Analysis
- max time kernel
146s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
19/05/2024, 14:08
General
- Target d288f453ca6d1734d4836a9ae4544030_NeikiAnalytics.exe
- Size 1.4MB
- Sample240519-rfw5nsbd21
- SHA256 70ea633971829fc255db1e853ee70cfc3e3f06bd7e2e16ea463b5ce590007b93
Malware Config
Signatures
- KPOT
KPOT is an information stealer that steals user data and account credentials.
- KPOT Core Executable 33 IoCs
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 60 IoCs
- Executes dropped EXE 64 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d288f453ca6d1734d4836a9ae4544030_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d288f453ca6d1734d4836a9ae4544030_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\IwSUSIc.exeC:\Windows\System\IwSUSIc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aGJwdxs.exeC:\Windows\System\aGJwdxs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JJEguKh.exeC:\Windows\System\JJEguKh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OBXdokb.exeC:\Windows\System\OBXdokb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hYMNQmJ.exeC:\Windows\System\hYMNQmJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xcZunRO.exeC:\Windows\System\xcZunRO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aahrCWU.exeC:\Windows\System\aahrCWU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UnJZzfo.exeC:\Windows\System\UnJZzfo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gCQFljI.exeC:\Windows\System\gCQFljI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MGeXwAg.exeC:\Windows\System\MGeXwAg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cpvbjiL.exeC:\Windows\System\cpvbjiL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yFyJURZ.exeC:\Windows\System\yFyJURZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MNOnagy.exeC:\Windows\System\MNOnagy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aBxACUy.exeC:\Windows\System\aBxACUy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zQKFkLM.exeC:\Windows\System\zQKFkLM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jtPSgxZ.exeC:\Windows\System\jtPSgxZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WPdiGsw.exeC:\Windows\System\WPdiGsw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vOBAuiJ.exeC:\Windows\System\vOBAuiJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kxWmvhL.exeC:\Windows\System\kxWmvhL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rszXpBi.exeC:\Windows\System\rszXpBi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vGGGWTr.exeC:\Windows\System\vGGGWTr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XhSbthn.exeC:\Windows\System\XhSbthn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XSCdpTd.exeC:\Windows\System\XSCdpTd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HLbymaS.exeC:\Windows\System\HLbymaS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PMhxQzk.exeC:\Windows\System\PMhxQzk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wCvRaPp.exeC:\Windows\System\wCvRaPp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HirtZaO.exeC:\Windows\System\HirtZaO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TZJItCW.exeC:\Windows\System\TZJItCW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UghwrXr.exeC:\Windows\System\UghwrXr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rNtKwpQ.exeC:\Windows\System\rNtKwpQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cPbPhVk.exeC:\Windows\System\cPbPhVk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hVcOvlY.exeC:\Windows\System\hVcOvlY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FsUiZjD.exeC:\Windows\System\FsUiZjD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AxNoKdT.exeC:\Windows\System\AxNoKdT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ajTEJee.exeC:\Windows\System\ajTEJee.