xmrig | c052d8854e4a0747a2ff6f22633c49afe14c063c8cbeb750b5d0cbefd9b086c1

Analysis

max time kernel
114s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
18/05/2024, 23:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
Size 3.3MB
Sample240518-3l481sef25
SHA256 c052d8854e4a0747a2ff6f22633c49afe14c063c8cbeb750b5d0cbefd9b086c1
MD5 26091ebef1ac432126617f4586640120
SHA1 3a497246da6f8539362d06141f8cada01363694f
SHA512 1e71a9fd9860cc4f98c01871cb76c1da329bcf457c7983478af414dfcd711f195f47af5634f84cc17fd8b40f448fc19a5303eb473d20efc211c1b71e7dc152ee
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc41:wFWPClFl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3280-0-0x00007FF7BF0A0000-0x00007FF7BF495000-memory.dmp	xmrig
behavioral2/files/0x00080000000233d9-4.dat	xmrig
behavioral2/memory/2232-8-0x00007FF760CB0000-0x00007FF7610A5000-memory.dmp	xmrig
behavioral2/files/0x00070000000233dd-12.dat	xmrig
behavioral2/files/0x00070000000233de-11.dat	xmrig
behavioral2/memory/4120-15-0x00007FF6C4840000-0x00007FF6C4C35000-memory.dmp	xmrig
behavioral2/memory/3740-20-0x00007FF6B1C70000-0x00007FF6B2065000-memory.dmp	xmrig
behavioral2/files/0x00070000000233df-22.dat	xmrig
behavioral2/files/0x00080000000233da-28.dat	xmrig
behavioral2/files/0x00070000000233e0-35.dat	xmrig
behavioral2/files/0x00070000000233e1-40.dat	xmrig
behavioral2/memory/3452-27-0x00007FF6C0340000-0x00007FF6C0735000-memory.dmp	xmrig
behavioral2/files/0x00070000000233e2-42.dat	xmrig
behavioral2/memory/2940-43-0x00007FF6F1080000-0x00007FF6F1475000-memory.dmp	xmrig
behavioral2/files/0x00070000000233e3-49.dat	xmrig
behavioral2/memory/4124-56-0x00007FF632420000-0x00007FF632815000-memory.dmp	xmrig
behavioral2/files/0x00070000000233e4-55.dat	xmrig
behavioral2/memory/3840-62-0x00007FF74FDC0000-0x00007FF7501B5000-memory.dmp	xmrig
behavioral2/memory/4276-66-0x00007FF630C00000-0x00007FF630FF5000-memory.dmp	xmrig
behavioral2/memory/4340-71-0x00007FF6E8170000-0x00007FF6E8565000-memory.dmp	xmrig
behavioral2/files/0x00070000000233e7-73.dat	xmrig
behavioral2/files/0x00070000000233e8-76.dat	xmrig
behavioral2/memory/4604-84-0x00007FF6D3230000-0x00007FF6D3625000-memory.dmp	xmrig
behavioral2/files/0x00070000000233e9-90.dat	xmrig
behavioral2/files/0x00070000000233eb-100.dat	xmrig
behavioral2/files/0x00070000000233ed-110.dat	xmrig
behavioral2/files/0x00070000000233f2-131.dat	xmrig
behavioral2/files/0x00070000000233f5-146.dat	xmrig
behavioral2/files/0x00070000000233fa-175.dat	xmrig
behavioral2/files/0x00070000000233f9-170.dat	xmrig
behavioral2/files/0x00070000000233f8-165.dat	xmrig
behavioral2/files/0x00070000000233f7-160.dat	xmrig
behavioral2/files/0x00070000000233f6-155.dat	xmrig
behavioral2/files/0x00070000000233f4-148.dat	xmrig
behavioral2/files/0x00070000000233f3-143.dat	xmrig
behavioral2/files/0x00070000000233f1-133.dat	xmrig
behavioral2/files/0x00070000000233f0-125.dat	xmrig
behavioral2/files/0x00070000000233ef-120.dat	xmrig
behavioral2/files/0x00070000000233ee-115.dat	xmrig
behavioral2/files/0x00070000000233ec-105.dat	xmrig
behavioral2/files/0x00070000000233ea-95.dat	xmrig
behavioral2/files/0x00070000000233e6-79.dat	xmrig
behavioral2/memory/2136-78-0x00007FF681A70000-0x00007FF681E65000-memory.dmp	xmrig
behavioral2/memory/384-75-0x00007FF7A7290000-0x00007FF7A7685000-memory.dmp	xmrig
behavioral2/files/0x00070000000233e5-72.dat	xmrig
behavioral2/memory/3244-61-0x00007FF769220000-0x00007FF769615000-memory.dmp	xmrig
behavioral2/memory/3768-58-0x00007FF7985E0000-0x00007FF7989D5000-memory.dmp	xmrig
behavioral2/memory/3280-822-0x00007FF7BF0A0000-0x00007FF7BF495000-memory.dmp	xmrig
behavioral2/memory/2788-827-0x00007FF7AB2D0000-0x00007FF7AB6C5000-memory.dmp	xmrig
behavioral2/memory/1296-831-0x00007FF72F5B0000-0x00007FF72F9A5000-memory.dmp	xmrig
behavioral2/memory/4940-836-0x00007FF6B7B10000-0x00007FF6B7F05000-memory.dmp	xmrig
behavioral2/memory/3680-839-0x00007FF6EF9D0000-0x00007FF6EFDC5000-memory.dmp	xmrig
behavioral2/memory/1332-844-0x00007FF6AE920000-0x00007FF6AED15000-memory.dmp	xmrig
behavioral2/memory/3088-853-0x00007FF781C00000-0x00007FF781FF5000-memory.dmp	xmrig
behavioral2/memory/5076-859-0x00007FF6AD910000-0x00007FF6ADD05000-memory.dmp	xmrig
behavioral2/memory/1172-862-0x00007FF6A7350000-0x00007FF6A7745000-memory.dmp	xmrig
behavioral2/memory/2176-865-0x00007FF7513E0000-0x00007FF7517D5000-memory.dmp	xmrig
behavioral2/memory/4984-869-0x00007FF77F6A0000-0x00007FF77FA95000-memory.dmp	xmrig
behavioral2/memory/3452-1761-0x00007FF6C0340000-0x00007FF6C0735000-memory.dmp	xmrig
behavioral2/memory/3244-1943-0x00007FF769220000-0x00007FF769615000-memory.dmp	xmrig
behavioral2/memory/4340-1944-0x00007FF6E8170000-0x00007FF6E8565000-memory.dmp	xmrig
behavioral2/memory/384-1945-0x00007FF7A7290000-0x00007FF7A7685000-memory.dmp	xmrig
behavioral2/memory/2136-1946-0x00007FF681A70000-0x00007FF681E65000-memory.dmp	xmrig
behavioral2/memory/4604-1947-0x00007FF6D3230000-0x00007FF6D3625000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2232	srPeYoq.exe
4120	bjuRKOb.exe
3740	vdMUDLQ.exe
3452	rrDMKZh.exe
2940	gPmNyJd.exe
3840	LBIAHkJ.exe
4124	NtMmVIl.exe
3768	kUDHQMh.exe
4276	NBBJsVl.exe
3244	cCtGNvx.exe
4340	BMeztMZ.exe
384	qLnLQHL.exe
2136	jrITrKN.exe
4604	CGqcPkD.exe
2788	BwEOnpD.exe
1296	HSsXRYw.exe
4940	bdcklFW.exe
3680	EbbctVg.exe
1332	PiMLgDM.exe
3088	XDgESJV.exe
5076	qHADHWj.exe
1172	TbxSAho.exe
2176	vlyWkLI.exe
4984	JxYBgGt.exe
2856	hodnPoS.exe
3804	CgLRneS.exe
4576	IFlvcrJ.exe
2936	nlGkrPu.exe
2240	QylHNFk.exe
3620	IyVgknu.exe
4820	lMbxYQx.exe
4760	PwbwOzl.exe
1224	SvtfQqR.exe
3076	nWmzKAk.exe
1688	deanQtS.exe
3476	NmnzBif.exe
2072	NUExeAi.exe
640	KTFYgvZ.exe
2512	liCFxSn.exe
1072	XpoPQJL.exe
4140	meDpfqf.exe
5028	PMlFODs.exe
4516	QZGPUBU.exe
2488	kKlpDJL.exe
3848	yxKZPxn.exe
4076	csiBnrK.exe
772	XNGTEoG.exe
780	OkQAfyk.exe
224	UrzlHor.exe
3304	mWAdmWU.exe
4204	pRkLwFK.exe
5084	FetjgUm.exe
4672	pevEclL.exe
4436	ZbjqYES.exe
2012	WTIrScg.exe
2724	aemNNHO.exe
4936	BdufTrV.exe
3000	KfqgohD.exe
2520	IAZqvcu.exe
3704	DrLJifK.exe
3192	WUxQrnU.exe
1464	eUWjWlz.exe
2992	mXJxokn.exe
2596	AkQzdWX.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3280-0-0x00007FF7BF0A0000-0x00007FF7BF495000-memory.dmp	upx
behavioral2/files/0x00080000000233d9-4.dat	upx
behavioral2/memory/2232-8-0x00007FF760CB0000-0x00007FF7610A5000-memory.dmp	upx
behavioral2/files/0x00070000000233dd-12.dat	upx
behavioral2/files/0x00070000000233de-11.dat	upx
behavioral2/memory/4120-15-0x00007FF6C4840000-0x00007FF6C4C35000-memory.dmp	upx
behavioral2/memory/3740-20-0x00007FF6B1C70000-0x00007FF6B2065000-memory.dmp	upx
behavioral2/files/0x00070000000233df-22.dat	upx
behavioral2/files/0x00080000000233da-28.dat	upx
behavioral2/files/0x00070000000233e0-35.dat	upx
behavioral2/files/0x00070000000233e1-40.dat	upx
behavioral2/memory/3452-27-0x00007FF6C0340000-0x00007FF6C0735000-memory.dmp	upx
behavioral2/files/0x00070000000233e2-42.dat	upx
behavioral2/memory/2940-43-0x00007FF6F1080000-0x00007FF6F1475000-memory.dmp	upx
behavioral2/files/0x00070000000233e3-49.dat	upx
behavioral2/memory/4124-56-0x00007FF632420000-0x00007FF632815000-memory.dmp	upx
behavioral2/files/0x00070000000233e4-55.dat	upx
behavioral2/memory/3840-62-0x00007FF74FDC0000-0x00007FF7501B5000-memory.dmp	upx
behavioral2/memory/4276-66-0x00007FF630C00000-0x00007FF630FF5000-memory.dmp	upx
behavioral2/memory/4340-71-0x00007FF6E8170000-0x00007FF6E8565000-memory.dmp	upx
behavioral2/files/0x00070000000233e7-73.dat	upx
behavioral2/files/0x00070000000233e8-76.dat	upx
behavioral2/memory/4604-84-0x00007FF6D3230000-0x00007FF6D3625000-memory.dmp	upx
behavioral2/files/0x00070000000233e9-90.dat	upx
behavioral2/files/0x00070000000233eb-100.dat	upx
behavioral2/files/0x00070000000233ed-110.dat	upx
behavioral2/files/0x00070000000233f2-131.dat	upx
behavioral2/files/0x00070000000233f5-146.dat	upx
behavioral2/files/0x00070000000233fa-175.dat	upx
behavioral2/files/0x00070000000233f9-170.dat	upx
behavioral2/files/0x00070000000233f8-165.dat	upx
behavioral2/files/0x00070000000233f7-160.dat	upx
behavioral2/files/0x00070000000233f6-155.dat	upx
behavioral2/files/0x00070000000233f4-148.dat	upx
behavioral2/files/0x00070000000233f3-143.dat	upx
behavioral2/files/0x00070000000233f1-133.dat	upx
behavioral2/files/0x00070000000233f0-125.dat	upx
behavioral2/files/0x00070000000233ef-120.dat	upx
behavioral2/files/0x00070000000233ee-115.dat	upx
behavioral2/files/0x00070000000233ec-105.dat	upx
behavioral2/files/0x00070000000233ea-95.dat	upx
behavioral2/files/0x00070000000233e6-79.dat	upx
behavioral2/memory/2136-78-0x00007FF681A70000-0x00007FF681E65000-memory.dmp	upx
behavioral2/memory/384-75-0x00007FF7A7290000-0x00007FF7A7685000-memory.dmp	upx
behavioral2/files/0x00070000000233e5-72.dat	upx
behavioral2/memory/3244-61-0x00007FF769220000-0x00007FF769615000-memory.dmp	upx
behavioral2/memory/3768-58-0x00007FF7985E0000-0x00007FF7989D5000-memory.dmp	upx
behavioral2/memory/3280-822-0x00007FF7BF0A0000-0x00007FF7BF495000-memory.dmp	upx
behavioral2/memory/2788-827-0x00007FF7AB2D0000-0x00007FF7AB6C5000-memory.dmp	upx
behavioral2/memory/1296-831-0x00007FF72F5B0000-0x00007FF72F9A5000-memory.dmp	upx
behavioral2/memory/4940-836-0x00007FF6B7B10000-0x00007FF6B7F05000-memory.dmp	upx
behavioral2/memory/3680-839-0x00007FF6EF9D0000-0x00007FF6EFDC5000-memory.dmp	upx
behavioral2/memory/1332-844-0x00007FF6AE920000-0x00007FF6AED15000-memory.dmp	upx
behavioral2/memory/3088-853-0x00007FF781C00000-0x00007FF781FF5000-memory.dmp	upx
behavioral2/memory/5076-859-0x00007FF6AD910000-0x00007FF6ADD05000-memory.dmp	upx
behavioral2/memory/1172-862-0x00007FF6A7350000-0x00007FF6A7745000-memory.dmp	upx
behavioral2/memory/2176-865-0x00007FF7513E0000-0x00007FF7517D5000-memory.dmp	upx
behavioral2/memory/4984-869-0x00007FF77F6A0000-0x00007FF77FA95000-memory.dmp	upx
behavioral2/memory/3452-1761-0x00007FF6C0340000-0x00007FF6C0735000-memory.dmp	upx
behavioral2/memory/3244-1943-0x00007FF769220000-0x00007FF769615000-memory.dmp	upx
behavioral2/memory/4340-1944-0x00007FF6E8170000-0x00007FF6E8565000-memory.dmp	upx
behavioral2/memory/384-1945-0x00007FF7A7290000-0x00007FF7A7685000-memory.dmp	upx
behavioral2/memory/2136-1946-0x00007FF681A70000-0x00007FF681E65000-memory.dmp	upx
behavioral2/memory/4604-1947-0x00007FF6D3230000-0x00007FF6D3625000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\xikeePs.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\tPxxeef.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\uISwVBn.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\CWrztPZ.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\cegBhtX.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\ruovmXU.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\pRkLwFK.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\UPspGbo.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\RQzCTvu.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\NxSxfak.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\YYVauam.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\cRveKUv.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\WmRMsfq.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\AGRLPYC.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\hxaGpOT.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\wvchzqa.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\oRXKFUG.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\dyksJiv.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\Rzloedq.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\ZVzAOTn.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\ifnPAtm.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\JpCWhel.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\PCTEedg.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\CrXdFxz.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\HMxQwxr.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\UtKRKEV.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\IRFiFzG.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\jrITrKN.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\gOjjSBl.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\CHMBZkp.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\PkGoLHL.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\EgqYYWv.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\BDEybTV.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\FfNyTOZ.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\KPYHmtn.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\iKtiAct.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\vvsyiZe.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\QPQYiMd.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\GCLbuDr.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\YrfMHti.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\wOXymfj.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\PuYyaIT.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\ckiNpZt.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\AIlfOLW.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\BYGcUGs.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\rLsAApH.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\WazKLzF.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\XpoPQJL.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\OkQAfyk.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\CKHowDI.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\GUAVEsM.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\ReEIWaN.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\jIxUxCE.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\tPvtyUs.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\LUkmPye.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\YUVkPCv.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\zzOnUuu.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\cFHwqiQ.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\EwFndvG.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\cxkFgXt.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\tSZQPJH.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\wRquMIC.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\xQnuuPA.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
File created	C:\Windows\System32\VVQHhqE.exe	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3280 wrote to memory of 2232	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	82
PID 3280 wrote to memory of 2232	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	82
PID 3280 wrote to memory of 4120	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	83
PID 3280 wrote to memory of 4120	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	83
PID 3280 wrote to memory of 3740	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	84
PID 3280 wrote to memory of 3740	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	84
PID 3280 wrote to memory of 3452	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	85
PID 3280 wrote to memory of 3452	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	85
PID 3280 wrote to memory of 2940	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	86
PID 3280 wrote to memory of 2940	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	86
PID 3280 wrote to memory of 3840	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	87
PID 3280 wrote to memory of 3840	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	87
PID 3280 wrote to memory of 4124	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	88
PID 3280 wrote to memory of 4124	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	88
PID 3280 wrote to memory of 3768	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	89
PID 3280 wrote to memory of 3768	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	89
PID 3280 wrote to memory of 4276	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	90
PID 3280 wrote to memory of 4276	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	90
PID 3280 wrote to memory of 3244	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	91
PID 3280 wrote to memory of 3244	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	91
PID 3280 wrote to memory of 4340	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	92
PID 3280 wrote to memory of 4340	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	92
PID 3280 wrote to memory of 384	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	93
PID 3280 wrote to memory of 384	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	93
PID 3280 wrote to memory of 2136	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	94
PID 3280 wrote to memory of 2136	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	94
PID 3280 wrote to memory of 4604	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	95
PID 3280 wrote to memory of 4604	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	95
PID 3280 wrote to memory of 2788	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	96
PID 3280 wrote to memory of 2788	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	96
PID 3280 wrote to memory of 1296	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	97
PID 3280 wrote to memory of 1296	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	97
PID 3280 wrote to memory of 4940	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	98
PID 3280 wrote to memory of 4940	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	98
PID 3280 wrote to memory of 3680	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	99
PID 3280 wrote to memory of 3680	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	99
PID 3280 wrote to memory of 1332	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	100
PID 3280 wrote to memory of 1332	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	100
PID 3280 wrote to memory of 3088	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	101
PID 3280 wrote to memory of 3088	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	101
PID 3280 wrote to memory of 5076	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	102
PID 3280 wrote to memory of 5076	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	102
PID 3280 wrote to memory of 1172	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	103
PID 3280 wrote to memory of 1172	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	103
PID 3280 wrote to memory of 2176	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	104
PID 3280 wrote to memory of 2176	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	104
PID 3280 wrote to memory of 4984	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	105
PID 3280 wrote to memory of 4984	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	105
PID 3280 wrote to memory of 2856	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	106
PID 3280 wrote to memory of 2856	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	106
PID 3280 wrote to memory of 3804	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	107
PID 3280 wrote to memory of 3804	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	107
PID 3280 wrote to memory of 4576	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	108
PID 3280 wrote to memory of 4576	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	108
PID 3280 wrote to memory of 2936	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	109
PID 3280 wrote to memory of 2936	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	109
PID 3280 wrote to memory of 2240	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	110
PID 3280 wrote to memory of 2240	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	110
PID 3280 wrote to memory of 3620	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	111
PID 3280 wrote to memory of 3620	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	111
PID 3280 wrote to memory of 4820	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	112
PID 3280 wrote to memory of 4820	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	112
PID 3280 wrote to memory of 4760	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	113
PID 3280 wrote to memory of 4760	3280	26091ebef1ac432126617f4586640120_NeikiAnalytics.exe	113

