xmrig | 54cd9a7173f95ba91e2a2d163ad5ea48f5423f709b862c1a2fb646b74dac3f3a

Analysis

max time kernel
125s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
Size 1.8MB
Sample240526-tyfazsdd73
SHA256 54cd9a7173f95ba91e2a2d163ad5ea48f5423f709b862c1a2fb646b74dac3f3a
MD5 136b970381359d07d7024f7ff80488b0
SHA1 a64cba7f36794f5631580c8b01f9a389c682df6e
SHA512 eb051896e7072fd8fc497e7ab8c26328d90e6aa0e96822c14d1309fbef754afabebb4000e2ae05e0f8f7271e3cf84696d557a6cb9ee6212a38b7678b48c61545
SSDEEP 49152:knw9oUUEEDlGUJ8Y9c87MQyRjdF5zkragO:kQUEEjE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 47 IoCs

miner

resource	yara_rule
behavioral2/memory/1184-33-0x00007FF73F0B0000-0x00007FF73F4A1000-memory.dmp	xmrig
behavioral2/memory/3460-36-0x00007FF6DB220000-0x00007FF6DB611000-memory.dmp	xmrig
behavioral2/memory/4632-447-0x00007FF684F50000-0x00007FF685341000-memory.dmp	xmrig
behavioral2/memory/4160-449-0x00007FF7752A0000-0x00007FF775691000-memory.dmp	xmrig
behavioral2/memory/4136-38-0x00007FF7FBAD0000-0x00007FF7FBEC1000-memory.dmp	xmrig
behavioral2/memory/4924-450-0x00007FF7134C0000-0x00007FF7138B1000-memory.dmp	xmrig
behavioral2/memory/1692-451-0x00007FF795F40000-0x00007FF796331000-memory.dmp	xmrig
behavioral2/memory/2244-453-0x00007FF7C8260000-0x00007FF7C8651000-memory.dmp	xmrig
behavioral2/memory/5012-452-0x00007FF6F2640000-0x00007FF6F2A31000-memory.dmp	xmrig
behavioral2/memory/4464-473-0x00007FF722CC0000-0x00007FF7230B1000-memory.dmp	xmrig
behavioral2/memory/3304-468-0x00007FF6CDEC0000-0x00007FF6CE2B1000-memory.dmp	xmrig
behavioral2/memory/3964-477-0x00007FF7E7C20000-0x00007FF7E8011000-memory.dmp	xmrig
behavioral2/memory/4688-488-0x00007FF7FCBB0000-0x00007FF7FCFA1000-memory.dmp	xmrig
behavioral2/memory/4916-493-0x00007FF7AFFF0000-0x00007FF7B03E1000-memory.dmp	xmrig
behavioral2/memory/1028-507-0x00007FF73E390000-0x00007FF73E781000-memory.dmp	xmrig
behavioral2/memory/2152-526-0x00007FF7630E0000-0x00007FF7634D1000-memory.dmp	xmrig
behavioral2/memory/4948-522-0x00007FF680990000-0x00007FF680D81000-memory.dmp	xmrig
behavioral2/memory/4524-528-0x00007FF661810000-0x00007FF661C01000-memory.dmp	xmrig
behavioral2/memory/4204-496-0x00007FF70A110000-0x00007FF70A501000-memory.dmp	xmrig
behavioral2/memory/4288-532-0x00007FF712D80000-0x00007FF713171000-memory.dmp	xmrig
behavioral2/memory/5056-536-0x00007FF76A870000-0x00007FF76AC61000-memory.dmp	xmrig
behavioral2/memory/2008-538-0x00007FF7F9C70000-0x00007FF7FA061000-memory.dmp	xmrig
behavioral2/memory/2552-1997-0x00007FF7C6D00000-0x00007FF7C70F1000-memory.dmp	xmrig
behavioral2/memory/4528-2008-0x00007FF7201C0000-0x00007FF7205B1000-memory.dmp	xmrig
behavioral2/memory/2552-2012-0x00007FF7C6D00000-0x00007FF7C70F1000-memory.dmp	xmrig
behavioral2/memory/4136-2011-0x00007FF7FBAD0000-0x00007FF7FBEC1000-memory.dmp	xmrig
behavioral2/memory/1184-2014-0x00007FF73F0B0000-0x00007FF73F4A1000-memory.dmp	xmrig
behavioral2/memory/3460-2016-0x00007FF6DB220000-0x00007FF6DB611000-memory.dmp	xmrig
behavioral2/memory/5056-2025-0x00007FF76A870000-0x00007FF76AC61000-memory.dmp	xmrig
behavioral2/memory/5012-2030-0x00007FF6F2640000-0x00007FF6F2A31000-memory.dmp	xmrig
behavioral2/memory/3304-2034-0x00007FF6CDEC0000-0x00007FF6CE2B1000-memory.dmp	xmrig
behavioral2/memory/4464-2036-0x00007FF722CC0000-0x00007FF7230B1000-memory.dmp	xmrig
behavioral2/memory/2244-2033-0x00007FF7C8260000-0x00007FF7C8651000-memory.dmp	xmrig
behavioral2/memory/4160-2028-0x00007FF7752A0000-0x00007FF775691000-memory.dmp	xmrig
behavioral2/memory/4632-2026-0x00007FF684F50000-0x00007FF685341000-memory.dmp	xmrig
behavioral2/memory/4924-2020-0x00007FF7134C0000-0x00007FF7138B1000-memory.dmp	xmrig
behavioral2/memory/2008-2022-0x00007FF7F9C70000-0x00007FF7FA061000-memory.dmp	xmrig
behavioral2/memory/1692-2019-0x00007FF795F40000-0x00007FF796331000-memory.dmp	xmrig
behavioral2/memory/4288-2043-0x00007FF712D80000-0x00007FF713171000-memory.dmp	xmrig
behavioral2/memory/4204-2063-0x00007FF70A110000-0x00007FF70A501000-memory.dmp	xmrig
behavioral2/memory/3964-2070-0x00007FF7E7C20000-0x00007FF7E8011000-memory.dmp	xmrig
behavioral2/memory/4688-2067-0x00007FF7FCBB0000-0x00007FF7FCFA1000-memory.dmp	xmrig
behavioral2/memory/1028-2062-0x00007FF73E390000-0x00007FF73E781000-memory.dmp	xmrig
behavioral2/memory/4948-2048-0x00007FF680990000-0x00007FF680D81000-memory.dmp	xmrig
behavioral2/memory/2152-2047-0x00007FF7630E0000-0x00007FF7634D1000-memory.dmp	xmrig
behavioral2/memory/4524-2044-0x00007FF661810000-0x00007FF661C01000-memory.dmp	xmrig
behavioral2/memory/4916-2066-0x00007FF7AFFF0000-0x00007FF7B03E1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4528	iIQBSsY.exe
2552	txjbMXi.exe
4136	qbxAACN.exe
1184	aqQrcPU.exe
3460	XRkUcEY.exe
4632	EkXEAVo.exe
5056	DHNJjTP.exe
2008	ChrKuhO.exe
4160	iKtLnxN.exe
4924	gECbMes.exe
1692	TyiZOCw.exe
5012	XfZHeCj.exe
2244	ssphMaK.exe
3304	WozudaE.exe
4464	rpItvTi.exe
3964	zqOfWWd.exe
4688	spexoeU.exe
4916	spvSjZG.exe
4204	YJMQWGu.exe
1028	BfEEKnw.exe
4948	jBtPQdP.exe
2152	iGqgDBM.exe
4524	kilekux.exe
4288	bHjQBmN.exe
224	yGXLqSe.exe
844	zDDSMIE.exe
4068	sHyyBnD.exe
708	EAEzTlA.exe
4936	MmQshRb.exe
3348	zUdsaxW.exe
3464	vcDwJCg.exe
2036	oejpzMJ.exe
4720	liQIFCw.exe
1108	QzrKTIa.exe
4900	MznREsR.exe
768	ZncAJLj.exe
3112	iFeSILZ.exe
2800	yewmEpx.exe
2288	EpvgSiS.exe
3556	ptluKLc.exe
1576	cgSaCGN.exe
2952	QNfXrjF.exe
1680	JobmimM.exe
1136	iYybgvp.exe
4084	rhBIrPN.exe
212	HjExdbJ.exe
3824	RZRRxXT.exe
4316	gnkrdHs.exe
2064	xFWFEFx.exe
2120	XJNLLhO.exe
3560	kLGonQf.exe
1584	vvvPVdG.exe
4584	bvBscEj.exe
5116	bmIvZib.exe
5004	rVUbFEn.exe
3536	LrPlPMH.exe
3288	UurvBQC.exe
3180	eNAQuwo.exe
676	qBodVWA.exe
4256	zZgBFvq.exe
4352	JjqIVBV.exe
1160	fMYasNd.exe
1624	eeZCgqP.exe
3708	OZTEmaf.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4940-0-0x00007FF7BB1E0000-0x00007FF7BB5D1000-memory.dmp	upx
behavioral2/files/0x00080000000233ff-4.dat	upx
behavioral2/files/0x0007000000023401-8.dat	upx
behavioral2/files/0x0007000000023400-17.dat	upx
behavioral2/files/0x0007000000023402-23.dat	upx
behavioral2/memory/2552-26-0x00007FF7C6D00000-0x00007FF7C70F1000-memory.dmp	upx
behavioral2/files/0x0007000000023404-31.dat	upx
behavioral2/memory/1184-33-0x00007FF73F0B0000-0x00007FF73F4A1000-memory.dmp	upx
behavioral2/memory/3460-36-0x00007FF6DB220000-0x00007FF6DB611000-memory.dmp	upx
behavioral2/files/0x0007000000023406-43.dat	upx
behavioral2/files/0x0007000000023408-53.dat	upx
behavioral2/files/0x0007000000023409-58.dat	upx
behavioral2/files/0x000700000002340a-65.dat	upx
behavioral2/files/0x000700000002340e-86.dat	upx
behavioral2/files/0x0007000000023411-101.dat	upx
behavioral2/files/0x0007000000023413-111.dat	upx
behavioral2/files/0x0007000000023416-124.dat	upx
behavioral2/files/0x000700000002341a-146.dat	upx
behavioral2/files/0x000700000002341d-158.dat	upx
behavioral2/memory/4632-447-0x00007FF684F50000-0x00007FF685341000-memory.dmp	upx
behavioral2/memory/4160-449-0x00007FF7752A0000-0x00007FF775691000-memory.dmp	upx
behavioral2/files/0x000700000002341e-166.dat	upx
behavioral2/files/0x000700000002341c-156.dat	upx
behavioral2/files/0x000700000002341b-152.dat	upx
behavioral2/files/0x0007000000023419-141.dat	upx
behavioral2/files/0x0007000000023418-136.dat	upx
behavioral2/files/0x0007000000023417-134.dat	upx
behavioral2/files/0x0007000000023415-121.dat	upx
behavioral2/files/0x0007000000023414-116.dat	upx
behavioral2/files/0x0007000000023412-109.dat	upx
behavioral2/files/0x0007000000023410-99.dat	upx
behavioral2/files/0x000700000002340f-91.dat	upx
behavioral2/files/0x000700000002340d-81.dat	upx
behavioral2/files/0x000700000002340c-76.dat	upx
behavioral2/files/0x000700000002340b-72.dat	upx
behavioral2/files/0x0007000000023407-51.dat	upx
behavioral2/files/0x0007000000023405-41.dat	upx
behavioral2/memory/4136-38-0x00007FF7FBAD0000-0x00007FF7FBEC1000-memory.dmp	upx
behavioral2/files/0x0007000000023403-28.dat	upx
behavioral2/memory/4528-13-0x00007FF7201C0000-0x00007FF7205B1000-memory.dmp	upx
behavioral2/memory/4924-450-0x00007FF7134C0000-0x00007FF7138B1000-memory.dmp	upx
behavioral2/memory/1692-451-0x00007FF795F40000-0x00007FF796331000-memory.dmp	upx
behavioral2/memory/2244-453-0x00007FF7C8260000-0x00007FF7C8651000-memory.dmp	upx
behavioral2/memory/5012-452-0x00007FF6F2640000-0x00007FF6F2A31000-memory.dmp	upx
behavioral2/memory/4464-473-0x00007FF722CC0000-0x00007FF7230B1000-memory.dmp	upx
behavioral2/memory/3304-468-0x00007FF6CDEC0000-0x00007FF6CE2B1000-memory.dmp	upx
behavioral2/memory/3964-477-0x00007FF7E7C20000-0x00007FF7E8011000-memory.dmp	upx
behavioral2/memory/4688-488-0x00007FF7FCBB0000-0x00007FF7FCFA1000-memory.dmp	upx
behavioral2/memory/4916-493-0x00007FF7AFFF0000-0x00007FF7B03E1000-memory.dmp	upx
behavioral2/memory/1028-507-0x00007FF73E390000-0x00007FF73E781000-memory.dmp	upx
behavioral2/memory/2152-526-0x00007FF7630E0000-0x00007FF7634D1000-memory.dmp	upx
behavioral2/memory/4948-522-0x00007FF680990000-0x00007FF680D81000-memory.dmp	upx
behavioral2/memory/4524-528-0x00007FF661810000-0x00007FF661C01000-memory.dmp	upx
behavioral2/memory/4204-496-0x00007FF70A110000-0x00007FF70A501000-memory.dmp	upx
behavioral2/memory/4288-532-0x00007FF712D80000-0x00007FF713171000-memory.dmp	upx
behavioral2/memory/5056-536-0x00007FF76A870000-0x00007FF76AC61000-memory.dmp	upx
behavioral2/memory/2008-538-0x00007FF7F9C70000-0x00007FF7FA061000-memory.dmp	upx
behavioral2/memory/2552-1997-0x00007FF7C6D00000-0x00007FF7C70F1000-memory.dmp	upx
behavioral2/memory/4528-2008-0x00007FF7201C0000-0x00007FF7205B1000-memory.dmp	upx
behavioral2/memory/2552-2012-0x00007FF7C6D00000-0x00007FF7C70F1000-memory.dmp	upx
behavioral2/memory/4136-2011-0x00007FF7FBAD0000-0x00007FF7FBEC1000-memory.dmp	upx
behavioral2/memory/1184-2014-0x00007FF73F0B0000-0x00007FF73F4A1000-memory.dmp	upx
behavioral2/memory/3460-2016-0x00007FF6DB220000-0x00007FF6DB611000-memory.dmp	upx
behavioral2/memory/5056-2025-0x00007FF76A870000-0x00007FF76AC61000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\XJNLLhO.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\XqZqMbJ.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\GgqyOfb.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\WXZwSGr.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\sgEVsYn.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\dNZWzXW.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\nHXIvyn.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\yAroUtf.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\spexoeU.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\zUdsaxW.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\uQSvBCT.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\GZKmdEZ.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\bgLKErj.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\oaexOdZ.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\QOOWmWN.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\PyZhxLt.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\NPSSsEn.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\BkTMlvj.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\QTCKpZD.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\wiHhfTh.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\zFZJWDO.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\hzRnDzD.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\zFQFYmM.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\GSENQJR.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\AwVKkIM.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\iGqgDBM.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\zZgBFvq.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\bdpkYpr.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\aLtzePf.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\ghqViPU.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\gvaWZwU.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\RKmtAUZ.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\MtxmPaU.