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UkGRkbf.exeC:\Windows\System\UkGRkbf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LrNarPI.exeC:\Windows\System\LrNarPI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NaLCcLn.exeC:\Windows\System\NaLCcLn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rXtqusM.exeC:\Windows\System\rXtqusM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FSRUPQd.exeC:\Windows\System\FSRUPQd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bSRICRe.exeC:\Windows\System\bSRICRe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sYSscsN.exeC:\Windows\System\sYSscsN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Hzzbyfc.exeC:\Windows\System\Hzzbyfc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tMCkWni.exeC:\Windows\System\tMCkWni.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RbkLxdx.exeC:\Windows\System\RbkLxdx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CRMQOAc.exeC:\Windows\System\CRMQOAc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HqWrzNV.exeC:\Windows\System\HqWrzNV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BBBmsBo.exeC:\Windows\System\BBBmsBo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MycQmJJ.exeC:\Windows\System\MycQmJJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WgXpjvM.exeC:\Windows\System\WgXpjvM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jCAgAkZ.exeC:\Windows\System\jCAgAkZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KjHvrDJ.exeC:\Windows\System\KjHvrDJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gDyfHZX.exeC:\Windows\System\gDyfHZX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QRFfvda.exeC:\Windows\System\QRFfvda.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KWJZtIC.exeC:\Windows\System\KWJZtIC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AbNdGoU.exeC:\Windows\System\AbNdGoU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rAHWCtV.exeC:\Windows\System\rAHWCtV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZxlygLg.exeC:\Windows\System\ZxlygLg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cQikZvr.exeC:\Windows\System\cQikZvr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rhJlclu.exeC:\Windows\System\rhJlclu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SYpZvev.exeC:\Windows\System\SYpZvev.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BMOLgsj.exeC:\Windows\System\BMOLgsj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oPTGiBb.exeC:\Windows\System\oPTGiBb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\COCeqBR.exeC:\Windows\System\COCeqBR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lKUNzun.exeC:\Windows\System\lKUNzun.exe2⤵
-
-
C:\Windows\System\UOXzVgE.exeC:\Windows\System\UOXzVgE.exe2⤵
-
-
C:\Windows\System\eKffwqc.exeC:\Windows\System\eKffwqc.exe2⤵
-
-
C:\Windows\System\jBzlaDJ.exeC:\Windows\System\jBzlaDJ.exe2⤵
-
-
C:\Windows\System\UrmNTnL.exeC:\Windows\System\UrmNTnL.exe2⤵
-
-
C:\Windows\System\LdniYiZ.exeC:\Windows\System\LdniYiZ.exe2⤵
-
-
C:\Windows\System\gMKWgRk.exeC:\Windows\System\gMKWgRk.exe2⤵
-
-
C:\Windows\System\FogjDGb.exeC:\Windows\System\FogjDGb.exe2⤵
-
-
C:\Windows\System\FsQIKJn.exeC:\Windows\System\FsQIKJn.exe2⤵
-
-
C:\Windows\System\XZUOEFO.exeC:\Windows\System\XZUOEFO.exe2⤵
-
-
C:\Windows\System\DFPxjre.exeC:\Windows\System\DFPxjre.exe2⤵
-
-
C:\Windows\System\NEuPdlc.exeC:\Windows\System\NEuPdlc.exe2⤵
-
-
C:\Windows\System\MCMGqWD.exeC:\Windows\System\MCMGqWD.exe2⤵
-
-
C:\Windows\System\MYFteKR.exeC:\Windows\System\MYFteKR.exe2⤵
-
-
C:\Windows\System\HXqIYTi.exeC:\Windows\System\HXqIYTi.exe2⤵
-
-
C:\Windows\System\PeCRggK.exeC:\Windows\System\PeCRggK.exe2⤵
-
-
C:\Windows\System\OFKFqcp.exeC:\Windows\System\OFKFqcp.exe2⤵
-
-
C:\Windows\System\hItvehY.exeC:\Windows\System\hItvehY.exe2⤵
-
-
C:\Windows\System\Xiaviwr.exeC:\Windows\System\Xiaviwr.exe2⤵
-
-
C:\Windows\System\RGvydvM.exeC:\Windows\System\RGvydvM.exe2⤵
-
-
C:\Windows\System\waRhXcT.exeC:\Windows\System\waRhXcT.exe2⤵
-
-
C:\Windows\System\khTRpQJ.exeC:\Windows\System\khTRpQJ.exe2⤵
-
-
C:\Windows\System\xxyqIGZ.exeC:\Windows\System\xxyqIGZ.exe2⤵
-
-
C:\Windows\System\AFFoSRk.exeC:\Windows\System\AFFoSRk.exe2⤵
-
-
C:\Windows\System\XWYiFrT.exeC:\Windows\System\XWYiFrT.exe2⤵
-
-
C:\Windows\System\EoUJsNo.exeC:\Windows\System\EoUJsNo.exe2⤵
-
-
C:\Windows\System\TUkYdBk.exeC:\Windows\System\TUkYdBk.exe2⤵
-
-
C:\Windows\System\BFDUPpZ.exeC:\Windows\System\BFDUPpZ.exe2⤵
-
-
C:\Windows\System\ICprHZP.exeC:\Windows\System\ICprHZP.exe2⤵
-
-
C:\Windows\System\ZcgulCS.exeC:\Windows\System\ZcgulCS.exe2⤵
-
-
C:\Windows\System\LFBwhPg.exeC:\Windows\System\LFBwhPg.exe2⤵
-
-
C:\Windows\System\lbZwKHH.exeC:\Windows\System\lbZwKHH.exe2⤵
-
-
C:\Windows\System\ybVwTzx.exeC:\Windows\System\ybVwTzx.exe2⤵
-
-
C:\Windows\System\jLuFYvz.exeC:\Windows\System\jLuFYvz.exe2⤵
-
-
C:\Windows\System\AGVltNw.exeC:\Windows\System\AGVltNw.exe2⤵
-
-
C:\Windows\System\RpNVofQ.exeC:\Windows\System\RpNVofQ.exe2⤵
-
-
C:\Windows\System\teXuJNw.exeC:\Windows\System\teXuJNw.exe2⤵
-
-
C:\Windows\System\zTkjudC.exeC:\Windows\System\zTkjudC.exe2⤵
-
-
C:\Windows\System\LbKovnh.exeC:\Windows\System\LbKovnh.exe2⤵
-
-
C:\Windows\System\uVXAdiR.exeC:\Windows\System\uVXAdiR.exe2⤵
-
-
C:\Windows\System\xGWCeCf.exeC:\Windows\System\xGWCeCf.exe2⤵
-
-
C:\Windows\System\erdvRqe.exeC:\Windows\System\erdvRqe.exe2⤵
-
-
C:\Windows\System\ZiFBKdk.exeC:\Windows\System\ZiFBKdk.exe2⤵
-
-
C:\Windows\System\GCeVGzT.exeC:\Windows\System\GCeVGzT.exe2⤵
-
-
C:\Windows\System\VtSnmSK.exeC:\Windows\System\VtSnmSK.exe2⤵
-
-
C:\Windows\System\ZXjkiuM.exeC:\Windows\System\ZXjkiuM.exe2⤵
-
-
C:\Windows\System\jGZYIPe.exeC:\Windows\System\jGZYIPe.exe2⤵
-
-
C:\Windows\System\JdKpQYT.exeC:\Windows\System\JdKpQYT.exe2⤵
-
-
C:\Windows\System\PEzrTCZ.exeC:\Windows\System\PEzrTCZ.exe2⤵
-
-
C:\Windows\System\JXnupNI.exeC:\Windows\System\JXnupNI.exe2⤵
-
-
C:\Windows\System\TprvFBV.exeC:\Windows\System\TprvFBV.exe2⤵
-
-
C:\Windows\System\gxGHUmz.exeC:\Windows\System\gxGHUmz.exe2⤵
-
-
C:\Windows\System\ACWucHa.exeC:\Windows\System\ACWucHa.exe2⤵
-
-
C:\Windows\System\haEeMVE.exeC:\Windows\System\haEeMVE.exe2⤵
-
-
C:\Windows\System\SLJpeKP.exeC:\Windows\System\SLJpeKP.exe2⤵
-
-
C:\Windows\System\NEqJQSP.exeC:\Windows\System\NEqJQSP.exe2⤵
-
-
C:\Windows\System\VhuHCJB.exeC:\Windows\System\VhuHCJB.exe2⤵
-
-
C:\Windows\System\LOciueN.exeC:\Windows\System\LOciueN.exe2⤵
-
-
C:\Windows\System\makwenc.exeC:\Windows\System\makwenc.exe2⤵
-
-
C:\Windows\System\zfnpAQS.exeC:\Windows\System\zfnpAQS.exe2⤵
-
-
C:\Windows\System\mHpCciz.exeC:\Windows\System\mHpCciz.exe2⤵
-
-
C:\Windows\System\JyVOcJu.exeC:\Windows\System\JyVOcJu.exe2⤵
-
-
C:\Windows\System\zGQwChP.exeC:\Windows\System\zGQwChP.exe2⤵
-
-
C:\Windows\System\YDgcRIe.exeC:\Windows\System\YDgcRIe.exe2⤵
-
-
C:\Windows\System\NiUoVEp.exeC:\Windows\System\NiUoVEp.exe2⤵
-
-
C:\Windows\System\MtzqFIB.exeC:\Windows\System\MtzqFIB.exe2⤵
-
-
C:\Windows\System\duxWNPH.exeC:\Windows\System\duxWNPH.exe2⤵
-
-
C:\Windows\System\EbbGjAx.exeC:\Windows\System\EbbGjAx.exe2⤵
-
-
C:\Windows\System\FdWxJWy.exeC:\Windows\System\FdWxJWy.exe2⤵
-
-
C:\Windows\System\RvekLFj.exeC:\Windows\System\RvekLFj.exe2⤵
