Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 05:36
Behavioral task
behavioral1
Sample
e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe
Resource
win7-20240221-en
General
-
Target
e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe
-
Size
1.8MB
-
MD5
e5ebd36619845c90ee54fcc831ca6460
-
SHA1
a8e9e04ca7bd1c599d48ea32a9df3bde0ea2ecd3
-
SHA256
5cfa054c7e5931561741f9d1ef478073849247b244084eb1a6960e267de9ef3c
-
SHA512
a4bcc9138ff1566f5df56f5bd42cff7adae9e4e59795cf3d001bb8a29d9581179193edb5b0b06dd8ef4408e729df17d34fd57a96fbb336be05498e2989d7dc6a
-
SSDEEP
49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+Agr6Stib7Urf:BemTLkNdfE0pZrwM
Malware Config
Signatures
-
KPOT Core Executable 32 IoCs
resource yara_rule behavioral1/files/0x000c00000001445e-5.dat family_kpot behavioral1/files/0x0009000000014a94-11.dat family_kpot behavioral1/files/0x0007000000014b6d-25.dat family_kpot behavioral1/files/0x0007000000014c67-31.dat family_kpot behavioral1/files/0x0006000000016c1a-42.dat family_kpot behavioral1/files/0x0006000000016d36-117.dat family_kpot behavioral1/files/0x000500000001868c-162.dat family_kpot behavioral1/files/0x0006000000018ae2-174.dat family_kpot behavioral1/files/0x00050000000186a0-171.dat family_kpot behavioral1/files/0x00050000000186a0-168.dat family_kpot behavioral1/files/0x0005000000018698-164.dat family_kpot behavioral1/files/0x0006000000017090-159.dat family_kpot behavioral1/files/0x0006000000016d84-156.dat family_kpot behavioral1/files/0x0006000000016d4f-155.dat family_kpot behavioral1/files/0x0006000000016e56-145.dat family_kpot behavioral1/files/0x0006000000016d24-125.dat family_kpot behavioral1/files/0x0006000000016d41-152.dat family_kpot behavioral1/files/0x0006000000016d01-115.dat family_kpot behavioral1/files/0x000600000001704f-148.dat family_kpot behavioral1/files/0x0006000000016cd4-112.dat family_kpot behavioral1/files/0x0006000000016c90-98.dat family_kpot behavioral1/files/0x0006000000016ccf-81.dat family_kpot behavioral1/files/0x0006000000016d55-134.dat family_kpot behavioral1/files/0x0006000000016d36-122.dat family_kpot behavioral1/files/0x0006000000016ca9-71.dat family_kpot behavioral1/files/0x000e000000014738-69.dat family_kpot behavioral1/files/0x0006000000016d11-105.dat family_kpot behavioral1/files/0x0006000000016cf0-89.dat family_kpot behavioral1/files/0x0006000000016c23-51.dat family_kpot behavioral1/files/0x0007000000015c3c-36.dat family_kpot behavioral1/files/0x0007000000014aec-23.dat family_kpot behavioral1/files/0x002e000000014698-10.dat family_kpot -
XMRig Miner payload 64 IoCs
resource yara_rule behavioral1/memory/2244-0-0x000000013FA50000-0x000000013FDA4000-memory.dmp xmrig behavioral1/files/0x000c00000001445e-5.dat xmrig behavioral1/files/0x0009000000014a94-11.dat xmrig behavioral1/files/0x0007000000014b6d-25.dat xmrig behavioral1/memory/2888-29-0x000000013F1D0000-0x000000013F524000-memory.dmp xmrig behavioral1/files/0x0007000000014c67-31.dat xmrig behavioral1/files/0x0006000000016c1a-42.dat xmrig behavioral1/files/0x0006000000016d36-117.dat xmrig behavioral1/files/0x000500000001868c-162.dat xmrig behavioral1/files/0x0006000000018ae2-174.dat xmrig behavioral1/files/0x00050000000186a0-171.dat xmrig behavioral1/files/0x00050000000186a0-168.dat xmrig behavioral1/files/0x0005000000018698-164.dat xmrig behavioral1/files/0x000500000001868c-160.dat xmrig behavioral1/files/0x0006000000017090-159.dat xmrig behavioral1/files/0x0006000000016e56-157.dat xmrig behavioral1/files/0x0006000000016d84-156.dat xmrig behavioral1/files/0x0006000000016d4f-155.dat xmrig behavioral1/files/0x0006000000016e56-145.dat xmrig behavioral1/files/0x0006000000016d24-125.dat xmrig behavioral1/files/0x0006000000016d41-152.dat xmrig behavioral1/memory/2244-1068-0x000000013FA50000-0x000000013FDA4000-memory.dmp xmrig behavioral1/files/0x0006000000016d01-115.dat xmrig behavioral1/files/0x000600000001704f-148.dat xmrig behavioral1/files/0x0006000000016cd4-112.dat xmrig behavioral1/files/0x0006000000016c90-98.dat xmrig behavioral1/memory/2704-82-0x000000013F990000-0x000000013FCE4000-memory.dmp xmrig behavioral1/files/0x0006000000016ccf-81.dat xmrig behavioral1/files/0x0006000000016d89-143.dat xmrig behavioral1/files/0x0006000000016d89-141.dat xmrig behavioral1/files/0x0006000000016d55-137.dat xmrig behavioral1/files/0x0006000000016d55-134.dat xmrig behavioral1/files/0x0006000000016d4a-127.dat xmrig behavioral1/files/0x0006000000016d36-122.dat xmrig behavioral1/memory/2428-121-0x000000013FCF0000-0x0000000140044000-memory.dmp xmrig behavioral1/files/0x0006000000016ca9-71.dat xmrig behavioral1/files/0x000e000000014738-69.dat xmrig behavioral1/memory/2572-62-0x000000013F1F0000-0x000000013F544000-memory.dmp xmrig behavioral1/memory/2580-60-0x000000013F340000-0x000000013F694000-memory.dmp xmrig behavioral1/memory/1932-59-0x000000013F690000-0x000000013F9E4000-memory.dmp xmrig behavioral1/memory/2612-55-0x000000013F5A0000-0x000000013F8F4000-memory.dmp xmrig behavioral1/files/0x0006000000016d11-105.dat xmrig behavioral1/memory/1076-95-0x000000013F5D0000-0x000000013F924000-memory.dmp xmrig behavioral1/memory/2324-90-0x000000013F1C0000-0x000000013F514000-memory.dmp xmrig behavioral1/files/0x0006000000016cf0-89.dat xmrig behavioral1/memory/2852-87-0x000000013FF00000-0x0000000140254000-memory.dmp xmrig behavioral1/memory/2512-45-0x000000013F570000-0x000000013F8C4000-memory.dmp xmrig behavioral1/files/0x0006000000016c23-51.dat xmrig behavioral1/memory/2768-49-0x000000013FCF0000-0x0000000140044000-memory.dmp xmrig behavioral1/files/0x0007000000015c3c-36.dat xmrig behavioral1/memory/2892-19-0x000000013FAD0000-0x000000013FE24000-memory.dmp xmrig behavioral1/files/0x0007000000014aec-23.dat xmrig behavioral1/files/0x002e000000014698-10.dat xmrig behavioral1/memory/2324-1072-0x000000013F1C0000-0x000000013F514000-memory.dmp xmrig behavioral1/memory/1076-1073-0x000000013F5D0000-0x000000013F924000-memory.dmp xmrig behavioral1/memory/2892-1074-0x000000013FAD0000-0x000000013FE24000-memory.dmp xmrig behavioral1/memory/2612-1078-0x000000013F5A0000-0x000000013F8F4000-memory.dmp xmrig behavioral1/memory/2768-1077-0x000000013FCF0000-0x0000000140044000-memory.dmp xmrig behavioral1/memory/2512-1076-0x000000013F570000-0x000000013F8C4000-memory.dmp xmrig behavioral1/memory/2888-1075-0x000000013F1D0000-0x000000013F524000-memory.dmp xmrig behavioral1/memory/2580-1080-0x000000013F340000-0x000000013F694000-memory.dmp xmrig behavioral1/memory/2704-1082-0x000000013F990000-0x000000013FCE4000-memory.dmp xmrig behavioral1/memory/2572-1081-0x000000013F1F0000-0x000000013F544000-memory.dmp xmrig behavioral1/memory/2852-1083-0x000000013FF00000-0x0000000140254000-memory.dmp xmrig -
Executes dropped EXE 64 IoCs
pid Process 2892 pSLVSIv.exe 2888 jAFlXEo.exe 2512 zxPZlax.exe 2768 gLPsAlm.exe 2612 puEJZjP.exe 1932 YRtCkLB.exe 2580 BUCAQDa.exe 2704 ZszFArS.exe 2572 MIiDidW.exe 2852 wlCNJiR.exe 2324 lAnthku.exe 1076 ooSlkZP.exe 2428 cllLyuE.exe 2836 fYdMklz.exe 2668 ydWFchx.exe 1156 dpgYAVs.exe 1676 XFviZfG.exe 1868 iOKXSTr.exe 2708 tNaVbpo.exe 1808 ZxLcjET.exe 1812 YyCaTqg.exe 1936 sLJVLdP.exe 2724 YNzwyFh.exe 1996 TEhYzXN.exe 2216 yDEDTjs.exe 844 SzlYxTn.exe 1528 WtWrrLd.exe 1476 cbKBAGp.exe 2996 oCPmlkG.exe 2096 EGKeQAD.exe 2592 XdDUSfu.exe 2772 ETDvNyp.exe 2992 QnerCmB.exe 2040 gbiFkSn.exe 2504 oKjAzzQ.exe 1272 XMVTKgu.exe 2012 RZTeaHg.exe 440 VKFhFdY.exe 2948 RaSrsKV.exe 1800 fZKNFqW.exe 1776 mjahpkB.exe 1852 cEKgwFI.exe 1584 wWmgXyD.exe 1608 QwRkNBG.exe 1864 wZMEQbt.exe 1620 oDGiwxQ.exe 1580 aaPDpDD.exe 868 QsjEPiL.exe 2904 DFXmDcq.exe 2760 IqTyHcN.exe 1680 rqXnzBl.exe 2024 gYmrwMW.exe 2280 CkjGMNo.exe 2020 MGOVeqX.exe 1976 hSWFEyt.exe 2696 vBEykfh.exe 1696 QyXdpLH.exe 2632 CgQCbDm.exe 2524 FyOuiHR.exe 2908 sFCTQyk.exe 2652 japJbKa.exe 2464 VOtZuZY.exe 3024 FswBNVZ.exe 1252 xOZsQMf.exe -
Loads dropped DLL 64 IoCs
pid Process 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe -
resource yara_rule behavioral1/memory/2244-0-0x000000013FA50000-0x000000013FDA4000-memory.dmp upx behavioral1/files/0x000c00000001445e-5.dat upx behavioral1/files/0x0009000000014a94-11.dat upx behavioral1/files/0x0007000000014b6d-25.dat upx behavioral1/memory/2888-29-0x000000013F1D0000-0x000000013F524000-memory.dmp upx behavioral1/files/0x0007000000014c67-31.dat upx behavioral1/files/0x0006000000016c1a-42.dat upx behavioral1/files/0x0006000000016d36-117.dat upx behavioral1/files/0x000500000001868c-162.dat upx behavioral1/files/0x0006000000018ae2-174.dat upx behavioral1/files/0x00050000000186a0-171.dat upx behavioral1/files/0x00050000000186a0-168.dat upx behavioral1/files/0x0005000000018698-164.dat upx behavioral1/files/0x000500000001868c-160.dat upx behavioral1/files/0x0006000000017090-159.dat upx behavioral1/files/0x0006000000016e56-157.dat upx behavioral1/files/0x0006000000016d84-156.dat upx behavioral1/files/0x0006000000016d4f-155.dat upx behavioral1/files/0x0006000000016e56-145.dat upx behavioral1/files/0x0006000000016d24-125.dat upx behavioral1/files/0x0006000000016d41-152.dat upx behavioral1/memory/2244-1068-0x000000013FA50000-0x000000013FDA4000-memory.dmp upx behavioral1/files/0x0006000000016d01-115.dat upx behavioral1/files/0x000600000001704f-148.dat upx behavioral1/files/0x0006000000016cd4-112.dat upx behavioral1/files/0x0006000000016c90-98.dat upx behavioral1/memory/2704-82-0x000000013F990000-0x000000013FCE4000-memory.dmp upx behavioral1/files/0x0006000000016ccf-81.dat upx behavioral1/files/0x0006000000016d89-143.dat upx behavioral1/files/0x0006000000016d89-141.dat upx behavioral1/files/0x0006000000016d55-137.dat upx behavioral1/files/0x0006000000016d55-134.dat upx behavioral1/files/0x0006000000016d4a-127.dat upx behavioral1/files/0x0006000000016d36-122.dat upx behavioral1/memory/2428-121-0x000000013FCF0000-0x0000000140044000-memory.dmp upx behavioral1/files/0x0006000000016ca9-71.dat upx behavioral1/files/0x000e000000014738-69.dat upx behavioral1/memory/2572-62-0x000000013F1F0000-0x000000013F544000-memory.dmp upx behavioral1/memory/2580-60-0x000000013F340000-0x000000013F694000-memory.dmp upx behavioral1/memory/1932-59-0x000000013F690000-0x000000013F9E4000-memory.dmp upx behavioral1/memory/2612-55-0x000000013F5A0000-0x000000013F8F4000-memory.dmp upx behavioral1/files/0x0006000000016d11-105.dat upx behavioral1/memory/1076-95-0x000000013F5D0000-0x000000013F924000-memory.dmp upx behavioral1/memory/2324-90-0x000000013F1C0000-0x000000013F514000-memory.dmp upx behavioral1/files/0x0006000000016cf0-89.dat upx behavioral1/memory/2852-87-0x000000013FF00000-0x0000000140254000-memory.dmp upx behavioral1/memory/2852-1071-0x000000013FF00000-0x0000000140254000-memory.dmp upx behavioral1/memory/2512-45-0x000000013F570000-0x000000013F8C4000-memory.dmp upx behavioral1/files/0x0006000000016c23-51.dat upx behavioral1/memory/2768-49-0x000000013FCF0000-0x0000000140044000-memory.dmp upx behavioral1/files/0x0007000000015c3c-36.dat upx behavioral1/memory/2892-19-0x000000013FAD0000-0x000000013FE24000-memory.dmp upx behavioral1/files/0x0007000000014aec-23.dat upx behavioral1/files/0x002e000000014698-10.dat upx behavioral1/memory/2324-1072-0x000000013F1C0000-0x000000013F514000-memory.dmp upx behavioral1/memory/1076-1073-0x000000013F5D0000-0x000000013F924000-memory.dmp upx behavioral1/memory/2892-1074-0x000000013FAD0000-0x000000013FE24000-memory.dmp upx behavioral1/memory/2612-1078-0x000000013F5A0000-0x000000013F8F4000-memory.dmp upx behavioral1/memory/2768-1077-0x000000013FCF0000-0x0000000140044000-memory.dmp upx behavioral1/memory/2512-1076-0x000000013F570000-0x000000013F8C4000-memory.dmp upx behavioral1/memory/2888-1075-0x000000013F1D0000-0x000000013F524000-memory.dmp upx behavioral1/memory/2580-1080-0x000000013F340000-0x000000013F694000-memory.dmp upx behavioral1/memory/2704-1082-0x000000013F990000-0x000000013FCE4000-memory.dmp upx behavioral1/memory/2572-1081-0x000000013F1F0000-0x000000013F544000-memory.dmp upx -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\System\lUSAPMp.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\MFBAFCp.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\pSLVSIv.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\ZxLcjET.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\UqqjlgU.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\aNOUNZV.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\JCoqReC.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\RHOIwHZ.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\embKNEi.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\dUmNJqy.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\MIiDidW.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\YpeWIRx.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\ckSBIBW.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\jKntDCH.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\YSqpAYC.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\kXSRpTH.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\oKjAzzQ.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\RZTeaHg.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\yLrkrbf.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\NJvaxtw.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\gGNYQHj.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\TEmVKKB.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\YbKLIUw.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\zxPZlax.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\XFviZfG.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\DFXmDcq.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\QEGYhsq.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\QWWDdtD.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\MiyYYuu.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\gLPsAlm.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\cQaFjPm.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\PkvsBMn.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\AgVXpPR.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\DRFAjfY.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\sqdzgkf.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\YRtCkLB.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\VKFhFdY.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\IqTyHcN.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\FBVHHYf.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\kcPkOvN.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\RtqnSlR.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\BfnIRLw.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\DsIVCuO.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\JsOVgDr.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\lAnthku.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\oDGiwxQ.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\VOtZuZY.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\qbkjkWs.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\unnmHIW.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\budBkSy.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\lgCaVSQ.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\cpBWdNv.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\wlviHVh.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\DXqlXfU.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\KZWPQTL.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\RglgoyD.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\yDEDTjs.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\fZKNFqW.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\wZMEQbt.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\rqXnzBl.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\hSWFEyt.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\ILrisHD.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\DKQWWWM.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe File created C:\Windows\System\cllLyuE.exe e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe Token: SeLockMemoryPrivilege 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2892 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 29 PID 2244 wrote to memory of 2892 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 29 PID 2244 wrote to memory of 2892 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 29 PID 2244 wrote to memory of 2888 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 30 PID 2244 wrote to memory of 2888 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 30 PID 2244 wrote to memory of 2888 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 30 PID 2244 wrote to memory of 2512 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 31 PID 2244 wrote to memory of 2512 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 31 PID 2244 wrote to memory of 2512 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 31 PID 2244 wrote to memory of 2768 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 32 PID 2244 wrote to memory of 2768 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 32 PID 2244 wrote to memory of 2768 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 32 PID 2244 wrote to memory of 2612 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 33 PID 2244 wrote to memory of 2612 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 33 PID 2244 wrote to memory of 2612 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 33 PID 2244 wrote to memory of 1932 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 34 PID 2244 wrote to memory of 1932 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 34 PID 2244 wrote to memory of 1932 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 34 PID 2244 wrote to memory of 2580 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 35 PID 2244 wrote to memory of 2580 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 35 PID 2244 wrote to memory of 2580 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 35 PID 2244 wrote to memory of 2704 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 36 PID 2244 wrote to memory of 2704 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 36 PID 2244 wrote to memory of 2704 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 36 PID 2244 wrote to memory of 2572 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 37 PID 2244 wrote to memory of 2572 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 37 PID 2244 wrote to memory of 2572 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 37 PID 2244 wrote to memory of 2428 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 38 PID 2244 wrote to memory of 2428 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 38 PID 2244 wrote to memory of 2428 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 38 PID 2244 wrote to memory of 2852 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 39 PID 2244 wrote to memory of 2852 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 39 PID 2244 wrote to memory of 2852 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 39 PID 2244 wrote to memory of 2836 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 40 PID 2244 wrote to memory of 2836 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 40 PID 2244 wrote to memory of 2836 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 40 PID 2244 wrote to memory of 2324 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 41 PID 2244 wrote to memory of 2324 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 41 PID 2244 wrote to memory of 2324 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 41 PID 2244 wrote to memory of 1156 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 42 PID 2244 wrote to memory of 1156 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 42 PID 2244 wrote to memory of 1156 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 42 PID 2244 wrote to memory of 1076 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 43 PID 2244 wrote to memory of 1076 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 43 PID 2244 wrote to memory of 1076 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 43 PID 2244 wrote to memory of 1676 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 44 PID 2244 wrote to memory of 1676 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 44 PID 2244 wrote to memory of 1676 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 44 PID 2244 wrote to memory of 2668 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 45 PID 2244 wrote to memory of 2668 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 45 PID 2244 wrote to memory of 2668 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 45 PID 2244 wrote to memory of 2708 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 46 PID 2244 wrote to memory of 2708 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 46 PID 2244 wrote to memory of 2708 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 46 PID 2244 wrote to memory of 1868 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 47 PID 2244 wrote to memory of 1868 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 47 PID 2244 wrote to memory of 1868 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 47 PID 2244 wrote to memory of 1996 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 48 PID 2244 wrote to memory of 1996 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 48 PID 2244 wrote to memory of 1996 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 48 PID 2244 wrote to memory of 1808 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 49 PID 2244 wrote to memory of 1808 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 49 PID 2244 wrote to memory of 1808 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 49 PID 2244 wrote to memory of 2216 2244 e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe 50
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\e5ebd36619845c90ee54fcc831ca6460_NEIKI.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\System\pSLVSIv.exeC:\Windows\System\pSLVSIv.exe2⤵
- Executes dropped EXE
PID:2892
-
-
C:\Windows\System\jAFlXEo.exeC:\Windows\System\jAFlXEo.exe2⤵
- Executes dropped EXE
PID:2888
-
-
C:\Windows\System\zxPZlax.exeC:\Windows\System\zxPZlax.exe2⤵
- Executes dropped EXE
PID:2512
-
-
C:\Windows\System\gLPsAlm.exeC:\Windows\System\gLPsAlm.exe2⤵
- Executes dropped EXE
PID:2768
-
-
C:\Windows\System\puEJZjP.exeC:\Windows\System\puEJZjP.exe2⤵
- Executes dropped EXE
PID:2612
-
-
C:\Windows\System\YRtCkLB.exeC:\Windows\System\YRtCkLB.exe2⤵
- Executes dropped EXE
PID:1932
-
-
C:\Windows\System\BUCAQDa.exeC:\Windows\System\BUCAQDa.exe2⤵
- Executes dropped EXE
PID:2580
-
-
C:\Windows\System\ZszFArS.exeC:\Windows\System\ZszFArS.exe2⤵
- Executes dropped EXE
PID:2704
-
-
C:\Windows\System\MIiDidW.exeC:\Windows\System\MIiDidW.exe2⤵
- Executes dropped EXE
PID:2572
-
-
C:\Windows\System\cllLyuE.exeC:\Windows\System\cllLyuE.exe2⤵
- Executes dropped EXE
PID:2428
-
-
C:\Windows\System\wlCNJiR.exeC:\Windows\System\wlCNJiR.exe2⤵
- Executes dropped EXE
PID:2852
-
-
C:\Windows\System\fYdMklz.exeC:\Windows\System\fYdMklz.exe2⤵
- Executes dropped EXE
PID:2836
-
-
C:\Windows\System\lAnthku.exeC:\Windows\System\lAnthku.exe2⤵
- Executes dropped EXE
PID:2324
-
-
C:\Windows\System\dpgYAVs.exeC:\Windows\System\dpgYAVs.exe2⤵
- Executes dropped EXE
PID:1156
-
-
C:\Windows\System\ooSlkZP.exeC:\Windows\System\ooSlkZP.exe2⤵
- Executes dropped EXE
PID:1076
-
-
C:\Windows\System\XFviZfG.exeC:\Windows\System\XFviZfG.exe2⤵
- Executes dropped EXE
PID:1676
-
-
C:\Windows\System\ydWFchx.exeC:\Windows\System\ydWFchx.exe2⤵
- Executes dropped EXE
PID:2668
-
-
C:\Windows\System\tNaVbpo.exeC:\Windows\System\tNaVbpo.exe2⤵
- Executes dropped EXE
PID:2708
-
-
C:\Windows\System\iOKXSTr.exeC:\Windows\System\iOKXSTr.exe2⤵
- Executes dropped EXE
PID:1868
-
-
C:\Windows\System\TEhYzXN.exeC:\Windows\System\TEhYzXN.exe2⤵
- Executes dropped EXE
PID:1996
-
-
C:\Windows\System\ZxLcjET.exeC:\Windows\System\ZxLcjET.exe2⤵
- Executes dropped EXE
PID:1808
-
-
C:\Windows\System\yDEDTjs.exeC:\Windows\System\yDEDTjs.exe2⤵
- Executes dropped EXE
PID:2216
-
-
C:\Windows\System\YyCaTqg.exeC:\Windows\System\YyCaTqg.exe2⤵
- Executes dropped EXE
PID:1812
-
-
C:\Windows\System\SzlYxTn.exeC:\Windows\System\SzlYxTn.exe2⤵
- Executes dropped EXE
PID:844
-
-
C:\Windows\System\sLJVLdP.exeC:\Windows\System\sLJVLdP.exe2⤵
- Executes dropped EXE
PID:1936
-
-
C:\Windows\System\WtWrrLd.exeC:\Windows\System\WtWrrLd.exe2⤵
- Executes dropped EXE
PID:1528
-
-
C:\Windows\System\YNzwyFh.exeC:\Windows\System\YNzwyFh.exe2⤵
- Executes dropped EXE
PID:2724
-
-
C:\Windows\System\cbKBAGp.exeC:\Windows\System\cbKBAGp.exe2⤵
- Executes dropped EXE
PID:1476
-
-
C:\Windows\System\oCPmlkG.exeC:\Windows\System\oCPmlkG.exe2⤵
- Executes dropped EXE
PID:2996
-
-
C:\Windows\System\EGKeQAD.exeC:\Windows\System\EGKeQAD.exe2⤵
- Executes dropped EXE
PID:2096
-
-
C:\Windows\System\XdDUSfu.exeC:\Windows\System\XdDUSfu.exe2⤵
- Executes dropped EXE
PID:2592
-
-
C:\Windows\System\ETDvNyp.exeC:\Windows\System\ETDvNyp.exe2⤵
- Executes dropped EXE
PID:2772
-
-
C:\Windows\System\QnerCmB.exeC:\Windows\System\QnerCmB.exe2⤵
- Executes dropped EXE
PID:2992
-
-
C:\Windows\System\gbiFkSn.exeC:\Windows\System\gbiFkSn.exe2⤵
- Executes dropped EXE
PID:2040
-
-
C:\Windows\System\oKjAzzQ.exeC:\Windows\System\oKjAzzQ.exe2⤵
- Executes dropped EXE
PID:2504
-
-
C:\Windows\System\XMVTKgu.exeC:\Windows\System\XMVTKgu.exe2⤵
- Executes dropped EXE
PID:1272
-
-
C:\Windows\System\RZTeaHg.exeC:\Windows\System\RZTeaHg.exe2⤵
- Executes dropped EXE
PID:2012
-
-
C:\Windows\System\VKFhFdY.exeC:\Windows\System\VKFhFdY.exe2⤵
- Executes dropped EXE
PID:440
-
-
C:\Windows\System\RaSrsKV.exeC:\Windows\System\RaSrsKV.exe2⤵
- Executes dropped EXE
PID:2948
-
-
C:\Windows\System\fZKNFqW.exeC:\Windows\System\fZKNFqW.exe2⤵
- Executes dropped EXE
PID:1800
-
-
C:\Windows\System\mjahpkB.exeC:\Windows\System\mjahpkB.exe2⤵
- Executes dropped EXE
PID:1776
-
-
C:\Windows\System\wZMEQbt.exeC:\Windows\System\wZMEQbt.exe2⤵
- Executes dropped EXE
PID:1864
-
-
C:\Windows\System\cEKgwFI.exeC:\Windows\System\cEKgwFI.exe2⤵
- Executes dropped EXE
PID:1852
-
-
C:\Windows\System\oDGiwxQ.exeC:\Windows\System\oDGiwxQ.exe2⤵
- Executes dropped EXE
PID:1620
-
-
C:\Windows\System\wWmgXyD.exeC:\Windows\System\wWmgXyD.exe2⤵
- Executes dropped EXE
PID:1584
-
-
C:\Windows\System\aaPDpDD.exeC:\Windows\System\aaPDpDD.exe2⤵
- Executes dropped EXE
PID:1580
-
-
C:\Windows\System\QwRkNBG.exeC:\Windows\System\QwRkNBG.exe2⤵
- Executes dropped EXE
PID:1608
-
-
C:\Windows\System\QsjEPiL.exeC:\Windows\System\QsjEPiL.exe2⤵
- Executes dropped EXE
PID:868
-
-
C:\Windows\System\DFXmDcq.exeC:\Windows\System\DFXmDcq.exe2⤵
- Executes dropped EXE
PID:2904
-
-
C:\Windows\System\IqTyHcN.exeC:\Windows\System\IqTyHcN.exe2⤵
- Executes dropped EXE
PID:2760
-
-
C:\Windows\System\rqXnzBl.exeC:\Windows\System\rqXnzBl.exe2⤵
- Executes dropped EXE
PID:1680
-
-
C:\Windows\System\gYmrwMW.exeC:\Windows\System\gYmrwMW.exe2⤵
- Executes dropped EXE
PID:2024
-
-
C:\Windows\System\CkjGMNo.exeC:\Windows\System\CkjGMNo.exe2⤵
- Executes dropped EXE
PID:2280
-
-
C:\Windows\System\MGOVeqX.exeC:\Windows\System\MGOVeqX.exe2⤵
- Executes dropped EXE
PID:2020
-
-
C:\Windows\System\hSWFEyt.exeC:\Windows\System\hSWFEyt.exe2⤵
- Executes dropped EXE
PID:1976
-
-
C:\Windows\System\vBEykfh.exeC:\Windows\System\vBEykfh.exe2⤵
- Executes dropped EXE
PID:2696
-
-
C:\Windows\System\QyXdpLH.exeC:\Windows\System\QyXdpLH.exe2⤵
- Executes dropped EXE
PID:1696
-
-
C:\Windows\System\sFCTQyk.exeC:\Windows\System\sFCTQyk.exe2⤵
- Executes dropped EXE
PID:2908
-
-
C:\Windows\System\CgQCbDm.exeC:\Windows\System\CgQCbDm.exe2⤵
- Executes dropped EXE
PID:2632
-
-
C:\Windows\System\japJbKa.exeC:\Windows\System\japJbKa.exe2⤵
- Executes dropped EXE
PID:2652
-
-
C:\Windows\System\FyOuiHR.exeC:\Windows\System\FyOuiHR.exe2⤵
- Executes dropped EXE
PID:2524
-
-
C:\Windows\System\VOtZuZY.exeC:\Windows\System\VOtZuZY.exe2⤵
- Executes dropped EXE
PID:2464
-
-
C:\Windows\System\FswBNVZ.exeC:\Windows\System\FswBNVZ.exe2⤵
- Executes dropped EXE
PID:3024
-
-
C:\Windows\System\uXRRCdd.exeC:\Windows\System\uXRRCdd.exe2⤵PID:2848
-
-
C:\Windows\System\xOZsQMf.exeC:\Windows\System\xOZsQMf.exe2⤵
- Executes dropped EXE
PID:1252
-
-
C:\Windows\System\iSITjHA.exeC:\Windows\System\iSITjHA.exe2⤵PID:748
-
-
C:\Windows\System\nIExqmE.exeC:\Windows\System\nIExqmE.exe2⤵PID:2716
-
-
C:\Windows\System\WuUeROr.exeC:\Windows\System\WuUeROr.exe2⤵PID:492
-
-
C:\Windows\System\aqNBUZW.exeC:\Windows\System\aqNBUZW.exe2⤵PID:1940
-
-
C:\Windows\System\KUyjQQo.exeC:\Windows\System\KUyjQQo.exe2⤵PID:1432
-
-
C:\Windows\System\lgCaVSQ.exeC:\Windows\System\lgCaVSQ.exe2⤵PID:2316
-
-
C:\Windows\System\NjTmpNi.exeC:\Windows\System\NjTmpNi.exe2⤵PID:2812
-
-
C:\Windows\System\yLrkrbf.exeC:\Windows\System\yLrkrbf.exe2⤵PID:1820
-
-
C:\Windows\System\hyykEPH.exeC:\Windows\System\hyykEPH.exe2⤵PID:2588
-
-
C:\Windows\System\UtuADya.exeC:\Windows\System\UtuADya.exe2⤵PID:896
-
-
C:\Windows\System\UqqjlgU.exeC:\Windows\System\UqqjlgU.exe2⤵PID:2964
-
-
C:\Windows\System\tBfmDmx.exeC:\Windows\System\tBfmDmx.exe2⤵PID:2340
-
-
C:\Windows\System\olDOsfE.exeC:\Windows\System\olDOsfE.exe2⤵PID:1792
-
-
C:\Windows\System\wIbnxIA.exeC:\Windows\System\wIbnxIA.exe2⤵PID:2016
-
-
C:\Windows\System\cHpofgl.exeC:\Windows\System\cHpofgl.exe2⤵PID:2144
-
-
C:\Windows\System\oflgJGu.exeC:\Windows\System\oflgJGu.exe2⤵PID:2264
-
-
C:\Windows\System\zMnKqrW.exeC:\Windows\System\zMnKqrW.exe2⤵PID:768
-
-
C:\Windows\System\PkvsBMn.exeC:\Windows\System\PkvsBMn.exe2⤵PID:2272
-
-
C:\Windows\System\JotYpfC.exeC:\Windows\System\JotYpfC.exe2⤵PID:624
-
-
C:\Windows\System\cpBWdNv.exeC:\Windows\System\cpBWdNv.exe2⤵PID:2748
-
-
C:\Windows\System\CACZpoN.exeC:\Windows\System\CACZpoN.exe2⤵PID:1760
-
-
C:\Windows\System\kgcVzfA.exeC:\Windows\System\kgcVzfA.exe2⤵PID:920
-
-
C:\Windows\System\lPjRUls.exeC:\Windows\System\lPjRUls.exe2⤵PID:2124
-
-
C:\Windows\System\FBVHHYf.exeC:\Windows\System\FBVHHYf.exe2⤵PID:2860
-
-
C:\Windows\System\ibNIVgE.exeC:\Windows\System\ibNIVgE.exe2⤵PID:2660
-
-
C:\Windows\System\jjWPjKh.exeC:\Windows\System\jjWPjKh.exe2⤵PID:2192
-
-
C:\Windows\System\ssaRAKA.exeC:\Windows\System\ssaRAKA.exe2⤵PID:2672
-
-
C:\Windows\System\aAEzuWb.exeC:\Windows\System\aAEzuWb.exe2⤵PID:2636
-
-
C:\Windows\System\aKYtkIZ.exeC:\Windows\System\aKYtkIZ.exe2⤵PID:2548
-
-
C:\Windows\System\AgVXpPR.exeC:\Windows\System\AgVXpPR.exe2⤵PID:580
-
-
C:\Windows\System\HKOkhhh.exeC:\Windows\System\HKOkhhh.exe2⤵PID:1656
-
-
C:\Windows\System\WycsYqp.exeC:\Windows\System\WycsYqp.exe2⤵PID:1728
-
-
C:\Windows\System\utjjAeN.exeC:\Windows\System\utjjAeN.exe2⤵PID:1964
-
-
C:\Windows\System\rxqoUDS.exeC:\Windows\System\rxqoUDS.exe2⤵PID:1768
-
-
C:\Windows\System\aNOUNZV.exeC:\Windows\System\aNOUNZV.exe2⤵PID:2412
-
-
C:\Windows\System\kWbgfwT.exeC:\Windows\System\kWbgfwT.exe2⤵PID:1652
-
-
C:\Windows\System\UjjdbOx.exeC:\Windows\System\UjjdbOx.exe2⤵PID:2600
-
-
C:\Windows\System\JCoqReC.exeC:\Windows\System\JCoqReC.exe2⤵PID:1920
-
-
C:\Windows\System\SrnXJsI.exeC:\Windows\System\SrnXJsI.exe2⤵PID:1952
-
-
C:\Windows\System\zOaHrvR.exeC:\Windows\System\zOaHrvR.exe2⤵PID:3004
-
-
C:\Windows\System\qbkjkWs.exeC:\Windows\System\qbkjkWs.exe2⤵PID:2152
-
-
C:\Windows\System\NuGFTFd.exeC:\Windows\System\NuGFTFd.exe2⤵PID:2780
-
-
C:\Windows\System\oVGuZdE.exeC:\Windows\System\oVGuZdE.exe2⤵PID:376
-
-
C:\Windows\System\vrvyBlY.exeC:\Windows\System\vrvyBlY.exe2⤵PID:324
-
-
C:\Windows\System\kXcWqPq.exeC:\Windows\System\kXcWqPq.exe2⤵PID:1784
-
-
C:\Windows\System\yjnZgcM.exeC:\Windows\System\yjnZgcM.exe2⤵PID:2256
-
-
C:\Windows\System\DcswTqC.exeC:\Windows\System\DcswTqC.exe2⤵PID:2184
-
-
C:\Windows\System\viGETto.exeC:\Windows\System\viGETto.exe2⤵PID:1944
-
-
C:\Windows\System\ZIiGWvZ.exeC:\Windows\System\ZIiGWvZ.exe2⤵PID:3068
-
-
C:\Windows\System\CXRpGfT.exeC:\Windows\System\CXRpGfT.exe2⤵PID:2684
-
-
C:\Windows\System\MuKakPB.exeC:\Windows\System\MuKakPB.exe2⤵PID:2420
-
-
C:\Windows\System\RSRejBg.exeC:\Windows\System\RSRejBg.exe2⤵PID:2008
-
-
C:\Windows\System\exkZHkF.exeC:\Windows\System\exkZHkF.exe2⤵PID:2616
-
-
C:\Windows\System\YpeWIRx.exeC:\Windows\System\YpeWIRx.exe2⤵PID:2404
-
-
C:\Windows\System\wlviHVh.exeC:\Windows\System\wlviHVh.exe2⤵PID:2712
-
-
C:\Windows\System\ZQxkOQW.exeC:\Windows\System\ZQxkOQW.exe2⤵PID:1492
-
-
C:\Windows\System\VJticmz.exeC:\Windows\System\VJticmz.exe2⤵PID:1548
-
-
C:\Windows\System\WcSrWXy.exeC:\Windows\System\WcSrWXy.exe2⤵PID:984
-
-
C:\Windows\System\CgnCzUY.exeC:\Windows\System\CgnCzUY.exe2⤵PID:2604
-
-
C:\Windows\System\ukVbnZl.exeC:\Windows\System\ukVbnZl.exe2⤵PID:2360
-
-
C:\Windows\System\ODJtjue.exeC:\Windows\System\ODJtjue.exe2⤵PID:1312
-
-
C:\Windows\System\RtqnSlR.exeC:\Windows\System\RtqnSlR.exe2⤵PID:3088
-
-
C:\Windows\System\RHOIwHZ.exeC:\Windows\System\RHOIwHZ.exe2⤵PID:3104
-
-
C:\Windows\System\BfnIRLw.exeC:\Windows\System\BfnIRLw.exe2⤵PID:3120
-
-
C:\Windows\System\DXqlXfU.exeC:\Windows\System\DXqlXfU.exe2⤵PID:3136
-
-
C:\Windows\System\huIpzDM.exeC:\Windows\System\huIpzDM.exe2⤵PID:3172
-
-
C:\Windows\System\DqNGLzv.exeC:\Windows\System\DqNGLzv.exe2⤵PID:3248
-
-
C:\Windows\System\pexJPpx.exeC:\Windows\System\pexJPpx.exe2⤵PID:3268
-
-
C:\Windows\System\zwMCxUi.exeC:\Windows\System\zwMCxUi.exe2⤵PID:3284
-
-
C:\Windows\System\BcuqvZs.exeC:\Windows\System\BcuqvZs.exe2⤵PID:3304
-
-
C:\Windows\System\PxyMZIu.exeC:\Windows\System\PxyMZIu.exe2⤵PID:3324
-
-
C:\Windows\System\LwhaNQi.exeC:\Windows\System\LwhaNQi.exe2⤵PID:3348
-
-
C:\Windows\System\ElttCJz.exeC:\Windows\System\ElttCJz.exe2⤵PID:3364
-
-
C:\Windows\System\OlVfIoX.exeC:\Windows\System\OlVfIoX.exe2⤵PID:3384
-
-
C:\Windows\System\kAoAaiL.exeC:\Windows\System\kAoAaiL.exe2⤵PID:3400
-
-
C:\Windows\System\qBNIlyx.exeC:\Windows\System\qBNIlyx.exe2⤵PID:3424
-
-
C:\Windows\System\unnmHIW.exeC:\Windows\System\unnmHIW.exe2⤵PID:3440
-
-
C:\Windows\System\niwLfGv.exeC:\Windows\System\niwLfGv.exe2⤵PID:3456
-
-
C:\Windows\System\XxRjhqp.exeC:\Windows\System\XxRjhqp.exe2⤵PID:3472
-
-
C:\Windows\System\ZnFpcFJ.exeC:\Windows\System\ZnFpcFJ.exe2⤵PID:3492
-
-
C:\Windows\System\OKXPBXQ.exeC:\Windows\System\OKXPBXQ.exe2⤵PID:3512
-
-
C:\Windows\System\NlzdHCr.exeC:\Windows\System\NlzdHCr.exe2⤵PID:3548
-
-
C:\Windows\System\SUpWrGm.exeC:\Windows\System\SUpWrGm.exe2⤵PID:3568
-
-
C:\Windows\System\FwqEdjL.exeC:\Windows\System\FwqEdjL.exe2⤵PID:3592
-
-
C:\Windows\System\ZKFsVlE.exeC:\Windows\System\ZKFsVlE.exe2⤵PID:3620
-
-
C:\Windows\System\KZWPQTL.exeC:\Windows\System\KZWPQTL.exe2⤵PID:3636
-
-
C:\Windows\System\tCcmPTL.exeC:\Windows\System\tCcmPTL.exe2⤵PID:3652
-
-
C:\Windows\System\hQVHhHE.exeC:\Windows\System\hQVHhHE.exe2⤵PID:3668
-
-
C:\Windows\System\ZYsxLSr.exeC:\Windows\System\ZYsxLSr.exe2⤵PID:3684
-
-
C:\Windows\System\slsLscJ.exeC:\Windows\System\slsLscJ.exe2⤵PID:3704
-
-
C:\Windows\System\rmKEBmi.exeC:\Windows\System\rmKEBmi.exe2⤵PID:3720
-
-
C:\Windows\System\mxUbDJN.exeC:\Windows\System\mxUbDJN.exe2⤵PID:3736
-
-
C:\Windows\System\qvaTePm.exeC:\Windows\System\qvaTePm.exe2⤵PID:3760
-
-
C:\Windows\System\GMoDhmu.exeC:\Windows\System\GMoDhmu.exe2⤵PID:3792
-
-
C:\Windows\System\cnzsAKh.exeC:\Windows\System\cnzsAKh.exe2⤵PID:3808
-
-
C:\Windows\System\giHkLEU.exeC:\Windows\System\giHkLEU.exe2⤵PID:3824
-
-
C:\Windows\System\VyKNjzr.exeC:\Windows\System\VyKNjzr.exe2⤵PID:3844
-
-
C:\Windows\System\QHfdpEg.exeC:\Windows\System\QHfdpEg.exe2⤵PID:3860
-
-
C:\Windows\System\FUszyhi.exeC:\Windows\System\FUszyhi.exe2⤵PID:3880
-
-
C:\Windows\System\ILrisHD.exeC:\Windows\System\ILrisHD.exe2⤵PID:3900
-
-
C:\Windows\System\ziRGXZs.exeC:\Windows\System\ziRGXZs.exe2⤵PID:3924
-
-
C:\Windows\System\FPeLguB.exeC:\Windows\System\FPeLguB.exe2⤵PID:3952
-
-
C:\Windows\System\XhAtFMX.exeC:\Windows\System\XhAtFMX.exe2⤵PID:3968
-
-
C:\Windows\System\tDyCSaA.exeC:\Windows\System\tDyCSaA.exe2⤵PID:3988
-
-
C:\Windows\System\BwjPEOg.exeC:\Windows\System\BwjPEOg.exe2⤵PID:4004
-
-
C:\Windows\System\fDMClRG.exeC:\Windows\System\fDMClRG.exe2⤵PID:4024
-
-
C:\Windows\System\ckSBIBW.exeC:\Windows\System\ckSBIBW.exe2⤵PID:4060
-
-
C:\Windows\System\fCXsWpe.exeC:\Windows\System\fCXsWpe.exe2⤵PID:4076
-
-
C:\Windows\System\NJvaxtw.exeC:\Windows\System\NJvaxtw.exe2⤵PID:4092
-
-
C:\Windows\System\oEcoNCB.exeC:\Windows\System\oEcoNCB.exe2⤵PID:2060
-
-
C:\Windows\System\rLQVaCq.exeC:\Windows\System\rLQVaCq.exe2⤵PID:1264
-
-
C:\Windows\System\jceAVEZ.exeC:\Windows\System\jceAVEZ.exe2⤵PID:2984
-
-
C:\Windows\System\XiiXQgd.exeC:\Windows\System\XiiXQgd.exe2⤵PID:884
-
-
C:\Windows\System\kcGuYVK.exeC:\Windows\System\kcGuYVK.exe2⤵PID:2868
-
-
C:\Windows\System\OVuPuam.exeC:\Windows\System\OVuPuam.exe2⤵PID:1992
-
-
C:\Windows\System\ezhxuNB.exeC:\Windows\System\ezhxuNB.exe2⤵PID:1684
-
-
C:\Windows\System\nCfQeQu.exeC:\Windows\System\nCfQeQu.exe2⤵PID:1672
-
-
C:\Windows\System\jKntDCH.exeC:\Windows\System\jKntDCH.exe2⤵PID:3100
-
-
C:\Windows\System\XnKTOwW.exeC:\Windows\System\XnKTOwW.exe2⤵PID:2268
-
-
C:\Windows\System\VhQVhdH.exeC:\Windows\System\VhQVhdH.exe2⤵PID:1372
-
-
C:\Windows\System\oDiSrTq.exeC:\Windows\System\oDiSrTq.exe2⤵PID:2396
-
-
C:\Windows\System\gPfdJnf.exeC:\Windows\System\gPfdJnf.exe2⤵PID:2352
-
-
C:\Windows\System\KOuWhNy.exeC:\Windows\System\KOuWhNy.exe2⤵PID:3084
-
-
C:\Windows\System\lUSAPMp.exeC:\Windows\System\lUSAPMp.exe2⤵PID:1664
-
-
C:\Windows\System\PEmDRCO.exeC:\Windows\System\PEmDRCO.exe2⤵PID:3184
-
-
C:\Windows\System\QIJPGzA.exeC:\Windows\System\QIJPGzA.exe2⤵PID:3200
-
-
C:\Windows\System\zafaWqq.exeC:\Windows\System\zafaWqq.exe2⤵PID:3216
-
-
C:\Windows\System\kKOLvNx.exeC:\Windows\System\kKOLvNx.exe2⤵PID:3236
-
-
C:\Windows\System\xwfLqRM.exeC:\Windows\System\xwfLqRM.exe2⤵PID:2004
-
-
C:\Windows\System\ZLrqIRh.exeC:\Windows\System\ZLrqIRh.exe2⤵PID:3316
-
-
C:\Windows\System\AHnbfiK.exeC:\Windows\System\AHnbfiK.exe2⤵PID:2784
-
-
C:\Windows\System\yEMZxCZ.exeC:\Windows\System\yEMZxCZ.exe2⤵PID:3432
-
-
C:\Windows\System\ENCXMvb.exeC:\Windows\System\ENCXMvb.exe2⤵PID:3292
-
-
C:\Windows\System\cOCYiSe.exeC:\Windows\System\cOCYiSe.exe2⤵PID:3260
-
-
C:\Windows\System\OuIGBIP.exeC:\Windows\System\OuIGBIP.exe2⤵PID:3336
-
-
C:\Windows\System\MJoLtEY.exeC:\Windows\System\MJoLtEY.exe2⤵PID:3412
-
-
C:\Windows\System\YDrLAEr.exeC:\Windows\System\YDrLAEr.exe2⤵PID:3484
-
-
C:\Windows\System\FUvKQHt.exeC:\Windows\System\FUvKQHt.exe2⤵PID:3520
-
-
C:\Windows\System\kcPkOvN.exeC:\Windows\System\kcPkOvN.exe2⤵PID:3528
-
-
C:\Windows\System\BkSeial.exeC:\Windows\System\BkSeial.exe2⤵PID:3544
-
-
C:\Windows\System\zmrUKEn.exeC:\Windows\System\zmrUKEn.exe2⤵PID:3580
-
-
C:\Windows\System\PdSyrDO.exeC:\Windows\System\PdSyrDO.exe2⤵PID:3588
-
-
C:\Windows\System\gyMGOFd.exeC:\Windows\System\gyMGOFd.exe2⤵PID:3616
-
-
C:\Windows\System\nEKNRkv.exeC:\Windows\System\nEKNRkv.exe2⤵PID:3680
-
-
C:\Windows\System\HPhAbUq.exeC:\Windows\System\HPhAbUq.exe2⤵PID:3716
-
-
C:\Windows\System\StxfcpD.exeC:\Windows\System\StxfcpD.exe2⤵PID:3700
-
-
C:\Windows\System\SBmmYkM.exeC:\Windows\System\SBmmYkM.exe2⤵PID:3744
-
-
C:\Windows\System\LWmKiSs.exeC:\Windows\System\LWmKiSs.exe2⤵PID:1916
-
-
C:\Windows\System\rlolSpK.exeC:\Windows\System\rlolSpK.exe2⤵PID:3780
-
-
C:\Windows\System\FipTbKc.exeC:\Windows\System\FipTbKc.exe2⤵PID:3804
-
-
C:\Windows\System\bognyrS.exeC:\Windows\System\bognyrS.exe2⤵PID:3868
-
-
C:\Windows\System\lpylJRV.exeC:\Windows\System\lpylJRV.exe2⤵PID:3788
-
-
C:\Windows\System\khcHcJm.exeC:\Windows\System\khcHcJm.exe2⤵PID:3852
-
-
C:\Windows\System\zusepXa.exeC:\Windows\System\zusepXa.exe2⤵PID:2532
-
-
C:\Windows\System\OdvpcxH.exeC:\Windows\System\OdvpcxH.exe2⤵PID:1240
-
-
C:\Windows\System\cNPkTRE.exeC:\Windows\System\cNPkTRE.exe2⤵PID:1828
-
-
C:\Windows\System\LupWhBy.exeC:\Windows\System\LupWhBy.exe2⤵PID:3196
-
-
C:\Windows\System\TZDSwoS.exeC:\Windows\System\TZDSwoS.exe2⤵PID:3232
-
-
C:\Windows\System\CAeJEDr.exeC:\Windows\System\CAeJEDr.exe2⤵PID:3312
-
-
C:\Windows\System\JLCeUaK.exeC:\Windows\System\JLCeUaK.exe2⤵PID:3192
-
-
C:\Windows\System\bNkTeJa.exeC:\Windows\System\bNkTeJa.exe2⤵PID:3500
-
-
C:\Windows\System\rAXZmrL.exeC:\Windows\System\rAXZmrL.exe2⤵PID:3396
-
-
C:\Windows\System\QEGYhsq.exeC:\Windows\System\QEGYhsq.exe2⤵PID:3372
-
-
C:\Windows\System\RglgoyD.exeC:\Windows\System\RglgoyD.exe2⤵PID:3536
-
-
C:\Windows\System\embKNEi.exeC:\Windows\System\embKNEi.exe2⤵PID:3964
-
-
C:\Windows\System\QWWDdtD.exeC:\Windows\System\QWWDdtD.exe2⤵PID:4036
-
-
C:\Windows\System\hlLDxda.exeC:\Windows\System\hlLDxda.exe2⤵PID:1592
-
-
C:\Windows\System\Otrcfgl.exeC:\Windows\System\Otrcfgl.exe2⤵PID:3344
-
-
C:\Windows\System\WUxSHYt.exeC:\Windows\System\WUxSHYt.exe2⤵PID:2052
-
-
C:\Windows\System\PkdnMGo.exeC:\Windows\System\PkdnMGo.exe2⤵PID:3132
-
-
C:\Windows\System\MgvNIMg.exeC:\Windows\System\MgvNIMg.exe2⤵PID:2792
-
-
C:\Windows\System\BNltPex.exeC:\Windows\System\BNltPex.exe2⤵PID:3180
-
-
C:\Windows\System\LpFxeHQ.exeC:\Windows\System\LpFxeHQ.exe2⤵PID:3356
-
-
C:\Windows\System\ltnxUHB.exeC:\Windows\System\ltnxUHB.exe2⤵PID:3332
-
-
C:\Windows\System\MKOCagj.exeC:\Windows\System\MKOCagj.exe2⤵PID:3480
-
-
C:\Windows\System\WLDjMuE.exeC:\Windows\System\WLDjMuE.exe2⤵PID:2688
-
-
C:\Windows\System\SHmhKJS.exeC:\Windows\System\SHmhKJS.exe2⤵PID:3608
-
-
C:\Windows\System\DHGQZVB.exeC:\Windows\System\DHGQZVB.exe2⤵PID:3676
-
-
C:\Windows\System\BRYPZIm.exeC:\Windows\System\BRYPZIm.exe2⤵PID:3604
-
-
C:\Windows\System\BLQCsnG.exeC:\Windows\System\BLQCsnG.exe2⤵PID:328
-
-
C:\Windows\System\zYnUObN.exeC:\Windows\System\zYnUObN.exe2⤵PID:3856
-
-
C:\Windows\System\dEAFvjz.exeC:\Windows\System\dEAFvjz.exe2⤵PID:3776
-
-
C:\Windows\System\wViIkcv.exeC:\Windows\System\wViIkcv.exe2⤵PID:3892
-
-
C:\Windows\System\ZqTIVUn.exeC:\Windows\System\ZqTIVUn.exe2⤵PID:3800
-
-
C:\Windows\System\NBypmRm.exeC:\Windows\System\NBypmRm.exe2⤵PID:3944
-
-
C:\Windows\System\EJbyHlM.exeC:\Windows\System\EJbyHlM.exe2⤵PID:3940
-
-
C:\Windows\System\MFBAFCp.exeC:\Windows\System\MFBAFCp.exe2⤵PID:3984
-
-
C:\Windows\System\lLOQvBu.exeC:\Windows\System\lLOQvBu.exe2⤵PID:1972
-
-
C:\Windows\System\rTDEVux.exeC:\Windows\System\rTDEVux.exe2⤵PID:3912
-
-
C:\Windows\System\jXhdnJt.exeC:\Windows\System\jXhdnJt.exe2⤵PID:1704
-
-
C:\Windows\System\CQuFXqg.exeC:\Windows\System\CQuFXqg.exe2⤵PID:4056
-
-
C:\Windows\System\nNKATKM.exeC:\Windows\System\nNKATKM.exe2⤵PID:2540
-
-
C:\Windows\System\RTWRFkB.exeC:\Windows\System\RTWRFkB.exe2⤵PID:4016
-
-
C:\Windows\System\WoMThMa.exeC:\Windows\System\WoMThMa.exe2⤵PID:3756
-
-
C:\Windows\System\clBjZdo.exeC:\Windows\System\clBjZdo.exe2⤵PID:4068
-
-
C:\Windows\System\YSqpAYC.exeC:\Windows\System\YSqpAYC.exe2⤵PID:3228
-
-
C:\Windows\System\kzVmQFW.exeC:\Windows\System\kzVmQFW.exe2⤵PID:3540
-
-
C:\Windows\System\HhYMMus.exeC:\Windows\System\HhYMMus.exe2⤵PID:3468
-
-
C:\Windows\System\DPBEwNY.exeC:\Windows\System\DPBEwNY.exe2⤵PID:3436
-
-
C:\Windows\System\RXneLcA.exeC:\Windows\System\RXneLcA.exe2⤵PID:664
-
-
C:\Windows\System\yBYoBMI.exeC:\Windows\System\yBYoBMI.exe2⤵PID:3508
-
-
C:\Windows\System\CyvOILA.exeC:\Windows\System\CyvOILA.exe2⤵PID:2536
-
-
C:\Windows\System\cQaFjPm.exeC:\Windows\System\cQaFjPm.exe2⤵PID:3096
-
-
C:\Windows\System\CqdzjAO.exeC:\Windows\System\CqdzjAO.exe2⤵PID:3960
-
-
C:\Windows\System\gGNYQHj.exeC:\Windows\System\gGNYQHj.exe2⤵PID:2988
-
-
C:\Windows\System\KhJKgsv.exeC:\Windows\System\KhJKgsv.exe2⤵PID:3448
-
-
C:\Windows\System\budBkSy.exeC:\Windows\System\budBkSy.exe2⤵PID:2240
-
-
C:\Windows\System\ERrqXaw.exeC:\Windows\System\ERrqXaw.exe2⤵PID:1500
-
-
C:\Windows\System\dUmNJqy.exeC:\Windows\System\dUmNJqy.exe2⤵PID:3692
-
-
C:\Windows\System\TEmVKKB.exeC:\Windows\System\TEmVKKB.exe2⤵PID:3832
-
-
C:\Windows\System\DsIVCuO.exeC:\Windows\System\DsIVCuO.exe2⤵PID:1352
-
-
C:\Windows\System\yYIgmTC.exeC:\Windows\System\yYIgmTC.exe2⤵PID:2480
-
-
C:\Windows\System\iqEhxMT.exeC:\Windows\System\iqEhxMT.exe2⤵PID:2456
-
-
C:\Windows\System\PEQVoww.exeC:\Windows\System\PEQVoww.exe2⤵PID:1872
-
-
C:\Windows\System\aRWYojK.exeC:\Windows\System\aRWYojK.exe2⤵PID:1048
-
-
C:\Windows\System\EHbeWSA.exeC:\Windows\System\EHbeWSA.exe2⤵PID:3732
-
-
C:\Windows\System\yQEcZee.exeC:\Windows\System\yQEcZee.exe2⤵PID:3584
-
-
C:\Windows\System\jmfRFHI.exeC:\Windows\System\jmfRFHI.exe2⤵PID:3040
-
-
C:\Windows\System\QJIQwbe.exeC:\Windows\System\QJIQwbe.exe2⤵PID:3256
-
-
C:\Windows\System\jcktfuj.exeC:\Windows\System\jcktfuj.exe2⤵PID:2720
-
-
C:\Windows\System\zxQAeWw.exeC:\Windows\System\zxQAeWw.exe2⤵PID:2380
-
-
C:\Windows\System\wnPTndV.exeC:\Windows\System\wnPTndV.exe2⤵PID:3168
-
-
C:\Windows\System\CwVOHFt.exeC:\Windows\System\CwVOHFt.exe2⤵PID:940
-
-
C:\Windows\System\itGKHym.exeC:\Windows\System\itGKHym.exe2⤵PID:3628
-
-
C:\Windows\System\dxAtRBe.exeC:\Windows\System\dxAtRBe.exe2⤵PID:3896
-
-
C:\Windows\System\TkWuifS.exeC:\Windows\System\TkWuifS.exe2⤵PID:2452
-
-
C:\Windows\System\KBFLWOh.exeC:\Windows\System\KBFLWOh.exe2⤵PID:1564
-
-
C:\Windows\System\ArmqcqQ.exeC:\Windows\System\ArmqcqQ.exe2⤵PID:2164
-
-
C:\Windows\System\MiyYYuu.exeC:\Windows\System\MiyYYuu.exe2⤵PID:4108
-
-
C:\Windows\System\DRFAjfY.exeC:\Windows\System\DRFAjfY.exe2⤵PID:4124
-
-
C:\Windows\System\tJxVcuK.exeC:\Windows\System\tJxVcuK.exe2⤵PID:4152
-
-
C:\Windows\System\ScssRwx.exeC:\Windows\System\ScssRwx.exe2⤵PID:4168
-
-
C:\Windows\System\trcWSfW.exeC:\Windows\System\trcWSfW.exe2⤵PID:4188
-
-
C:\Windows\System\xXxleRb.exeC:\Windows\System\xXxleRb.exe2⤵PID:4208
-
-
C:\Windows\System\DdJQiqP.exeC:\Windows\System\DdJQiqP.exe2⤵PID:4228
-
-
C:\Windows\System\YbKLIUw.exeC:\Windows\System\YbKLIUw.exe2⤵PID:4244
-
-
C:\Windows\System\sqdzgkf.exeC:\Windows\System\sqdzgkf.exe2⤵PID:4260
-
-
C:\Windows\System\JsOVgDr.exeC:\Windows\System\JsOVgDr.exe2⤵PID:4276
-
-
C:\Windows\System\EbbSsrA.exeC:\Windows\System\EbbSsrA.exe2⤵PID:4292
-
-
C:\Windows\System\ovUXxIi.exeC:\Windows\System\ovUXxIi.exe2⤵PID:4308
-
-
C:\Windows\System\MGkScMc.exeC:\Windows\System\MGkScMc.exe2⤵PID:4360
-
-
C:\Windows\System\DKQWWWM.exeC:\Windows\System\DKQWWWM.exe2⤵PID:4376
-
-
C:\Windows\System\nOSseBw.exeC:\Windows\System\nOSseBw.exe2⤵PID:4392
-
-
C:\Windows\System\umVWmCY.exeC:\Windows\System\umVWmCY.exe2⤵PID:4416
-
-
C:\Windows\System\HnrrnaH.exeC:\Windows\System\HnrrnaH.exe2⤵PID:4440
-
-
C:\Windows\System\PXikkDz.exeC:\Windows\System\PXikkDz.exe2⤵PID:4456
-
-
C:\Windows\System\mVqFqBt.exeC:\Windows\System\mVqFqBt.exe2⤵PID:4480
-
-
C:\Windows\System\IYqOvPR.exeC:\Windows\System\IYqOvPR.exe2⤵PID:4496
-
-
C:\Windows\System\vqJtJwv.exeC:\Windows\System\vqJtJwv.exe2⤵PID:4512
-
-
C:\Windows\System\BLVgZsK.exeC:\Windows\System\BLVgZsK.exe2⤵PID:4528
-
-
C:\Windows\System\TehcqOA.exeC:\Windows\System\TehcqOA.exe2⤵PID:4548
-
-
C:\Windows\System\TyUBLTj.exeC:\Windows\System\TyUBLTj.exe2⤵PID:4568
-
-
C:\Windows\System\HrIWvgv.exeC:\Windows\System\HrIWvgv.exe2⤵PID:4588
-
-
C:\Windows\System\GoNtBSF.exeC:\Windows\System\GoNtBSF.exe2⤵PID:4604
-
-
C:\Windows\System\viPYUjm.exeC:\Windows\System\viPYUjm.exe2⤵PID:4620
-
-
C:\Windows\System\aCbLIfN.exeC:\Windows\System\aCbLIfN.exe2⤵PID:4636
-
-
C:\Windows\System\zKbAbQf.exeC:\Windows\System\zKbAbQf.exe2⤵PID:4656
-
-
C:\Windows\System\JjkHZso.exeC:\Windows\System\JjkHZso.exe2⤵PID:4676
-
-
C:\Windows\System\wlMRUTo.exeC:\Windows\System\wlMRUTo.exe2⤵PID:4696
-
-
C:\Windows\System\kXSRpTH.exeC:\Windows\System\kXSRpTH.exe2⤵PID:4720
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD55d0bc5ccec5d86192ceb23f630878e42
SHA16e797b83f89993c3ecf2bc4235c7ffa8e260c122
SHA256713d9659916568794c338f6224530caf77c27208a7522a7dbc7e26eb47999e4e
SHA512343e78e585cfdf850b5cc907c6e6fb8cf3e5d498336f99ffbe12a387b1bfc8e3582bac8aafc3e34612e49cf43a9e98b088a763b49e1abe53714a33d95efff29f
-
Filesize
1.8MB
MD542f8104dedc2f259245f89f82b327496
SHA1181e702eb67ddca8b704f6521417681e997e21fe
SHA25693526be574d96aa2afdc67e9d9282a68891a6e2b932164e7f7ef6d89f29b4eff
SHA512b8d2a260691a29e6e362e5a167244ae47960c8b856702ddaa9f9dff87758a22282385d095f7456d434f160a5d4261d3225c2f0f83618b9c870dd0fea7b5239b6
-
Filesize
1.8MB
MD591ccbe4ba8138cfcd9ee4a2a355bdcf7
SHA1517e574d2b3d485cb3c06ebf10be1b98749dc186
SHA25630ce4cf07bb04828a2ae48191c81240f50a31eb3355b77ce83699853017d5af5
SHA51298300e1ab7b5f5527910a9d06ed453f789d948e90abbe2a4c2195cc247dae5f9d601ffb8537dd7f565b9f35a6bd22e744412fee23389fd18faff6074891b2870
-
Filesize
1.8MB
MD57f8a46859a265a3687d71da7cdaa9350
SHA1fc1ea2a0dd9c87cb2f371ed151031423c850fdc9
SHA2565dd18ddf26628436ab357d35c704d2b0b30328c4b8cd27954b0d9877b89c22c2
SHA512c6da0dbfb3fc448934005684fa22a100b81884030e6a24c811f9fe6765549402451707d0d968f10548531aaab61ad93106f04ae48ae01860b4c1d3b7844fd42f
-
Filesize
1.2MB
MD5cd5ef36ef03eac2b20cce67daca8e60e
SHA178ffe5bdf11fd5c1af061891a6f825c7e6d5971e
SHA256c9394411c09cedeb6199f3ce46bf92c0c6fd19fa68844008591c10a1cf195974
SHA5125806b974fa088e66d040826bc66b929a74fa0017878d780c1b5daeca898125a6d7965ed63fbdb5f892a98e1909fc8fae29ef3faa316e6f8db54adbdaa8571a2a
-
Filesize
1.8MB
MD5a58c0c309c2226e4f839cd6d11adee0e
SHA10bbd091d9be70d8645d76723c0acc087c508c349
SHA2569f977ce32d8a2e8cddf2a516f042897c15b7c15a189bfe36449a0b19eb0d6118
SHA5127eb6af075f2e84734bfc7313cc3c9a027636adbdea663c24cfe4cb1638ec51d241c50125aac4156b4d116b00436683f4043f228f5d606da0d3804bccd5f2cfaf
-
Filesize
1.8MB
MD58aa24f2d6609c92562a12392f5473232
SHA19f778f7a0d040c3d477e771fe96f4640d0a8ab1c
SHA25689492713ae3348c7431157aec03e00af8ee4224e5b183866e26d9647473b935e
SHA512a4275c354f4570b2b005164a09db5425603f545be81ccfcc607a2c4dae27311239fed6a2a90c942d571b374c5f96943ac1aa838db8c0de88fb9676b27dd82db4
-
Filesize
1024KB
MD5b2ad855639c2b8f4bb10c3fa9e5e0e9a
SHA163a4a138146af5e173502df54e615e87862cd1a7
SHA256cd53f3c3dd2c1bd95105a3edb1ec4cb3264e45baa2409fc2350b91725a8bf544
SHA5123529025d3e0f67cb320696d9895c3861afb6e90b20da8d36532718eee7a4a8cbc519616d746669732421d515893f7df7d8c074a583a7d45ba03bc909082ec6ba
-
Filesize
1.8MB
MD51c1e140273332d0cb371ccbb500fef41
SHA145feea051bae45d141700a4b0d33e2f40aeaaeb4
SHA256c06483e4b3293441da28e435fd909f56e172adf2d2f804bbe379c92fc61786ca
SHA512251f0ec567cfacd0f8ecf73384504645a0e9e5a2867c8bb2ea638215fd764fce03d43d570abefbee730694102e5f1c2a15b9ed28031e4ab72673648347406721
-
Filesize
1.8MB
MD5df83058c766dda4dcf213edbec63df1b
SHA15fe98395e17d41cc9c2562e5854e063b089c975e
SHA2569510434943951b3a70119b6f114fb709f8cf439a776df77453633a3de5e39307
SHA5124ae9e1426dfacbd9b4e14d7280548b4dd4a50172d8c4d0a1d0e260c3170097c610e0634120a71580f5eeeccf44d83e5c677a95779c21647121566c170d132e41
-
Filesize
1.8MB
MD5075edec68a9c853f178fb86db3d3f61f
SHA1bbf954bc41507df9ec6bf9e4d399a8a11ff692c5
SHA256c189aa792f45bbad17b9311c42f859c97d623807f08d61c661553a6be6ce6acc
SHA512c15b7b345a06f673a8155cccfb73aaeabc0b8ad79e3530c81e851c04d807a994ac2bdf89e3448f690a617584a49ddc75b7ea740a0dc622ee1130812efd8d43d0
-
Filesize
1.8MB
MD5613d2113aef558e11e2e6a3741b67f42
SHA1ada003c79893d4c79dd848f00a309b259bee3108
SHA2565fbd3ce3f8f9190b9ce6cf61a35cf2324bb93b96f8032167d744e239a5cf00f6
SHA512051e007442563aaa05b727ce4c610e5b334d23ef3b75b3fab786686782f73e56bf38bd63da7bfb179595c861681d2db0aeed45db2f3b5a45eedc32e45553d720
-
Filesize
1.8MB
MD54f8b91b7904ef591d2b256752aea9b51
SHA1d56cfc5dc3bc177b28575432293e148345e0ebf1
SHA256fd8a7c4b9f895cf0d0bab7b00bf97696cc5b6078abc1ab65c55aee9b10f239c2
SHA512acb4c856233c9c9c867eec66f07d5cdaade9b1f0aea788c338bafcf461ea592c1135a612c4287aa5fe6170d307cb483b567f2f42a59a6cb24cad72ec5c2d9407
-
Filesize
1.8MB
MD593aa49862b8ea9cf9c67f10480f8f741
SHA13307574a780a7e9a972973dc2d817234d6c0b316
SHA256eb5e42b86b216f2c3022f5b311ac48b66be6f9711d54f89c31c7512118ac4cea
SHA512d58a1f8b6da5da2c803362dbb594d3a799346556f2594a991a192b34e200bf41c8d903d850645eeaff2807b954221ef9fc1e3841e24cbb3c63772f5ee1629eb2
-
Filesize
1.8MB
MD53f694235e768cc86fdbcd2cd4a599c94
SHA1db559cd5a8d01f6e5f897d48e431a76429e90d4e
SHA256991fedf229cc08113c4173550988a167e96ea12031d8651bc3ba0caaf6c8341b
SHA5123ec0790a9600c0861a2f33de193458e9c002cb586965b61c70098ef3de937db5ff3da7fed666063708ba31c0e3328057af68c777976ffd84a247d67a0e992631
-
Filesize
1.6MB
MD5e0ae98ebe954443e0f223b4721efb9bb
SHA1744646e3249b3019168cceb49466cb0800943491
SHA256803fa53333e74f736735f43074e0ab3bb99949bf1295c5bc7e120ce9daab4534
SHA512c10973ba0bd55c90aed5f66a7e2ec65dd14f7c5cb348919febbd1ab2e1d4c626f0314155fc269d3704a2b79005f29d323a76cee1229c36ca830a94689f240f36
-
Filesize
1.8MB
MD57a58c1d4713eb75424827b807939040f
SHA1172e8a3464804a19cf0b6c1f61c314fa49bb1e4b
SHA2567dee8d8d6d7671e0dbc50319488aae14eb63261a9c00daaf82a487769f9f092d
SHA51237819c7a1c63eb5f8b21cc674a0222c88c174ebda946f56e2a7a1f53081fd5089ab6ee35ba2bf33bc0ae22ba3982c1b4a026756ad9bb667b89c351cffd6324f0
-
Filesize
1.8MB
MD5666b00402ecb295d57cd3f5764eeb3d4
SHA124de462deb56f7832124a48e537d58965787c9dc
SHA25697839ae1d3d83c5e52ecd5d8382ed530e3b074ffd9d5a7f6cb3ea2eec9f0c91f
SHA512621caf84424d3f90e4918ab37ca30192fe44124e9171b4946d3471999b0918ab9f1441874a7048e4ddac696e0accd7825fc0c6f56264f045560ccd9acd93937d
-
Filesize
1.4MB
MD5d495c8d14dfb73423f0da61cde63542a
SHA17845b2db67ca31ad643a38c12c55cc7381a8dfb1
SHA2565abb98dc37a56a4796619b9067bd79c7c461d3881127d7633b0c198d1abec318
SHA512570349ec34070b0d6d3941b9bc1ad0ed79f9a0778c96b2a8457098b0eef442a293f1801d9279a1adc148b5ca498d73b85a3c00005133f764deda8281f7378cb9
-
Filesize
1.8MB
MD5fc2b98e322505eb5e094afd9346c9a12
SHA1785c2bbf34cbc91c0248ad8000163dcc1e254b7e
SHA256a816c5277ce20401449137e3893fd0af7e3b367a18279f63095e8148ae6dc1cd
SHA512cdb78daa5aa1564480cbf107facf5a9484d354e6ff58c20c8d8fbde18a31503a2f2150f4bd2138df179ff97c6c069389b0494d8ab7a08a4f68caa21de43a3073
-
Filesize
1.8MB
MD5f17fa37d98eafe88d249b545ae0bee20
SHA15e285251be92b9e3da8580278d2a1d39245f4200
SHA2560eb11ac876db7d91381e361b7f1b4bb9cc508fe448dcbc3b2f372e73cfc621f3
SHA512443746be88bfaf3a391359a9e078be1216c1df187ec1375f7ef1bd56c0691a91e6723627ceea4f57817435a13537dbb766e42d842122f69897fd52e7b0e5ecae
-
Filesize
1.8MB
MD5039f324a8db20c9d0cffe3db3e62447f
SHA1f4930cd4080afa17fd61aad766c308657504cffd
SHA25670a0b6e2d2fc3a4f796ea5510abbd724437f7e6a33f0a195ebb06097020124ca
SHA512b93d8d99fb262ed5fba7b45cbf2621b4f0d2e611ed81ceee1197b1506b9c5e291706a116cebeeed2cf177416b6e01b8341ddeae4f1bf6a193dfece0e0947da01
-
Filesize
1.8MB
MD53182c712bf4ea48259d6433365de5950
SHA165529c2a89c09f145aa585cb486874f87cfac6fb
SHA2565279587a69cb63315f9e1e3efe6751b5621e4a9eb23dadee45f92334a578ee9b
SHA5126b30f5d93d57a86ee1c429ca178840f2b318e07ee5a5a1b4fb95d0a96db3894a88dc87d9155570691634f270057128db64f2563aa67361c36397bf6f4d1c4478
-
Filesize
1.8MB
MD531e1ac41b220a1e84e48b9de4fb7c608
SHA13c5a72e2ab533b7345cc4f4bfe4fb988b1624e77
SHA2566caccbbc8f69894d6129c93067ccd4f9242a68aee8225b77b08ce1f565e33d99
SHA512a6d18391e0e4296a10b35d2745044a1730f2f9ec50c77bc1772f883761ef49031a11fe6ef49c35fb2512f3c3f72d6f89b706d0d2660e8b2a12e275abfe0b11f6
-
Filesize
1.8MB
MD50a206a88feeb7402377e60fe2acf4fff
SHA1aee8f66c347fb1a7b972b2db9ae4d26920f98a84
SHA2566dd7ea992aa73f631a4003931a4a89665403c3ccda2a4bcf45bd279ea5f81463
SHA51252424e02f852d1b0779a4eb974968f0592dc8d73ef8cf5fa99ddfa4ee8e9b658d6b074aad6c25f45e67c3e3099bd14b6204a021afff9cf2b6883159c95fe8146
-
Filesize
1.7MB
MD5489e93d54fac861c2d5670f89f726f62
SHA1bdf9e9a9534b7a1bb7225f6b91fa611186400b63
SHA2568e0107c5fba6c4991ba6b3f864366e0143ac96f60a27fb804c576ce1c896447f
SHA512bc97250d116dc70085ab954893f09a6c21397411fa158f9fd133c355b8c148ff4cdf949f2c6d3514bb9405b0e692c356737374de475c3d0d1d057b8078bd3c16
-
Filesize
1.8MB
MD50268c1d6111fb573a0a4c62fe63b4210
SHA1a4b16b43beecede2ff0f5f0547b60426e52ef817
SHA256b6cdc7361cb01c1705a73edd80f901f19c1420feb16dad048a29d7a17fd56b73
SHA5121c09cb3c7b16023f1609ac58c73d84fc3946b299f47ff1be4fe0869ee156d024f25c6bd29dddd816506841d97616c72bcf64d8820ad7bb139d8cde5b402a7c38
-
Filesize
1.6MB
MD571e116d716fde7333a1293d3c5c9d1fd
SHA1a6f944cdaaaec4938451adc4067133a15f5bcc30
SHA256b2c533ba9d73a2bde4759a83aaa4e6045ebf3291661da9c9e9fcf021d18f6a5b
SHA5127e5860918f6d50949847a21d132bbb3a72fa1231e42f763b0aa4706fefa7f5218d1210f607115a1d5f7057a7fa1c5d67b50c5ffe6c4e8cfdab96e56561245805
-
Filesize
1.8MB
MD55273943b4170cb89338f054ec8284ea0
SHA189b46319267c251ac6c25ceec6456e498468166d
SHA256faec912766d19059cb08839ba422bbf9f5cc76e0de069279fcb007d10086584f
SHA51215a4b737b41ca063a4f08b6bfa5e554cc15c2ef8bf697a7325f8f24f9e41c4c1a72fe6a4b18cfc590aa5b9a1e05569d43593bac654d183ff061e40a39eb7ce34
-
Filesize
1.8MB
MD569f26f400115450594ae0193a42fbe83
SHA1a6fafdd5da58752df308664f54ef89def32c4c86
SHA2560a0aea2cc8b045a90db671215570976fad13bdeaec5bb4dd6a6cb70dbd67ef33
SHA51252bbf3f2f6b0fd18328f9f0832294f54c82acdeb0e00c5799720c0925b7a0bbf947a4c95774d4a93be9ef07f248c6068162512f38c24ebd37524554adb7e1ac9
-
Filesize
1.8MB
MD5a969709ae8bb99f9d22dd48837fc1d91
SHA1449811ee19c001b6391e015bf697c8f6132b72fb
SHA2568295c25b2243fde7f8bae273df938e5b5fd3c1532b587c20f79740c2e449beda
SHA51207769dd771e3fbe8b789a894d80a217ae055bd96f513f14573538b6671d4d52ef04d3455306a9cbb18c94b13c8f6130a3136aca051669b6796525cbdb41e2e19
-
Filesize
1.8MB
MD538f918fe28c0d3ebd13d4c8d2580e00c
SHA199b16c6902c1a1c877531f6b84c17755414b3de7
SHA256d80dd1efe94bf893121167f75ef4af3ddb0606a96e3593b22988688f2af8120a
SHA512ab3d8547c6fb685dc917e04da124908718c3420690629917239aab66c2e9c7a23bc3e3b05ccbd084a35d450d5dc7dae930b35d232fe1f0ee87a9acc2d71d61b5
-
Filesize
1.2MB
MD5fd14487c96148e9b45e47086dd701312
SHA1db11c30a2d33c4a4470b21c4e150b371d5ce63a2
SHA256f7b02500d5fa0ab0792478deecca40806435b425f8705105717f649a5fc8c515
SHA512804d4088a0a9f51042874dc1c84927f66c689acb9142c64bcd8548059897bde3e9e7569feef0f30ce15264e10304dc77cc9f88c4ebea97216a2d91680ae93b9d
-
Filesize
1.8MB
MD516fac759db1fa43fadce2a5f2d8257b3
SHA107769919e957252b82abbe1fd45ba025db99c70b
SHA256d35a8a0329c96c9b32455b65c5c5234a7b33475bb00d793c37308fed5aeda1c2
SHA512f6cd80136b820bdefb3cffea8c373140a552fbb543a068bd1c55094ca95acc9ed4a05e1c0190e7edb89b6d4b614aedddf8388d13c4980db091c2f7e2589cfbea
-
Filesize
1.5MB
MD5f433193c11ce64dd1e2517991ec9f29e
SHA190df4ad6b9554cfc4930b90a45a738194a3db176
SHA256f94467274ab855ba3835a7d10b49f5f7294208a0d29ff6c345c0fcf704b3760b
SHA512b87f740ee2ac66060e7efdc6112815058b67b35f1de212a3a4d997632bbd7e09b1748996f2e8cf2f857b13b70653ffff44c9aeebc43f2fffbecf6ce6d1e6afae
-
Filesize
1.1MB
MD58b2eab9a9bb1361eafd5bc47cb69d5dd
SHA1d26c0c240cf96c7874a2470914ecaee58edf1c7c
SHA256f7e76e45ee22d9a423b9f2a47e6138b6b56aac3e32e93aef3e9d227671709cc9
SHA512158532117b03f91d18e84735461eb50a4919361d94c7826029cc08c6c331c2e68aeb6d8d3e6b16484cc8263386da449fe3dc3358b3327ec0b2843a796fef56af
-
Filesize
1.8MB
MD5dd4f86451363035b562c52df81546a5d
SHA1a6f530125c9bfac00a9b6de2da83bd4c35dace39
SHA2563e9a6c06d8cd3166060ff566c50b4e8f5059b3cb543851d51b9f5162b4dbd66b
SHA512158d2fe6288b3e44d80c910858f0fa5c566da452338e112d1bded4ad9900c7a878f4494628713f8aea58ba6826742d63ac44026a1d800c2fccbcaaf41f043ef8
-
Filesize
1.1MB
MD5cdcf7356647142d422479f05aad1001b
SHA12fda40d60a5615f87789846dc8219bea51def515
SHA2562cbe7d6b79d031ef87e25b9df210f15a283114a83369809ccac96683171ab551
SHA51230ff3785f4f2744e1b83fc3ae807e49c2e99d8ebda936a47f59bd97d0ed22a8fce2c2933fd2a4452a2399dd28d53bea5e5764a413a49014c1a4fa6622137e1e5