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\LJsjkZC.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\OZTEmaf.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\UOTxNqe.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\qjKvoCL.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\JxFRnKK.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\EwEfIUj.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\pIRiiZe.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\SaISEpj.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\qecIAva.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\YOwQeBN.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\dIowzOV.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\LeoNJpm.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\NQQPRDx.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\BZzbCPg.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\xRigxmO.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\zEGbBPK.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\hGhXPbM.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\dcRdVwB.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\uyaDLof.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\xyDKknd.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\SSYgrKX.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\GwaiiyS.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\dNlkPQo.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\vZCNqZQ.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\kilekux.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\eNAQuwo.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\aAiWvjV.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\pzgLZfF.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\UdjDhQr.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\XBHAhkt.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
File created	C:\Windows\System32\oejpzMJ.exe	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 4528	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	83
PID 4940 wrote to memory of 4528	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	83
PID 4940 wrote to memory of 2552	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	84
PID 4940 wrote to memory of 2552	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	84
PID 4940 wrote to memory of 4136	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	85
PID 4940 wrote to memory of 4136	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	85
PID 4940 wrote to memory of 1184	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	86
PID 4940 wrote to memory of 1184	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	86
PID 4940 wrote to memory of 3460	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	87
PID 4940 wrote to memory of 3460	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	87
PID 4940 wrote to memory of 4632	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	88
PID 4940 wrote to memory of 4632	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	88
PID 4940 wrote to memory of 5056	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	89
PID 4940 wrote to memory of 5056	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	89
PID 4940 wrote to memory of 2008	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	90
PID 4940 wrote to memory of 2008	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	90
PID 4940 wrote to memory of 4160	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	91
PID 4940 wrote to memory of 4160	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	91
PID 4940 wrote to memory of 4924	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	92
PID 4940 wrote to memory of 4924	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	92
PID 4940 wrote to memory of 1692	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	93
PID 4940 wrote to memory of 1692	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	93
PID 4940 wrote to memory of 5012	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	94
PID 4940 wrote to memory of 5012	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	94
PID 4940 wrote to memory of 2244	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	95
PID 4940 wrote to memory of 2244	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	95
PID 4940 wrote to memory of 3304	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	96
PID 4940 wrote to memory of 3304	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	96
PID 4940 wrote to memory of 4464	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	97
PID 4940 wrote to memory of 4464	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	97
PID 4940 wrote to memory of 3964	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	98
PID 4940 wrote to memory of 3964	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	98
PID 4940 wrote to memory of 4688	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	99
PID 4940 wrote to memory of 4688	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	99
PID 4940 wrote to memory of 4916	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	100
PID 4940 wrote to memory of 4916	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	100
PID 4940 wrote to memory of 4204	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	101
PID 4940 wrote to memory of 4204	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	101
PID 4940 wrote to memory of 1028	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	102
PID 4940 wrote to memory of 1028	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	102
PID 4940 wrote to memory of 4948	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	103
PID 4940 wrote to memory of 4948	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	103
PID 4940 wrote to memory of 2152	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	104
PID 4940 wrote to memory of 2152	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	104
PID 4940 wrote to memory of 4524	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	105
PID 4940 wrote to memory of 4524	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	105
PID 4940 wrote to memory of 4288	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	106
PID 4940 wrote to memory of 4288	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	106
PID 4940 wrote to memory of 224	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	107
PID 4940 wrote to memory of 224	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	107
PID 4940 wrote to memory of 844	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	108
PID 4940 wrote to memory of 844	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	108
PID 4940 wrote to memory of 4068	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	109
PID 4940 wrote to memory of 4068	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	109
PID 4940 wrote to memory of 708	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	110
PID 4940 wrote to memory of 708	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	110
PID 4940 wrote to memory of 4936	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	111
PID 4940 wrote to memory of 4936	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	111
PID 4940 wrote to memory of 3348	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	112
PID 4940 wrote to memory of 3348	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	112
PID 4940 wrote to memory of 3464	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	113
PID 4940 wrote to memory of 3464	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	113
PID 4940 wrote to memory of 2036	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	114
PID 4940 wrote to memory of 2036	4940	136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\136b970381359d07d7024f7ff80488b0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\System32\iIQBSsY.exe
  C:\Windows\System32\iIQBSsY.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System32\txjbMXi.exe
  C:\Windows\System32\txjbMXi.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System32\qbxAACN.exe
  C:\Windows\System32\qbxAACN.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System32\aqQrcPU.exe
  C:\Windows\System32\aqQrcPU.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System32\XRkUcEY.exe
  C:\Windows\System32\XRkUcEY.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System32\EkXEAVo.exe
  C:\Windows\System32\EkXEAVo.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System32\DHNJjTP.exe
  C:\Windows\System32\DHNJjTP.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System32\ChrKuhO.exe
  C:\Windows\System32\ChrKuhO.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System32\iKtLnxN.exe
  C:\Windows\System32\iKtLnxN.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System32\gECbMes.exe
  C:\Windows\System32\gECbMes.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System32\TyiZOCw.exe
  C:\Windows\System32\TyiZOCw.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System32\XfZHeCj.exe
  C:\Windows\System32\XfZHeCj.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System32\ssphMaK.exe
  C:\Windows\System32\ssphMaK.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System32\WozudaE.exe
  C:\Windows\System32\WozudaE.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System32\rpItvTi.exe
  C:\Windows\System32\rpItvTi.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System32\zqOfWWd.exe
  C:\Windows\System32\zqOfWWd.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System32\spexoeU.exe
  C:\Windows\System32\spexoeU.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System32\spvSjZG.exe
  C:\Windows\System32\spvSjZG.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System32\YJMQWGu.exe
  C:\Windows\System32\YJMQWGu.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System32\BfEEKnw.exe
  C:\Windows\System32\BfEEKnw.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System32\jBtPQdP.exe
  C:\Windows\System32\jBtPQdP.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System32\iGqgDBM.exe
  C:\Windows\System32\iGqgDBM.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System32\kilekux.exe
  C:\Windows\System32\kilekux.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System32\bHjQBmN.exe
  C:\Windows\System32\bHjQBmN.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System32\yGXLqSe.exe
  C:\Windows\System32\yGXLqSe.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System32\zDDSMIE.exe
  C:\Windows\System32\zDDSMIE.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System32\sHyyBnD.exe
  C:\Windows\System32\sHyyBnD.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System32\EAEzTlA.exe
  C:\Windows\System32\EAEzTlA.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System32\MmQshRb.exe
  C:\Windows\System32\MmQshRb.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System32\zUdsaxW.exe
  C:\Windows\System32\zUdsaxW.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System32\vcDwJCg.exe
  C:\Windows\System32\vcDwJCg.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System32\oejpzMJ.exe
  C:\Windows\System32\oejpzMJ.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System32\liQIFCw.exe
  C:\Windows\System32\liQIFCw.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System32\QzrKTIa.exe
  C:\Windows\System32\QzrKTIa.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System32\MznREsR.exe
  C:\Windows\System32\MznREsR.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System32\ZncAJLj.exe
  C:\Windows\System32\ZncAJLj.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System32\iFeSILZ.exe
  C:\Windows\System32\iFeSILZ.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System32\yewmEpx.exe
  C:\Windows\System32\yewmEpx.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System32\EpvgSiS.exe
  C:\Windows\System32\EpvgSiS.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System32\ptluKLc.exe
  C:\Windows\System32\ptluKLc.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System32\cgSaCGN.exe
  C:\Windows\System32\cgSaCGN.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System32\QNfXrjF.exe
  C:\Windows\System32\QNfXrjF.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System32\JobmimM.exe
  C:\Windows\System32\JobmimM.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System32\iYybgvp.exe
  C:\Windows\System32\iYybgvp.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System32\rhBIrPN.exe
  C:\Windows\System32\rhBIrPN.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System32\HjExdbJ.exe
  C:\Windows\System32\HjExdbJ.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System32\RZRRxXT.exe
  C:\Windows\System32\RZRRxXT.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System32\gnkrdHs.exe
  C:\Windows\System32\gnkrdHs.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System32\xFWFEFx.exe
  C:\Windows\System32\xFWFEFx.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System32\XJNLLhO.exe
  C:\Windows\System32\XJNLLhO.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System32\kLGonQf.exe
  C:\Windows\System32\kLGonQf.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System32\vvvPVdG.exe
  C:\Windows\System32\vvvPVdG.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System32\bvBscEj.exe
  C:\Windows\System32\bvBscEj.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System32\bmIvZib.exe
  C:\Windows\System32\bmIvZib.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System32\rVUbFEn.exe
  C:\Windows\System32\rVUbFEn.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System32\LrPlPMH.exe
  C:\Windows\System32\LrPlPMH.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System32\UurvBQC.exe
  C:\Windows\System32\UurvBQC.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System32\eNAQuwo.exe
  C:\Windows\System32\eNAQuwo.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System32\qBodVWA.exe
  C:\Windows\System32\qBodVWA.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System32\zZgBFvq.exe
  C:\Windows\System32\zZgBFvq.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System32\JjqIVBV.exe
  C:\Windows\System32\JjqIVBV.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System32\fMYasNd.exe
  C:\Windows\System32\fMYasNd.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System32\eeZCgqP.exe
  C:\Windows\System32\eeZCgqP.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System32\OZTEmaf.exe
  C:\Windows\System32\OZTEmaf.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System32\JmembeR.exe
  C:\Windows\System32\JmembeR.exe
  2⤵
  PID:3548
- C:\Windows\System32\igBJIQz.exe
  C:\Windows\System32\igBJIQz.exe
  2⤵
  PID:4168
- C:\Windows\System32\UOTxNqe.exe
  C:\Windows\System32\UOTxNqe.exe
  2⤵
  PID:2896
- C:\Windows\System32\ZpgAZWU.exe
  C:\Windows\System32\ZpgAZWU.exe
  2⤵
  PID:2000
- C:\Windows\System32\wKMUtcJ.exe
  C:\Windows\System32\wKMUtcJ.exe
  2⤵
  PID:1920
- C:\Windows\System32\SaISEpj.exe
  C:\Windows\System32\SaISEpj.exe
  2⤵
  PID:4456
- C:\Windows\System32\pwXUMTR.exe
  C:\Windows\System32\pwXUMTR.exe
  2⤵
  PID:2580
- C:\Windows\System32\JFvHHuN.exe
  C:\Windows\System32\JFvHHuN.exe
  2⤵
  PID:4196
- C:\Windows\System32\ocvxqWu.exe
  C:\Windows\System32\ocvxqWu.exe
  2⤵
  PID:3552
- C:\Windows\System32\HOlDFsI.exe
  C:\Windows\System32\HOlDFsI.exe
  2⤵
  PID:3424
- C:\Windows\System32\OCItDYj.exe
  C:\Windows\System32\OCItDYj.exe
  2⤵
  PID:1836
- C:\Windows\System32\IflihGz.exe
  C:\Windows\System32\IflihGz.exe
  2⤵
  PID:4476
- C:\Windows\System32\uQSvBCT.exe
  C:\Windows\System32\uQSvBCT.exe
  2⤵
  PID:1308
- C:\Windows\System32\yVKAigM.exe
  C:\Windows\System32\yVKAigM.exe
  2⤵
  PID:4244
- C:\Windows\System32\doougjT.exe
  C:\Windows\System32\doougjT.exe
  2⤵
  PID:1500
- C:\Windows\System32\mjcQCQw.exe
  C:\Windows\System32\mjcQCQw.exe
  2⤵
  PID:2372
- C:\Windows\System32\huYeeAD.exe
  C:\Windows\System32\huYeeAD.exe
  2⤵
  PID:3188
- C:\Windows\System32\RAIVuOZ.exe
  C:\Windows\System32\RAIVuOZ.exe
  2⤵
  PID:4424
- C:\Windows\System32\ZWjEsHa.exe
  C:\Windows\System32\ZWjEsHa.exe
  2⤵
  PID:3960
- C:\Windows\System32\PeLrmcE.exe
  C:\Windows\System32\PeLrmcE.exe
  2⤵
  PID:2328
- C:\Windows\System32\cpTunvw.exe
  C:\Windows\System32\cpTunvw.exe
  2⤵
  PID:5144
- C:\Windows\System32\SybScAO.exe
  C:\Windows\System32\SybScAO.exe
  2⤵
  PID:5172
- C:\Windows\System32\hyXNmOr.exe
  C:\Windows\System32\hyXNmOr.exe
  2⤵
  PID:5204
- C:\Windows\System32\PyZhxLt.exe
  C:\Windows\System32\PyZhxLt.exe
  2⤵
  PID:5232
- C:\Windows\System32\GgqyOfb.exe
  C:\Windows\System32\GgqyOfb.exe
  2⤵
  PID:5264
- C:\Windows\System32\vdarVRm.exe
  C:\Windows\System32\vdarVRm.exe
  2⤵
  PID:5296
- C:\Windows\System32\pbYnvJv.exe
  C:\Windows\System32\pbYnvJv.exe
  2⤵
  PID:5312
- C:\Windows\System32\AkIPQBj.exe
  C:\Windows\System32\AkIPQBj.exe
  2⤵
  PID:5340
- C:\Windows\System32\jtrChKm.exe
  C:\Windows\System32\jtrChKm.exe
  2⤵
  PID:5368
- C:\Windows\System32\SJaDFrN.exe
  C:\Windows\System32\SJaDFrN.exe
  2⤵
  PID:5396
- C:\Windows\System32\LOGimZs.exe
  C:\Windows\System32\LOGimZs.exe
  2⤵
  PID:5424
- C:\Windows\System32\WJjCFpU.exe
  C:\Windows\System32\WJjCFpU.exe
  2⤵
  PID:5452
- C:\Windows\System32\RPUbFdH.exe
  C:\Windows\System32\RPUbFdH.exe
  2⤵
  PID:5476
- C:\Windows\System32\jfVIDCA.exe
  C:\Windows\System32\jfVIDCA.exe
  2⤵
  PID:5508
- C:\Windows\System32\kXoxIqS.exe
  C:\Windows\System32\kXoxIqS.exe
  2⤵
  PID:5536
- C:\Windows\System32\ZtTGBgK.exe
  C:\Windows\System32\ZtTGBgK.exe
  2⤵
  PID:5564
- C:\Windows\System32\ZQwbLOY.exe
  C:\Windows\System32\ZQwbLOY.exe
  2⤵
  PID:5592
- C:\Windows\System32\KAgOnyj.exe
  C:\Windows\System32\KAgOnyj.exe
  2⤵
  PID:5620
- C:\Windows\System32\RnACQcR.exe
  C:\Windows\System32\RnACQcR.exe
  2⤵
  PID:5644
- C:\Windows\System32\rVsRHyI.exe
  C:\Windows\System32\rVsRHyI.exe
  2⤵
  PID:5676
- C:\Windows\System32\FzwgyNb.exe
  C:\Windows\System32\FzwgyNb.exe
  2⤵
  PID:5712
- C:\Windows\System32\HNrjewr.exe
  C:\Windows\System32\HNrjewr.exe
  2⤵
  PID:5732
- C:\Windows\System32\GZKmdEZ.exe
  C:\Windows\System32\GZKmdEZ.exe
  2⤵
  PID:5760
- C:\Windows\System32\SyCeExS.exe
  C:\Windows\System32\SyCeExS.exe
  2⤵
  PID:5784
- C:\Windows\System32\YWAFodC.exe
  C:\Windows\System32\YWAFodC.exe
  2⤵
  PID:5812
- C:\Windows\System32\qqUHPTG.exe
  C:\Windows\System32\qqUHPTG.exe
  2⤵
  PID:5844
- C:\Windows\System32\FnPkonz.exe
  C:\Windows\System32\FnPkonz.exe
  2⤵
  PID:5872
- C:\Windows\System32\ojIljUh.exe
  C:\Windows\System32\ojIljUh.exe
  2⤵
  PID:5900
- C:\Windows\System32\bWCEIjL.exe
  C:\Windows\System32\bWCEIjL.exe
  2⤵
  PID:5928
- C:\Windows\System32\HvVYynd.exe
  C:\Windows\System32\HvVYynd.exe
  2⤵
  PID:5956
- C:\Windows\System32\bgLKErj.exe
  C:\Windows\System32\bgLKErj.exe
  2⤵
  PID:5984
- C:\Windows\System32\SpjLAjB.exe
  C:\Windows\System32\SpjLAjB.exe
  2⤵
  PID:6012
- C:\Windows\System32\ddIgAqm.exe
  C:\Windows\System32\ddIgAqm.exe
  2⤵
  PID:6040
- C:\Windows\System32\hSrXsaN.exe
  C:\Windows\System32\hSrXsaN.exe
  2⤵
  PID:6068
- C:\Windows\System32\UHXHciS.exe
  C:\Windows\System32\UHXHciS.exe
  2⤵
  PID:6108
- C:\Windows\System32\WXZwSGr.exe
  C:\Windows\System32\WXZwSGr.exe
  2⤵
  PID:6124
- C:\Windows\System32\ExumqPY.exe
  C:\Windows\System32\ExumqPY.exe
  2⤵
  PID:4224
- C:\Windows\System32\LZkRhJX.exe
  C:\Windows\System32\LZkRhJX.exe
  2⤵
  PID:1256
- C:\Windows\System32\oDnXzAz.exe
  C:\Windows\System32\oDnXzAz.exe
  2⤵
  PID:4332
- C:\Windows\System32\uGBNehb.exe
  C:\Windows\System32\uGBNehb.exe
  2⤵
  PID:5136
- C:\Windows\System32\ifQMYDQ.exe
  C:\Windows\System32\ifQMYDQ.exe
  2⤵
  PID:2920
- C:\Windows\System32\ZTttEJJ.exe
  C:\Windows\System32\ZTttEJJ.exe
  2⤵
  PID:5240
- C:\Windows\System32\QnSsURe.exe
  C:\Windows\System32\QnSsURe.exe
  2⤵
  PID:5324
- C:\Windows\System32\wvkeBho.exe
  C:\Windows\System32\wvkeBho.exe
  2⤵
  PID:5472
- C:\Windows\System32\Djsbpmv.exe
  C:\Windows\System32\Djsbpmv.exe
  2⤵
  PID:3068
- C:\Windows\System32\skmdjjQ.exe
  C:\Windows\System32\skmdjjQ.exe
  2⤵
  PID:5544
- C:\Windows\System32\UWPAZgD.exe
  C:\Windows\System32\UWPAZgD.exe
  2⤵
  PID:5572
- C:\Windows\System32\qecIAva.exe
  C:\Windows\System32\qecIAva.exe
  2⤵
  PID:5628
- C:\Windows\System32\PkjJpyC.exe
  C:\Windows\System32\PkjJpyC.exe
  2⤵
  PID:5772
- C:\Windows\System32\MTKomNB.exe
  C:\Windows\System32\MTKomNB.exe
  2⤵
  PID:5836
- C:\Windows\System32\JQAmyPe.exe
  C:\Windows\System32\JQAmyPe.exe
  2⤵
  PID:4904
- C:\Windows\System32\ZSdRwzl.exe
  C:\Windows\System32\ZSdRwzl.exe
  2⤵
  PID:5880
- C:\Windows\System32\EdxTisC.exe
  C:\Windows\System32\EdxTisC.exe
  2⤵
  PID:2680
- C:\Windows\System32\TAnsCMj.exe
  C:\Windows\System32\TAnsCMj.exe
  2⤵
  PID:1404
- C:\Windows\System32\TeBGcxK.exe
  C:\Windows\System32\TeBGcxK.exe
  2⤵
  PID:436
- C:\Windows\System32\DtVYVaG.exe
  C:\Windows\System32\DtVYVaG.exe
  2⤵
  PID:6020
- C:\Windows\System32\VVACAqt.exe
  C:\Windows\System32\VVACAqt.exe
  2⤵
  PID:6052
- C:\Windows\System32\dNmeFVa.exe
  C:\Windows\System32\dNmeFVa.exe
  2⤵
  PID:2668
- C:\Windows\System32\TGnjyna.exe
  C:\Windows\System32\TGnjyna.exe
  2⤵
  PID:432
- C:\Windows\System32\KZFDZoL.exe
  C:\Windows\System32\KZFDZoL.exe
  2⤵
  PID:3640
- C:\Windows\System32\QVqmMLc.exe
  C:\Windows\System32\QVqmMLc.exe
  2⤵
  PID:2424
- C:\Windows\System32\DXXlgRL.exe
  C:\Windows\System32\DXXlgRL.exe
  2⤵
  PID:392
- C:\Windows\System32\GzrBVju.exe
  C:\Windows\System32\GzrBVju.exe
  2⤵
  PID:3524
- C:\Windows\System32\wkZNTOq.exe
  C:\Windows\System32\wkZNTOq.exe
  2⤵
  PID:1216
- C:\Windows\System32\StEfwIK.exe
  C:\Windows\System32\StEfwIK.exe
  2⤵
  PID:820
- C:\Windows\System32\uWBwagq.exe
  C:\Windows\System32\uWBwagq.exe
  2⤵
  PID:5516
- C:\Windows\System32\cGukNOv.exe
  C:\Windows\System32\cGukNOv.exe
  2⤵
  PID:5708
- C:\Windows\System32\IpywpHd.exe
  C:\Windows\System32\IpywpHd.exe
  2⤵
  PID:5432
- C:\Windows\System32\OcQcgZi.exe
  C:\Windows\System32\OcQcgZi.exe
  2⤵
  PID:3292
- C:\Windows\System32\UvbuRiU.exe
  C:\Windows\System32\UvbuRiU.exe
  2⤵
  PID:6048
- C:\Windows\System32\LjAiDrA.exe
  C:\Windows\System32\LjAiDrA.exe
  2⤵
  PID:4320
- C:\Windows\System32\iWVmBNR.exe
  C:\Windows\System32\iWVmBNR.exe
  2⤵
  PID:5184
- C:\Windows\System32\CpkdjZZ.exe
  C:\Windows\System32\CpkdjZZ.exe
  2⤵
  PID:5652
- C:\Windows\System32\gFzdRty.exe
  C:\Windows\System32\gFzdRty.exe
  2⤵
  PID:5640
- C:\Windows\System32\KWZiooe.exe
  C:\Windows\System32\KWZiooe.exe
  2⤵
  PID:6032
- C:\Windows\System32\VaZEOLv.exe
  C:\Windows\System32\VaZEOLv.exe
  2⤵
  PID:6116
- C:\Windows\System32\JcEJuxV.exe
  C:\Windows\System32\JcEJuxV.exe
  2⤵
  PID:3616
- C:\Windows\System32\MvsbKrx.exe
  C:\Windows\System32\MvsbKrx.exe
  2⤵
  PID:5404
- C:\Windows\System32\SgrjoVj.exe
  C:\Windows\System32\SgrjoVj.exe
  2⤵
  PID:5576
- C:\Windows\System32\MVRcjcT.exe
  C:\Windows\System32\MVRcjcT.exe
  2⤵
  PID:652
- C:\Windows\System32\sgEVsYn.exe
  C:\Windows\System32\sgEVsYn.exe
  2⤵
  PID:3996
- C:\Windows\System32\WojuPzM.exe
  C:\Windows\System32\WojuPzM.exe
  2⤵
  PID:4412
- C:\Windows\System32\ukWIfrz.exe
  C:\Windows\System32\ukWIfrz.exe
  2⤵
  PID:3268
- C:\Windows\System32\uyaDLof.exe
  C:\Windows\System32\uyaDLof.exe
  2⤵
  PID:6160
- C:\Windows\System32\pJaBfBc.exe
  C:\Windows\System32\pJaBfBc.exe
  2⤵
  PID:6180
- C:\Windows\System32\DBiFUvt.exe
  C:\Windows\System32\DBiFUvt.exe
  2⤵
  PID:6196
- C:\Windows\System32\bIYAgsy.exe
  C:\Windows\System32\bIYAgsy.exe
  2⤵
  PID:6220
- C:\Windows\System32\tSekBoy.exe
  C:\Windows\System32\tSekBoy.exe
  2⤵
  PID:6240
- C:\Windows\System32\SXaqDmU.exe
  C:\Windows\System32\SXaqDmU.exe
  2⤵
  PID:6264
- C:\Windows\System32\ZbAEqTY.exe
  C:\Windows\System32\ZbAEqTY.exe
  2⤵
  PID:6316
- C:\Windows\System32\MIwztEd.exe
  C:\Windows\System32\MIwztEd.exe
  2⤵
  PID:6360
- C:\Windows\System32\wbGNLnS.exe
  C:\Windows\System32\wbGNLnS.exe
  2⤵
  PID:6384
- C:\Windows\System32\IICmuyT.exe
  C:\Windows\System32\IICmuyT.exe
  2⤵
  PID:6424
- C:\Windows\System32\UCLMPHP.exe
  C:\Windows\System32\UCLMPHP.exe
  2⤵
  PID:6444
- C:\Windows\System32\fqqahcv.exe
  C:\Windows\System32\fqqahcv.exe
  2⤵
  PID:6468
- C:\Windows\System32\dWsvUpb.exe
  C:\Windows\System32\dWsvUpb.exe
  2⤵
  PID:6488
- C:\Windows\System32\UfCezmG.exe
  C:\Windows\System32\UfCezmG.exe
  2⤵
  PID:6516
- C:\Windows\System32\CxDWhGE.exe
  C:\Windows\System32\CxDWhGE.exe
  2⤵
  PID:6540
- C:\Windows\System32\jPBBotv.exe
  C:\Windows\System32\jPBBotv.exe
  2⤵
  PID:6564
- C:\Windows\System32\JOhqBjs.exe
  C:\Windows\System32\JOhqBjs.exe
  2⤵
  PID:6596
- C:\Windows\System32\nLhwkEI.exe
  C:\Windows\System32\nLhwkEI.exe
  2⤵
  PID:6620
- C:\Windows\System32\caDsnxD.exe
  C:\Windows\System32\caDsnxD.exe
  2⤵
  PID:6660
- C:\Windows\System32\qSAqppi.exe
  C:\Windows\System32\qSAqppi.exe
  2⤵
  PID:6676
- C:\Windows\System32\kBpAoEG.exe
  C:\Windows\System32\kBpAoEG.exe
  2⤵
  PID:6704
- C:\Windows\System32\YvwzWUz.exe
  C:\Windows\System32\YvwzWUz.exe
  2⤵
  PID:6736
- C:\Windows\System32\TnmjMVH.exe
  C:\Windows\System32\TnmjMVH.exe
  2⤵
  PID:6752
- C:\Windows\System32\xLUjJZr.exe
  C:\Windows\System32\xLUjJZr.exe
  2⤵
  PID:6788
- C:\Windows\System32\wiHhfTh.exe
  C:\Windows\System32\wiHhfTh.exe
  2⤵
  PID:6804
- C:\Windows\System32\YKibdKU.exe
  C:\Windows\System32\YKibdKU.exe
  2⤵
  PID:6868
- C:\Windows\System32\boInGBG.exe
  C:\Windows\System32\boInGBG.exe
  2⤵
  PID:6916
- C:\Windows\System32\sfNtUVA.exe
  C:\Windows\System32\sfNtUVA.exe
  2⤵
  PID:6944
- C:\Windows\System32\vdJglIS.exe
  C:\Windows\System32\vdJglIS.exe
  2⤵
  PID:6964
- C:\Windows\System32\fShcMkz.exe
  C:\Windows\System32\fShcMkz.exe
  2⤵
  PID:7004
- C:\Windows\System32\MaTKcCR.exe
  C:\Windows\System32\MaTKcCR.exe
  2⤵
  PID:7032
- C:\Windows\System32\aeukCsc.exe
  C:\Windows\System32\aeukCsc.exe
  2⤵
  PID:7048
- C:\Windows\System32\LvKhjpA.exe
  C:\Windows\System32\LvKhjpA.exe
  2⤵
  PID:7072
- C:\Windows\System32\Qtigkew.exe
  C:\Windows\System32\Qtigkew.exe
  2⤵
  PID:7100
- C:\Windows\System32\oCTudqf.exe
  C:\Windows\System32\oCTudqf.exe
  2⤵
  PID:7116
- C:\Windows\System32\JCLVoIp.exe
  C:\Windows\System32\JCLVoIp.exe
  2⤵
  PID:7136
- C:\Windows\System32\aLgqDny.exe
  C:\Windows\System32\aLgqDny.exe
  2⤵
  PID:6148
- C:\Windows\System32\uKJSrsA.exe
  C:\Windows\System32\uKJSrsA.exe
  2⤵
  PID:6324
- C:\Windows\System32\zLurwAe.exe
  C:\Windows\System32\zLurwAe.exe
  2⤵
  PID:6232
- C:\Windows\System32\EmCXNks.exe
  C:\Windows\System32\EmCXNks.exe
  2⤵
  PID:6348
- C:\Windows\System32\OYUTUjq.exe
  C:\Windows\System32\OYUTUjq.exe
  2⤵
  PID:6412
- C:\Windows\System32\vfsvciD.exe
  C:\Windows\System32\vfsvciD.exe
  2⤵
  PID:6452
- C:\Windows\System32\yKUbmGG.exe
  C:\Windows\System32\yKUbmGG.exe
  2⤵
  PID:6532
- C:\Windows\System32\xRigxmO.exe
  C:\Windows\System32\xRigxmO.exe
  2⤵
  PID:6580
- C:\Windows\System32\FcoblQn.exe
  C:\Windows\System32\FcoblQn.exe
  2⤵
  PID:6644
- C:\Windows\System32\NhCFFAj.exe
  C:\Windows\System32\NhCFFAj.exe
  2⤵
  PID:6688
- C:\Windows\System32\sQOhlEx.exe
  C:\Windows\System32\sQOhlEx.exe
  2⤵
  PID:6768
- C:\Windows\System32\TolXaDN.exe
  C:\Windows\System32\TolXaDN.exe
  2⤵
  PID:6900
- C:\Windows\System32\pOJATJy.exe
  C:\Windows\System32\pOJATJy.exe
  2⤵
  PID:6936
- C:\Windows\System32\oTbWWnz.exe
  C:\Windows\System32\oTbWWnz.exe
  2⤵
  PID:7024
- C:\Windows\System32\LqGeNxx.exe
  C:\Windows\System32\LqGeNxx.exe
  2⤵
  PID:7080
- C:\Windows\System32\aAiWvjV.exe
  C:\Windows\System32\aAiWvjV.exe
  2⤵
  PID:7112
- C:\Windows\System32\MzqlEaJ.exe
  C:\Windows\System32\MzqlEaJ.exe
  2⤵
  PID:7160
- C:\Windows\System32\HpruVTg.exe
  C:\Windows\System32\HpruVTg.exe
  2⤵
  PID:6208
- C:\Windows\System32\pzgLZfF.exe
  C:\Windows\System32\pzgLZfF.exe
  2⤵
  PID:6248
- C:\Windows\System32\hlNbEQq.exe
  C:\Windows\System32\hlNbEQq.exe
  2⤵
  PID:6684
- C:\Windows\System32\VfacexP.exe
  C:\Windows\System32\VfacexP.exe
  2⤵
  PID:6848
- C:\Windows\System32\PGUocpE.exe
  C:\Windows\System32\PGUocpE.exe
  2⤵
  PID:6960
- C:\Windows\System32\qjKvoCL.exe
  C:\Windows\System32\qjKvoCL.exe
  2⤵
  PID:7132
- C:\Windows\System32\tNgOGss.exe
  C:\Windows\System32\tNgOGss.exe
  2⤵
  PID:6204
- C:\Windows\System32\KsAquqC.exe
  C:\Windows\System32\KsAquqC.exe
  2⤵
  PID:6436
- C:\Windows\System32\xxCFBxL.exe
  C:\Windows\System32\xxCFBxL.exe
  2⤵
  PID:6988
- C:\Windows\System32\UuuVRAr.exe
  C:\Windows\System32\UuuVRAr.exe
  2⤵
  PID:6500
- C:\Windows\System32\FQDanKe.exe
  C:\Windows\System32\FQDanKe.exe
  2⤵
  PID:7180
- C:\Windows\System32\mvFFLPH.exe
  C:\Windows\System32\mvFFLPH.exe
  2⤵
  PID:7212
- C:\Windows\System32\QyPudSq.exe
  C:\Windows\System32\QyPudSq.exe
  2⤵
  PID:7240
- C:\Windows\System32\NWqQdli.exe
  C:\Windows\System32\NWqQdli.exe
  2⤵
  PID:7256
- C:\Windows\System32\RXLIZmf.exe
  C:\Windows\System32\RXLIZmf.exe
  2⤵
  PID:7288
- C:\Windows\System32\bQBijPH.exe
  C:\Windows\System32\bQBijPH.exe
  2⤵
  PID:7324
- C:\Windows\System32\RIpmFxn.exe
  C:\Windows\System32\RIpmFxn.exe
  2⤵
  PID:7340
- C:\Windows\System32\nTMpGgV.exe
  C:\Windows\System32\nTMpGgV.exe
  2⤵
  PID:7360
- C:\Windows\System32\SMpFrtO.exe
  C:\Windows\System32\SMpFrtO.exe
  2⤵
  PID:7380
- C:\Windows\System32\hsKeDxY.exe
  C:\Windows\System32\hsKeDxY.exe
  2⤵
  PID:7400
- C:\Windows\System32\FqOIAGa.exe
  C:\Windows\System32\FqOIAGa.exe
  2⤵
  PID:7432
- C:\Windows\System32\eiYVgCa.exe
  C:\Windows\System32\eiYVgCa.exe
  2⤵
  PID:7452
- C:\Windows\System32\VUYAosn.exe
  C:\Windows\System32\VUYAosn.exe
  2⤵
  PID:7520
- C:\Windows\System32\nalHoPe.exe
  C:\Windows\System32\nalHoPe.exe
  2⤵
  PID:7548
- C:\Windows\System32\oaexOdZ.exe
  C:\Windows\System32\oaexOdZ.exe
  2⤵
  PID:7568
- C:\Windows\System32\eqOKuzp.exe
  C:\Windows\System32\eqOKuzp.exe
  2⤵
  PID:7592
- C:\Windows\System32\FrcsNYN.exe
  C:\Windows\System32\FrcsNYN.exe
  2⤵
  PID:7640
- C:\Windows\System32\lPDdLTM.exe
  C:\Windows\System32\lPDdLTM.exe
  2⤵
  PID:7676
- C:\Windows\System32\xAUanYW.exe
  C:\Windows\System32\xAUanYW.exe
  2⤵
  PID:7708
- C:\Windows\System32\nTvNMvj.exe
  C:\Windows\System32\nTvNMvj.exe
  2⤵
  PID:7732
- C:\Windows\System32\SRjnqEV.exe
  C:\Windows\System32\SRjnqEV.exe
  2⤵
  PID:7756
- C:\Windows\System32\NPSSsEn.exe
  C:\Windows\System32\NPSSsEn.exe
  2⤵
  PID:7776
- C:\Windows\System32\noiSDvm.exe
  C:\Windows\System32\noiSDvm.exe
  2⤵
  PID:7796
- C:\Windows\System32\LjbttzE.exe
  C:\Windows\System32\LjbttzE.exe
  2⤵
  PID:7816
- C:\Windows\System32\JxFRnKK.exe
  C:\Windows\System32\JxFRnKK.exe
  2⤵
  PID:7840
- C:\Windows\System32\dxplhEH.exe
  C:\Windows\System32\dxplhEH.exe
  2⤵
  PID:7868
- C:\Windows\System32\UQYLmej.exe
  C:\Windows\System32\UQYLmej.exe
  2⤵
  PID:7912
- C:\Windows\System32\rhhufiv.exe
  C:\Windows\System32\rhhufiv.exe
  2⤵
  PID:7944
- C:\Windows\System32\GlxbCNl.exe
  C:\Windows\System32\GlxbCNl.exe
  2⤵
  PID:7976
- C:\Windows\System32\rEiTCOQ.exe
  C:\Windows\System32\rEiTCOQ.exe
  2⤵
  PID:8024
- C:\Windows\System32\ItEJjTp.exe
  C:\Windows\System32\ItEJjTp.exe
  2⤵
  PID:8052
- C:\Windows\System32\EwEfIUj.exe
  C:\Windows\System32\EwEfIUj.exe
  2⤵
  PID:8076
- C:\Windows\System32\VrbBuZl.exe
  C:\Windows\System32\VrbBuZl.exe
  2⤵
  PID:8092
- C:\Windows\System32\qcALiSs.exe
  C:\Windows\System32\qcALiSs.exe
  2⤵
  PID:8124
- C:\Windows\System32\PTAUOhH.exe
  C:\Windows\System32\PTAUOhH.exe
  2⤵
  PID:8176
- C:\Windows\System32\CSUHYrj.exe
  C:\Windows\System32\CSUHYrj.exe
  2⤵
  PID:7148
- C:\Windows\System32\sMohbGM.exe
  C:\Windows\System32\sMohbGM.exe
  2⤵
  PID:5940
- C:\Windows\System32\YOwQeBN.exe
  C:\Windows\System32\YOwQeBN.exe
  2⤵
  PID:7224
- C:\Windows\System32\bknhZhK.exe
  C:\Windows\System32\bknhZhK.exe
  2⤵
  PID:7296
- C:\Windows\System32\BkTMlvj.exe
  C:\Windows\System32\BkTMlvj.exe
  2⤵
  PID:7412
- C:\Windows\System32\jZGHNST.exe
  C:\Windows\System32\jZGHNST.exe
  2⤵
  PID:7468
- C:\Windows\System32\soKVFsW.exe
  C:\Windows\System32\soKVFsW.exe
  2⤵
  PID:7448
- C:\Windows\System32\loeDhyo.exe
  C:\Windows\System32\loeDhyo.exe
  2⤵
  PID:7576
- C:\Windows\System32\LaPHOjk.exe
  C:\Windows\System32\LaPHOjk.exe
  2⤵
  PID:7608
- C:\Windows\System32\hQiVsna.exe
  C:\Windows\System32\hQiVsna.exe
  2⤵
  PID:7688
- C:\Windows\System32\cLzYtvV.exe
  C:\Windows\System32\cLzYtvV.exe
  2⤵
  PID:7772
- C:\Windows\System32\KivVtag.exe
  C:\Windows\System32\KivVtag.exe
  2⤵
  PID:7788
- C:\Windows\System32\SsTjdxF.exe
  C:\Windows\System32\SsTjdxF.exe
  2⤵
  PID:7808
- C:\Windows\System32\RMjJIAR.exe
  C:\Windows\System32\RMjJIAR.exe
  2⤵
  PID:7956
- C:\Windows\System32\sqbSFmP.exe
  C:\Windows\System32\sqbSFmP.exe
  2⤵
  PID:7996
- C:\Windows\System32\elGoCau.exe
  C:\Windows\System32\elGoCau.exe
  2⤵
  PID:8112
- C:\Windows\System32\axMXLvj.exe
  C:\Windows\System32\axMXLvj.exe
  2⤵
  PID:8116
- C:\Windows\System32\fJqwlBa.exe
  C:\Windows\System32\fJqwlBa.exe
  2⤵
  PID:8184
- C:\Windows\System32\MWXYwkI.exe
  C:\Windows\System32\MWXYwkI.exe
  2⤵
  PID:7220
- C:\Windows\System32\JeYoRLH.exe
  C:\Windows\System32\JeYoRLH.exe
  2⤵
  PID:7532
- C:\Windows\System32\RYdtMLv.exe
  C:\Windows\System32\RYdtMLv.exe
  2⤵
  PID:7748
- C:\Windows\System32\WvMDIFM.exe
  C:\Windows\System32\WvMDIFM.exe
  2⤵
  PID:7744
- C:\Windows\System32\mgptdtC.exe
  C:\Windows\System32\mgptdtC.exe
  2⤵
  PID:7992
- C:\Windows\System32\xIEhHSi.exe
  C:\Windows\System32\xIEhHSi.exe
  2⤵
  PID:8148
- C:\Windows\System32\QcWlhwc.exe
  C:\Windows\System32\QcWlhwc.exe
  2⤵
  PID:7192
- C:\Windows\System32\azXnsNu.exe
  C:\Windows\System32\azXnsNu.exe
  2⤵
  PID:7544
- C:\Windows\System32\UdjDhQr.exe
  C:\Windows\System32\UdjDhQr.exe
  2⤵
  PID:7876
- C:\Windows\System32\KrGzFwi.exe
  C:\Windows\System32\KrGzFwi.exe
  2⤵
  PID:7272
- C:\Windows\System32\JkekfGM.exe
  C:\Windows\System32\JkekfGM.exe
  2⤵
  PID:8200
- C:\Windows\System32\sCFfQdM.exe
  C:\Windows\System32\sCFfQdM.exe
  2⤵
  PID:8216
- C:\Windows\System32\LdrCFKP.exe
  C:\Windows\System32\LdrCFKP.exe
  2⤵
  PID:8244
- C:\Windows\System32\TupGsXP.exe
  C:\Windows\System32\TupGsXP.exe
  2⤵
  PID:8272
- C:\Windows\System32\vIxViVA.exe
  C:\Windows\System32\vIxViVA.exe
  2⤵
  PID:8296
- C:\Windows\System32\duJttnI.exe
  C:\Windows\System32\duJttnI.exe
  2⤵
  PID:8344
- C:\Windows\System32\RFpvqnD.exe
  C:\Windows\System32\RFpvqnD.exe
  2⤵
  PID:8360
- C:\Windows\System32\RunzLHV.exe
  C:\Windows\System32\RunzLHV.exe
  2⤵
  PID:8384
- C:\Windows\System32\cdZGAew.exe
  C:\Windows\System32\cdZGAew.exe
  2⤵
  PID:8416
- C:\Windows\System32\kGHPVbM.exe
  C:\Windows\System32\kGHPVbM.exe
  2⤵
  PID:8436
- C:\Windows\System32\EuItGSl.exe
  C:\Windows\System32\EuItGSl.exe
  2⤵
  PID:8464
- C:\Windows\System32\MmDyjCG.exe
  C:\Windows\System32\MmDyjCG.exe
  2⤵
  PID:8488
- C:\Windows\System32\xqejAcx.exe
  C:\Windows\System32\xqejAcx.exe
  2⤵
  PID:8508
- C:\Windows\System32\DLkXnbH.exe
  C:\Windows\System32\DLkXnbH.exe
  2⤵
  PID:8536
- C:\Windows\System32\YYhSjnI.exe
  C:\Windows\System32\YYhSjnI.exe
  2⤵
  PID:8556
- C:\Windows\System32\xyDKknd.exe
  C:\Windows\System32\xyDKknd.exe
  2⤵
  PID:8580
- C:\Windows\System32\daisJYd.exe
  C:\Windows\System32\daisJYd.exe
  2⤵
  PID:8596
- C:\Windows\System32\vNPCnsr.exe
  C:\Windows\System32\vNPCnsr.exe
  2⤵
  PID:8620
- C:\Windows\System32\vInWItp.exe
  C:\Windows\System32\vInWItp.exe
  2⤵
  PID:8644
- C:\Windows\System32\WTrzbaz.exe
  C:\Windows\System32\WTrzbaz.exe
  2⤵
  PID:8680
- C:\Windows\System32\bdpkYpr.exe
  C:\Windows\System32\bdpkYpr.exe
  2⤵
  PID:8712
- C:\Windows\System32\rhUmPug.exe
  C:\Windows\System32\rhUmPug.exe
  2⤵
  PID:8728
- C:\Windows\System32\xsPNgEa.exe
  C:\Windows\System32\xsPNgEa.exe
  2⤵
  PID:8760
- C:\Windows\System32\PdiEjRO.exe
  C:\Windows\System32\PdiEjRO.exe
  2⤵
  PID:8788
- C:\Windows\System32\zxpLcQS.exe
  C:\Windows\System32\zxpLcQS.exe
  2⤵
  PID:8844
- C:\Windows\System32\QKHLqjn.exe
  C:\Windows\System32\QKHLqjn.exe
  2⤵
  PID:8872
- C:\Windows\System32\mBlwavU.exe
  C:\Windows\System32\mBlwavU.exe
  2⤵
  PID:8916
- C:\Windows\System32\zZTTLYn.exe
  C:\Windows\System32\zZTTLYn.exe
  2⤵
  PID:8932
- C:\Windows\System32\xmInUlF.exe
  C:\Windows\System32\xmInUlF.exe
  2⤵
  PID:8964
- C:\Windows\System32\tDjaoTm.exe
  C:\Windows\System32\tDjaoTm.exe
  2⤵
  PID:8992
- C:\Windows\System32\FFnaAQM.exe
  C:\Windows\System32\FFnaAQM.exe
  2⤵
  PID:9020
- C:\Windows\System32\LVBPkOD.exe
  C:\Windows\System32\LVBPkOD.exe
  2⤵
  PID:9048
- C:\Windows\System32\TtGMpDb.exe
  C:\Windows\System32\TtGMpDb.exe
  2⤵
  PID:9076
- C:\Windows\System32\nKFuXfL.exe
  C:\Windows\System32\nKFuXfL.exe
  2⤵
  PID:9104
- C:\Windows\System32\heNiIaY.exe
  C:\Windows\System32\heNiIaY.exe
  2⤵
  PID:9132
- C:\Windows\System32\MoihiIZ.exe
  C:\Windows\System32\MoihiIZ.exe
  2⤵
  PID:9160
- C:\Windows\System32\dhkdSLr.exe
  C:\Windows\System32\dhkdSLr.exe
  2⤵
  PID:9188
- C:\Windows\System32\MenAFKv.exe
  C:\Windows\System32\MenAFKv.exe
  2⤵
  PID:9212
- C:\Windows\System32\NhMFpne.exe
  C:\Windows\System32\NhMFpne.exe
  2⤵
  PID:8208
- C:\Windows\System32\KvsweIw.exe
  C:\Windows\System32\KvsweIw.exe
  2⤵
  PID:8308
- C:\Windows\System32\tkTsHnI.exe
  C:\Windows\System32\tkTsHnI.exe
  2⤵
  PID:8472
- C:\Windows\System32\aPhrvox.exe
  C:\Windows\System32\aPhrvox.exe
  2⤵
  PID:8520
- C:\Windows\System32\kcFxGwW.exe
  C:\Windows\System32\kcFxGwW.exe
  2⤵
  PID:8552
- C:\Windows\System32\OLwOPCD.exe
  C:\Windows\System32\OLwOPCD.exe
  2⤵
  PID:8568
- C:\Windows\System32\YXEoKGT.exe
  C:\Windows\System32\YXEoKGT.exe
  2⤵
  PID:8592
- C:\Windows\System32\aLtzePf.exe
  C:\Windows\System32\aLtzePf.exe
  2⤵
  PID:8672
- C:\Windows\System32\zFZJWDO.exe
  C:\Windows\System32\zFZJWDO.exe
  2⤵
  PID:8744
- C:\Windows\System32\zEGbBPK.exe
  C:\Windows\System32\zEGbBPK.exe
  2⤵
  PID:8820
- C:\Windows\System32\fYxHCPs.exe
  C:\Windows\System32\fYxHCPs.exe
  2⤵
  PID:8784
- C:\Windows\System32\yfGHCyz.exe
  C:\Windows\System32\yfGHCyz.exe
  2⤵
  PID:9096
- C:\Windows\System32\sACdhqA.exe
  C:\Windows\System32\sACdhqA.exe
  2⤵
  PID:9172
- C:\Windows\System32\maJZXyw.exe
  C:\Windows\System32\maJZXyw.exe
  2⤵
  PID:8252
- C:\Windows\System32\iBvWVoN.exe
  C:\Windows\System32\iBvWVoN.exe
  2⤵
  PID:8284
- C:\Windows\System32\gXRwjCH.exe
  C:\Windows\System32\gXRwjCH.exe
  2⤵
  PID:8376
- C:\Windows\System32\UtQOpTY.exe
  C:\Windows\System32\UtQOpTY.exe
  2⤵
  PID:8476
- C:\Windows\System32\YEUhxim.exe
  C:\Windows\System32\YEUhxim.exe
  2⤵
  PID:8636
- C:\Windows\System32\JDKLPLK.exe
  C:\Windows\System32\JDKLPLK.exe
  2⤵
  PID:8692
- C:\Windows\System32\XbIaWTo.exe
  C:\Windows\System32\XbIaWTo.exe
  2⤵
  PID:8884
- C:\Windows\System32\xeNYrze.exe
  C:\Windows\System32\xeNYrze.exe
  2⤵
  PID:9128
- C:\Windows\System32\eIsLXPq.exe
  C:\Windows\System32\eIsLXPq.exe
  2⤵
  PID:8264
- C:\Windows\System32\UqQVlMW.exe
  C:\Windows\System32\UqQVlMW.exe
  2⤵
  PID:8456
- C:\Windows\System32\jVhdFhn.exe
  C:\Windows\System32\jVhdFhn.exe
  2⤵
  PID:8756
- C:\Windows\System32\EyugGfe.exe
  C:\Windows\System32\EyugGfe.exe
  2⤵
  PID:8980
- C:\Windows\System32\RxZKcRq.exe
  C:\Windows\System32\RxZKcRq.exe
  2⤵
  PID:7804
- C:\Windows\System32\KAxzjRX.exe
  C:\Windows\System32\KAxzjRX.exe
  2⤵
  PID:9000
- C:\Windows\System32\OfLcWyj.exe
  C:\Windows\System32\OfLcWyj.exe
  2⤵
  PID:9268
- C:\Windows\System32\xMbcKvP.exe
  C:\Windows\System32\xMbcKvP.exe
  2⤵
  PID:9288
- C:\Windows\System32\AQEjwVS.exe
  C:\Windows\System32\AQEjwVS.exe
  2⤵
  PID:9304
- C:\Windows\System32\zmOIlFG.exe
  C:\Windows\System32\zmOIlFG.exe
  2⤵
  PID:9340
- C:\Windows\System32\uuBQlHB.exe
  C:\Windows\System32\uuBQlHB.exe
  2⤵
  PID:9356
- C:\Windows\System32\VtmQTch.exe
  C:\Windows\System32\VtmQTch.exe
  2⤵
  PID:9400
- C:\Windows\System32\edTdfEb.exe
  C:\Windows\System32\edTdfEb.exe
  2⤵
  PID:9436
- C:\Windows\System32\ciZWSsx.exe
  C:\Windows\System32\ciZWSsx.exe
  2⤵
  PID:9476
- C:\Windows\System32\ETNYtKt.exe
  C:\Windows\System32\ETNYtKt.exe
  2⤵
  PID:9492
- C:\Windows\System32\YMICMdH.exe
  C:\Windows\System32\YMICMdH.exe
  2⤵
  PID:9512
- C:\Windows\System32\TZnHUis.exe
  C:\Windows\System32\TZnHUis.exe
  2⤵
  PID:9540
- C:\Windows\System32\pXqTnkL.exe
  C:\Windows\System32\pXqTnkL.exe
  2⤵
  PID:9560
- C:\Windows\System32\zXaIloY.exe
  C:\Windows\System32\zXaIloY.exe
  2⤵
  PID:9580
- C:\Windows\System32\ghqViPU.exe
  C:\Windows\System32\ghqViPU.exe
  2⤵
  PID:9596
- C:\Windows\System32\LCXhAfI.exe
  C:\Windows\System32\LCXhAfI.exe
  2⤵
  PID:9624
- C:\Windows\System32\XJNPZmW.exe
  C:\Windows\System32\XJNPZmW.exe
  2⤵
  PID:9680
- C:\Windows\System32\nZWwSou.exe
  C:\Windows\System32\nZWwSou.exe
  2⤵
  PID:9712
- C:\Windows\System32\xOCcIWG.exe
  C:\Windows\System32\xOCcIWG.exe
  2⤵
  PID:9728
- C:\Windows\System32\OVOQxwx.exe
  C:\Windows\System32\OVOQxwx.exe
  2⤵
  PID:9756
- C:\Windows\System32\UrSMboD.exe
  C:\Windows\System32\UrSMboD.exe
  2⤵
  PID:9792
- C:\Windows\System32\xlLyqKX.exe
  C:\Windows\System32\xlLyqKX.exe
  2⤵
  PID:9836
- C:\Windows\System32\RUtbykE.exe
  C:\Windows\System32\RUtbykE.exe
  2⤵
  PID:9868
- C:\Windows\System32\FnhfvZN.exe
  C:\Windows\System32\FnhfvZN.exe
  2⤵
  PID:9892
- C:\Windows\System32\OimQkev.exe
  C:\Windows\System32\OimQkev.exe
  2⤵
  PID:9908
- C:\Windows\System32\HqosKlG.exe
  C:\Windows\System32\HqosKlG.exe
  2⤵
  PID:9932
- C:\Windows\System32\ZRjgCBm.exe
  C:\Windows\System32\ZRjgCBm.exe
  2⤵
  PID:9956
- C:\Windows\System32\pIRiiZe.exe
  C:\Windows\System32\pIRiiZe.exe
  2⤵
  PID:9988
- C:\Windows\System32\vkpKEDj.exe
  C:\Windows\System32\vkpKEDj.exe
  2⤵
  PID:10016
- C:\Windows\System32\hOMsEcI.exe
  C:\Windows\System32\hOMsEcI.exe
  2⤵
  PID:10036
- C:\Windows\System32\jkQxwza.exe
  C:\Windows\System32\jkQxwza.exe
  2⤵
  PID:10072
- C:\Windows\System32\mVpTYaU.exe
  C:\Windows\System32\mVpTYaU.exe
  2⤵
  PID:10120
- C:\Windows\System32\dIowzOV.exe
  C:\Windows\System32\dIowzOV.exe
  2⤵
  PID:10140
- C:\Windows\System32\AhbfyJY.exe
  C:\Windows\System32\AhbfyJY.exe
  2⤵
  PID:10164
- C:\Windows\System32\etkvFto.exe
  C:\Windows\System32\etkvFto.exe
  2⤵
  PID:10196
- C:\Windows\System32\tfNYCxN.exe
  C:\Windows\System32\tfNYCxN.exe
  2⤵
  PID:10212
- C:\Windows\System32\ZGmEfuX.exe
  C:\Windows\System32\ZGmEfuX.exe
  2⤵
  PID:8212
- C:\Windows\System32\mEoLmFS.exe
  C:\Windows\System32\mEoLmFS.exe
  2⤵
  PID:9240
- C:\Windows\System32\texeWeo.exe
  C:\Windows\System32\texeWeo.exe
  2⤵
  PID:9348
- C:\Windows\System32\OmTqqiT.exe
  C:\Windows\System32\OmTqqiT.exe
  2⤵
  PID:9432
- C:\Windows\System32\FnDJanq.exe
  C:\Windows\System32\FnDJanq.exe
  2⤵
  PID:9524
- C:\Windows\System32\YjVWtLR.exe
  C:\Windows\System32\YjVWtLR.exe
  2⤵
  PID:9556
- C:\Windows\System32\YkGepKB.exe
  C:\Windows\System32\YkGepKB.exe
  2⤵
  PID:9588
- C:\Windows\System32\WdnRazx.exe
  C:\Windows\System32\WdnRazx.exe
  2⤵
  PID:9616
- C:\Windows\System32\zoQPQfW.exe
  C:\Windows\System32\zoQPQfW.exe
  2⤵
  PID:9700
- C:\Windows\System32\kDOfXSP.exe
  C:\Windows\System32\kDOfXSP.exe
  2⤵
  PID:9812
- C:\Windows\System32\lJENzvl.exe
  C:\Windows\System32\lJENzvl.exe
  2⤵
  PID:9856
- C:\Windows\System32\OvPLzvY.exe
  C:\Windows\System32\OvPLzvY.exe
  2⤵
  PID:9928
- C:\Windows\System32\eKPwBhU.exe
  C:\Windows\System32\eKPwBhU.exe
  2⤵
  PID:10004
- C:\Windows\System32\ORVcaBn.exe
  C:\Windows\System32\ORVcaBn.exe
  2⤵
  PID:10008
- C:\Windows\System32\xujvhUt.exe
  C:\Windows\System32\xujvhUt.exe
  2⤵
  PID:10108
- C:\Windows\System32\KVdSxqz.exe
  C:\Windows\System32\KVdSxqz.exe
  2⤵
  PID:10136
- C:\Windows\System32\QmlfKDb.exe
  C:\Windows\System32\QmlfKDb.exe
  2⤵
  PID:10220
- C:\Windows\System32\HSBxAeZ.exe
  C:\Windows\System32\HSBxAeZ.exe
  2⤵
  PID:9276
- C:\Windows\System32\nNtrHaO.exe
  C:\Windows\System32\nNtrHaO.exe
  2⤵
  PID:9236
- C:\Windows\System32\UuZrgkO.exe
  C:\Windows\System32\UuZrgkO.exe
  2⤵
  PID:9548
- C:\Windows\System32\LFQoLXs.exe
  C:\Windows\System32\LFQoLXs.exe
  2⤵
  PID:9748
- C:\Windows\System32\LeoNJpm.exe
  C:\Windows\System32\LeoNJpm.exe
  2⤵
  PID:9844
- C:\Windows\System32\YNklFJG.exe
  C:\Windows\System32\YNklFJG.exe
  2⤵
  PID:10028
- C:\Windows\System32\GyBgFSU.exe
  C:\Windows\System32\GyBgFSU.exe
  2⤵
  PID:10208
- C:\Windows\System32\BFgCRME.exe
  C:\Windows\System32\BFgCRME.exe
  2⤵
  PID:10180
- C:\Windows\System32\OkwOFbV.exe
  C:\Windows\System32\OkwOFbV.exe
  2⤵
  PID:9876
- C:\Windows\System32\YIpcgag.exe
  C:\Windows\System32\YIpcgag.exe
  2⤵
  PID:10268
- C:\Windows\System32\hnpvWRu.exe
  C:\Windows\System32\hnpvWRu.exe
  2⤵
  PID:10284
- C:\Windows\System32\dqFxLdI.exe
  C:\Windows\System32\dqFxLdI.exe
  2⤵
  PID:10304
- C:\Windows\System32\rHBkdrF.exe
  C:\Windows\System32\rHBkdrF.exe
  2⤵
  PID:10328
- C:\Windows\System32\hzRnDzD.exe
  C:\Windows\System32\hzRnDzD.exe
  2⤵
  PID:10352
- C:\Windows\System32\FVGKhTn.exe
  C:\Windows\System32\FVGKhTn.exe
  2⤵
  PID:10388
- C:\Windows\System32\YlZYMSV.exe
  C:\Windows\System32\YlZYMSV.exe
  2⤵
  PID:10436
- C:\Windows\System32\EbDBAVK.exe
  C:\Windows\System32\EbDBAVK.exe
  2⤵
  PID:10472
- C:\Windows\System32\ZvuxoFJ.exe
  C:\Windows\System32\ZvuxoFJ.exe
  2⤵
  PID:10504
- C:\Windows\System32\dNZWzXW.exe
  C:\Windows\System32\dNZWzXW.exe
  2⤵
  PID:10524
- C:\Windows\System32\QOOWmWN.exe
  C:\Windows\System32\QOOWmWN.exe
  2⤵
  PID:10548
- C:\Windows\System32\MriVmFY.exe
  C:\Windows\System32\MriVmFY.exe
  2⤵
  PID:10576
- C:\Windows\System32\onjABHB.exe
  C:\Windows\System32\onjABHB.exe
  2⤵
  PID:10624
- C:\Windows\System32\UCkoOkN.exe
  C:\Windows\System32\UCkoOkN.exe
  2⤵
  PID:10644
- C:\Windows\System32\iZlJVfu.exe
  C:\Windows\System32\iZlJVfu.exe
  2⤵
  PID:10676
- C:\Windows\System32\gvaWZwU.exe
  C:\Windows\System32\gvaWZwU.exe
  2⤵
  PID:10696
- C:\Windows\System32\IUrbaTm.exe
  C:\Windows\System32\IUrbaTm.exe
  2⤵
  PID:10716
- C:\Windows\System32\ibmJYik.exe
  C:\Windows\System32\ibmJYik.exe
  2⤵
  PID:10740
- C:\Windows\System32\RuJhGtS.exe
  C:\Windows\System32\RuJhGtS.exe
  2⤵
  PID:10760
- C:\Windows\System32\rEBZnhX.exe
  C:\Windows\System32\rEBZnhX.exe
  2⤵
  PID:10844
- C:\Windows\System32\NMeMYJr.exe
  C:\Windows\System32\NMeMYJr.exe
  2⤵
  PID:10860
- C:\Windows\System32\OhxFMam.exe
  C:\Windows\System32\OhxFMam.exe
  2⤵
  PID:10876
- C:\Windows\System32\aSIddPj.exe
  C:\Windows\System32\aSIddPj.exe
  2⤵
  PID:10896
- C:\Windows\System32\MeVAdBL.exe
  C:\Windows\System32\MeVAdBL.exe
  2⤵
  PID:10932
- C:\Windows\System32\vuKsNKT.exe
  C:\Windows\System32\vuKsNKT.exe
  2⤵
  PID:10948
- C:\Windows\System32\YiVclsV.exe
  C:\Windows\System32\YiVclsV.exe
  2⤵
  PID:10968
- C:\Windows\System32\opsZZxS.exe
  C:\Windows\System32\opsZZxS.exe
  2⤵
  PID:11024
- C:\Windows\System32\scmRDbP.exe
  C:\Windows\System32\scmRDbP.exe
  2⤵
  PID:11044
- C:\Windows\System32\WWXJRiY.exe
  C:\Windows\System32\WWXJRiY.exe
  2⤵
  PID:11064
- C:\Windows\System32\bOYBqAk.exe
  C:\Windows\System32\bOYBqAk.exe
  2⤵
  PID:11088
- C:\Windows\System32\LjYqjjF.exe
  C:\Windows\System32\LjYqjjF.exe
  2⤵
  PID:11120
- C:\Windows\System32\mZSPMUq.exe
  C:\Windows\System32\mZSPMUq.exe
  2⤵
  PID:11156
- C:\Windows\System32\ZqFToPz.exe
  C:\Windows\System32\ZqFToPz.exe
  2⤵
  PID:11172
- C:\Windows\System32\byCVYOW.exe
  C:\Windows\System32\byCVYOW.exe
  2⤵
  PID:11196
- C:\Windows\System32\umdpfal.exe
  C:\Windows\System32\umdpfal.exe
  2⤵
  PID:11228
- C:\Windows\System32\xpdHGRL.exe
  C:\Windows\System32\xpdHGRL.exe
  2⤵
  PID:10236
- C:\Windows\System32\sJdZJCI.exe
  C:\Windows\System32\sJdZJCI.exe
  2⤵
  PID:9968
- C:\Windows\System32\OJHoMtL.exe
  C:\Windows\System32\OJHoMtL.exe
  2⤵
  PID:10312
- C:\Windows\System32\rbWFffT.exe
  C:\Windows\System32\rbWFffT.exe
  2⤵
  PID:10316
- C:\Windows\System32\wTjJive.exe
  C:\Windows\System32\wTjJive.exe
  2⤵
  PID:5064
- C:\Windows\System32\seRaItJ.exe
  C:\Windows\System32\seRaItJ.exe
  2⤵
  PID:10456
- C:\Windows\System32\XipFZnZ.exe
  C:\Windows\System32\XipFZnZ.exe
  2⤵
  PID:10556
- C:\Windows\System32\kbggWNm.exe
  C:\Windows\System32\kbggWNm.exe
  2⤵
  PID:10636
- C:\Windows\System32\qOJdlnr.exe
  C:\Windows\System32\qOJdlnr.exe
  2⤵
  PID:10688
- C:\Windows\System32\RKmtAUZ.exe
  C:\Windows\System32\RKmtAUZ.exe
  2⤵
  PID:10736
- C:\Windows\System32\BupwPpJ.exe
  C:\Windows\System32\BupwPpJ.exe
  2⤵
  PID:10776
- C:\Windows\System32\vWioKjJ.exe
  C:\Windows\System32\vWioKjJ.exe
  2⤵
  PID:10836
- C:\Windows\System32\gThUsnM.exe
  C:\Windows\System32\gThUsnM.exe
  2⤵
  PID:10868
- C:\Windows\System32\mgzOuMe.exe
  C:\Windows\System32\mgzOuMe.exe
  2⤵
  PID:10916
- C:\Windows\System32\eSecUlW.exe
  C:\Windows\System32\eSecUlW.exe
  2⤵
  PID:10940
- C:\Windows\System32\ZGZAEQD.exe
  C:\Windows\System32\ZGZAEQD.exe
  2⤵
  PID:11036
- C:\Windows\System32\mKoafsx.exe
  C:\Windows\System32\mKoafsx.exe
  2⤵
  PID:11060
- C:\Windows\System32\cxTmwlS.exe
  C:\Windows\System32\cxTmwlS.exe
  2⤵
  PID:11148
- C:\Windows\System32\dqkaULh.exe
  C:\Windows\System32\dqkaULh.exe
  2⤵
  PID:11180
- C:\Windows\System32\DzYmity.exe
  C:\Windows\System32\DzYmity.exe
  2⤵
  PID:11220
- C:\Windows\System32\CxsQgYy.exe
  C:\Windows\System32\CxsQgYy.exe
  2⤵
  PID:9648
- C:\Windows\System32\tpzNWVz.exe
  C:\Windows\System32\tpzNWVz.exe
  2⤵
  PID:4260
- C:\Windows\System32\xVdKSIG.exe
  C:\Windows\System32\xVdKSIG.exe
  2⤵
  PID:10432
- C:\Windows\System32\RGJEcJw.exe
  C:\Windows\System32\RGJEcJw.exe
  2⤵
  PID:2296
- C:\Windows\System32\KocUdQq.exe
  C:\Windows\System32\KocUdQq.exe
  2⤵
  PID:10872
- C:\Windows\System32\VNtfZIl.exe
  C:\Windows\System32\VNtfZIl.exe
  2⤵
  PID:3492
- C:\Windows\System32\JoOsbwo.exe
  C:\Windows\System32\JoOsbwo.exe
  2⤵
  PID:11100
- C:\Windows\System32\PcmpHpC.exe
  C:\Windows\System32\PcmpHpC.exe
  2⤵
  PID:10280
- C:\Windows\System32\ZQmPgoW.exe
  C:\Windows\System32\ZQmPgoW.exe
  2⤵
  PID:10276
- C:\Windows\System32\SSYgrKX.exe
  C:\Windows\System32\SSYgrKX.exe
  2⤵
  PID:10588
- C:\Windows\System32\aWEVLQd.exe
  C:\Windows\System32\aWEVLQd.exe
  2⤵
  PID:4612
- C:\Windows\System32\YjBrNZz.exe
  C:\Windows\System32\YjBrNZz.exe
  2⤵
  PID:11016
- C:\Windows\System32\XBHAhkt.exe
  C:\Windows\System32\XBHAhkt.exe
  2⤵
  PID:2684
- C:\Windows\System32\dnFZzar.exe
  C:\Windows\System32\dnFZzar.exe
  2⤵
  PID:11072
- C:\Windows\System32\UYkGAbe.exe
  C:\Windows\System32\UYkGAbe.exe
  2⤵
  PID:11272
- C:\Windows\System32\KQeaBzz.exe
  C:\Windows\System32\KQeaBzz.exe
  2⤵
  PID:11300
- C:\Windows\System32\XBvrNyk.exe
  C:\Windows\System32\XBvrNyk.exe
  2⤵
  PID:11328
- C:\Windows\System32\csGFrXX.exe
  C:\Windows\System32\csGFrXX.exe
  2⤵
  PID:11380
- C:\Windows\System32\gxpQexE.exe
  C:\Windows\System32\gxpQexE.exe
  2⤵
  PID:11396
- C:\Windows\System32\GwaiiyS.exe
  C:\Windows\System32\GwaiiyS.exe
  2⤵
  PID:11432
- C:\Windows\System32\edomRFJ.exe
  C:\Windows\System32\edomRFJ.exe
  2⤵
  PID:11452
- C:\Windows\System32\yjjPSoT.exe
  C:\Windows\System32\yjjPSoT.exe
  2⤵
  PID:11468
- C:\Windows\System32\hWwZRGY.exe
  C:\Windows\System32\hWwZRGY.exe
  2⤵
  PID:11488
- C:\Windows\System32\xbGULsJ.exe
  C:\Windows\System32\xbGULsJ.exe
  2⤵
  PID:11524
- C:\Windows\System32\NQQPRDx.exe
  C:\Windows\System32\NQQPRDx.exe
  2⤵
  PID:11572
- C:\Windows\System32\OztJcou.exe
  C:\Windows\System32\OztJcou.exe
  2⤵
  PID:11604
- C:\Windows\System32\WMSvjkc.exe
  C:\Windows\System32\WMSvjkc.exe
  2⤵
  PID:11648
- C:\Windows\System32\ViFfksg.exe
  C:\Windows\System32\ViFfksg.exe
  2⤵
  PID:11680
- C:\Windows\System32\makmoPC.exe
  C:\Windows\System32\makmoPC.exe
  2⤵
  PID:11700
- C:\Windows\System32\mTNqCHU.exe
  C:\Windows\System32\mTNqCHU.exe
  2⤵
  PID:11728
- C:\Windows\System32\AMtdziI.exe
  C:\Windows\System32\AMtdziI.exe
  2⤵
  PID:11744
- C:\Windows\System32\udJpHUP.exe
  C:\Windows\System32\udJpHUP.exe
  2⤵
  PID:11764
- C:\Windows\System32\RMpMuLa.exe
  C:\Windows\System32\RMpMuLa.exe
  2⤵
  PID:11812
- C:\Windows\System32\hiTBAwh.exe
  C:\Windows\System32\hiTBAwh.exe
  2⤵
  PID:11828
- C:\Windows\System32\DZcOXmE.exe
  C:\Windows\System32\DZcOXmE.exe
  2⤵
  PID:11848
- C:\Windows\System32\JrFazFD.exe
  C:\Windows\System32\JrFazFD.exe
  2⤵
  PID:11872
- C:\Windows\System32\dNomuWj.exe
  C:\Windows\System32\dNomuWj.exe
  2⤵
  PID:11900
- C:\Windows\System32\LUpEvVe.exe
  C:\Windows\System32\LUpEvVe.exe
  2⤵
  PID:11928
- C:\Windows\System32\kbWLHHb.exe
  C:\Windows\System32\kbWLHHb.exe
  2⤵
  PID:11944
- C:\Windows\System32\rrlQlOr.exe
  C:\Windows\System32\rrlQlOr.exe
  2⤵
  PID:12008
- C:\Windows\System32\AJnzbir.exe
  C:\Windows\System32\AJnzbir.exe
  2⤵
  PID:12044
- C:\Windows\System32\dzaROrV.exe
  C:\Windows\System32\dzaROrV.exe
  2⤵
  PID:12076
- C:\Windows\System32\UsigbgQ.exe
  C:\Windows\System32\UsigbgQ.exe
  2⤵
  PID:12096
- C:\Windows\System32\nHXIvyn.exe
  C:\Windows\System32\nHXIvyn.exe
  2⤵
  PID:12120
- C:\Windows\System32\ZhTrvJY.exe
  C:\Windows\System32\ZhTrvJY.exe
  2⤵
  PID:12136
- C:\Windows\System32\zFQFYmM.exe
  C:\Windows\System32\zFQFYmM.exe
  2⤵
  PID:12168
- C:\Windows\System32\hGhXPbM.exe
  C:\Windows\System32\hGhXPbM.exe
  2⤵
  PID:12212
- C:\Windows\System32\yBlEiyY.exe
  C:\Windows\System32\yBlEiyY.exe
  2⤵
  PID:12240
- C:\Windows\System32\sPAIuzl.exe
  C:\Windows\System32\sPAIuzl.exe
  2⤵
  PID:12260
- C:\Windows\System32\LkpKTRt.exe
  C:\Windows\System32\LkpKTRt.exe
  2⤵
  PID:12280
- C:\Windows\System32\RSsqAWQ.exe
  C:\Windows\System32\RSsqAWQ.exe
  2⤵
  PID:3932
- C:\Windows\System32\GXxcrWk.exe
  C:\Windows\System32\GXxcrWk.exe
  2⤵
  PID:11324
- C:\Windows\System32\mXZAmPX.exe
  C:\Windows\System32\mXZAmPX.exe
  2⤵
  PID:11360
- C:\Windows\System32\AcDaGTl.exe
  C:\Windows\System32\AcDaGTl.exe
  2⤵
  PID:5092
- C:\Windows\System32\QtYmoXe.exe
  C:\Windows\System32\QtYmoXe.exe
  2⤵
  PID:11484
- C:\Windows\System32\MtxmPaU.exe
  C:\Windows\System32\MtxmPaU.exe
  2⤵
  PID:11600
- C:\Windows\System32\AsuXbvp.exe
  C:\Windows\System32\AsuXbvp.exe
  2⤵
  PID:11624
- C:\Windows\System32\mBTlmpN.exe
  C:\Windows\System32\mBTlmpN.exe
  2⤵
  PID:11692
- C:\Windows\System32\juQuNKc.exe
  C:\Windows\System32\juQuNKc.exe
  2⤵
  PID:11760
- C:\Windows\System32\gJPvJsA.exe
  C:\Windows\System32\gJPvJsA.exe
  2⤵
  PID:11844
- C:\Windows\System32\gJMCyEe.exe
  C:\Windows\System32\gJMCyEe.exe
  2⤵
  PID:11840
- C:\Windows\System32\fklmqEn.exe
  C:\Windows\System32\fklmqEn.exe
  2⤵
  PID:11916
- C:\Windows\System32\fTPChpR.exe
  C:\Windows\System32\fTPChpR.exe
  2⤵
  PID:11996
- C:\Windows\System32\PZamxNI.exe
  C:\Windows\System32\PZamxNI.exe
  2⤵
  PID:12084
- C:\Windows\System32\rJUUbVs.exe
  C:\Windows\System32\rJUUbVs.exe
  2⤵
  PID:12132
- C:\Windows\System32\ynwOXdV.exe
  C:\Windows\System32\ynwOXdV.exe
  2⤵
  PID:12220
- C:\Windows\System32\vJDTTjh.exe
  C:\Windows\System32\vJDTTjh.exe
  2⤵
  PID:4176
- C:\Windows\System32\KxTVHuu.exe
  C:\Windows\System32\KxTVHuu.exe
  2⤵
  PID:11408
- C:\Windows\System32\AwsPaXx.exe
  C:\Windows\System32\AwsPaXx.exe
  2⤵
  PID:11340
- C:\Windows\System32\vNNPNXZ.exe
  C:\Windows\System32\vNNPNXZ.exe
  2⤵
  PID:3084
- C:\Windows\System32\LAeBbcr.exe
  C:\Windows\System32\LAeBbcr.exe
  2⤵
  PID:11796
- C:\Windows\System32\zISmNOQ.exe
  C:\Windows\System32\zISmNOQ.exe
  2⤵
  PID:11912
- C:\Windows\System32\GUVDzvc.exe
  C:\Windows\System32\GUVDzvc.exe
  2⤵
  PID:12016
- C:\Windows\System32\QGDsoPN.exe
  C:\Windows\System32\QGDsoPN.exe
  2⤵
  PID:12256
- C:\Windows\System32\EaBFray.exe
  C:\Windows\System32\EaBFray.exe
  2⤵
  PID:4460
- C:\Windows\System32\SndsMdF.exe
  C:\Windows\System32\SndsMdF.exe
  2⤵
  PID:11940
- C:\Windows\System32\aOGcfuv.exe
  C:\Windows\System32\aOGcfuv.exe
  2⤵
  PID:12024
- C:\Windows\System32\HbLQJnL.exe
  C:\Windows\System32\HbLQJnL.exe
  2⤵
  PID:11424
- C:\Windows\System32\HOjRjOI.exe
  C:\Windows\System32\HOjRjOI.exe
  2⤵
  PID:4704
- C:\Windows\System32\xwuKCWJ.exe
  C:\Windows\System32\xwuKCWJ.exe
  2⤵
  PID:11460
- C:\Windows\System32\rXhHemx.exe
  C:\Windows\System32\rXhHemx.exe
  2⤵
  PID:4556
- C:\Windows\System32\GEDpqZH.exe
  C:\Windows\System32\GEDpqZH.exe
  2⤵
  PID:12312
- C:\Windows\System32\FKcvwCL.exe
  C:\Windows\System32\FKcvwCL.exe
  2⤵
  PID:12328
- C:\Windows\System32\XxzJYyp.exe
  C:\Windows\System32\XxzJYyp.exe
  2⤵
  PID:12356
- C:\Windows\System32\wWuCoFU.exe
  C:\Windows\System32\wWuCoFU.exe
  2⤵
  PID:12392
- C:\Windows\System32\tnapRvR.exe
  C:\Windows\System32\tnapRvR.exe
  2⤵
  PID:12412
- C:\Windows\System32\dcRdVwB.exe
  C:\Windows\System32\dcRdVwB.exe
  2⤵
  PID:12432
- C:\Windows\System32\oKQFXEV.exe
  C:\Windows\System32\oKQFXEV.exe
  2⤵
  PID:12452
- C:\Windows\System32\QJIscYe.exe
  C:\Windows\System32\QJIscYe.exe
  2⤵
  PID:12488
- C:\Windows\System32\QDSLCeI.exe
  C:\Windows\System32\QDSLCeI.exe
  2⤵
  PID:12528
- C:\Windows\System32\QWYadso.exe
  C:\Windows\System32\QWYadso.exe
  2⤵
  PID:12552
- C:\Windows\System32\dNlkPQo.exe
  C:\Windows\System32\dNlkPQo.exe
  2⤵
  PID:12572
- C:\Windows\System32\MynrvNA.exe
  C:\Windows\System32\MynrvNA.exe
  2⤵
  PID:12596
- C:\Windows\System32\wvmhskG.exe
  C:\Windows\System32\wvmhskG.exe
  2⤵
  PID:12652
- C:\Windows\System32\GSENQJR.exe
  C:\Windows\System32\GSENQJR.exe
  2⤵
  PID:12676
- C:\Windows\System32\mqEWPIk.exe
  C:\Windows\System32\mqEWPIk.exe
  2⤵
  PID:12692
- C:\Windows\System32\uyKtXzm.exe
  C:\Windows\System32\uyKtXzm.exe
  2⤵
  PID:12712
- C:\Windows\System32\tSVKxmh.exe
  C:\Windows\System32\tSVKxmh.exe
  2⤵
  PID:12736
- C:\Windows\System32\MZlSoic.exe
  C:\Windows\System32\MZlSoic.exe
  2⤵
  PID:12764
- C:\Windows\System32\aYnKOJO.exe
  C:\Windows\System32\aYnKOJO.exe
  2⤵
  PID:12792
- C:\Windows\System32\UUSWtSt.exe
  C:\Windows\System32\UUSWtSt.exe
  2⤵
  PID:12816
- C:\Windows\System32\RzJZcXw.exe
  C:\Windows\System32\RzJZcXw.exe
  2⤵
  PID:12848
- C:\Windows\System32\rWRpyrg.exe
  C:\Windows\System32\rWRpyrg.exe
  2⤵
  PID:12880
- C:\Windows\System32\JHVrqcN.exe
  C:\Windows\System32\JHVrqcN.exe
  2⤵
  PID:12928
- C:\Windows\System32\zRyeErB.exe
  C:\Windows\System32\zRyeErB.exe
  2⤵
  PID:12948
- C:\Windows\System32\MCzeNwi.exe
  C:\Windows\System32\MCzeNwi.exe
  2⤵
  PID:12972
- C:\Windows\System32\rSAppRS.exe
  C:\Windows\System32\rSAppRS.exe
  2⤵
  PID:12992
- C:\Windows\System32\qGdIdbc.exe
  C:\Windows\System32\qGdIdbc.exe
  2⤵
  PID:13016
- C:\Windows\System32\QTCKpZD.exe
  C:\Windows\System32\QTCKpZD.exe
  2⤵
  PID:13060
- C:\Windows\System32\ESmvSsw.exe
  C:\Windows\System32\ESmvSsw.exe
  2⤵
  PID:13076
- C:\Windows\System32\vRAqAdC.exe
  C:\Windows\System32\vRAqAdC.exe
  2⤵
  PID:13104
- C:\Windows\System32\JnNkZhg.exe
  C:\Windows\System32\JnNkZhg.exe
  2⤵
  PID:13128
- C:\Windows\System32\ckDkMWl.exe
  C:\Windows\System32\ckDkMWl.exe
  2⤵
  PID:13148
- C:\Windows\System32\IBauYaO.exe
  C:\Windows\System32\IBauYaO.exe
  2⤵
  PID:13168
- C:\Windows\System32\gDBshMb.exe
  C:\Windows\System32\gDBshMb.exe
  2⤵
  PID:13200
- C:\Windows\System32\ztxLyRV.exe
  C:\Windows\System32\ztxLyRV.exe
  2⤵
  PID:13216
- C:\Windows\System32\VUdCcgx.exe
  C:\Windows\System32\VUdCcgx.exe
  2⤵
  PID:13236
- C:\Windows\System32\XWzIjaZ.exe
  C:\Windows\System32\XWzIjaZ.exe
  2⤵
  PID:13256
- C:\Windows\System32\pLLEjWy.exe
  C:\Windows\System32\pLLEjWy.exe
  2⤵
  PID:13308
- C:\Windows\System32\ukzqvPP.exe
  C:\Windows\System32\ukzqvPP.exe
  2⤵
  PID:11696
- C:\Windows\System32\KSVnaSi.exe
  C:\Windows\System32\KSVnaSi.exe
  2⤵
  PID:12440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BfEEKnw.exe

Path C:\Windows\System32\BfEEKnw.exe
Size 1.8MB
SHA256 cd671bd9860950c2c96a68f26966fc10f5c9d6c325bf05b935c9d60c44d761ed
MD5 56f3c6bad67dd24f98d7d7594e108011
SHA1 7464524cef0a54c52d4606f46437fcca2ad215bc
SHA512 a7b5d9bae43d947c190e26b67d18c54f5bda4baa9c104b8ebbf44253367cc3f1efa2d12bfb504e317b90c2a998e7047acd5e184a86a6b85ae7c275d760c4a711
SSDEEP 49152:knw9oUUEEDlGUJ8Y9c87MQyRjdF5zkrag8:kQUEEji
MD5 SHA1 SHA512 SSDEEP

Submit Download

ChrKuhO.exe

Path C:\Windows\System32\ChrKuhO.exe
Size 1.8MB
SHA256 ffa5425faaa7111795d1a603fdc99f5600dc33ed6864db5b512152e2256e2b78
MD5 70a4b330066bf81bcdacf4db9769ce10
SHA1 d7f70b012a5cc86aca31b821246da6573cd48075
SHA512 1ca23956fe8c8b5bed07ff18eadca180ebc72c9bc0f4c150411a1737554de7ad0977aea3f609a0718d4ea17f605fc82b66caa76171838b180cf6bddbb7fa9f30
SSDEEP 49152:knw9oUUEEDlGUJ8Y9c87MQyRjdF5zkrag4:kQUEEjC
MD5 SHA1 SHA512 SSDEEP

Submit Download

DHNJjTP.exe

Path C:\Windows\System32\DHNJjTP.exe
Size 1.8MB
SHA256 0b6494cd8b93adb88010ddffa216fcfa03f7ebffbab002ef8aaea0e790460ce8
MD5 bbe05fb2025efee69767fb332cce3b71
SHA1 9ed39dd41fca318ae67b4b8d48d56c728bd9c119
SHA512 b7355c89cb0e62e42e2870e406f19f44e0e90db2354c843262b45dedb4505926e76b2cfb820f14a65f0ec5e62bbd159080c93540e74006dfc07b4fb3ee76d945
SSDEEP 49152:knw9oUUEEDlGUJ8Y9c87MQyRjdF5zkragy:kQUEEjI
MD5 SHA1 SHA512 SSDEEP

Submit Download

EAEzTlA.exe

Path C:\Windows\System32\EAEzTlA.exe
Size 1.8MB
SHA256 7b2a77c7d7e92236b7b6cd77fa59b00c5c4cbd7b8ac4f92c8693b41367a9f320
MD5 60f1d44cfe899874bdcfb2c898339ddd
SHA1 449e17b84528f2b13931c7738260ea0824140ecd
SHA512 02206a434e1c52f17bdf337ae9fc133b341002ad320a5105e675a7cf323fda19c1ef50494e2a4a84b1971c626df41320f46b84dd5e760ffdc1ea9f3aed7992eb
SSDEEP 49152:knw9oUUEEDlGUJ8Y9c87MQyRjdF5zkragO:kQUEEjc
MD5 SHA1 SHA512 SSDEEP

Submit Download

EkXEAVo.exe

Path C:\Windows\System32\EkXEAVo.exe
Size 1.8MB
SHA256 7e2084015119d01c0f715814395615d8108d6ed8a5c3c10e9d3b7fc0c77ee777
MD5 d3353ce8779f8e40395edc0b2bd9a884
SHA1 a1d0a3329f7e6b07d65e8a117c237a356af23a43
SHA512 98611d51fd90d9ed637b7fdd37c747db052f49e07283e2986f7c16e5c1746ea865e04864b8fdf8fb9e1b973ad865cece2e907fb54d12c0377fb5db2c7c02f705
SSDEEP 49152:knw9oUUEEDlGUJ8Y9c87MQyRjdF5zkragV:kQUEEjf
MD5 SHA1 SHA512 SSDEEP

Submit Download

MmQshRb.exe

Path C:\Windows\System32\MmQshRb.exe
Size 1.8MB
SHA256 b977c4b03e7800f5061b4ba70c2a8af616fe6d28142f9e931582f27f89964b5a
MD5 40d5b0a23070cdf67ebcc4d95cbea1d4
SHA1 53bf5005a17f4e29b03217ba641717f2366718d5
SHA512 1343e6ba80de9e534cb0cf831bf2e1b40002ed8860016d86ac1a2368330ad0e2fec3a47e5f90d75c6a251708b074bdfc4ea1a4d0e5c11ef0204a20fff85762db
SSDEEP 49152:knw9oUUEEDlGUJ8Y9c87MQyRjdF5zkragi:kQUEEj4
MD5 SHA1 SHA512 SSDEEP

Submit Download

TyiZOCw.exe

Path C:\Windows\System32\TyiZOCw.exe
Size 1.8MB
SHA256 f4575b25069ec4bccccdecd207aeb3586ecee38a5f2aa0e529d9bb2b2f03f076
MD5 d740b94df233d9aaff8ecf4d9e1fb5cd
SHA1 5b2b3ed1aacf24dddcb955aa5b07777de8bbe2bc
SHA512 aef031093923c5cc28a4b3015dcaf7f8b57a992c3bf7cdb0435b8284ceb19c35b6c5cf52b93406287aedd608142beb35295c49260801cd1f99d98ca9c410a6bb
SSDEEP 49152:knw9oUUEEDlGUJ8Y9c87MQyRjdF5zkragQ:kQUEEjy
MD5 SHA1 SHA512 SSDEEP

Submit Download

WozudaE.exe

Path C:\Windows\System32\WozudaE.exe
Size 1.8MB
SHA256 f92807c25d3533a574989bdae0f2c7fcf4b3961feef351c279706485b0bd3080
MD5 f36108de25072dcec0bbaaf619ce9193
SHA1 73ea32417f609d9ca02fd2f82da5f5eaaabf6bb9
SHA512 7b2d0f5a5fe0b623b86ceeef50c7ddb03a2d4842fc0bec1ca9db0c7ea777a50b21645e707ee018359b840687b360b83f9b5afbb2ed0ce2203e478ba14e05ab6f
SSDEEP 49152:knw9oUUEEDlGUJ8Y9c87MQyRjdF5zkragi:kQUEEjM
MD5 SHA1 SHA512 SSDEEP

Submit Download

XRkUcEY.exe

Path C:\Windows\System32\XRkUcEY.exe
Size 1.8MB
SHA256 238ae0a3a3ad9ee201cfc2f0a7c200ed259a25522aa3393dfbbfbbec91d19350
MD5 e561f02d657e24b99cc10d6c14a59480
SHA1 9c69cffb3a0022d8f5a457e1eaebfdf3190bed2e
SHA512 e62b9010b89ba014c7677c39a05f77aa54d1a56da25a7256ccbdc599619092dd43d4a892d6b863968db2b9076fb6c0b9e5cbe01f99c621be30767ecd27d107ad
SSDEEP 49152:knw9oUUEEDlGUJ8Y9c87MQyRjdF5zkragL:kQUEEjB
MD5 SHA1 SHA512 SSDEEP

Submit Download

XfZHeCj.exe

Path C:\Windows\System32\XfZHeCj.exe
Size 1.8MB
SHA256 903828f0cf8f2502875dd87a5bd83254441ea59235dc8481c296b24f4be918ee
MD5 69b8330d2e665291c3bf918e15d787bf
SHA1 8a787d67888abc07ba38dbfdd1b0745adcd0004d
SHA512 e0b3111d4472919c1442f17f1f5157581365b9e8a60bf35a1788fd2c0cdbfcd3f88f2071e4d649ec24704a657582fd584ea87e1bb2820eb768979b55330ce008
SSDEEP 49152:knw9oUUEEDlGUJ8Y9c87MQyRjdF5zkrag5:kQUEEjD
MD5 SHA1 SHA512 SSDEEP

Submit Download

YJMQWGu.exe

Path C:\Windows\System32\YJMQWGu.exe
Size 1.8MB
SHA256 c19a3e59b815a26fda5da2aa522eb83c47453f8eb4d1e77e5a8238d0c1564b13
MD5 91bb15fab77037963cc48dcd9d9dc475
SHA1 0fd15d154cc8d4b53f1be17e9e01ac29644bafdd
SHA512 3c1ce1a87a5a6c410d73eba92d0142cb64a59b1695d2a201f712121cd26d3f8f1ab3025d7a207347404e9adf830573a1c7840e7b72cfd397af1e6c4ea1358e7c
SSDEEP 49152:knw9oUUEEDlGUJ8Y9c87MQyRjdF5zkrag2:kQUEEjc
MD5 SHA1 SHA512 SSDEEP

Submit Download

aqQrcPU.exe

Path C:\Windows\System32\aqQrcPU.exe
Size 1.8MB
SHA256 82c1ac65aff42df947bc5cab338ef8c317ce98654f8d62804d67b3f14430fdb9
MD5 880de437204799e2e217112fbda0e775
SHA1 2f8dffee08238ef2165775aa505365dff70c8160
SHA512 704e2ea7a47f2a8bb254c9c75f8d9379e148a8a6b0fc41a835c68f263923bf5adeb7753dd533afc0965c045f914663296fe9736267debcb164a9c4cde9443d06
SSDEEP 49152:knw9oUUEEDlGUJ8Y9c87MQyRjdF5zkragn:kQUEEj9
MD5 SHA1 SHA512 SSDEEP

Submit Download

bHjQBmN.exe

Path C:\Windows\System32\bHjQBmN.exe
Size 1.8MB
SHA256 ac0d3112af39a480acb1a429d3490e85d8dbf4f9faa00ac9b51e137a7103537f
MD5 ab117c98bcd049d2b5b0bfabea73a26e
SHA1 4d277c2ca05170b0a21453e695e0d420a8fa8cce
SHA512 e6196ae67d47066a2bef0abaf9e04ab5cb38283869a733178e8cc7a4bdac62913ada33e39f9663729673ff5a6cc1cfbdd010905f18de9cdb3a5cb24eb2e31c85
SSDEEP 49152:knw9oUUEEDlGUJ8Y9c87MQyRjdF5zkragvi:kQUEEjk
MD5 SHA1 SHA512 SSDEEP

Submit Download

gECbMes.exe

Path C:\Windows\System32\gECbMes.exe
Size 1.8MB
SHA256 3aaf0c5ea2e250bbe2ff8dc0978b0963437861d17ee7d9fccbaccb4623edf499
MD5 6f51d87886756876848e371e8828670a
SHA1 4fb2e1d5480f50209153c356e0111775ed15d029
SHA512 f99fd4a427b34c48366995c87fff97d392943ea8239464661b7a1d067cac00b02cfa4c59207d2f26a1d13d87e29c7a66151ee6cd835e19c6584cc5c86dc286a2
SSDEEP 49152:knw9oUUEEDlGUJ8Y9c87MQyRjdF5zkragh:kQUEEj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

iGqgDBM.exe

Path C:\Windows\System32\iGqgDBM.exe
Size 1.8MB
SHA256 4c096f3bae726326b1df945fb0a25d05b88cab76f3e913d4d60081b6195b6482
MD5 9fb36c3ef3e3034b4204bcbd0661204a
SHA1 4a1c2a9803ccf5609dcc259c4a7ff8a8c164afe8
SHA512 654b0c5b437b425858d2ad2cb91114381ef5a5fa71ee0832976e3a9829966268451994af979b972ce2df4d83280c298436b5f7cadc220d216d53c2eec61618fd
SSDEEP 49152:knw9oUUEEDlGUJ8Y9c87MQyRjdF5zkrag8:kQUEEju
MD5 SHA1 SHA512 SSDEEP

Submit Download

iIQBSsY.exe

Path C:\Windows\System32\iIQBSsY.exe
Size 1.8MB
SHA256 1aec2ecda56111166f782d96f857f512a18ebc5baed2478e501105bc3dfeb398
MD5 8066787c8a94394acbf147004076dbd4
SHA1 d550ed1c94c89f820a6f58153fcce096707907fb
SHA512 9fbdee751d452e7091665fd029c09a57962930110a963f8e655509eff9ef852e794e19b7f479c89475b8c489b88607bb0608b8fc929eccf22d0762d30cbaaa97
SSDEEP 49152:knw9oUUEEDlGUJ8Y9c87MQyRjdF5zkragT:kQUEEjp
MD5 SHA1 SHA512 SSDEEP

Submit Download

iKtLnxN.exe

Path C:\Windows\System32\iKtLnxN.exe
Size 1.8MB
SHA256 f842fa2c0b50e99d2269451fe16d4bd22b4806d6a2ed18762fac05c5f98fc260
MD5 18bca156cb6bcd2d866e7986f9a0a300
SHA1 393fb9ea17f42d42fb4c4a9e69b587915e647b13
SHA512 565a744be6a897fa19f39704c5de723a7d1eda46d4caf525f3ef8a9b9aab9817a432a9984982344000266043a235d937cf79c76f4a9edb90be2d8281638b9f9c
SSDEEP 49152:knw9oUUEEDlGUJ8Y9c87MQyRjdF5zkragF:kQUEEjL
MD5 SHA1 SHA512 SSDEEP

Submit Download

jBtPQdP.exe

Path C:\Windows\System32\jBtPQdP.exe
Size 1.8MB
SHA256 4a1ded6195e6c99ef8338ddf310856d4b352b1b4d9bd9e02f9071c203fe7b538
MD5 92e69a9a9673ec63843c8f992a687a21
SHA1 127e921ba5be3a93528f87e8752dd26ef8ccc8ef
SHA512 11ff24293030b271b1b45dea69d54cbfe0be5708da5c880da7b2656adb4248eeff4949eba225fa1203a92548fd05095144d15ba442e5cca942491d2bc547df10
SSDEEP 49152:knw9oUUEEDlGUJ8Y9c87MQyRjdF5zkragE:kQUEEjC
MD5 SHA1 SHA512 SSDEEP

Submit Download

kilekux.exe

Path C:\Windows\System32\kilekux.exe
Size 1.8MB
SHA256 a84df4227e80cbd9d5369e5e54c33ca93a328ed4433e47c92d90a2a7d43c2cb7
MD5 329fb5f280acfe24619e036eae02e20e
SHA1 23ef500acc882c28921934276f66ff99c0a08a58
SHA512 0f6d4315b5b26dce2ab51924a91a838ed33a12816ac76b34ea53a4b5e338943c6c2143f8b8ac0fa6c79c3e36c5fcee019235a2b9b969c6e76175fc93ecd2848e
SSDEEP 49152:knw9oUUEEDlGUJ8Y9c87MQyRjdF5zkragf:kQUEEjJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

oejpzMJ.exe

Path C:\Windows\System32\oejpzMJ.exe
Size 1.8MB
SHA256 88f4dd864e1ec78f88b589d2f9206f7c21c979ecbc5bd78e914621f0568dce06
MD5 bae380ca189cc2f206b059f2c568b1c0
SHA1 23300d08e6ca3a520657645ce3111db8bd343c26
SHA512 be3f7d803410f42f8d542885e5a59ca7cb0b8e8b2ac52f5c2137ce90989d032ad3a8cc3316b5c039e08c0caa4dd915d5d1d5de7b7fce6810524c2e02a9d727f0
SSDEEP 49152:knw9oUUEEDlGUJ8Y9c87MQyRjdF5zkragy:kQUEEjM
MD5 SHA1 SHA512 SSDEEP

Submit Download

qbxAACN.exe

Path C:\Windows\System32\qbxAACN.exe
Size 1.8MB
SHA256 728ac475d4ef8170c98a7512835867001a0f5f1f8f51ff8ba8384cf0cf215734
MD5 33049c0fcf622658da0031ec973faa44
SHA1 6e056b1d9dd2ad1951f843ac8040a93b2912cef8
SHA512 bd20cea6a5e28739640fac5379d116ba01d8af57420b53997a1fe4d18255c2a6ed95ee9d1f766b3abd1f7c3d2e4c12de9285873217427c92fb51bb065aec39b7
SSDEEP 49152:knw9oUUEEDlGUJ8Y9c87MQyRjdF5zkragQ:kQUEEjy
MD5 SHA1 SHA512 SSDEEP

Submit Download

rpItvTi.exe

Path C:\Windows\System32\rpItvTi.exe
Size 1.8MB
SHA256 ca03471e301eb25b9f19f8b42d13727cc73ad6f9165c5418ad6c6010851a9ea5
MD5 2285f622bf2eaf660850ad9fdd126f64
SHA1 b3f77ce084549331ee9f44357a46f36c22697af2
SHA512 3401a0c62aa7d6b57d064c02f7a8d1ad5146f6c988462f6b53d9242b10829f64a321c7a13a7dfd2ac1d487dd2a6e27a16db4c78435e680361c36249ba30116fd
SSDEEP 49152:knw9oUUEEDlGUJ8Y9c87MQyRjdF5zkragDf:kQUEEjl
MD5 SHA1 SHA512 SSDEEP

Submit Download

sHyyBnD.exe

Path C:\Windows\System32\sHyyBnD.exe
Size 1.8MB
SHA256 2207df04fd0deb24201d1e1d04969d41febf4c597c7277f9adb376f77b924c2e
MD5 6cab4e8ab9c15f245562daba93f92d17
SHA1 f5c7d4eff0e38f1cbdb2d2f836ffb874707908ed
SHA512 d90b9cc7fb695c1c45d1497454f24efccd3211f4970a8dbc90fa5a3ca71354186c6aced636467dbf31a86374f293ed43fc1cf787025db77676c1c0d0ad611359
SSDEEP 49152:knw9oUUEEDlGUJ8Y9c87MQyRjdF5zkrag8:kQUEEji
MD5 SHA1 SHA512 SSDEEP

Submit Download

spexoeU.exe

Path C:\Windows\System32\spexoeU.exe
Size 1.8MB
SHA256 919dbc09a0c9441e0eac58dd3668f0dc8da8548dca649353a4839bba89711ca4
MD5 2e94e93f1c725d68e39bb29dde3e66ed
SHA1 4ae404ef99e1af8d3024481fabfc2949b450efad
SHA512 ddea3d524006e3fd7323a3ab1f2dc1152b080d31ed27469cb69e90918916ec24f298a242b58bc13d27a120bea31507e2c786008bac848ab50bcda413c75cc84c
SSDEEP 49152:knw9oUUEEDlGUJ8Y9c87MQyRjdF5zkrag1:kQUEEjz
MD5 SHA1 SHA512 SSDEEP

Submit Download

spvSjZG.exe

Path C:\Windows\System32\spvSjZG.exe
Size 1.8MB
SHA256 2337ec21b6c1c6b580e6b95c4028def4c2d668b2d89cf57ff67a63ab3f057a59
MD5 933df14580ef4cc32ad1926307d52c7c
SHA1 bf2428263f83ae78c22db3b7320ec01b441990e4
SHA512 35bed6a5afcec095e6e090481f53cd399a1877c68d1fe3e3e3d4560c9d095c9786079e84769d8f10445cbd716cc9b7766b38f05ba98aa56866b2cb3f285e50ab
SSDEEP 49152:knw9oUUEEDlGUJ8Y9c87MQyRjdF5zkragz:kQUEEjR
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssphMaK.exe

Path C:\Windows\System32\ssphMaK.exe
Size 1.8MB
SHA256 e15a50f71c4d6c0cd0467016caf0622658f106a0615e91aec695ddfcfa081e65
MD5 c18ab529cad2c24c4961ded9b2927106
SHA1 04cc8b604ec985547cdef13b267137579324aec6
SHA512 fa6895ab45d0ecf054097ab9a6c2cbebb1584c1897c46d41c24a7c62e8beed2d55a31e5ec9cacdf34a6e8f8a9de74eb8d21bbd2f54d41c8141af68033c078cc8
SSDEEP 49152:knw9oUUEEDlGUJ8Y9c87MQyRjdF5zkragh:kQUEEjv
MD5 SHA1 SHA512 SSDEEP

Submit Download

txjbMXi.exe

Path C:\Windows\System32\txjbMXi.exe
Size 1.8MB
SHA256 9072b8b12a5c466a19c6df75b8b42bccf36d37d2b130bea814fc843708a507a8
MD5 c0661bcda67b54d49fd8f5b0ecaaa7fe
SHA1 e778e1d746f6ee7c2c11aae42ddfb09d277af64d
SHA512 06bc5e142187a7942a5fc93ed0cec5b32e2791524107a065a476fda96063cb4141f8405b953b5d0368836578967141ee9871c699efd1026bdaaff35b6ed43e72
SSDEEP 49152:knw9oUUEEDlGUJ8Y9c87MQyRjdF5zkrag+:kQUEEjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcDwJCg.exe

Path C:\Windows\System32\vcDwJCg.exe
Size 1.8MB
SHA256 ceaec55b8e072961cdcbf7d17ffffcd71234b88c270947b1efd36baa07e7aa80
MD5 406091ce0287034536442f6676d63c83
SHA1 bcfd0a6b7436ff6523f2160016b1249f4a70a558
SHA512 47258c11571dbee02b5d369a19b921d62f68b8dcfe22d89d3aa9393bce662e7fe9c4d5edc97b845ce346de6b2f1790a01d8c0c00aef30a1b04b3b57972f545d3
SSDEEP 49152:knw9oUUEEDlGUJ8Y9c87MQyRjdF5zkragm:kQUEEjE
MD5 SHA1 SHA512 SSDEEP

Submit Download

yGXLqSe.exe

Path C:\Windows\System32\yGXLqSe.exe
Size 1.8MB
SHA256 18e66da0e447d0142a2e169697a00edb790ad318386d62be573c000aa7d09d93
MD5 7bd620e2b6c4cda3046e9e04a587efdd
SHA1 3daf5e6064a17276ed969c7702ed9e1cf41c3f5d
SHA512 3d748da0b4ae2c8da05e7241402b98204ea73edf00809049ab65308dcca514ab39e1db8c6223da9df73a8a4f46425e5e06457f0fbdd086fc2e252d629adb1b6e
SSDEEP 49152:knw9oUUEEDlGUJ8Y9c87MQyRjdF5zkragq:kQUEEjI
MD5 SHA1 SHA512 SSDEEP

Submit Download

zDDSMIE.exe

Path C:\Windows\System32\zDDSMIE.exe
Size 1.8MB
SHA256 09016aa4644cdbf5ed8123fcb06941bbdcf27d9ec179f0cb9bd1d18a47ee3fa9
MD5 70403ff564c622f92266fab9bcb411ee
SHA1 be3c7af7eeb969e4fc43871e3e4aee55a5012d5d
SHA512 e9e4303952aba61a2f3b507f1cefd51f823f90817be52b8aefa3a7cfe9f68169e2bb66b340a99bc7b5c845365410cd68c8e244f1c54a13cf276d9d987e1f8274
SSDEEP 49152:knw9oUUEEDlGUJ8Y9c87MQyRjdF5zkragy:kQUEEjQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

zUdsaxW.exe

Path C:\Windows\System32\zUdsaxW.exe
Size 1.8MB
SHA256 c3683b280e827e557a5a7d10cca59c87f8e1256c4b160bb859965a54b40acc21
MD5 f2079813f7e096a2544bc48658f0d268
SHA1 d61d9c46c1193d486874dca0274a1d351a5c3387
SHA512 8e6348396aa48800157d47ddc95b46e91f15357b77fbb7c4d75ffdc3b42e8e29acd3afeff6230ebf6354b4db887733ba845a16e82942d77129e02275838ae4b6
SSDEEP 49152:knw9oUUEEDlGUJ8Y9c87MQyRjdF5zkrag5:kQUEEj/
MD5 SHA1 SHA512 SSDEEP

Submit Download

zqOfWWd.exe

Path C:\Windows\System32\zqOfWWd.exe
Size 1.8MB
SHA256 f8e645f4e09aa45573a466625932e04439688d26e7bc0d0bd46a52b58c57b316
MD5 df5db9eb217e2e755359dff3f6a6d114
SHA1 b13914702d2dbe7dbfbb7daecaa1098ec3dba1fc
SHA512 a6f6c7d40923cf1824f551a068bda0d323ffe0ce2ce1be8d801d313ec4962b20f624b69e657e7d374287d375daaf1bdaf5dd4f834e6bca7aa89d438eaba76f2d
SSDEEP 49152:knw9oUUEEDlGUJ8Y9c87MQyRjdF5zkrage:kQUEEjI
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1028-507-0x00007FF73E390000-0x00007FF73E781000-memory.dmp

Download

memory/1028-2062-0x00007FF73E390000-0x00007FF73E781000-memory.dmp

Download

memory/1184-33-0x00007FF73F0B0000-0x00007FF73F4A1000-memory.dmp

Download

memory/1184-2014-0x00007FF73F0B0000-0x00007FF73F4A1000-memory.dmp

Download

memory/1692-2019-0x00007FF795F40000-0x00007FF796331000-memory.dmp

Download

memory/1692-451-0x00007FF795F40000-0x00007FF796331000-memory.dmp

Download

memory/2008-538-0x00007FF7F9C70000-0x00007FF7FA061000-memory.dmp

Download

memory/2008-2022-0x00007FF7F9C70000-0x00007FF7FA061000-memory.dmp

Download

memory/2152-2047-0x00007FF7630E0000-0x00007FF7634D1000-memory.dmp

Download

memory/2152-526-0x00007FF7630E0000-0x00007FF7634D1000-memory.dmp

Download

memory/2244-453-0x00007FF7C8260000-0x00007FF7C8651000-memory.dmp

Download

memory/2244-2033-0x00007FF7C8260000-0x00007FF7C8651000-memory.dmp

Download

memory/2552-2012-0x00007FF7C6D00000-0x00007FF7C70F1000-memory.dmp

Download

memory/2552-26-0x00007FF7C6D00000-0x00007FF7C70F1000-memory.dmp

Download

memory/2552-1997-0x00007FF7C6D00000-0x00007FF7C70F1000-memory.dmp

Download

memory/3304-2034-0x00007FF6CDEC0000-0x00007FF6CE2B1000-memory.dmp

Download

memory/3304-468-0x00007FF6CDEC0000-0x00007FF6CE2B1000-memory.dmp

Download

memory/3460-36-0x00007FF6DB220000-0x00007FF6DB611000-memory.dmp

Download

memory/3460-2016-0x00007FF6DB220000-0x00007FF6DB611000-memory.dmp

Download

memory/3964-477-0x00007FF7E7C20000-0x00007FF7E8011000-memory.dmp

Download

memory/3964-2070-0x00007FF7E7C20000-0x00007FF7E8011000-memory.dmp

Download

memory/4136-2011-0x00007FF7FBAD0000-0x00007FF7FBEC1000-memory.dmp

Download

memory/4136-38-0x00007FF7FBAD0000-0x00007FF7FBEC1000-memory.dmp

Download

memory/4160-449-0x00007FF7752A0000-0x00007FF775691000-memory.dmp

Download

memory/4160-2028-0x00007FF7752A0000-0x00007FF775691000-memory.dmp

Download

memory/4204-2063-0x00007FF70A110000-0x00007FF70A501000-memory.dmp

Download

memory/4204-496-0x00007FF70A110000-0x00007FF70A501000-memory.dmp

Download

memory/4288-532-0x00007FF712D80000-0x00007FF713171000-memory.dmp

Download

memory/4288-2043-0x00007FF712D80000-0x00007FF713171000-memory.dmp

Download

memory/4464-2036-0x00007FF722CC0000-0x00007FF7230B1000-memory.dmp

Download

memory/4464-473-0x00007FF722CC0000-0x00007FF7230B1000-memory.dmp

Download

memory/4524-528-0x00007FF661810000-0x00007FF661C01000-memory.dmp

Download

memory/4524-2044-0x00007FF661810000-0x00007FF661C01000-memory.dmp

Download

memory/4528-2008-0x00007FF7201C0000-0x00007FF7205B1000-memory.dmp

Download

memory/4528-13-0x00007FF7201C0000-0x00007FF7205B1000-memory.dmp

Download

memory/4632-447-0x00007FF684F50000-0x00007FF685341000-memory.dmp

Download

memory/4632-2026-0x00007FF684F50000-0x00007FF685341000-memory.dmp

Download

memory/4688-2067-0x00007FF7FCBB0000-0x00007FF7FCFA1000-memory.dmp

Download

memory/4688-488-0x00007FF7FCBB0000-0x00007FF7FCFA1000-memory.dmp

Download

memory/4916-493-0x00007FF7AFFF0000-0x00007FF7B03E1000-memory.dmp

Download

memory/4916-2066-0x00007FF7AFFF0000-0x00007FF7B03E1000-memory.dmp

Download

memory/4924-450-0x00007FF7134C0000-0x00007FF7138B1000-memory.dmp

Download

memory/4924-2020-0x00007FF7134C0000-0x00007FF7138B1000-memory.dmp

Download

memory/4940-0-0x00007FF7BB1E0000-0x00007FF7BB5D1000-memory.dmp

Download

memory/4940-1-0x000001D049680000-0x000001D049690000-memory.dmp

Download

memory/4948-2048-0x00007FF680990000-0x00007FF680D81000-memory.dmp

Download

memory/4948-522-0x00007FF680990000-0x00007FF680D81000-memory.dmp

Download

memory/5012-452-0x00007FF6F2640000-0x00007FF6F2A31000-memory.dmp

Download

memory/5012-2030-0x00007FF6F2640000-0x00007FF6F2A31000-memory.dmp

Download

memory/5056-2025-0x00007FF76A870000-0x00007FF76AC61000-memory.dmp

Download

memory/5056-536-0x00007FF76A870000-0x00007FF76AC61000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads