xmrig | b4ae7ae224d3c8d31e66eeeafa48b3c2e4589cf08b5c39dc4a6f2ccb4515ae7f

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 19:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
Size 3.1MB
Sample240523-ya35csde8z
SHA256 b4ae7ae224d3c8d31e66eeeafa48b3c2e4589cf08b5c39dc4a6f2ccb4515ae7f
MD5 9158b78f33a18d4a77608ddf3b9b3f30
SHA1 000fcf76efecce6151eb905015688678f5c683d4
SHA512 de6a5abf9d74527609ea395ecb52c850f5b87bff8eb4f975e0c85115b12ed946dc326c8e943dcc46d1e120c0bf1bf84d896f1ec1695c1a9034f881562e4dc275
SSDEEP 98304:N0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc40E:NFWPClFkE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4808-0-0x00007FF686620000-0x00007FF686A15000-memory.dmp	xmrig
behavioral2/files/0x0007000000023298-5.dat	xmrig
behavioral2/files/0x0008000000023423-8.dat	xmrig
behavioral2/files/0x0007000000023427-17.dat	xmrig
behavioral2/memory/2904-9-0x00007FF699DC0000-0x00007FF69A1B5000-memory.dmp	xmrig
behavioral2/files/0x0007000000023428-22.dat	xmrig
behavioral2/memory/1588-21-0x00007FF7A2920000-0x00007FF7A2D15000-memory.dmp	xmrig
behavioral2/memory/2596-23-0x00007FF730790000-0x00007FF730B85000-memory.dmp	xmrig
behavioral2/files/0x0007000000023429-31.dat	xmrig
behavioral2/files/0x000700000002342a-34.dat	xmrig
behavioral2/files/0x000700000002342b-41.dat	xmrig
behavioral2/memory/2936-35-0x00007FF622210000-0x00007FF622605000-memory.dmp	xmrig
behavioral2/memory/2660-26-0x00007FF7C3BD0000-0x00007FF7C3FC5000-memory.dmp	xmrig
behavioral2/memory/2324-43-0x00007FF739770000-0x00007FF739B65000-memory.dmp	xmrig
behavioral2/memory/4680-50-0x00007FF726560000-0x00007FF726955000-memory.dmp	xmrig
behavioral2/files/0x000700000002342e-52.dat	xmrig
behavioral2/files/0x000700000002342f-55.dat	xmrig
behavioral2/files/0x0007000000023432-78.dat	xmrig
behavioral2/files/0x0007000000023434-86.dat	xmrig
behavioral2/files/0x0007000000023437-103.dat	xmrig
behavioral2/files/0x0007000000023438-108.dat	xmrig
behavioral2/files/0x000700000002343b-121.dat	xmrig
behavioral2/files/0x000700000002343c-128.dat	xmrig
behavioral2/files/0x0007000000023441-153.dat	xmrig
behavioral2/files/0x0007000000023444-168.dat	xmrig
behavioral2/memory/2600-535-0x00007FF6DF1E0000-0x00007FF6DF5D5000-memory.dmp	xmrig
behavioral2/memory/5032-536-0x00007FF61A650000-0x00007FF61AA45000-memory.dmp	xmrig
behavioral2/memory/876-537-0x00007FF634120000-0x00007FF634515000-memory.dmp	xmrig
behavioral2/memory/2980-538-0x00007FF6295E0000-0x00007FF6299D5000-memory.dmp	xmrig
behavioral2/memory/1208-540-0x00007FF7287F0000-0x00007FF728BE5000-memory.dmp	xmrig
behavioral2/memory/2096-539-0x00007FF69EAE0000-0x00007FF69EED5000-memory.dmp	xmrig
behavioral2/memory/4544-541-0x00007FF7BE2E0000-0x00007FF7BE6D5000-memory.dmp	xmrig
behavioral2/memory/1880-542-0x00007FF7365B0000-0x00007FF7369A5000-memory.dmp	xmrig
behavioral2/memory/3064-543-0x00007FF66A1C0000-0x00007FF66A5B5000-memory.dmp	xmrig
behavioral2/memory/3416-553-0x00007FF6918F0000-0x00007FF691CE5000-memory.dmp	xmrig
behavioral2/memory/668-557-0x00007FF77BE90000-0x00007FF77C285000-memory.dmp	xmrig
behavioral2/memory/3300-573-0x00007FF673370000-0x00007FF673765000-memory.dmp	xmrig
behavioral2/memory/4608-577-0x00007FF65C4A0000-0x00007FF65C895000-memory.dmp	xmrig
behavioral2/memory/564-567-0x00007FF76BC80000-0x00007FF76C075000-memory.dmp	xmrig
behavioral2/memory/3936-563-0x00007FF7EBEC0000-0x00007FF7EC2B5000-memory.dmp	xmrig
behavioral2/memory/4704-550-0x00007FF6B8980000-0x00007FF6B8D75000-memory.dmp	xmrig
behavioral2/memory/1048-547-0x00007FF73B210000-0x00007FF73B605000-memory.dmp	xmrig
behavioral2/files/0x0007000000023443-163.dat	xmrig
behavioral2/files/0x0007000000023442-158.dat	xmrig
behavioral2/files/0x0007000000023440-148.dat	xmrig
behavioral2/files/0x000700000002343f-143.dat	xmrig
behavioral2/files/0x000700000002343e-138.dat	xmrig
behavioral2/files/0x000700000002343d-133.dat	xmrig
behavioral2/files/0x000700000002343a-118.dat	xmrig
behavioral2/files/0x0007000000023439-113.dat	xmrig
behavioral2/files/0x0007000000023436-98.dat	xmrig
behavioral2/files/0x0007000000023435-93.dat	xmrig
behavioral2/files/0x0007000000023433-83.dat	xmrig
behavioral2/files/0x0007000000023431-73.dat	xmrig
behavioral2/files/0x0007000000023430-68.dat	xmrig
behavioral2/files/0x0008000000023424-63.dat	xmrig
behavioral2/files/0x000700000002342c-47.dat	xmrig
behavioral2/memory/4808-1405-0x00007FF686620000-0x00007FF686A15000-memory.dmp	xmrig
behavioral2/memory/2904-1408-0x00007FF699DC0000-0x00007FF69A1B5000-memory.dmp	xmrig
behavioral2/memory/2324-1897-0x00007FF739770000-0x00007FF739B65000-memory.dmp	xmrig
behavioral2/memory/4808-1898-0x00007FF686620000-0x00007FF686A15000-memory.dmp	xmrig
behavioral2/memory/2904-1899-0x00007FF699DC0000-0x00007FF69A1B5000-memory.dmp	xmrig
behavioral2/memory/1588-1900-0x00007FF7A2920000-0x00007FF7A2D15000-memory.dmp	xmrig
behavioral2/memory/2660-1901-0x00007FF7C3BD0000-0x00007FF7C3FC5000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2904	vsJklIo.exe
1588	vUJojTR.exe
2660	MrkryOC.exe
2596	xVIRGQy.exe
2936	PEyQvOZ.exe
2324	BwkQSoT.exe
4680	frZimVE.exe
2600	vONWDeF.exe
4608	bvYmdWg.exe
5032	vrWOTUz.exe
876	UmJGxnz.exe
2980	tfZqMqq.exe
2096	kbujkdK.exe
1208	QWtYwvc.exe
4544	wrhsxaE.exe
1880	Cwifaib.exe
3064	DexWvia.exe
1048	MajAdUC.exe
4704	axHwJQa.exe
3416	CSnquJV.exe
668	QZZRQUx.exe
3936	EwiTOTx.exe
564	iapvRBL.exe
3300	gMSTymW.exe
748	vfBeVLs.exe
4840	zmmpWnq.exe
3756	cJkjEUk.exe
1216	CAvvGct.exe
4320	hmgFrPl.exe
1072	jnnDazX.exe
4344	muGTwsh.exe
5044	Zrrkfal.exe
4920	zByOPbb.exe
2328	aBkKLtm.exe
2616	XgFrcwR.exe
4996	bMWniaK.exe
1164	HSsBeEr.exe
3520	VnBrenN.exe
4280	KrZcRis.exe
3308	KABoQXt.exe
4404	qyCjZbI.exe
3108	BkKjHEo.exe
4708	vCkhBRt.exe
1828	lXYHcIU.exe
2044	ZXmamOo.exe
4788	VyFSfRV.exe
3516	QidfReP.exe
4236	xfBhJEw.exe
1952	dNazumN.exe
3916	IWSksHs.exe
1720	RPGfrnX.exe
3876	UlGfLQn.exe
1200	FrOAnvN.exe
2900	SRXmFdQ.exe
3548	dsMwrnm.exe
216	TOLaYwH.exe
4180	IbYITWW.exe
3364	JmDeNTt.exe
2260	vsALeBI.exe
5028	wlEOOIU.exe
3676	yClKDRE.exe
1864	lONFEFf.exe
1304	wdeFobh.exe
4136	GBckiAw.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4808-0-0x00007FF686620000-0x00007FF686A15000-memory.dmp	upx
behavioral2/files/0x0007000000023298-5.dat	upx
behavioral2/files/0x0008000000023423-8.dat	upx
behavioral2/files/0x0007000000023427-17.dat	upx
behavioral2/memory/2904-9-0x00007FF699DC0000-0x00007FF69A1B5000-memory.dmp	upx
behavioral2/files/0x0007000000023428-22.dat	upx
behavioral2/memory/1588-21-0x00007FF7A2920000-0x00007FF7A2D15000-memory.dmp	upx
behavioral2/memory/2596-23-0x00007FF730790000-0x00007FF730B85000-memory.dmp	upx
behavioral2/files/0x0007000000023429-31.dat	upx
behavioral2/files/0x000700000002342a-34.dat	upx
behavioral2/files/0x000700000002342b-41.dat	upx
behavioral2/memory/2936-35-0x00007FF622210000-0x00007FF622605000-memory.dmp	upx
behavioral2/memory/2660-26-0x00007FF7C3BD0000-0x00007FF7C3FC5000-memory.dmp	upx
behavioral2/memory/2324-43-0x00007FF739770000-0x00007FF739B65000-memory.dmp	upx
behavioral2/memory/4680-50-0x00007FF726560000-0x00007FF726955000-memory.dmp	upx
behavioral2/files/0x000700000002342e-52.dat	upx
behavioral2/files/0x000700000002342f-55.dat	upx
behavioral2/files/0x0007000000023432-78.dat	upx
behavioral2/files/0x0007000000023434-86.dat	upx
behavioral2/files/0x0007000000023437-103.dat	upx
behavioral2/files/0x0007000000023438-108.dat	upx
behavioral2/files/0x000700000002343b-121.dat	upx
behavioral2/files/0x000700000002343c-128.dat	upx
behavioral2/files/0x0007000000023441-153.dat	upx
behavioral2/files/0x0007000000023444-168.dat	upx
behavioral2/memory/2600-535-0x00007FF6DF1E0000-0x00007FF6DF5D5000-memory.dmp	upx
behavioral2/memory/5032-536-0x00007FF61A650000-0x00007FF61AA45000-memory.dmp	upx
behavioral2/memory/876-537-0x00007FF634120000-0x00007FF634515000-memory.dmp	upx
behavioral2/memory/2980-538-0x00007FF6295E0000-0x00007FF6299D5000-memory.dmp	upx
behavioral2/memory/1208-540-0x00007FF7287F0000-0x00007FF728BE5000-memory.dmp	upx
behavioral2/memory/2096-539-0x00007FF69EAE0000-0x00007FF69EED5000-memory.dmp	upx
behavioral2/memory/4544-541-0x00007FF7BE2E0000-0x00007FF7BE6D5000-memory.dmp	upx
behavioral2/memory/1880-542-0x00007FF7365B0000-0x00007FF7369A5000-memory.dmp	upx
behavioral2/memory/3064-543-0x00007FF66A1C0000-0x00007FF66A5B5000-memory.dmp	upx
behavioral2/memory/3416-553-0x00007FF6918F0000-0x00007FF691CE5000-memory.dmp	upx
behavioral2/memory/668-557-0x00007FF77BE90000-0x00007FF77C285000-memory.dmp	upx
behavioral2/memory/3300-573-0x00007FF673370000-0x00007FF673765000-memory.dmp	upx
behavioral2/memory/4608-577-0x00007FF65C4A0000-0x00007FF65C895000-memory.dmp	upx
behavioral2/memory/564-567-0x00007FF76BC80000-0x00007FF76C075000-memory.dmp	upx
behavioral2/memory/3936-563-0x00007FF7EBEC0000-0x00007FF7EC2B5000-memory.dmp	upx
behavioral2/memory/4704-550-0x00007FF6B8980000-0x00007FF6B8D75000-memory.dmp	upx
behavioral2/memory/1048-547-0x00007FF73B210000-0x00007FF73B605000-memory.dmp	upx
behavioral2/files/0x0007000000023443-163.dat	upx
behavioral2/files/0x0007000000023442-158.dat	upx
behavioral2/files/0x0007000000023440-148.dat	upx
behavioral2/files/0x000700000002343f-143.dat	upx
behavioral2/files/0x000700000002343e-138.dat	upx
behavioral2/files/0x000700000002343d-133.dat	upx
behavioral2/files/0x000700000002343a-118.dat	upx
behavioral2/files/0x0007000000023439-113.dat	upx
behavioral2/files/0x0007000000023436-98.dat	upx
behavioral2/files/0x0007000000023435-93.dat	upx
behavioral2/files/0x0007000000023433-83.dat	upx
behavioral2/files/0x0007000000023431-73.dat	upx
behavioral2/files/0x0007000000023430-68.dat	upx
behavioral2/files/0x0008000000023424-63.dat	upx
behavioral2/files/0x000700000002342c-47.dat	upx
behavioral2/memory/4808-1405-0x00007FF686620000-0x00007FF686A15000-memory.dmp	upx
behavioral2/memory/2904-1408-0x00007FF699DC0000-0x00007FF69A1B5000-memory.dmp	upx
behavioral2/memory/2324-1897-0x00007FF739770000-0x00007FF739B65000-memory.dmp	upx
behavioral2/memory/4808-1898-0x00007FF686620000-0x00007FF686A15000-memory.dmp	upx
behavioral2/memory/2904-1899-0x00007FF699DC0000-0x00007FF69A1B5000-memory.dmp	upx
behavioral2/memory/1588-1900-0x00007FF7A2920000-0x00007FF7A2D15000-memory.dmp	upx
behavioral2/memory/2660-1901-0x00007FF7C3BD0000-0x00007FF7C3FC5000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\VHEeZxF.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\RUrhvJV.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\tfZqMqq.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\pSOedPK.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\FDCXCDS.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\mbIEOOY.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\EGDIfbf.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\lbTeYDM.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\ECeBiyy.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\sBbskZB.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\bIJNHwg.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\TfQTmkH.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\NRJhgaI.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\CvfPskc.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\GwFcYaQ.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\WmqCpBf.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\cENweWK.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\qnqbnps.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\vyMrigs.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\lXYHcIU.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\dOVFEeD.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\XklZrjV.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\OzemeKs.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\KpHZNKu.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\qgUnZGI.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\jXfLKIJ.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\WIjMJrj.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\psFDaTI.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\TmmGYnJ.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\bsaVEAh.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\pQuTYwZ.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\sPZwwQM.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\uVMTSfq.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\OTpXHxn.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\DSebdbO.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\bCxxijT.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\oAgGBrU.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\rtSGxdF.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\DKqeMpD.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\fPiljzw.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\FbQIujc.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\pcWxkhp.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\pFoGrxx.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\oZcMDwP.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\RuKvFIm.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\xNNNwmp.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\iFnDIAn.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\ZWBOhJo.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\STpDBXx.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\YxVIsEa.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\RPGfrnX.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\sKcXSEI.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\nAKbVyC.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\cpussmH.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\ONyvUKx.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\IWSksHs.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\wzkHLIR.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\toENGTD.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\TzdmTzc.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\ZdOodau.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\sCPiMym.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\QkVglyh.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\JbEgazA.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
File created	C:\Windows\System32\PEyQvOZ.exe	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 2904	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	85
PID 4808 wrote to memory of 2904	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	85
PID 4808 wrote to memory of 1588	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	86
PID 4808 wrote to memory of 1588	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	86
PID 4808 wrote to memory of 2660	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	87
PID 4808 wrote to memory of 2660	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	87
PID 4808 wrote to memory of 2596	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	88
PID 4808 wrote to memory of 2596	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	88
PID 4808 wrote to memory of 2936	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	89
PID 4808 wrote to memory of 2936	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	89
PID 4808 wrote to memory of 2324	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	90
PID 4808 wrote to memory of 2324	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	90
PID 4808 wrote to memory of 4680	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	91
PID 4808 wrote to memory of 4680	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	91
PID 4808 wrote to memory of 2600	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	92
PID 4808 wrote to memory of 2600	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	92
PID 4808 wrote to memory of 4608	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	93
PID 4808 wrote to memory of 4608	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	93
PID 4808 wrote to memory of 5032	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	94
PID 4808 wrote to memory of 5032	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	94
PID 4808 wrote to memory of 876	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	95
PID 4808 wrote to memory of 876	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	95
PID 4808 wrote to memory of 2980	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	96
PID 4808 wrote to memory of 2980	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	96
PID 4808 wrote to memory of 2096	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	97
PID 4808 wrote to memory of 2096	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	97
PID 4808 wrote to memory of 1208	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	98
PID 4808 wrote to memory of 1208	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	98
PID 4808 wrote to memory of 4544	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	99
PID 4808 wrote to memory of 4544	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	99
PID 4808 wrote to memory of 1880	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	100
PID 4808 wrote to memory of 1880	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	100
PID 4808 wrote to memory of 3064	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	101
PID 4808 wrote to memory of 3064	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	101
PID 4808 wrote to memory of 1048	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	102
PID 4808 wrote to memory of 1048	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	102
PID 4808 wrote to memory of 4704	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	103
PID 4808 wrote to memory of 4704	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	103
PID 4808 wrote to memory of 3416	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	104
PID 4808 wrote to memory of 3416	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	104
PID 4808 wrote to memory of 668	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	105
PID 4808 wrote to memory of 668	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	105
PID 4808 wrote to memory of 3936	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	106
PID 4808 wrote to memory of 3936	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	106
PID 4808 wrote to memory of 564	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	107
PID 4808 wrote to memory of 564	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	107
PID 4808 wrote to memory of 3300	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	108
PID 4808 wrote to memory of 3300	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	108
PID 4808 wrote to memory of 748	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	109
PID 4808 wrote to memory of 748	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	109
PID 4808 wrote to memory of 4840	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	110
PID 4808 wrote to memory of 4840	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	110
PID 4808 wrote to memory of 3756	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	111
PID 4808 wrote to memory of 3756	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	111
PID 4808 wrote to memory of 1216	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	112
PID 4808 wrote to memory of 1216	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	112
PID 4808 wrote to memory of 4320	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	113
PID 4808 wrote to memory of 4320	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	113
PID 4808 wrote to memory of 1072	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	114
PID 4808 wrote to memory of 1072	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	114
PID 4808 wrote to memory of 4344	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	115
PID 4808 wrote to memory of 4344	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	115
PID 4808 wrote to memory of 5044	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	116
PID 4808 wrote to memory of 5044	4808	9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe	116

C:\Users\Admin\AppData\Local\Temp\9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9158b78f33a18d4a77608ddf3b9b3f30_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\System32\vsJklIo.exe
  C:\Windows\System32\vsJklIo.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System32\vUJojTR.exe
  C:\Windows\System32\vUJojTR.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System32\MrkryOC.exe
  C:\Windows\System32\MrkryOC.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System32\xVIRGQy.exe
  C:\Windows\System32\xVIRGQy.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System32\PEyQvOZ.exe
  C:\Windows\System32\PEyQvOZ.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System32\BwkQSoT.exe
  C:\Windows\System32\BwkQSoT.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System32\frZimVE.exe
  C:\Windows\System32\frZimVE.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System32\vONWDeF.exe
  C:\Windows\System32\vONWDeF.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System32\bvYmdWg.exe
  C:\Windows\System32\bvYmdWg.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System32\vrWOTUz.exe
  C:\Windows\System32\vrWOTUz.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System32\UmJGxnz.exe
  C:\Windows\System32\UmJGxnz.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System32\tfZqMqq.exe
  C:\Windows\System32\tfZqMqq.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System32\kbujkdK.exe
  C:\Windows\System32\kbujkdK.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System32\QWtYwvc.exe
  C:\Windows\System32\QWtYwvc.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System32\wrhsxaE.exe
  C:\Windows\System32\wrhsxaE.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System32\Cwifaib.exe
  C:\Windows\System32\Cwifaib.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System32\DexWvia.exe
  C:\Windows\System32\DexWvia.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System32\MajAdUC.exe
  C:\Windows\System32\MajAdUC.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System32\axHwJQa.exe
  C:\Windows\System32\axHwJQa.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System32\CSnquJV.exe
  C:\Windows\System32\CSnquJV.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System32\QZZRQUx.exe
  C:\Windows\System32\QZZRQUx.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System32\EwiTOTx.exe
  C:\Windows\System32\EwiTOTx.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System32\iapvRBL.exe
  C:\Windows\System32\iapvRBL.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System32\gMSTymW.exe
  C:\Windows\System32\gMSTymW.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System32\vfBeVLs.exe
  C:\Windows\System32\vfBeVLs.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System32\zmmpWnq.exe
  C:\Windows\System32\zmmpWnq.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System32\cJkjEUk.exe
  C:\Windows\System32\cJkjEUk.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System32\CAvvGct.exe
  C:\Windows\System32\CAvvGct.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System32\hmgFrPl.exe
  C:\Windows\System32\hmgFrPl.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System32\jnnDazX.exe
  C:\Windows\System32\jnnDazX.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System32\muGTwsh.exe
  C:\Windows\System32\muGTwsh.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System32\Zrrkfal.exe
  C:\Windows\System32\Zrrkfal.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System32\zByOPbb.exe
  C:\Windows\System32\zByOPbb.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System32\aBkKLtm.exe
  C:\Windows\System32\aBkKLtm.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System32\XgFrcwR.exe
  C:\Windows\System32\XgFrcwR.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System32\bMWniaK.exe
  C:\Windows\System32\bMWniaK.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System32\HSsBeEr.exe
  C:\Windows\System32\HSsBeEr.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System32\VnBrenN.exe
  C:\Windows\System32\VnBrenN.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System32\KrZcRis.exe
  C:\Windows\System32\KrZcRis.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System32\KABoQXt.exe
  C:\Windows\System32\KABoQXt.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System32\qyCjZbI.exe
  C:\Windows\System32\qyCjZbI.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System32\BkKjHEo.exe
  C:\Windows\System32\BkKjHEo.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System32\vCkhBRt.exe
  C:\Windows\System32\vCkhBRt.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System32\lXYHcIU.exe
  C:\Windows\System32\lXYHcIU.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System32\ZXmamOo.exe
  C:\Windows\System32\ZXmamOo.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System32\VyFSfRV.exe
  C:\Windows\System32\VyFSfRV.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System32\QidfReP.exe
  C:\Windows\System32\QidfReP.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System32\xfBhJEw.exe
  C:\Windows\System32\xfBhJEw.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System32\dNazumN.exe
  C:\Windows\System32\dNazumN.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System32\IWSksHs.exe
  C:\Windows\System32\IWSksHs.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System32\RPGfrnX.exe
  C:\Windows\System32\RPGfrnX.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System32\UlGfLQn.exe
  C:\Windows\System32\UlGfLQn.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System32\FrOAnvN.exe
  C:\Windows\System32\FrOAnvN.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System32\SRXmFdQ.exe
  C:\Windows\System32\SRXmFdQ.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System32\dsMwrnm.exe
  C:\Windows\System32\dsMwrnm.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System32\TOLaYwH.exe
  C:\Windows\System32\TOLaYwH.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System32\IbYITWW.exe
  C:\Windows\System32\IbYITWW.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System32\JmDeNTt.exe
  C:\Windows\System32\JmDeNTt.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System32\vsALeBI.exe
  C:\Windows\System32\vsALeBI.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System32\wlEOOIU.exe
  C:\Windows\System32\wlEOOIU.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System32\yClKDRE.exe
  C:\Windows\System32\yClKDRE.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System32\lONFEFf.exe
  C:\Windows\System32\lONFEFf.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System32\wdeFobh.exe
  C:\Windows\System32\wdeFobh.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System32\GBckiAw.exe
  C:\Windows\System32\GBckiAw.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System32\zrZSCTg.exe
  C:\Windows\System32\zrZSCTg.exe
  2⤵
  PID:4612
- C:\Windows\System32\vawVZvW.exe
  C:\Windows\System32\vawVZvW.exe
  2⤵
  PID:2464
- C:\Windows\System32\vhsTYka.exe
  C:\Windows\System32\vhsTYka.exe
  2⤵
  PID:3464
- C:\Windows\System32\uBCqrlO.exe
  C:\Windows\System32\uBCqrlO.exe
  2⤵
  PID:5132
- C:\Windows\System32\vEUajRX.exe
  C:\Windows\System32\vEUajRX.exe
  2⤵
  PID:5172
- C:\Windows\System32\WQbuWid.exe
  C:\Windows\System32\WQbuWid.exe
  2⤵
  PID:5188
- C:\Windows\System32\IQSHpbp.exe
  C:\Windows\System32\IQSHpbp.exe
  2⤵
  PID:5216
- C:\Windows\System32\XlTUUJK.exe
  C:\Windows\System32\XlTUUJK.exe
  2⤵
  PID:5256
- C:\Windows\System32\uzorUVE.exe
  C:\Windows\System32\uzorUVE.exe
  2⤵
  PID:5272
- C:\Windows\System32\ODSFOwl.exe
  C:\Windows\System32\ODSFOwl.exe
  2⤵
  PID:5312
- C:\Windows\System32\ambYZQC.exe
  C:\Windows\System32\ambYZQC.exe
  2⤵
  PID:5340
- C:\Windows\System32\cjQKMVT.exe
  C:\Windows\System32\cjQKMVT.exe
  2⤵
  PID:5356
- C:\Windows\System32\jYpeJyt.exe
  C:\Windows\System32\jYpeJyt.exe
  2⤵
  PID:5396
- C:\Windows\System32\vFkQpVi.exe
  C:\Windows\System32\vFkQpVi.exe
  2⤵
  PID:5424
- C:\Windows\System32\nqdbNZr.exe
  C:\Windows\System32\nqdbNZr.exe
  2⤵
  PID:5440
- C:\Windows\System32\THUJumg.exe
  C:\Windows\System32\THUJumg.exe
  2⤵
  PID:5468
- C:\Windows\System32\wzkHLIR.exe
  C:\Windows\System32\wzkHLIR.exe
  2⤵
  PID:5496
- C:\Windows\System32\XhKWmQn.exe
  C:\Windows\System32\XhKWmQn.exe
  2⤵
  PID:5524
- C:\Windows\System32\sPZwwQM.exe
  C:\Windows\System32\sPZwwQM.exe
  2⤵
  PID:5564
- C:\Windows\System32\bPppHJW.exe
  C:\Windows\System32\bPppHJW.exe
  2⤵
  PID:5580
- C:\Windows\System32\dCywKKZ.exe
  C:\Windows\System32\dCywKKZ.exe
  2⤵
  PID:5608
- C:\Windows\System32\fCkVkCC.exe
  C:\Windows\System32\fCkVkCC.exe
  2⤵
  PID:5648
- C:\Windows\System32\Sqywjec.exe
  C:\Windows\System32\Sqywjec.exe
  2⤵
  PID:5664
- C:\Windows\System32\jYLjdAT.exe
  C:\Windows\System32\jYLjdAT.exe
  2⤵
  PID:5692
- C:\Windows\System32\NzogQoJ.exe
  C:\Windows\System32\NzogQoJ.exe
  2⤵
  PID:5720
- C:\Windows\System32\QhGMYwN.exe
  C:\Windows\System32\QhGMYwN.exe
  2⤵
  PID:5760
- C:\Windows\System32\sonAHac.exe
  C:\Windows\System32\sonAHac.exe
  2⤵
  PID:5788
- C:\Windows\System32\vpTMhZr.exe
  C:\Windows\System32\vpTMhZr.exe
  2⤵
  PID:5816
- C:\Windows\System32\KcOiKsL.exe
  C:\Windows\System32\KcOiKsL.exe
  2⤵
  PID:5844
- C:\Windows\System32\qDxseYB.exe
  C:\Windows\System32\qDxseYB.exe
  2⤵
  PID:5860
- C:\Windows\System32\OJEZuYD.exe
  C:\Windows\System32\OJEZuYD.exe
  2⤵
  PID:5888
- C:\Windows\System32\QKLjJpJ.exe
  C:\Windows\System32\QKLjJpJ.exe
  2⤵
  PID:5928
- C:\Windows\System32\UzJoron.exe
  C:\Windows\System32\UzJoron.exe
  2⤵
  PID:5944
- C:\Windows\System32\xQMJNPF.exe
  C:\Windows\System32\xQMJNPF.exe
  2⤵
  PID:5984
- C:\Windows\System32\zneMRkT.exe
  C:\Windows\System32\zneMRkT.exe
  2⤵
  PID:6000
- C:\Windows\System32\BkblFUv.exe
  C:\Windows\System32\BkblFUv.exe
  2⤵
  PID:6028
- C:\Windows\System32\fqxjUzc.exe
  C:\Windows\System32\fqxjUzc.exe
  2⤵
  PID:6056
- C:\Windows\System32\MbAiPBI.exe
  C:\Windows\System32\MbAiPBI.exe
  2⤵
  PID:6084
- C:\Windows\System32\TlwgFTI.exe
  C:\Windows\System32\TlwgFTI.exe
  2⤵
  PID:6124
- C:\Windows\System32\QgEbTgU.exe
  C:\Windows\System32\QgEbTgU.exe
  2⤵
  PID:6140
- C:\Windows\System32\ILAKlEL.exe
  C:\Windows\System32\ILAKlEL.exe
  2⤵
  PID:4372
- C:\Windows\System32\EwBSbgS.exe
  C:\Windows\System32\EwBSbgS.exe
  2⤵
  PID:2580
- C:\Windows\System32\NikbqaU.exe
  C:\Windows\System32\NikbqaU.exe
  2⤵
  PID:1740
- C:\Windows\System32\iVdWwlZ.exe
  C:\Windows\System32\iVdWwlZ.exe
  2⤵
  PID:5164
- C:\Windows\System32\ZxGPiVs.exe
  C:\Windows\System32\ZxGPiVs.exe
  2⤵
  PID:5200
- C:\Windows\System32\MEZZUPt.exe
  C:\Windows\System32\MEZZUPt.exe
  2⤵
  PID:5296
- C:\Windows\System32\BOkGjGP.exe
  C:\Windows\System32\BOkGjGP.exe
  2⤵
  PID:5320
- C:\Windows\System32\jNqvmJV.exe
  C:\Windows\System32\jNqvmJV.exe
  2⤵
  PID:5404
- C:\Windows\System32\zGdosUh.exe
  C:\Windows\System32\zGdosUh.exe
  2⤵
  PID:5464
- C:\Windows\System32\ZbawgSP.exe
  C:\Windows\System32\ZbawgSP.exe
  2⤵
  PID:5540
- C:\Windows\System32\KqIohFr.exe
  C:\Windows\System32\KqIohFr.exe
  2⤵
  PID:5592
- C:\Windows\System32\WOBSKNS.exe
  C:\Windows\System32\WOBSKNS.exe
  2⤵
  PID:5688
- C:\Windows\System32\jKZuHdF.exe
  C:\Windows\System32\jKZuHdF.exe
  2⤵
  PID:5704
- C:\Windows\System32\WgtwNNi.exe
  C:\Windows\System32\WgtwNNi.exe
  2⤵
  PID:5800
- C:\Windows\System32\hrnouHq.exe
  C:\Windows\System32\hrnouHq.exe
  2⤵
  PID:5824
- C:\Windows\System32\QjdwrsW.exe
  C:\Windows\System32\QjdwrsW.exe
  2⤵
  PID:4712
- C:\Windows\System32\RAxkpRF.exe
  C:\Windows\System32\RAxkpRF.exe
  2⤵
  PID:5960
- C:\Windows\System32\LQDwJwn.exe
  C:\Windows\System32\LQDwJwn.exe
  2⤵
  PID:6012
- C:\Windows\System32\IGdknjD.exe
  C:\Windows\System32\IGdknjD.exe
  2⤵
  PID:6076
- C:\Windows\System32\ggBNysh.exe
  C:\Windows\System32\ggBNysh.exe
  2⤵
  PID:6136
- C:\Windows\System32\RBkFakQ.exe
  C:\Windows\System32\RBkFakQ.exe
  2⤵
  PID:2572
- C:\Windows\System32\GwFcYaQ.exe
  C:\Windows\System32\GwFcYaQ.exe
  2⤵
  PID:3316
- C:\Windows\System32\CLgngAc.exe
  C:\Windows\System32\CLgngAc.exe
  2⤵
  PID:5264
- C:\Windows\System32\lbTeYDM.exe
  C:\Windows\System32\lbTeYDM.exe
  2⤵
  PID:5352
- C:\Windows\System32\JBwslNZ.exe
  C:\Windows\System32\JBwslNZ.exe
  2⤵
  PID:5484
- C:\Windows\System32\kOuRKbz.exe
  C:\Windows\System32\kOuRKbz.exe
  2⤵
  PID:5620
- C:\Windows\System32\pSOedPK.exe
  C:\Windows\System32\pSOedPK.exe
  2⤵
  PID:5768
- C:\Windows\System32\eFLRoUT.exe
  C:\Windows\System32\eFLRoUT.exe
  2⤵
  PID:5884
- C:\Windows\System32\sKcXSEI.exe
  C:\Windows\System32\sKcXSEI.exe
  2⤵
  PID:5992
- C:\Windows\System32\yTaZmFB.exe
  C:\Windows\System32\yTaZmFB.exe
  2⤵
  PID:4312
- C:\Windows\System32\UcfJVbv.exe
  C:\Windows\System32\UcfJVbv.exe
  2⤵
  PID:5184
- C:\Windows\System32\YCyVKUT.exe
  C:\Windows\System32\YCyVKUT.exe
  2⤵
  PID:5572
- C:\Windows\System32\EnDJAFG.exe
  C:\Windows\System32\EnDJAFG.exe
  2⤵
  PID:6160
- C:\Windows\System32\xmfUXYz.exe
  C:\Windows\System32\xmfUXYz.exe
  2⤵
  PID:6200
- C:\Windows\System32\YkLCjmU.exe
  C:\Windows\System32\YkLCjmU.exe
  2⤵
  PID:6228
- C:\Windows\System32\RoYMhKn.exe
  C:\Windows\System32\RoYMhKn.exe
  2⤵
  PID:6244
- C:\Windows\System32\qfqNZfP.exe
  C:\Windows\System32\qfqNZfP.exe
  2⤵
  PID:6272
- C:\Windows\System32\etiipGh.exe
  C:\Windows\System32\etiipGh.exe
  2⤵
  PID:6300
- C:\Windows\System32\RiAWFZf.exe
  C:\Windows\System32\RiAWFZf.exe
  2⤵
  PID:6328
- C:\Windows\System32\GYPKAnh.exe
  C:\Windows\System32\GYPKAnh.exe
  2⤵
  PID:6368
- C:\Windows\System32\sNWdUna.exe
  C:\Windows\System32\sNWdUna.exe
  2⤵
  PID:6384
- C:\Windows\System32\inKYyUv.exe
  C:\Windows\System32\inKYyUv.exe
  2⤵
  PID:6424
- C:\Windows\System32\TfQTmkH.exe
  C:\Windows\System32\TfQTmkH.exe
  2⤵
  PID:6440
- C:\Windows\System32\bYYIdfN.exe
  C:\Windows\System32\bYYIdfN.exe
  2⤵
  PID:6480
- C:\Windows\System32\zgguPwJ.exe
  C:\Windows\System32\zgguPwJ.exe
  2⤵
  PID:6496
- C:\Windows\System32\cJKXWLd.exe
  C:\Windows\System32\cJKXWLd.exe
  2⤵
  PID:6524
- C:\Windows\System32\VLTeDNn.exe
  C:\Windows\System32\VLTeDNn.exe
  2⤵
  PID:6552
- C:\Windows\System32\ymeBmPk.exe
  C:\Windows\System32\ymeBmPk.exe
  2⤵
  PID:6580
- C:\Windows\System32\hbQWHrP.exe
  C:\Windows\System32\hbQWHrP.exe
  2⤵
  PID:6608
- C:\Windows\System32\yaEdFtn.exe
  C:\Windows\System32\yaEdFtn.exe
  2⤵
  PID:6648
- C:\Windows\System32\ytLZJkf.exe
  C:\Windows\System32\ytLZJkf.exe
  2⤵
  PID:6664
- C:\Windows\System32\WmqCpBf.exe
  C:\Windows\System32\WmqCpBf.exe
  2⤵
  PID:6756
- C:\Windows\System32\rtSGxdF.exe
  C:\Windows\System32\rtSGxdF.exe
  2⤵
  PID:6776
- C:\Windows\System32\vWbyiPQ.exe
  C:\Windows\System32\vWbyiPQ.exe
  2⤵
  PID:6796
- C:\Windows\System32\qIioMyE.exe
  C:\Windows\System32\qIioMyE.exe
  2⤵
  PID:6824
- C:\Windows\System32\LMRpZMF.exe
  C:\Windows\System32\LMRpZMF.exe
  2⤵
  PID:6856
- C:\Windows\System32\fRJLXzK.exe
  C:\Windows\System32\fRJLXzK.exe
  2⤵
  PID:6884
- C:\Windows\System32\JJmityT.exe
  C:\Windows\System32\JJmityT.exe
  2⤵
  PID:6908
- C:\Windows\System32\YYIVWQB.exe
  C:\Windows\System32\YYIVWQB.exe
  2⤵
  PID:6952
- C:\Windows\System32\rcFAZAe.exe
  C:\Windows\System32\rcFAZAe.exe
  2⤵
  PID:6972
- C:\Windows\System32\IfAMtzp.exe
  C:\Windows\System32\IfAMtzp.exe
  2⤵
  PID:6996
- C:\Windows\System32\dmiWqVg.exe
  C:\Windows\System32\dmiWqVg.exe
  2⤵
  PID:7020
- C:\Windows\System32\GIrkait.exe
  C:\Windows\System32\GIrkait.exe
  2⤵
  PID:7088
- C:\Windows\System32\kekWFtr.exe
  C:\Windows\System32\kekWFtr.exe
  2⤵
  PID:7132
- C:\Windows\System32\NVVXhrk.exe
  C:\Windows\System32\NVVXhrk.exe
  2⤵
  PID:7160
- C:\Windows\System32\ftVsCEv.exe
  C:\Windows\System32\ftVsCEv.exe
  2⤵
  PID:5940
- C:\Windows\System32\rXjEFzS.exe
  C:\Windows\System32\rXjEFzS.exe
  2⤵
  PID:6108
- C:\Windows\System32\nIXmFtb.exe
  C:\Windows\System32\nIXmFtb.exe
  2⤵
  PID:5492
- C:\Windows\System32\PCcTtZU.exe
  C:\Windows\System32\PCcTtZU.exe
  2⤵
  PID:6208
- C:\Windows\System32\uehapvP.exe
  C:\Windows\System32\uehapvP.exe
  2⤵
  PID:6288
- C:\Windows\System32\QCzGxfg.exe
  C:\Windows\System32\QCzGxfg.exe
  2⤵
  PID:6340
- C:\Windows\System32\aQwfFph.exe
  C:\Windows\System32\aQwfFph.exe
  2⤵
  PID:6396
- C:\Windows\System32\wofbTIn.exe
  C:\Windows\System32\wofbTIn.exe
  2⤵
  PID:6432
- C:\Windows\System32\zCDjDEl.exe
  C:\Windows\System32\zCDjDEl.exe
  2⤵
  PID:4624
- C:\Windows\System32\zqAZeLH.exe
  C:\Windows\System32\zqAZeLH.exe
  2⤵
  PID:6540
- C:\Windows\System32\jXfLKIJ.exe
  C:\Windows\System32\jXfLKIJ.exe
  2⤵
  PID:6632
- C:\Windows\System32\pMGbpbB.exe
  C:\Windows\System32\pMGbpbB.exe
  2⤵
  PID:6656
- C:\Windows\System32\linPuza.exe
  C:\Windows\System32\linPuza.exe
  2⤵
  PID:3692
- C:\Windows\System32\LlmhaEY.exe
  C:\Windows\System32\LlmhaEY.exe
  2⤵
  PID:4368
- C:\Windows\System32\texITBo.exe
  C:\Windows\System32\texITBo.exe
  2⤵
  PID:4296
- C:\Windows\System32\xGnRtTC.exe
  C:\Windows\System32\xGnRtTC.exe
  2⤵
  PID:1268
- C:\Windows\System32\CozavRF.exe
  C:\Windows\System32\CozavRF.exe
  2⤵
  PID:4256
- C:\Windows\System32\BuobiSG.exe
  C:\Windows\System32\BuobiSG.exe
  2⤵
  PID:1448
- C:\Windows\System32\fPiljzw.exe
  C:\Windows\System32\fPiljzw.exe
  2⤵
  PID:4556
- C:\Windows\System32\BnZGDkg.exe
  C:\Windows\System32\BnZGDkg.exe
  2⤵
  PID:6852
- C:\Windows\System32\PCVIwQC.exe
  C:\Windows\System32\PCVIwQC.exe
  2⤵
  PID:7028
- C:\Windows\System32\umSvFsV.exe
  C:\Windows\System32\umSvFsV.exe
  2⤵
  PID:7124
- C:\Windows\System32\lLUbWfr.exe
  C:\Windows\System32\lLUbWfr.exe
  2⤵
  PID:4488
- C:\Windows\System32\ysLgXZs.exe
  C:\Windows\System32\ysLgXZs.exe
  2⤵
  PID:6156
- C:\Windows\System32\ipAUizT.exe
  C:\Windows\System32\ipAUizT.exe
  2⤵
  PID:6380
- C:\Windows\System32\NMVZMJK.exe
  C:\Windows\System32\NMVZMJK.exe
  2⤵
  PID:6464
- C:\Windows\System32\QtItXcG.exe
  C:\Windows\System32\QtItXcG.exe
  2⤵
  PID:6576
- C:\Windows\System32\BDdQMrs.exe
  C:\Windows\System32\BDdQMrs.exe
  2⤵
  PID:4252
- C:\Windows\System32\ZXEBHuq.exe
  C:\Windows\System32\ZXEBHuq.exe
  2⤵
  PID:3872
- C:\Windows\System32\nNTZKBf.exe
  C:\Windows\System32\nNTZKBf.exe
  2⤵
  PID:7012
- C:\Windows\System32\KwHZMzP.exe
  C:\Windows\System32\KwHZMzP.exe
  2⤵
  PID:2636
- C:\Windows\System32\syqktXh.exe
  C:\Windows\System32\syqktXh.exe
  2⤵
  PID:3324
- C:\Windows\System32\gXmizgQ.exe
  C:\Windows\System32\gXmizgQ.exe
  2⤵
  PID:6904
- C:\Windows\System32\KtEGonm.exe
  C:\Windows\System32\KtEGonm.exe
  2⤵
  PID:6548
- C:\Windows\System32\cFnKWQk.exe
  C:\Windows\System32\cFnKWQk.exe
  2⤵
  PID:1636
- C:\Windows\System32\pFoGrxx.exe
  C:\Windows\System32\pFoGrxx.exe
  2⤵
  PID:5012
- C:\Windows\System32\rxjoXdl.exe
  C:\Windows\System32\rxjoXdl.exe
  2⤵
  PID:6916
- C:\Windows\System32\RuKvFIm.exe
  C:\Windows\System32\RuKvFIm.exe
  2⤵
  PID:6324
- C:\Windows\System32\oOwWdLm.exe
  C:\Windows\System32\oOwWdLm.exe
  2⤵
  PID:4572
- C:\Windows\System32\aScsxAk.exe
  C:\Windows\System32\aScsxAk.exe
  2⤵
  PID:7196
- C:\Windows\System32\SXEdsps.exe
  C:\Windows\System32\SXEdsps.exe
  2⤵
  PID:7220
- C:\Windows\System32\PxNZOgw.exe
  C:\Windows\System32\PxNZOgw.exe
  2⤵
  PID:7244
- C:\Windows\System32\RhOBrMC.exe
  C:\Windows\System32\RhOBrMC.exe
  2⤵
  PID:7284
- C:\Windows\System32\hdsXmyQ.exe
  C:\Windows\System32\hdsXmyQ.exe
  2⤵
  PID:7312
- C:\Windows\System32\pcXHROS.exe
  C:\Windows\System32\pcXHROS.exe
  2⤵
  PID:7340
- C:\Windows\System32\yXrCnNz.exe
  C:\Windows\System32\yXrCnNz.exe
  2⤵
  PID:7376
- C:\Windows\System32\CaDDCrA.exe
  C:\Windows\System32\CaDDCrA.exe
  2⤵
  PID:7400
- C:\Windows\System32\IqXKTAf.exe
  C:\Windows\System32\IqXKTAf.exe
  2⤵
  PID:7436
- C:\Windows\System32\hycGhnp.exe
  C:\Windows\System32\hycGhnp.exe
  2⤵
  PID:7468
- C:\Windows\System32\nIFAyXK.exe
  C:\Windows\System32\nIFAyXK.exe
  2⤵
  PID:7492
- C:\Windows\System32\FbZZOOd.exe
  C:\Windows\System32\FbZZOOd.exe
  2⤵
  PID:7540
- C:\Windows\System32\toENGTD.exe
  C:\Windows\System32\toENGTD.exe
  2⤵
  PID:7572
- C:\Windows\System32\ziEsCRF.exe
  C:\Windows\System32\ziEsCRF.exe
  2⤵
  PID:7608
- C:\Windows\System32\LPoUSyl.exe
  C:\Windows\System32\LPoUSyl.exe
  2⤵
  PID:7648
- C:\Windows\System32\TzdmTzc.exe
  C:\Windows\System32\TzdmTzc.exe
  2⤵
  PID:7676
- C:\Windows\System32\JEDgVLF.exe
  C:\Windows\System32\JEDgVLF.exe
  2⤵
  PID:7716
- C:\Windows\System32\dkdDkAe.exe
  C:\Windows\System32\dkdDkAe.exe
  2⤵
  PID:7748
- C:\Windows\System32\SMBBkYO.exe
  C:\Windows\System32\SMBBkYO.exe
  2⤵
  PID:7776
- C:\Windows\System32\GYKoNqm.exe
  C:\Windows\System32\GYKoNqm.exe
  2⤵
  PID:7816
- C:\Windows\System32\CSkLcOB.exe
  C:\Windows\System32\CSkLcOB.exe
  2⤵
  PID:7844
- C:\Windows\System32\lqMbpUq.exe
  C:\Windows\System32\lqMbpUq.exe
  2⤵
  PID:7880
- C:\Windows\System32\ILpufXf.exe
  C:\Windows\System32\ILpufXf.exe
  2⤵
  PID:7908
- C:\Windows\System32\UZqvGqB.exe
  C:\Windows\System32\UZqvGqB.exe
  2⤵
  PID:7944
- C:\Windows\System32\kTGhqtG.exe
  C:\Windows\System32\kTGhqtG.exe
  2⤵
  PID:7972
- C:\Windows\System32\LBLqvMM.exe
  C:\Windows\System32\LBLqvMM.exe
  2⤵
  PID:8004
- C:\Windows\System32\KKLcclU.exe
  C:\Windows\System32\KKLcclU.exe
  2⤵
  PID:8036
- C:\Windows\System32\WPvAzbD.exe
  C:\Windows\System32\WPvAzbD.exe
  2⤵
  PID:8064
- C:\Windows\System32\VgLaLwY.exe
  C:\Windows\System32\VgLaLwY.exe
  2⤵
  PID:8092
- C:\Windows\System32\WEEnThL.exe
  C:\Windows\System32\WEEnThL.exe
  2⤵
  PID:8120
- C:\Windows\System32\tyqDQDA.exe
  C:\Windows\System32\tyqDQDA.exe
  2⤵
  PID:8148
- C:\Windows\System32\VCUDUNu.exe
  C:\Windows\System32\VCUDUNu.exe
  2⤵
  PID:8180
- C:\Windows\System32\gxoKOzy.exe
  C:\Windows\System32\gxoKOzy.exe
  2⤵
  PID:7216
- C:\Windows\System32\NWaytOX.exe
  C:\Windows\System32\NWaytOX.exe
  2⤵
  PID:7276
- C:\Windows\System32\ZdOodau.exe
  C:\Windows\System32\ZdOodau.exe
  2⤵
  PID:7368
- C:\Windows\System32\qQBULCX.exe
  C:\Windows\System32\qQBULCX.exe
  2⤵
  PID:7428
- C:\Windows\System32\YMlUmNM.exe
  C:\Windows\System32\YMlUmNM.exe
  2⤵
  PID:7460
- C:\Windows\System32\DhcnvbD.exe
  C:\Windows\System32\DhcnvbD.exe
  2⤵
  PID:7580
- C:\Windows\System32\PAEXOoj.exe
  C:\Windows\System32\PAEXOoj.exe
  2⤵
  PID:7604
- C:\Windows\System32\fbuHXby.exe
  C:\Windows\System32\fbuHXby.exe
  2⤵
  PID:7668
- C:\Windows\System32\bALfxnB.exe
  C:\Windows\System32\bALfxnB.exe
  2⤵
  PID:7772
- C:\Windows\System32\dWWinKD.exe
  C:\Windows\System32\dWWinKD.exe
  2⤵
  PID:7864
- C:\Windows\System32\MopeEQB.exe
  C:\Windows\System32\MopeEQB.exe
  2⤵
  PID:7904
- C:\Windows\System32\EanPwPU.exe
  C:\Windows\System32\EanPwPU.exe
  2⤵
  PID:7992
- C:\Windows\System32\BLErgDr.exe
  C:\Windows\System32\BLErgDr.exe
  2⤵
  PID:8032
- C:\Windows\System32\GwkiNxu.exe
  C:\Windows\System32\GwkiNxu.exe
  2⤵
  PID:8104
- C:\Windows\System32\BJLzWZc.exe
  C:\Windows\System32\BJLzWZc.exe
  2⤵
  PID:8144
- C:\Windows\System32\SuXEKym.exe
  C:\Windows\System32\SuXEKym.exe
  2⤵
  PID:7176
- C:\Windows\System32\tmphbnN.exe
  C:\Windows\System32\tmphbnN.exe
  2⤵
  PID:7352
- C:\Windows\System32\VhNPMkf.exe
  C:\Windows\System32\VhNPMkf.exe
  2⤵
  PID:7636
- C:\Windows\System32\tUqOKHq.exe
  C:\Windows\System32\tUqOKHq.exe
  2⤵
  PID:3792
- C:\Windows\System32\tRBGNrD.exe
  C:\Windows\System32\tRBGNrD.exe
  2⤵
  PID:6704
- C:\Windows\System32\rNgrMfE.exe
  C:\Windows\System32\rNgrMfE.exe
  2⤵
  PID:7964
- C:\Windows\System32\mLSSQSB.exe
  C:\Windows\System32\mLSSQSB.exe
  2⤵
  PID:7584
- C:\Windows\System32\QejBUlh.exe
  C:\Windows\System32\QejBUlh.exe
  2⤵
  PID:8088
- C:\Windows\System32\cpussmH.exe
  C:\Windows\System32\cpussmH.exe
  2⤵
  PID:8168
- C:\Windows\System32\zCllWIG.exe
  C:\Windows\System32\zCllWIG.exe
  2⤵
  PID:7728
- C:\Windows\System32\AmLrhpB.exe
  C:\Windows\System32\AmLrhpB.exe
  2⤵
  PID:8016
- C:\Windows\System32\ivnmchD.exe
  C:\Windows\System32\ivnmchD.exe
  2⤵
  PID:6844
- C:\Windows\System32\iqtqxJT.exe
  C:\Windows\System32\iqtqxJT.exe
  2⤵
  PID:7556
- C:\Windows\System32\SgsHkPS.exe
  C:\Windows\System32\SgsHkPS.exe
  2⤵
  PID:8240
- C:\Windows\System32\zppgliX.exe
  C:\Windows\System32\zppgliX.exe
  2⤵
  PID:8268
- C:\Windows\System32\EmNtaJi.exe
  C:\Windows\System32\EmNtaJi.exe
  2⤵
  PID:8296
- C:\Windows\System32\IzXeZUK.exe
  C:\Windows\System32\IzXeZUK.exe
  2⤵
  PID:8324
- C:\Windows\System32\LkpBucA.exe
  C:\Windows\System32\LkpBucA.exe
  2⤵
  PID:8352
- C:\Windows\System32\zRkeBZI.exe
  C:\Windows\System32\zRkeBZI.exe
  2⤵
  PID:8380
- C:\Windows\System32\TlHucAp.exe
  C:\Windows\System32\TlHucAp.exe
  2⤵
  PID:8408
- C:\Windows\System32\mbIEOOY.exe
  C:\Windows\System32\mbIEOOY.exe
  2⤵
  PID:8440
- C:\Windows\System32\QkpnUdb.exe
  C:\Windows\System32\QkpnUdb.exe
  2⤵
  PID:8468
- C:\Windows\System32\Yegjczk.exe
  C:\Windows\System32\Yegjczk.exe
  2⤵
  PID:8492
- C:\Windows\System32\WcbXjkN.exe
  C:\Windows\System32\WcbXjkN.exe
  2⤵
  PID:8528
- C:\Windows\System32\ONNYdiD.exe
  C:\Windows\System32\ONNYdiD.exe
  2⤵
  PID:8564
- C:\Windows\System32\KmNaEzw.exe
  C:\Windows\System32\KmNaEzw.exe
  2⤵
  PID:8584
- C:\Windows\System32\kjpejYT.exe
  C:\Windows\System32\kjpejYT.exe
  2⤵
  PID:8612
- C:\Windows\System32\CZUKpis.exe
  C:\Windows\System32\CZUKpis.exe
  2⤵
  PID:8648
- C:\Windows\System32\WYIVjBM.exe
  C:\Windows\System32\WYIVjBM.exe
  2⤵
  PID:8680
- C:\Windows\System32\AJcMJto.exe
  C:\Windows\System32\AJcMJto.exe
  2⤵
  PID:8704
- C:\Windows\System32\ZWFRIkY.exe
  C:\Windows\System32\ZWFRIkY.exe
  2⤵
  PID:8732
- C:\Windows\System32\cWtZKwd.exe
  C:\Windows\System32\cWtZKwd.exe
  2⤵
  PID:8760
- C:\Windows\System32\gEWmxTD.exe
  C:\Windows\System32\gEWmxTD.exe
  2⤵
  PID:8788
- C:\Windows\System32\trOJuef.exe
  C:\Windows\System32\trOJuef.exe
  2⤵
  PID:8816
- C:\Windows\System32\tqvnCfz.exe
  C:\Windows\System32\tqvnCfz.exe
  2⤵
  PID:8844
- C:\Windows\System32\ENuIylQ.exe
  C:\Windows\System32\ENuIylQ.exe
  2⤵
  PID:8872
- C:\Windows\System32\xwvmLxH.exe
  C:\Windows\System32\xwvmLxH.exe
  2⤵
  PID:8900
- C:\Windows\System32\UkyGZqB.exe
  C:\Windows\System32\UkyGZqB.exe
  2⤵
  PID:8928
- C:\Windows\System32\ouKhIEe.exe
  C:\Windows\System32\ouKhIEe.exe
  2⤵
  PID:8956
- C:\Windows\System32\wSvVEbk.exe
  C:\Windows\System32\wSvVEbk.exe
  2⤵
  PID:8984
- C:\Windows\System32\sjuUFDe.exe
  C:\Windows\System32\sjuUFDe.exe
  2⤵
  PID:9016
- C:\Windows\System32\ftrIEom.exe
  C:\Windows\System32\ftrIEom.exe
  2⤵
  PID:9044
- C:\Windows\System32\MbLemhZ.exe
  C:\Windows\System32\MbLemhZ.exe
  2⤵
  PID:9072
- C:\Windows\System32\ScVDBDB.exe
  C:\Windows\System32\ScVDBDB.exe
  2⤵
  PID:9100
- C:\Windows\System32\XqEOyTI.exe
  C:\Windows\System32\XqEOyTI.exe
  2⤵
  PID:9128
- C:\Windows\System32\oZcMDwP.exe
  C:\Windows\System32\oZcMDwP.exe
  2⤵
  PID:9156
- C:\Windows\System32\luLdNts.exe
  C:\Windows\System32\luLdNts.exe
  2⤵
  PID:9184
- C:\Windows\System32\pCoCMRQ.exe
  C:\Windows\System32\pCoCMRQ.exe
  2⤵
  PID:8236
- C:\Windows\System32\FqSSJei.exe
  C:\Windows\System32\FqSSJei.exe
  2⤵
  PID:6968
- C:\Windows\System32\WDSjWbD.exe
  C:\Windows\System32\WDSjWbD.exe
  2⤵
  PID:8480
- C:\Windows\System32\gJbINhJ.exe
  C:\Windows\System32\gJbINhJ.exe
  2⤵
  PID:8624
- C:\Windows\System32\gWtHLEF.exe
  C:\Windows\System32\gWtHLEF.exe
  2⤵
  PID:8728
- C:\Windows\System32\AJzHcpS.exe
  C:\Windows\System32\AJzHcpS.exe
  2⤵
  PID:8832
- C:\Windows\System32\vulARgv.exe
  C:\Windows\System32\vulARgv.exe
  2⤵
  PID:8924
- C:\Windows\System32\jgdABJO.exe
  C:\Windows\System32\jgdABJO.exe
  2⤵
  PID:8976
- C:\Windows\System32\jblufeH.exe
  C:\Windows\System32\jblufeH.exe
  2⤵
  PID:9056
- C:\Windows\System32\WvdStME.exe
  C:\Windows\System32\WvdStME.exe
  2⤵
  PID:9012
- C:\Windows\System32\YeQmKhB.exe
  C:\Windows\System32\YeQmKhB.exe
  2⤵
  PID:9180
- C:\Windows\System32\wfqlLQB.exe
  C:\Windows\System32\wfqlLQB.exe
  2⤵
  PID:8552
- C:\Windows\System32\WIjMJrj.exe
  C:\Windows\System32\WIjMJrj.exe
  2⤵
  PID:8800
- C:\Windows\System32\QNDKxtu.exe
  C:\Windows\System32\QNDKxtu.exe
  2⤵
  PID:9008
- C:\Windows\System32\uVMTSfq.exe
  C:\Windows\System32\uVMTSfq.exe
  2⤵
  PID:9152
- C:\Windows\System32\EGDIfbf.exe
  C:\Windows\System32\EGDIfbf.exe
  2⤵
  PID:8920
- C:\Windows\System32\LAkpfwE.exe
  C:\Windows\System32\LAkpfwE.exe
  2⤵
  PID:8756
- C:\Windows\System32\nWCbkOt.exe
  C:\Windows\System32\nWCbkOt.exe
  2⤵
  PID:9148
- C:\Windows\System32\PFQznPv.exe
  C:\Windows\System32\PFQznPv.exe
  2⤵
  PID:9244
- C:\Windows\System32\AbHoRRv.exe
  C:\Windows\System32\AbHoRRv.exe
  2⤵
  PID:9272
- C:\Windows\System32\xvpDzGE.exe
  C:\Windows\System32\xvpDzGE.exe
  2⤵
  PID:9304
- C:\Windows\System32\RNKoJIS.exe
  C:\Windows\System32\RNKoJIS.exe
  2⤵
  PID:9332
- C:\Windows\System32\iGZCXas.exe
  C:\Windows\System32\iGZCXas.exe
  2⤵
  PID:9368
- C:\Windows\System32\WvwJyQl.exe
  C:\Windows\System32\WvwJyQl.exe
  2⤵
  PID:9396
- C:\Windows\System32\wzDmOsQ.exe
  C:\Windows\System32\wzDmOsQ.exe
  2⤵
  PID:9424
- C:\Windows\System32\zsCKTxj.exe
  C:\Windows\System32\zsCKTxj.exe
  2⤵
  PID:9456
- C:\Windows\System32\kGHSMON.exe
  C:\Windows\System32\kGHSMON.exe
  2⤵
  PID:9480
- C:\Windows\System32\RzyTKhZ.exe
  C:\Windows\System32\RzyTKhZ.exe
  2⤵
  PID:9508
- C:\Windows\System32\GQMguLZ.exe
  C:\Windows\System32\GQMguLZ.exe
  2⤵
  PID:9536
- C:\Windows\System32\nHXDfwf.exe
  C:\Windows\System32\nHXDfwf.exe
  2⤵
  PID:9564
- C:\Windows\System32\DKqeMpD.exe
  C:\Windows\System32\DKqeMpD.exe
  2⤵
  PID:9592
- C:\Windows\System32\dOVFEeD.exe
  C:\Windows\System32\dOVFEeD.exe
  2⤵
  PID:9620
- C:\Windows\System32\haLboET.exe
  C:\Windows\System32\haLboET.exe
  2⤵
  PID:9648
- C:\Windows\System32\kiQUvIp.exe
  C:\Windows\System32\kiQUvIp.exe
  2⤵
  PID:9676
- C:\Windows\System32\vyCCNFe.exe
  C:\Windows\System32\vyCCNFe.exe
  2⤵
  PID:9704
- C:\Windows\System32\sRNlper.exe
  C:\Windows\System32\sRNlper.exe
  2⤵
  PID:9732
- C:\Windows\System32\TfnvGxK.exe
  C:\Windows\System32\TfnvGxK.exe
  2⤵
  PID:9760
- C:\Windows\System32\psFDaTI.exe
  C:\Windows\System32\psFDaTI.exe
  2⤵
  PID:9788
- C:\Windows\System32\sChmtXu.exe
  C:\Windows\System32\sChmtXu.exe
  2⤵
  PID:9816
- C:\Windows\System32\NRJhgaI.exe
  C:\Windows\System32\NRJhgaI.exe
  2⤵
  PID:9844
- C:\Windows\System32\NtzcAFN.exe
  C:\Windows\System32\NtzcAFN.exe
  2⤵
  PID:9872
- C:\Windows\System32\PNdsmlH.exe
  C:\Windows\System32\PNdsmlH.exe
  2⤵
  PID:9900
- C:\Windows\System32\uXTcRwf.exe
  C:\Windows\System32\uXTcRwf.exe
  2⤵
  PID:9928
- C:\Windows\System32\sCgZTFo.exe
  C:\Windows\System32\sCgZTFo.exe
  2⤵
  PID:9956
- C:\Windows\System32\NspEzdm.exe
  C:\Windows\System32\NspEzdm.exe
  2⤵
  PID:9984
- C:\Windows\System32\pxiihXp.exe
  C:\Windows\System32\pxiihXp.exe
  2⤵
  PID:10012
- C:\Windows\System32\XklZrjV.exe
  C:\Windows\System32\XklZrjV.exe
  2⤵
  PID:10048
- C:\Windows\System32\OzemeKs.exe
  C:\Windows\System32\OzemeKs.exe
  2⤵
  PID:10080
- C:\Windows\System32\zhOHqVa.exe
  C:\Windows\System32\zhOHqVa.exe
  2⤵
  PID:10108
- C:\Windows\System32\JQNRFbR.exe
  C:\Windows\System32\JQNRFbR.exe
  2⤵
  PID:10136
- C:\Windows\System32\RerYFAe.exe
  C:\Windows\System32\RerYFAe.exe
  2⤵
  PID:10164
- C:\Windows\System32\nJpSipR.exe
  C:\Windows\System32\nJpSipR.exe
  2⤵
  PID:10196
- C:\Windows\System32\jpiOiRE.exe
  C:\Windows\System32\jpiOiRE.exe
  2⤵
  PID:10224
- C:\Windows\System32\eBDUMgG.exe
  C:\Windows\System32\eBDUMgG.exe
  2⤵
  PID:9264
- C:\Windows\System32\bwdAChB.exe
  C:\Windows\System32\bwdAChB.exe
  2⤵
  PID:9324
- C:\Windows\System32\ByIERvv.exe
  C:\Windows\System32\ByIERvv.exe
  2⤵
  PID:9388
- C:\Windows\System32\sFwNvke.exe
  C:\Windows\System32\sFwNvke.exe
  2⤵
  PID:9468
- C:\Windows\System32\FgXAQFA.exe
  C:\Windows\System32\FgXAQFA.exe
  2⤵
  PID:9528
- C:\Windows\System32\PXXMmiH.exe
  C:\Windows\System32\PXXMmiH.exe
  2⤵
  PID:9588
- C:\Windows\System32\VHEeZxF.exe
  C:\Windows\System32\VHEeZxF.exe
  2⤵
  PID:9660
- C:\Windows\System32\iIMhYIu.exe
  C:\Windows\System32\iIMhYIu.exe
  2⤵
  PID:9724
- C:\Windows\System32\DlMBBBA.exe
  C:\Windows\System32\DlMBBBA.exe
  2⤵
  PID:9784
- C:\Windows\System32\zTaJugC.exe
  C:\Windows\System32\zTaJugC.exe
  2⤵
  PID:9840
- C:\Windows\System32\rkOxMje.exe
  C:\Windows\System32\rkOxMje.exe
  2⤵
  PID:9916
- C:\Windows\System32\QCplkJr.exe
  C:\Windows\System32\QCplkJr.exe
  2⤵
  PID:9996
- C:\Windows\System32\ZcdgYup.exe
  C:\Windows\System32\ZcdgYup.exe
  2⤵
  PID:10076
- C:\Windows\System32\TluxWeB.exe
  C:\Windows\System32\TluxWeB.exe
  2⤵
  PID:10132
- C:\Windows\System32\TyFZoAm.exe
  C:\Windows\System32\TyFZoAm.exe
  2⤵
  PID:10188
- C:\Windows\System32\reyVIrY.exe
  C:\Windows\System32\reyVIrY.exe
  2⤵
  PID:9288
- C:\Windows\System32\NHMbyPT.exe
  C:\Windows\System32\NHMbyPT.exe
  2⤵
  PID:9444
- C:\Windows\System32\vCXzLfB.exe
  C:\Windows\System32\vCXzLfB.exe
  2⤵
  PID:9584
- C:\Windows\System32\OTpXHxn.exe
  C:\Windows\System32\OTpXHxn.exe
  2⤵
  PID:9756
- C:\Windows\System32\sCPiMym.exe
  C:\Windows\System32\sCPiMym.exe
  2⤵
  PID:9948
- C:\Windows\System32\ZoybWFJ.exe
  C:\Windows\System32\ZoybWFJ.exe
  2⤵
  PID:10068
- C:\Windows\System32\DAIzvaH.exe
  C:\Windows\System32\DAIzvaH.exe
  2⤵
  PID:9556
- C:\Windows\System32\paksVJa.exe
  C:\Windows\System32\paksVJa.exe
  2⤵
  PID:10104
- C:\Windows\System32\KyzpEOp.exe
  C:\Windows\System32\KyzpEOp.exe
  2⤵
  PID:9896
- C:\Windows\System32\HQHtoSi.exe
  C:\Windows\System32\HQHtoSi.exe
  2⤵
  PID:10260
- C:\Windows\System32\TmmGYnJ.exe
  C:\Windows\System32\TmmGYnJ.exe
  2⤵
  PID:10288
- C:\Windows\System32\wcCIdwq.exe
  C:\Windows\System32\wcCIdwq.exe
  2⤵
  PID:10316
- C:\Windows\System32\cENweWK.exe
  C:\Windows\System32\cENweWK.exe
  2⤵
  PID:10344
- C:\Windows\System32\EJkOGVQ.exe
  C:\Windows\System32\EJkOGVQ.exe
  2⤵
  PID:10372
- C:\Windows\System32\LEpLIpz.exe
  C:\Windows\System32\LEpLIpz.exe
  2⤵
  PID:10404
- C:\Windows\System32\LQWBhtO.exe
  C:\Windows\System32\LQWBhtO.exe
  2⤵
  PID:10436
- C:\Windows\System32\TQtjOQD.exe
  C:\Windows\System32\TQtjOQD.exe
  2⤵
  PID:10468
- C:\Windows\System32\DSebdbO.exe
  C:\Windows\System32\DSebdbO.exe
  2⤵
  PID:10496
- C:\Windows\System32\FxTTdWg.exe
  C:\Windows\System32\FxTTdWg.exe
  2⤵
  PID:10524
- C:\Windows\System32\ArNFQrT.exe
  C:\Windows\System32\ArNFQrT.exe
  2⤵
  PID:10552
- C:\Windows\System32\bsaVEAh.exe
  C:\Windows\System32\bsaVEAh.exe
  2⤵
  PID:10580
- C:\Windows\System32\mRwIgxq.exe
  C:\Windows\System32\mRwIgxq.exe
  2⤵
  PID:10612
- C:\Windows\System32\kPlxTDV.exe
  C:\Windows\System32\kPlxTDV.exe
  2⤵
  PID:10640
- C:\Windows\System32\zKOGelt.exe
  C:\Windows\System32\zKOGelt.exe
  2⤵
  PID:10668
- C:\Windows\System32\SLiOPYp.exe
  C:\Windows\System32\SLiOPYp.exe
  2⤵
  PID:10696
- C:\Windows\System32\DEZRjRZ.exe
  C:\Windows\System32\DEZRjRZ.exe
  2⤵
  PID:10724
- C:\Windows\System32\ESdFiOE.exe
  C:\Windows\System32\ESdFiOE.exe
  2⤵
  PID:10752
- C:\Windows\System32\eumnvrp.exe
  C:\Windows\System32\eumnvrp.exe
  2⤵
  PID:10780
- C:\Windows\System32\RncfrRL.exe
  C:\Windows\System32\RncfrRL.exe
  2⤵
  PID:10808
- C:\Windows\System32\pcWxkhp.exe
  C:\Windows\System32\pcWxkhp.exe
  2⤵
  PID:10840
- C:\Windows\System32\RUrhvJV.exe
  C:\Windows\System32\RUrhvJV.exe
  2⤵
  PID:10868
- C:\Windows\System32\OrQPfHa.exe
  C:\Windows\System32\OrQPfHa.exe
  2⤵
  PID:10904
- C:\Windows\System32\pvRCSiH.exe
  C:\Windows\System32\pvRCSiH.exe
  2⤵
  PID:10956
- C:\Windows\System32\LCGTOdm.exe
  C:\Windows\System32\LCGTOdm.exe
  2⤵
  PID:10984
- C:\Windows\System32\xNNNwmp.exe
  C:\Windows\System32\xNNNwmp.exe
  2⤵
  PID:11016
- C:\Windows\System32\BRpAdve.exe
  C:\Windows\System32\BRpAdve.exe
  2⤵
  PID:11048
- C:\Windows\System32\SKCPaQi.exe
  C:\Windows\System32\SKCPaQi.exe
  2⤵
  PID:11076
- C:\Windows\System32\FkSfype.exe
  C:\Windows\System32\FkSfype.exe
  2⤵
  PID:11104
- C:\Windows\System32\FXpXabo.exe
  C:\Windows\System32\FXpXabo.exe
  2⤵
  PID:11132
- C:\Windows\System32\JMtPvTd.exe
  C:\Windows\System32\JMtPvTd.exe
  2⤵
  PID:11160
- C:\Windows\System32\BtYsbjE.exe
  C:\Windows\System32\BtYsbjE.exe
  2⤵
  PID:11192
- C:\Windows\System32\DOjgMzD.exe
  C:\Windows\System32\DOjgMzD.exe
  2⤵
  PID:11220
- C:\Windows\System32\jyntQVu.exe
  C:\Windows\System32\jyntQVu.exe
  2⤵
  PID:11248
- C:\Windows\System32\iDzgMeK.exe
  C:\Windows\System32\iDzgMeK.exe
  2⤵
  PID:10276
- C:\Windows\System32\FcGeqPw.exe
  C:\Windows\System32\FcGeqPw.exe
  2⤵
  PID:10336
- C:\Windows\System32\TGJXjGk.exe
  C:\Windows\System32\TGJXjGk.exe
  2⤵
  PID:10400
- C:\Windows\System32\fhxkALu.exe
  C:\Windows\System32\fhxkALu.exe
  2⤵
  PID:10484
- C:\Windows\System32\FzeUdsu.exe
  C:\Windows\System32\FzeUdsu.exe
  2⤵
  PID:10544
- C:\Windows\System32\PrLMMyh.exe
  C:\Windows\System32\PrLMMyh.exe
  2⤵
  PID:10608
- C:\Windows\System32\hBTYDgT.exe
  C:\Windows\System32\hBTYDgT.exe
  2⤵
  PID:10664
- C:\Windows\System32\bJuCtlU.exe
  C:\Windows\System32\bJuCtlU.exe
  2⤵
  PID:10736
- C:\Windows\System32\FGlQlYa.exe
  C:\Windows\System32\FGlQlYa.exe
  2⤵
  PID:10800
- C:\Windows\System32\JsROWMN.exe
  C:\Windows\System32\JsROWMN.exe
  2⤵
  PID:9804
- C:\Windows\System32\bOuzQup.exe
  C:\Windows\System32\bOuzQup.exe
  2⤵
  PID:10600
- C:\Windows\System32\jBHFdaC.exe
  C:\Windows\System32\jBHFdaC.exe
  2⤵
  PID:10864
- C:\Windows\System32\nOPFuSp.exe
  C:\Windows\System32\nOPFuSp.exe
  2⤵
  PID:10968
- C:\Windows\System32\jVpLSuT.exe
  C:\Windows\System32\jVpLSuT.exe
  2⤵
  PID:11036
- C:\Windows\System32\itLuJld.exe
  C:\Windows\System32\itLuJld.exe
  2⤵
  PID:11072
- C:\Windows\System32\vwWerks.exe
  C:\Windows\System32\vwWerks.exe
  2⤵
  PID:10888
- C:\Windows\System32\HXIhQML.exe
  C:\Windows\System32\HXIhQML.exe
  2⤵
  PID:11244
- C:\Windows\System32\RfriBDn.exe
  C:\Windows\System32\RfriBDn.exe
  2⤵
  PID:10308
- C:\Windows\System32\vYGZjDg.exe
  C:\Windows\System32\vYGZjDg.exe
  2⤵
  PID:10464
- C:\Windows\System32\erncMbN.exe
  C:\Windows\System32\erncMbN.exe
  2⤵
  PID:10192
- C:\Windows\System32\bCxxijT.exe
  C:\Windows\System32\bCxxijT.exe
  2⤵
  PID:10792
- C:\Windows\System32\uXYqzpi.exe
  C:\Windows\System32\uXYqzpi.exe
  2⤵
  PID:10836
- C:\Windows\System32\QkVglyh.exe
  C:\Windows\System32\QkVglyh.exe
  2⤵
  PID:10996
- C:\Windows\System32\YdzdctU.exe
  C:\Windows\System32\YdzdctU.exe
  2⤵
  PID:11156
- C:\Windows\System32\XmFSygN.exe
  C:\Windows\System32\XmFSygN.exe
  2⤵
  PID:10396
- C:\Windows\System32\ZZUwOUG.exe
  C:\Windows\System32\ZZUwOUG.exe
  2⤵
  PID:10764
- C:\Windows\System32\RUIkdnO.exe
  C:\Windows\System32\RUIkdnO.exe
  2⤵
  PID:11100
- C:\Windows\System32\ZuoUtYW.exe
  C:\Windows\System32\ZuoUtYW.exe
  2⤵
  PID:10604
- C:\Windows\System32\OCLFZTm.exe
  C:\Windows\System32\OCLFZTm.exe
  2⤵
  PID:10916
- C:\Windows\System32\mSQdyZH.exe
  C:\Windows\System32\mSQdyZH.exe
  2⤵
  PID:11284
- C:\Windows\System32\VLDqrpP.exe
  C:\Windows\System32\VLDqrpP.exe
  2⤵
  PID:11312
- C:\Windows\System32\ZsxwMrc.exe
  C:\Windows\System32\ZsxwMrc.exe
  2⤵
  PID:11340
- C:\Windows\System32\rTcNkTz.exe
  C:\Windows\System32\rTcNkTz.exe
  2⤵
  PID:11368
- C:\Windows\System32\XftLJet.exe
  C:\Windows\System32\XftLJet.exe
  2⤵
  PID:11396
- C:\Windows\System32\WmrQWJG.exe
  C:\Windows\System32\WmrQWJG.exe
  2⤵
  PID:11424
- C:\Windows\System32\yXbTBJQ.exe
  C:\Windows\System32\yXbTBJQ.exe
  2⤵
  PID:11452
- C:\Windows\System32\bzcdvaJ.exe
  C:\Windows\System32\bzcdvaJ.exe
  2⤵
  PID:11484
- C:\Windows\System32\UfDpYfZ.exe
  C:\Windows\System32\UfDpYfZ.exe
  2⤵
  PID:11512
- C:\Windows\System32\wSKnGlv.exe
  C:\Windows\System32\wSKnGlv.exe
  2⤵
  PID:11540
- C:\Windows\System32\BujcFCr.exe
  C:\Windows\System32\BujcFCr.exe
  2⤵
  PID:11568
- C:\Windows\System32\uzydMVv.exe
  C:\Windows\System32\uzydMVv.exe
  2⤵
  PID:11596
- C:\Windows\System32\opVNjLv.exe
  C:\Windows\System32\opVNjLv.exe
  2⤵
  PID:11624
- C:\Windows\System32\DZocAAp.exe
  C:\Windows\System32\DZocAAp.exe
  2⤵
  PID:11652
- C:\Windows\System32\rjPhiOL.exe
  C:\Windows\System32\rjPhiOL.exe
  2⤵
  PID:11680
- C:\Windows\System32\RjDJEqM.exe
  C:\Windows\System32\RjDJEqM.exe
  2⤵
  PID:11720
- C:\Windows\System32\kcejSeG.exe
  C:\Windows\System32\kcejSeG.exe
  2⤵
  PID:11736
- C:\Windows\System32\NObQbdB.exe
  C:\Windows\System32\NObQbdB.exe
  2⤵
  PID:11764
- C:\Windows\System32\qnqbnps.exe
  C:\Windows\System32\qnqbnps.exe
  2⤵
  PID:11792
- C:\Windows\System32\eymmjqU.exe
  C:\Windows\System32\eymmjqU.exe
  2⤵
  PID:11820
- C:\Windows\System32\ojBNiEz.exe
  C:\Windows\System32\ojBNiEz.exe
  2⤵
  PID:11848
- C:\Windows\System32\iTtuomk.exe
  C:\Windows\System32\iTtuomk.exe
  2⤵
  PID:11876
- C:\Windows\System32\KSngjbW.exe
  C:\Windows\System32\KSngjbW.exe
  2⤵
  PID:11904
- C:\Windows\System32\EjZhgUV.exe
  C:\Windows\System32\EjZhgUV.exe
  2⤵
  PID:11932
- C:\Windows\System32\TxYxwGn.exe
  C:\Windows\System32\TxYxwGn.exe
  2⤵
  PID:11960
- C:\Windows\System32\kLHhrCl.exe
  C:\Windows\System32\kLHhrCl.exe
  2⤵
  PID:11988
- C:\Windows\System32\KCgCGtD.exe
  C:\Windows\System32\KCgCGtD.exe
  2⤵
  PID:12012
- C:\Windows\System32\IshwePh.exe
  C:\Windows\System32\IshwePh.exe
  2⤵
  PID:12044
- C:\Windows\System32\esFDtFJ.exe
  C:\Windows\System32\esFDtFJ.exe
  2⤵
  PID:12072
- C:\Windows\System32\nVZBhgd.exe
  C:\Windows\System32\nVZBhgd.exe
  2⤵
  PID:12092
- C:\Windows\System32\mDvThoq.exe
  C:\Windows\System32\mDvThoq.exe
  2⤵
  PID:12120
- C:\Windows\System32\CsHINxm.exe
  C:\Windows\System32\CsHINxm.exe
  2⤵
  PID:12164
- C:\Windows\System32\ZpQIXLB.exe
  C:\Windows\System32\ZpQIXLB.exe
  2⤵
  PID:12184
- C:\Windows\System32\sLBzzQf.exe
  C:\Windows\System32\sLBzzQf.exe
  2⤵
  PID:12208
- C:\Windows\System32\TdAlMTq.exe
  C:\Windows\System32\TdAlMTq.exe
  2⤵
  PID:12236
- C:\Windows\System32\sczzPUi.exe
  C:\Windows\System32\sczzPUi.exe
  2⤵
  PID:12272
- C:\Windows\System32\pQuTYwZ.exe
  C:\Windows\System32\pQuTYwZ.exe
  2⤵
  PID:11276
- C:\Windows\System32\KpHZNKu.exe
  C:\Windows\System32\KpHZNKu.exe
  2⤵
  PID:11324
- C:\Windows\System32\LkOxMsU.exe
  C:\Windows\System32\LkOxMsU.exe
  2⤵
  PID:11416
- C:\Windows\System32\LbAevPD.exe
  C:\Windows\System32\LbAevPD.exe
  2⤵
  PID:11496
- C:\Windows\System32\vLyEJLZ.exe
  C:\Windows\System32\vLyEJLZ.exe
  2⤵
  PID:11560
- C:\Windows\System32\ECeBiyy.exe
  C:\Windows\System32\ECeBiyy.exe
  2⤵
  PID:11620
- C:\Windows\System32\zhZGKhH.exe
  C:\Windows\System32\zhZGKhH.exe
  2⤵
  PID:11676
- C:\Windows\System32\zqRFXDu.exe
  C:\Windows\System32\zqRFXDu.exe
  2⤵
  PID:4472
- C:\Windows\System32\SvmNNum.exe
  C:\Windows\System32\SvmNNum.exe
  2⤵
  PID:4848
- C:\Windows\System32\diTZzwJ.exe
  C:\Windows\System32\diTZzwJ.exe
  2⤵
  PID:4052
- C:\Windows\System32\tkmrREr.exe
  C:\Windows\System32\tkmrREr.exe
  2⤵
  PID:3500
- C:\Windows\System32\dOLzFOA.exe
  C:\Windows\System32\dOLzFOA.exe
  2⤵
  PID:11704
- C:\Windows\System32\gZwTztX.exe
  C:\Windows\System32\gZwTztX.exe
  2⤵
  PID:11804
- C:\Windows\System32\TUPgJof.exe
  C:\Windows\System32\TUPgJof.exe
  2⤵
  PID:11868
- C:\Windows\System32\XfgdIQD.exe
  C:\Windows\System32\XfgdIQD.exe
  2⤵
  PID:11928
- C:\Windows\System32\ONyvUKx.exe
  C:\Windows\System32\ONyvUKx.exe
  2⤵
  PID:11472
- C:\Windows\System32\FbQIujc.exe
  C:\Windows\System32\FbQIujc.exe
  2⤵
  PID:12056
- C:\Windows\System32\ILUxbwD.exe
  C:\Windows\System32\ILUxbwD.exe
  2⤵
  PID:12100
- C:\Windows\System32\kBHQmyb.exe
  C:\Windows\System32\kBHQmyb.exe
  2⤵
  PID:12180
- C:\Windows\System32\MTuEyWM.exe
  C:\Windows\System32\MTuEyWM.exe
  2⤵
  PID:12220
- C:\Windows\System32\PaUitgw.exe
  C:\Windows\System32\PaUitgw.exe
  2⤵
  PID:11296
- C:\Windows\System32\eGJCAkV.exe
  C:\Windows\System32\eGJCAkV.exe
  2⤵
  PID:11408
- C:\Windows\System32\FpMmjQB.exe
  C:\Windows\System32\FpMmjQB.exe
  2⤵
  PID:11648
- C:\Windows\System32\vNZTywV.exe
  C:\Windows\System32\vNZTywV.exe
  2⤵
  PID:3612
- C:\Windows\System32\oNZetMr.exe
  C:\Windows\System32\oNZetMr.exe
  2⤵
  PID:11700
- C:\Windows\System32\KiEYHFS.exe
  C:\Windows\System32\KiEYHFS.exe
  2⤵
  PID:11776
- C:\Windows\System32\iFnDIAn.exe
  C:\Windows\System32\iFnDIAn.exe
  2⤵
  PID:11984
- C:\Windows\System32\TFYWRIH.exe
  C:\Windows\System32\TFYWRIH.exe
  2⤵
  PID:12028
- C:\Windows\System32\fJbpigw.exe
  C:\Windows\System32\fJbpigw.exe
  2⤵
  PID:11304
- C:\Windows\System32\BfeoeCi.exe
  C:\Windows\System32\BfeoeCi.exe
  2⤵
  PID:11608
- C:\Windows\System32\wQmtXPG.exe
  C:\Windows\System32\wQmtXPG.exe
  2⤵
  PID:7852
- C:\Windows\System32\VdajfIe.exe
  C:\Windows\System32\VdajfIe.exe
  2⤵
  PID:11900
- C:\Windows\System32\sbtMAbq.exe
  C:\Windows\System32\sbtMAbq.exe
  2⤵
  PID:11476
- C:\Windows\System32\NVklchX.exe
  C:\Windows\System32\NVklchX.exe
  2⤵
  PID:11760
- C:\Windows\System32\ISokPAH.exe
  C:\Windows\System32\ISokPAH.exe
  2⤵
  PID:12300
- C:\Windows\System32\cIugcPf.exe
  C:\Windows\System32\cIugcPf.exe
  2⤵
  PID:12352
- C:\Windows\System32\nEPTwGv.exe
  C:\Windows\System32\nEPTwGv.exe
  2⤵
  PID:12388
- C:\Windows\System32\wjtszsL.exe
  C:\Windows\System32\wjtszsL.exe
  2⤵
  PID:12420
- C:\Windows\System32\pEVssCm.exe
  C:\Windows\System32\pEVssCm.exe
  2⤵
  PID:12448
- C:\Windows\System32\RgLrPdo.exe
  C:\Windows\System32\RgLrPdo.exe
  2⤵
  PID:12472
- C:\Windows\System32\PGIOHsz.exe
  C:\Windows\System32\PGIOHsz.exe
  2⤵
  PID:12496
- C:\Windows\System32\DuRcHQP.exe
  C:\Windows\System32\DuRcHQP.exe
  2⤵
  PID:12524
- C:\Windows\System32\cDUOmHa.exe
  C:\Windows\System32\cDUOmHa.exe
  2⤵
  PID:12592
- C:\Windows\System32\XSDyZLY.exe
  C:\Windows\System32\XSDyZLY.exe
  2⤵
  PID:12628
- C:\Windows\System32\NjHvdhi.exe
  C:\Windows\System32\NjHvdhi.exe
  2⤵
  PID:12684
- C:\Windows\System32\hbYUcKS.exe
  C:\Windows\System32\hbYUcKS.exe
  2⤵
  PID:12708
- C:\Windows\System32\JbEgazA.exe
  C:\Windows\System32\JbEgazA.exe
  2⤵
  PID:12740
- C:\Windows\System32\EjOvgcF.exe
  C:\Windows\System32\EjOvgcF.exe
  2⤵
  PID:12772
- C:\Windows\System32\FwWXRde.exe
  C:\Windows\System32\FwWXRde.exe
  2⤵
  PID:12796
- C:\Windows\System32\gEaOevK.exe
  C:\Windows\System32\gEaOevK.exe
  2⤵
  PID:12836
- C:\Windows\System32\BgzNDHU.exe
  C:\Windows\System32\BgzNDHU.exe
  2⤵
  PID:12864
- C:\Windows\System32\XtfpkZY.exe
  C:\Windows\System32\XtfpkZY.exe
  2⤵
  PID:12900
- C:\Windows\System32\OyVDxbv.exe
  C:\Windows\System32\OyVDxbv.exe
  2⤵
  PID:12932
- C:\Windows\System32\jpfgAlR.exe
  C:\Windows\System32\jpfgAlR.exe
  2⤵
  PID:12960
- C:\Windows\System32\vyMrigs.exe
  C:\Windows\System32\vyMrigs.exe
  2⤵
  PID:12992
- C:\Windows\System32\hLMRcgl.exe
  C:\Windows\System32\hLMRcgl.exe
  2⤵
  PID:13016
- C:\Windows\System32\sBbskZB.exe
  C:\Windows\System32\sBbskZB.exe
  2⤵
  PID:13056
- C:\Windows\System32\KkOTKkL.exe
  C:\Windows\System32\KkOTKkL.exe
  2⤵
  PID:13084
- C:\Windows\System32\WEQAQoi.exe
  C:\Windows\System32\WEQAQoi.exe
  2⤵
  PID:13112
- C:\Windows\System32\UayIVOi.exe
  C:\Windows\System32\UayIVOi.exe
  2⤵
  PID:13140
- C:\Windows\System32\GiiHkWC.exe
  C:\Windows\System32\GiiHkWC.exe
  2⤵
  PID:13164
- C:\Windows\System32\fxyInwt.exe
  C:\Windows\System32\fxyInwt.exe
  2⤵
  PID:13196
- C:\Windows\System32\wyScWdm.exe
  C:\Windows\System32\wyScWdm.exe
  2⤵
  PID:13224
- C:\Windows\System32\RomIjAr.exe
  C:\Windows\System32\RomIjAr.exe
  2⤵
  PID:13252
- C:\Windows\System32\YAOQePK.exe
  C:\Windows\System32\YAOQePK.exe
  2⤵
  PID:13280
- C:\Windows\System32\lrbtUOj.exe
  C:\Windows\System32\lrbtUOj.exe
  2⤵
  PID:13308
- C:\Windows\System32\CvfPskc.exe
  C:\Windows\System32\CvfPskc.exe
  2⤵
  PID:12320
- C:\Windows\System32\uVoSjGj.exe
  C:\Windows\System32\uVoSjGj.exe
  2⤵
  PID:12332
- C:\Windows\System32\UdaghoY.exe
  C:\Windows\System32\UdaghoY.exe
  2⤵
  PID:12428
- C:\Windows\System32\FDCXCDS.exe
  C:\Windows\System32\FDCXCDS.exe
  2⤵
  PID:12488
- C:\Windows\System32\wPZFKtW.exe
  C:\Windows\System32\wPZFKtW.exe
  2⤵
  PID:12564
- C:\Windows\System32\YLCAxMZ.exe
  C:\Windows\System32\YLCAxMZ.exe
  2⤵
  PID:12648
- C:\Windows\System32\BOWwiZJ.exe
  C:\Windows\System32\BOWwiZJ.exe
  2⤵
  PID:12724
- C:\Windows\System32\UhJGlKJ.exe
  C:\Windows\System32\UhJGlKJ.exe
  2⤵
  PID:12824
- C:\Windows\System32\aCJDlUF.exe
  C:\Windows\System32\aCJDlUF.exe
  2⤵
  PID:12880
- C:\Windows\System32\sARYorH.exe
  C:\Windows\System32\sARYorH.exe
  2⤵
  PID:12952
- C:\Windows\System32\erMHzPb.exe
  C:\Windows\System32\erMHzPb.exe
  2⤵
  PID:13032
- C:\Windows\System32\LTuKicn.exe
  C:\Windows\System32\LTuKicn.exe
  2⤵
  PID:13096
- C:\Windows\System32\UkHMusk.exe
  C:\Windows\System32\UkHMusk.exe
  2⤵
  PID:13148
- C:\Windows\System32\oAgGBrU.exe
  C:\Windows\System32\oAgGBrU.exe
  2⤵
  PID:13220
- C:\Windows\System32\wosiYGY.exe
  C:\Windows\System32\wosiYGY.exe
  2⤵
  PID:13272
- C:\Windows\System32\DbEgLtB.exe
  C:\Windows\System32\DbEgLtB.exe
  2⤵
  PID:4420
- C:\Windows\System32\hLziozG.exe
  C:\Windows\System32\hLziozG.exe
  2⤵
  PID:12480
- C:\Windows\System32\ZWBOhJo.exe
  C:\Windows\System32\ZWBOhJo.exe
  2⤵
  PID:12716
- C:\Windows\System32\AACGxzG.exe
  C:\Windows\System32\AACGxzG.exe
  2⤵
  PID:12860
- C:\Windows\System32\HgZdsge.exe
  C:\Windows\System32\HgZdsge.exe
  2⤵
  PID:13000
- C:\Windows\System32\vYLuVPD.exe
  C:\Windows\System32\vYLuVPD.exe
  2⤵
  PID:13192
- C:\Windows\System32\qlgESfa.exe
  C:\Windows\System32\qlgESfa.exe
  2⤵
  PID:3856
- C:\Windows\System32\KsBWEPz.exe
  C:\Windows\System32\KsBWEPz.exe
  2⤵
  PID:12828
- C:\Windows\System32\TaOjLOu.exe
  C:\Windows\System32\TaOjLOu.exe
  2⤵
  PID:13076
- C:\Windows\System32\ivmfXjq.exe
  C:\Windows\System32\ivmfXjq.exe
  2⤵
  PID:12548
- C:\Windows\System32\VaOiDCP.exe
  C:\Windows\System32\VaOiDCP.exe
  2⤵
  PID:2828
- C:\Windows\System32\kJwDJHh.exe
  C:\Windows\System32\kJwDJHh.exe
  2⤵
  PID:13328
- C:\Windows\System32\XaVnGBz.exe
  C:\Windows\System32\XaVnGBz.exe
  2⤵
  PID:13356
- C:\Windows\System32\PTxqIIf.exe
  C:\Windows\System32\PTxqIIf.exe
  2⤵
  PID:13384
- C:\Windows\System32\RwjyjXC.exe
  C:\Windows\System32\RwjyjXC.exe
  2⤵
  PID:13412
- C:\Windows\System32\EawGYbB.exe
  C:\Windows\System32\EawGYbB.exe
  2⤵
  PID:13440
- C:\Windows\System32\dajBFFR.exe
  C:\Windows\System32\dajBFFR.exe
  2⤵
  PID:13468
- C:\Windows\System32\BWMzClw.exe
  C:\Windows\System32\BWMzClw.exe
  2⤵
  PID:13496
- C:\Windows\System32\WvXaQQC.exe
  C:\Windows\System32\WvXaQQC.exe
  2⤵
  PID:13532
- C:\Windows\System32\WTkcoJF.exe
  C:\Windows\System32\WTkcoJF.exe
  2⤵
  PID:13560
- C:\Windows\System32\qgUnZGI.exe
  C:\Windows\System32\qgUnZGI.exe
  2⤵
  PID:13588
- C:\Windows\System32\CWkbFys.exe
  C:\Windows\System32\CWkbFys.exe
  2⤵
  PID:13616
- C:\Windows\System32\YQHWMAH.exe
  C:\Windows\System32\YQHWMAH.exe
  2⤵
  PID:13644
- C:\Windows\System32\icGQIjl.exe
  C:\Windows\System32\icGQIjl.exe
  2⤵
  PID:13672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BwkQSoT.exe

Path C:\Windows\System32\BwkQSoT.exe
Size 3.1MB
SHA256 972b253f14ff4305071f5facaff0b84395d503a46ee6af4c754cbc7839ed564c
MD5 7bf5112720596103091b151d3023fe93
SHA1 050059467cf43ab2d342acf073f42602f77a3fb4
SHA512 8f1ab1d3e2f11a2a2e340db5aea818b4545b47085f922b0eb8aed8ea2c511c0e3f2e2cc6da2e8a88d23a13172762ac9cf9a7e057f7c7ab2f13f188d0c597db29
SSDEEP 98304:N0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc40L:NFWPClFkL
MD5 SHA1 SHA512 SSDEEP

Submit Download

CAvvGct.exe

Path C:\Windows\System32\CAvvGct.exe
Size 3.1MB
SHA256 12ab98179d5ff7d27df9b1d10a05345288ce20d1728871bc6dbd8d6e3f4f15a2
MD5 501da04c3aaf0b3320c7e0acfdf7adab
SHA1 eb777fc77c0f900fc57ac3036bbdc73a12dd773b
SHA512 3c924c545d35476fbc544798c8f5cabb409ecd2acd44aaef902ed540d6f067bfc79021d53396db94523f29921cdf7941471fc37edb3631185a93cc40a095ea04
SSDEEP 98304:N0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc409:NFWPClFk9
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSnquJV.exe

Path C:\Windows\System32\CSnquJV.exe
Size 3.1MB
SHA256 83fc3df9f1d9ac69c2b00384fcdfd846b5ceb2d173960ad776b1da1449e89180
MD5 c89f51bf5da39cc6127d94ca090410c4
SHA1 5f74fcf16901b17f28e25eb9b575b9868175b8ab
SHA512 9848f7ee49282ad4983ab74f343659a1ec9174db94d535905e69bcbb412d51b6a100d61c6e9275edfdaa877c7b1a716455d162c56803e6a3ff74129f868f5f2c
SSDEEP 98304:N0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc40M:NFWPClFkM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cwifaib.exe

Path C:\Windows\System32\Cwifaib.exe
Size 3.1MB
SHA256 deda5a4a43d68bbc3f37e9b0982b6504baedcb5304a2064d09d758948701ba23
MD5 8cb093518ab70de1faa782d058f157b2
SHA1 635fd8e7b9755ac5b35b2342249c877e8ae6ea54
SHA512 3d6f58c557b28ea0837da64b8f85b705a99cf15b78e4687ca0cb6568d7720af3c97adb2a1f76f9ec6dd6836d1b423753abeb706e7feb5cdf5b7495739dddee11
SSDEEP 98304:N0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc40h:NFWPClFkh
MD5 SHA1 SHA512 SSDEEP

Submit Download

DexWvia.exe

Path C:\Windows\System32\DexWvia.exe
Size 3.1MB
SHA256 f91fc606202094d1c410dcfa53922e845ea6f9181c6578376c1bca9f32075c8c
MD5 a51fa9224ceac6928f51137e15dcfc47
SHA1 515b1fe83902f92c0793585f4c290861e5f6ce4b
SHA512 6b650bda663c9b81602d385ab72da808f934898e56343fba71400256f1e347431e26dd44cc4f8e4084bb6229b7b3d4d9cf6697c280e9180c3f2cd6636f58af34
SSDEEP 98304:N0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc40D:NFWPClFkD
MD5 SHA1 SHA512 SSDEEP

Submit Download

EwiTOTx.exe

Path C:\Windows\System32\EwiTOTx.exe
Size 3.1MB
SHA256 91ea8472ea7db036629a76e48ae956c73f8dcd0f282ab29fa6f84c4d4e0dbac3
MD5 d3b82be59103c94d993c315a89a38ae1
SHA1 8cfad732bbed6b46427cec0e5f350e1fe3d7bb8a
SHA512 c475f68bae8ca68259c2fea1afde6f32546dcf9da0997682208a6a27dd2dbdb9918e3491eab3505597c8b0992a492c1050ea69f05e4b3be34a64e0800e5b5e76
SSDEEP 98304:N0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc40P:NFWPClFkP
MD5 SHA1 SHA512 SSDEEP

Submit Download

MajAdUC.exe

Path C:\Windows\System32\MajAdUC.exe
Size 3.1MB
SHA256 4e78cdb0b7e17601ad339f87f2e87d4ca1d70841f941880444d4b7eafd3e26ac
MD5 ad844339977058ee79449be8a9b19a74
SHA1 5b460f678bc4c643f5b8005cc9a855694c1f38d0
SHA512 889ab7b78d92efe5351edd23ecb7f71c78e00de104eb88e3fa6483bf7671cf241878b9ecc943588cdb5754fb42afb49c1a87d7dfca045dc16e7f24bb1b0654f4
SSDEEP 98304:N0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc40+:NFWPClFk+
MD5 SHA1 SHA512 SSDEEP

Submit Download

MrkryOC.exe

Path C:\Windows\System32\MrkryOC.exe
Size 3.1MB
SHA256 089f8bb4173d8a6e10a87a748cc3aac782f29e871153a17c7ecf7ac084bf54cd
MD5 3341d344b5786e743067370f1f81aef1
SHA1 5ca5a3da7798c5e9f61229bf395c3cec9ba93cee
SHA512 c7e1377991ab877cedeaf15f4f13e657b5a5fce698eff820ba99e4816c15a4344ac4f750e055bb3274685e37e8d8ddcfbdb3636d273b52d23b893b4ba6f4895e
SSDEEP 98304:N0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc40+:NFWPClFk+
MD5 SHA1 SHA512 SSDEEP

Submit Download

PEyQvOZ.exe

Path C:\Windows\System32\PEyQvOZ.exe
Size 3.1MB
SHA256 74b2befa01f863f927f38bca3ece1207297393904f44ebf2410332a0f8b7ce49
MD5 389ffd593ac978c21596568316c35bc8
SHA1 b48d51cbbae8bd77e59edff38b0d466d8570cda9
SHA512 f25c20f394fbdc0599aa4acb667cbc906c7032efceef14af71128b1b9e9a87ed5b95c2f0075fdd579f1e7ff4583f0781e78a7cbffd73e0ef35c4d74da1a6266c
SSDEEP 98304:N0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc401:NFWPClFk1
MD5 SHA1 SHA512 SSDEEP

Submit Download

QWtYwvc.exe

Path C:\Windows\System32\QWtYwvc.exe
Size 3.1MB
SHA256 091453eea9e9df911a0f9dd21a0c3c93e9d0a908fcf588ff8c00ec598072de99
MD5 7af68198d57763a6f711c382c36cd03d
SHA1 5cfe4b40ed1cbd68df4081d577debd8a967e46e8
SHA512 98d2db2aa3280fcc9715be3c6998aab671c1a12a68851981ee33873be82ca2ebf20eb69d61ab534383aa84181e7c0461ace791db7709ffa5c14ec790ae011073
SSDEEP 98304:N0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc40W:NFWPClFkW
MD5 SHA1 SHA512 SSDEEP

Submit Download

QZZRQUx.exe

Path C:\Windows\System32\QZZRQUx.exe
Size 3.1MB
SHA256 cfd0a927b10b728aa868ce304e1e3ce0de853d3663f4fd81682a49860d22c4d4
MD5 7bba4e50dada779969e0aa7a6a867a85
SHA1 2d4d354a9285e8da3790001979acaab25633217c
SHA512 55f7d174bf380919c793cd0b04b0f05bcaf7e013955efb3f740819153013d08f6a53cbe56043c6b5aec48c8c22fbb4a03776ae5f18075766f7d6770103bd700a
SSDEEP 98304:N0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc40s:NFWPClFks
MD5 SHA1 SHA512 SSDEEP

Submit Download

UmJGxnz.exe

Path C:\Windows\System32\UmJGxnz.exe
Size 3.1MB
SHA256 37e76f083e1223768d237be9e9cf74068cd783d820f0a5229ca4295383f33b69
MD5 769d1766a7a55f71160819941ccff5ca
SHA1 c944be5f7fb2d0f18b63f465fdba862fee3a3914
SHA512 7eb9232a8afdbb52cff77da48b1af2c54b06637bcba62f5d7c9c9414aabd71fc2094f6d45c5be691e076fd059955c35d18bfdbf753dc8c9e78d9bac8683a4c61
SSDEEP 98304:N0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc402:NFWPClFk2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Zrrkfal.exe

Path C:\Windows\System32\Zrrkfal.exe
Size 3.1MB
SHA256 4e8c1f08c05b2f002030fe1ceaf06cfe7ecea90b29fe0f62fc4ffc6662592577
MD5 1190f4a71845ddafd4074d1f643479a3
SHA1 8babe0ea63161cd8f47c5d12f972463d63a66650
SHA512 f932d51436d54a881d53b00701e710c467396323ff6a0c47a10ba369a31f76ddea849fe1a1c6fc34e2499fd2a697581c85e728ae6a11cfeda6a3e7849fb8b6ca
SSDEEP 98304:N0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc40p:NFWPClFkp
MD5 SHA1 SHA512 SSDEEP

Submit Download

axHwJQa.exe

Path C:\Windows\System32\axHwJQa.exe
Size 3.1MB
SHA256 f1451788f5441010714c6c7be1c61639c59cf47b8f0a735cbcf9efd2bf84190f
MD5 be6e41154909490a1193f0cec1b9220b
SHA1 049be7bf7d3cbe2de60353f9d8a3489086ba723c
SHA512 db8d088080a43cfc86aeecf3ccd6dafbe50e34eb8e1f92154ad9d39ea210969c1871b616b633cdcbb8da57d9175eecbba842f464b8235b3c0740f14cb2f79f1f
SSDEEP 98304:N0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc40C:NFWPClFkC
MD5 SHA1 SHA512 SSDEEP

Submit Download

bvYmdWg.exe

Path C:\Windows\System32\bvYmdWg.exe
Size 3.1MB
SHA256 94e21650c652d021250649ac212091fbab21e98915683e929066679a72d4fd68
MD5 b3795dbb45aa48bd61ddaec1776a355e
SHA1 8051e8184607e7149011dec2478c929fb084a4c2
SHA512 cb7c0eeb6de528ba5ce0aed771a0a4709982c9ddc19cbbd67f42b066ff5611b472345ebb7782f229f81c5523b5be850b682d7ea2c339eb4381996dd9f706ec41
SSDEEP 98304:N0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc40b:NFWPClFkb
MD5 SHA1 SHA512 SSDEEP

Submit Download

cJkjEUk.exe

Path C:\Windows\System32\cJkjEUk.exe
Size 3.1MB
SHA256 e09920b976c768ba35540bd7c1edc2caf302fab4c9a059e000aaaa13f24ca785
MD5 4da2b1ac026f7447875b7c1638cd4470
SHA1 1387e222bd1feba6f08fe3a36e660d19b4994d06
SHA512 739e0b8341670a2d617239b827433fa6715cfad66d182c9b0c1d024a285030dc3bba72fb2796612faaae871c95372918b71b2f3c281b30b0c764d5bc2e12442c
SSDEEP 98304:N0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc40C:NFWPClFkC
MD5 SHA1 SHA512 SSDEEP

Submit Download

frZimVE.exe

Path C:\Windows\System32\frZimVE.exe
Size 3.1MB
SHA256 c8807f2c39fdd966c201dadd8d6e46df5a0358c918c3637a02204f9d394ff204
MD5 42755001ed1925fc25f99a0d058c4090
SHA1 19bb1aeff5f260fda85b4b32f6351ccb59037f24
SHA512 52dec85168baadc9a92e981b84d75e2f797b0d37899e694b5c17cd859f44bf7d4da5ae3086a661a3dd242935efe8acf61516a152d0a7b3582c597bc2a37f02f5
SSDEEP 98304:N0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc408:NFWPClFk8
MD5 SHA1 SHA512 SSDEEP

Submit Download

gMSTymW.exe

Path C:\Windows\System32\gMSTymW.exe
Size 3.1MB
SHA256 eacded136220d74b42fdaf7f6df9ce40212896dd8374ff0d781bee50306980bd
MD5 a66455bac1c42975d556d324b62fc2f3
SHA1 b02b6c182299977e26233e0cee1bdf3957734486
SHA512 d3a69e00be6bbf20ec9475a50174ef49db8115e57435ec2f388e8fc1e855cb00099dbb9f2f1f0163681b1484f1f5c386182ea25f94be67c4b2c29a4d1b72635e
SSDEEP 98304:N0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc40i:NFWPClFki
MD5 SHA1 SHA512 SSDEEP

Submit Download

hmgFrPl.exe

Path C:\Windows\System32\hmgFrPl.exe
Size 3.1MB
SHA256 cea58f25f0f0896e3a2bcb7cb640b25314880573030fdf5a3667d5f56e4e9ef8
MD5 07fa7fc03422c7a05f250676acf13e81
SHA1 037abb05a51f15e025dc735eedc45d6c12c5e376
SHA512 7aec42197697528886a241d9578ab62dc4db6a44f6aff67b966fc3fde006fab18b4f0aba5a97163cfd7f7e311b5227b9deef67f3788301ad06f2742b38910f95
SSDEEP 98304:N0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc409:NFWPClFk9
MD5 SHA1 SHA512 SSDEEP

Submit Download

iapvRBL.exe

Path C:\Windows\System32\iapvRBL.exe
Size 3.1MB
SHA256 07bcdba35f410446fdc059ced020b9d24f372a10a122b8f3d5cb876d6bc86fb4
MD5 87e7cf8ba4c076247937cc23f6166353
SHA1 982d513ae490db207a72d6142eb4d889c363a369
SHA512 28eb8537e6e2f145b796cb2163cbf5a29cf08f17ce0a2363cc170c5d6ebda8749f8d79d62016f152f81d7d5897978fe3edc05fbaa6fa25f0e7f5f5886bdf5fc4
SSDEEP 98304:N0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc40Q:NFWPClFkQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jnnDazX.exe

Path C:\Windows\System32\jnnDazX.exe
Size 3.1MB
SHA256 70d5a096438be918423ee53f507a979b99280ca0ad8991cd3cd95d0026fe5a49
MD5 22f7323e50d0659f5ce53642d2c963ca
SHA1 5690e96b63c44d044786adacfba2aec4e10eae31
SHA512 05be77d3978d11c8bb9c7658de9e788b2fa44425e78eec42d791e6ffae7f91a13ce54a9844b85171800a2e26550e078754c91fb56d6887987432900cf5cdf2af
SSDEEP 98304:N0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc40N:NFWPClFkN
MD5 SHA1 SHA512 SSDEEP

Submit Download

kbujkdK.exe

Path C:\Windows\System32\kbujkdK.exe
Size 3.1MB
SHA256 59ff53b22501b988c9dca4396c6c08ca33e5f1238288e4e20d3ddbbdd5c1b634
MD5 734f63ba0a8c2c5eff83c8477aed735f
SHA1 3aec518cb306e47c5c7a6b10cd939bf486bd38eb
SHA512 ebcd8b3a1d206a12dfe1bc043e17b6dbe795da298ef2c6cf60d30c352fe9a4eadb8a1650627476374277cbcda1b88bd7f1fac9e21b9973d33cda1f790a419902
SSDEEP 98304:N0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc403:NFWPClFk3
MD5 SHA1 SHA512 SSDEEP

Submit Download

muGTwsh.exe

Path C:\Windows\System32\muGTwsh.exe
Size 3.1MB
SHA256 eca5005a3386ca3123aef5e0f190c98c0b58b40722c0e21e0f46d1a1a274a766
MD5 98d76ba25ffab9b73624c9e6bc2842ff
SHA1 fa464b818460f5d163cddd09035157513036dc43
SHA512 77dc424afc8a8f922577f28649928491a02f9a25fc9cfa9c6423f13bde419273ace02083903117140454c23a6673b8b6b8992077f66d742980b8dd575fb5ea99
SSDEEP 98304:N0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc400:NFWPClFk0
MD5 SHA1 SHA512 SSDEEP

Submit Download

tfZqMqq.exe

Path C:\Windows\System32\tfZqMqq.exe
Size 3.1MB
SHA256 b4a4c9bbb3c4747ac4d95f2a3e316ce5dc83c2dae88ddb8ca8d4b29db8710a15
MD5 a962c50b0275cf8863a250d234ebfc2f
SHA1 6e109136109a08777ef088b6f497863d6dfa1621
SHA512 2338ddab41c499ddb304b13e09a67baa28b191f6ac416901f1e6718e3391820b5f1ade5c677a804d465435d385cf1e488a2e35934bac3e04cfa599afc548d36c
SSDEEP 98304:N0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc40y:NFWPClFky
MD5 SHA1 SHA512 SSDEEP

Submit Download

vONWDeF.exe

Path C:\Windows\System32\vONWDeF.exe
Size 3.1MB
SHA256 83a3c1bc03cf5087cdafd85764c136cf956be7d511cfbf23cb048bef9c4aea4e
MD5 1346766a762b53266737f67b41b6f14f
SHA1 e1a5636e4a9283806aba9c98afc1c1dd7a869fe2
SHA512 192c240c43f3b1f3e62bedb8fdb83d995ff4d47289fd02d06889252759d044b59814cecd505ea37f4c59cc815189f8fed01409bf4694887409955e7c48127028
SSDEEP 98304:N0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc40V:NFWPClFkV
MD5 SHA1 SHA512 SSDEEP

Submit Download

vUJojTR.exe

Path C:\Windows\System32\vUJojTR.exe
Size 3.1MB
SHA256 75d4e03b7f1b469ae7b8b0df7a719b65385a7b171720053262b8769d44250c1b
MD5 3c8d588f1fef3224da8e00c443070146
SHA1 81d9026a46911f0813de2d506c7ff3f233b0cb9d
SHA512 7a92b17bf622005bb06205113504e5c3165b0a61e35304119292394f639aac5253d2d5ec98a70931238371261c2703f71e9a204c2e6aaf8489b913e86086bb20
SSDEEP 98304:N0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc40o:NFWPClFko
MD5 SHA1 SHA512 SSDEEP

Submit Download

vfBeVLs.exe

Path C:\Windows\System32\vfBeVLs.exe
Size 3.1MB
SHA256 5ef41cf2b6c15f4507b06551164a7cc549738350a6cdbd88fc5304299ca42878
MD5 b3dc86b8e78b810be6cdd7f1970e53f3
SHA1 350934c75611b1d94b4181a88d5992aee1c9441c
SHA512 c3df6f94f5721e55d0fb348fe6a12f0f57533f4102dc158e18f4bb829e6e0545cbb7fcba925c3a1fdc3784f211c7f3ce41808612e9e4bac835ec2149b20da99d
SSDEEP 98304:N0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc40E:NFWPClFkE
MD5 SHA1 SHA512 SSDEEP

Submit Download

vrWOTUz.exe

Path C:\Windows\System32\vrWOTUz.exe
Size 3.1MB
SHA256 17bdd86de8b7783d35d9bd4db6c09cd0cfaa0d5fcb9697d8db1b026c1fc9cf59
MD5 8044b11b26959ab440c1a648b1866787
SHA1 fdd33e42aecae5a769e6b7c61f0293faf04ec030
SHA512 a26178ed94e7ed9acebe531ae515c098ef6a3d6901b045776d1c5d2ef8a85e5a7d7394951c191f0a11e878518cc18802420334b99279187d8e4efa6ff2deb4c6
SSDEEP 98304:N0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc400:NFWPClFk0
MD5 SHA1 SHA512 SSDEEP

Submit Download

vsJklIo.exe

Path C:\Windows\System32\vsJklIo.exe
Size 3.1MB
SHA256 eaedf853e765171a589d8c06fad0d959e7d75092bb80639f2be47a959f1c840f
MD5 9dbfe2f83ea9b3f337b7e2f37b53eada
SHA1 637a4962a7a9397e306b16b281ea2e567e40ab63
SHA512 3faf7766e7a084f40f10eb9229bec7ff9f4f3ddac869a8f97150ca6233a1d47f346a7531908f81c5e012c34a41b17d430553930e1722b8fcbd5e39f539d05445
SSDEEP 98304:N0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc40U:NFWPClFkU
MD5 SHA1 SHA512 SSDEEP

Submit Download

wrhsxaE.exe

Path C:\Windows\System32\wrhsxaE.exe
Size 3.1MB
SHA256 aa21a9a082d02048119f7b0247a3c8dd2b5311b8529a7f7dea42776b3437dd95
MD5 77e4bb8d9c92360723a092494a51d905
SHA1 a65359e40653fb40f089672cb0ac22ec001a63a5
SHA512 334ebc99f45ca8d853052a6741f1ec7fdb22cc7d2940eca4df4b5dd207a5c7c0985a8916b25226568ee18ad68fc5421fbcd77a8987f45797ece66cbabfed5f44
SSDEEP 98304:N0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc40z:NFWPClFkz
MD5 SHA1 SHA512 SSDEEP

Submit Download

xVIRGQy.exe

Path C:\Windows\System32\xVIRGQy.exe
Size 3.1MB
SHA256 7dcef944a973fba90ace1c9d38134b9a1450718a811a2f03c55bfa9214dfee5a
MD5 cc6bba5d579ec260560f9892684fb125
SHA1 407db93c93284c0b759ef1d230e021319022c538
SHA512 a43d08f74cbbde92f45df0a107d645195b43721f92dbcf9d45a9f5c77e9ca91f1a729d841eab5c77371cb09767232b55fd72f7f711c040e8508c678957a8df0c
SSDEEP 98304:N0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc40S:NFWPClFkS
MD5 SHA1 SHA512 SSDEEP

Submit Download

zmmpWnq.exe

Path C:\Windows\System32\zmmpWnq.exe
Size 3.1MB
SHA256 eafcb9e546eb8dd7a2c3f9f93e013ea74b4e84502ef18a316150b38130dd28b0
MD5 ab2024a0d3fbf3e9b49fe0bb7b7e4d8e
SHA1 057369902ff7c03ce01616718c45df90a9e0a43b
SHA512 0e4ef0b20e2edba499c0fb26c833f3484dba16c43c44f63f780080774f87341e313df5685dc049bfe30a6ceaaef503b439f77413e31a3a418f5ea82dd281ccdb
SSDEEP 98304:N0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc40l:NFWPClFkl
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/564-567-0x00007FF76BC80000-0x00007FF76C075000-memory.dmp

Download

memory/564-1921-0x00007FF76BC80000-0x00007FF76C075000-memory.dmp

Download

memory/668-1919-0x00007FF77BE90000-0x00007FF77C285000-memory.dmp

Download

memory/668-557-0x00007FF77BE90000-0x00007FF77C285000-memory.dmp

Download

memory/876-537-0x00007FF634120000-0x00007FF634515000-memory.dmp

Download

memory/876-1909-0x00007FF634120000-0x00007FF634515000-memory.dmp

Download

memory/1048-547-0x00007FF73B210000-0x00007FF73B605000-memory.dmp

Download

memory/1048-1915-0x00007FF73B210000-0x00007FF73B605000-memory.dmp

Download

memory/1208-1912-0x00007FF7287F0000-0x00007FF728BE5000-memory.dmp

Download

memory/1208-540-0x00007FF7287F0000-0x00007FF728BE5000-memory.dmp

Download

memory/1588-1900-0x00007FF7A2920000-0x00007FF7A2D15000-memory.dmp

Download

memory/1588-21-0x00007FF7A2920000-0x00007FF7A2D15000-memory.dmp

Download

memory/1880-542-0x00007FF7365B0000-0x00007FF7369A5000-memory.dmp

Download

memory/1880-1918-0x00007FF7365B0000-0x00007FF7369A5000-memory.dmp

Download

memory/2096-1911-0x00007FF69EAE0000-0x00007FF69EED5000-memory.dmp

Download

memory/2096-539-0x00007FF69EAE0000-0x00007FF69EED5000-memory.dmp

Download

memory/2324-43-0x00007FF739770000-0x00007FF739B65000-memory.dmp

Download

memory/2324-1897-0x00007FF739770000-0x00007FF739B65000-memory.dmp

Download

memory/2324-1904-0x00007FF739770000-0x00007FF739B65000-memory.dmp

Download

memory/2596-1902-0x00007FF730790000-0x00007FF730B85000-memory.dmp

Download

memory/2596-23-0x00007FF730790000-0x00007FF730B85000-memory.dmp

Download

memory/2600-535-0x00007FF6DF1E0000-0x00007FF6DF5D5000-memory.dmp

Download

memory/2600-1906-0x00007FF6DF1E0000-0x00007FF6DF5D5000-memory.dmp

Download

memory/2660-26-0x00007FF7C3BD0000-0x00007FF7C3FC5000-memory.dmp

Download

memory/2660-1901-0x00007FF7C3BD0000-0x00007FF7C3FC5000-memory.dmp

Download

memory/2904-1408-0x00007FF699DC0000-0x00007FF69A1B5000-memory.dmp

Download

memory/2904-1899-0x00007FF699DC0000-0x00007FF69A1B5000-memory.dmp

Download

memory/2904-9-0x00007FF699DC0000-0x00007FF69A1B5000-memory.dmp

Download

memory/2936-1903-0x00007FF622210000-0x00007FF622605000-memory.dmp

Download

memory/2936-35-0x00007FF622210000-0x00007FF622605000-memory.dmp

Download

memory/2980-538-0x00007FF6295E0000-0x00007FF6299D5000-memory.dmp

Download

memory/2980-1910-0x00007FF6295E0000-0x00007FF6299D5000-memory.dmp

Download

memory/3064-1914-0x00007FF66A1C0000-0x00007FF66A5B5000-memory.dmp

Download

memory/3064-543-0x00007FF66A1C0000-0x00007FF66A5B5000-memory.dmp

Download

memory/3300-1922-0x00007FF673370000-0x00007FF673765000-memory.dmp

Download

memory/3300-573-0x00007FF673370000-0x00007FF673765000-memory.dmp

Download

memory/3416-553-0x00007FF6918F0000-0x00007FF691CE5000-memory.dmp

Download

memory/3416-1916-0x00007FF6918F0000-0x00007FF691CE5000-memory.dmp

Download

memory/3936-1920-0x00007FF7EBEC0000-0x00007FF7EC2B5000-memory.dmp

Download

memory/3936-563-0x00007FF7EBEC0000-0x00007FF7EC2B5000-memory.dmp

Download

memory/4544-541-0x00007FF7BE2E0000-0x00007FF7BE6D5000-memory.dmp

Download

memory/4544-1913-0x00007FF7BE2E0000-0x00007FF7BE6D5000-memory.dmp

Download

memory/4608-1908-0x00007FF65C4A0000-0x00007FF65C895000-memory.dmp

Download

memory/4608-577-0x00007FF65C4A0000-0x00007FF65C895000-memory.dmp

Download

memory/4680-1905-0x00007FF726560000-0x00007FF726955000-memory.dmp

Download

memory/4680-50-0x00007FF726560000-0x00007FF726955000-memory.dmp

Download

memory/4704-1917-0x00007FF6B8980000-0x00007FF6B8D75000-memory.dmp

Download

memory/4704-550-0x00007FF6B8980000-0x00007FF6B8D75000-memory.dmp

Download

memory/4808-0-0x00007FF686620000-0x00007FF686A15000-memory.dmp

Download

memory/4808-1898-0x00007FF686620000-0x00007FF686A15000-memory.dmp

Download

memory/4808-1-0x000002071BE40000-0x000002071BE50000-memory.dmp

Download

memory/4808-1405-0x00007FF686620000-0x00007FF686A15000-memory.dmp

Download

memory/5032-1907-0x00007FF61A650000-0x00007FF61AA45000-memory.dmp

Download

memory/5032-536-0x00007FF61A650000-0x00007FF61AA45000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads