Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 12:38
Behavioral task
behavioral1
Sample
b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe
-
Size
2.3MB
-
MD5
b37e80049bc7a77f374e5ff7fa3c8990
-
SHA1
cc65c14c9496b4356bf6dc5fc0acd8eb7eb61d36
-
SHA256
61258271ccc4def3f7732fc3dc997471ac1f6eb143e63f48647f75e1ea4a3b02
-
SHA512
2a07126507d3643f18e1cf84719190cba5db153fdec812bdf1de9897605a69a8009153d3cc1f26980096d427189f6402d49462503281f3d6e2c2c9a5e90f5cee
-
SSDEEP
49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+Agr6StVEnmcKWnq0vljs:BemTLkNdfE0pZrw4
Malware Config
Signatures
-
KPOT Core Executable 32 IoCs
resource yara_rule behavioral1/files/0x000e000000012122-3.dat family_kpot behavioral1/files/0x0038000000015d28-11.dat family_kpot behavioral1/files/0x0009000000015d7f-10.dat family_kpot behavioral1/files/0x0007000000015ff4-28.dat family_kpot behavioral1/files/0x0006000000016d4e-66.dat family_kpot behavioral1/files/0x0006000000016d65-81.dat family_kpot behavioral1/files/0x0014000000018669-147.dat family_kpot behavioral1/files/0x0005000000018787-188.dat family_kpot behavioral1/files/0x000500000001873f-183.dat family_kpot behavioral1/files/0x0005000000018739-178.dat family_kpot behavioral1/files/0x00050000000186ff-173.dat family_kpot behavioral1/files/0x00050000000186f1-168.dat family_kpot behavioral1/files/0x00050000000186e6-163.dat family_kpot behavioral1/files/0x0005000000018686-158.dat family_kpot behavioral1/files/0x001100000001867a-153.dat family_kpot behavioral1/files/0x0006000000018663-144.dat family_kpot behavioral1/files/0x0006000000017486-133.dat family_kpot behavioral1/files/0x0006000000017495-137.dat family_kpot behavioral1/files/0x0006000000017042-123.dat family_kpot behavioral1/files/0x0006000000017477-128.dat family_kpot behavioral1/files/0x0006000000016de7-113.dat family_kpot behavioral1/files/0x0006000000016eb9-118.dat family_kpot behavioral1/files/0x0006000000016dde-108.dat family_kpot behavioral1/files/0x0006000000016dda-102.dat family_kpot behavioral1/files/0x0006000000016d69-88.dat family_kpot behavioral1/files/0x0006000000016d71-95.dat family_kpot behavioral1/files/0x0006000000016d61-74.dat family_kpot behavioral1/files/0x00090000000165a8-61.dat family_kpot behavioral1/files/0x0008000000016310-54.dat family_kpot behavioral1/files/0x0007000000016103-47.dat family_kpot behavioral1/files/0x0007000000015f71-46.dat family_kpot behavioral1/files/0x0008000000015e5b-27.dat family_kpot -
XMRig Miner payload 64 IoCs
resource yara_rule behavioral1/memory/2236-0-0x000000013FD60000-0x00000001400B4000-memory.dmp xmrig behavioral1/files/0x000e000000012122-3.dat xmrig behavioral1/files/0x0038000000015d28-11.dat xmrig behavioral1/files/0x0009000000015d7f-10.dat xmrig behavioral1/files/0x0007000000015ff4-28.dat xmrig behavioral1/memory/2848-50-0x000000013F180000-0x000000013F4D4000-memory.dmp xmrig behavioral1/files/0x0006000000016d4e-66.dat xmrig behavioral1/memory/2512-70-0x000000013F500000-0x000000013F854000-memory.dmp xmrig behavioral1/files/0x0006000000016d65-81.dat xmrig behavioral1/files/0x0014000000018669-147.dat xmrig behavioral1/memory/2800-1071-0x000000013FA70000-0x000000013FDC4000-memory.dmp xmrig behavioral1/memory/2612-1072-0x000000013F0B0000-0x000000013F404000-memory.dmp xmrig behavioral1/memory/2848-749-0x000000013F180000-0x000000013F4D4000-memory.dmp xmrig behavioral1/files/0x0005000000018787-188.dat xmrig behavioral1/files/0x000500000001873f-183.dat xmrig behavioral1/files/0x0005000000018739-178.dat xmrig behavioral1/files/0x00050000000186ff-173.dat xmrig behavioral1/files/0x00050000000186f1-168.dat xmrig behavioral1/files/0x00050000000186e6-163.dat xmrig behavioral1/files/0x0005000000018686-158.dat xmrig behavioral1/files/0x001100000001867a-153.dat xmrig behavioral1/files/0x0006000000018663-144.dat xmrig behavioral1/files/0x0006000000017486-133.dat xmrig behavioral1/files/0x0006000000017495-137.dat xmrig behavioral1/files/0x0006000000017042-123.dat xmrig behavioral1/files/0x0006000000017477-128.dat xmrig behavioral1/files/0x0006000000016de7-113.dat xmrig behavioral1/files/0x0006000000016eb9-118.dat xmrig behavioral1/memory/2236-104-0x0000000001F70000-0x00000000022C4000-memory.dmp xmrig behavioral1/files/0x0006000000016dde-108.dat xmrig behavioral1/files/0x0006000000016dda-102.dat xmrig behavioral1/memory/1668-92-0x000000013F570000-0x000000013F8C4000-memory.dmp xmrig behavioral1/memory/1504-99-0x000000013F3F0000-0x000000013F744000-memory.dmp xmrig behavioral1/memory/2108-91-0x000000013F930000-0x000000013FC84000-memory.dmp xmrig behavioral1/files/0x0006000000016d69-88.dat xmrig behavioral1/files/0x0006000000016d71-95.dat xmrig behavioral1/memory/2936-84-0x000000013F410000-0x000000013F764000-memory.dmp xmrig behavioral1/memory/1728-78-0x000000013F1F0000-0x000000013F544000-memory.dmp xmrig behavioral1/memory/2236-77-0x000000013FD60000-0x00000001400B4000-memory.dmp xmrig behavioral1/files/0x0006000000016d61-74.dat xmrig behavioral1/memory/2612-63-0x000000013F0B0000-0x000000013F404000-memory.dmp xmrig behavioral1/files/0x00090000000165a8-61.dat xmrig behavioral1/memory/2800-56-0x000000013FA70000-0x000000013FDC4000-memory.dmp xmrig behavioral1/memory/2684-49-0x000000013F500000-0x000000013F854000-memory.dmp xmrig behavioral1/files/0x0008000000016310-54.dat xmrig behavioral1/files/0x0007000000016103-47.dat xmrig behavioral1/files/0x0007000000015f71-46.dat xmrig behavioral1/memory/2592-45-0x000000013F4F0000-0x000000013F844000-memory.dmp xmrig behavioral1/memory/2732-44-0x000000013F5D0000-0x000000013F924000-memory.dmp xmrig behavioral1/memory/2236-43-0x000000013F180000-0x000000013F4D4000-memory.dmp xmrig behavioral1/memory/2328-39-0x000000013FF10000-0x0000000140264000-memory.dmp xmrig behavioral1/files/0x0008000000015e5b-27.dat xmrig behavioral1/memory/1828-22-0x000000013F970000-0x000000013FCC4000-memory.dmp xmrig behavioral1/memory/2108-13-0x000000013F930000-0x000000013FC84000-memory.dmp xmrig behavioral1/memory/2936-1074-0x000000013F410000-0x000000013F764000-memory.dmp xmrig behavioral1/memory/2108-1077-0x000000013F930000-0x000000013FC84000-memory.dmp xmrig behavioral1/memory/1828-1078-0x000000013F970000-0x000000013FCC4000-memory.dmp xmrig behavioral1/memory/2328-1079-0x000000013FF10000-0x0000000140264000-memory.dmp xmrig behavioral1/memory/2848-1083-0x000000013F180000-0x000000013F4D4000-memory.dmp xmrig behavioral1/memory/2612-1086-0x000000013F0B0000-0x000000013F404000-memory.dmp xmrig behavioral1/memory/2512-1085-0x000000013F500000-0x000000013F854000-memory.dmp xmrig behavioral1/memory/2592-1084-0x000000013F4F0000-0x000000013F844000-memory.dmp xmrig behavioral1/memory/2800-1082-0x000000013FA70000-0x000000013FDC4000-memory.dmp xmrig behavioral1/memory/1728-1087-0x000000013F1F0000-0x000000013F544000-memory.dmp xmrig -
Executes dropped EXE 64 IoCs
pid Process 2108 MuTGzth.exe 1828 HVOxFsL.exe 2328 kHiyUNQ.exe 2732 RYMgPMy.exe 2592 YeBEiFe.exe 2684 tzblLRq.exe 2848 uEFpmXq.exe 2800 yqNMDYq.exe 2612 HuPjoai.exe 2512 SrqXrfe.exe 1728 QOeAQcI.exe 2936 fHImTwM.exe 1668 NwPojAg.exe 1504 PQkwGAB.exe 2568 qNZPQUl.exe 1620 ycwtIjA.exe 2828 LMaGNHV.exe 1008 uiUZaHE.exe 308 eCKagnq.exe 2416 idCuyon.exe 2436 CziooOV.exe 304 RXPzrEk.exe 1312 yLLanYd.exe 836 kOeuOnQ.exe 2332 RWNITOO.exe 2324 DqgEQRW.exe 2804 FIzckJP.exe 2268 klECwJG.exe 2812 FgNTZTb.exe 320 PxZCEKK.exe 572 xsFlSkz.exe 1624 rBQdlCl.exe 2356 JhKUDwE.exe 844 AbQlfRi.exe 2808 pxETBiN.exe 2460 mpKGvmy.exe 2372 qctiOvD.exe 1136 oYmWlvf.exe 3024 ByfoTxc.exe 1676 XpiznEI.exe 1032 wPYPpfx.exe 1532 hWoGFHv.exe 948 HAhApEH.exe 976 ChUAPcB.exe 568 iBiHWOr.exe 756 JffVolO.exe 820 urgbUaN.exe 1944 JXpTTgy.exe 2296 vyXWbEs.exe 2892 SStDBRQ.exe 2020 twJURcP.exe 2736 IPERgEA.exe 2980 wrukgFS.exe 1984 AWICrcY.exe 880 IrouTev.exe 2420 DbDLgzC.exe 2888 HXCHpZD.exe 1456 OrEaWNh.exe 1696 scXDAGy.exe 2100 krcrtQM.exe 2640 orUxOpP.exe 2628 ZKvDJHq.exe 2384 sWhXJvO.exe 1724 wXZegFD.exe -
Loads dropped DLL 64 IoCs
pid Process 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe -
resource yara_rule behavioral1/memory/2236-0-0x000000013FD60000-0x00000001400B4000-memory.dmp upx behavioral1/files/0x000e000000012122-3.dat upx behavioral1/files/0x0038000000015d28-11.dat upx behavioral1/files/0x0009000000015d7f-10.dat upx behavioral1/files/0x0007000000015ff4-28.dat upx behavioral1/memory/2848-50-0x000000013F180000-0x000000013F4D4000-memory.dmp upx behavioral1/files/0x0006000000016d4e-66.dat upx behavioral1/memory/2512-70-0x000000013F500000-0x000000013F854000-memory.dmp upx behavioral1/files/0x0006000000016d65-81.dat upx behavioral1/files/0x0014000000018669-147.dat upx behavioral1/memory/2800-1071-0x000000013FA70000-0x000000013FDC4000-memory.dmp upx behavioral1/memory/2612-1072-0x000000013F0B0000-0x000000013F404000-memory.dmp upx behavioral1/memory/2848-749-0x000000013F180000-0x000000013F4D4000-memory.dmp upx behavioral1/files/0x0005000000018787-188.dat upx behavioral1/files/0x000500000001873f-183.dat upx behavioral1/files/0x0005000000018739-178.dat upx behavioral1/files/0x00050000000186ff-173.dat upx behavioral1/files/0x00050000000186f1-168.dat upx behavioral1/files/0x00050000000186e6-163.dat upx behavioral1/files/0x0005000000018686-158.dat upx behavioral1/files/0x001100000001867a-153.dat upx behavioral1/files/0x0006000000018663-144.dat upx behavioral1/files/0x0006000000017486-133.dat upx behavioral1/files/0x0006000000017495-137.dat upx behavioral1/files/0x0006000000017042-123.dat upx behavioral1/files/0x0006000000017477-128.dat upx behavioral1/files/0x0006000000016de7-113.dat upx behavioral1/files/0x0006000000016eb9-118.dat upx behavioral1/files/0x0006000000016dde-108.dat upx behavioral1/files/0x0006000000016dda-102.dat upx behavioral1/memory/1668-92-0x000000013F570000-0x000000013F8C4000-memory.dmp upx behavioral1/memory/1504-99-0x000000013F3F0000-0x000000013F744000-memory.dmp upx behavioral1/memory/2108-91-0x000000013F930000-0x000000013FC84000-memory.dmp upx behavioral1/files/0x0006000000016d69-88.dat upx behavioral1/files/0x0006000000016d71-95.dat upx behavioral1/memory/2936-84-0x000000013F410000-0x000000013F764000-memory.dmp upx behavioral1/memory/1728-78-0x000000013F1F0000-0x000000013F544000-memory.dmp upx behavioral1/memory/2236-77-0x000000013FD60000-0x00000001400B4000-memory.dmp upx behavioral1/files/0x0006000000016d61-74.dat upx behavioral1/memory/2612-63-0x000000013F0B0000-0x000000013F404000-memory.dmp upx behavioral1/files/0x00090000000165a8-61.dat upx behavioral1/memory/2800-56-0x000000013FA70000-0x000000013FDC4000-memory.dmp upx behavioral1/memory/2684-49-0x000000013F500000-0x000000013F854000-memory.dmp upx behavioral1/files/0x0008000000016310-54.dat upx behavioral1/files/0x0007000000016103-47.dat upx behavioral1/files/0x0007000000015f71-46.dat upx behavioral1/memory/2592-45-0x000000013F4F0000-0x000000013F844000-memory.dmp upx behavioral1/memory/2732-44-0x000000013F5D0000-0x000000013F924000-memory.dmp upx behavioral1/memory/2328-39-0x000000013FF10000-0x0000000140264000-memory.dmp upx behavioral1/files/0x0008000000015e5b-27.dat upx behavioral1/memory/1828-22-0x000000013F970000-0x000000013FCC4000-memory.dmp upx behavioral1/memory/2108-13-0x000000013F930000-0x000000013FC84000-memory.dmp upx behavioral1/memory/2936-1074-0x000000013F410000-0x000000013F764000-memory.dmp upx behavioral1/memory/2108-1077-0x000000013F930000-0x000000013FC84000-memory.dmp upx behavioral1/memory/1828-1078-0x000000013F970000-0x000000013FCC4000-memory.dmp upx behavioral1/memory/2328-1079-0x000000013FF10000-0x0000000140264000-memory.dmp upx behavioral1/memory/2848-1083-0x000000013F180000-0x000000013F4D4000-memory.dmp upx behavioral1/memory/2612-1086-0x000000013F0B0000-0x000000013F404000-memory.dmp upx behavioral1/memory/2512-1085-0x000000013F500000-0x000000013F854000-memory.dmp upx behavioral1/memory/2592-1084-0x000000013F4F0000-0x000000013F844000-memory.dmp upx behavioral1/memory/2800-1082-0x000000013FA70000-0x000000013FDC4000-memory.dmp upx behavioral1/memory/1728-1087-0x000000013F1F0000-0x000000013F544000-memory.dmp upx behavioral1/memory/2684-1081-0x000000013F500000-0x000000013F854000-memory.dmp upx behavioral1/memory/2732-1080-0x000000013F5D0000-0x000000013F924000-memory.dmp upx -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\System\ipqKlcL.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\xlDYpel.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\IpKKkPW.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\hYGTeIx.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\JhKUDwE.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\ChUAPcB.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\Ixixvjj.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\XukMYkF.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\sXvrlOD.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\oetZIsy.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\JKJoXOB.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\BMddnZW.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\BwRsOui.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\kHiyUNQ.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\wrukgFS.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\doiNEdl.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\sExdWFq.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\oLtmhUz.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\orUxOpP.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\BEaFliA.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\FeXGzaU.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\trTgCun.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\xsFlSkz.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\glAPhyj.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\EDdYnxb.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\zosUsJW.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\TSmWSMP.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\NtwkLoS.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\rrbdVLh.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\MuTGzth.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\RYMgPMy.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\RLnyHts.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\qrDbGuR.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\DxrMuXH.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\FObMhUn.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\RtyfHAe.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\ujdotcL.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\cNNoBUl.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\binJebv.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\XYDzSaH.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\DIsMkrB.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\YPztmkh.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\djNFzmO.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\fzLkdtw.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\fcXaCxV.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\ZVLUNPT.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\vvIkpSN.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\HVrrlAD.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\aetDxdZ.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\TgLnOyb.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\idCuyon.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\FgNTZTb.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\tcmmgvt.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\VbUvxDE.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\EvgvCAU.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\BtpyZdR.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\hWoGFHv.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\IrouTev.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\fmmskee.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\PwBjXUB.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\PzoIwut.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\wYjSCtz.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\QPHijEd.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe File created C:\Windows\System\ubXEkIn.exe b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe Token: SeLockMemoryPrivilege 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2108 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 29 PID 2236 wrote to memory of 2108 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 29 PID 2236 wrote to memory of 2108 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 29 PID 2236 wrote to memory of 1828 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 30 PID 2236 wrote to memory of 1828 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 30 PID 2236 wrote to memory of 1828 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 30 PID 2236 wrote to memory of 2592 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 31 PID 2236 wrote to memory of 2592 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 31 PID 2236 wrote to memory of 2592 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 31 PID 2236 wrote to memory of 2328 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 32 PID 2236 wrote to memory of 2328 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 32 PID 2236 wrote to memory of 2328 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 32 PID 2236 wrote to memory of 2684 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 33 PID 2236 wrote to memory of 2684 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 33 PID 2236 wrote to memory of 2684 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 33 PID 2236 wrote to memory of 2732 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 34 PID 2236 wrote to memory of 2732 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 34 PID 2236 wrote to memory of 2732 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 34 PID 2236 wrote to memory of 2848 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 35 PID 2236 wrote to memory of 2848 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 35 PID 2236 wrote to memory of 2848 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 35 PID 2236 wrote to memory of 2800 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 36 PID 2236 wrote to memory of 2800 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 36 PID 2236 wrote to memory of 2800 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 36 PID 2236 wrote to memory of 2612 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 37 PID 2236 wrote to memory of 2612 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 37 PID 2236 wrote to memory of 2612 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 37 PID 2236 wrote to memory of 2512 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 38 PID 2236 wrote to memory of 2512 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 38 PID 2236 wrote to memory of 2512 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 38 PID 2236 wrote to memory of 1728 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 39 PID 2236 wrote to memory of 1728 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 39 PID 2236 wrote to memory of 1728 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 39 PID 2236 wrote to memory of 2936 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 40 PID 2236 wrote to memory of 2936 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 40 PID 2236 wrote to memory of 2936 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 40 PID 2236 wrote to memory of 1668 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 41 PID 2236 wrote to memory of 1668 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 41 PID 2236 wrote to memory of 1668 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 41 PID 2236 wrote to memory of 1504 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 42 PID 2236 wrote to memory of 1504 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 42 PID 2236 wrote to memory of 1504 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 42 PID 2236 wrote to memory of 2568 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 43 PID 2236 wrote to memory of 2568 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 43 PID 2236 wrote to memory of 2568 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 43 PID 2236 wrote to memory of 1620 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 44 PID 2236 wrote to memory of 1620 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 44 PID 2236 wrote to memory of 1620 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 44 PID 2236 wrote to memory of 2828 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 45 PID 2236 wrote to memory of 2828 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 45 PID 2236 wrote to memory of 2828 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 45 PID 2236 wrote to memory of 1008 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 46 PID 2236 wrote to memory of 1008 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 46 PID 2236 wrote to memory of 1008 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 46 PID 2236 wrote to memory of 308 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 47 PID 2236 wrote to memory of 308 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 47 PID 2236 wrote to memory of 308 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 47 PID 2236 wrote to memory of 2416 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 48 PID 2236 wrote to memory of 2416 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 48 PID 2236 wrote to memory of 2416 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 48 PID 2236 wrote to memory of 2436 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 49 PID 2236 wrote to memory of 2436 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 49 PID 2236 wrote to memory of 2436 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 49 PID 2236 wrote to memory of 304 2236 b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe 50
Processes
-
C:\Users\Admin\AppData\Local\Temp\b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b37e80049bc7a77f374e5ff7fa3c8990_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\System\MuTGzth.exeC:\Windows\System\MuTGzth.exe2⤵
- Executes dropped EXE
PID:2108
-
-
C:\Windows\System\HVOxFsL.exeC:\Windows\System\HVOxFsL.exe2⤵
- Executes dropped EXE
PID:1828
-
-
C:\Windows\System\YeBEiFe.exeC:\Windows\System\YeBEiFe.exe2⤵
- Executes dropped EXE
PID:2592
-
-
C:\Windows\System\kHiyUNQ.exeC:\Windows\System\kHiyUNQ.exe2⤵
- Executes dropped EXE
PID:2328
-
-
C:\Windows\System\tzblLRq.exeC:\Windows\System\tzblLRq.exe2⤵
- Executes dropped EXE
PID:2684
-
-
C:\Windows\System\RYMgPMy.exeC:\Windows\System\RYMgPMy.exe2⤵
- Executes dropped EXE
PID:2732
-
-
C:\Windows\System\uEFpmXq.exeC:\Windows\System\uEFpmXq.exe2⤵
- Executes dropped EXE
PID:2848
-
-
C:\Windows\System\yqNMDYq.exeC:\Windows\System\yqNMDYq.exe2⤵
- Executes dropped EXE
PID:2800
-
-
C:\Windows\System\HuPjoai.exeC:\Windows\System\HuPjoai.exe2⤵
- Executes dropped EXE
PID:2612
-
-
C:\Windows\System\SrqXrfe.exeC:\Windows\System\SrqXrfe.exe2⤵
- Executes dropped EXE
PID:2512
-
-
C:\Windows\System\QOeAQcI.exeC:\Windows\System\QOeAQcI.exe2⤵
- Executes dropped EXE
PID:1728
-
-
C:\Windows\System\fHImTwM.exeC:\Windows\System\fHImTwM.exe2⤵
- Executes dropped EXE
PID:2936
-
-
C:\Windows\System\NwPojAg.exeC:\Windows\System\NwPojAg.exe2⤵
- Executes dropped EXE
PID:1668
-
-
C:\Windows\System\PQkwGAB.exeC:\Windows\System\PQkwGAB.exe2⤵
- Executes dropped EXE
PID:1504
-
-
C:\Windows\System\qNZPQUl.exeC:\Windows\System\qNZPQUl.exe2⤵
- Executes dropped EXE
PID:2568
-
-
C:\Windows\System\ycwtIjA.exeC:\Windows\System\ycwtIjA.exe2⤵
- Executes dropped EXE
PID:1620
-
-
C:\Windows\System\LMaGNHV.exeC:\Windows\System\LMaGNHV.exe2⤵
- Executes dropped EXE
PID:2828
-
-
C:\Windows\System\uiUZaHE.exeC:\Windows\System\uiUZaHE.exe2⤵
- Executes dropped EXE
PID:1008
-
-
C:\Windows\System\eCKagnq.exeC:\Windows\System\eCKagnq.exe2⤵
- Executes dropped EXE
PID:308
-
-
C:\Windows\System\idCuyon.exeC:\Windows\System\idCuyon.exe2⤵
- Executes dropped EXE
PID:2416
-
-
C:\Windows\System\CziooOV.exeC:\Windows\System\CziooOV.exe2⤵
- Executes dropped EXE
PID:2436
-
-
C:\Windows\System\RXPzrEk.exeC:\Windows\System\RXPzrEk.exe2⤵
- Executes dropped EXE
PID:304
-
-
C:\Windows\System\yLLanYd.exeC:\Windows\System\yLLanYd.exe2⤵
- Executes dropped EXE
PID:1312
-
-
C:\Windows\System\kOeuOnQ.exeC:\Windows\System\kOeuOnQ.exe2⤵
- Executes dropped EXE
PID:836
-
-
C:\Windows\System\RWNITOO.exeC:\Windows\System\RWNITOO.exe2⤵
- Executes dropped EXE
PID:2332
-
-
C:\Windows\System\DqgEQRW.exeC:\Windows\System\DqgEQRW.exe2⤵
- Executes dropped EXE
PID:2324
-
-
C:\Windows\System\FIzckJP.exeC:\Windows\System\FIzckJP.exe2⤵
- Executes dropped EXE
PID:2804
-
-
C:\Windows\System\klECwJG.exeC:\Windows\System\klECwJG.exe2⤵
- Executes dropped EXE
PID:2268
-
-
C:\Windows\System\FgNTZTb.exeC:\Windows\System\FgNTZTb.exe2⤵
- Executes dropped EXE
PID:2812
-
-
C:\Windows\System\PxZCEKK.exeC:\Windows\System\PxZCEKK.exe2⤵
- Executes dropped EXE
PID:320
-
-
C:\Windows\System\xsFlSkz.exeC:\Windows\System\xsFlSkz.exe2⤵
- Executes dropped EXE
PID:572
-
-
C:\Windows\System\rBQdlCl.exeC:\Windows\System\rBQdlCl.exe2⤵
- Executes dropped EXE
PID:1624
-
-
C:\Windows\System\JhKUDwE.exeC:\Windows\System\JhKUDwE.exe2⤵
- Executes dropped EXE
PID:2356
-
-
C:\Windows\System\AbQlfRi.exeC:\Windows\System\AbQlfRi.exe2⤵
- Executes dropped EXE
PID:844
-
-
C:\Windows\System\pxETBiN.exeC:\Windows\System\pxETBiN.exe2⤵
- Executes dropped EXE
PID:2808
-
-
C:\Windows\System\mpKGvmy.exeC:\Windows\System\mpKGvmy.exe2⤵
- Executes dropped EXE
PID:2460
-
-
C:\Windows\System\qctiOvD.exeC:\Windows\System\qctiOvD.exe2⤵
- Executes dropped EXE
PID:2372
-
-
C:\Windows\System\oYmWlvf.exeC:\Windows\System\oYmWlvf.exe2⤵
- Executes dropped EXE
PID:1136
-
-
C:\Windows\System\ByfoTxc.exeC:\Windows\System\ByfoTxc.exe2⤵
- Executes dropped EXE
PID:3024
-
-
C:\Windows\System\XpiznEI.exeC:\Windows\System\XpiznEI.exe2⤵
- Executes dropped EXE
PID:1676
-
-
C:\Windows\System\wPYPpfx.exeC:\Windows\System\wPYPpfx.exe2⤵
- Executes dropped EXE
PID:1032
-
-
C:\Windows\System\hWoGFHv.exeC:\Windows\System\hWoGFHv.exe2⤵
- Executes dropped EXE
PID:1532
-
-
C:\Windows\System\HAhApEH.exeC:\Windows\System\HAhApEH.exe2⤵
- Executes dropped EXE
PID:948
-
-
C:\Windows\System\ChUAPcB.exeC:\Windows\System\ChUAPcB.exe2⤵
- Executes dropped EXE
PID:976
-
-
C:\Windows\System\iBiHWOr.exeC:\Windows\System\iBiHWOr.exe2⤵
- Executes dropped EXE
PID:568
-
-
C:\Windows\System\JffVolO.exeC:\Windows\System\JffVolO.exe2⤵
- Executes dropped EXE
PID:756
-
-
C:\Windows\System\urgbUaN.exeC:\Windows\System\urgbUaN.exe2⤵
- Executes dropped EXE
PID:820
-
-
C:\Windows\System\JXpTTgy.exeC:\Windows\System\JXpTTgy.exe2⤵
- Executes dropped EXE
PID:1944
-
-
C:\Windows\System\vyXWbEs.exeC:\Windows\System\vyXWbEs.exe2⤵
- Executes dropped EXE
PID:2296
-
-
C:\Windows\System\SStDBRQ.exeC:\Windows\System\SStDBRQ.exe2⤵
- Executes dropped EXE
PID:2892
-
-
C:\Windows\System\twJURcP.exeC:\Windows\System\twJURcP.exe2⤵
- Executes dropped EXE
PID:2020
-
-
C:\Windows\System\IPERgEA.exeC:\Windows\System\IPERgEA.exe2⤵
- Executes dropped EXE
PID:2736
-
-
C:\Windows\System\wrukgFS.exeC:\Windows\System\wrukgFS.exe2⤵
- Executes dropped EXE
PID:2980
-
-
C:\Windows\System\AWICrcY.exeC:\Windows\System\AWICrcY.exe2⤵
- Executes dropped EXE
PID:1984
-
-
C:\Windows\System\IrouTev.exeC:\Windows\System\IrouTev.exe2⤵
- Executes dropped EXE
PID:880
-
-
C:\Windows\System\DbDLgzC.exeC:\Windows\System\DbDLgzC.exe2⤵
- Executes dropped EXE
PID:2420
-
-
C:\Windows\System\HXCHpZD.exeC:\Windows\System\HXCHpZD.exe2⤵
- Executes dropped EXE
PID:2888
-
-
C:\Windows\System\OrEaWNh.exeC:\Windows\System\OrEaWNh.exe2⤵
- Executes dropped EXE
PID:1456
-
-
C:\Windows\System\scXDAGy.exeC:\Windows\System\scXDAGy.exe2⤵
- Executes dropped EXE
PID:1696
-
-
C:\Windows\System\krcrtQM.exeC:\Windows\System\krcrtQM.exe2⤵
- Executes dropped EXE
PID:2100
-
-
C:\Windows\System\orUxOpP.exeC:\Windows\System\orUxOpP.exe2⤵
- Executes dropped EXE
PID:2640
-
-
C:\Windows\System\ZKvDJHq.exeC:\Windows\System\ZKvDJHq.exe2⤵
- Executes dropped EXE
PID:2628
-
-
C:\Windows\System\sWhXJvO.exeC:\Windows\System\sWhXJvO.exe2⤵
- Executes dropped EXE
PID:2384
-
-
C:\Windows\System\wXZegFD.exeC:\Windows\System\wXZegFD.exe2⤵
- Executes dropped EXE
PID:1724
-
-
C:\Windows\System\yjyGcgS.exeC:\Windows\System\yjyGcgS.exe2⤵PID:2532
-
-
C:\Windows\System\XFBSErQ.exeC:\Windows\System\XFBSErQ.exe2⤵PID:2504
-
-
C:\Windows\System\XYuPErX.exeC:\Windows\System\XYuPErX.exe2⤵PID:2552
-
-
C:\Windows\System\XTGkGAH.exeC:\Windows\System\XTGkGAH.exe2⤵PID:1580
-
-
C:\Windows\System\DlduUBp.exeC:\Windows\System\DlduUBp.exe2⤵PID:2400
-
-
C:\Windows\System\fmmskee.exeC:\Windows\System\fmmskee.exe2⤵PID:2024
-
-
C:\Windows\System\NiGPgTB.exeC:\Windows\System\NiGPgTB.exe2⤵PID:1608
-
-
C:\Windows\System\fCtVtvt.exeC:\Windows\System\fCtVtvt.exe2⤵PID:328
-
-
C:\Windows\System\doiNEdl.exeC:\Windows\System\doiNEdl.exe2⤵PID:2916
-
-
C:\Windows\System\aTzrEMu.exeC:\Windows\System\aTzrEMu.exe2⤵PID:2960
-
-
C:\Windows\System\FiRZYgz.exeC:\Windows\System\FiRZYgz.exe2⤵PID:2596
-
-
C:\Windows\System\ShYHXAM.exeC:\Windows\System\ShYHXAM.exe2⤵PID:2056
-
-
C:\Windows\System\ECdQglM.exeC:\Windows\System\ECdQglM.exe2⤵PID:2292
-
-
C:\Windows\System\oetZIsy.exeC:\Windows\System\oetZIsy.exe2⤵PID:1156
-
-
C:\Windows\System\rvKVLlb.exeC:\Windows\System\rvKVLlb.exe2⤵PID:1092
-
-
C:\Windows\System\PPMLOTT.exeC:\Windows\System\PPMLOTT.exe2⤵PID:688
-
-
C:\Windows\System\FObMhUn.exeC:\Windows\System\FObMhUn.exe2⤵PID:1804
-
-
C:\Windows\System\FMbMyAI.exeC:\Windows\System\FMbMyAI.exe2⤵PID:284
-
-
C:\Windows\System\xHqRAQo.exeC:\Windows\System\xHqRAQo.exe2⤵PID:448
-
-
C:\Windows\System\TgWjFWg.exeC:\Windows\System\TgWjFWg.exe2⤵PID:1544
-
-
C:\Windows\System\tVTyVuu.exeC:\Windows\System\tVTyVuu.exe2⤵PID:348
-
-
C:\Windows\System\UGfMqHx.exeC:\Windows\System\UGfMqHx.exe2⤵PID:1688
-
-
C:\Windows\System\BTbXcCi.exeC:\Windows\System\BTbXcCi.exe2⤵PID:2880
-
-
C:\Windows\System\DXfFxnS.exeC:\Windows\System\DXfFxnS.exe2⤵PID:2360
-
-
C:\Windows\System\binJebv.exeC:\Windows\System\binJebv.exe2⤵PID:2984
-
-
C:\Windows\System\xQevbAW.exeC:\Windows\System\xQevbAW.exe2⤵PID:396
-
-
C:\Windows\System\qCrxton.exeC:\Windows\System\qCrxton.exe2⤵PID:1268
-
-
C:\Windows\System\PdXeUDg.exeC:\Windows\System\PdXeUDg.exe2⤵PID:892
-
-
C:\Windows\System\qQshUGb.exeC:\Windows\System\qQshUGb.exe2⤵PID:3056
-
-
C:\Windows\System\xtVdCDh.exeC:\Windows\System\xtVdCDh.exe2⤵PID:1564
-
-
C:\Windows\System\NevBUCC.exeC:\Windows\System\NevBUCC.exe2⤵PID:2948
-
-
C:\Windows\System\CQYombv.exeC:\Windows\System\CQYombv.exe2⤵PID:1592
-
-
C:\Windows\System\JhCNqxg.exeC:\Windows\System\JhCNqxg.exe2⤵PID:2656
-
-
C:\Windows\System\rkRpCSv.exeC:\Windows\System\rkRpCSv.exe2⤵PID:2752
-
-
C:\Windows\System\azEYeAj.exeC:\Windows\System\azEYeAj.exe2⤵PID:2928
-
-
C:\Windows\System\rMwevKX.exeC:\Windows\System\rMwevKX.exe2⤵PID:1200
-
-
C:\Windows\System\glAPhyj.exeC:\Windows\System\glAPhyj.exe2⤵PID:2600
-
-
C:\Windows\System\RtyfHAe.exeC:\Windows\System\RtyfHAe.exe2⤵PID:1820
-
-
C:\Windows\System\rhpOmPM.exeC:\Windows\System\rhpOmPM.exe2⤵PID:2176
-
-
C:\Windows\System\ipqKlcL.exeC:\Windows\System\ipqKlcL.exe2⤵PID:1256
-
-
C:\Windows\System\dqvlVsd.exeC:\Windows\System\dqvlVsd.exe2⤵PID:2484
-
-
C:\Windows\System\tcmmgvt.exeC:\Windows\System\tcmmgvt.exe2⤵PID:1260
-
-
C:\Windows\System\wGRXiIF.exeC:\Windows\System\wGRXiIF.exe2⤵PID:1852
-
-
C:\Windows\System\TFMJomK.exeC:\Windows\System\TFMJomK.exe2⤵PID:3088
-
-
C:\Windows\System\rfwuXdE.exeC:\Windows\System\rfwuXdE.exe2⤵PID:3108
-
-
C:\Windows\System\OCxOvng.exeC:\Windows\System\OCxOvng.exe2⤵PID:3124
-
-
C:\Windows\System\QkWeWKr.exeC:\Windows\System\QkWeWKr.exe2⤵PID:3144
-
-
C:\Windows\System\PsyFOjg.exeC:\Windows\System\PsyFOjg.exe2⤵PID:3168
-
-
C:\Windows\System\HvZlpNo.exeC:\Windows\System\HvZlpNo.exe2⤵PID:3184
-
-
C:\Windows\System\DIrRpXc.exeC:\Windows\System\DIrRpXc.exe2⤵PID:3204
-
-
C:\Windows\System\DxsJpWd.exeC:\Windows\System\DxsJpWd.exe2⤵PID:3228
-
-
C:\Windows\System\GJKJFnV.exeC:\Windows\System\GJKJFnV.exe2⤵PID:3244
-
-
C:\Windows\System\PwBjXUB.exeC:\Windows\System\PwBjXUB.exe2⤵PID:3268
-
-
C:\Windows\System\UEyGczP.exeC:\Windows\System\UEyGczP.exe2⤵PID:3284
-
-
C:\Windows\System\TkhipOY.exeC:\Windows\System\TkhipOY.exe2⤵PID:3308
-
-
C:\Windows\System\tEPkWJI.exeC:\Windows\System\tEPkWJI.exe2⤵PID:3328
-
-
C:\Windows\System\trkTAgd.exeC:\Windows\System\trkTAgd.exe2⤵PID:3348
-
-
C:\Windows\System\NrTVLww.exeC:\Windows\System\NrTVLww.exe2⤵PID:3368
-
-
C:\Windows\System\hAcJDAY.exeC:\Windows\System\hAcJDAY.exe2⤵PID:3388
-
-
C:\Windows\System\qUHiqQD.exeC:\Windows\System\qUHiqQD.exe2⤵PID:3404
-
-
C:\Windows\System\ASOWYiK.exeC:\Windows\System\ASOWYiK.exe2⤵PID:3428
-
-
C:\Windows\System\SvkznrO.exeC:\Windows\System\SvkznrO.exe2⤵PID:3444
-
-
C:\Windows\System\JzWQlBJ.exeC:\Windows\System\JzWQlBJ.exe2⤵PID:3468
-
-
C:\Windows\System\fYRynZr.exeC:\Windows\System\fYRynZr.exe2⤵PID:3488
-
-
C:\Windows\System\HqQSepx.exeC:\Windows\System\HqQSepx.exe2⤵PID:3508
-
-
C:\Windows\System\VyeFjmp.exeC:\Windows\System\VyeFjmp.exe2⤵PID:3524
-
-
C:\Windows\System\PrqSBGo.exeC:\Windows\System\PrqSBGo.exe2⤵PID:3548
-
-
C:\Windows\System\dtulCDY.exeC:\Windows\System\dtulCDY.exe2⤵PID:3568
-
-
C:\Windows\System\FkBlBvX.exeC:\Windows\System\FkBlBvX.exe2⤵PID:3588
-
-
C:\Windows\System\VbUvxDE.exeC:\Windows\System\VbUvxDE.exe2⤵PID:3608
-
-
C:\Windows\System\PzoIwut.exeC:\Windows\System\PzoIwut.exe2⤵PID:3628
-
-
C:\Windows\System\EvgvCAU.exeC:\Windows\System\EvgvCAU.exe2⤵PID:3648
-
-
C:\Windows\System\KAKWpZm.exeC:\Windows\System\KAKWpZm.exe2⤵PID:3668
-
-
C:\Windows\System\ujdotcL.exeC:\Windows\System\ujdotcL.exe2⤵PID:3684
-
-
C:\Windows\System\gReZKDv.exeC:\Windows\System\gReZKDv.exe2⤵PID:3708
-
-
C:\Windows\System\fuEjxcj.exeC:\Windows\System\fuEjxcj.exe2⤵PID:3724
-
-
C:\Windows\System\IJGhxxR.exeC:\Windows\System\IJGhxxR.exe2⤵PID:3748
-
-
C:\Windows\System\QTXpQwd.exeC:\Windows\System\QTXpQwd.exe2⤵PID:3768
-
-
C:\Windows\System\uDauPug.exeC:\Windows\System\uDauPug.exe2⤵PID:3788
-
-
C:\Windows\System\NWiCfKX.exeC:\Windows\System\NWiCfKX.exe2⤵PID:3804
-
-
C:\Windows\System\VCrBFVj.exeC:\Windows\System\VCrBFVj.exe2⤵PID:3828
-
-
C:\Windows\System\xqxGZwR.exeC:\Windows\System\xqxGZwR.exe2⤵PID:3844
-
-
C:\Windows\System\FpQxoTC.exeC:\Windows\System\FpQxoTC.exe2⤵PID:3868
-
-
C:\Windows\System\bhyJBBD.exeC:\Windows\System\bhyJBBD.exe2⤵PID:3888
-
-
C:\Windows\System\AsPGNNa.exeC:\Windows\System\AsPGNNa.exe2⤵PID:3904
-
-
C:\Windows\System\xvXulaX.exeC:\Windows\System\xvXulaX.exe2⤵PID:3928
-
-
C:\Windows\System\QqYEvcM.exeC:\Windows\System\QqYEvcM.exe2⤵PID:3948
-
-
C:\Windows\System\jtypHDM.exeC:\Windows\System\jtypHDM.exe2⤵PID:3964
-
-
C:\Windows\System\sExdWFq.exeC:\Windows\System\sExdWFq.exe2⤵PID:3984
-
-
C:\Windows\System\deeIVXe.exeC:\Windows\System\deeIVXe.exe2⤵PID:4008
-
-
C:\Windows\System\LEWDJmv.exeC:\Windows\System\LEWDJmv.exe2⤵PID:4028
-
-
C:\Windows\System\BEaFliA.exeC:\Windows\System\BEaFliA.exe2⤵PID:4044
-
-
C:\Windows\System\BrVFqIK.exeC:\Windows\System\BrVFqIK.exe2⤵PID:4068
-
-
C:\Windows\System\CHaEgiN.exeC:\Windows\System\CHaEgiN.exe2⤵PID:4084
-
-
C:\Windows\System\EDdYnxb.exeC:\Windows\System\EDdYnxb.exe2⤵PID:1796
-
-
C:\Windows\System\RfthreF.exeC:\Windows\System\RfthreF.exe2⤵PID:2192
-
-
C:\Windows\System\DsXPXdW.exeC:\Windows\System\DsXPXdW.exe2⤵PID:2204
-
-
C:\Windows\System\wVxLkiA.exeC:\Windows\System\wVxLkiA.exe2⤵PID:352
-
-
C:\Windows\System\RLnyHts.exeC:\Windows\System\RLnyHts.exe2⤵PID:780
-
-
C:\Windows\System\LWKNpNn.exeC:\Windows\System\LWKNpNn.exe2⤵PID:908
-
-
C:\Windows\System\rexnLzI.exeC:\Windows\System\rexnLzI.exe2⤵PID:2840
-
-
C:\Windows\System\Ixixvjj.exeC:\Windows\System\Ixixvjj.exe2⤵PID:2448
-
-
C:\Windows\System\gIPHuRW.exeC:\Windows\System\gIPHuRW.exe2⤵PID:1028
-
-
C:\Windows\System\eiXLeja.exeC:\Windows\System\eiXLeja.exe2⤵PID:2264
-
-
C:\Windows\System\SUCWeOA.exeC:\Windows\System\SUCWeOA.exe2⤵PID:2820
-
-
C:\Windows\System\iXykyaf.exeC:\Windows\System\iXykyaf.exe2⤵PID:2744
-
-
C:\Windows\System\XYDzSaH.exeC:\Windows\System\XYDzSaH.exe2⤵PID:2940
-
-
C:\Windows\System\hvwOWhi.exeC:\Windows\System\hvwOWhi.exe2⤵PID:2180
-
-
C:\Windows\System\FeXGzaU.exeC:\Windows\System\FeXGzaU.exe2⤵PID:1328
-
-
C:\Windows\System\yIPyHaQ.exeC:\Windows\System\yIPyHaQ.exe2⤵PID:2308
-
-
C:\Windows\System\RTBBlIX.exeC:\Windows\System\RTBBlIX.exe2⤵PID:636
-
-
C:\Windows\System\BtpyZdR.exeC:\Windows\System\BtpyZdR.exe2⤵PID:3076
-
-
C:\Windows\System\piIAsbz.exeC:\Windows\System\piIAsbz.exe2⤵PID:3120
-
-
C:\Windows\System\aysiTMJ.exeC:\Windows\System\aysiTMJ.exe2⤵PID:3224
-
-
C:\Windows\System\uARUAng.exeC:\Windows\System\uARUAng.exe2⤵PID:3196
-
-
C:\Windows\System\UmRIfOD.exeC:\Windows\System\UmRIfOD.exe2⤵PID:3240
-
-
C:\Windows\System\IJtcgef.exeC:\Windows\System\IJtcgef.exe2⤵PID:3292
-
-
C:\Windows\System\TAwRaeF.exeC:\Windows\System\TAwRaeF.exe2⤵PID:3336
-
-
C:\Windows\System\hwhvEuo.exeC:\Windows\System\hwhvEuo.exe2⤵PID:3320
-
-
C:\Windows\System\XCtooVH.exeC:\Windows\System\XCtooVH.exe2⤵PID:3364
-
-
C:\Windows\System\GbuTxYF.exeC:\Windows\System\GbuTxYF.exe2⤵PID:3420
-
-
C:\Windows\System\NEgObBe.exeC:\Windows\System\NEgObBe.exe2⤵PID:3396
-
-
C:\Windows\System\zosUsJW.exeC:\Windows\System\zosUsJW.exe2⤵PID:3476
-
-
C:\Windows\System\gZHGXQU.exeC:\Windows\System\gZHGXQU.exe2⤵PID:3532
-
-
C:\Windows\System\FjGwxta.exeC:\Windows\System\FjGwxta.exe2⤵PID:3520
-
-
C:\Windows\System\XyouKgP.exeC:\Windows\System\XyouKgP.exe2⤵PID:3580
-
-
C:\Windows\System\mHqxikx.exeC:\Windows\System\mHqxikx.exe2⤵PID:3560
-
-
C:\Windows\System\POkkWjP.exeC:\Windows\System\POkkWjP.exe2⤵PID:3660
-
-
C:\Windows\System\HIqdlin.exeC:\Windows\System\HIqdlin.exe2⤵PID:3644
-
-
C:\Windows\System\gEhusyW.exeC:\Windows\System\gEhusyW.exe2⤵PID:3680
-
-
C:\Windows\System\AmrEZNl.exeC:\Windows\System\AmrEZNl.exe2⤵PID:3744
-
-
C:\Windows\System\TSmWSMP.exeC:\Windows\System\TSmWSMP.exe2⤵PID:3764
-
-
C:\Windows\System\RPnNMzO.exeC:\Windows\System\RPnNMzO.exe2⤵PID:3824
-
-
C:\Windows\System\CWuHXCA.exeC:\Windows\System\CWuHXCA.exe2⤵PID:3800
-
-
C:\Windows\System\MnRqwfc.exeC:\Windows\System\MnRqwfc.exe2⤵PID:3840
-
-
C:\Windows\System\HooKLMA.exeC:\Windows\System\HooKLMA.exe2⤵PID:3884
-
-
C:\Windows\System\BIxLDdi.exeC:\Windows\System\BIxLDdi.exe2⤵PID:3920
-
-
C:\Windows\System\IwSGQiL.exeC:\Windows\System\IwSGQiL.exe2⤵PID:3976
-
-
C:\Windows\System\XuqeYoz.exeC:\Windows\System\XuqeYoz.exe2⤵PID:4000
-
-
C:\Windows\System\MClwkRD.exeC:\Windows\System\MClwkRD.exe2⤵PID:4056
-
-
C:\Windows\System\pMwgVUx.exeC:\Windows\System\pMwgVUx.exe2⤵PID:1704
-
-
C:\Windows\System\LeZQYYO.exeC:\Windows\System\LeZQYYO.exe2⤵PID:4076
-
-
C:\Windows\System\hVCjxoD.exeC:\Windows\System\hVCjxoD.exe2⤵PID:2140
-
-
C:\Windows\System\IheDjnL.exeC:\Windows\System\IheDjnL.exe2⤵PID:580
-
-
C:\Windows\System\tNzmyvB.exeC:\Windows\System\tNzmyvB.exe2⤵PID:108
-
-
C:\Windows\System\uZcVXvp.exeC:\Windows\System\uZcVXvp.exe2⤵PID:2196
-
-
C:\Windows\System\KQYLLxt.exeC:\Windows\System\KQYLLxt.exe2⤵PID:2668
-
-
C:\Windows\System\KcCeVoN.exeC:\Windows\System\KcCeVoN.exe2⤵PID:1292
-
-
C:\Windows\System\NUQwgmL.exeC:\Windows\System\NUQwgmL.exe2⤵PID:1916
-
-
C:\Windows\System\CLTbeZI.exeC:\Windows\System\CLTbeZI.exe2⤵PID:2476
-
-
C:\Windows\System\mPpcDyY.exeC:\Windows\System\mPpcDyY.exe2⤵PID:3100
-
-
C:\Windows\System\MjPnIcH.exeC:\Windows\System\MjPnIcH.exe2⤵PID:3116
-
-
C:\Windows\System\RwXxsLj.exeC:\Windows\System\RwXxsLj.exe2⤵PID:3176
-
-
C:\Windows\System\OFJOrMn.exeC:\Windows\System\OFJOrMn.exe2⤵PID:3256
-
-
C:\Windows\System\meXANeP.exeC:\Windows\System\meXANeP.exe2⤵PID:3212
-
-
C:\Windows\System\zySgjFe.exeC:\Windows\System\zySgjFe.exe2⤵PID:3304
-
-
C:\Windows\System\QkoOSwJ.exeC:\Windows\System\QkoOSwJ.exe2⤵PID:3416
-
-
C:\Windows\System\WgPHAFs.exeC:\Windows\System\WgPHAFs.exe2⤵PID:3452
-
-
C:\Windows\System\PWkPfDX.exeC:\Windows\System\PWkPfDX.exe2⤵PID:3540
-
-
C:\Windows\System\ynNXzkH.exeC:\Windows\System\ynNXzkH.exe2⤵PID:3544
-
-
C:\Windows\System\ZVLUNPT.exeC:\Windows\System\ZVLUNPT.exe2⤵PID:3620
-
-
C:\Windows\System\ZfPaxYW.exeC:\Windows\System\ZfPaxYW.exe2⤵PID:3696
-
-
C:\Windows\System\sLQviVt.exeC:\Windows\System\sLQviVt.exe2⤵PID:3600
-
-
C:\Windows\System\GeMYQuO.exeC:\Windows\System\GeMYQuO.exe2⤵PID:3776
-
-
C:\Windows\System\DIsMkrB.exeC:\Windows\System\DIsMkrB.exe2⤵PID:3812
-
-
C:\Windows\System\ynGVcVW.exeC:\Windows\System\ynGVcVW.exe2⤵PID:3856
-
-
C:\Windows\System\NtwkLoS.exeC:\Windows\System\NtwkLoS.exe2⤵PID:3924
-
-
C:\Windows\System\YPztmkh.exeC:\Windows\System\YPztmkh.exe2⤵PID:2712
-
-
C:\Windows\System\VspyVVY.exeC:\Windows\System\VspyVVY.exe2⤵PID:4020
-
-
C:\Windows\System\gmYPvoy.exeC:\Windows\System\gmYPvoy.exe2⤵PID:4052
-
-
C:\Windows\System\rrbdVLh.exeC:\Windows\System\rrbdVLh.exe2⤵PID:808
-
-
C:\Windows\System\pMVaCwD.exeC:\Windows\System\pMVaCwD.exe2⤵PID:2132
-
-
C:\Windows\System\JKJoXOB.exeC:\Windows\System\JKJoXOB.exe2⤵PID:608
-
-
C:\Windows\System\BMddnZW.exeC:\Windows\System\BMddnZW.exe2⤵PID:1788
-
-
C:\Windows\System\xlDYpel.exeC:\Windows\System\xlDYpel.exe2⤵PID:1448
-
-
C:\Windows\System\trTgCun.exeC:\Windows\System\trTgCun.exe2⤵PID:484
-
-
C:\Windows\System\bAOfcKV.exeC:\Windows\System\bAOfcKV.exe2⤵PID:2344
-
-
C:\Windows\System\ltqcdEh.exeC:\Windows\System\ltqcdEh.exe2⤵PID:3164
-
-
C:\Windows\System\djNFzmO.exeC:\Windows\System\djNFzmO.exe2⤵PID:3236
-
-
C:\Windows\System\FpfWrRs.exeC:\Windows\System\FpfWrRs.exe2⤵PID:4112
-
-
C:\Windows\System\tzoPJXq.exeC:\Windows\System\tzoPJXq.exe2⤵PID:4132
-
-
C:\Windows\System\BDSXBCJ.exeC:\Windows\System\BDSXBCJ.exe2⤵PID:4148
-
-
C:\Windows\System\KHyrtnC.exeC:\Windows\System\KHyrtnC.exe2⤵PID:4172
-
-
C:\Windows\System\DkREVkN.exeC:\Windows\System\DkREVkN.exe2⤵PID:4192
-
-
C:\Windows\System\etgOfhj.exeC:\Windows\System\etgOfhj.exe2⤵PID:4212
-
-
C:\Windows\System\nNERiRN.exeC:\Windows\System\nNERiRN.exe2⤵PID:4228
-
-
C:\Windows\System\aFGGxsc.exeC:\Windows\System\aFGGxsc.exe2⤵PID:4248
-
-
C:\Windows\System\ZDqlKWs.exeC:\Windows\System\ZDqlKWs.exe2⤵PID:4264
-
-
C:\Windows\System\vvIkpSN.exeC:\Windows\System\vvIkpSN.exe2⤵PID:4284
-
-
C:\Windows\System\vodwuxj.exeC:\Windows\System\vodwuxj.exe2⤵PID:4300
-
-
C:\Windows\System\OiDeQPw.exeC:\Windows\System\OiDeQPw.exe2⤵PID:4316
-
-
C:\Windows\System\UIxvXcD.exeC:\Windows\System\UIxvXcD.exe2⤵PID:4340
-
-
C:\Windows\System\iFdYFHP.exeC:\Windows\System\iFdYFHP.exe2⤵PID:4364
-
-
C:\Windows\System\veaoleM.exeC:\Windows\System\veaoleM.exe2⤵PID:4380
-
-
C:\Windows\System\arbjQWf.exeC:\Windows\System\arbjQWf.exe2⤵PID:4400
-
-
C:\Windows\System\jGTDkUk.exeC:\Windows\System\jGTDkUk.exe2⤵PID:4416
-
-
C:\Windows\System\qrDbGuR.exeC:\Windows\System\qrDbGuR.exe2⤵PID:4440
-
-
C:\Windows\System\VAgpfVP.exeC:\Windows\System\VAgpfVP.exe2⤵PID:4460
-
-
C:\Windows\System\gBTXOIC.exeC:\Windows\System\gBTXOIC.exe2⤵PID:4480
-
-
C:\Windows\System\DxrMuXH.exeC:\Windows\System\DxrMuXH.exe2⤵PID:4500
-
-
C:\Windows\System\EJUHWeA.exeC:\Windows\System\EJUHWeA.exe2⤵PID:4520
-
-
C:\Windows\System\WZGqjXo.exeC:\Windows\System\WZGqjXo.exe2⤵PID:4540
-
-
C:\Windows\System\fzLkdtw.exeC:\Windows\System\fzLkdtw.exe2⤵PID:4564
-
-
C:\Windows\System\DchXUnC.exeC:\Windows\System\DchXUnC.exe2⤵PID:4584
-
-
C:\Windows\System\DARVkhq.exeC:\Windows\System\DARVkhq.exe2⤵PID:4608
-
-
C:\Windows\System\GMnMBSO.exeC:\Windows\System\GMnMBSO.exe2⤵PID:4628
-
-
C:\Windows\System\PPfUsiI.exeC:\Windows\System\PPfUsiI.exe2⤵PID:4652
-
-
C:\Windows\System\ouQiODD.exeC:\Windows\System\ouQiODD.exe2⤵PID:4668
-
-
C:\Windows\System\keYHpSV.exeC:\Windows\System\keYHpSV.exe2⤵PID:4688
-
-
C:\Windows\System\gIyKZEN.exeC:\Windows\System\gIyKZEN.exe2⤵PID:4708
-
-
C:\Windows\System\UATmRiX.exeC:\Windows\System\UATmRiX.exe2⤵PID:4732
-
-
C:\Windows\System\QPHijEd.exeC:\Windows\System\QPHijEd.exe2⤵PID:4748
-
-
C:\Windows\System\XYoreSg.exeC:\Windows\System\XYoreSg.exe2⤵PID:4768
-
-
C:\Windows\System\JRgDbST.exeC:\Windows\System\JRgDbST.exe2⤵PID:4788
-
-
C:\Windows\System\bHaIsOv.exeC:\Windows\System\bHaIsOv.exe2⤵PID:4808
-
-
C:\Windows\System\jKCnFJB.exeC:\Windows\System\jKCnFJB.exe2⤵PID:4824
-
-
C:\Windows\System\BwRsOui.exeC:\Windows\System\BwRsOui.exe2⤵PID:4848
-
-
C:\Windows\System\MhpxArs.exeC:\Windows\System\MhpxArs.exe2⤵PID:4868
-
-
C:\Windows\System\hZlOTlE.exeC:\Windows\System\hZlOTlE.exe2⤵PID:4888
-
-
C:\Windows\System\rhRTncW.exeC:\Windows\System\rhRTncW.exe2⤵PID:4904
-
-
C:\Windows\System\oByheHd.exeC:\Windows\System\oByheHd.exe2⤵PID:4928
-
-
C:\Windows\System\VTcpgsF.exeC:\Windows\System\VTcpgsF.exe2⤵PID:4948
-
-
C:\Windows\System\AweuMTo.exeC:\Windows\System\AweuMTo.exe2⤵PID:4968
-
-
C:\Windows\System\PUjUywl.exeC:\Windows\System\PUjUywl.exe2⤵PID:4984
-
-
C:\Windows\System\edwQbIS.exeC:\Windows\System\edwQbIS.exe2⤵PID:5008
-
-
C:\Windows\System\HVrrlAD.exeC:\Windows\System\HVrrlAD.exe2⤵PID:5032
-
-
C:\Windows\System\pDWBdnX.exeC:\Windows\System\pDWBdnX.exe2⤵PID:5052
-
-
C:\Windows\System\IpKKkPW.exeC:\Windows\System\IpKKkPW.exe2⤵PID:5068
-
-
C:\Windows\System\BatvMxy.exeC:\Windows\System\BatvMxy.exe2⤵PID:5088
-
-
C:\Windows\System\wYjSCtz.exeC:\Windows\System\wYjSCtz.exe2⤵PID:5108
-
-
C:\Windows\System\VoOpdLY.exeC:\Windows\System\VoOpdLY.exe2⤵PID:3412
-
-
C:\Windows\System\ytpCdMN.exeC:\Windows\System\ytpCdMN.exe2⤵PID:3464
-
-
C:\Windows\System\oLtmhUz.exeC:\Windows\System\oLtmhUz.exe2⤵PID:3384
-
-
C:\Windows\System\XukMYkF.exeC:\Windows\System\XukMYkF.exe2⤵PID:3584
-
-
C:\Windows\System\EytkLuz.exeC:\Windows\System\EytkLuz.exe2⤵PID:3692
-
-
C:\Windows\System\cASJuUj.exeC:\Windows\System\cASJuUj.exe2⤵PID:3912
-
-
C:\Windows\System\aetDxdZ.exeC:\Windows\System\aetDxdZ.exe2⤵PID:596
-
-
C:\Windows\System\DkDYNQm.exeC:\Windows\System\DkDYNQm.exe2⤵PID:3700
-
-
C:\Windows\System\RqqrqpR.exeC:\Windows\System\RqqrqpR.exe2⤵PID:2636
-
-
C:\Windows\System\aWODrZS.exeC:\Windows\System\aWODrZS.exe2⤵PID:3944
-
-
C:\Windows\System\flhmllQ.exeC:\Windows\System\flhmllQ.exe2⤵PID:4024
-
-
C:\Windows\System\Cxzfyuu.exeC:\Windows\System\Cxzfyuu.exe2⤵PID:2392
-
-
C:\Windows\System\mHGfcQZ.exeC:\Windows\System\mHGfcQZ.exe2⤵PID:3156
-
-
C:\Windows\System\prxVHST.exeC:\Windows\System\prxVHST.exe2⤵PID:1736
-
-
C:\Windows\System\wmhTVOJ.exeC:\Windows\System\wmhTVOJ.exe2⤵PID:4164
-
-
C:\Windows\System\GBMGVHa.exeC:\Windows\System\GBMGVHa.exe2⤵PID:4208
-
-
C:\Windows\System\fcXaCxV.exeC:\Windows\System\fcXaCxV.exe2⤵PID:3096
-
-
C:\Windows\System\sXvrlOD.exeC:\Windows\System\sXvrlOD.exe2⤵PID:4100
-
-
C:\Windows\System\hdjRSKv.exeC:\Windows\System\hdjRSKv.exe2⤵PID:4140
-
-
C:\Windows\System\RviegIs.exeC:\Windows\System\RviegIs.exe2⤵PID:4348
-
-
C:\Windows\System\TzmgWPO.exeC:\Windows\System\TzmgWPO.exe2⤵PID:4224
-
-
C:\Windows\System\hYGTeIx.exeC:\Windows\System\hYGTeIx.exe2⤵PID:4424
-
-
C:\Windows\System\SxIqlnF.exeC:\Windows\System\SxIqlnF.exe2⤵PID:4476
-
-
C:\Windows\System\KNjeTvB.exeC:\Windows\System\KNjeTvB.exe2⤵PID:4372
-
-
C:\Windows\System\ZTLWIzB.exeC:\Windows\System\ZTLWIzB.exe2⤵PID:4292
-
-
C:\Windows\System\ubXEkIn.exeC:\Windows\System\ubXEkIn.exe2⤵PID:4560
-
-
C:\Windows\System\pwweLis.exeC:\Windows\System\pwweLis.exe2⤵PID:4456
-
-
C:\Windows\System\cNNoBUl.exeC:\Windows\System\cNNoBUl.exe2⤵PID:4412
-
-
C:\Windows\System\VItYGts.exeC:\Windows\System\VItYGts.exe2⤵PID:4644
-
-
C:\Windows\System\TgLnOyb.exeC:\Windows\System\TgLnOyb.exe2⤵PID:4680
-
-
C:\Windows\System\cgxTUcw.exeC:\Windows\System\cgxTUcw.exe2⤵PID:4624
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD5caff83a3fc0cd60e23f8fa7fcbe27e80
SHA177b6d1c36404a4b963afe45cd0d6a91bb5a417bf
SHA256b4aa9e0b6b7a92c45386ddcab52f7d92f54c1c92edf622259c64bf1c5929751d
SHA512c601d2a9f283ec8f97b0564c9f1ef2963535283244a205b7e527d3c904a709cd2dd6f0e17bd0b27ecdd1031b6571777618564c4b58a6369111b9268b4a5718f0
-
Filesize
2.3MB
MD580b23fc046c61fa622c12a0339634648
SHA16c018244fd0466246086439dd6efee2ecb599de4
SHA2565c69a574e8804dc1e9ef2918f78e5f80b54fbb84b5345261b654cbdc1de009db
SHA512a8e2e6f3beb999fe64559489a44d93a405b91802757f26f8ce162f3d74d94efe4cbc3cf20436892ba14784c97f39d4c89798799564a5a90e43d1d967d8f47599
-
Filesize
2.3MB
MD54caeba62c09eae7f14125fb2ba5f8a86
SHA193f6e9f69233e48804bc4ac35b9160264b72fe8b
SHA2566826a3225dd5e8efd4fd52fb90a78c0e2881511dc2c72b0bf04724c9367ecabb
SHA512d5f379dd4671c1694d1f4a7e36a9751c62b2646385bbb8e6e4ba7e5161552cf95e0b734c4288963da41e980e3f3d5b42586bd3a93fa9637f606fa4595fffcacb
-
Filesize
2.3MB
MD51fbac1bad574b3cc83688d2fd9d2a9b1
SHA1255f682ccd8e93909599d8c7933cdd03956fa590
SHA2561aee417e9df34789925b890a2e2d25273eadf1790db8188ba271411db4b05557
SHA51265f948b10fca55d682bbbe5bc3be13cc9f3a42e158af3b4e1bc5d48b228d750570cb9115deb83f3c7542c044a198a21f4b77ddc9d4585b3f8e83916edce8e796
-
Filesize
2.3MB
MD5dbdc83df47ef97b0374b04e265b0eded
SHA125e41712a5cd0c9b7265ca6000c35d0cd68065a7
SHA2563af8af56478061168ae262f268ced21ac472506bc698440e7c8e45bb4495564e
SHA512808a230ca16b8cfd2a75265438538856122093698bc335812ed0c0112eac75bb12ebe6a6dd80cc8fbd0d57650b2057eec41f59df883a28735c43e734ad394dfd
-
Filesize
2.3MB
MD5e421da2c9b6e8c32a3a89f7dd8161991
SHA1b94e4bd179b09e53da2edef0383127088fa43c23
SHA256dd0578a75f246b55b1065c2bb5ad4b173f0447a375d10bf0c344a8f0bf2b1797
SHA5125a1c92ea1b05030300b90b8baa56ff7c6b90a1e068a5b1551e0732f63c2d4355c8a0def2909fa5f41a2f1ecb519b774e9e9c2ec4707ef5219f8bfabc5f28facf
-
Filesize
2.3MB
MD57e141f43b6bb9b4a6e52e144b474191e
SHA101ae684c0faa6512ff800bdf75fdd19dcf2c3aea
SHA2562a2c7f7228f42abc2f55b0b91121b16985008056cb9a36cd8f2550e8c3672e96
SHA5125fc01e770395f09f02cfc637bfc1edbab2cbf87e84a2b47681371c9f1290ae97c34bbd073fe9ff78ac6fbb520c9f9c5145ea6f49ad8d0696a2ff1e789309f8a3
-
Filesize
2.3MB
MD569e2c2cfba95c030bf40aef8cd721b75
SHA1477148a1b18d91bb0c800481de98e6a8f0072758
SHA2567c58b80d3c5b775dcbc61c2fa4a7c9337897ae75cdb2c1635b496c30c60f61b9
SHA5125f6d50015bc0afa24d8e2b906ff209e8c6de388f567ce5fc86db127d266767d2a943d5912f67d6d42778fb31533d3fabe7fd9879705bd51a85eb4cff376d8653
-
Filesize
2.3MB
MD5f6f5bce904b3d329b28a6d25888a84c1
SHA1739297c87734b56e868d14428ff495eb5443caf9
SHA2566e587aa7943dee9e5a9f35b83b4c10082661ca86e4747851dc04ea0a2e5643b3
SHA512caf97978bab6b4466ae89b35e3fa820c5d52e88a91f185f927c46283815f0447ccaf1c96ed441311a376b4c3f897cba4533b0e821ebddd30350bb491a679b135
-
Filesize
2.3MB
MD542269d1d13955985c4403c49d401953e
SHA1ef5d8c2b8dca9f380892f7059223cbb1acf1bc9e
SHA2569503227310ce69031a07d9ce519cc0ccc0d57e873f1f95231dd92cd11b343ce9
SHA512d7877262300a3d634d1b6865b4947d7c83aa5228439ab75daa84380e7f1115c09e4c3bf1859bb458f1e66e5ef7589dfb472a71f37897cafed5431affac172605
-
Filesize
2.3MB
MD561c1ca26e911cb65e688c46cf78fc898
SHA15dd471bffc3ca3a66652d719997b994b700a064d
SHA256b215469f41fa3bc48bcbb2658392204665a4c4c3ec6851a615be29216814b24c
SHA5122727c45efc8f714a09e9b5227b88f5c371c9ab54c16f2b5ea119f35ebb4659cc10cf0c9f56a6f6db38a14d0f55f8eb1c254e06ca05e72d5a45fda413093e7200
-
Filesize
2.3MB
MD5d744a119574de41da86058a8080951fc
SHA15203c03d3321f4276bf1a5e19f411c70a6dd7f2f
SHA2563f5de1981103c47287075f833914990e062016546110fd1817a169522e61176c
SHA512a060a3b6aec16b6c8898423876212fe03669654bc6e30769a98db4c443718594cc0d0db3ef1495bfb5a59dc93d22c911dd6c1bf4ba31466cc9211f0e0940d0c2
-
Filesize
2.3MB
MD542b4a8309d0c14b13227f56cc090e64a
SHA1158585b907945b90098092b385d39e00bfe8d82d
SHA256eff014d03c296ea5a444f69ca4d5662806c5cc22ecae403de8d76945c906ed41
SHA5126ede06e90c31e66f88690f33b92491aac18e6c7438d5b67ab73313895436a2cf22effe95c057852577019568d9c70fdeab39dbd79473c76a7a570f3ca226fe45
-
Filesize
2.3MB
MD53d32c385eb1a805db74ee73eb99a16b0
SHA154d485d8b9d5c9c59902a618535adc01e568e708
SHA2562488c8aaeb986d740e4728cd622d7cde15969f02bb795d8b664dd9a114ca0089
SHA512b74c7e9d4b2cdf11e2c542dafd0cd03cc1a7ca1dceb8a51bd8261a4ea4925e00abe960ba1c8e6ba34f8a7a7eabe13ccb7b58e1d4c3c4cbc8d974e445187fd7eb
-
Filesize
2.3MB
MD5851b28485788ac4571a9520780ede52e
SHA18b00bd71f66c9ab3a839fc1aaf460c0007b4846f
SHA2560e4e5e399282818510b5e134eb0992c3b3e541b8d86bc366898ba6b9e3fc4408
SHA512fbd5a0d079763a356867386bf5ff6784ce52c558ab24334e87c08c1448f0e7f9916189a353df507ec965c639df083009127d166c508cbb8b6dac2a96f748a02c
-
Filesize
2.3MB
MD5978942fe636056d7f5d7d92ac4f02484
SHA180bc61d9cb36c98c98b2260ee7a2913621dccb02
SHA256fba75b0305349cd7b42cc0b4f07ef4240fd778002d4b7dd0cb53897fd3ce2f74
SHA512a56db104b3b8cede89cb93b07157ed339e1a9e18fda826f54294e76d1b085c60caef62a1f744ddee86ad35f3b31b0e61f3a482e5a0e961d497f1bfa3c2080806
-
Filesize
2.3MB
MD5f47047b5712ca4820c1c04b6ec4e1738
SHA106f7c3a26b6a98fc7e386dee1e248460aadc3456
SHA256630e0e0e96f943b3445d15b32f279850a6fd592828df362978e4ecf712a4689a
SHA512aea13ac27346930add15b35b958bd363e32925631a01468729cb2299f9af34cfe680525ae0c3b3e47ca3f3609d9c335f21da4b0546a11f7dd1cdb9dede82d2e1
-
Filesize
2.3MB
MD543719261d9751e3367e341fab480022d
SHA1b5c939e13d31acd9811c632908d7e09a85db7ec2
SHA256ac03fc23b45f2eeb218dafbd423bb3fa168143d1e771841f163ea184c36f44f6
SHA5129b56901f97d5481133f45fbd2cd4387b5f668da61f20e1f7e0261d51bd760aff52fd9d48b8792589243a6afc7ba0ac6f32d43fe6ece3edb50fa1075cf6fc7d4d
-
Filesize
2.3MB
MD5d6126530a49ae23fbecabdf89e53bff2
SHA1853c4e8eb4ff0049edeaf8143d38020431ba6a05
SHA2561ff5e89924c53ac39075d5dab220da1b249dffea97b018d20855e8b9c7ef90e6
SHA512d905eeca381dcda3b096d95243721c2eb203d9500054bc8319ace9437459eaf60d75c35bd2a6c6abd3b37e886567dceee7dc777079d90ddc8a843d20c2e0a8c9
-
Filesize
2.3MB
MD5c7f4b7e1ad95e9413190a0c0515fd305
SHA1a6ed83a6219f7caa55241d5dccee57cfc65b33f1
SHA256b6ecfc7df822448c3f069f48e18eb37f11d3040fe2d872287d6ee4c8073221d3
SHA51299333d1bbdee92a36da6577aaaa8284b51460b3c07f86b7b6a7c65b99e8f69ccb876a8100946bbe7e6828abff53f5fe1e5ac716f3cec2f27e22b818dad63e56e
-
Filesize
2.3MB
MD5c0a2e76d6f674da2da4612f1b97b7b6a
SHA131e05344547209a7c6ace3e779c69d4443e9aa63
SHA256d9710c0bd71d431275e8408d527cda89bf83f9001d3e61059f45b313ea485601
SHA51254b157431bcc2492a2796b687fec125a476bd4e03d02793302b274c64c2f4ba8a95b8c68eb2658becd5c11111b5659083467c4ce88f1f77680df668a69916f93
-
Filesize
2.3MB
MD5f02741426595234b94a5073b8a05e933
SHA1d381c8690b5bebdf315876a3cc4cb528ea724ccb
SHA2562d50d033d2feccf10051e4d36408aec4928c3119c53597c10f8b21ff6d18854b
SHA512073aafbc08f1d6963486d4e9f26413f4d225f6ffc916095c5da5cfc0d6fc4826d53320be273cb587ee5793fb09af34436e1795dcaeca9f94b0da3cadc81b1666
-
Filesize
2.3MB
MD5fae837e12171e48b93d0a2d0a3781628
SHA190fabede13c811fa7080f79c0da398698903d3c7
SHA256d2f01ccb0f592bac16d9a07382eb1d381dbf34ce8b2663511d7019b04846f9d8
SHA512c40a3b0ee81680c9ef564f4291e5e3da6a07c4145cf6726a633ae5820d53f6c92ee17029293e7e57428bb06b2d8828252063e547045029973c8ee52369f17f3e
-
Filesize
2.3MB
MD5812d2f5dbdb6eee35bdefc6f34505866
SHA114ca3efbc524b53da77e43aaf7910e742e9e6f93
SHA25645677a1c9470adef9bd3f246ad87bf0cecf211af5f197143520cb75996f0b662
SHA51278aa46adb0926dd11afd1a4ccff2c316d675ab0cfc84a4b9cd50a9f97a8f2eaa5526714f4b9d98e27a77a4dfef3e24df3aef5acad2ba9701c3365d603e0ede36
-
Filesize
2.3MB
MD512a62ae856a301807763312b5aeb4190
SHA1ae03ca66a66017bf3fac43284589aee6dfeec6cf
SHA256b1b34463dfbb5932dcd3ea813d5492f1ca88612e034108d92ffe84dc1d562aa2
SHA5129b509ed333618861e15a1e964fb4608c8e79b90e9f9a4e88a6b3a74d4663c0e636b95ed71db858a28817c9dadf0e3e2d8713527c7d2c1ae6642c17ebb87d13b0
-
Filesize
2.3MB
MD58537839c659bc9d39d00a303824a0a98
SHA1f3445c80fb0b224a67afcca4b2bd6d38c271d623
SHA256e21b635bda0ccf1b757b08fff49bdf044694a5019f957a10753c6d96d947f5a2
SHA512ff5af2d835510ac33b3dd4c4c9db2aaea19dfd2ff6fce3d50cbebba1c64e63361995703b35c34e483f5db548c63b3af01b0637189539af9eb5d6e139bbd26f13
-
Filesize
2.3MB
MD53f6c0235fa294abfaaa9681cd17e818c
SHA11fbe48bb737d0362f240dd6640f8b8db5e19bf09
SHA256afb6d902a08a1185fad8b7b01bf824ac2266bd936d5cc27d2f0303d09807b3a6
SHA5122cc0118713c0aea22eba695936430023f7069593013aa8ec21ac7c20b0daf4a7765a265adcf0e612bb6253e42e5434ce3d8c928446a6dc8ab850742bc47f1e56
-
Filesize
2.3MB
MD5751de973f2b62b8a7aa58d46c1f458f9
SHA13f082362fef532bc5def3c7a18f0a6f95e6ce2c8
SHA2568b9458d7f11809c3c50e81db23cad57e495f9f960cac21d896d5a051ba8dd8e3
SHA512f3bdccb78685b29811abe033315181b325e2fc1fdb633414550ec2c9a4977b520452bd9f60b3c5d0a22e6e5e0b61160aa0c88dc08e6d2a6acd603363d813be84
-
Filesize
2.3MB
MD5b7192a52fff452be8e1fdc7926583454
SHA1822923db4231abb4d67397b47aa15c2507e0811f
SHA2560af1a492880f67d5d39341c729e33d9518243a4b1acffcfdfe249cba82735f96
SHA5125a5e27576e0b7d62dced86fe7b2dd881835a2977c8b9bb3c6ca496f494ef6fc79090bda7a4e61add4ea2e1ac88ff9350a40a695abe64018d77258f86e54316bf
-
Filesize
2.3MB
MD5caa5699292d046958abf653d39794718
SHA1651a1fe0bffab9ec31113c4e2ee6a2a21743b6ba
SHA256660565f46ba7ca24d65fff3d37162c6107b9e36f11ef4e5efe9bcc9deee064e5
SHA5127836134ac59b06b872a2b76b992b350f821b62730740f8469f788be11ccd3ed5bd3ad5afbaefde490a48ce05359a8cb593c6da4a70ba1144ebdd9a228ee29d1a
-
Filesize
2.3MB
MD5239af4dcb3393766fea752c893eddd6d
SHA18d3197a296c5464242da101b4f3a70b8ff3f5e53
SHA256d93be2a8a505d558114750791a779bac1396bf47c1a5f6fe3153f5b5663f711f
SHA512a318c2953721788807386f1d6ac30616143533e8d2ccb71763a01e7c84d0f33288bc3aec397310d51490bdd0ef63ebdbb5d7c0738553bebc942e6735707f0c28
-
Filesize
2.3MB
MD5c84c87e6a65c1c748ee56bf0b345f6ac
SHA1592c4480fa52a3fe1a8c9ef11e9e8361fea081b6
SHA2560224d09488bd4abdeb932b01564d44e7a007344fa65854bd716cf9cf13e96f6c
SHA5128705445ff90be9814b95be45900731a5265b5b6b28721b3bcbeb05b8c1ffce0f8921ca24b23f45457d75d6c1e410836222decc95898d23a2693ea56193e3ee16