C:\Users\Admin\AppData\Local\Temp\26091ebef1ac432126617f4586640120_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\26091ebef1ac432126617f4586640120_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Windows\System32\srPeYoq.exe
  C:\Windows\System32\srPeYoq.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System32\bjuRKOb.exe
  C:\Windows\System32\bjuRKOb.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System32\vdMUDLQ.exe
  C:\Windows\System32\vdMUDLQ.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System32\rrDMKZh.exe
  C:\Windows\System32\rrDMKZh.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System32\gPmNyJd.exe
  C:\Windows\System32\gPmNyJd.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System32\LBIAHkJ.exe
  C:\Windows\System32\LBIAHkJ.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System32\NtMmVIl.exe
  C:\Windows\System32\NtMmVIl.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System32\kUDHQMh.exe
  C:\Windows\System32\kUDHQMh.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System32\NBBJsVl.exe
  C:\Windows\System32\NBBJsVl.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System32\cCtGNvx.exe
  C:\Windows\System32\cCtGNvx.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System32\BMeztMZ.exe
  C:\Windows\System32\BMeztMZ.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System32\qLnLQHL.exe
  C:\Windows\System32\qLnLQHL.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System32\jrITrKN.exe
  C:\Windows\System32\jrITrKN.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System32\CGqcPkD.exe
  C:\Windows\System32\CGqcPkD.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System32\BwEOnpD.exe
  C:\Windows\System32\BwEOnpD.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System32\HSsXRYw.exe
  C:\Windows\System32\HSsXRYw.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System32\bdcklFW.exe
  C:\Windows\System32\bdcklFW.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System32\EbbctVg.exe
  C:\Windows\System32\EbbctVg.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System32\PiMLgDM.exe
  C:\Windows\System32\PiMLgDM.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System32\XDgESJV.exe
  C:\Windows\System32\XDgESJV.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System32\qHADHWj.exe
  C:\Windows\System32\qHADHWj.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System32\TbxSAho.exe
  C:\Windows\System32\TbxSAho.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System32\vlyWkLI.exe
  C:\Windows\System32\vlyWkLI.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System32\JxYBgGt.exe
  C:\Windows\System32\JxYBgGt.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System32\hodnPoS.exe
  C:\Windows\System32\hodnPoS.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System32\CgLRneS.exe
  C:\Windows\System32\CgLRneS.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System32\IFlvcrJ.exe
  C:\Windows\System32\IFlvcrJ.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System32\nlGkrPu.exe
  C:\Windows\System32\nlGkrPu.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System32\QylHNFk.exe
  C:\Windows\System32\QylHNFk.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System32\IyVgknu.exe
  C:\Windows\System32\IyVgknu.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System32\lMbxYQx.exe
  C:\Windows\System32\lMbxYQx.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System32\PwbwOzl.exe
  C:\Windows\System32\PwbwOzl.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System32\SvtfQqR.exe
  C:\Windows\System32\SvtfQqR.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System32\nWmzKAk.exe
  C:\Windows\System32\nWmzKAk.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System32\deanQtS.exe
  C:\Windows\System32\deanQtS.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System32\NmnzBif.exe
  C:\Windows\System32\NmnzBif.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System32\NUExeAi.exe
  C:\Windows\System32\NUExeAi.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System32\KTFYgvZ.exe
  C:\Windows\System32\KTFYgvZ.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System32\liCFxSn.exe
  C:\Windows\System32\liCFxSn.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System32\XpoPQJL.exe
  C:\Windows\System32\XpoPQJL.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System32\meDpfqf.exe
  C:\Windows\System32\meDpfqf.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System32\PMlFODs.exe
  C:\Windows\System32\PMlFODs.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System32\QZGPUBU.exe
  C:\Windows\System32\QZGPUBU.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System32\kKlpDJL.exe
  C:\Windows\System32\kKlpDJL.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System32\yxKZPxn.exe
  C:\Windows\System32\yxKZPxn.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System32\csiBnrK.exe
  C:\Windows\System32\csiBnrK.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System32\XNGTEoG.exe
  C:\Windows\System32\XNGTEoG.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System32\OkQAfyk.exe
  C:\Windows\System32\OkQAfyk.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System32\UrzlHor.exe
  C:\Windows\System32\UrzlHor.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System32\mWAdmWU.exe
  C:\Windows\System32\mWAdmWU.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System32\pRkLwFK.exe
  C:\Windows\System32\pRkLwFK.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System32\FetjgUm.exe
  C:\Windows\System32\FetjgUm.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System32\pevEclL.exe
  C:\Windows\System32\pevEclL.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System32\ZbjqYES.exe
  C:\Windows\System32\ZbjqYES.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System32\WTIrScg.exe
  C:\Windows\System32\WTIrScg.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System32\aemNNHO.exe
  C:\Windows\System32\aemNNHO.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System32\BdufTrV.exe
  C:\Windows\System32\BdufTrV.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System32\KfqgohD.exe
  C:\Windows\System32\KfqgohD.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System32\IAZqvcu.exe
  C:\Windows\System32\IAZqvcu.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System32\DrLJifK.exe
  C:\Windows\System32\DrLJifK.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System32\WUxQrnU.exe
  C:\Windows\System32\WUxQrnU.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System32\eUWjWlz.exe
  C:\Windows\System32\eUWjWlz.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System32\mXJxokn.exe
  C:\Windows\System32\mXJxokn.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System32\AkQzdWX.exe
  C:\Windows\System32\AkQzdWX.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System32\QJmgWjQ.exe
  C:\Windows\System32\QJmgWjQ.exe
  2⤵
  PID:3236
- C:\Windows\System32\JXCdSms.exe
  C:\Windows\System32\JXCdSms.exe
  2⤵
  PID:2580
- C:\Windows\System32\iiDyVGf.exe
  C:\Windows\System32\iiDyVGf.exe
  2⤵
  PID:4016
- C:\Windows\System32\ynNpRCp.exe
  C:\Windows\System32\ynNpRCp.exe
  2⤵
  PID:4620
- C:\Windows\System32\ClYAyRu.exe
  C:\Windows\System32\ClYAyRu.exe
  2⤵
  PID:4860
- C:\Windows\System32\oTcojMt.exe
  C:\Windows\System32\oTcojMt.exe
  2⤵
  PID:3600
- C:\Windows\System32\IMTXJtE.exe
  C:\Windows\System32\IMTXJtE.exe
  2⤵
  PID:676
- C:\Windows\System32\FaDdaHB.exe
  C:\Windows\System32\FaDdaHB.exe
  2⤵
  PID:532
- C:\Windows\System32\tnHmJjn.exe
  C:\Windows\System32\tnHmJjn.exe
  2⤵
  PID:1488
- C:\Windows\System32\gdBUQfT.exe
  C:\Windows\System32\gdBUQfT.exe
  2⤵
  PID:1556
- C:\Windows\System32\bQtWRNZ.exe
  C:\Windows\System32\bQtWRNZ.exe
  2⤵
  PID:1752
- C:\Windows\System32\kGzxGhf.exe
  C:\Windows\System32\kGzxGhf.exe
  2⤵
  PID:2824
- C:\Windows\System32\XYBCTDf.exe
  C:\Windows\System32\XYBCTDf.exe
  2⤵
  PID:4700
- C:\Windows\System32\yIEWZOF.exe
  C:\Windows\System32\yIEWZOF.exe
  2⤵
  PID:448
- C:\Windows\System32\NCQEtnQ.exe
  C:\Windows\System32\NCQEtnQ.exe
  2⤵
  PID:3316
- C:\Windows\System32\FqCrOMD.exe
  C:\Windows\System32\FqCrOMD.exe
  2⤵
  PID:3164
- C:\Windows\System32\XKlDKwd.exe
  C:\Windows\System32\XKlDKwd.exe
  2⤵
  PID:3604
- C:\Windows\System32\xvrAKJg.exe
  C:\Windows\System32\xvrAKJg.exe
  2⤵
  PID:656
- C:\Windows\System32\DpqcGgx.exe
  C:\Windows\System32\DpqcGgx.exe
  2⤵
  PID:1380
- C:\Windows\System32\lZyoagc.exe
  C:\Windows\System32\lZyoagc.exe
  2⤵
  PID:1668
- C:\Windows\System32\ngjuSIa.exe
  C:\Windows\System32\ngjuSIa.exe
  2⤵
  PID:4224
- C:\Windows\System32\wogSIwV.exe
  C:\Windows\System32\wogSIwV.exe
  2⤵
  PID:1444
- C:\Windows\System32\eINdAtZ.exe
  C:\Windows\System32\eINdAtZ.exe
  2⤵
  PID:4680
- C:\Windows\System32\VydUHmB.exe
  C:\Windows\System32\VydUHmB.exe
  2⤵
  PID:2220
- C:\Windows\System32\TTbRgfq.exe
  C:\Windows\System32\TTbRgfq.exe
  2⤵
  PID:1792
- C:\Windows\System32\zwNBofV.exe
  C:\Windows\System32\zwNBofV.exe
  2⤵
  PID:4112
- C:\Windows\System32\CXpjHhW.exe
  C:\Windows\System32\CXpjHhW.exe
  2⤵
  PID:5148
- C:\Windows\System32\foCnIFs.exe
  C:\Windows\System32\foCnIFs.exe
  2⤵
  PID:5176
- C:\Windows\System32\QXXLfCp.exe
  C:\Windows\System32\QXXLfCp.exe
  2⤵
  PID:5204
- C:\Windows\System32\icPnKRP.exe
  C:\Windows\System32\icPnKRP.exe
  2⤵
  PID:5232
- C:\Windows\System32\WVeYJic.exe
  C:\Windows\System32\WVeYJic.exe
  2⤵
  PID:5260
- C:\Windows\System32\qGdNoKi.exe
  C:\Windows\System32\qGdNoKi.exe
  2⤵
  PID:5288
- C:\Windows\System32\ZVzAOTn.exe
  C:\Windows\System32\ZVzAOTn.exe
  2⤵
  PID:5316
- C:\Windows\System32\hHNWLae.exe
  C:\Windows\System32\hHNWLae.exe
  2⤵
  PID:5344
- C:\Windows\System32\YUVkPCv.exe
  C:\Windows\System32\YUVkPCv.exe
  2⤵
  PID:5384
- C:\Windows\System32\ezAjTRT.exe
  C:\Windows\System32\ezAjTRT.exe
  2⤵
  PID:5400
- C:\Windows\System32\hRQqkUr.exe
  C:\Windows\System32\hRQqkUr.exe
  2⤵
  PID:5424
- C:\Windows\System32\uqdGAIJ.exe
  C:\Windows\System32\uqdGAIJ.exe
  2⤵
  PID:5456
- C:\Windows\System32\wfSkbHU.exe
  C:\Windows\System32\wfSkbHU.exe
  2⤵
  PID:5484
- C:\Windows\System32\UPspGbo.exe
  C:\Windows\System32\UPspGbo.exe
  2⤵
  PID:5512
- C:\Windows\System32\PLyjefo.exe
  C:\Windows\System32\PLyjefo.exe
  2⤵
  PID:5552
- C:\Windows\System32\FyadzcN.exe
  C:\Windows\System32\FyadzcN.exe
  2⤵
  PID:5568
- C:\Windows\System32\PJHwrTs.exe
  C:\Windows\System32\PJHwrTs.exe
  2⤵
  PID:5596
- C:\Windows\System32\DjicyeF.exe
  C:\Windows\System32\DjicyeF.exe
  2⤵
  PID:5624
- C:\Windows\System32\OzgXkcF.exe
  C:\Windows\System32\OzgXkcF.exe
  2⤵
  PID:5652
- C:\Windows\System32\wYZTPQa.exe
  C:\Windows\System32\wYZTPQa.exe
  2⤵
  PID:5680
- C:\Windows\System32\VPxQpAs.exe
  C:\Windows\System32\VPxQpAs.exe
  2⤵
  PID:5704
- C:\Windows\System32\KDgLTXm.exe
  C:\Windows\System32\KDgLTXm.exe
  2⤵
  PID:5736
- C:\Windows\System32\bZXSsJq.exe
  C:\Windows\System32\bZXSsJq.exe
  2⤵
  PID:5776
- C:\Windows\System32\XrZmNpd.exe
  C:\Windows\System32\XrZmNpd.exe
  2⤵
  PID:5792
- C:\Windows\System32\hViMvYI.exe
  C:\Windows\System32\hViMvYI.exe
  2⤵
  PID:5816
- C:\Windows\System32\BgaSHgt.exe
  C:\Windows\System32\BgaSHgt.exe
  2⤵
  PID:5848
- C:\Windows\System32\PWvBSIy.exe
  C:\Windows\System32\PWvBSIy.exe
  2⤵
  PID:5876
- C:\Windows\System32\ptNYXFe.exe
  C:\Windows\System32\ptNYXFe.exe
  2⤵
  PID:5904
- C:\Windows\System32\rdUjAOn.exe
  C:\Windows\System32\rdUjAOn.exe
  2⤵
  PID:5932
- C:\Windows\System32\KkPrBJb.exe
  C:\Windows\System32\KkPrBJb.exe
  2⤵
  PID:5960
- C:\Windows\System32\nuMOypj.exe
  C:\Windows\System32\nuMOypj.exe
  2⤵
  PID:5988
- C:\Windows\System32\cuWaHzk.exe
  C:\Windows\System32\cuWaHzk.exe
  2⤵
  PID:6016
- C:\Windows\System32\PRnZoru.exe
  C:\Windows\System32\PRnZoru.exe
  2⤵
  PID:6052
- C:\Windows\System32\DgrppEq.exe
  C:\Windows\System32\DgrppEq.exe
  2⤵
  PID:6072
- C:\Windows\System32\tGEAZSa.exe
  C:\Windows\System32\tGEAZSa.exe
  2⤵
  PID:6100
- C:\Windows\System32\AIlfOLW.exe
  C:\Windows\System32\AIlfOLW.exe
  2⤵
  PID:6128
- C:\Windows\System32\hsPTPbC.exe
  C:\Windows\System32\hsPTPbC.exe
  2⤵
  PID:2044
- C:\Windows\System32\lNQtGNY.exe
  C:\Windows\System32\lNQtGNY.exe
  2⤵
  PID:2584
- C:\Windows\System32\ifnPAtm.exe
  C:\Windows\System32\ifnPAtm.exe
  2⤵
  PID:1788
- C:\Windows\System32\SeFAYmW.exe
  C:\Windows\System32\SeFAYmW.exe
  2⤵
  PID:4520
- C:\Windows\System32\IBajFap.exe
  C:\Windows\System32\IBajFap.exe
  2⤵
  PID:4776
- C:\Windows\System32\aNEwnOF.exe
  C:\Windows\System32\aNEwnOF.exe
  2⤵
  PID:5132
- C:\Windows\System32\gOjjSBl.exe
  C:\Windows\System32\gOjjSBl.exe
  2⤵
  PID:5196
- C:\Windows\System32\DmrJvvY.exe
  C:\Windows\System32\DmrJvvY.exe
  2⤵
  PID:5280
- C:\Windows\System32\PUwyRuz.exe
  C:\Windows\System32\PUwyRuz.exe
  2⤵
  PID:5328
- C:\Windows\System32\GVLLRgU.exe
  C:\Windows\System32\GVLLRgU.exe
  2⤵
  PID:5420
- C:\Windows\System32\qevEWHd.exe
  C:\Windows\System32\qevEWHd.exe
  2⤵
  PID:5464
- C:\Windows\System32\FqxTkUT.exe
  C:\Windows\System32\FqxTkUT.exe
  2⤵
  PID:5544
- C:\Windows\System32\wXLEfHo.exe
  C:\Windows\System32\wXLEfHo.exe
  2⤵
  PID:5588
- C:\Windows\System32\QNJRuFH.exe
  C:\Windows\System32\QNJRuFH.exe
  2⤵
  PID:5660
- C:\Windows\System32\LQCYZxu.exe
  C:\Windows\System32\LQCYZxu.exe
  2⤵
  PID:5720
- C:\Windows\System32\HSJNfKg.exe
  C:\Windows\System32\HSJNfKg.exe
  2⤵
  PID:5788
- C:\Windows\System32\DkekpAC.exe
  C:\Windows\System32\DkekpAC.exe
  2⤵
  PID:5868
- C:\Windows\System32\KsnrBtN.exe
  C:\Windows\System32\KsnrBtN.exe
  2⤵
  PID:5916
- C:\Windows\System32\VrlTCGw.exe
  C:\Windows\System32\VrlTCGw.exe
  2⤵
  PID:5980
- C:\Windows\System32\klklJBK.exe
  C:\Windows\System32\klklJBK.exe
  2⤵
  PID:6024
- C:\Windows\System32\CdgxpBM.exe
  C:\Windows\System32\CdgxpBM.exe
  2⤵
  PID:6108
- C:\Windows\System32\HnSZFpk.exe
  C:\Windows\System32\HnSZFpk.exe
  2⤵
  PID:4452
- C:\Windows\System32\rvdlrwY.exe
  C:\Windows\System32\rvdlrwY.exe
  2⤵
  PID:3356
- C:\Windows\System32\qKtouOF.exe
  C:\Windows\System32\qKtouOF.exe
  2⤵
  PID:5160
- C:\Windows\System32\TABBjOn.exe
  C:\Windows\System32\TABBjOn.exe
  2⤵
  PID:5272
- C:\Windows\System32\YSSrcjX.exe
  C:\Windows\System32\YSSrcjX.exe
  2⤵
  PID:5476
- C:\Windows\System32\pmeJsBz.exe
  C:\Windows\System32\pmeJsBz.exe
  2⤵
  PID:5616
- C:\Windows\System32\nuSmCWl.exe
  C:\Windows\System32\nuSmCWl.exe
  2⤵
  PID:5748
- C:\Windows\System32\jLCDjYO.exe
  C:\Windows\System32\jLCDjYO.exe
  2⤵
  PID:5940
- C:\Windows\System32\UHXgpCe.exe
  C:\Windows\System32\UHXgpCe.exe
  2⤵
  PID:4172
- C:\Windows\System32\emiWhAM.exe
  C:\Windows\System32\emiWhAM.exe
  2⤵
  PID:6168
- C:\Windows\System32\IqcYHKY.exe
  C:\Windows\System32\IqcYHKY.exe
  2⤵
  PID:6196
- C:\Windows\System32\UeWhQTz.exe
  C:\Windows\System32\UeWhQTz.exe
  2⤵
  PID:6224
- C:\Windows\System32\BmTNnGm.exe
  C:\Windows\System32\BmTNnGm.exe
  2⤵
  PID:6252
- C:\Windows\System32\tIvyPap.exe
  C:\Windows\System32\tIvyPap.exe
  2⤵
  PID:6280
- C:\Windows\System32\BXVyBdx.exe
  C:\Windows\System32\BXVyBdx.exe
  2⤵
  PID:6308
- C:\Windows\System32\acISjsW.exe
  C:\Windows\System32\acISjsW.exe
  2⤵
  PID:6336
- C:\Windows\System32\tRKFsOs.exe
  C:\Windows\System32\tRKFsOs.exe
  2⤵
  PID:6364
- C:\Windows\System32\xlBrQxV.exe
  C:\Windows\System32\xlBrQxV.exe
  2⤵
  PID:6404
- C:\Windows\System32\vJHPPok.exe
  C:\Windows\System32\vJHPPok.exe
  2⤵
  PID:6420
- C:\Windows\System32\AlEYEWG.exe
  C:\Windows\System32\AlEYEWG.exe
  2⤵
  PID:6444
- C:\Windows\System32\IQsmeac.exe
  C:\Windows\System32\IQsmeac.exe
  2⤵
  PID:6476
- C:\Windows\System32\Rcvmcfg.exe
  C:\Windows\System32\Rcvmcfg.exe
  2⤵
  PID:6504
- C:\Windows\System32\LSQFyVw.exe
  C:\Windows\System32\LSQFyVw.exe
  2⤵
  PID:6532
- C:\Windows\System32\usrszlq.exe
  C:\Windows\System32\usrszlq.exe
  2⤵
  PID:6560
- C:\Windows\System32\HMxQwxr.exe
  C:\Windows\System32\HMxQwxr.exe
  2⤵
  PID:6588
- C:\Windows\System32\dYBdCMG.exe
  C:\Windows\System32\dYBdCMG.exe
  2⤵
  PID:6628
- C:\Windows\System32\OwvHybD.exe
  C:\Windows\System32\OwvHybD.exe
  2⤵
  PID:6644
- C:\Windows\System32\xxifNqe.exe
  C:\Windows\System32\xxifNqe.exe
  2⤵
  PID:6668
- C:\Windows\System32\FcEdVML.exe
  C:\Windows\System32\FcEdVML.exe
  2⤵
  PID:6700
- C:\Windows\System32\nOCRUMV.exe
  C:\Windows\System32\nOCRUMV.exe
  2⤵
  PID:6728
- C:\Windows\System32\OTpOIfI.exe
  C:\Windows\System32\OTpOIfI.exe
  2⤵
  PID:6756
- C:\Windows\System32\QPQYiMd.exe
  C:\Windows\System32\QPQYiMd.exe
  2⤵
  PID:6784
- C:\Windows\System32\GvxiGng.exe
  C:\Windows\System32\GvxiGng.exe
  2⤵
  PID:6812
- C:\Windows\System32\RUkBeEL.exe
  C:\Windows\System32\RUkBeEL.exe
  2⤵
  PID:6840
- C:\Windows\System32\yTdJltX.exe
  C:\Windows\System32\yTdJltX.exe
  2⤵
  PID:6868
- C:\Windows\System32\wLVARWb.exe
  C:\Windows\System32\wLVARWb.exe
  2⤵
  PID:6904
- C:\Windows\System32\tJgyqYK.exe
  C:\Windows\System32\tJgyqYK.exe
  2⤵
  PID:6924
- C:\Windows\System32\KXxLQSR.exe
  C:\Windows\System32\KXxLQSR.exe
  2⤵
  PID:6952
- C:\Windows\System32\erSMsOs.exe
  C:\Windows\System32\erSMsOs.exe
  2⤵
  PID:6980
- C:\Windows\System32\BYafyaV.exe
  C:\Windows\System32\BYafyaV.exe
  2⤵
  PID:7020
- C:\Windows\System32\tdCvnTi.exe
  C:\Windows\System32\tdCvnTi.exe
  2⤵
  PID:7036
- C:\Windows\System32\rXqPwmW.exe
  C:\Windows\System32\rXqPwmW.exe
  2⤵
  PID:7064
- C:\Windows\System32\HlWIRHF.exe
  C:\Windows\System32\HlWIRHF.exe
  2⤵
  PID:7092
- C:\Windows\System32\uCXeShY.exe
  C:\Windows\System32\uCXeShY.exe
  2⤵
  PID:7120
- C:\Windows\System32\WxETkVH.exe
  C:\Windows\System32\WxETkVH.exe
  2⤵
  PID:7148
- C:\Windows\System32\wGqVIiA.exe
  C:\Windows\System32\wGqVIiA.exe
  2⤵
  PID:6120
- C:\Windows\System32\yvRfLDr.exe
  C:\Windows\System32\yvRfLDr.exe
  2⤵
  PID:1152
- C:\Windows\System32\ajlUeeN.exe
  C:\Windows\System32\ajlUeeN.exe
  2⤵
  PID:5448
- C:\Windows\System32\DbmtAwe.exe
  C:\Windows\System32\DbmtAwe.exe
  2⤵
  PID:5804
- C:\Windows\System32\yVqZQuD.exe
  C:\Windows\System32\yVqZQuD.exe
  2⤵
  PID:6152
- C:\Windows\System32\mSEgqUk.exe
  C:\Windows\System32\mSEgqUk.exe
  2⤵
  PID:6204
- C:\Windows\System32\gsUHHUL.exe
  C:\Windows\System32\gsUHHUL.exe
  2⤵
  PID:6272
- C:\Windows\System32\FQrQdxw.exe
  C:\Windows\System32\FQrQdxw.exe
  2⤵
  PID:6328
- C:\Windows\System32\wNJZSvg.exe
  C:\Windows\System32\wNJZSvg.exe
  2⤵
  PID:6396
- C:\Windows\System32\QyEpteJ.exe
  C:\Windows\System32\QyEpteJ.exe
  2⤵
  PID:6452
- C:\Windows\System32\hdySSZV.exe
  C:\Windows\System32\hdySSZV.exe
  2⤵
  PID:6544
- C:\Windows\System32\gxFKqbL.exe
  C:\Windows\System32\gxFKqbL.exe
  2⤵
  PID:6568
- C:\Windows\System32\xKEGnno.exe
  C:\Windows\System32\xKEGnno.exe
  2⤵
  PID:6640
- C:\Windows\System32\tFAywxf.exe
  C:\Windows\System32\tFAywxf.exe
  2⤵
  PID:6720
- C:\Windows\System32\JjWKlgc.exe
  C:\Windows\System32\JjWKlgc.exe
  2⤵
  PID:6736
- C:\Windows\System32\qYRTVmI.exe
  C:\Windows\System32\qYRTVmI.exe
  2⤵
  PID:6792
- C:\Windows\System32\HuvkJDg.exe
  C:\Windows\System32\HuvkJDg.exe
  2⤵
  PID:6876
- C:\Windows\System32\riQEWWn.exe
  C:\Windows\System32\riQEWWn.exe
  2⤵
  PID:6944
- C:\Windows\System32\hpmBxMG.exe
  C:\Windows\System32\hpmBxMG.exe
  2⤵
  PID:7012
- C:\Windows\System32\imEQGZT.exe
  C:\Windows\System32\imEQGZT.exe
  2⤵
  PID:7048
- C:\Windows\System32\itITGwF.exe
  C:\Windows\System32\itITGwF.exe
  2⤵
  PID:7104
- C:\Windows\System32\KttzMTS.exe
  C:\Windows\System32\KttzMTS.exe
  2⤵
  PID:6068
- C:\Windows\System32\VVQHhqE.exe
  C:\Windows\System32\VVQHhqE.exe
  2⤵
  PID:5688
- C:\Windows\System32\rQjxhcz.exe
  C:\Windows\System32\rQjxhcz.exe
  2⤵
  PID:6176
- C:\Windows\System32\VlMLUBn.exe
  C:\Windows\System32\VlMLUBn.exe
  2⤵
  PID:6292
- C:\Windows\System32\KGwuugk.exe
  C:\Windows\System32\KGwuugk.exe
  2⤵
  PID:6416
- C:\Windows\System32\HRLfUgL.exe
  C:\Windows\System32\HRLfUgL.exe
  2⤵
  PID:6596
- C:\Windows\System32\uDnrIVY.exe
  C:\Windows\System32\uDnrIVY.exe
  2⤵
  PID:4904
- C:\Windows\System32\zQMhZSl.exe
  C:\Windows\System32\zQMhZSl.exe
  2⤵
  PID:6832
- C:\Windows\System32\vhCWQdB.exe
  C:\Windows\System32\vhCWQdB.exe
  2⤵
  PID:6972
- C:\Windows\System32\XABzCSC.exe
  C:\Windows\System32\XABzCSC.exe
  2⤵
  PID:7156
- C:\Windows\System32\XBNkfDB.exe
  C:\Windows\System32\XBNkfDB.exe
  2⤵
  PID:6136
- C:\Windows\System32\Kzhrros.exe
  C:\Windows\System32\Kzhrros.exe
  2⤵
  PID:6344
- C:\Windows\System32\Vyhohgr.exe
  C:\Windows\System32\Vyhohgr.exe
  2⤵
  PID:7192
- C:\Windows\System32\QHHjcDe.exe
  C:\Windows\System32\QHHjcDe.exe
  2⤵
  PID:7220
- C:\Windows\System32\oPnZVSQ.exe
  C:\Windows\System32\oPnZVSQ.exe
  2⤵
  PID:7248
- C:\Windows\System32\zzOnUuu.exe
  C:\Windows\System32\zzOnUuu.exe
  2⤵
  PID:7276
- C:\Windows\System32\UhPUmLc.exe
  C:\Windows\System32\UhPUmLc.exe
  2⤵
  PID:7304
- C:\Windows\System32\GUAVEsM.exe
  C:\Windows\System32\GUAVEsM.exe
  2⤵
  PID:7332
- C:\Windows\System32\zcpLbNZ.exe
  C:\Windows\System32\zcpLbNZ.exe
  2⤵
  PID:7360
- C:\Windows\System32\geubGKJ.exe
  C:\Windows\System32\geubGKJ.exe
  2⤵
  PID:7388
- C:\Windows\System32\MCutKDK.exe
  C:\Windows\System32\MCutKDK.exe
  2⤵
  PID:7416
- C:\Windows\System32\gFcAcIm.exe
  C:\Windows\System32\gFcAcIm.exe
  2⤵
  PID:7444
- C:\Windows\System32\UeieFHR.exe
  C:\Windows\System32\UeieFHR.exe
  2⤵
  PID:7472
- C:\Windows\System32\XcPXBpQ.exe
  C:\Windows\System32\XcPXBpQ.exe
  2⤵
  PID:7500
- C:\Windows\System32\EhXVFiE.exe
  C:\Windows\System32\EhXVFiE.exe
  2⤵
  PID:7528
- C:\Windows\System32\zUhDkDw.exe
  C:\Windows\System32\zUhDkDw.exe
  2⤵
  PID:7556
- C:\Windows\System32\nkgKThp.exe
  C:\Windows\System32\nkgKThp.exe
  2⤵
  PID:7584
- C:\Windows\System32\dpzlHug.exe
  C:\Windows\System32\dpzlHug.exe
  2⤵
  PID:7612
- C:\Windows\System32\MROFlvW.exe
  C:\Windows\System32\MROFlvW.exe
  2⤵
  PID:7640
- C:\Windows\System32\SsisHhb.exe
  C:\Windows\System32\SsisHhb.exe
  2⤵
  PID:7668
- C:\Windows\System32\AWuEzYA.exe
  C:\Windows\System32\AWuEzYA.exe
  2⤵
  PID:7696
- C:\Windows\System32\BJBtTga.exe
  C:\Windows\System32\BJBtTga.exe
  2⤵
  PID:7724
- C:\Windows\System32\YyQDajY.exe
  C:\Windows\System32\YyQDajY.exe
  2⤵
  PID:7752
- C:\Windows\System32\PqBPcxf.exe
  C:\Windows\System32\PqBPcxf.exe
  2⤵
  PID:7780
- C:\Windows\System32\nJOLkHL.exe
  C:\Windows\System32\nJOLkHL.exe
  2⤵
  PID:7808
- C:\Windows\System32\uhfhpRU.exe
  C:\Windows\System32\uhfhpRU.exe
  2⤵
  PID:7836
- C:\Windows\System32\WDiGedG.exe
  C:\Windows\System32\WDiGedG.exe
  2⤵
  PID:7920
- C:\Windows\System32\DipVGqt.exe
  C:\Windows\System32\DipVGqt.exe
  2⤵
  PID:7940
- C:\Windows\System32\HIrzYia.exe
  C:\Windows\System32\HIrzYia.exe
  2⤵
  PID:7960
- C:\Windows\System32\omxZFHw.exe
  C:\Windows\System32\omxZFHw.exe
  2⤵
  PID:7980
- C:\Windows\System32\vaWTsGo.exe
  C:\Windows\System32\vaWTsGo.exe
  2⤵
  PID:7996
- C:\Windows\System32\HQxXgOX.exe
  C:\Windows\System32\HQxXgOX.exe
  2⤵
  PID:8036
- C:\Windows\System32\abkhzqc.exe
  C:\Windows\System32\abkhzqc.exe
  2⤵
  PID:8068
- C:\Windows\System32\cCHwgpb.exe
  C:\Windows\System32\cCHwgpb.exe
  2⤵
  PID:8092
- C:\Windows\System32\trEBbQa.exe
  C:\Windows\System32\trEBbQa.exe
  2⤵
  PID:8108
- C:\Windows\System32\fPAtrzr.exe
  C:\Windows\System32\fPAtrzr.exe
  2⤵
  PID:8140
- C:\Windows\System32\ZNNUoNG.exe
  C:\Windows\System32\ZNNUoNG.exe
  2⤵
  PID:8160
- C:\Windows\System32\yPlXHEL.exe
  C:\Windows\System32\yPlXHEL.exe
  2⤵
  PID:4572
- C:\Windows\System32\quPIrgM.exe
  C:\Windows\System32\quPIrgM.exe
  2⤵
  PID:7176
- C:\Windows\System32\KxpxNOv.exe
  C:\Windows\System32\KxpxNOv.exe
  2⤵
  PID:7228
- C:\Windows\System32\oZEVPqH.exe
  C:\Windows\System32\oZEVPqH.exe
  2⤵
  PID:7260
- C:\Windows\System32\gtdvJZe.exe
  C:\Windows\System32\gtdvJZe.exe
  2⤵
  PID:1360
- C:\Windows\System32\qZUvsRm.exe
  C:\Windows\System32\qZUvsRm.exe
  2⤵
  PID:7368
- C:\Windows\System32\EylMNAE.exe
  C:\Windows\System32\EylMNAE.exe
  2⤵
  PID:7436
- C:\Windows\System32\KxQFBoj.exe
  C:\Windows\System32\KxQFBoj.exe
  2⤵
  PID:7480
- C:\Windows\System32\vfpMHOz.exe
  C:\Windows\System32\vfpMHOz.exe
  2⤵
  PID:1832
- C:\Windows\System32\oFtxcSG.exe
  C:\Windows\System32\oFtxcSG.exe
  2⤵
  PID:1804
- C:\Windows\System32\RiwxUuC.exe
  C:\Windows\System32\RiwxUuC.exe
  2⤵
  PID:3528
- C:\Windows\System32\GnDTfoi.exe
  C:\Windows\System32\GnDTfoi.exe
  2⤵
  PID:4876
- C:\Windows\System32\XJCUMuL.exe
  C:\Windows\System32\XJCUMuL.exe
  2⤵
  PID:3676
- C:\Windows\System32\dNNcLcF.exe
  C:\Windows\System32\dNNcLcF.exe
  2⤵
  PID:7708
- C:\Windows\System32\CTtJWnd.exe
  C:\Windows\System32\CTtJWnd.exe
  2⤵
  PID:4292
- C:\Windows\System32\nuUFHoD.exe
  C:\Windows\System32\nuUFHoD.exe
  2⤵
  PID:7764
- C:\Windows\System32\odHVhxL.exe
  C:\Windows\System32\odHVhxL.exe
  2⤵
  PID:1780
- C:\Windows\System32\jwGMgrX.exe
  C:\Windows\System32\jwGMgrX.exe
  2⤵
  PID:2116
- C:\Windows\System32\AGRLPYC.exe
  C:\Windows\System32\AGRLPYC.exe
  2⤵
  PID:3348
- C:\Windows\System32\ZgMyMSa.exe
  C:\Windows\System32\ZgMyMSa.exe
  2⤵
  PID:1196
- C:\Windows\System32\xikeePs.exe
  C:\Windows\System32\xikeePs.exe
  2⤵
  PID:7968
- C:\Windows\System32\UtKRKEV.exe
  C:\Windows\System32\UtKRKEV.exe
  2⤵
  PID:8020
- C:\Windows\System32\muknuEq.exe
  C:\Windows\System32\muknuEq.exe
  2⤵
  PID:8104
- C:\Windows\System32\tcFnDjq.exe
  C:\Windows\System32\tcFnDjq.exe
  2⤵
  PID:8152
- C:\Windows\System32\YdfnvJQ.exe
  C:\Windows\System32\YdfnvJQ.exe
  2⤵
  PID:8176
- C:\Windows\System32\wRquMIC.exe
  C:\Windows\System32\wRquMIC.exe
  2⤵
  PID:1760
- C:\Windows\System32\nSqOAYt.exe
  C:\Windows\System32\nSqOAYt.exe
  2⤵
  PID:7948
- C:\Windows\System32\lPLsJcd.exe
  C:\Windows\System32\lPLsJcd.exe
  2⤵
  PID:6484
- C:\Windows\System32\MLycjRe.exe
  C:\Windows\System32\MLycjRe.exe
  2⤵
  PID:7204
- C:\Windows\System32\oHcDBQb.exe
  C:\Windows\System32\oHcDBQb.exe
  2⤵
  PID:7344
- C:\Windows\System32\QFuEbWO.exe
  C:\Windows\System32\QFuEbWO.exe
  2⤵
  PID:7492
- C:\Windows\System32\xWeOhsB.exe
  C:\Windows\System32\xWeOhsB.exe
  2⤵
  PID:7592
- C:\Windows\System32\tdzaKIF.exe
  C:\Windows\System32\tdzaKIF.exe
  2⤵
  PID:7680
- C:\Windows\System32\bltYrck.exe
  C:\Windows\System32\bltYrck.exe
  2⤵
  PID:7736
- C:\Windows\System32\UjPMPpl.exe
  C:\Windows\System32\UjPMPpl.exe
  2⤵
  PID:1748
- C:\Windows\System32\hOFEBJZ.exe
  C:\Windows\System32\hOFEBJZ.exe
  2⤵
  PID:3220
- C:\Windows\System32\YYzWSDZ.exe
  C:\Windows\System32\YYzWSDZ.exe
  2⤵
  PID:8084
- C:\Windows\System32\zPAhTeZ.exe
  C:\Windows\System32\zPAhTeZ.exe
  2⤵
  PID:8120
- C:\Windows\System32\tVJLWnU.exe
  C:\Windows\System32\tVJLWnU.exe
  2⤵
  PID:8044
- C:\Windows\System32\eVpSZHs.exe
  C:\Windows\System32\eVpSZHs.exe
  2⤵
  PID:2376
- C:\Windows\System32\ReEIWaN.exe
  C:\Windows\System32\ReEIWaN.exe
  2⤵
  PID:7536
- C:\Windows\System32\cvRUCmS.exe
  C:\Windows\System32\cvRUCmS.exe
  2⤵
  PID:7772
- C:\Windows\System32\RsbtzSC.exe
  C:\Windows\System32\RsbtzSC.exe
  2⤵
  PID:432
- C:\Windows\System32\keoQbEK.exe
  C:\Windows\System32\keoQbEK.exe
  2⤵
  PID:1616
- C:\Windows\System32\jIxUxCE.exe
  C:\Windows\System32\jIxUxCE.exe
  2⤵
  PID:1700
- C:\Windows\System32\OaqwbrZ.exe
  C:\Windows\System32\OaqwbrZ.exe
  2⤵
  PID:1980
- C:\Windows\System32\TvhbQmU.exe
  C:\Windows\System32\TvhbQmU.exe
  2⤵
  PID:2460
- C:\Windows\System32\HyVYMUL.exe
  C:\Windows\System32\HyVYMUL.exe
  2⤵
  PID:8204
- C:\Windows\System32\ZtOZQBb.exe
  C:\Windows\System32\ZtOZQBb.exe
  2⤵
  PID:8236
- C:\Windows\System32\vKAPaYN.exe
  C:\Windows\System32\vKAPaYN.exe
  2⤵
  PID:8264
- C:\Windows\System32\GVDcDaC.exe
  C:\Windows\System32\GVDcDaC.exe
  2⤵
  PID:8292
- C:\Windows\System32\AvnJrDS.exe
  C:\Windows\System32\AvnJrDS.exe
  2⤵
  PID:8320
- C:\Windows\System32\jkwhRDT.exe
  C:\Windows\System32\jkwhRDT.exe
  2⤵
  PID:8340
- C:\Windows\System32\GhKEWFi.exe
  C:\Windows\System32\GhKEWFi.exe
  2⤵
  PID:8364
- C:\Windows\System32\YasejjU.exe
  C:\Windows\System32\YasejjU.exe
  2⤵
  PID:8384
- C:\Windows\System32\OvZkMrD.exe
  C:\Windows\System32\OvZkMrD.exe
  2⤵
  PID:8432
- C:\Windows\System32\oIATHJA.exe
  C:\Windows\System32\oIATHJA.exe
  2⤵
  PID:8456
- C:\Windows\System32\wQIYRLf.exe
  C:\Windows\System32\wQIYRLf.exe
  2⤵
  PID:8480
- C:\Windows\System32\eLFNpBv.exe
  C:\Windows\System32\eLFNpBv.exe
  2⤵
  PID:8504
- C:\Windows\System32\YYcWXXv.exe
  C:\Windows\System32\YYcWXXv.exe
  2⤵
  PID:8532
- C:\Windows\System32\krCUnbd.exe
  C:\Windows\System32\krCUnbd.exe
  2⤵
  PID:8572
- C:\Windows\System32\wuEgIzn.exe
  C:\Windows\System32\wuEgIzn.exe
  2⤵
  PID:8588
- C:\Windows\System32\PuYyaIT.exe
  C:\Windows\System32\PuYyaIT.exe
  2⤵
  PID:8620
- C:\Windows\System32\pQjwfZP.exe
  C:\Windows\System32\pQjwfZP.exe
  2⤵
  PID:8652
- C:\Windows\System32\NIUdjaI.exe
  C:\Windows\System32\NIUdjaI.exe
  2⤵
  PID:8676
- C:\Windows\System32\gPQuoXk.exe
  C:\Windows\System32\gPQuoXk.exe
  2⤵
  PID:8704
- C:\Windows\System32\tPxxeef.exe
  C:\Windows\System32\tPxxeef.exe
  2⤵
  PID:8736
- C:\Windows\System32\SJwRFQw.exe
  C:\Windows\System32\SJwRFQw.exe
  2⤵
  PID:8768
- C:\Windows\System32\cyISLlx.exe
  C:\Windows\System32\cyISLlx.exe
  2⤵
  PID:8800
- C:\Windows\System32\EiEsroI.exe
  C:\Windows\System32\EiEsroI.exe
  2⤵
  PID:8828
- C:\Windows\System32\yxUFiIh.exe
  C:\Windows\System32\yxUFiIh.exe
  2⤵
  PID:8856
- C:\Windows\System32\tiEaLAf.exe
  C:\Windows\System32\tiEaLAf.exe
  2⤵
  PID:8888
- C:\Windows\System32\wrflgRl.exe
  C:\Windows\System32\wrflgRl.exe
  2⤵
  PID:8908
- C:\Windows\System32\xNYpTua.exe
  C:\Windows\System32\xNYpTua.exe
  2⤵
  PID:8940
- C:\Windows\System32\KOVmmvQ.exe
  C:\Windows\System32\KOVmmvQ.exe
  2⤵
  PID:8972
- C:\Windows\System32\IRFiFzG.exe
  C:\Windows\System32\IRFiFzG.exe
  2⤵
  PID:8996
- C:\Windows\System32\oAUNxnj.exe
  C:\Windows\System32\oAUNxnj.exe
  2⤵
  PID:9024
- C:\Windows\System32\qoKLZCO.exe
  C:\Windows\System32\qoKLZCO.exe
  2⤵
  PID:9044
- C:\Windows\System32\fMjkliT.exe
  C:\Windows\System32\fMjkliT.exe
  2⤵
  PID:9072
- C:\Windows\System32\taeUkRW.exe
  C:\Windows\System32\taeUkRW.exe
  2⤵
  PID:9112
- C:\Windows\System32\hxaGpOT.exe
  C:\Windows\System32\hxaGpOT.exe
  2⤵
  PID:9136
- C:\Windows\System32\JgmfsJw.exe
  C:\Windows\System32\JgmfsJw.exe
  2⤵
  PID:9156
- C:\Windows\System32\xAsMzhE.exe
  C:\Windows\System32\xAsMzhE.exe
  2⤵
  PID:9196
- C:\Windows\System32\BoWYbYa.exe
  C:\Windows\System32\BoWYbYa.exe
  2⤵
  PID:9212
- C:\Windows\System32\nzxzcgt.exe
  C:\Windows\System32\nzxzcgt.exe
  2⤵
  PID:8260
- C:\Windows\System32\hfIdoEA.exe
  C:\Windows\System32\hfIdoEA.exe
  2⤵
  PID:8348
- C:\Windows\System32\IiluJtE.exe
  C:\Windows\System32\IiluJtE.exe
  2⤵
  PID:8400
- C:\Windows\System32\xtBBZnt.exe
  C:\Windows\System32\xtBBZnt.exe
  2⤵
  PID:8448
- C:\Windows\System32\ckiNpZt.exe
  C:\Windows\System32\ckiNpZt.exe
  2⤵
  PID:8516
- C:\Windows\System32\KdVknkv.exe
  C:\Windows\System32\KdVknkv.exe
  2⤵
  PID:8628
- C:\Windows\System32\QdZnVoI.exe
  C:\Windows\System32\QdZnVoI.exe
  2⤵
  PID:8684
- C:\Windows\System32\tslbkhf.exe
  C:\Windows\System32\tslbkhf.exe
  2⤵
  PID:8752
- C:\Windows\System32\UwcMVYF.exe
  C:\Windows\System32\UwcMVYF.exe
  2⤵
  PID:8808
- C:\Windows\System32\CHElXMx.exe
  C:\Windows\System32\CHElXMx.exe
  2⤵
  PID:8868
- C:\Windows\System32\bCWcGef.exe
  C:\Windows\System32\bCWcGef.exe
  2⤵
  PID:8960
- C:\Windows\System32\nReJkVN.exe
  C:\Windows\System32\nReJkVN.exe
  2⤵
  PID:8992
- C:\Windows\System32\GgUSkWC.exe
  C:\Windows\System32\GgUSkWC.exe
  2⤵
  PID:9060
- C:\Windows\System32\geNZgMc.exe
  C:\Windows\System32\geNZgMc.exe
  2⤵
  PID:9148
- C:\Windows\System32\DjPZxdT.exe
  C:\Windows\System32\DjPZxdT.exe
  2⤵
  PID:7288
- C:\Windows\System32\LkRQgBv.exe
  C:\Windows\System32\LkRQgBv.exe
  2⤵
  PID:8276
- C:\Windows\System32\ZzDeuDG.exe
  C:\Windows\System32\ZzDeuDG.exe
  2⤵
  PID:8496
- C:\Windows\System32\uISwVBn.exe
  C:\Windows\System32\uISwVBn.exe
  2⤵
  PID:8668
- C:\Windows\System32\FvqyOXA.exe
  C:\Windows\System32\FvqyOXA.exe
  2⤵
  PID:8820
- C:\Windows\System32\SYzHpey.exe
  C:\Windows\System32\SYzHpey.exe
  2⤵
  PID:8980
- C:\Windows\System32\ZbqVfoI.exe
  C:\Windows\System32\ZbqVfoI.exe
  2⤵
  PID:9120
- C:\Windows\System32\pyllnqH.exe
  C:\Windows\System32\pyllnqH.exe
  2⤵
  PID:9188
- C:\Windows\System32\AIPJUUI.exe
  C:\Windows\System32\AIPJUUI.exe
  2⤵
  PID:7988
- C:\Windows\System32\kLYxEGp.exe
  C:\Windows\System32\kLYxEGp.exe
  2⤵
  PID:8896
- C:\Windows\System32\fsCzKVQ.exe
  C:\Windows\System32\fsCzKVQ.exe
  2⤵
  PID:8372
- C:\Windows\System32\GCLbuDr.exe
  C:\Windows\System32\GCLbuDr.exe
  2⤵
  PID:4332
- C:\Windows\System32\jJHPLwK.exe
  C:\Windows\System32\jJHPLwK.exe
  2⤵
  PID:8244
- C:\Windows\System32\ArnlfHz.exe
  C:\Windows\System32\ArnlfHz.exe
  2⤵
  PID:9236
- C:\Windows\System32\boLUPTr.exe
  C:\Windows\System32\boLUPTr.exe
  2⤵
  PID:9276
- C:\Windows\System32\jSPkmLW.exe
  C:\Windows\System32\jSPkmLW.exe
  2⤵
  PID:9308
- C:\Windows\System32\XZfmmXa.exe
  C:\Windows\System32\XZfmmXa.exe
  2⤵
  PID:9328
- C:\Windows\System32\sXgSQgE.exe
  C:\Windows\System32\sXgSQgE.exe
  2⤵
  PID:9372
- C:\Windows\System32\aXjbIzG.exe
  C:\Windows\System32\aXjbIzG.exe
  2⤵
  PID:9400
- C:\Windows\System32\lDqxipA.exe
  C:\Windows\System32\lDqxipA.exe
  2⤵
  PID:9428
- C:\Windows\System32\cxjDQAA.exe
  C:\Windows\System32\cxjDQAA.exe
  2⤵
  PID:9464
- C:\Windows\System32\zuCfMHn.exe
  C:\Windows\System32\zuCfMHn.exe
  2⤵
  PID:9484
- C:\Windows\System32\HMmtRbX.exe
  C:\Windows\System32\HMmtRbX.exe
  2⤵
  PID:9512
- C:\Windows\System32\uXLqyfH.exe
  C:\Windows\System32\uXLqyfH.exe
  2⤵
  PID:9540
- C:\Windows\System32\xuHtayy.exe
  C:\Windows\System32\xuHtayy.exe
  2⤵
  PID:9568
- C:\Windows\System32\OIULoSB.exe
  C:\Windows\System32\OIULoSB.exe
  2⤵
  PID:9596
- C:\Windows\System32\SUgmVck.exe
  C:\Windows\System32\SUgmVck.exe
  2⤵
  PID:9624
- C:\Windows\System32\tPotiRq.exe
  C:\Windows\System32\tPotiRq.exe
  2⤵
  PID:9652
- C:\Windows\System32\VAzqjCZ.exe
  C:\Windows\System32\VAzqjCZ.exe
  2⤵
  PID:9680
- C:\Windows\System32\xQnuuPA.exe
  C:\Windows\System32\xQnuuPA.exe
  2⤵
  PID:9708
- C:\Windows\System32\gnjWFFE.exe
  C:\Windows\System32\gnjWFFE.exe
  2⤵
  PID:9736
- C:\Windows\System32\LEDulYE.exe
  C:\Windows\System32\LEDulYE.exe
  2⤵
  PID:9764
- C:\Windows\System32\ZROjqtv.exe
  C:\Windows\System32\ZROjqtv.exe
  2⤵
  PID:9792
- C:\Windows\System32\TzVVxvn.exe
  C:\Windows\System32\TzVVxvn.exe
  2⤵
  PID:9820
- C:\Windows\System32\yccvUwg.exe
  C:\Windows\System32\yccvUwg.exe
  2⤵
  PID:9848
- C:\Windows\System32\waltYnR.exe
  C:\Windows\System32\waltYnR.exe
  2⤵
  PID:9876
- C:\Windows\System32\sjMqkRs.exe
  C:\Windows\System32\sjMqkRs.exe
  2⤵
  PID:9904
- C:\Windows\System32\BYGcUGs.exe
  C:\Windows\System32\BYGcUGs.exe
  2⤵
  PID:9932
- C:\Windows\System32\ENRmOuN.exe
  C:\Windows\System32\ENRmOuN.exe
  2⤵
  PID:9960
- C:\Windows\System32\Cxtexxt.exe
  C:\Windows\System32\Cxtexxt.exe
  2⤵
  PID:9988
- C:\Windows\System32\wvchzqa.exe
  C:\Windows\System32\wvchzqa.exe
  2⤵
  PID:10016
- C:\Windows\System32\OJYEouw.exe
  C:\Windows\System32\OJYEouw.exe
  2⤵
  PID:10044
- C:\Windows\System32\mAUbaPy.exe
  C:\Windows\System32\mAUbaPy.exe
  2⤵
  PID:10072
- C:\Windows\System32\uVnJJpA.exe
  C:\Windows\System32\uVnJJpA.exe
  2⤵
  PID:10100
- C:\Windows\System32\HbZHcvm.exe
  C:\Windows\System32\HbZHcvm.exe
  2⤵
  PID:10128
- C:\Windows\System32\YrfMHti.exe
  C:\Windows\System32\YrfMHti.exe
  2⤵
  PID:10156
- C:\Windows\System32\hGFPXQq.exe
  C:\Windows\System32\hGFPXQq.exe
  2⤵
  PID:10184
- C:\Windows\System32\MZAzXut.exe
  C:\Windows\System32\MZAzXut.exe
  2⤵
  PID:10212
- C:\Windows\System32\OidbvAi.exe
  C:\Windows\System32\OidbvAi.exe
  2⤵
  PID:9224
- C:\Windows\System32\tyXEAHk.exe
  C:\Windows\System32\tyXEAHk.exe
  2⤵
  PID:9284
- C:\Windows\System32\WwFaRoS.exe
  C:\Windows\System32\WwFaRoS.exe
  2⤵
  PID:9348
- C:\Windows\System32\pEzfnZZ.exe
  C:\Windows\System32\pEzfnZZ.exe
  2⤵
  PID:9420
- C:\Windows\System32\qMWRpjo.exe
  C:\Windows\System32\qMWRpjo.exe
  2⤵
  PID:9452
- C:\Windows\System32\WrDRlKf.exe
  C:\Windows\System32\WrDRlKf.exe
  2⤵
  PID:9524
- C:\Windows\System32\juZrgFR.exe
  C:\Windows\System32\juZrgFR.exe
  2⤵
  PID:9588
- C:\Windows\System32\ZquntgJ.exe
  C:\Windows\System32\ZquntgJ.exe
  2⤵
  PID:9664
- C:\Windows\System32\KRyKgrs.exe
  C:\Windows\System32\KRyKgrs.exe
  2⤵
  PID:9728
- C:\Windows\System32\dvXdHkw.exe
  C:\Windows\System32\dvXdHkw.exe
  2⤵
  PID:9776
- C:\Windows\System32\UBlRTGv.exe
  C:\Windows\System32\UBlRTGv.exe
  2⤵
  PID:9840
- C:\Windows\System32\zVoWaWC.exe
  C:\Windows\System32\zVoWaWC.exe
  2⤵
  PID:9916
- C:\Windows\System32\uVBAnqS.exe
  C:\Windows\System32\uVBAnqS.exe
  2⤵
  PID:2508
- C:\Windows\System32\SRVVSwq.exe
  C:\Windows\System32\SRVVSwq.exe
  2⤵
  PID:10036
- C:\Windows\System32\CbpNsGt.exe
  C:\Windows\System32\CbpNsGt.exe
  2⤵
  PID:10092
- C:\Windows\System32\BQLPTKI.exe
  C:\Windows\System32\BQLPTKI.exe
  2⤵
  PID:10124
- C:\Windows\System32\EAyjvTx.exe
  C:\Windows\System32\EAyjvTx.exe
  2⤵
  PID:10196
- C:\Windows\System32\zHicEHX.exe
  C:\Windows\System32\zHicEHX.exe
  2⤵
  PID:9252
- C:\Windows\System32\rLsAApH.exe
  C:\Windows\System32\rLsAApH.exe
  2⤵
  PID:5048
- C:\Windows\System32\dvgTwRK.exe
  C:\Windows\System32\dvgTwRK.exe
  2⤵
  PID:9508
- C:\Windows\System32\QwIhOAy.exe
  C:\Windows\System32\QwIhOAy.exe
  2⤵
  PID:9692
- C:\Windows\System32\yMSesUp.exe
  C:\Windows\System32\yMSesUp.exe
  2⤵
  PID:8464
- C:\Windows\System32\ZasuCiV.exe
  C:\Windows\System32\ZasuCiV.exe
  2⤵
  PID:9956
- C:\Windows\System32\QxYQTgI.exe
  C:\Windows\System32\QxYQTgI.exe
  2⤵
  PID:4900
- C:\Windows\System32\RVIiNRT.exe
  C:\Windows\System32\RVIiNRT.exe
  2⤵
  PID:10224
- C:\Windows\System32\PXgByWy.exe
  C:\Windows\System32\PXgByWy.exe
  2⤵
  PID:9472
- C:\Windows\System32\nZpRWjf.exe
  C:\Windows\System32\nZpRWjf.exe
  2⤵
  PID:2624
- C:\Windows\System32\iwQOuhu.exe
  C:\Windows\System32\iwQOuhu.exe
  2⤵
  PID:9804
- C:\Windows\System32\aCuZfjD.exe
  C:\Windows\System32\aCuZfjD.exe
  2⤵
  PID:10120
- C:\Windows\System32\BcaoGoL.exe
  C:\Windows\System32\BcaoGoL.exe
  2⤵
  PID:4104
- C:\Windows\System32\plQPnhg.exe
  C:\Windows\System32\plQPnhg.exe
  2⤵
  PID:10084
- C:\Windows\System32\JzIPglb.exe
  C:\Windows\System32\JzIPglb.exe
  2⤵
  PID:2644
- C:\Windows\System32\lymBrNj.exe
  C:\Windows\System32\lymBrNj.exe
  2⤵
  PID:10260
- C:\Windows\System32\ArGvhxr.exe
  C:\Windows\System32\ArGvhxr.exe
  2⤵
  PID:10288
- C:\Windows\System32\BDEybTV.exe
  C:\Windows\System32\BDEybTV.exe
  2⤵
  PID:10316
- C:\Windows\System32\bmOhsnE.exe
  C:\Windows\System32\bmOhsnE.exe
  2⤵
  PID:10344
- C:\Windows\System32\OnHLHeX.exe
  C:\Windows\System32\OnHLHeX.exe
  2⤵
  PID:10376
- C:\Windows\System32\pGpzmpY.exe
  C:\Windows\System32\pGpzmpY.exe
  2⤵
  PID:10404
- C:\Windows\System32\qMxbldD.exe
  C:\Windows\System32\qMxbldD.exe
  2⤵
  PID:10432
- C:\Windows\System32\SStitaW.exe
  C:\Windows\System32\SStitaW.exe
  2⤵
  PID:10460
- C:\Windows\System32\CWrztPZ.exe
  C:\Windows\System32\CWrztPZ.exe
  2⤵
  PID:10488
- C:\Windows\System32\frRbyMw.exe
  C:\Windows\System32\frRbyMw.exe
  2⤵
  PID:10516
- C:\Windows\System32\NNbyarn.exe
  C:\Windows\System32\NNbyarn.exe
  2⤵
  PID:10544
- C:\Windows\System32\KPYHmtn.exe
  C:\Windows\System32\KPYHmtn.exe
  2⤵
  PID:10572
- C:\Windows\System32\YAHGkhx.exe
  C:\Windows\System32\YAHGkhx.exe
  2⤵
  PID:10600
- C:\Windows\System32\jtRBzIR.exe
  C:\Windows\System32\jtRBzIR.exe
  2⤵
  PID:10628
- C:\Windows\System32\RNWyDAS.exe
  C:\Windows\System32\RNWyDAS.exe
  2⤵
  PID:10656
- C:\Windows\System32\SCtwIDE.exe
  C:\Windows\System32\SCtwIDE.exe
  2⤵
  PID:10684
- C:\Windows\System32\acCShvz.exe
  C:\Windows\System32\acCShvz.exe
  2⤵
  PID:10712
- C:\Windows\System32\XwJFFXE.exe
  C:\Windows\System32\XwJFFXE.exe
  2⤵
  PID:10740
- C:\Windows\System32\FmrKAev.exe
  C:\Windows\System32\FmrKAev.exe
  2⤵
  PID:10768
- C:\Windows\System32\wIdquHk.exe
  C:\Windows\System32\wIdquHk.exe
  2⤵
  PID:10796
- C:\Windows\System32\JXDGviC.exe
  C:\Windows\System32\JXDGviC.exe
  2⤵
  PID:10824
- C:\Windows\System32\CKHowDI.exe
  C:\Windows\System32\CKHowDI.exe
  2⤵
  PID:10852
- C:\Windows\System32\oyvyyqD.exe
  C:\Windows\System32\oyvyyqD.exe
  2⤵
  PID:10884
- C:\Windows\System32\hzVqPiZ.exe
  C:\Windows\System32\hzVqPiZ.exe
  2⤵
  PID:10912
- C:\Windows\System32\PsMVzEB.exe
  C:\Windows\System32\PsMVzEB.exe
  2⤵
  PID:10936
- C:\Windows\System32\vsyzBeg.exe
  C:\Windows\System32\vsyzBeg.exe
  2⤵
  PID:10976
- C:\Windows\System32\ipykSeu.exe
  C:\Windows\System32\ipykSeu.exe
  2⤵
  PID:10996
- C:\Windows\System32\aUcgVhx.exe
  C:\Windows\System32\aUcgVhx.exe
  2⤵
  PID:11024
- C:\Windows\System32\tBEKZMw.exe
  C:\Windows\System32\tBEKZMw.exe
  2⤵
  PID:11052
- C:\Windows\System32\cFNidjy.exe
  C:\Windows\System32\cFNidjy.exe
  2⤵
  PID:11080
- C:\Windows\System32\wTosxHu.exe
  C:\Windows\System32\wTosxHu.exe
  2⤵
  PID:11108
- C:\Windows\System32\cegBhtX.exe
  C:\Windows\System32\cegBhtX.exe
  2⤵
  PID:11136
- C:\Windows\System32\UpJgSaA.exe
  C:\Windows\System32\UpJgSaA.exe
  2⤵
  PID:11164
- C:\Windows\System32\QOBRKDZ.exe
  C:\Windows\System32\QOBRKDZ.exe
  2⤵
  PID:11192
- C:\Windows\System32\qeAOBzX.exe
  C:\Windows\System32\qeAOBzX.exe
  2⤵
  PID:11220
- C:\Windows\System32\FfNyTOZ.exe
  C:\Windows\System32\FfNyTOZ.exe
  2⤵
  PID:11248
- C:\Windows\System32\iNIrLZS.exe
  C:\Windows\System32\iNIrLZS.exe
  2⤵
  PID:10272
- C:\Windows\System32\oRXKFUG.exe
  C:\Windows\System32\oRXKFUG.exe
  2⤵
  PID:10336
- C:\Windows\System32\dyksJiv.exe
  C:\Windows\System32\dyksJiv.exe
  2⤵
  PID:10400
- C:\Windows\System32\VHNYCaO.exe
  C:\Windows\System32\VHNYCaO.exe
  2⤵
  PID:10456
- C:\Windows\System32\hqeLTFL.exe
  C:\Windows\System32\hqeLTFL.exe
  2⤵
  PID:10556
- C:\Windows\System32\bEWgsTO.exe
  C:\Windows\System32\bEWgsTO.exe
  2⤵
  PID:10612
- C:\Windows\System32\JLrrrLq.exe
  C:\Windows\System32\JLrrrLq.exe
  2⤵
  PID:10676
- C:\Windows\System32\fzIHuPY.exe
  C:\Windows\System32\fzIHuPY.exe
  2⤵
  PID:10736
- C:\Windows\System32\ziZPlfX.exe
  C:\Windows\System32\ziZPlfX.exe
  2⤵
  PID:10808
- C:\Windows\System32\XaHoXzr.exe
  C:\Windows\System32\XaHoXzr.exe
  2⤵
  PID:10872
- C:\Windows\System32\REODRNy.exe
  C:\Windows\System32\REODRNy.exe
  2⤵
  PID:10944
- C:\Windows\System32\ruovmXU.exe
  C:\Windows\System32\ruovmXU.exe
  2⤵
  PID:11008
- C:\Windows\System32\GtXDzMQ.exe
  C:\Windows\System32\GtXDzMQ.exe
  2⤵
  PID:11072
- C:\Windows\System32\DNnTpkR.exe
  C:\Windows\System32\DNnTpkR.exe
  2⤵
  PID:11132
- C:\Windows\System32\zrooSDo.exe
  C:\Windows\System32\zrooSDo.exe
  2⤵
  PID:11204
- C:\Windows\System32\qNPRZOc.exe
  C:\Windows\System32\qNPRZOc.exe
  2⤵
  PID:10252
- C:\Windows\System32\uQlTAJX.exe
  C:\Windows\System32\uQlTAJX.exe
  2⤵
  PID:10396
- C:\Windows\System32\oxMzJof.exe
  C:\Windows\System32\oxMzJof.exe
  2⤵
  PID:4872
- C:\Windows\System32\QMemqRo.exe
  C:\Windows\System32\QMemqRo.exe
  2⤵
  PID:10652
- C:\Windows\System32\PggomkK.exe
  C:\Windows\System32\PggomkK.exe
  2⤵
  PID:10788
- C:\Windows\System32\CHMBZkp.exe
  C:\Windows\System32\CHMBZkp.exe
  2⤵
  PID:10924
- C:\Windows\System32\aZRFdKF.exe
  C:\Windows\System32\aZRFdKF.exe
  2⤵
  PID:11100
- C:\Windows\System32\hOrcmHT.exe
  C:\Windows\System32\hOrcmHT.exe
  2⤵
  PID:11260
- C:\Windows\System32\NZioXCo.exe
  C:\Windows\System32\NZioXCo.exe
  2⤵
  PID:10536
- C:\Windows\System32\xBUEECq.exe
  C:\Windows\System32\xBUEECq.exe
  2⤵
  PID:10848
- C:\Windows\System32\DiMREsX.exe
  C:\Windows\System32\DiMREsX.exe
  2⤵
  PID:11160
- C:\Windows\System32\ygaZNkA.exe
  C:\Windows\System32\ygaZNkA.exe
  2⤵
  PID:10732
- C:\Windows\System32\cFHwqiQ.exe
  C:\Windows\System32\cFHwqiQ.exe
  2⤵
  PID:10640
- C:\Windows\System32\cIOHjHv.exe
  C:\Windows\System32\cIOHjHv.exe
  2⤵
  PID:11280
- C:\Windows\System32\StgHnLF.exe
  C:\Windows\System32\StgHnLF.exe
  2⤵
  PID:11308
- C:\Windows\System32\KHfvAcM.exe
  C:\Windows\System32\KHfvAcM.exe
  2⤵
  PID:11336
- C:\Windows\System32\cRveKUv.exe
  C:\Windows\System32\cRveKUv.exe
  2⤵
  PID:11364
- C:\Windows\System32\oDqAfIk.exe
  C:\Windows\System32\oDqAfIk.exe
  2⤵
  PID:11392
- C:\Windows\System32\gvGJfqR.exe
  C:\Windows\System32\gvGJfqR.exe
  2⤵
  PID:11424
- C:\Windows\System32\fdVQOEC.exe
  C:\Windows\System32\fdVQOEC.exe
  2⤵
  PID:11452
- C:\Windows\System32\WmRMsfq.exe
  C:\Windows\System32\WmRMsfq.exe
  2⤵
  PID:11480
- C:\Windows\System32\MjSWQCV.exe
  C:\Windows\System32\MjSWQCV.exe
  2⤵
  PID:11508
- C:\Windows\System32\EwFndvG.exe
  C:\Windows\System32\EwFndvG.exe
  2⤵
  PID:11536
- C:\Windows\System32\Rzloedq.exe
  C:\Windows\System32\Rzloedq.exe
  2⤵
  PID:11564
- C:\Windows\System32\NhUQiNH.exe
  C:\Windows\System32\NhUQiNH.exe
  2⤵
  PID:11592
- C:\Windows\System32\tPvtyUs.exe
  C:\Windows\System32\tPvtyUs.exe
  2⤵
  PID:11620
- C:\Windows\System32\iKtiAct.exe
  C:\Windows\System32\iKtiAct.exe
  2⤵
  PID:11648
- C:\Windows\System32\CttXWYz.exe
  C:\Windows\System32\CttXWYz.exe
  2⤵
  PID:11676
- C:\Windows\System32\vNkfyuR.exe
  C:\Windows\System32\vNkfyuR.exe
  2⤵
  PID:11704
- C:\Windows\System32\koQbLvb.exe
  C:\Windows\System32\koQbLvb.exe
  2⤵
  PID:11732
- C:\Windows\System32\PkGoLHL.exe
  C:\Windows\System32\PkGoLHL.exe
  2⤵
  PID:11760
- C:\Windows\System32\RQzCTvu.exe
  C:\Windows\System32\RQzCTvu.exe
  2⤵
  PID:11788
- C:\Windows\System32\jZhmhwR.exe
  C:\Windows\System32\jZhmhwR.exe
  2⤵
  PID:11816
- C:\Windows\System32\wOuCEbV.exe
  C:\Windows\System32\wOuCEbV.exe
  2⤵
  PID:11844
- C:\Windows\System32\AZaxjbF.exe
  C:\Windows\System32\AZaxjbF.exe
  2⤵
  PID:11876
- C:\Windows\System32\mFlCGAr.exe
  C:\Windows\System32\mFlCGAr.exe
  2⤵
  PID:11904
- C:\Windows\System32\BlCLbGw.exe
  C:\Windows\System32\BlCLbGw.exe
  2⤵
  PID:11932
- C:\Windows\System32\vSPaeln.exe
  C:\Windows\System32\vSPaeln.exe
  2⤵
  PID:11960
- C:\Windows\System32\LyZxTCG.exe
  C:\Windows\System32\LyZxTCG.exe
  2⤵
  PID:11988
- C:\Windows\System32\aDGlpIW.exe
  C:\Windows\System32\aDGlpIW.exe
  2⤵
  PID:12016
- C:\Windows\System32\ciZOfFY.exe
  C:\Windows\System32\ciZOfFY.exe
  2⤵
  PID:12044
- C:\Windows\System32\PCTEedg.exe
  C:\Windows\System32\PCTEedg.exe
  2⤵
  PID:12072
- C:\Windows\System32\VHiRSdS.exe
  C:\Windows\System32\VHiRSdS.exe
  2⤵
  PID:12100
- C:\Windows\System32\XeoAtul.exe
  C:\Windows\System32\XeoAtul.exe
  2⤵
  PID:12128
- C:\Windows\System32\NQigWXY.exe
  C:\Windows\System32\NQigWXY.exe
  2⤵
  PID:12156
- C:\Windows\System32\QlOSLrT.exe
  C:\Windows\System32\QlOSLrT.exe
  2⤵
  PID:12184
- C:\Windows\System32\mCvhxDE.exe
  C:\Windows\System32\mCvhxDE.exe
  2⤵
  PID:12212
- C:\Windows\System32\MFcHMoU.exe
  C:\Windows\System32\MFcHMoU.exe
  2⤵
  PID:12240
- C:\Windows\System32\zYDcUsu.exe
  C:\Windows\System32\zYDcUsu.exe
  2⤵
  PID:12268
- C:\Windows\System32\CRRltkS.exe
  C:\Windows\System32\CRRltkS.exe
  2⤵
  PID:11276
- C:\Windows\System32\IotFYgx.exe
  C:\Windows\System32\IotFYgx.exe
  2⤵
  PID:11348
- C:\Windows\System32\KJvhWgi.exe
  C:\Windows\System32\KJvhWgi.exe
  2⤵
  PID:11436
- C:\Windows\System32\aeamSmU.exe
  C:\Windows\System32\aeamSmU.exe
  2⤵
  PID:11476
- C:\Windows\System32\CrXdFxz.exe
  C:\Windows\System32\CrXdFxz.exe
  2⤵
  PID:11548
- C:\Windows\System32\pdYVyCP.exe
  C:\Windows\System32\pdYVyCP.exe
  2⤵
  PID:11604
- C:\Windows\System32\UaUAzWB.exe
  C:\Windows\System32\UaUAzWB.exe
  2⤵
  PID:11668
- C:\Windows\System32\GicEHmw.exe
  C:\Windows\System32\GicEHmw.exe
  2⤵
  PID:11728
- C:\Windows\System32\sGsLQFX.exe
  C:\Windows\System32\sGsLQFX.exe
  2⤵
  PID:11800
- C:\Windows\System32\UEeDPDE.exe
  C:\Windows\System32\UEeDPDE.exe
  2⤵
  PID:4844
- C:\Windows\System32\HUANneJ.exe
  C:\Windows\System32\HUANneJ.exe
  2⤵
  PID:11860
- C:\Windows\System32\nNOlonx.exe
  C:\Windows\System32\nNOlonx.exe
  2⤵
  PID:11924
- C:\Windows\System32\BXOtbvi.exe
  C:\Windows\System32\BXOtbvi.exe
  2⤵
  PID:11984
- C:\Windows\System32\WazKLzF.exe
  C:\Windows\System32\WazKLzF.exe
  2⤵
  PID:12056
- C:\Windows\System32\fUdZDCp.exe
  C:\Windows\System32\fUdZDCp.exe
  2⤵
  PID:12120
- C:\Windows\System32\KJZHGPw.exe
  C:\Windows\System32\KJZHGPw.exe
  2⤵
  PID:12180
- C:\Windows\System32\gCHlnXd.exe
  C:\Windows\System32\gCHlnXd.exe
  2⤵
  PID:12252
- C:\Windows\System32\uGQlKXa.exe
  C:\Windows\System32\uGQlKXa.exe
  2⤵
  PID:11328
- C:\Windows\System32\CZwuvhh.exe
  C:\Windows\System32\CZwuvhh.exe
  2⤵
  PID:11532
- C:\Windows\System32\zBjWYss.exe
  C:\Windows\System32\zBjWYss.exe
  2⤵
  PID:11644
- C:\Windows\System32\NxSxfak.exe
  C:\Windows\System32\NxSxfak.exe
  2⤵
  PID:11756
- C:\Windows\System32\bStBRbG.exe
  C:\Windows\System32\bStBRbG.exe
  2⤵
  PID:11900
- C:\Windows\System32\EgqYYWv.exe
  C:\Windows\System32\EgqYYWv.exe
  2⤵
  PID:12040
- C:\Windows\System32\bcjFmlI.exe
  C:\Windows\System32\bcjFmlI.exe
  2⤵
  PID:12208
- C:\Windows\System32\GTzGLqz.exe
  C:\Windows\System32\GTzGLqz.exe
  2⤵
  PID:11272
- C:\Windows\System32\PtwfhCH.exe
  C:\Windows\System32\PtwfhCH.exe
  2⤵
  PID:11584
- C:\Windows\System32\aPDXLQK.exe
  C:\Windows\System32\aPDXLQK.exe
  2⤵
  PID:12012
- C:\Windows\System32\vvsyiZe.exe
  C:\Windows\System32\vvsyiZe.exe
  2⤵
  PID:11472
- C:\Windows\System32\sapmbPj.exe
  C:\Windows\System32\sapmbPj.exe
  2⤵
  PID:11696
- C:\Windows\System32\gZuzLaB.exe
  C:\Windows\System32\gZuzLaB.exe
  2⤵
  PID:12036
- C:\Windows\System32\EgJqVFT.exe
  C:\Windows\System32\EgJqVFT.exe
  2⤵
  PID:12316
- C:\Windows\System32\IyLaKbf.exe
  C:\Windows\System32\IyLaKbf.exe
  2⤵
  PID:12344
- C:\Windows\System32\aaiPcMT.exe
  C:\Windows\System32\aaiPcMT.exe
  2⤵
  PID:12372
- C:\Windows\System32\kkCNAZl.exe
  C:\Windows\System32\kkCNAZl.exe
  2⤵
  PID:12400
- C:\Windows\System32\IqsNlob.exe
  C:\Windows\System32\IqsNlob.exe
  2⤵
  PID:12428
- C:\Windows\System32\oSnPyrp.exe
  C:\Windows\System32\oSnPyrp.exe
  2⤵
  PID:12456
- C:\Windows\System32\TkCXBDA.exe
  C:\Windows\System32\TkCXBDA.exe
  2⤵
  PID:12488
- C:\Windows\System32\vzaDWnS.exe
  C:\Windows\System32\vzaDWnS.exe
  2⤵
  PID:12516
- C:\Windows\System32\CuBDmSB.exe
  C:\Windows\System32\CuBDmSB.exe
  2⤵
  PID:12544
- C:\Windows\System32\IOhcgxU.exe
  C:\Windows\System32\IOhcgxU.exe
  2⤵
  PID:12584
- C:\Windows\System32\JNWQOYs.exe
  C:\Windows\System32\JNWQOYs.exe
  2⤵
  PID:12600
- C:\Windows\System32\OsogsKv.exe
  C:\Windows\System32\OsogsKv.exe
  2⤵
  PID:12628
- C:\Windows\System32\WslTXVR.exe
  C:\Windows\System32\WslTXVR.exe
  2⤵
  PID:12656
- C:\Windows\System32\lQajQzF.exe
  C:\Windows\System32\lQajQzF.exe
  2⤵
  PID:12684
- C:\Windows\System32\QgMFIZY.exe
  C:\Windows\System32\QgMFIZY.exe
  2⤵
  PID:12712
- C:\Windows\System32\BuXbWoQ.exe
  C:\Windows\System32\BuXbWoQ.exe
  2⤵
  PID:12740
- C:\Windows\System32\OLyciOO.exe
  C:\Windows\System32\OLyciOO.exe
  2⤵
  PID:12768
- C:\Windows\System32\RJCCJSI.exe
  C:\Windows\System32\RJCCJSI.exe
  2⤵
  PID:12796
- C:\Windows\System32\bkSuJij.exe
  C:\Windows\System32\bkSuJij.exe
  2⤵
  PID:12824
- C:\Windows\System32\zpCMeJG.exe
  C:\Windows\System32\zpCMeJG.exe
  2⤵
  PID:12852
- C:\Windows\System32\LUkmPye.exe
  C:\Windows\System32\LUkmPye.exe
  2⤵
  PID:12880
- C:\Windows\System32\qPuNfZM.exe
  C:\Windows\System32\qPuNfZM.exe
  2⤵
  PID:12908
- C:\Windows\System32\RMMmkIu.exe
  C:\Windows\System32\RMMmkIu.exe
  2⤵
  PID:12936
- C:\Windows\System32\aajKtHi.exe
  C:\Windows\System32\aajKtHi.exe
  2⤵
  PID:12968
- C:\Windows\System32\nRFBjcu.exe
  C:\Windows\System32\nRFBjcu.exe
  2⤵
  PID:12996
- C:\Windows\System32\SHyjimN.exe
  C:\Windows\System32\SHyjimN.exe
  2⤵
  PID:13024
- C:\Windows\System32\VlmiRbO.exe
  C:\Windows\System32\VlmiRbO.exe
  2⤵
  PID:13052
- C:\Windows\System32\nyJSPMu.exe
  C:\Windows\System32\nyJSPMu.exe
  2⤵
  PID:13080
- C:\Windows\System32\InnoOOS.exe
  C:\Windows\System32\InnoOOS.exe
  2⤵
  PID:13108
- C:\Windows\System32\jOmNWkB.exe
  C:\Windows\System32\jOmNWkB.exe
  2⤵
  PID:13136
- C:\Windows\System32\JpCWhel.exe
  C:\Windows\System32\JpCWhel.exe
  2⤵
  PID:13164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BMeztMZ.exe

Path C:\Windows\System32\BMeztMZ.exe
Size 3.3MB
SHA256 b85c9606e3701210823ed22b0b358471762fada9554ba41926ae87659d7f8794
MD5 ef21c20c47d3c6863ff5679c774d440b
SHA1 aef8617911d2b21020fe606a2aca587409e775d1
SHA512 3b4f0e0ba4d10f1ded83cc020821fbd493f2b763d114c86d48e3c0bc5df4cafe7fcc419a1b76179a3bfabd0791ba33fd6f360df82caef381c9390a17fdac9f11
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc40:wFWPClFE
MD5 SHA1 SHA512 SSDEEP

Submit Download

BwEOnpD.exe

Path C:\Windows\System32\BwEOnpD.exe
Size 3.3MB
SHA256 0e102ef7bbe82d1781c2653d32059d6c2459c6d9ac760f0262fd2ddf4acdbe8a
MD5 6d258ce844d61a9b5300b0442236d359
SHA1 67bb720ff8e25f37a1b151b36ac23936702def26
SHA512 8e1c84c7b51683d02012880ee54d7ae7d028633d0e0c49a5fec427b3d12b670cbdd936939bcde98787325073299f2dd2086e600a6cf2efce3a429b25c494b4b4
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc46:wFWPClFq
MD5 SHA1 SHA512 SSDEEP

Submit Download

CGqcPkD.exe

Path C:\Windows\System32\CGqcPkD.exe
Size 3.3MB
SHA256 8579287b871f4aaafbfbc43bd75c03582e3aabea1e604d45e043a3a5104db701
MD5 209d7a39cde4ca26dc8ef411efa66a06
SHA1 ec16fb328802fce6eea702b5cb3b5a44c3aff584
SHA512 7e28e8812c3945559e5afa1d9a8d7e561423c94737a1b459327845bb0a8fb9cc63573ce10d1b46c7f7582faf97afb61859e513c5e72afc055f5d7643ed0342e7
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4r:wFWPClF7
MD5 SHA1 SHA512 SSDEEP

Submit Download

CgLRneS.exe

Path C:\Windows\System32\CgLRneS.exe
Size 3.3MB
SHA256 8bed06572c93da58f5bcec0df2585effb30b42e4947c009b3fef69f72267a8c0
MD5 d9fcafa8a63463adfa5930dbd9c8949a
SHA1 d9d349dbfc7e48320b0fbe4c33d4bfa84f87bdbf
SHA512 362296af997b906feba0c46f4adb466c2508be9c0bb747e8d80d5550db2036e81571c3ebf262b67e3fb54166fcefcd55ed24c50d0b49700309709147f51d02ef
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4y:wFWPClFi
MD5 SHA1 SHA512 SSDEEP

Submit Download

EbbctVg.exe

Path C:\Windows\System32\EbbctVg.exe
Size 3.3MB
SHA256 19e017b5ebeb4694d0df8f935a3ee4b7c313109b4b85720486c9177066c892a1
MD5 0a619874db6f6140b9dc56a1074ca51a
SHA1 d715e4647460ec70f8caf106483ac9c4e085cd64
SHA512 c9ad031f5ed29107f6b1c18a2181acae6851caee948e74f5675e1465bac6e4239c536f49eef4920aed74136ee04b40e4fb56bac52e99466641c0f5aeea6b62c2
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4y:wFWPClFC
MD5 SHA1 SHA512 SSDEEP

Submit Download

HSsXRYw.exe

Path C:\Windows\System32\HSsXRYw.exe
Size 3.3MB
SHA256 d6631f17c5cd1622cd4995c1dfcf95ede16c7b0dfadbaea7997a9026738d58e3
MD5 66e76919393d85c9b815a748e55e37e5
SHA1 803af376d33f8a5a0a5c37bfde253cfd8c5fb361
SHA512 eab1d32862605afab22ed98568e35db35dd01ff875a772cfb93a5c3a0b31fbc486ee29cb88f5415f5b06b3d7ea75f2ddc73f70140ead131010b9bec56573acfa
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4q:wFWPClFa
MD5 SHA1 SHA512 SSDEEP

Submit Download

IFlvcrJ.exe

Path C:\Windows\System32\IFlvcrJ.exe
Size 3.3MB
SHA256 db4ef028560ae4bead9d39878f139db10c88213ab05fef0316bd073e079adaea
MD5 e8dc5147790b26027fabe04edf93d408
SHA1 2efce8af66a2a4ff7b583f95e1f20377fc29aa1a
SHA512 924b15d7faac6a8097bd223f0071807475ecdbf455b52f8f863ec96a5c1308281abb7d42f9a565d67bbe3ba2187c65b7528e6bb3e5bacd5d8b7adf70de7d6533
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4w:wFWPClFg
MD5 SHA1 SHA512 SSDEEP

Submit Download

IyVgknu.exe

Path C:\Windows\System32\IyVgknu.exe
Size 3.3MB
SHA256 2563c0cf321d558a15e7170957f97e9cbbb7d41d4348e75ba5e64116f6d12dc5
MD5 1b275fc3dc77c63fcf8205138d18b67f
SHA1 5423fe35495108cb91782b0cff9a65bd9c9e7883
SHA512 37e1a3d1cb3e40dafbafa91bc0a9dd9315253d9b2823fb9905fb645691684ad069a53f5b37698775fbe2b0217d37d29f75b002f473277f5da5c5a93a51a4b663
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4g:wFWPClFw
MD5 SHA1 SHA512 SSDEEP

Submit Download

JxYBgGt.exe

Path C:\Windows\System32\JxYBgGt.exe
Size 3.3MB
SHA256 14e548e248d40203a7e3bb13e7afab6872ad71a2e0c3ca201c244a1ec6321277
MD5 95e1cf56526d21f8ee3de7d72d4732cc
SHA1 88c679816809d1c70c9a640ab86845f2d7756d86
SHA512 2cd44ad741ae4f6f02c514b347656cad6f6b54205c67bd0ba4dd09ec2351a2250af943896fdb8a1e4ee9c4c6119465b55241449025d9af70887d8f2720233db3
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4t:wFWPClFd
MD5 SHA1 SHA512 SSDEEP

Submit Download

LBIAHkJ.exe

Path C:\Windows\System32\LBIAHkJ.exe
Size 3.3MB
SHA256 41d782652d6f33e4696684c2329d93015da3b4b9c1820b0bc41a9cf3167b699a
MD5 45b09b4deac839e7366029a4a3b7e2ce
SHA1 a7937849d39a3e423bc5f6b725cae15ad0ce8ce0
SHA512 c280d61a46441603dbbdfa33d2542abbb73152583888d45672af66f8b859562f75b1dabe5cf9922cb8213540eea44debf630621d23b55cfc0fb35b2f2d5da219
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4l:wFWPClF1
MD5 SHA1 SHA512 SSDEEP

Submit Download

NBBJsVl.exe

Path C:\Windows\System32\NBBJsVl.exe
Size 3.3MB
SHA256 31df3b08e665c93cd7facbba7c9b6a3a8611ff03bc20957a3b4f6e021ee7d8a5
MD5 10a0103c2d4e846eb572f7f824be7ba0
SHA1 1880e871a62eb5e95d1a5efd0edea23c54b93f11
SHA512 55b3b5e78d1a5bf16ff6e9790b5aef17a91d35885758d8b45d99c902cdd99cf781f0e77faa6f65af5a5f2f713b04e5c73f40c6af5483d87a3e47d3e850e7edd7
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc46:wFWPClFq
MD5 SHA1 SHA512 SSDEEP

Submit Download

NtMmVIl.exe

Path C:\Windows\System32\NtMmVIl.exe
Size 3.3MB
SHA256 b94195eb7dd86798de2277091e6c9087805d3d889cb6067ce951edf63dc5d2df
MD5 e09b1acb8121f80418a5da5802287ff9
SHA1 dd604e9d09e950fec69cb64e453b97b10a4c616b
SHA512 8fe5b6ac04661ad7cd72440c8162badbbc43f71770cd613098cf86ca0256e4e2d4a689d5aa6ce536b04e3f9f0baabf82c6df7431a865518fdda9d6546894acc2
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4B:wFWPClFx
MD5 SHA1 SHA512 SSDEEP

Submit Download

PiMLgDM.exe

Path C:\Windows\System32\PiMLgDM.exe
Size 3.3MB
SHA256 0686c3043ed0edd51dc57eaeb39b364ddada6e504e5d5314eeaedcaf36bd4e60
MD5 84c52bf07ec3a805b15b98f0aded1690
SHA1 552d6e11d7304783c6fccb6c3a28eb496eb67b66
SHA512 dd15810d88d4884dbe18593b1083889f0816dd7c161f25ad96e6eea17bbd38400965327afd96b51495db4e4adfe9155661de372a4f9456417d107c5c84cfb368
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4l:wFWPClF1
MD5 SHA1 SHA512 SSDEEP

Submit Download

PwbwOzl.exe

Path C:\Windows\System32\PwbwOzl.exe
Size 3.3MB
SHA256 9014c99ba9a3c7db8ac528b0b4ac89fa5654f19e96a91541bbb9c9529d272450
MD5 942738402e2074ae574744a9f9b314b2
SHA1 a8f8be0d3967c6de5773284f312e7080894db6c6
SHA512 3fc54dd3e4e448664cab1ee83644214172313138c8bbc34e2f344579e23246befb550a617aa3098b18a99d1ca35511138ae9bf2ac9a20bc02740648dad65957f
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4o:wFWPClFY
MD5 SHA1 SHA512 SSDEEP

Submit Download

QylHNFk.exe

Path C:\Windows\System32\QylHNFk.exe
Size 3.3MB
SHA256 0252bce847895b50f0de661e423ef0f69fa255dc91943d53afdc3a34527b4ee4
MD5 b939a177b0692468cf5dbe1724ff0282
SHA1 9f59e04a82a514ac07db61fdc505a60441e84a90
SHA512 a723d675b885b4971941da5c74d8a0af2c4fb313431b910da792504fbdefacfca71cb27524fbbbcca56ff8f4a80b3700de1a98d6d997bb28806a365e7e070f6a
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4u:wFWPClF+
MD5 SHA1 SHA512 SSDEEP

Submit Download

TbxSAho.exe

Path C:\Windows\System32\TbxSAho.exe
Size 3.3MB
SHA256 415f6f8f3e13f7bc0e5eb81e619269a4a9bd7c303cd16572db4d4b214cc6b33a
MD5 26fb2553018a4898a051b1700c6d36a5
SHA1 2b2b5f135a4cdfc34531f0ffb6ebf1c079d4291d
SHA512 75181f845aacb237c24700ef6e49ed039ef06c3190acb1a450093aae79bc8312ae2f9842961f85ea9633614cdcf8e59b99738a275551a3684c3fad4c4a6decc2
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4D:wFWPClFz
MD5 SHA1 SHA512 SSDEEP

Submit Download

XDgESJV.exe

Path C:\Windows\System32\XDgESJV.exe
Size 3.3MB
SHA256 430269049548153c4d6b0f027e8ee14416c147d3c6492029c6d3ba5d15e4f2d3
MD5 4cd24edffa4609a7472951cec55bcbb1
SHA1 b2ff0fb40e7940b805c9537319f54ba088408ab1
SHA512 ffe7d69e0a7d30b72d3763697712554dc5fedbc7f4a1d1ba215aed87f81e2b9b8a15688f0e70933818a62640266e0a2dad902fb058fe2956b177e4c763ce5801
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4B:wFWPClFx
MD5 SHA1 SHA512 SSDEEP

Submit Download

bdcklFW.exe

Path C:\Windows\System32\bdcklFW.exe
Size 3.3MB
SHA256 ef7937fd14254344df9d4c9ba414b99c1c06f7fde1d621e7a3467583e7f2654f
MD5 5e43ef8ccf5d24868e099deb009be20c
SHA1 1da701caa7651b34f99d1c4f74c92b944db1c747
SHA512 255039b708c7dd1144693ea0eced9c98eefc24d3471cbd837e166f512d5a085f1405ed8a824ef45aa600e2d28a729fb97be758db969642d9621e28cd523b2b5c
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4X:wFWPClFn
MD5 SHA1 SHA512 SSDEEP

Submit Download

bjuRKOb.exe

Path C:\Windows\System32\bjuRKOb.exe
Size 3.3MB
SHA256 9e0c3a0e0af1248b4ad092dd7c493f9323865e558fb9e3697dedaa17ba71318e
MD5 6825c12a7b56124bf42fad14d1fac24c
SHA1 2584986a2f5b83ceb46949bdd767afb9753b5d86
SHA512 403a9b1aeae9716dcdcee10664a5318f4f1568f563a5f17e3953aaf89a71991b2ed5cd99427746b4e5853421cedf68bdf95036fe9be5b70f3435afd55c54db56
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4/:wFWPClFv
MD5 SHA1 SHA512 SSDEEP

Submit Download

cCtGNvx.exe

Path C:\Windows\System32\cCtGNvx.exe
Size 3.3MB
SHA256 047183fa576822ffdd5d2a35639c5fa2ac00e5547c5f962f7ce787affcef4d5b
MD5 de7430ef4a9c424e988c99e2813a48cf
SHA1 cef8e8200a7059c60eabbffc199387ea2e8029ea
SHA512 a7281e554fa115634ea554aded1f4d6f9d9889edbd547ff30e1654adfc6f3005d0b4d0f9186380fe80441ace73cf05d8ffeae59ee4f982b540e5b92dcb9caab5
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4d:wFWPClFt
MD5 SHA1 SHA512 SSDEEP

Submit Download

gPmNyJd.exe

Path C:\Windows\System32\gPmNyJd.exe
Size 3.3MB
SHA256 fb70c11d53a662e356e7398978b4fadb441b669bc338999654aa9d07487c87e8
MD5 b85ebee0865fe11d9d5b131e3dde287a
SHA1 e829aade08068bd69ae0c31f8591b0beeda63fc4
SHA512 1857c55afa071adea76c0badc31e34c17fcaf7c4814cb6fde32b31bd37041593bf2df5ff22ce239ac139b16b05476198980867043284d78fc153d1aca84a3679
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4s:wFWPClF8
MD5 SHA1 SHA512 SSDEEP

Submit Download

hodnPoS.exe

Path C:\Windows\System32\hodnPoS.exe
Size 3.3MB
SHA256 f7a0cd40f34a805e32eb9acb3b4d9f0f660575ef9f7a4595249303199b8c8079
MD5 013b8761829a55edd355d39f68cae48c
SHA1 ec45366a8bc270dd0abdc72f4e79ba8358906cca
SHA512 fb0d619644b8e2f3c8fc1843a1388c05eec750675614e974eaf7b04ddbca12fbf639a8e6b4f3762f0dfb2c156b6d9bdcf86dbcd6c20523f4114c51e20e2e7e96
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4I:wFWPClFY
MD5 SHA1 SHA512 SSDEEP

Submit Download

jrITrKN.exe

Path C:\Windows\System32\jrITrKN.exe
Size 3.3MB
SHA256 42cc25a64a4d422eb0232d4451d2aa6a237028c6fa1d558855a5a7a64c399730
MD5 aa9b20fa375e5e3629623f5d3ffbca04
SHA1 9c37e05da221910023e76f9ef2e9d137a60deeb2
SHA512 4019d7e69311d14068640d5576a43478de7524aff5b0caa237a551ca5839c7df68062f6d4394d9715acd9f6079b6ab38174f02752c74049eb5f14a618a8b3b97
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4j:wFWPClFz
MD5 SHA1 SHA512 SSDEEP

Submit Download

kUDHQMh.exe

Path C:\Windows\System32\kUDHQMh.exe
Size 3.3MB
SHA256 dbee87b353c67b0900a2953ed233ee6c017e00db753ae43c0150bd67879a66b9
MD5 234028c90aed84810135939ae42dae95
SHA1 f8339e8f331ccbba472af9bf9574a0b8e65af32b
SHA512 e383da37d6445db27dd74c448051c50fb4c9ebe8f54e98e71e9759679e37d99f1b8ac6d095a3acb4299db2f38b130e5bda4d7c65bf00b7cc700e48d399c89a42
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4Q:wFWPClFA
MD5 SHA1 SHA512 SSDEEP

Submit Download

lMbxYQx.exe

Path C:\Windows\System32\lMbxYQx.exe
Size 3.3MB
SHA256 25be7332cc68a16df5bc6fa948bb53feb4816e4c0eb7e0a2aa9c7b2f706f0742
MD5 25bb2d2437f986085fe5e03248bc1bdc
SHA1 95da43b114b7a22323160f0ed150b26e0b050e35
SHA512 ce41561568c6d615cea03ccee2f731d262855c7be926b6b74aecee5721764c2a41ce2dfdb4228ee9e980ec8a72c95469f826af0b0b7fd860c7c079c4d72d1924
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4n:wFWPClFX
MD5 SHA1 SHA512 SSDEEP

Submit Download

nlGkrPu.exe

Path C:\Windows\System32\nlGkrPu.exe
Size 3.3MB
SHA256 80d915d34f40e09f28e18ae96b9a081ed327f7fef4cef9c1a8821bce7b8fa870
MD5 cb57981168046ac4a54cbb663e5dd5d5
SHA1 f149c0592cde290d38b6c221a96f8435bf7092a3
SHA512 d8a785b0bde77bfb32445fd2e0c8d2f0b1b68756cb6fe238bbf9e8671c12980f3e552a64d2aa51d0217f9dd576a13eb8de52837ac42451eb65ffb82671a894ea
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4s:wFWPClFc
MD5 SHA1 SHA512 SSDEEP

Submit Download

qHADHWj.exe

Path C:\Windows\System32\qHADHWj.exe
Size 3.3MB
SHA256 7b22595b8882fb39850b728eb0dac9bec7fce1998a4d7ded6dba064b704db568
MD5 f5eb2c7ab614c45b0955efe7897cc26c
SHA1 76b99ea7c28939f292b6f2b0d89003f83f6b2403
SHA512 12f16c1a0b7b46c906b96740bb09b93b30a07767a567031bbece3ad9aafbeb363956e029707ef7952abec5b0abefe09bc8416bea6dcbdd37a7651c1a7df83a2b
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4t:wFWPClF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

qLnLQHL.exe

Path C:\Windows\System32\qLnLQHL.exe
Size 3.3MB
SHA256 a39ad4a59ef7c870a788eba761dbf493e0bbcfeeb622e189d0b50c026907cdd4
MD5 d0c651b531e8f30da280626ecb749a26
SHA1 591026995105ca974586374b6820ea0e15ad76d8
SHA512 44382840fb25cdf455defb0c1419e49af9c653c87a4c09ecc2594346fa8df5f0244aeb00be0e45da3c29d224747ed684b250245508029be89a9cba29b9938692
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4e:wFWPClFu
MD5 SHA1 SHA512 SSDEEP

Submit Download

rrDMKZh.exe

Path C:\Windows\System32\rrDMKZh.exe
Size 3.3MB
SHA256 f3a04be32c3c22c82247a3d3aef63556998c616f05e9dd9f15077be54c1599a3
MD5 34769084273234b7658fb19bea333436
SHA1 2aa720c72e47e97ef94b6603117df189243e72b0
SHA512 6687e7766d6f3f3c99a18987caa6e7642d2260808601e761b036df7155e4e6865114c40700373c74c3e58b2c0289d1ab30136a92b22d5c7c28bd9b8ee7173e76
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc49:wFWPClFN
MD5 SHA1 SHA512 SSDEEP

Submit Download

srPeYoq.exe

Path C:\Windows\System32\srPeYoq.exe
Size 3.3MB
SHA256 bc8de0bf82fd0ec0779eafafe32e9553f7671d5df7974b767f92e46591cecaba
MD5 c496d6c83447a161b55eeafa7ea607d2
SHA1 25af9e60c05a8acb1b27e6323628d76631688273
SHA512 b4540098726a2caa2bf66307c5497548641cd612bf9c09d2906300c0952140b0e1d0a61dfb6af37be8207cc89d1836e6dd3791f62850a224fbd30097a3f36d43
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4w:wFWPClFg
MD5 SHA1 SHA512 SSDEEP

Submit Download

vdMUDLQ.exe

Path C:\Windows\System32\vdMUDLQ.exe
Size 3.3MB
SHA256 4bb05c643ae807f25cfadba61744e5bb34de8a482003d0118ad4492c8a03b529
MD5 312df19a44887e61b3ef94deb6f1fbd8
SHA1 9034d165316e58a61bc2de632e2ed71386164c8c
SHA512 dd28c788e05640d49dbdaa604d193399337d88af6ab9c419f96b1fb48e239b76ada48e4f7db3187fd551c494210b7f5cb518811c891f59882fbae46a071ba969
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4R:wFWPClFB
MD5 SHA1 SHA512 SSDEEP

Submit Download

vlyWkLI.exe

Path C:\Windows\System32\vlyWkLI.exe
Size 3.3MB
SHA256 386d84f2724beb0ae6ad0fbbf4fe1494e35f77bbb34c31ab5e457de572d6de56
MD5 1e90fe3de81cf928bda216fd6ee45a5f
SHA1 a1c88fcd8ef319fb785cbb017278bd373d1a728a
SHA512 765acf5cd099d84faa14617a500bc55d3988f9182ea0f72f7b968638e750fd4cd732934814acb7ef7a47248fdedde5a7f228153689f2d5035ba73d405cf60c28
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4v:wFWPClF/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/384-75-0x00007FF7A7290000-0x00007FF7A7685000-memory.dmp

Download

memory/384-1960-0x00007FF7A7290000-0x00007FF7A7685000-memory.dmp

Download

memory/384-1945-0x00007FF7A7290000-0x00007FF7A7685000-memory.dmp

Download

memory/1172-862-0x00007FF6A7350000-0x00007FF6A7745000-memory.dmp

Download

memory/1172-1969-0x00007FF6A7350000-0x00007FF6A7745000-memory.dmp

Download

memory/1296-1966-0x00007FF72F5B0000-0x00007FF72F9A5000-memory.dmp

Download

memory/1296-831-0x00007FF72F5B0000-0x00007FF72F9A5000-memory.dmp

Download

memory/1332-844-0x00007FF6AE920000-0x00007FF6AED15000-memory.dmp

Download

memory/1332-1965-0x00007FF6AE920000-0x00007FF6AED15000-memory.dmp

Download

memory/2136-78-0x00007FF681A70000-0x00007FF681E65000-memory.dmp

Download

memory/2136-1959-0x00007FF681A70000-0x00007FF681E65000-memory.dmp

Download

memory/2136-1946-0x00007FF681A70000-0x00007FF681E65000-memory.dmp

Download

memory/2176-865-0x00007FF7513E0000-0x00007FF7517D5000-memory.dmp

Download

memory/2176-1972-0x00007FF7513E0000-0x00007FF7517D5000-memory.dmp

Download

memory/2232-8-0x00007FF760CB0000-0x00007FF7610A5000-memory.dmp

Download

memory/2232-1949-0x00007FF760CB0000-0x00007FF7610A5000-memory.dmp

Download

memory/2788-1967-0x00007FF7AB2D0000-0x00007FF7AB6C5000-memory.dmp

Download

memory/2788-827-0x00007FF7AB2D0000-0x00007FF7AB6C5000-memory.dmp

Download

memory/2940-1953-0x00007FF6F1080000-0x00007FF6F1475000-memory.dmp

Download

memory/2940-43-0x00007FF6F1080000-0x00007FF6F1475000-memory.dmp

Download

memory/3088-853-0x00007FF781C00000-0x00007FF781FF5000-memory.dmp

Download

memory/3088-1964-0x00007FF781C00000-0x00007FF781FF5000-memory.dmp

Download

memory/3244-1958-0x00007FF769220000-0x00007FF769615000-memory.dmp

Download

memory/3244-61-0x00007FF769220000-0x00007FF769615000-memory.dmp

Download

memory/3244-1943-0x00007FF769220000-0x00007FF769615000-memory.dmp

Download

memory/3280-1-0x000001BBF02B0000-0x000001BBF02C0000-memory.dmp

Download

memory/3280-1948-0x00007FF7BF0A0000-0x00007FF7BF495000-memory.dmp

Download

memory/3280-822-0x00007FF7BF0A0000-0x00007FF7BF495000-memory.dmp

Download

memory/3280-0-0x00007FF7BF0A0000-0x00007FF7BF495000-memory.dmp

Download

memory/3452-1952-0x00007FF6C0340000-0x00007FF6C0735000-memory.dmp

Download

memory/3452-27-0x00007FF6C0340000-0x00007FF6C0735000-memory.dmp

Download

memory/3452-1761-0x00007FF6C0340000-0x00007FF6C0735000-memory.dmp

Download

memory/3680-1963-0x00007FF6EF9D0000-0x00007FF6EFDC5000-memory.dmp

Download

memory/3680-839-0x00007FF6EF9D0000-0x00007FF6EFDC5000-memory.dmp

Download

memory/3740-1951-0x00007FF6B1C70000-0x00007FF6B2065000-memory.dmp

Download

memory/3740-20-0x00007FF6B1C70000-0x00007FF6B2065000-memory.dmp

Download

memory/3768-58-0x00007FF7985E0000-0x00007FF7989D5000-memory.dmp

Download

memory/3768-1954-0x00007FF7985E0000-0x00007FF7989D5000-memory.dmp

Download

memory/3840-1955-0x00007FF74FDC0000-0x00007FF7501B5000-memory.dmp

Download

memory/3840-62-0x00007FF74FDC0000-0x00007FF7501B5000-memory.dmp

Download

memory/4120-15-0x00007FF6C4840000-0x00007FF6C4C35000-memory.dmp

Download

memory/4120-1950-0x00007FF6C4840000-0x00007FF6C4C35000-memory.dmp

Download

memory/4124-1956-0x00007FF632420000-0x00007FF632815000-memory.dmp

Download

memory/4124-56-0x00007FF632420000-0x00007FF632815000-memory.dmp

Download

memory/4276-66-0x00007FF630C00000-0x00007FF630FF5000-memory.dmp

Download

memory/4276-1957-0x00007FF630C00000-0x00007FF630FF5000-memory.dmp

Download

memory/4340-1944-0x00007FF6E8170000-0x00007FF6E8565000-memory.dmp

Download

memory/4340-1961-0x00007FF6E8170000-0x00007FF6E8565000-memory.dmp

Download

memory/4340-71-0x00007FF6E8170000-0x00007FF6E8565000-memory.dmp

Download

memory/4604-1968-0x00007FF6D3230000-0x00007FF6D3625000-memory.dmp

Download

memory/4604-84-0x00007FF6D3230000-0x00007FF6D3625000-memory.dmp

Download

memory/4604-1947-0x00007FF6D3230000-0x00007FF6D3625000-memory.dmp

Download

memory/4940-1970-0x00007FF6B7B10000-0x00007FF6B7F05000-memory.dmp

Download

memory/4940-836-0x00007FF6B7B10000-0x00007FF6B7F05000-memory.dmp

Download

memory/4984-1971-0x00007FF77F6A0000-0x00007FF77FA95000-memory.dmp

Download

memory/4984-869-0x00007FF77F6A0000-0x00007FF77FA95000-memory.dmp

Download

memory/5076-859-0x00007FF6AD910000-0x00007FF6ADD05000-memory.dmp

Download

memory/5076-1962-0x00007FF6AD910000-0x00007FF6ADD05000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads