1 SHA512 SSDEEP

Submit Download

TlcwpIt.exe

Path C:\Windows\System\TlcwpIt.exe
Size 1.6MB
SHA256 17b8c99dd6abb7b895ec85e7a88a58cdae30c73e27c4701abe7fa0e01c0a81dc
MD5 056480ad1b6564b0acd888c803056b92
SHA1 95959763c1e34e75a207905a62af403fd08cc5c7
SHA512 c01abb3bad54048a91bf4630e4b11511dd1d1ca20a0aa35f05b9fcce1f9f182cf197b2c147167232138d5266a679b491fb2d51e927500c3527df2b21f858f5d7
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdxh:Lz071uv4BPMki8CnfLv3zQXtTEjh
MD5 SHA1 SHA512 SSDEEP

Submit Download

VwLmRCG.exe

Path C:\Windows\System\VwLmRCG.exe
Size 1.6MB
SHA256 a4502cd5347dd368c404b09525527c510ef27b9a87250df24f6e1bc6d08a3a16
MD5 c169f59c586703adc5a25e86a77a573a
SHA1 6653506cd9f06ed33b3919734f2bfd0cee05e992
SHA512 6e84920dd012ce3c2573169db4901b599dfad92bc6e230655032cedd0ba16c963348b8e1b1653f625bbee2538f127f7a19a119fd877a8d55de86d6b06d089a6c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdxV:Lz071uv4BPMki8CnfLv3zQXtTEjV
MD5 SHA1 SHA512 SSDEEP

Submit Download

XEWyzHF.exe

Path C:\Windows\System\XEWyzHF.exe
Size 1.6MB
SHA256 d36a87f82c26860e2450589fc0f3b67b15e74c30d64727946a0eb961dedfde09
MD5 c89f819c8300d5117d408fd27d16eee3
SHA1 2e69d46e110f79854542e0a0cce6cc798be53e64
SHA512 d85b538a4606ef398633471361b69e4a0172c4bed73cf39c9265d224cf85e6f0cb448c18c68212c864bace139abb9fb8fd3d6ddc55fcf990edaae53e05a1199c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdxw:Lz071uv4BPMki8CnfLv3zQXtTEjw
MD5 SHA1 SHA512 SSDEEP

Submit Download

XtHdyGk.exe

Path C:\Windows\System\XtHdyGk.exe
Size 1.6MB
SHA256 a7f03ad36249b34c6de791d07df3c7ee103bf5770ac866c426f35a12fe7d575a
MD5 eac123b288262f7b922e8cbed52fbc4e
SHA1 256cc748db4746f27d99157f4ad11194b2ffc72e
SHA512 014397f2bfbedb9a65867b1b3f26722a8f5b6add1ccfece61951aeb646d09ab49e08284ad9c515d9a11c8541dfa310cf093e234a4641a22ac3d20b98a8c3058b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdxI:Lz071uv4BPMki8CnfLv3zQXtTEjI
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZxUEXng.exe

Path C:\Windows\System\ZxUEXng.exe
Size 1.6MB
SHA256 cabc452596ea38615a6a8cf4d5e0355f89f8bae98c37a8253cb39c506f6ff591
MD5 818fec11ef83345ff452bb9fb41c85f0
SHA1 25a50bc1ac093e62559d0932386273060c3e172c
SHA512 5e1f85696f0be862816cf5c307892378c7a967018a2796baadd132e6cc865c93227091e7863a9783ca748467e0903a357951ff8e11734cc6bd845c29bb90ebe4
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdxW:Lz071uv4BPMki8CnfLv3zQXtTEjW
MD5 SHA1 SHA512 SSDEEP

Submit Download

bPTMzbq.exe

Path C:\Windows\System\bPTMzbq.exe
Size 1.6MB
SHA256 aa0f8e718d1182ee8fc9f842031a48635f717e6cdb995ed28568e6a7433873fe
MD5 6f25059ea378eaf2cc6b83efcee584f7
SHA1 595d1f17a06c3119a38921ba6a093ee4d5ce950f
SHA512 37199691a23519b50ec4ec6c58fef10654da133c1d396d7633da1ecbe79038bd4c439184a6aaca51cf61d1d836ae19544834cc0324b79153018c91e5ab84663b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdxk:Lz071uv4BPMki8CnfLv3zQXtTEjk
MD5 SHA1 SHA512 SSDEEP

Submit Download

boYZmzj.exe

Path C:\Windows\System\boYZmzj.exe
Size 1.6MB
SHA256 b6b9ad72ce418637b4e9402862101d98a5f235305b0585c7072731a70d92eb59
MD5 e36a0458e99c5928567762dc6e6a5e0f
SHA1 430023bb473ed6ec03e3f6f037b85cc58c5feb6e
SHA512 b825b88b4dc663a046d4e19d9047482b47c2f81d29ff5a1f9ebda1866b2ac290d5178754cbd6066351e89ff085b236d5dbf1fe5b12a9c54364a1fbe6b43c77fd
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdxM:Lz071uv4BPMki8CnfLv3zQXtTEjgF
MD5 SHA1 SHA512 SSDEEP

Submit Download

cGRByVm.exe

Path C:\Windows\System\cGRByVm.exe
Size 1.6MB
SHA256 24c7dc40d1ce7d5b78a4f4e0ac817e1bcfb54a1f31b5504a5540571ae5d7f104
MD5 d8c8328e7d58dd4232db76c6aa3f424e
SHA1 94bdf9b8f3983b9cddbee54208fca13935de0e82
SHA512 74b4cba6fe05a9db02b6127b664d297179b6b96eeb184437fdfda2364a6db34b693ae60892630993ce7ffc79d17dcdcc9c065864fcbe0cde1adec57451595d2f
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdxe:Lz071uv4BPMki8CnfLv3zQXtTEje
MD5 SHA1 SHA512 SSDEEP

Submit Download

cNROIlu.exe

Path C:\Windows\System\cNROIlu.exe
Size 1.6MB
SHA256 4f0e982580a053643b36a790b0a267222dca1fad08f5f4edef287b362dfc3539
MD5 7be6b95a297722e943f2958d9b7252c6
SHA1 9edd10d59efe37f3db72ef3bf63eb7a5aed71669
SHA512 d76446ca8cd8b6a1a74b3a53802c929239e8f0c2ef390cb96329cd65e69202cbb7d66efb9c202e5b8cd51752df4a76198527d21c40afd162a269950e658bc1a3
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdxf:Lz071uv4BPMki8CnfLv3zQXtTEjBXV
MD5 SHA1 SHA512 SSDEEP

Submit Download

dwyNZdl.exe

Path C:\Windows\System\dwyNZdl.exe
Size 1.6MB
SHA256 8c4b6babdbd5a9e2736f25cbdd3a94f3a79949549fd290a0f226b839ef0fb659
MD5 2c715f46b2ea54bd9b852d2c35c5e450
SHA1 992ea133923b5fcd5f500f03b6ff0b873303d017
SHA512 1ffe631c4c838dfec54018cccf502dd4aa965b37b80e9f094865bc9b9c894af3291bfcb4b15398d5933991b42786dc04e01c45db5312d4dea89c29b8d6b240b2
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdx/:Lz071uv4BPMki8CnfLv3zQXtTEj/
MD5 SHA1 SHA512 SSDEEP

Submit Download

hAPqRJV.exe

Path C:\Windows\System\hAPqRJV.exe
Size 1.6MB
SHA256 d286bd350726d0202529725fa7ed6cbf33ebc248774b85e97eace48bb0714a6a
MD5 088078aaec463d3289f5b1f570de59b5
SHA1 bf7a048a1ba9d143f751e5e4a055d23e3cb01217
SHA512 b12f10f51da121e4905bddfc30ad049cb82f0048e1cad30ca2fac434a907a80e7e3366c35b89a5f43276fea90892f592e5ffcd9cfa15384ec68ed13742532b96
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdxy:Lz071uv4BPMki8CnfLv3zQXtTEjy
MD5 SHA1 SHA512 SSDEEP

Submit Download

krORkAP.exe

Path C:\Windows\System\krORkAP.exe
Size 1.6MB
SHA256 761fff925b2df1d3693e30437c8829f50588f5c74de8cc730ecbe703ad448afe
MD5 d2760ccbdf7746bc5caedf9c1825a52d
SHA1 a8d8117aae0c8c5e68469a7b192ef5d8ea58ada3
SHA512 07dd5e167f658456e1a0ed0496e10983a1fa903802f4a8913973f3f0c3f8e55496d5a1b4129372ed58f7ab6517592a33e1a5337ac4a325187c8ba457804e5e4f
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdxf:Lz071uv4BPMki8CnfLv3zQXtTEjf
MD5 SHA1 SHA512 SSDEEP

Submit Download

mDpmKGD.exe

Path C:\Windows\System\mDpmKGD.exe
Size 1.6MB
SHA256 f0fdc38860b5ec1defce2600a7c27505978d764ba7396012e7ff0c20e811896c
MD5 49fb00814c1efc6a99d6742a9e7a9b9a
SHA1 d9bcfb3a9e10846388854be70b20dbd8842c8abe
SHA512 fe8c7f91d9c2ff6373df9a93986821aa4abe328a106bab87bda66127fc3c3f8dc719f5c785c8b906dd7e4ece8bbc799fe00f96a88080052797b8b2f4fac0d843
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdxS:Lz071uv4BPMki8CnfLv3zQXtTEjS
MD5 SHA1 SHA512 SSDEEP

Submit Download

nluHyqU.exe

Path C:\Windows\System\nluHyqU.exe
Size 1.6MB
SHA256 7eaf204bcab243bfd6909f08abf3d64e1d0a015456a56a6f9991b41ba73088cb
MD5 b26be4f56f8beced9f457f3ed06a9041
SHA1 abad0778c9ccb4a250b1cf34421f983b5f17717d
SHA512 8c9e31580e8925b3ee9009e0d30a4f9310a0752a93ae551f89cfbaf83be3319e82a87bd2f957f5809e48556e11cf1d45b85e7f7851c0fc81c5bf27e79761ea5d
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdx1:Lz071uv4BPMki8CnfLv3zQXtTEj1
MD5 SHA1 SHA512 SSDEEP

Submit Download

plyNpcL.exe

Path C:\Windows\System\plyNpcL.exe
Size 1.6MB
SHA256 0b619987619da5d04fe1dfb4a379b92bae37261b76fb75604acbbfbce6784db7
MD5 eebf0f8248e8a030a42c5d2a271692a0
SHA1 13e828efaefabdd0d071d117a223e3f714208ed7
SHA512 56b9d86c5042cba7b1fc2a8504e5772691e9c7d972d16b6febcda77100f7a5b48cc9592fe9cf243f1af329c9ff1a3ca85cfb72049f15cba3582d51a31df91a53
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdxu:Lz071uv4BPMki8CnfLv3zQXtTEju
MD5 SHA1 SHA512 SSDEEP

Submit Download

rqpuglS.exe

Path C:\Windows\System\rqpuglS.exe
Size 1.6MB
SHA256 d122d11b0265bee393502fb05c880c812eea5a6d7b9e24c2738962095dd8895d
MD5 ebb8f8c38b62c36c6df2e62875894f01
SHA1 6f51939e83fcdbedffacbfe12ee2909d3e3d471d
SHA512 ee48add66c1b5f4267aa48d00dfc516e668fd004054583d3b1b2773fe0b749a859dd553fe9ea09f137969c8e530d016aac5b22bd5629557018cb504326e73e9c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdxv:Lz071uv4BPMki8CnfLv3zQXtTEjv
MD5 SHA1 SHA512 SSDEEP

Submit Download

rsQjFAQ.exe

Path C:\Windows\System\rsQjFAQ.exe
Size 8B
SHA256 5af3a1341f496326df1524541aced67d93fdd0a1fdbeea5fbba587fa5eb07a36
MD5 451cfa3088797a5759ea7abf906e1ccf
SHA1 eeaf2fd2f001ed5a41ce1efebd82f3fc28a520be
SHA512 bd445dbd05fbe2a6973d61447ab875240d6c79b3f30588d7a435d220b1181e8ac50e19a9616fe10e43f12e3e6f4cb3e9d3c38f5188e762af12be986ddff06b28
MD5 SHA1 SHA512

Submit Download

syGAFrw.exe

Path C:\Windows\System\syGAFrw.exe
Size 1.6MB
SHA256 d2865e1f6c24109f2e10afeb9045d0d9fb74299dbe6db8ee9eb5b280a0972d35
MD5 462c83406c4beecfa50354baa33005cd
SHA1 cdbed232cb29d985f9889721b6c61a589ea91b46
SHA512 fc0bef71912a5a03b19a41c0e7deeefd4b4c9d652659be06b1a8818a1d5cc7e644d43d00272ce8a706b32321da3d224d35e51d457ecabfa11b55c67f8dcce814
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdxP:Lz071uv4BPMki8CnfLv3zQXtTEjP
MD5 SHA1 SHA512 SSDEEP

Submit Download

tTFMYRM.exe

Path C:\Windows\System\tTFMYRM.exe
Size 1.6MB
SHA256 17481f0491fedcdd97638823f711f5cf3c280a16dde91b73a71d1971c4d02720
MD5 8fc01b8e028054113195e24aab574e37
SHA1 7905779abb154c894b465e19f26f3ab9f536f1f3
SHA512 3316563567b01cbe54e80bf6d6c95a7fbeb81fbc0d06e149efbde52e22771970221df673b38bdfa0768ec000471ea224e368d965170c65f581fd1e1d144ea894
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdxe:Lz071uv4BPMki8CnfLv3zQXtTEje
MD5 SHA1 SHA512 SSDEEP

Submit Download

wTvHulF.exe

Path C:\Windows\System\wTvHulF.exe
Size 1.6MB
SHA256 22ca8a8904aeeb26db876d9d2e26c207aeb316be3795ec415f31c08314724ab2
MD5 66732938171b24337a573b5949934b27
SHA1 eecc83c09f670789432359298991275aae87f85c
SHA512 675f57c53cd290bef72991b2079062d30c538a2be2f25ff8a5b59fcc9c334dcb3df9eaea578a8ea0b314c4ac57fa212791933ee92a82aefd10b0508a7e5f3192
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdxK:Lz071uv4BPMki8CnfLv3zQXtTEjK
MD5 SHA1 SHA512 SSDEEP

Submit Download

xCMagcJ.exe

Path C:\Windows\System\xCMagcJ.exe
Size 1.6MB
SHA256 b2ba4c9ccefc9019381b386130f598609e0e31eeed3372f3f0c96c282934d870
MD5 5737cdd04604b095186c6de510b4ebf1
SHA1 acd664fe306e12da9d1bcfd9cf54540f83eeba52
SHA512 88627864212b68c0a06f764191c2221fc51bae75193517a961182c82226bf9eaa303f38d6d57a078f6bace6cfcfbad59e93d1b65db16d452a72fcde9e66187c7
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdxj:Lz071uv4BPMki8CnfLv3zQXtTEjj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/232-78-0x00007FF7D48F0000-0x00007FF7D4CE2000-memory.dmp

Download

memory/232-2015-0x00007FF7D48F0000-0x00007FF7D4CE2000-memory.dmp

Download

memory/732-158-0x00007FF787180000-0x00007FF787572000-memory.dmp

Download

memory/732-2051-0x00007FF787180000-0x00007FF787572000-memory.dmp

Download

memory/896-2013-0x00007FF791B70000-0x00007FF791F62000-memory.dmp

Download

memory/896-6-0x00007FF791B70000-0x00007FF791F62000-memory.dmp

Download

memory/896-1993-0x00007FF791B70000-0x00007FF791F62000-memory.dmp

Download

memory/1344-2038-0x00007FF60C0A0000-0x00007FF60C492000-memory.dmp

Download

memory/1344-100-0x00007FF60C0A0000-0x00007FF60C492000-memory.dmp

Download

memory/1432-82-0x00007FF6E2090000-0x00007FF6E2482000-memory.dmp

Download

memory/1432-2023-0x00007FF6E2090000-0x00007FF6E2482000-memory.dmp

Download

memory/1564-132-0x00007FF73F0F0000-0x00007FF73F4E2000-memory.dmp

Download

memory/1564-2034-0x00007FF73F0F0000-0x00007FF73F4E2000-memory.dmp

Download

memory/1764-2021-0x00007FF72EC40000-0x00007FF72F032000-memory.dmp

Download

memory/1764-79-0x00007FF72EC40000-0x00007FF72F032000-memory.dmp

Download

memory/1900-2053-0x00007FF696740000-0x00007FF696B32000-memory.dmp

Download

memory/1900-164-0x00007FF696740000-0x00007FF696B32000-memory.dmp

Download

memory/2104-125-0x00007FF6B7920000-0x00007FF6B7D12000-memory.dmp

Download

memory/2104-2049-0x00007FF6B7920000-0x00007FF6B7D12000-memory.dmp

Download

memory/2416-2032-0x00007FF68E0B0000-0x00007FF68E4A2000-memory.dmp

Download

memory/2416-145-0x00007FF68E0B0000-0x00007FF68E4A2000-memory.dmp

Download

memory/2744-2019-0x00007FF680E50000-0x00007FF681242000-memory.dmp

Download

memory/2744-113-0x00007FF680E50000-0x00007FF681242000-memory.dmp

Download

memory/2836-99-0x00007FF6B7CA0000-0x00007FF6B8092000-memory.dmp

Download

memory/2836-2039-0x00007FF6B7CA0000-0x00007FF6B8092000-memory.dmp

Download

memory/3164-171-0x00007FF6DC880000-0x00007FF6DCC72000-memory.dmp

Download

memory/3164-2058-0x00007FF6DC880000-0x00007FF6DCC72000-memory.dmp

Download

memory/3312-89-0x00007FF7D61B0000-0x00007FF7D65A2000-memory.dmp

Download

memory/3312-2027-0x00007FF7D61B0000-0x00007FF7D65A2000-memory.dmp

Download

memory/3452-2043-0x00007FF7530E0000-0x00007FF7534D2000-memory.dmp

Download

memory/3452-139-0x00007FF7530E0000-0x00007FF7534D2000-memory.dmp

Download

memory/3560-1-0x0000028A0AC90000-0x0000028A0ACA0000-memory.dmp

Download

memory/3560-0-0x00007FF706C40000-0x00007FF707032000-memory.dmp

Download

memory/3628-112-0x00007FF784FE0000-0x00007FF7853D2000-memory.dmp

Download

memory/3628-2017-0x00007FF784FE0000-0x00007FF7853D2000-memory.dmp

Download

memory/4140-2061-0x00007FF6A85B0000-0x00007FF6A89A2000-memory.dmp

Download

memory/4140-170-0x00007FF6A85B0000-0x00007FF6A89A2000-memory.dmp

Download

memory/4392-2366-0x00007FF7815B0000-0x00007FF7819A2000-memory.dmp

Download

memory/4392-106-0x00007FF7815B0000-0x00007FF7819A2000-memory.dmp

Download

memory/4392-1995-0x00007FF7815B0000-0x00007FF7819A2000-memory.dmp

Download

memory/4532-2026-0x00007FF70BE00000-0x00007FF70C1F2000-memory.dmp

Download

memory/4532-93-0x00007FF70BE00000-0x00007FF70C1F2000-memory.dmp

Download

memory/4544-2047-0x00007FF7287D0000-0x00007FF728BC2000-memory.dmp

Download

memory/4544-138-0x00007FF7287D0000-0x00007FF728BC2000-memory.dmp

Download

memory/4548-157-0x00007FF78DCC0000-0x00007FF78E0B2000-memory.dmp

Download

memory/4548-2045-0x00007FF78DCC0000-0x00007FF78E0B2000-memory.dmp

Download

memory/4796-40-0x00007FF8F8F30000-0x00007FF8F99F1000-memory.dmp

Download

memory/4796-490-0x0000023974FB0000-0x0000023975756000-memory.dmp

Download

memory/4796-69-0x000002395BD60000-0x000002395BD82000-memory.dmp

Download

memory/4796-1970-0x00007FF8F8F30000-0x00007FF8F99F1000-memory.dmp

Download

memory/4796-15-0x00007FF8F8F33000-0x00007FF8F8F35000-memory.dmp

Download

memory/4796-65-0x00007FF8F8F30000-0x00007FF8F99F1000-memory.dmp

Download

memory/4940-151-0x00007FF733910000-0x00007FF733D02000-memory.dmp

Download

memory/4940-2042-0x00007FF733910000-0x00007FF733D02000-memory.dmp

Download

memory/4972-2036-0x00007FF786FB0000-0x00007FF7873A2000-memory.dmp

Download

memory/4972-126-0x00007FF786FB0000-0x00007FF7873A2000-memory.dmp

Download

memory/4980-2029-0x00007FF773EC0000-0x00007FF7742B2000-memory.dmp

Download

memory/4980-119-0x00007FF773EC0000-0x00007FF7742B2000-memory.dmp

Download