-
-
C:\Windows\System\WQjTTYq.exeC:\Windows\System\WQjTTYq.exe2⤵
-
-
C:\Windows\System\sEKFjPf.exeC:\Windows\System\sEKFjPf.exe2⤵
-
-
C:\Windows\System\pvVBNVZ.exeC:\Windows\System\pvVBNVZ.exe2⤵
-
-
C:\Windows\System\IqMJdHO.exeC:\Windows\System\IqMJdHO.exe2⤵
-
-
C:\Windows\System\ATTLGOg.exeC:\Windows\System\ATTLGOg.exe2⤵
-
-
C:\Windows\System\HhWngBy.exeC:\Windows\System\HhWngBy.exe2⤵
-
-
C:\Windows\System\qtdcFtw.exeC:\Windows\System\qtdcFtw.exe2⤵
-
-
C:\Windows\System\ZVMRsAe.exeC:\Windows\System\ZVMRsAe.exe2⤵
-
-
C:\Windows\System\vMjCpCC.exeC:\Windows\System\vMjCpCC.exe2⤵
-
-
C:\Windows\System\GOoYYcD.exeC:\Windows\System\GOoYYcD.exe2⤵
-
-
C:\Windows\System\tALdccZ.exeC:\Windows\System\tALdccZ.exe2⤵
-
-
C:\Windows\System\ltEWBSc.exeC:\Windows\System\ltEWBSc.exe2⤵
-
-
C:\Windows\System\LmEwlzz.exeC:\Windows\System\LmEwlzz.exe2⤵
-
-
C:\Windows\System\TJcjrNB.exeC:\Windows\System\TJcjrNB.exe2⤵
-
-
C:\Windows\System\HwjIcqg.exeC:\Windows\System\HwjIcqg.exe2⤵
-
-
C:\Windows\System\JvUdblW.exeC:\Windows\System\JvUdblW.exe2⤵
-
-
C:\Windows\System\KACejHf.exeC:\Windows\System\KACejHf.exe2⤵
-
-
C:\Windows\System\FLhGlqX.exeC:\Windows\System\FLhGlqX.exe2⤵
-
-
C:\Windows\System\kJpKYyY.exeC:\Windows\System\kJpKYyY.exe2⤵
-
-
C:\Windows\System\tsQhFJH.exeC:\Windows\System\tsQhFJH.exe2⤵
-
-
C:\Windows\System\IpnEiZv.exeC:\Windows\System\IpnEiZv.exe2⤵
-
-
C:\Windows\System\ERmWise.exeC:\Windows\System\ERmWise.exe2⤵
-
-
C:\Windows\System\BfpZGlr.exeC:\Windows\System\BfpZGlr.exe2⤵
-
-
C:\Windows\System\FFXxQTT.exeC:\Windows\System\FFXxQTT.exe2⤵
-
-
C:\Windows\System\SNUIawP.exeC:\Windows\System\SNUIawP.exe2⤵
-
-
C:\Windows\System\dMInpLe.exeC:\Windows\System\dMInpLe.exe2⤵
-
-
C:\Windows\System\WnXIKKa.exeC:\Windows\System\WnXIKKa.exe2⤵
-
-
C:\Windows\System\oAhLBZc.exeC:\Windows\System\oAhLBZc.exe2⤵
-
-
C:\Windows\System\EYGucMz.exeC:\Windows\System\EYGucMz.exe2⤵
-
-
C:\Windows\System\dzDwNDQ.exeC:\Windows\System\dzDwNDQ.exe2⤵
-
-
C:\Windows\System\VsRSuZp.exeC:\Windows\System\VsRSuZp.exe2⤵
-
-
C:\Windows\System\VilGVDv.exeC:\Windows\System\VilGVDv.exe2⤵
-
-
C:\Windows\System\KlbgVBg.exeC:\Windows\System\KlbgVBg.exe2⤵
-
-
C:\Windows\System\GicIuJR.exeC:\Windows\System\GicIuJR.exe2⤵
-
-
C:\Windows\System\wYTCjCi.exeC:\Windows\System\wYTCjCi.exe2⤵
-
-
C:\Windows\System\tsqiBco.exeC:\Windows\System\tsqiBco.exe2⤵
-
-
C:\Windows\System\swdsdYu.exeC:\Windows\System\swdsdYu.exe2⤵
-
-
C:\Windows\System\WpyArPu.exeC:\Windows\System\WpyArPu.exe2⤵
-
-
C:\Windows\System\QipoTAQ.exeC:\Windows\System\QipoTAQ.exe2⤵
-
-
C:\Windows\System\EWMPGrK.exeC:\Windows\System\EWMPGrK.exe2⤵
-
-
C:\Windows\System\HPQibcC.exeC:\Windows\System\HPQibcC.exe2⤵
-
-
C:\Windows\System\yVwYQBL.exeC:\Windows\System\yVwYQBL.exe2⤵
-
-
C:\Windows\System\OcyVWHF.exeC:\Windows\System\OcyVWHF.exe2⤵
-
-
C:\Windows\System\tuBjDMg.exeC:\Windows\System\tuBjDMg.exe2⤵
-
-
C:\Windows\System\cONeOHt.exeC:\Windows\System\cONeOHt.exe2⤵
-
-
C:\Windows\System\RlxNDiz.exeC:\Windows\System\RlxNDiz.exe2⤵
-
-
C:\Windows\System\qRVuoZF.exeC:\Windows\System\qRVuoZF.exe2⤵
-
-
C:\Windows\System\ZMTLnwQ.exeC:\Windows\System\ZMTLnwQ.exe2⤵
-
-
C:\Windows\System\KBKwAzW.exeC:\Windows\System\KBKwAzW.exe2⤵
-
-
C:\Windows\System\AXGlxma.exeC:\Windows\System\AXGlxma.exe2⤵
-
-
C:\Windows\System\fPTVcLI.exeC:\Windows\System\fPTVcLI.exe2⤵
-
-
C:\Windows\System\zeBKXSX.exeC:\Windows\System\zeBKXSX.exe2⤵
-
-
C:\Windows\System\uncvWrJ.exeC:\Windows\System\uncvWrJ.exe2⤵
-
-
C:\Windows\System\LnjiKmp.exeC:\Windows\System\LnjiKmp.exe2⤵
-
-
C:\Windows\System\YSUqdoU.exeC:\Windows\System\YSUqdoU.exe2⤵
-
-
C:\Windows\System\DGkLlok.exeC:\Windows\System\DGkLlok.exe2⤵
-
-
C:\Windows\System\mCqwsgB.exeC:\Windows\System\mCqwsgB.exe2⤵
-
-
C:\Windows\System\QcYHzgQ.exeC:\Windows\System\QcYHzgQ.exe2⤵
-
-
C:\Windows\System\ZzUIxFx.exeC:\Windows\System\ZzUIxFx.exe2⤵
-
-
C:\Windows\System\mvpCsei.exeC:\Windows\System\mvpCsei.exe2⤵
-
-
C:\Windows\System\BWVFVhW.exeC:\Windows\System\BWVFVhW.exe2⤵
-
-
C:\Windows\System\MZduNdg.exeC:\Windows\System\MZduNdg.exe2⤵
-
-
C:\Windows\System\fyJhqCZ.exeC:\Windows\System\fyJhqCZ.exe2⤵
-
-
C:\Windows\System\ureFvYA.exeC:\Windows\System\ureFvYA.exe2⤵
-
-
C:\Windows\System\EcUyEGP.exeC:\Windows\System\EcUyEGP.exe2⤵
-
-
C:\Windows\System\sjWbKtv.exeC:\Windows\System\sjWbKtv.exe2⤵
-
-
C:\Windows\System\RAvxxgB.exeC:\Windows\System\RAvxxgB.exe2⤵
-
-
C:\Windows\System\mjbwtSG.exeC:\Windows\System\mjbwtSG.exe2⤵
-
-
C:\Windows\System\SxJGNNM.exeC:\Windows\System\SxJGNNM.exe2⤵
-
-
C:\Windows\System\hCmAQIC.exeC:\Windows\System\hCmAQIC.exe2⤵
-
-
C:\Windows\System\FDYDABO.exeC:\Windows\System\FDYDABO.exe2⤵
-
-
C:\Windows\System\BGhncZV.exeC:\Windows\System\BGhncZV.exe2⤵
-
-
C:\Windows\System\LGdaBBV.exeC:\Windows\System\LGdaBBV.exe2⤵
-
-
C:\Windows\System\ytkAPlx.exeC:\Windows\System\ytkAPlx.exe2⤵
-
-
C:\Windows\System\wIZXrCw.exeC:\Windows\System\wIZXrCw.exe2⤵
-
-
C:\Windows\System\CtdmdDl.exeC:\Windows\System\CtdmdDl.exe2⤵
-
-
C:\Windows\System\pdBNIgE.exeC:\Windows\System\pdBNIgE.exe2⤵
-
-
C:\Windows\System\YVBSfFk.exeC:\Windows\System\YVBSfFk.exe2⤵
-
-
C:\Windows\System\MaXLBNh.exeC:\Windows\System\MaXLBNh.exe2⤵
-
-
C:\Windows\System\JJOfTWN.exeC:\Windows\System\JJOfTWN.exe2⤵
-
-
C:\Windows\System\okfENYw.exeC:\Windows\System\okfENYw.exe2⤵
-
-
C:\Windows\System\xIBMgkX.exeC:\Windows\System\xIBMgkX.exe2⤵
-
-
C:\Windows\System\symIdUM.exeC:\Windows\System\symIdUM.exe2⤵
-
-
C:\Windows\System\LwPJmtz.exeC:\Windows\System\LwPJmtz.exe2⤵
-
-
C:\Windows\System\LyYXKab.exeC:\Windows\System\LyYXKab.exe2⤵
-
-
C:\Windows\System\evCXSyf.exeC:\Windows\System\evCXSyf.exe2⤵
-
-
C:\Windows\System\vEjkZpk.exeC:\Windows\System\vEjkZpk.exe2⤵
-
-
C:\Windows\System\CLqpgaO.exeC:\Windows\System\CLqpgaO.exe2⤵
-
-
C:\Windows\System\AKYtxIp.exeC:\Windows\System\AKYtxIp.exe2⤵
-
-
C:\Windows\System\YkOBnjj.exeC:\Windows\System\YkOBnjj.exe2⤵
-
-
C:\Windows\System\iNNyzQO.exeC:\Windows\System\iNNyzQO.exe2⤵
-
-
C:\Windows\System\rszEmpW.exeC:\Windows\System\rszEmpW.exe2⤵
-
-
C:\Windows\System\BMWHCJX.exeC:\Windows\System\BMWHCJX.exe2⤵
-
-
C:\Windows\System\RqvpsNG.exeC:\Windows\System\RqvpsNG.exe2⤵
-
-
C:\Windows\System\qIdzYdO.exeC:\Windows\System\qIdzYdO.exe2⤵
-
-
C:\Windows\System\OmHIObf.exeC:\Windows\System\OmHIObf.exe2⤵
-
-
C:\Windows\System\moiPJGP.exeC:\Windows\System\moiPJGP.exe2⤵
-
-
C:\Windows\System\Lncofmt.exeC:\Windows\System\Lncofmt.exe2⤵
-
-
C:\Windows\System\mftBmNX.exeC:\Windows\System\mftBmNX.exe2⤵
-
-
C:\Windows\System\msSaVAe.exeC:\Windows\System\msSaVAe.exe2⤵
-
-
C:\Windows\System\tdRCksT.exeC:\Windows\System\tdRCksT.exe2⤵
-
-
C:\Windows\System\qVXVOdk.exeC:\Windows\System\qVXVOdk.exe2⤵
-
-
C:\Windows\System\EiwkvGi.exeC:\Windows\System\EiwkvGi.exe2⤵
-
-
C:\Windows\System\SqwEFrj.exeC:\Windows\System\SqwEFrj.exe2⤵
-
-
C:\Windows\System\upovPsM.exeC:\Windows\System\upovPsM.exe2⤵
-
-
C:\Windows\System\xcaELOT.exeC:\Windows\System\xcaELOT.exe2⤵
-
-
C:\Windows\System\BRngGYH.exeC:\Windows\System\BRngGYH.exe2⤵
-
-
C:\Windows\System\HDGlMox.exeC:\Windows\System\HDGlMox.exe2⤵
-
-
C:\Windows\System\ifRuKCe.exeC:\Windows\System\ifRuKCe.exe2⤵
-
-
C:\Windows\System\yRQybEO.exeC:\Windows\System\yRQybEO.exe2⤵
-
-
C:\Windows\System\mafdNph.exeC:\Windows\System\mafdNph.exe2⤵
-
-
C:\Windows\System\JnfebKe.exeC:\Windows\System\JnfebKe.exe2⤵
-
-
C:\Windows\System\xgTJAjQ.exeC:\Windows\System\xgTJAjQ.exe2⤵
-
-
C:\Windows\System\MBZxqmm.exeC:\Windows\System\MBZxqmm.exe2⤵
-
-
C:\Windows\System\paMKHJR.exeC:\Windows\System\paMKHJR.exe2⤵
-
-
C:\Windows\System\ZFpKgvd.exeC:\Windows\System\ZFpKgvd.exe2⤵
-
-
C:\Windows\System\rmrXRhH.exeC:\Windows\System\rmrXRhH.exe2⤵
-
-
C:\Windows\System\XHPpBfL.exeC:\Windows\System\XHPpBfL.exe2⤵
-
-
C:\Windows\System\rQVXxHJ.exeC:\Windows\System\rQVXxHJ.exe2⤵
-
-
C:\Windows\System\OuUHEDN.exeC:\Windows\System\OuUHEDN.exe2⤵
-
-
C:\Windows\System\ZMweUtG.exeC:\Windows\System\ZMweUtG.exe2⤵
-
-
C:\Windows\System\FTrdxZO.exeC:\Windows\System\FTrdxZO.exe2⤵
-
-
C:\Windows\System\slQfHtQ.exeC:\Windows\System\slQfHtQ.exe2⤵
-
-
C:\Windows\System\FpHBrUc.exeC:\Windows\System\FpHBrUc.exe2⤵
-
-
C:\Windows\System\TIcUeVr.exeC:\Windows\System\TIcUeVr.exe2⤵
-
-
C:\Windows\System\AhTQRZF.exeC:\Windows\System\AhTQRZF.exe2⤵
-
-
C:\Windows\System\TqCarrx.exeC:\Windows\System\TqCarrx.exe2⤵
-
-
C:\Windows\System\HjqzhSb.exeC:\Windows\System\HjqzhSb.exe2⤵
-
-
C:\Windows\System\dxnLLvz.exeC:\Windows\System\dxnLLvz.exe2⤵
-
-
C:\Windows\System\yhddNws.exeC:\Windows\System\yhddNws.exe2⤵
-
-
C:\Windows\System\dVdefHU.exeC:\Windows\System\dVdefHU.exe2⤵
-
-
C:\Windows\System\qPsnZqy.exeC:\Windows\System\qPsnZqy.exe2⤵
-
-
C:\Windows\System\ehpBMug.exeC:\Windows\System\ehpBMug.exe2⤵
-
-
C:\Windows\System\PBsQyix.exeC:\Windows\System\PBsQyix.exe2⤵
-
-
C:\Windows\System\ylONCbZ.exeC:\Windows\System\ylONCbZ.exe2⤵
-
-
C:\Windows\System\KNiDBQI.exeC:\Windows\System\KNiDBQI.exe2⤵
-
-
C:\Windows\System\OsbLmSj.exeC:\Windows\System\OsbLmSj.exe2⤵
-
-
C:\Windows\System\kEuPOEc.exeC:\Windows\System\kEuPOEc.exe2⤵
-
-
C:\Windows\System\mmsMwsm.exeC:\Windows\System\mmsMwsm.exe2⤵
-
-
C:\Windows\System\psxxwCO.exeC:\Windows\System\psxxwCO.exe2⤵
-
-
C:\Windows\System\sLBTyFJ.exeC:\Windows\System\sLBTyFJ.exe2⤵
-
-
C:\Windows\System\MuTLUtX.exeC:\Windows\System\MuTLUtX.exe2⤵
-
-
C:\Windows\System\vcKnRtH.exeC:\Windows\System\vcKnRtH.exe2⤵
-
-
C:\Windows\System\JtIDImr.exeC:\Windows\System\JtIDImr.exe2⤵
-
-
C:\Windows\System\xSlDrMP.exeC:\Windows\System\xSlDrMP.exe2⤵
-
-
C:\Windows\System\GgyCbTv.exeC:\Windows\System\GgyCbTv.exe2⤵
-
-
C:\Windows\System\HELMXOT.exeC:\Windows\System\HELMXOT.exe2⤵
-
-
C:\Windows\System\grgdnPE.exeC:\Windows\System\grgdnPE.exe2⤵
-
-
C:\Windows\System\HZJLlwH.exeC:\Windows\System\HZJLlwH.exe2⤵
-
-
C:\Windows\System\PyeRgvZ.exeC:\Windows\System\PyeRgvZ.exe2⤵
-
-
C:\Windows\System\UXvTDLa.exeC:\Windows\System\UXvTDLa.exe2⤵
-
-
C:\Windows\System\eyPIdBY.exeC:\Windows\System\eyPIdBY.exe2⤵
-
-
C:\Windows\System\TElEBHa.exeC:\Windows\System\TElEBHa.exe2⤵
-
-
C:\Windows\System\MjCDhxf.exeC:\Windows\System\MjCDhxf.exe2⤵
-
-
C:\Windows\System\Jbkuxic.exeC:\Windows\System\Jbkuxic.exe2⤵
-
-
C:\Windows\System\zOcSDWZ.exeC:\Windows\System\zOcSDWZ.exe2⤵
-
-
C:\Windows\System\gtEBsLA.exeC:\Windows\System\gtEBsLA.exe2⤵
-
-
C:\Windows\System\NXjURfL.exeC:\Windows\System\NXjURfL.exe2⤵
-
-
C:\Windows\System\lAoHpSQ.exeC:\Windows\System\lAoHpSQ.exe2⤵
-
-
C:\Windows\System\bPefZHa.exeC:\Windows\System\bPefZHa.exe2⤵
-
-
C:\Windows\System\sMkbSbk.exeC:\Windows\System\sMkbSbk.exe2⤵
-
-
C:\Windows\System\FuzAsLa.exeC:\Windows\System\FuzAsLa.exe2⤵
-
-
C:\Windows\System\vDgxPHP.exeC:\Windows\System\vDgxPHP.exe2⤵
-
-
C:\Windows\System\xcFRQhx.exeC:\Windows\System\xcFRQhx.exe2⤵
-
-
C:\Windows\System\gBHteOy.exeC:\Windows\System\gBHteOy.exe2⤵
-
-
C:\Windows\System\BqEQTLM.exeC:\Windows\System\BqEQTLM.exe2⤵
-
-
C:\Windows\System\OdxtgmJ.exeC:\Windows\System\OdxtgmJ.exe2⤵
-
-
C:\Windows\System\kQOnFnT.exeC:\Windows\System\kQOnFnT.exe2⤵
-
-
C:\Windows\System\mshelTl.exeC:\Windows\System\mshelTl.exe2⤵
-
-
C:\Windows\System\uSifWZs.exeC:\Windows\System\uSifWZs.exe2⤵
-
-
C:\Windows\System\DXoaLzY.exeC:\Windows\System\DXoaLzY.exe2⤵
-
-
C:\Windows\System\bUVTVVz.exeC:\Windows\System\bUVTVVz.exe2⤵
-
-
C:\Windows\System\rLcxKaI.exeC:\Windows\System\rLcxKaI.exe2⤵
-
-
C:\Windows\System\vvtYJZv.exeC:\Windows\System\vvtYJZv.exe2⤵
-
-
C:\Windows\System\DPTpxat.exeC:\Windows\System\DPTpxat.exe2⤵
-
-
C:\Windows\System\lPwrZIL.exeC:\Windows\System\lPwrZIL.exe2⤵
-
-
C:\Windows\System\LkloWWt.exeC:\Windows\System\LkloWWt.exe2⤵
-
-
C:\Windows\System\arWyrgu.exeC:\Windows\System\arWyrgu.exe2⤵
-
-
C:\Windows\System\vSaptKF.exeC:\Windows\System\vSaptKF.exe2⤵
-
-
C:\Windows\System\AQHeQJQ.exeC:\Windows\System\AQHeQJQ.exe2⤵
-
-
C:\Windows\System\aBlXhTG.exeC:\Windows\System\aBlXhTG.exe2⤵
-
-
C:\Windows\System\GdInvUX.exeC:\Windows\System\GdInvUX.exe2⤵
-
-
C:\Windows\System\JZFsdfT.exeC:\Windows\System\JZFsdfT.exe2⤵
-
-
C:\Windows\System\IgBQUdY.exeC:\Windows\System\IgBQUdY.exe2⤵
-
-
C:\Windows\System\qWanFqm.exeC:\Windows\System\qWanFqm.exe2⤵
-
-
C:\Windows\System\kuFwzvK.exeC:\Windows\System\kuFwzvK.exe2⤵
-
-
C:\Windows\System\rUJtCQp.exeC:\Windows\System\rUJtCQp.exe2⤵
-
-
C:\Windows\System\mdjROML.exeC:\Windows\System\mdjROML.exe2⤵
-
-
C:\Windows\System\DCKMqJH.exeC:\Windows\System\DCKMqJH.exe2⤵
-
-
C:\Windows\System\EiBgbwi.exeC:\Windows\System\EiBgbwi.exe2⤵
-
-
C:\Windows\System\BqGaUxB.exeC:\Windows\System\BqGaUxB.exe2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
FsUiZjD.exe
HLbymaS.exe
HirtZaO.exe
IwSUSIc.exe
JJEguKh.exe
MGeXwAg.exe
MNOnagy.exe
OBXdokb.exe
PMhxQzk.exe
TZJItCW.exe
UghwrXr.exe
UnJZzfo.exe
WPdiGsw.exe
XSCdpTd.exe
XhSbthn.exe
aBxACUy.exe
aGJwdxs.exe
aahrCWU.exe
cPbPhVk.exe
cpvbjiL.exe
gCQFljI.exe
hVcOvlY.exe
hYMNQmJ.exe
jtPSgxZ.exe
kxWmvhL.exe
rNtKwpQ.exe
rszXpBi.exe
vGGGWTr.exe
vOBAuiJ.exe
wCvRaPp.exe
xcZunRO.exe
yFyJURZ.exe
zQKFkLM.exe
memory/1172-1147-0x00007FF6CD560000-0x00007FF6CD8B1000-memory.dmp
memory/1172-1217-0x00007FF6CD560000-0x00007FF6CD8B1000-memory.dmp
memory/1172-114-0x00007FF6CD560000-0x00007FF6CD8B1000-memory.dmp
memory/1272-155-0x00007FF6DE590000-0x00007FF6DE8E1000-memory.dmp
memory/1272-1233-0x00007FF6DE590000-0x00007FF6DE8E1000-memory.dmp
memory/1304-1207-0x00007FF7FC1B0000-0x00007FF7FC501000-memory.dmp
memory/1304-140-0x00007FF7FC1B0000-0x00007FF7FC501000-memory.dmp
memory/1304-61-0x00007FF7FC1B0000-0x00007FF7FC501000-memory.dmp
memory/1356-174-0x00007FF7CDC10000-0x00007FF7CDF61000-memory.dmp
memory/1356-1185-0x00007FF7CDC10000-0x00007FF7CDF61000-memory.dmp
memory/1356-1235-0x00007FF7CDC10000-0x00007FF7CDF61000-memory.dmp
memory/1368-1199-0x00007FF691E10000-0x00007FF692161000-memory.dmp
memory/1368-67-0x00007FF691E10000-0x00007FF692161000-memory.dmp
memory/1376-1186-0x00007FF7BAB40000-0x00007FF7BAE91000-memory.dmp
memory/1376-175-0x00007FF7BAB40000-0x00007FF7BAE91000-memory.dmp
memory/1376-1231-0x00007FF7BAB40000-0x00007FF7BAE91000-memory.dmp
memory/1572-1201-0x00007FF7FE550000-0x00007FF7FE8A1000-memory.dmp
memory/1572-139-0x00007FF7FE550000-0x00007FF7FE8A1000-memory.dmp
memory/1572-40-0x00007FF7FE550000-0x00007FF7FE8A1000-memory.dmp
memory/1624-20-0x00007FF7A7F90000-0x00007FF7A82E1000-memory.dmp
memory/1624-147-0x00007FF7A7F90000-0x00007FF7A82E1000-memory.dmp
memory/1624-1196-0x00007FF7A7F90000-0x00007FF7A82E1000-memory.dmp
memory/1804-64-0x00007FF7EB090000-0x00007FF7EB3E1000-memory.dmp
memory/1804-1208-0x00007FF7EB090000-0x00007FF7EB3E1000-memory.dmp
memory/1804-162-0x00007FF7EB090000-0x00007FF7EB3E1000-memory.dmp
memory/2012-1220-0x00007FF73BC10000-0x00007FF73BF61000-memory.dmp
memory/2012-194-0x00007FF73BC10000-0x00007FF73BF61000-memory.dmp
memory/2012-89-0x00007FF73BC10000-0x00007FF73BF61000-memory.dmp
memory/2032-156-0x00007FF688B80000-0x00007FF688ED1000-memory.dmp
memory/2032-1240-0x00007FF688B80000-0x00007FF688ED1000-memory.dmp
memory/2032-1152-0x00007FF688B80000-0x00007FF688ED1000-memory.dmp
memory/2128-1247-0x00007FF7C71F0000-0x00007FF7C7541000-memory.dmp
memory/2128-1150-0x00007FF7C71F0000-0x00007FF7C7541000-memory.dmp
memory/2128-138-0x00007FF7C71F0000-0x00007FF7C7541000-memory.dmp
memory/2368-187-0x00007FF6F7ED0000-0x00007FF6F8221000-memory.dmp
memory/2368-1251-0x00007FF6F7ED0000-0x00007FF6F8221000-memory.dmp
memory/2368-1187-0x00007FF6F7ED0000-0x00007FF6F8221000-memory.dmp
memory/2532-1228-0x00007FF7627A0000-0x00007FF762AF1000-memory.dmp
memory/2532-1148-0x00007FF7627A0000-0x00007FF762AF1000-memory.dmp
memory/2532-120-0x00007FF7627A0000-0x00007FF762AF1000-memory.dmp
memory/2628-1237-0x00007FF6FD3B0000-0x00007FF6FD701000-memory.dmp
memory/2628-154-0x00007FF6FD3B0000-0x00007FF6FD701000-memory.dmp
memory/2728-1216-0x00007FF76B310000-0x00007FF76B661000-memory.dmp
memory/2728-76-0x00007FF76B310000-0x00007FF76B661000-memory.dmp
memory/2772-1153-0x00007FF7196D0000-0x00007FF719A21000-memory.dmp
memory/2772-1238-0x00007FF7196D0000-0x00007FF719A21000-memory.dmp
memory/2772-168-0x00007FF7196D0000-0x00007FF719A21000-memory.dmp
memory/2972-79-0x00007FF62A310000-0x00007FF62A661000-memory.dmp
memory/2972-1214-0x00007FF62A310000-0x00007FF62A661000-memory.dmp
memory/3196-188-0x00007FF6822F0000-0x00007FF682641000-memory.dmp
memory/3196-1188-0x00007FF6822F0000-0x00007FF682641000-memory.dmp
memory/3196-1250-0x00007FF6822F0000-0x00007FF682641000-memory.dmp
memory/3620-181-0x00007FF786110000-0x00007FF786461000-memory.dmp
memory/3620-1212-0x00007FF786110000-0x00007FF786461000-memory.dmp
memory/3620-80-0x00007FF786110000-0x00007FF786461000-memory.dmp
memory/3968-141-0x00007FF6C60F0000-0x00007FF6C6441000-memory.dmp
memory/3968-1192-0x00007FF6C60F0000-0x00007FF6C6441000-memory.dmp
memory/3968-19-0x00007FF6C60F0000-0x00007FF6C6441000-memory.dmp
memory/4080-113-0x00007FF775AB0000-0x00007FF775E01000-memory.dmp
memory/4080-1-0x000001F1AD210000-0x000001F1AD220000-memory.dmp
memory/4080-0-0x00007FF775AB0000-0x00007FF775E01000-memory.dmp
memory/4172-107-0x00007FF7DDC00000-0x00007FF7DDF51000-memory.dmp
memory/4172-1219-0x00007FF7DDC00000-0x00007FF7DDF51000-memory.dmp
memory/4172-1146-0x00007FF7DDC00000-0x00007FF7DDF51000-memory.dmp
memory/4180-95-0x00007FF7133F0000-0x00007FF713741000-memory.dmp
memory/4180-1223-0x00007FF7133F0000-0x00007FF713741000-memory.dmp
memory/4180-195-0x00007FF7133F0000-0x00007FF713741000-memory.dmp
memory/4224-1203-0x00007FF6FC860000-0x00007FF6FCBB1000-memory.dmp
memory/4224-148-0x00007FF6FC860000-0x00007FF6FCBB1000-memory.dmp
memory/4224-50-0x00007FF6FC860000-0x00007FF6FCBB1000-memory.dmp
memory/4472-1227-0x00007FF6EE670000-0x00007FF6EE9C1000-memory.dmp
memory/4472-132-0x00007FF6EE670000-0x00007FF6EE9C1000-memory.dmp
memory/4472-1149-0x00007FF6EE670000-0x00007FF6EE9C1000-memory.dmp
memory/4708-1190-0x00007FF69E5C0000-0x00007FF69E911000-memory.dmp
memory/4708-126-0x00007FF69E5C0000-0x00007FF69E911000-memory.dmp
memory/4708-8-0x00007FF69E5C0000-0x00007FF69E911000-memory.dmp
memory/4960-73-0x00007FF7C2520000-0x00007FF7C2871000-memory.dmp
memory/4960-1204-0x00007FF7C2520000-0x00007FF7C2871000-memory.dmp
memory/5020-34-0x00007FF7C12B0000-0x00007FF7C1601000-memory.dmp
memory/5020-1195-0x00007FF7C12B0000-0x00007FF7C1601000-memory.dmp
memory/5048-1224-0x00007FF702E50000-0x00007FF7031A1000-memory.dmp
memory/5048-1113-0x00007FF702E50000-0x00007FF7031A1000-memory.dmp
memory/5048-101-0x00007FF702E50000-0x00007FF7031A1000-memory.dmp