xmrig | 4ea6f530e21b0ca573208d9b99c23e4a076073a8527795e82fdbb0e1a9b9105d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 15:18 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
Size

1.9MB
MD5

6f7915556258791de0243ed53e8fac90
SHA1

3b8e9af06edaf3bba21f1d14b80a0deb42c6b70a
SHA256

4ea6f530e21b0ca573208d9b99c23e4a076073a8527795e82fdbb0e1a9b9105d
SHA512

8f71852ee75ad80576d405ed70113b7721fc726dcade809fde98a1e53e7e63436ffe55cf7a8f39d23f470d59443ec226723285699ab14661f4bfc8b0bd08d721
SSDEEP

49152:knw9oUUEEDl37jcq4nPeyNIIKYLOHFDKd46RT:kQUEEE

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/2948-30-0x00007FF6972F0000-0x00007FF6976E1000-memory.dmp	xmrig
behavioral2/memory/2512-451-0x00007FF600140000-0x00007FF600531000-memory.dmp	xmrig
behavioral2/memory/2980-453-0x00007FF7D3BC0000-0x00007FF7D3FB1000-memory.dmp	xmrig
behavioral2/memory/4324-455-0x00007FF6E6D20000-0x00007FF6E7111000-memory.dmp	xmrig
behavioral2/memory/2152-454-0x00007FF7EFFC0000-0x00007FF7F03B1000-memory.dmp	xmrig
behavioral2/memory/4624-452-0x00007FF624BD0000-0x00007FF624FC1000-memory.dmp	xmrig
behavioral2/memory/1892-456-0x00007FF757A80000-0x00007FF757E71000-memory.dmp	xmrig
behavioral2/memory/3708-457-0x00007FF7A47E0000-0x00007FF7A4BD1000-memory.dmp	xmrig
behavioral2/memory/4752-458-0x00007FF7918B0000-0x00007FF791CA1000-memory.dmp	xmrig
behavioral2/memory/2248-459-0x00007FF6744C0000-0x00007FF6748B1000-memory.dmp	xmrig
behavioral2/memory/2628-461-0x00007FF798830000-0x00007FF798C21000-memory.dmp	xmrig
behavioral2/memory/3404-462-0x00007FF7F07E0000-0x00007FF7F0BD1000-memory.dmp	xmrig
behavioral2/memory/2148-463-0x00007FF73E540000-0x00007FF73E931000-memory.dmp	xmrig
behavioral2/memory/3948-464-0x00007FF71A5A0000-0x00007FF71A991000-memory.dmp	xmrig
behavioral2/memory/4580-465-0x00007FF6617E0000-0x00007FF661BD1000-memory.dmp	xmrig
behavioral2/memory/3148-460-0x00007FF76A260000-0x00007FF76A651000-memory.dmp	xmrig
behavioral2/memory/5072-467-0x00007FF666FC0000-0x00007FF6673B1000-memory.dmp	xmrig
behavioral2/memory/4648-468-0x00007FF7D4C00000-0x00007FF7D4FF1000-memory.dmp	xmrig
behavioral2/memory/4564-466-0x00007FF6AAC40000-0x00007FF6AB031000-memory.dmp	xmrig
behavioral2/memory/2532-469-0x00007FF6B5E70000-0x00007FF6B6261000-memory.dmp	xmrig
behavioral2/memory/1412-1983-0x00007FF7BD2D0000-0x00007FF7BD6C1000-memory.dmp	xmrig
behavioral2/memory/5064-1984-0x00007FF60D770000-0x00007FF60DB61000-memory.dmp	xmrig
behavioral2/memory/2640-1985-0x00007FF6A3500000-0x00007FF6A38F1000-memory.dmp	xmrig
behavioral2/memory/3272-2018-0x00007FF641850000-0x00007FF641C41000-memory.dmp	xmrig
behavioral2/memory/3832-2023-0x00007FF606F80000-0x00007FF607371000-memory.dmp	xmrig
behavioral2/memory/5064-2025-0x00007FF60D770000-0x00007FF60DB61000-memory.dmp	xmrig
behavioral2/memory/2948-2028-0x00007FF6972F0000-0x00007FF6976E1000-memory.dmp	xmrig
behavioral2/memory/2640-2029-0x00007FF6A3500000-0x00007FF6A38F1000-memory.dmp	xmrig
behavioral2/memory/2532-2036-0x00007FF6B5E70000-0x00007FF6B6261000-memory.dmp	xmrig
behavioral2/memory/3272-2038-0x00007FF641850000-0x00007FF641C41000-memory.dmp	xmrig
behavioral2/memory/2152-2041-0x00007FF7EFFC0000-0x00007FF7F03B1000-memory.dmp	xmrig
behavioral2/memory/2512-2039-0x00007FF600140000-0x00007FF600531000-memory.dmp	xmrig
behavioral2/memory/4624-2033-0x00007FF624BD0000-0x00007FF624FC1000-memory.dmp	xmrig
behavioral2/memory/2980-2032-0x00007FF7D3BC0000-0x00007FF7D3FB1000-memory.dmp	xmrig
behavioral2/memory/4324-2043-0x00007FF6E6D20000-0x00007FF6E7111000-memory.dmp	xmrig
behavioral2/memory/2628-2063-0x00007FF798830000-0x00007FF798C21000-memory.dmp	xmrig
behavioral2/memory/2248-2066-0x00007FF6744C0000-0x00007FF6748B1000-memory.dmp	xmrig
behavioral2/memory/1892-2075-0x00007FF757A80000-0x00007FF757E71000-memory.dmp	xmrig
behavioral2/memory/3708-2073-0x00007FF7A47E0000-0x00007FF7A4BD1000-memory.dmp	xmrig
behavioral2/memory/4752-2071-0x00007FF7918B0000-0x00007FF791CA1000-memory.dmp	xmrig
behavioral2/memory/3148-2065-0x00007FF76A260000-0x00007FF76A651000-memory.dmp	xmrig
behavioral2/memory/3404-2061-0x00007FF7F07E0000-0x00007FF7F0BD1000-memory.dmp	xmrig
behavioral2/memory/2148-2059-0x00007FF73E540000-0x00007FF73E931000-memory.dmp	xmrig
behavioral2/memory/3948-2057-0x00007FF71A5A0000-0x00007FF71A991000-memory.dmp	xmrig
behavioral2/memory/4580-2055-0x00007FF6617E0000-0x00007FF661BD1000-memory.dmp	xmrig
behavioral2/memory/4564-2053-0x00007FF6AAC40000-0x00007FF6AB031000-memory.dmp	xmrig
behavioral2/memory/5072-2051-0x00007FF666FC0000-0x00007FF6673B1000-memory.dmp	xmrig
behavioral2/memory/4648-2049-0x00007FF7D4C00000-0x00007FF7D4FF1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3832	yprKmWm.exe
5064	JtMUrFI.exe
2948	iEQYgKA.exe
2640	MXyjVmi.exe
3272	DxLwGnw.exe
2512	DTuwZFn.exe
2532	LlDSksF.exe
4624	iIAptVJ.exe
2980	ZiiKjhu.exe
2152	ewibYwg.exe
4324	IaauUqp.exe
1892	VXDlsQs.exe
3708	fnsxbZI.exe
4752	ulKvSAk.exe
2248	uqdDkEN.exe
3148	UFfInFb.exe
2628	OLAFXSF.exe
3404	XBRGYIK.exe
2148	JVnNZFI.exe
3948	tPqLpzf.exe
4580	PUTMjwv.exe
4564	sSTCbcs.exe
5072	ZtTBZMj.exe
4648	jJoLNik.exe
4604	NBGtznk.exe
812	nNXnbiB.exe
1464	KnXMzom.exe
1824	aIhZYYY.exe
4204	VFtLktS.exe
952	XpadmEO.exe
2012	CexClpK.exe
2068	FFSfhwv.exe
4460	euSunSS.exe
1828	hPJKdrU.exe
2644	FZWLhTo.exe
2508	aEaoOdm.exe
2880	jhynlUn.exe
716	DQZzPYN.exe
5020	sGcuWmS.exe
3188	KDGIYAI.exe
1952	vmxwXCt.exe
2392	VrjQQZr.exe
776	CvDVNtc.exe
1584	WOhFBzv.exe
4024	jYSSCSm.exe
2288	tCAQYku.exe
2444	DVUafVP.exe
4128	JocFrWV.exe
2040	RyFuNOr.exe
3308	wqqjVuR.exe
2192	cTlQuMZ.exe
3568	GTeSvOw.exe
2172	AGTyWEP.exe
1864	fFRxVOB.exe
4516	PYdGyCl.exe
4144	ePxeLsi.exe
2400	OWpqICO.exe
4980	rtfyChM.exe
1176	mWfEzBU.exe
2668	yMBzioK.exe
2752	OpznqWr.exe
3604	zUhKvvW.exe
436	turiEdb.exe
2272	UfDuRhO.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1412-0-0x00007FF7BD2D0000-0x00007FF7BD6C1000-memory.dmp	upx
behavioral2/files/0x00090000000233c0-5.dat	upx
behavioral2/files/0x00070000000233c7-13.dat	upx
behavioral2/memory/3832-16-0x00007FF606F80000-0x00007FF607371000-memory.dmp	upx
behavioral2/files/0x00070000000233c8-20.dat	upx
behavioral2/memory/2640-23-0x00007FF6A3500000-0x00007FF6A38F1000-memory.dmp	upx
behavioral2/files/0x00070000000233ca-34.dat	upx
behavioral2/files/0x00070000000233cb-33.dat	upx
behavioral2/memory/3272-31-0x00007FF641850000-0x00007FF641C41000-memory.dmp	upx
behavioral2/files/0x00070000000233cf-59.dat	upx
behavioral2/files/0x00070000000233d2-67.dat	upx
behavioral2/files/0x00070000000233d3-79.dat	upx
behavioral2/files/0x00070000000233d5-89.dat	upx
behavioral2/files/0x00070000000233d8-104.dat	upx
behavioral2/files/0x00070000000233da-114.dat	upx
behavioral2/files/0x00070000000233e2-148.dat	upx
behavioral2/files/0x00070000000233e3-159.dat	upx
behavioral2/files/0x00070000000233e6-167.dat	upx
behavioral2/files/0x00070000000233e4-164.dat	upx
behavioral2/files/0x00070000000233e5-162.dat	upx
behavioral2/files/0x00070000000233e1-146.dat	upx
behavioral2/files/0x00070000000233e0-144.dat	upx
behavioral2/files/0x00070000000233df-137.dat	upx
behavioral2/files/0x00070000000233de-132.dat	upx
behavioral2/files/0x00070000000233dd-127.dat	upx
behavioral2/files/0x00070000000233dc-121.dat	upx
behavioral2/files/0x00070000000233db-117.dat	upx
behavioral2/files/0x00070000000233d9-109.dat	upx
behavioral2/files/0x00070000000233d7-99.dat	upx
behavioral2/files/0x00070000000233d6-94.dat	upx
behavioral2/files/0x00070000000233d4-84.dat	upx
behavioral2/files/0x00070000000233d1-69.dat	upx
behavioral2/files/0x00070000000233d0-64.dat	upx
behavioral2/files/0x00070000000233ce-54.dat	upx
behavioral2/files/0x00070000000233cd-49.dat	upx
behavioral2/files/0x00070000000233cc-44.dat	upx
behavioral2/memory/2948-30-0x00007FF6972F0000-0x00007FF6976E1000-memory.dmp	upx
behavioral2/files/0x00070000000233c9-26.dat	upx
behavioral2/memory/5064-22-0x00007FF60D770000-0x00007FF60DB61000-memory.dmp	upx
behavioral2/memory/2512-451-0x00007FF600140000-0x00007FF600531000-memory.dmp	upx
behavioral2/memory/2980-453-0x00007FF7D3BC0000-0x00007FF7D3FB1000-memory.dmp	upx
behavioral2/memory/4324-455-0x00007FF6E6D20000-0x00007FF6E7111000-memory.dmp	upx
behavioral2/memory/2152-454-0x00007FF7EFFC0000-0x00007FF7F03B1000-memory.dmp	upx
behavioral2/memory/4624-452-0x00007FF624BD0000-0x00007FF624FC1000-memory.dmp	upx
behavioral2/memory/1892-456-0x00007FF757A80000-0x00007FF757E71000-memory.dmp	upx
behavioral2/memory/3708-457-0x00007FF7A47E0000-0x00007FF7A4BD1000-memory.dmp	upx
behavioral2/memory/4752-458-0x00007FF7918B0000-0x00007FF791CA1000-memory.dmp	upx
behavioral2/memory/2248-459-0x00007FF6744C0000-0x00007FF6748B1000-memory.dmp	upx
behavioral2/memory/2628-461-0x00007FF798830000-0x00007FF798C21000-memory.dmp	upx
behavioral2/memory/3404-462-0x00007FF7F07E0000-0x00007FF7F0BD1000-memory.dmp	upx
behavioral2/memory/2148-463-0x00007FF73E540000-0x00007FF73E931000-memory.dmp	upx
behavioral2/memory/3948-464-0x00007FF71A5A0000-0x00007FF71A991000-memory.dmp	upx
behavioral2/memory/4580-465-0x00007FF6617E0000-0x00007FF661BD1000-memory.dmp	upx
behavioral2/memory/3148-460-0x00007FF76A260000-0x00007FF76A651000-memory.dmp	upx
behavioral2/memory/5072-467-0x00007FF666FC0000-0x00007FF6673B1000-memory.dmp	upx
behavioral2/memory/4648-468-0x00007FF7D4C00000-0x00007FF7D4FF1000-memory.dmp	upx
behavioral2/memory/4564-466-0x00007FF6AAC40000-0x00007FF6AB031000-memory.dmp	upx
behavioral2/memory/2532-469-0x00007FF6B5E70000-0x00007FF6B6261000-memory.dmp	upx
behavioral2/memory/1412-1983-0x00007FF7BD2D0000-0x00007FF7BD6C1000-memory.dmp	upx
behavioral2/memory/5064-1984-0x00007FF60D770000-0x00007FF60DB61000-memory.dmp	upx
behavioral2/memory/2640-1985-0x00007FF6A3500000-0x00007FF6A38F1000-memory.dmp	upx
behavioral2/memory/3272-2018-0x00007FF641850000-0x00007FF641C41000-memory.dmp	upx
behavioral2/memory/3832-2023-0x00007FF606F80000-0x00007FF607371000-memory.dmp	upx
behavioral2/memory/5064-2025-0x00007FF60D770000-0x00007FF60DB61000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\iaeHywF.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\GkCMKYl.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\ynNivxt.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\WqqzGKK.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\bFeSZVj.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\jxfeMiK.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\jhynlUn.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\CeBeDXW.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\eRIkxRf.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\ZAwCWfF.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\kdnbtjz.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\qBrCdhr.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\LiJUcLh.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\yFVGroj.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\nWaTnLG.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\hgNWnzg.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\qloJowi.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\GbzoqSF.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\GTCYkXW.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\gOfJjhm.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\oqfkShy.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\SKIYEeb.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\oNPyJwa.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\smoQSAw.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\SfcTzPH.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\sRtSIAi.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\UFfInFb.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\SARrDfw.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\OQmUTqA.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\UdyewZc.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\zKGGghj.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\ZvvOppQ.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\wkoDOtJ.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\lMDXPZN.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\FWPSPFr.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\lbCoTgX.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\fchrVaK.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\TyuMLgH.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\fUtBAHR.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\SUqqhhg.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\MnebqPV.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\VFtLktS.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\FZWLhTo.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\RyFuNOr.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\UkPrwwy.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\fFRxVOB.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\rkNnudq.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\lLtLqiS.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\QCdNOfO.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\UYoKgsa.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\WWAHYBR.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\QFTdVBd.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\WEADObw.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\CexClpK.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\JocFrWV.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\foMnhhI.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\wsAOxtI.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\cfTKeFl.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\yGoRyMV.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\AmxaNEE.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\UCsSXYi.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\UqMxXep.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\paMmZqa.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
File created	C:\Windows\System32\hpMJnYd.exe	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 3832	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	83
PID 1412 wrote to memory of 3832	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	83
PID 1412 wrote to memory of 5064	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	84
PID 1412 wrote to memory of 5064	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	84
PID 1412 wrote to memory of 2948	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	85
PID 1412 wrote to memory of 2948	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	85
PID 1412 wrote to memory of 2640	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	86
PID 1412 wrote to memory of 2640	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	86
PID 1412 wrote to memory of 3272	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	87
PID 1412 wrote to memory of 3272	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	87
PID 1412 wrote to memory of 2512	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	88
PID 1412 wrote to memory of 2512	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	88
PID 1412 wrote to memory of 2532	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	89
PID 1412 wrote to memory of 2532	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	89
PID 1412 wrote to memory of 4624	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	90
PID 1412 wrote to memory of 4624	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	90
PID 1412 wrote to memory of 2980	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	91
PID 1412 wrote to memory of 2980	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	91
PID 1412 wrote to memory of 2152	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	92
PID 1412 wrote to memory of 2152	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	92
PID 1412 wrote to memory of 4324	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	93
PID 1412 wrote to memory of 4324	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	93
PID 1412 wrote to memory of 1892	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	94
PID 1412 wrote to memory of 1892	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	94
PID 1412 wrote to memory of 3708	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	95
PID 1412 wrote to memory of 3708	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	95
PID 1412 wrote to memory of 4752	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	96
PID 1412 wrote to memory of 4752	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	96
PID 1412 wrote to memory of 2248	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	97
PID 1412 wrote to memory of 2248	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	97
PID 1412 wrote to memory of 3148	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	98
PID 1412 wrote to memory of 3148	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	98
PID 1412 wrote to memory of 2628	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	99
PID 1412 wrote to memory of 2628	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	99
PID 1412 wrote to memory of 3404	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	100
PID 1412 wrote to memory of 3404	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	100
PID 1412 wrote to memory of 2148	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	101
PID 1412 wrote to memory of 2148	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	101
PID 1412 wrote to memory of 3948	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	102
PID 1412 wrote to memory of 3948	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	102
PID 1412 wrote to memory of 4580	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	103
PID 1412 wrote to memory of 4580	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	103
PID 1412 wrote to memory of 4564	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	104
PID 1412 wrote to memory of 4564	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	104
PID 1412 wrote to memory of 5072	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	105
PID 1412 wrote to memory of 5072	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	105
PID 1412 wrote to memory of 4648	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	106
PID 1412 wrote to memory of 4648	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	106
PID 1412 wrote to memory of 4604	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	107
PID 1412 wrote to memory of 4604	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	107
PID 1412 wrote to memory of 812	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	108
PID 1412 wrote to memory of 812	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	108
PID 1412 wrote to memory of 1464	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	109
PID 1412 wrote to memory of 1464	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	109
PID 1412 wrote to memory of 1824	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	110
PID 1412 wrote to memory of 1824	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	110
PID 1412 wrote to memory of 4204	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	111
PID 1412 wrote to memory of 4204	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	111
PID 1412 wrote to memory of 952	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	112
PID 1412 wrote to memory of 952	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	112
PID 1412 wrote to memory of 2012	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	113
PID 1412 wrote to memory of 2012	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	113
PID 1412 wrote to memory of 2068	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	114
PID 1412 wrote to memory of 2068	1412	6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6f7915556258791de0243ed53e8fac90_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\System32\yprKmWm.exe
  C:\Windows\System32\yprKmWm.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System32\JtMUrFI.exe
  C:\Windows\System32\JtMUrFI.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System32\iEQYgKA.exe
  C:\Windows\System32\iEQYgKA.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System32\MXyjVmi.exe
  C:\Windows\System32\MXyjVmi.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System32\DxLwGnw.exe
  C:\Windows\System32\DxLwGnw.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System32\DTuwZFn.exe
  C:\Windows\System32\DTuwZFn.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System32\LlDSksF.exe
  C:\Windows\System32\LlDSksF.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System32\iIAptVJ.exe
  C:\Windows\System32\iIAptVJ.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System32\ZiiKjhu.exe
  C:\Windows\System32\ZiiKjhu.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System32\ewibYwg.exe
  C:\Windows\System32\ewibYwg.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System32\IaauUqp.exe
  C:\Windows\System32\IaauUqp.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System32\VXDlsQs.exe
  C:\Windows\System32\VXDlsQs.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System32\fnsxbZI.exe
  C:\Windows\System32\fnsxbZI.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System32\ulKvSAk.exe
  C:\Windows\System32\ulKvSAk.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System32\uqdDkEN.exe
  C:\Windows\System32\uqdDkEN.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System32\UFfInFb.exe
  C:\Windows\System32\UFfInFb.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System32\OLAFXSF.exe
  C:\Windows\System32\OLAFXSF.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System32\XBRGYIK.exe
  C:\Windows\System32\XBRGYIK.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System32\JVnNZFI.exe
  C:\Windows\System32\JVnNZFI.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System32\tPqLpzf.exe
  C:\Windows\System32\tPqLpzf.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System32\PUTMjwv.exe
  C:\Windows\System32\PUTMjwv.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System32\sSTCbcs.exe
  C:\Windows\System32\sSTCbcs.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System32\ZtTBZMj.exe
  C:\Windows\System32\ZtTBZMj.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System32\jJoLNik.exe
  C:\Windows\System32\jJoLNik.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System32\NBGtznk.exe
  C:\Windows\System32\NBGtznk.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System32\nNXnbiB.exe
  C:\Windows\System32\nNXnbiB.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System32\KnXMzom.exe
  C:\Windows\System32\KnXMzom.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System32\aIhZYYY.exe
  C:\Windows\System32\aIhZYYY.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System32\VFtLktS.exe
  C:\Windows\System32\VFtLktS.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System32\XpadmEO.exe
  C:\Windows\System32\XpadmEO.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System32\CexClpK.exe
  C:\Windows\System32\CexClpK.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System32\FFSfhwv.exe
  C:\Windows\System32\FFSfhwv.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System32\euSunSS.exe
  C:\Windows\System32\euSunSS.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System32\hPJKdrU.exe
  C:\Windows\System32\hPJKdrU.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System32\FZWLhTo.exe
  C:\Windows\System32\FZWLhTo.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System32\aEaoOdm.exe
  C:\Windows\System32\aEaoOdm.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System32\jhynlUn.exe
  C:\Windows\System32\jhynlUn.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System32\DQZzPYN.exe
  C:\Windows\System32\DQZzPYN.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System32\sGcuWmS.exe
  C:\Windows\System32\sGcuWmS.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System32\KDGIYAI.exe
  C:\Windows\System32\KDGIYAI.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System32\vmxwXCt.exe
  C:\Windows\System32\vmxwXCt.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System32\VrjQQZr.exe
  C:\Windows\System32\VrjQQZr.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System32\CvDVNtc.exe
  C:\Windows\System32\CvDVNtc.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System32\WOhFBzv.exe
  C:\Windows\System32\WOhFBzv.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System32\jYSSCSm.exe
  C:\Windows\System32\jYSSCSm.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System32\tCAQYku.exe
  C:\Windows\System32\tCAQYku.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System32\DVUafVP.exe
  C:\Windows\System32\DVUafVP.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System32\JocFrWV.exe
  C:\Windows\System32\JocFrWV.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System32\RyFuNOr.exe
  C:\Windows\System32\RyFuNOr.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System32\wqqjVuR.exe
  C:\Windows\System32\wqqjVuR.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System32\cTlQuMZ.exe
  C:\Windows\System32\cTlQuMZ.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System32\GTeSvOw.exe
  C:\Windows\System32\GTeSvOw.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System32\AGTyWEP.exe
  C:\Windows\System32\AGTyWEP.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System32\fFRxVOB.exe
  C:\Windows\System32\fFRxVOB.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System32\PYdGyCl.exe
  C:\Windows\System32\PYdGyCl.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System32\ePxeLsi.exe
  C:\Windows\System32\ePxeLsi.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System32\OWpqICO.exe
  C:\Windows\System32\OWpqICO.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System32\rtfyChM.exe
  C:\Windows\System32\rtfyChM.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System32\mWfEzBU.exe
  C:\Windows\System32\mWfEzBU.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System32\yMBzioK.exe
  C:\Windows\System32\yMBzioK.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System32\OpznqWr.exe
  C:\Windows\System32\OpznqWr.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System32\zUhKvvW.exe
  C:\Windows\System32\zUhKvvW.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System32\turiEdb.exe
  C:\Windows\System32\turiEdb.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System32\UfDuRhO.exe
  C:\Windows\System32\UfDuRhO.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System32\IPfXXCI.exe
  C:\Windows\System32\IPfXXCI.exe
  2⤵
  PID:4116
- C:\Windows\System32\zxtnySI.exe
  C:\Windows\System32\zxtnySI.exe
  2⤵
  PID:3436
- C:\Windows\System32\hiwRgub.exe
  C:\Windows\System32\hiwRgub.exe
  2⤵
  PID:3068
- C:\Windows\System32\dFKDRMV.exe
  C:\Windows\System32\dFKDRMV.exe
  2⤵
  PID:3796
- C:\Windows\System32\PuPYGdE.exe
  C:\Windows\System32\PuPYGdE.exe
  2⤵
  PID:2344
- C:\Windows\System32\hLTnezO.exe
  C:\Windows\System32\hLTnezO.exe
  2⤵
  PID:3236
- C:\Windows\System32\pTGRtKB.exe
  C:\Windows\System32\pTGRtKB.exe
  2⤵
  PID:3356
- C:\Windows\System32\xPwtsiA.exe
  C:\Windows\System32\xPwtsiA.exe
  2⤵
  PID:4684
- C:\Windows\System32\TwkFzDX.exe
  C:\Windows\System32\TwkFzDX.exe
  2⤵
  PID:2440
- C:\Windows\System32\zBPBbwz.exe
  C:\Windows\System32\zBPBbwz.exe
  2⤵
  PID:1940
- C:\Windows\System32\SeOKSYR.exe
  C:\Windows\System32\SeOKSYR.exe
  2⤵
  PID:2100
- C:\Windows\System32\vdbMvvw.exe
  C:\Windows\System32\vdbMvvw.exe
  2⤵
  PID:4376
- C:\Windows\System32\NUDfjFv.exe
  C:\Windows\System32\NUDfjFv.exe
  2⤵
  PID:3820
- C:\Windows\System32\HRtWcrA.exe
  C:\Windows\System32\HRtWcrA.exe
  2⤵
  PID:1836
- C:\Windows\System32\zWQxdKu.exe
  C:\Windows\System32\zWQxdKu.exe
  2⤵
  PID:3616
- C:\Windows\System32\FfqRqGo.exe
  C:\Windows\System32\FfqRqGo.exe
  2⤵
  PID:4620
- C:\Windows\System32\XrHlTjb.exe
  C:\Windows\System32\XrHlTjb.exe
  2⤵
  PID:1044
- C:\Windows\System32\lIDxWDy.exe
  C:\Windows\System32\lIDxWDy.exe
  2⤵
  PID:4772
- C:\Windows\System32\ztUIPyK.exe
  C:\Windows\System32\ztUIPyK.exe
  2⤵
  PID:2268
- C:\Windows\System32\SBDPFTt.exe
  C:\Windows\System32\SBDPFTt.exe
  2⤵
  PID:4044
- C:\Windows\System32\UkPrwwy.exe
  C:\Windows\System32\UkPrwwy.exe
  2⤵
  PID:5056
- C:\Windows\System32\ArIyeuL.exe
  C:\Windows\System32\ArIyeuL.exe
  2⤵
  PID:2460
- C:\Windows\System32\ycrzJkQ.exe
  C:\Windows\System32\ycrzJkQ.exe
  2⤵
  PID:4608
- C:\Windows\System32\MYkvfdA.exe
  C:\Windows\System32\MYkvfdA.exe
  2⤵
  PID:2056
- C:\Windows\System32\KKZyaWK.exe
  C:\Windows\System32\KKZyaWK.exe
  2⤵
  PID:4724
- C:\Windows\System32\rkNnudq.exe
  C:\Windows\System32\rkNnudq.exe
  2⤵
  PID:2884
- C:\Windows\System32\UUENJVz.exe
  C:\Windows\System32\UUENJVz.exe
  2⤵
  PID:4508
- C:\Windows\System32\TBBnOoN.exe
  C:\Windows\System32\TBBnOoN.exe
  2⤵
  PID:3312
- C:\Windows\System32\mClNbTC.exe
  C:\Windows\System32\mClNbTC.exe
  2⤵
  PID:3292
- C:\Windows\System32\LvVuAwv.exe
  C:\Windows\System32\LvVuAwv.exe
  2⤵
  PID:2464
- C:\Windows\System32\UvsCBjn.exe
  C:\Windows\System32\UvsCBjn.exe
  2⤵
  PID:3716
- C:\Windows\System32\jTTDGvk.exe
  C:\Windows\System32\jTTDGvk.exe
  2⤵
  PID:5124
- C:\Windows\System32\nVyJUtR.exe
  C:\Windows\System32\nVyJUtR.exe
  2⤵
  PID:5152
- C:\Windows\System32\vJhTkyv.exe
  C:\Windows\System32\vJhTkyv.exe
  2⤵
  PID:5184
- C:\Windows\System32\mdEuuiO.exe
  C:\Windows\System32\mdEuuiO.exe
  2⤵
  PID:5212
- C:\Windows\System32\lSXddJU.exe
  C:\Windows\System32\lSXddJU.exe
  2⤵
  PID:5236
- C:\Windows\System32\sdSTnnD.exe
  C:\Windows\System32\sdSTnnD.exe
  2⤵
  PID:5268
- C:\Windows\System32\IBoUehW.exe
  C:\Windows\System32\IBoUehW.exe
  2⤵
  PID:5296
- C:\Windows\System32\aauZAMN.exe
  C:\Windows\System32\aauZAMN.exe
  2⤵
  PID:5324
- C:\Windows\System32\gMAmsLu.exe
  C:\Windows\System32\gMAmsLu.exe
  2⤵
  PID:5352
- C:\Windows\System32\VUKaUIF.exe
  C:\Windows\System32\VUKaUIF.exe
  2⤵
  PID:5380
- C:\Windows\System32\rgrrJpL.exe
  C:\Windows\System32\rgrrJpL.exe
  2⤵
  PID:5408
- C:\Windows\System32\FLbFRYs.exe
  C:\Windows\System32\FLbFRYs.exe
  2⤵
  PID:5436
- C:\Windows\System32\UbEIdmH.exe
  C:\Windows\System32\UbEIdmH.exe
  2⤵
  PID:5464
- C:\Windows\System32\dHbnDpo.exe
  C:\Windows\System32\dHbnDpo.exe
  2⤵
  PID:5492
- C:\Windows\System32\nBFqbDD.exe
  C:\Windows\System32\nBFqbDD.exe
  2⤵
  PID:5520
- C:\Windows\System32\luFOzhd.exe
  C:\Windows\System32\luFOzhd.exe
  2⤵
  PID:5548
- C:\Windows\System32\TOXiVlg.exe
  C:\Windows\System32\TOXiVlg.exe
  2⤵
  PID:5572
- C:\Windows\System32\bLBPNEL.exe
  C:\Windows\System32\bLBPNEL.exe
  2⤵
  PID:5604
- C:\Windows\System32\xMJgPcd.exe
  C:\Windows\System32\xMJgPcd.exe
  2⤵
  PID:5632
- C:\Windows\System32\OpZisHt.exe
  C:\Windows\System32\OpZisHt.exe
  2⤵
  PID:5660
- C:\Windows\System32\dNIWugf.exe
  C:\Windows\System32\dNIWugf.exe
  2⤵
  PID:5688
- C:\Windows\System32\reyFCJm.exe
  C:\Windows\System32\reyFCJm.exe
  2⤵
  PID:5716
- C:\Windows\System32\NMPTnOi.exe
  C:\Windows\System32\NMPTnOi.exe
  2⤵
  PID:5744
- C:\Windows\System32\xuoHIRm.exe
  C:\Windows\System32\xuoHIRm.exe
  2⤵
  PID:5772
- C:\Windows\System32\PMrgePR.exe
  C:\Windows\System32\PMrgePR.exe
  2⤵
  PID:5800
- C:\Windows\System32\zKGGghj.exe
  C:\Windows\System32\zKGGghj.exe
  2⤵
  PID:5840
- C:\Windows\System32\kUMKjdO.exe
  C:\Windows\System32\kUMKjdO.exe
  2⤵
  PID:5856
- C:\Windows\System32\UCsSXYi.exe
  C:\Windows\System32\UCsSXYi.exe
  2⤵
  PID:5880
- C:\Windows\System32\vLIZyEj.exe
  C:\Windows\System32\vLIZyEj.exe
  2⤵
  PID:5912
- C:\Windows\System32\GIQkJEW.exe
  C:\Windows\System32\GIQkJEW.exe
  2⤵
  PID:5940
- C:\Windows\System32\kdnbtjz.exe
  C:\Windows\System32\kdnbtjz.exe
  2⤵
  PID:5968
- C:\Windows\System32\lMDXPZN.exe
  C:\Windows\System32\lMDXPZN.exe
  2⤵
  PID:5996
- C:\Windows\System32\foMnhhI.exe
  C:\Windows\System32\foMnhhI.exe
  2⤵
  PID:3432
- C:\Windows\System32\nAYAraK.exe
  C:\Windows\System32\nAYAraK.exe
  2⤵
  PID:4312
- C:\Windows\System32\oNPyJwa.exe
  C:\Windows\System32\oNPyJwa.exe
  2⤵
  PID:2092
- C:\Windows\System32\ZMXfFgY.exe
  C:\Windows\System32\ZMXfFgY.exe
  2⤵
  PID:5148
- C:\Windows\System32\Cxjpnmp.exe
  C:\Windows\System32\Cxjpnmp.exe
  2⤵
  PID:5224
- C:\Windows\System32\yfjxWpp.exe
  C:\Windows\System32\yfjxWpp.exe
  2⤵
  PID:5280
- C:\Windows\System32\AtmiFhh.exe
  C:\Windows\System32\AtmiFhh.exe
  2⤵
  PID:5308
- C:\Windows\System32\YKXUUJY.exe
  C:\Windows\System32\YKXUUJY.exe
  2⤵
  PID:5360
- C:\Windows\System32\GqIdsFJ.exe
  C:\Windows\System32\GqIdsFJ.exe
  2⤵
  PID:5420
- C:\Windows\System32\qBrCdhr.exe
  C:\Windows\System32\qBrCdhr.exe
  2⤵
  PID:5472
- C:\Windows\System32\yPTFOtA.exe
  C:\Windows\System32\yPTFOtA.exe
  2⤵
  PID:5512
- C:\Windows\System32\WmCnRtS.exe
  C:\Windows\System32\WmCnRtS.exe
  2⤵
  PID:5528
- C:\Windows\System32\eNBXoHg.exe
  C:\Windows\System32\eNBXoHg.exe
  2⤵
  PID:5640
- C:\Windows\System32\exKCYvs.exe
  C:\Windows\System32\exKCYvs.exe
  2⤵
  PID:5680
- C:\Windows\System32\NTRcQaN.exe
  C:\Windows\System32\NTRcQaN.exe
  2⤵
  PID:5736
- C:\Windows\System32\oIVGQYK.exe
  C:\Windows\System32\oIVGQYK.exe
  2⤵
  PID:2796
- C:\Windows\System32\Eiznayv.exe
  C:\Windows\System32\Eiznayv.exe
  2⤵
  PID:5780
- C:\Windows\System32\rxPbGPs.exe
  C:\Windows\System32\rxPbGPs.exe
  2⤵
  PID:1360
- C:\Windows\System32\sVMxYUV.exe
  C:\Windows\System32\sVMxYUV.exe
  2⤵
  PID:4080
- C:\Windows\System32\BWWANwe.exe
  C:\Windows\System32\BWWANwe.exe
  2⤵
  PID:5888
- C:\Windows\System32\kICVDTq.exe
  C:\Windows\System32\kICVDTq.exe
  2⤵
  PID:6004
- C:\Windows\System32\FMZPjGz.exe
  C:\Windows\System32\FMZPjGz.exe
  2⤵
  PID:5980
- C:\Windows\System32\qXeCMgC.exe
  C:\Windows\System32\qXeCMgC.exe
  2⤵
  PID:5948
- C:\Windows\System32\NGMJUfU.exe
  C:\Windows\System32\NGMJUfU.exe
  2⤵
  PID:5988
- C:\Windows\System32\sjYsHyp.exe
  C:\Windows\System32\sjYsHyp.exe
  2⤵
  PID:6088
- C:\Windows\System32\YONKUZr.exe
  C:\Windows\System32\YONKUZr.exe
  2⤵
  PID:6100
- C:\Windows\System32\SHKvtmM.exe
  C:\Windows\System32\SHKvtmM.exe
  2⤵
  PID:6124
- C:\Windows\System32\cERwExe.exe
  C:\Windows\System32\cERwExe.exe
  2⤵
  PID:5052
- C:\Windows\System32\lTLVHgB.exe
  C:\Windows\System32\lTLVHgB.exe
  2⤵
  PID:1728
- C:\Windows\System32\CTgsTov.exe
  C:\Windows\System32\CTgsTov.exe
  2⤵
  PID:2168
- C:\Windows\System32\YHCbjgl.exe
  C:\Windows\System32\YHCbjgl.exe
  2⤵
  PID:1020
- C:\Windows\System32\jqkFjZO.exe
  C:\Windows\System32\jqkFjZO.exe
  2⤵
  PID:392
- C:\Windows\System32\EYAklEa.exe
  C:\Windows\System32\EYAklEa.exe
  2⤵
  PID:5540
- C:\Windows\System32\QDJogDx.exe
  C:\Windows\System32\QDJogDx.exe
  2⤵
  PID:4480
- C:\Windows\System32\vLgJnME.exe
  C:\Windows\System32\vLgJnME.exe
  2⤵
  PID:3776
- C:\Windows\System32\CeBeDXW.exe
  C:\Windows\System32\CeBeDXW.exe
  2⤵
  PID:5848
- C:\Windows\System32\cbqWeFh.exe
  C:\Windows\System32\cbqWeFh.exe
  2⤵
  PID:4732
- C:\Windows\System32\YCWcJsx.exe
  C:\Windows\System32\YCWcJsx.exe
  2⤵
  PID:3348
- C:\Windows\System32\eRIkxRf.exe
  C:\Windows\System32\eRIkxRf.exe
  2⤵
  PID:3016
- C:\Windows\System32\uZOTFrw.exe
  C:\Windows\System32\uZOTFrw.exe
  2⤵
  PID:1480
- C:\Windows\System32\YphFlFx.exe
  C:\Windows\System32\YphFlFx.exe
  2⤵
  PID:4712
- C:\Windows\System32\csYPceR.exe
  C:\Windows\System32\csYPceR.exe
  2⤵
  PID:4192
- C:\Windows\System32\zuHLeYt.exe
  C:\Windows\System32\zuHLeYt.exe
  2⤵
  PID:3048
- C:\Windows\System32\nKePetb.exe
  C:\Windows\System32\nKePetb.exe
  2⤵
  PID:5868
- C:\Windows\System32\XCQOENC.exe
  C:\Windows\System32\XCQOENC.exe
  2⤵
  PID:6084
- C:\Windows\System32\JeIVcWn.exe
  C:\Windows\System32\JeIVcWn.exe
  2⤵
  PID:5792
- C:\Windows\System32\BSxLQCX.exe
  C:\Windows\System32\BSxLQCX.exe
  2⤵
  PID:4336
- C:\Windows\System32\pAzluhX.exe
  C:\Windows\System32\pAzluhX.exe
  2⤵
  PID:6116
- C:\Windows\System32\DBcQPhU.exe
  C:\Windows\System32\DBcQPhU.exe
  2⤵
  PID:6156
- C:\Windows\System32\nWaTnLG.exe
  C:\Windows\System32\nWaTnLG.exe
  2⤵
  PID:6176
- C:\Windows\System32\secLNQW.exe
  C:\Windows\System32\secLNQW.exe
  2⤵
  PID:6200
- C:\Windows\System32\TEccKJz.exe
  C:\Windows\System32\TEccKJz.exe
  2⤵
  PID:6228
- C:\Windows\System32\ZSMyYmO.exe
  C:\Windows\System32\ZSMyYmO.exe
  2⤵
  PID:6248
- C:\Windows\System32\JCdWicA.exe
  C:\Windows\System32\JCdWicA.exe
  2⤵
  PID:6288
- C:\Windows\System32\FxuAEXW.exe
  C:\Windows\System32\FxuAEXW.exe
  2⤵
  PID:6320
- C:\Windows\System32\PbogMBm.exe
  C:\Windows\System32\PbogMBm.exe
  2⤵
  PID:6336
- C:\Windows\System32\TRMrmvt.exe
  C:\Windows\System32\TRMrmvt.exe
  2⤵
  PID:6356
- C:\Windows\System32\dJlqbkQ.exe
  C:\Windows\System32\dJlqbkQ.exe
  2⤵
  PID:6380
- C:\Windows\System32\MrZrxYN.exe
  C:\Windows\System32\MrZrxYN.exe
  2⤵
  PID:6424
- C:\Windows\System32\qrVpgBG.exe
  C:\Windows\System32\qrVpgBG.exe
  2⤵
  PID:6456
- C:\Windows\System32\ttFyoRA.exe
  C:\Windows\System32\ttFyoRA.exe
  2⤵
  PID:6480
- C:\Windows\System32\hTFOOHZ.exe
  C:\Windows\System32\hTFOOHZ.exe
  2⤵
  PID:6500
- C:\Windows\System32\ldnnaHI.exe
  C:\Windows\System32\ldnnaHI.exe
  2⤵
  PID:6552
- C:\Windows\System32\TkQvcRn.exe
  C:\Windows\System32\TkQvcRn.exe
  2⤵
  PID:6592
- C:\Windows\System32\ZuNYBPf.exe
  C:\Windows\System32\ZuNYBPf.exe
  2⤵
  PID:6620
- C:\Windows\System32\ySLQirn.exe
  C:\Windows\System32\ySLQirn.exe
  2⤵
  PID:6656
- C:\Windows\System32\UFAPQlp.exe
  C:\Windows\System32\UFAPQlp.exe
  2⤵
  PID:6688
- C:\Windows\System32\xfzuXgH.exe
  C:\Windows\System32\xfzuXgH.exe
  2⤵
  PID:6716
- C:\Windows\System32\czPXPII.exe
  C:\Windows\System32\czPXPII.exe
  2⤵
  PID:6740
- C:\Windows\System32\HsiiKAA.exe
  C:\Windows\System32\HsiiKAA.exe
  2⤵
  PID:6760
- C:\Windows\System32\slXTeQk.exe
  C:\Windows\System32\slXTeQk.exe
  2⤵
  PID:6780
- C:\Windows\System32\gTdhOXf.exe
  C:\Windows\System32\gTdhOXf.exe
  2⤵
  PID:6796
- C:\Windows\System32\qtXvVuD.exe
  C:\Windows\System32\qtXvVuD.exe
  2⤵
  PID:6844
- C:\Windows\System32\NNZTlbf.exe
  C:\Windows\System32\NNZTlbf.exe
  2⤵
  PID:6884
- C:\Windows\System32\oVvBuJC.exe
  C:\Windows\System32\oVvBuJC.exe
  2⤵
  PID:6912
- C:\Windows\System32\RRtqIjx.exe
  C:\Windows\System32\RRtqIjx.exe
  2⤵
  PID:6940
- C:\Windows\System32\xPsRImv.exe
  C:\Windows\System32\xPsRImv.exe
  2⤵
  PID:6968
- C:\Windows\System32\uCFzxTO.exe
  C:\Windows\System32\uCFzxTO.exe
  2⤵
  PID:6996
- C:\Windows\System32\UqMxXep.exe
  C:\Windows\System32\UqMxXep.exe
  2⤵
  PID:7012
- C:\Windows\System32\ZAwCWfF.exe
  C:\Windows\System32\ZAwCWfF.exe
  2⤵
  PID:7040
- C:\Windows\System32\hgNWnzg.exe
  C:\Windows\System32\hgNWnzg.exe
  2⤵
  PID:7056
- C:\Windows\System32\JBSJfoh.exe
  C:\Windows\System32\JBSJfoh.exe
  2⤵
  PID:7104
- C:\Windows\System32\zNJSDXV.exe
  C:\Windows\System32\zNJSDXV.exe
  2⤵
  PID:7136
- C:\Windows\System32\FWPSPFr.exe
  C:\Windows\System32\FWPSPFr.exe
  2⤵
  PID:5392
- C:\Windows\System32\VOnuETb.exe
  C:\Windows\System32\VOnuETb.exe
  2⤵
  PID:6172
- C:\Windows\System32\LkktBSp.exe
  C:\Windows\System32\LkktBSp.exe
  2⤵
  PID:6244
- C:\Windows\System32\AtLNoOg.exe
  C:\Windows\System32\AtLNoOg.exe
  2⤵
  PID:6304
- C:\Windows\System32\MiLNKrg.exe
  C:\Windows\System32\MiLNKrg.exe
  2⤵
  PID:6352
- C:\Windows\System32\Pvrifug.exe
  C:\Windows\System32\Pvrifug.exe
  2⤵
  PID:6388
- C:\Windows\System32\aDeyAJX.exe
  C:\Windows\System32\aDeyAJX.exe
  2⤵
  PID:6492
- C:\Windows\System32\EFCJdxI.exe
  C:\Windows\System32\EFCJdxI.exe
  2⤵
  PID:6508
- C:\Windows\System32\qxRzIHL.exe
  C:\Windows\System32\qxRzIHL.exe
  2⤵
  PID:6576
- C:\Windows\System32\TAfFPRG.exe
  C:\Windows\System32\TAfFPRG.exe
  2⤵
  PID:6680
- C:\Windows\System32\gASBkiV.exe
  C:\Windows\System32\gASBkiV.exe
  2⤵
  PID:6736
- C:\Windows\System32\CxtHqIq.exe
  C:\Windows\System32\CxtHqIq.exe
  2⤵
  PID:6804
- C:\Windows\System32\TDimEga.exe
  C:\Windows\System32\TDimEga.exe
  2⤵
  PID:6860
- C:\Windows\System32\nGUzzfS.exe
  C:\Windows\System32\nGUzzfS.exe
  2⤵
  PID:6924
- C:\Windows\System32\piEBeOU.exe
  C:\Windows\System32\piEBeOU.exe
  2⤵
  PID:6964
- C:\Windows\System32\OiHonnu.exe
  C:\Windows\System32\OiHonnu.exe
  2⤵
  PID:7028
- C:\Windows\System32\ZqqkJOw.exe
  C:\Windows\System32\ZqqkJOw.exe
  2⤵
  PID:7096
- C:\Windows\System32\AziZemi.exe
  C:\Windows\System32\AziZemi.exe
  2⤵
  PID:7128
- C:\Windows\System32\ePBDYMp.exe
  C:\Windows\System32\ePBDYMp.exe
  2⤵
  PID:6268
- C:\Windows\System32\MydTSdP.exe
  C:\Windows\System32\MydTSdP.exe
  2⤵
  PID:6536
- C:\Windows\System32\iFDUEtv.exe
  C:\Windows\System32\iFDUEtv.exe
  2⤵
  PID:6640
- C:\Windows\System32\QTaFqeG.exe
  C:\Windows\System32\QTaFqeG.exe
  2⤵
  PID:6728
- C:\Windows\System32\smoQSAw.exe
  C:\Windows\System32\smoQSAw.exe
  2⤵
  PID:6880
- C:\Windows\System32\zoighFg.exe
  C:\Windows\System32\zoighFg.exe
  2⤵
  PID:6196
- C:\Windows\System32\XmuOQtD.exe
  C:\Windows\System32\XmuOQtD.exe
  2⤵
  PID:6332
- C:\Windows\System32\TTCfdlR.exe
  C:\Windows\System32\TTCfdlR.exe
  2⤵
  PID:6588
- C:\Windows\System32\YNVcNZc.exe
  C:\Windows\System32\YNVcNZc.exe
  2⤵
  PID:2652
- C:\Windows\System32\AQyUsJT.exe
  C:\Windows\System32\AQyUsJT.exe
  2⤵
  PID:6152
- C:\Windows\System32\tpSibts.exe
  C:\Windows\System32\tpSibts.exe
  2⤵
  PID:6952
- C:\Windows\System32\GkCMKYl.exe
  C:\Windows\System32\GkCMKYl.exe
  2⤵
  PID:7184
- C:\Windows\System32\ynNivxt.exe
  C:\Windows\System32\ynNivxt.exe
  2⤵
  PID:7208
- C:\Windows\System32\KQjOQqx.exe
  C:\Windows\System32\KQjOQqx.exe
  2⤵
  PID:7236
- C:\Windows\System32\WqjQlUn.exe
  C:\Windows\System32\WqjQlUn.exe
  2⤵
  PID:7256
- C:\Windows\System32\lcKJEYp.exe
  C:\Windows\System32\lcKJEYp.exe
  2⤵
  PID:7280
- C:\Windows\System32\VanwvuL.exe
  C:\Windows\System32\VanwvuL.exe
  2⤵
  PID:7300
- C:\Windows\System32\VXXxQPq.exe
  C:\Windows\System32\VXXxQPq.exe
  2⤵
  PID:7324
- C:\Windows\System32\mKJMjxt.exe
  C:\Windows\System32\mKJMjxt.exe
  2⤵
  PID:7352
- C:\Windows\System32\lLtLqiS.exe
  C:\Windows\System32\lLtLqiS.exe
  2⤵
  PID:7404
- C:\Windows\System32\kqRVdHk.exe
  C:\Windows\System32\kqRVdHk.exe
  2⤵
  PID:7448
- C:\Windows\System32\TepSjAp.exe
  C:\Windows\System32\TepSjAp.exe
  2⤵
  PID:7480
- C:\Windows\System32\hApKmcv.exe
  C:\Windows\System32\hApKmcv.exe
  2⤵
  PID:7504
- C:\Windows\System32\wsAOxtI.exe
  C:\Windows\System32\wsAOxtI.exe
  2⤵
  PID:7528
- C:\Windows\System32\XjFtTBv.exe
  C:\Windows\System32\XjFtTBv.exe
  2⤵
  PID:7556
- C:\Windows\System32\LWEeKbB.exe
  C:\Windows\System32\LWEeKbB.exe
  2⤵
  PID:7576
- C:\Windows\System32\hPLTkNc.exe
  C:\Windows\System32\hPLTkNc.exe
  2⤵
  PID:7624
- C:\Windows\System32\SARrDfw.exe
  C:\Windows\System32\SARrDfw.exe
  2⤵
  PID:7652
- C:\Windows\System32\SfcTzPH.exe
  C:\Windows\System32\SfcTzPH.exe
  2⤵
  PID:7668
- C:\Windows\System32\jpgRMAG.exe
  C:\Windows\System32\jpgRMAG.exe
  2⤵
  PID:7696
- C:\Windows\System32\jFZSJWX.exe
  C:\Windows\System32\jFZSJWX.exe
  2⤵
  PID:7716
- C:\Windows\System32\SPwEWKH.exe
  C:\Windows\System32\SPwEWKH.exe
  2⤵
  PID:7752
- C:\Windows\System32\XpSKzlc.exe
  C:\Windows\System32\XpSKzlc.exe
  2⤵
  PID:7768
- C:\Windows\System32\hLqHbWW.exe
  C:\Windows\System32\hLqHbWW.exe
  2⤵
  PID:7796
- C:\Windows\System32\UfVWHOl.exe
  C:\Windows\System32\UfVWHOl.exe
  2⤵
  PID:7844
- C:\Windows\System32\BFeNGBr.exe
  C:\Windows\System32\BFeNGBr.exe
  2⤵
  PID:7872
- C:\Windows\System32\paMmZqa.exe
  C:\Windows\System32\paMmZqa.exe
  2⤵
  PID:7892
- C:\Windows\System32\gzKHTjW.exe
  C:\Windows\System32\gzKHTjW.exe
  2⤵
  PID:7920
- C:\Windows\System32\qloJowi.exe
  C:\Windows\System32\qloJowi.exe
  2⤵
  PID:7940
- C:\Windows\System32\ArRuTOS.exe
  C:\Windows\System32\ArRuTOS.exe
  2⤵
  PID:7976
- C:\Windows\System32\IHbsEpG.exe
  C:\Windows\System32\IHbsEpG.exe
  2⤵
  PID:7996
- C:\Windows\System32\PgQhgxV.exe
  C:\Windows\System32\PgQhgxV.exe
  2⤵
  PID:8028
- C:\Windows\System32\HiFhvhV.exe
  C:\Windows\System32\HiFhvhV.exe
  2⤵
  PID:8064
- C:\Windows\System32\aPaqsfn.exe
  C:\Windows\System32\aPaqsfn.exe
  2⤵
  PID:8088
- C:\Windows\System32\XvZiLUy.exe
  C:\Windows\System32\XvZiLUy.exe
  2⤵
  PID:8104
- C:\Windows\System32\sxGgaQK.exe
  C:\Windows\System32\sxGgaQK.exe
  2⤵
  PID:8148
- C:\Windows\System32\fHIMbTV.exe
  C:\Windows\System32\fHIMbTV.exe
  2⤵
  PID:8184
- C:\Windows\System32\USVfszY.exe
  C:\Windows\System32\USVfszY.exe
  2⤵
  PID:6700
- C:\Windows\System32\VQurNgd.exe
  C:\Windows\System32\VQurNgd.exe
  2⤵
  PID:7224
- C:\Windows\System32\OlEfPBe.exe
  C:\Windows\System32\OlEfPBe.exe
  2⤵
  PID:7340
- C:\Windows\System32\nYbwuKn.exe
  C:\Windows\System32\nYbwuKn.exe
  2⤵
  PID:7268
- C:\Windows\System32\wmiUHIo.exe
  C:\Windows\System32\wmiUHIo.exe
  2⤵
  PID:7416
- C:\Windows\System32\lbCoTgX.exe
  C:\Windows\System32\lbCoTgX.exe
  2⤵
  PID:7544
- C:\Windows\System32\YhyICHp.exe
  C:\Windows\System32\YhyICHp.exe
  2⤵
  PID:7568
- C:\Windows\System32\LiJUcLh.exe
  C:\Windows\System32\LiJUcLh.exe
  2⤵
  PID:7612
- C:\Windows\System32\SuEFVRZ.exe
  C:\Windows\System32\SuEFVRZ.exe
  2⤵
  PID:7664
- C:\Windows\System32\BKtTJLq.exe
  C:\Windows\System32\BKtTJLq.exe
  2⤵
  PID:7712
- C:\Windows\System32\kStFPwS.exe
  C:\Windows\System32\kStFPwS.exe
  2⤵
  PID:7780
- C:\Windows\System32\rTukryZ.exe
  C:\Windows\System32\rTukryZ.exe
  2⤵
  PID:7828
- C:\Windows\System32\BgkGHAs.exe
  C:\Windows\System32\BgkGHAs.exe
  2⤵
  PID:7916
- C:\Windows\System32\oANuWMu.exe
  C:\Windows\System32\oANuWMu.exe
  2⤵
  PID:7956
- C:\Windows\System32\wIxccBG.exe
  C:\Windows\System32\wIxccBG.exe
  2⤵
  PID:8072
- C:\Windows\System32\avDPPzL.exe
  C:\Windows\System32\avDPPzL.exe
  2⤵
  PID:8120
- C:\Windows\System32\lQofUCa.exe
  C:\Windows\System32\lQofUCa.exe
  2⤵
  PID:8176
- C:\Windows\System32\UksDEWO.exe
  C:\Windows\System32\UksDEWO.exe
  2⤵
  PID:7316
- C:\Windows\System32\GdkVlur.exe
  C:\Windows\System32\GdkVlur.exe
  2⤵
  PID:7564
- C:\Windows\System32\XcJQGQG.exe
  C:\Windows\System32\XcJQGQG.exe
  2⤵
  PID:7660
- C:\Windows\System32\WEHDfkR.exe
  C:\Windows\System32\WEHDfkR.exe
  2⤵
  PID:7832
- C:\Windows\System32\gfqTGvT.exe
  C:\Windows\System32\gfqTGvT.exe
  2⤵
  PID:8128
- C:\Windows\System32\IuluMwF.exe
  C:\Windows\System32\IuluMwF.exe
  2⤵
  PID:7444
- C:\Windows\System32\yGoSyjY.exe
  C:\Windows\System32\yGoSyjY.exe
  2⤵
  PID:7748
- C:\Windows\System32\TymAhsM.exe
  C:\Windows\System32\TymAhsM.exe
  2⤵
  PID:7680
- C:\Windows\System32\KptsMaP.exe
  C:\Windows\System32\KptsMaP.exe
  2⤵
  PID:7176
- C:\Windows\System32\MxpXboq.exe
  C:\Windows\System32\MxpXboq.exe
  2⤵
  PID:8212
- C:\Windows\System32\hYvzvCW.exe
  C:\Windows\System32\hYvzvCW.exe
  2⤵
  PID:8236
- C:\Windows\System32\MPvhCVY.exe
  C:\Windows\System32\MPvhCVY.exe
  2⤵
  PID:8256
- C:\Windows\System32\TyuMLgH.exe
  C:\Windows\System32\TyuMLgH.exe
  2⤵
  PID:8272
- C:\Windows\System32\yTNDMGR.exe
  C:\Windows\System32\yTNDMGR.exe
  2⤵
  PID:8304
- C:\Windows\System32\ERRhICB.exe
  C:\Windows\System32\ERRhICB.exe
  2⤵
  PID:8328
- C:\Windows\System32\OdxszDM.exe
  C:\Windows\System32\OdxszDM.exe
  2⤵
  PID:8368
- C:\Windows\System32\smhLpRT.exe
  C:\Windows\System32\smhLpRT.exe
  2⤵
  PID:8396
- C:\Windows\System32\GMOlyMO.exe
  C:\Windows\System32\GMOlyMO.exe
  2⤵
  PID:8476
- C:\Windows\System32\WzgXJgh.exe
  C:\Windows\System32\WzgXJgh.exe
  2⤵
  PID:8552
- C:\Windows\System32\pgOVjft.exe
  C:\Windows\System32\pgOVjft.exe
  2⤵
  PID:8572
- C:\Windows\System32\zQYzCjY.exe
  C:\Windows\System32\zQYzCjY.exe
  2⤵
  PID:8620
- C:\Windows\System32\dNltCaQ.exe
  C:\Windows\System32\dNltCaQ.exe
  2⤵
  PID:8680
- C:\Windows\System32\UVxrBRy.exe
  C:\Windows\System32\UVxrBRy.exe
  2⤵
  PID:8704
- C:\Windows\System32\HCUiBej.exe
  C:\Windows\System32\HCUiBej.exe
  2⤵
  PID:8732
- C:\Windows\System32\HilasxO.exe
  C:\Windows\System32\HilasxO.exe
  2⤵
  PID:8752
- C:\Windows\System32\exftEwi.exe
  C:\Windows\System32\exftEwi.exe
  2⤵
  PID:8800
- C:\Windows\System32\XsIJTqt.exe
  C:\Windows\System32\XsIJTqt.exe
  2⤵
  PID:8820
- C:\Windows\System32\BulbYOf.exe
  C:\Windows\System32\BulbYOf.exe
  2⤵
  PID:8840
- C:\Windows\System32\nKqpTYw.exe
  C:\Windows\System32\nKqpTYw.exe
  2⤵
  PID:8864
- C:\Windows\System32\IOVLFMp.exe
  C:\Windows\System32\IOVLFMp.exe
  2⤵
  PID:8880
- C:\Windows\System32\vgwrkSV.exe
  C:\Windows\System32\vgwrkSV.exe
  2⤵
  PID:8916
- C:\Windows\System32\VlmYUhl.exe
  C:\Windows\System32\VlmYUhl.exe
  2⤵
  PID:8936
- C:\Windows\System32\tmgydQO.exe
  C:\Windows\System32\tmgydQO.exe
  2⤵
  PID:8980
- C:\Windows\System32\eUxTGRz.exe
  C:\Windows\System32\eUxTGRz.exe
  2⤵
  PID:9000
- C:\Windows\System32\lwLayNI.exe
  C:\Windows\System32\lwLayNI.exe
  2⤵
  PID:9024
- C:\Windows\System32\qhFRtaw.exe
  C:\Windows\System32\qhFRtaw.exe
  2⤵
  PID:9056
- C:\Windows\System32\hpMJnYd.exe
  C:\Windows\System32\hpMJnYd.exe
  2⤵
  PID:9080
- C:\Windows\System32\fqNikzM.exe
  C:\Windows\System32\fqNikzM.exe
  2⤵
  PID:9104
- C:\Windows\System32\KtTmlCV.exe
  C:\Windows\System32\KtTmlCV.exe
  2⤵
  PID:9148
- C:\Windows\System32\FpcqkJU.exe
  C:\Windows\System32\FpcqkJU.exe
  2⤵
  PID:9168
- C:\Windows\System32\htNDSZD.exe
  C:\Windows\System32\htNDSZD.exe
  2⤵
  PID:9192
- C:\Windows\System32\HUtMQEQ.exe
  C:\Windows\System32\HUtMQEQ.exe
  2⤵
  PID:9212
- C:\Windows\System32\qSrAvwr.exe
  C:\Windows\System32\qSrAvwr.exe
  2⤵
  PID:8252
- C:\Windows\System32\keXXSBe.exe
  C:\Windows\System32\keXXSBe.exe
  2⤵
  PID:8464
- C:\Windows\System32\WwbOadW.exe
  C:\Windows\System32\WwbOadW.exe
  2⤵
  PID:8500
- C:\Windows\System32\EqCvWEN.exe
  C:\Windows\System32\EqCvWEN.exe
  2⤵
  PID:8452
- C:\Windows\System32\FcIAqgO.exe
  C:\Windows\System32\FcIAqgO.exe
  2⤵
  PID:8432
- C:\Windows\System32\DfpjyfQ.exe
  C:\Windows\System32\DfpjyfQ.exe
  2⤵
  PID:8496
- C:\Windows\System32\xIMGNwm.exe
  C:\Windows\System32\xIMGNwm.exe
  2⤵
  PID:8584
- C:\Windows\System32\NfYBpAT.exe
  C:\Windows\System32\NfYBpAT.exe
  2⤵
  PID:8636
- C:\Windows\System32\fchrVaK.exe
  C:\Windows\System32\fchrVaK.exe
  2⤵
  PID:8664
- C:\Windows\System32\IGwlsgW.exe
  C:\Windows\System32\IGwlsgW.exe
  2⤵
  PID:8740
- C:\Windows\System32\RRLupEz.exe
  C:\Windows\System32\RRLupEz.exe
  2⤵
  PID:8812
- C:\Windows\System32\OQmUTqA.exe
  C:\Windows\System32\OQmUTqA.exe
  2⤵
  PID:8836
- C:\Windows\System32\DDIyVew.exe
  C:\Windows\System32\DDIyVew.exe
  2⤵
  PID:8876
- C:\Windows\System32\GbzoqSF.exe
  C:\Windows\System32\GbzoqSF.exe
  2⤵
  PID:8932
- C:\Windows\System32\hjiWTmQ.exe
  C:\Windows\System32\hjiWTmQ.exe
  2⤵
  PID:8996
- C:\Windows\System32\zcDXrVT.exe
  C:\Windows\System32\zcDXrVT.exe
  2⤵
  PID:4984
- C:\Windows\System32\MNEUttg.exe
  C:\Windows\System32\MNEUttg.exe
  2⤵
  PID:9132
- C:\Windows\System32\GaUObIv.exe
  C:\Windows\System32\GaUObIv.exe
  2⤵
  PID:9092
- C:\Windows\System32\TwwuxzY.exe
  C:\Windows\System32\TwwuxzY.exe
  2⤵
  PID:8248
- C:\Windows\System32\ZvvOppQ.exe
  C:\Windows\System32\ZvvOppQ.exe
  2⤵
  PID:8296
- C:\Windows\System32\egjbqvr.exe
  C:\Windows\System32\egjbqvr.exe
  2⤵
  PID:8492
- C:\Windows\System32\enHhher.exe
  C:\Windows\System32\enHhher.exe
  2⤵
  PID:8376
- C:\Windows\System32\TaTHcad.exe
  C:\Windows\System32\TaTHcad.exe
  2⤵
  PID:8808
- C:\Windows\System32\CTJeovu.exe
  C:\Windows\System32\CTJeovu.exe
  2⤵
  PID:8928
- C:\Windows\System32\YZmvmnw.exe
  C:\Windows\System32\YZmvmnw.exe
  2⤵
  PID:8968
- C:\Windows\System32\yGoRyMV.exe
  C:\Windows\System32\yGoRyMV.exe
  2⤵
  PID:9096
- C:\Windows\System32\QlCJqpS.exe
  C:\Windows\System32\QlCJqpS.exe
  2⤵
  PID:8524
- C:\Windows\System32\RZwFPZA.exe
  C:\Windows\System32\RZwFPZA.exe
  2⤵
  PID:8656
- C:\Windows\System32\oqXXlGP.exe
  C:\Windows\System32\oqXXlGP.exe
  2⤵
  PID:8760
- C:\Windows\System32\HUbPocC.exe
  C:\Windows\System32\HUbPocC.exe
  2⤵
  PID:9052
- C:\Windows\System32\KQpNXWX.exe
  C:\Windows\System32\KQpNXWX.exe
  2⤵
  PID:1364
- C:\Windows\System32\sRtSIAi.exe
  C:\Windows\System32\sRtSIAi.exe
  2⤵
  PID:8580
- C:\Windows\System32\WqqzGKK.exe
  C:\Windows\System32\WqqzGKK.exe
  2⤵
  PID:9244
- C:\Windows\System32\sivSGsV.exe
  C:\Windows\System32\sivSGsV.exe
  2⤵
  PID:9268
- C:\Windows\System32\sLsCMLR.exe
  C:\Windows\System32\sLsCMLR.exe
  2⤵
  PID:9304
- C:\Windows\System32\lpXIsZH.exe
  C:\Windows\System32\lpXIsZH.exe
  2⤵
  PID:9332
- C:\Windows\System32\ZjPfZyU.exe
  C:\Windows\System32\ZjPfZyU.exe
  2⤵
  PID:9360
- C:\Windows\System32\osFtdJK.exe
  C:\Windows\System32\osFtdJK.exe
  2⤵
  PID:9388
- C:\Windows\System32\hWmzkee.exe
  C:\Windows\System32\hWmzkee.exe
  2⤵
  PID:9408
- C:\Windows\System32\UPKITkF.exe
  C:\Windows\System32\UPKITkF.exe
  2⤵
  PID:9424
- C:\Windows\System32\eblVBcs.exe
  C:\Windows\System32\eblVBcs.exe
  2⤵
  PID:9444
- C:\Windows\System32\YKWEMaO.exe
  C:\Windows\System32\YKWEMaO.exe
  2⤵
  PID:9476
- C:\Windows\System32\ftPwNuE.exe
  C:\Windows\System32\ftPwNuE.exe
  2⤵
  PID:9516
- C:\Windows\System32\NQVyeXE.exe
  C:\Windows\System32\NQVyeXE.exe
  2⤵
  PID:9548
- C:\Windows\System32\tKEVkIz.exe
  C:\Windows\System32\tKEVkIz.exe
  2⤵
  PID:9564
- C:\Windows\System32\TiJIXjS.exe
  C:\Windows\System32\TiJIXjS.exe
  2⤵
  PID:9592
- C:\Windows\System32\WOhLyPn.exe
  C:\Windows\System32\WOhLyPn.exe
  2⤵
  PID:9616
- C:\Windows\System32\hzQudoi.exe
  C:\Windows\System32\hzQudoi.exe
  2⤵
  PID:9636
- C:\Windows\System32\TWufkKq.exe
  C:\Windows\System32\TWufkKq.exe
  2⤵
  PID:9660
- C:\Windows\System32\fYMQPGz.exe
  C:\Windows\System32\fYMQPGz.exe
  2⤵
  PID:9688
- C:\Windows\System32\YLhHhhH.exe
  C:\Windows\System32\YLhHhhH.exe
  2⤵
  PID:9724
- C:\Windows\System32\buQbHcm.exe
  C:\Windows\System32\buQbHcm.exe
  2⤵
  PID:9744
- C:\Windows\System32\KHixLUx.exe
  C:\Windows\System32\KHixLUx.exe
  2⤵
  PID:9808
- C:\Windows\System32\ZCmbkrP.exe
  C:\Windows\System32\ZCmbkrP.exe
  2⤵
  PID:9860
- C:\Windows\System32\asTLUAS.exe
  C:\Windows\System32\asTLUAS.exe
  2⤵
  PID:9876
- C:\Windows\System32\HXvJbLp.exe
  C:\Windows\System32\HXvJbLp.exe
  2⤵
  PID:9900
- C:\Windows\System32\XcCpUbl.exe
  C:\Windows\System32\XcCpUbl.exe
  2⤵
  PID:9944
- C:\Windows\System32\yYbSHur.exe
  C:\Windows\System32\yYbSHur.exe
  2⤵
  PID:9976
- C:\Windows\System32\aCuDXXY.exe
  C:\Windows\System32\aCuDXXY.exe
  2⤵
  PID:9992
- C:\Windows\System32\ZMDRWVX.exe
  C:\Windows\System32\ZMDRWVX.exe
  2⤵
  PID:10020
- C:\Windows\System32\FBZbuzt.exe
  C:\Windows\System32\FBZbuzt.exe
  2⤵
  PID:10036
- C:\Windows\System32\OmUxMli.exe
  C:\Windows\System32\OmUxMli.exe
  2⤵
  PID:10052
- C:\Windows\System32\pDbmSQj.exe
  C:\Windows\System32\pDbmSQj.exe
  2⤵
  PID:10088
- C:\Windows\System32\LGUSLcH.exe
  C:\Windows\System32\LGUSLcH.exe
  2⤵
  PID:10124
- C:\Windows\System32\ZMChwOC.exe
  C:\Windows\System32\ZMChwOC.exe
  2⤵
  PID:10140
- C:\Windows\System32\eFniBRw.exe
  C:\Windows\System32\eFniBRw.exe
  2⤵
  PID:10188
- C:\Windows\System32\tWGtXyl.exe
  C:\Windows\System32\tWGtXyl.exe
  2⤵
  PID:10232
- C:\Windows\System32\WylHjVq.exe
  C:\Windows\System32\WylHjVq.exe
  2⤵
  PID:4680
- C:\Windows\System32\pgsgbjk.exe
  C:\Windows\System32\pgsgbjk.exe
  2⤵
  PID:9252
- C:\Windows\System32\vDuqfcg.exe
  C:\Windows\System32\vDuqfcg.exe
  2⤵
  PID:9324
- C:\Windows\System32\cgRvBrV.exe
  C:\Windows\System32\cgRvBrV.exe
  2⤵
  PID:9356
- C:\Windows\System32\RDVVZOA.exe
  C:\Windows\System32\RDVVZOA.exe
  2⤵
  PID:9396
- C:\Windows\System32\YHBUfKt.exe
  C:\Windows\System32\YHBUfKt.exe
  2⤵
  PID:9432
- C:\Windows\System32\PaiKaGp.exe
  C:\Windows\System32\PaiKaGp.exe
  2⤵
  PID:9528
- C:\Windows\System32\JFtKljL.exe
  C:\Windows\System32\JFtKljL.exe
  2⤵
  PID:9560
- C:\Windows\System32\snmFBcV.exe
  C:\Windows\System32\snmFBcV.exe
  2⤵
  PID:9612
- C:\Windows\System32\uonFmSm.exe
  C:\Windows\System32\uonFmSm.exe
  2⤵
  PID:9756
- C:\Windows\System32\eOjKqrc.exe
  C:\Windows\System32\eOjKqrc.exe
  2⤵
  PID:9872
- C:\Windows\System32\fxgimDD.exe
  C:\Windows\System32\fxgimDD.exe
  2⤵
  PID:9912
- C:\Windows\System32\LZWwBtb.exe
  C:\Windows\System32\LZWwBtb.exe
  2⤵
  PID:9968
- C:\Windows\System32\iQDPhzq.exe
  C:\Windows\System32\iQDPhzq.exe
  2⤵
  PID:10016
- C:\Windows\System32\xYbkwdg.exe
  C:\Windows\System32\xYbkwdg.exe
  2⤵
  PID:10044
- C:\Windows\System32\KmNhLOG.exe
  C:\Windows\System32\KmNhLOG.exe
  2⤵
  PID:10120
- C:\Windows\System32\TBZETPn.exe
  C:\Windows\System32\TBZETPn.exe
  2⤵
  PID:10160
- C:\Windows\System32\BRHDqQG.exe
  C:\Windows\System32\BRHDqQG.exe
  2⤵
  PID:9284
- C:\Windows\System32\khIlpvC.exe
  C:\Windows\System32\khIlpvC.exe
  2⤵
  PID:9372
- C:\Windows\System32\anZRpkx.exe
  C:\Windows\System32\anZRpkx.exe
  2⤵
  PID:9488
- C:\Windows\System32\inMONfK.exe
  C:\Windows\System32\inMONfK.exe
  2⤵
  PID:9608
- C:\Windows\System32\Kzgmiex.exe
  C:\Windows\System32\Kzgmiex.exe
  2⤵
  PID:9888
- C:\Windows\System32\BYUcpjT.exe
  C:\Windows\System32\BYUcpjT.exe
  2⤵
  PID:10048
- C:\Windows\System32\mhfPgsF.exe
  C:\Windows\System32\mhfPgsF.exe
  2⤵
  PID:9988
- C:\Windows\System32\cneeXQg.exe
  C:\Windows\System32\cneeXQg.exe
  2⤵
  PID:3132
- C:\Windows\System32\AmxaNEE.exe
  C:\Windows\System32\AmxaNEE.exe
  2⤵
  PID:9532
- C:\Windows\System32\dXqCJkg.exe
  C:\Windows\System32\dXqCJkg.exe
  2⤵
  PID:9504
- C:\Windows\System32\lAcPjXF.exe
  C:\Windows\System32\lAcPjXF.exe
  2⤵
  PID:10136
- C:\Windows\System32\NujAcTc.exe
  C:\Windows\System32\NujAcTc.exe
  2⤵
  PID:10244
- C:\Windows\System32\oxfWrrT.exe
  C:\Windows\System32\oxfWrrT.exe
  2⤵
  PID:10272
- C:\Windows\System32\PRXBzdI.exe
  C:\Windows\System32\PRXBzdI.exe
  2⤵
  PID:10300
- C:\Windows\System32\RPsPVCv.exe
  C:\Windows\System32\RPsPVCv.exe
  2⤵
  PID:10316
- C:\Windows\System32\rQxfZuP.exe
  C:\Windows\System32\rQxfZuP.exe
  2⤵
  PID:10340
- C:\Windows\System32\wWdrGXN.exe
  C:\Windows\System32\wWdrGXN.exe
  2⤵
  PID:10384
- C:\Windows\System32\GxUJRYj.exe
  C:\Windows\System32\GxUJRYj.exe
  2⤵
  PID:10400
- C:\Windows\System32\BDvUTSe.exe
  C:\Windows\System32\BDvUTSe.exe
  2⤵
  PID:10428
- C:\Windows\System32\GJUWLlQ.exe
  C:\Windows\System32\GJUWLlQ.exe
  2⤵
  PID:10448
- C:\Windows\System32\UYoKgsa.exe
  C:\Windows\System32\UYoKgsa.exe
  2⤵
  PID:10472
- C:\Windows\System32\qkGryrU.exe
  C:\Windows\System32\qkGryrU.exe
  2⤵
  PID:10520
- C:\Windows\System32\vUNIGSD.exe
  C:\Windows\System32\vUNIGSD.exe
  2⤵
  PID:10544
- C:\Windows\System32\wkoDOtJ.exe
  C:\Windows\System32\wkoDOtJ.exe
  2⤵
  PID:10568
- C:\Windows\System32\xHbtbGB.exe
  C:\Windows\System32\xHbtbGB.exe
  2⤵
  PID:10596
- C:\Windows\System32\fUtBAHR.exe
  C:\Windows\System32\fUtBAHR.exe
  2⤵
  PID:10616
- C:\Windows\System32\MNcCtjl.exe
  C:\Windows\System32\MNcCtjl.exe
  2⤵
  PID:10644
- C:\Windows\System32\JDuPhpF.exe
  C:\Windows\System32\JDuPhpF.exe
  2⤵
  PID:10664
- C:\Windows\System32\GTCYkXW.exe
  C:\Windows\System32\GTCYkXW.exe
  2⤵
  PID:10688
- C:\Windows\System32\TCEeCVR.exe
  C:\Windows\System32\TCEeCVR.exe
  2⤵
  PID:10712
- C:\Windows\System32\OiDjzKH.exe
  C:\Windows\System32\OiDjzKH.exe
  2⤵
  PID:10744
- C:\Windows\System32\RTotJVw.exe
  C:\Windows\System32\RTotJVw.exe
  2⤵
  PID:10784
- C:\Windows\System32\gOfJjhm.exe
  C:\Windows\System32\gOfJjhm.exe
  2⤵
  PID:10820
- C:\Windows\System32\VwsBLWh.exe
  C:\Windows\System32\VwsBLWh.exe
  2⤵
  PID:10840
- C:\Windows\System32\yFVGroj.exe
  C:\Windows\System32\yFVGroj.exe
  2⤵
  PID:10864
- C:\Windows\System32\FPanAuh.exe
  C:\Windows\System32\FPanAuh.exe
  2⤵
  PID:10908
- C:\Windows\System32\RGjzEaP.exe
  C:\Windows\System32\RGjzEaP.exe
  2⤵
  PID:10924
- C:\Windows\System32\ZgJknzo.exe
  C:\Windows\System32\ZgJknzo.exe
  2⤵
  PID:10952
- C:\Windows\System32\kyGwzGG.exe
  C:\Windows\System32\kyGwzGG.exe
  2⤵
  PID:10972
- C:\Windows\System32\RaRScBA.exe
  C:\Windows\System32\RaRScBA.exe
  2⤵
  PID:11004
- C:\Windows\System32\jxfeMiK.exe
  C:\Windows\System32\jxfeMiK.exe
  2⤵
  PID:11048
- C:\Windows\System32\QcJrLBU.exe
  C:\Windows\System32\QcJrLBU.exe
  2⤵
  PID:11072
- C:\Windows\System32\fIAHiUv.exe
  C:\Windows\System32\fIAHiUv.exe
  2⤵
  PID:11120
- C:\Windows\System32\cvJbQjy.exe
  C:\Windows\System32\cvJbQjy.exe
  2⤵
  PID:11144
- C:\Windows\System32\hILWRFg.exe
  C:\Windows\System32\hILWRFg.exe
  2⤵
  PID:11164
- C:\Windows\System32\GYvZYfj.exe
  C:\Windows\System32\GYvZYfj.exe
  2⤵
  PID:11192
- C:\Windows\System32\JfzfTjF.exe
  C:\Windows\System32\JfzfTjF.exe
  2⤵
  PID:11220
- C:\Windows\System32\DTJNUBA.exe
  C:\Windows\System32\DTJNUBA.exe
  2⤵
  PID:11252
- C:\Windows\System32\nJTucsP.exe
  C:\Windows\System32\nJTucsP.exe
  2⤵
  PID:9556
- C:\Windows\System32\AaOkrtk.exe
  C:\Windows\System32\AaOkrtk.exe
  2⤵
  PID:10284
- C:\Windows\System32\FhWxzra.exe
  C:\Windows\System32\FhWxzra.exe
  2⤵
  PID:10328
- C:\Windows\System32\pJbBohh.exe
  C:\Windows\System32\pJbBohh.exe
  2⤵
  PID:10392
- C:\Windows\System32\pbyBTGb.exe
  C:\Windows\System32\pbyBTGb.exe
  2⤵
  PID:10436
- C:\Windows\System32\ISgIdSj.exe
  C:\Windows\System32\ISgIdSj.exe
  2⤵
  PID:10512
- C:\Windows\System32\WDVqcLS.exe
  C:\Windows\System32\WDVqcLS.exe
  2⤵
  PID:10612
- C:\Windows\System32\QLlYook.exe
  C:\Windows\System32\QLlYook.exe
  2⤵
  PID:10636
- C:\Windows\System32\jNGNckx.exe
  C:\Windows\System32\jNGNckx.exe
  2⤵
  PID:10732
- C:\Windows\System32\zXVfYIj.exe
  C:\Windows\System32\zXVfYIj.exe
  2⤵
  PID:10760
- C:\Windows\System32\ovJPNaw.exe
  C:\Windows\System32\ovJPNaw.exe
  2⤵
  PID:10792
- C:\Windows\System32\nITJWea.exe
  C:\Windows\System32\nITJWea.exe
  2⤵
  PID:10828
- C:\Windows\System32\EujZpGQ.exe
  C:\Windows\System32\EujZpGQ.exe
  2⤵
  PID:10916
- C:\Windows\System32\aCaLhxr.exe
  C:\Windows\System32\aCaLhxr.exe
  2⤵
  PID:10968
- C:\Windows\System32\CGvDopn.exe
  C:\Windows\System32\CGvDopn.exe
  2⤵
  PID:10964
- C:\Windows\System32\FoSUhEA.exe
  C:\Windows\System32\FoSUhEA.exe
  2⤵
  PID:11036
- C:\Windows\System32\qmLmSPy.exe
  C:\Windows\System32\qmLmSPy.exe
  2⤵
  PID:11204
- C:\Windows\System32\vsmFvMO.exe
  C:\Windows\System32\vsmFvMO.exe
  2⤵
  PID:9436
- C:\Windows\System32\TVPwyEb.exe
  C:\Windows\System32\TVPwyEb.exe
  2⤵
  PID:10280
- C:\Windows\System32\WtglckM.exe
  C:\Windows\System32\WtglckM.exe
  2⤵
  PID:10424
- C:\Windows\System32\AUoHLtG.exe
  C:\Windows\System32\AUoHLtG.exe
  2⤵
  PID:10556
- C:\Windows\System32\bGHZcvD.exe
  C:\Windows\System32\bGHZcvD.exe
  2⤵
  PID:10736
- C:\Windows\System32\UUJLEHT.exe
  C:\Windows\System32\UUJLEHT.exe
  2⤵
  PID:10888
- C:\Windows\System32\WWAHYBR.exe
  C:\Windows\System32\WWAHYBR.exe
  2⤵
  PID:11128
- C:\Windows\System32\GWPRlkL.exe
  C:\Windows\System32\GWPRlkL.exe
  2⤵
  PID:11244
- C:\Windows\System32\vVagVkS.exe
  C:\Windows\System32\vVagVkS.exe
  2⤵
  PID:10264
- C:\Windows\System32\bIznTTR.exe
  C:\Windows\System32\bIznTTR.exe
  2⤵
  PID:11060
- C:\Windows\System32\GhSxbbb.exe
  C:\Windows\System32\GhSxbbb.exe
  2⤵
  PID:11232
- C:\Windows\System32\aOxUzwS.exe
  C:\Windows\System32\aOxUzwS.exe
  2⤵
  PID:10488
- C:\Windows\System32\wsfZkoE.exe
  C:\Windows\System32\wsfZkoE.exe
  2⤵
  PID:11236
- C:\Windows\System32\UdyewZc.exe
  C:\Windows\System32\UdyewZc.exe
  2⤵
  PID:11292
- C:\Windows\System32\rfmfrII.exe
  C:\Windows\System32\rfmfrII.exe
  2⤵
  PID:11320
- C:\Windows\System32\WNfrrrD.exe
  C:\Windows\System32\WNfrrrD.exe
  2⤵
  PID:11336
- C:\Windows\System32\NssNgfh.exe
  C:\Windows\System32\NssNgfh.exe
  2⤵
  PID:11360
- C:\Windows\System32\oPYiGrD.exe
  C:\Windows\System32\oPYiGrD.exe
  2⤵
  PID:11388
- C:\Windows\System32\AQbPZiD.exe
  C:\Windows\System32\AQbPZiD.exe
  2⤵
  PID:11416
- C:\Windows\System32\lLwKFoI.exe
  C:\Windows\System32\lLwKFoI.exe
  2⤵
  PID:11464
- C:\Windows\System32\PGFwtKs.exe
  C:\Windows\System32\PGFwtKs.exe
  2⤵
  PID:11504
- C:\Windows\System32\IlQouSK.exe
  C:\Windows\System32\IlQouSK.exe
  2⤵
  PID:11528
- C:\Windows\System32\lnraTCw.exe
  C:\Windows\System32\lnraTCw.exe
  2⤵
  PID:11564
- C:\Windows\System32\HshiglR.exe
  C:\Windows\System32\HshiglR.exe
  2⤵
  PID:11584
- C:\Windows\System32\QIySnoQ.exe
  C:\Windows\System32\QIySnoQ.exe
  2⤵
  PID:11612
- C:\Windows\System32\QFTdVBd.exe
  C:\Windows\System32\QFTdVBd.exe
  2⤵
  PID:11644
- C:\Windows\System32\CxCyTJR.exe
  C:\Windows\System32\CxCyTJR.exe
  2⤵
  PID:11672
- C:\Windows\System32\riLELUa.exe
  C:\Windows\System32\riLELUa.exe
  2⤵
  PID:11692
- C:\Windows\System32\SUqqhhg.exe
  C:\Windows\System32\SUqqhhg.exe
  2⤵
  PID:11708
- C:\Windows\System32\MHWHOHm.exe
  C:\Windows\System32\MHWHOHm.exe
  2⤵
  PID:11740
- C:\Windows\System32\qUXbgMH.exe
  C:\Windows\System32\qUXbgMH.exe
  2⤵
  PID:11760
- C:\Windows\System32\FhBRQHV.exe
  C:\Windows\System32\FhBRQHV.exe
  2⤵
  PID:11804
- C:\Windows\System32\eljeFZm.exe
  C:\Windows\System32\eljeFZm.exe
  2⤵
  PID:11820
- C:\Windows\System32\cbCdHpC.exe
  C:\Windows\System32\cbCdHpC.exe
  2⤵
  PID:11864
- C:\Windows\System32\oqfkShy.exe
  C:\Windows\System32\oqfkShy.exe
  2⤵
  PID:11892
- C:\Windows\System32\ECdwLqc.exe
  C:\Windows\System32\ECdwLqc.exe
  2⤵
  PID:11936
- C:\Windows\System32\mwKHyDX.exe
  C:\Windows\System32\mwKHyDX.exe
  2⤵
  PID:11956
- C:\Windows\System32\aAEYJMs.exe
  C:\Windows\System32\aAEYJMs.exe
  2⤵
  PID:11972
- C:\Windows\System32\gxnxPbn.exe
  C:\Windows\System32\gxnxPbn.exe
  2⤵
  PID:11992
- C:\Windows\System32\LaMubvF.exe
  C:\Windows\System32\LaMubvF.exe
  2⤵
  PID:12008
- C:\Windows\System32\mZJBIBa.exe
  C:\Windows\System32\mZJBIBa.exe
  2⤵
  PID:12036
- C:\Windows\System32\QCdNOfO.exe
  C:\Windows\System32\QCdNOfO.exe
  2⤵
  PID:12072
- C:\Windows\System32\ORTQAjE.exe
  C:\Windows\System32\ORTQAjE.exe
  2⤵
  PID:12104
- C:\Windows\System32\GTyiIcm.exe
  C:\Windows\System32\GTyiIcm.exe
  2⤵
  PID:12120
- C:\Windows\System32\NITWUnU.exe
  C:\Windows\System32\NITWUnU.exe
  2⤵
  PID:12144
- C:\Windows\System32\mZlsBcI.exe
  C:\Windows\System32\mZlsBcI.exe
  2⤵
  PID:12168
- C:\Windows\System32\WEADObw.exe
  C:\Windows\System32\WEADObw.exe
  2⤵
  PID:12228
- C:\Windows\System32\wzHlKvM.exe
  C:\Windows\System32\wzHlKvM.exe
  2⤵
  PID:12260
- C:\Windows\System32\BeitJlj.exe
  C:\Windows\System32\BeitJlj.exe
  2⤵
  PID:11152
- C:\Windows\System32\FqmwJis.exe
  C:\Windows\System32\FqmwJis.exe
  2⤵
  PID:11276
- C:\Windows\System32\uOozVEO.exe
  C:\Windows\System32\uOozVEO.exe
  2⤵
  PID:11316
- C:\Windows\System32\juhxOKF.exe
  C:\Windows\System32\juhxOKF.exe
  2⤵
  PID:11368
- C:\Windows\System32\IqCUMUB.exe
  C:\Windows\System32\IqCUMUB.exe
  2⤵
  PID:11412
- C:\Windows\System32\rrvhRjB.exe
  C:\Windows\System32\rrvhRjB.exe
  2⤵
  PID:11452
- C:\Windows\System32\GCvfvhI.exe
  C:\Windows\System32\GCvfvhI.exe
  2⤵
  PID:11552
- C:\Windows\System32\yvlujNt.exe
  C:\Windows\System32\yvlujNt.exe
  2⤵
  PID:11624
- C:\Windows\System32\kXRntht.exe
  C:\Windows\System32\kXRntht.exe
  2⤵
  PID:11668
- C:\Windows\System32\ctahgXj.exe
  C:\Windows\System32\ctahgXj.exe
  2⤵
  PID:11768
- C:\Windows\System32\wFuUhXB.exe
  C:\Windows\System32\wFuUhXB.exe
  2⤵
  PID:11872
- C:\Windows\System32\XKSLXte.exe
  C:\Windows\System32\XKSLXte.exe
  2⤵
  PID:11944
- C:\Windows\System32\TwAfDKb.exe
  C:\Windows\System32\TwAfDKb.exe
  2⤵
  PID:12016
- C:\Windows\System32\zEzEPAk.exe
  C:\Windows\System32\zEzEPAk.exe
  2⤵
  PID:12112
- C:\Windows\System32\xLrFkyK.exe
  C:\Windows\System32\xLrFkyK.exe
  2⤵
  PID:4880
- C:\Windows\System32\FjmFLNb.exe
  C:\Windows\System32\FjmFLNb.exe
  2⤵
  PID:12240
- C:\Windows\System32\CWvgUxV.exe
  C:\Windows\System32\CWvgUxV.exe
  2⤵
  PID:11344
- C:\Windows\System32\SKIYEeb.exe
  C:\Windows\System32\SKIYEeb.exe
  2⤵
  PID:11592
- C:\Windows\System32\vUxwyxX.exe
  C:\Windows\System32\vUxwyxX.exe
  2⤵
  PID:11520
- C:\Windows\System32\fbZQIUL.exe
  C:\Windows\System32\fbZQIUL.exe
  2⤵
  PID:11728
- C:\Windows\System32\QoyfNOk.exe
  C:\Windows\System32\QoyfNOk.exe
  2⤵
  PID:11852
- C:\Windows\System32\qBdLTqI.exe
  C:\Windows\System32\qBdLTqI.exe
  2⤵
  PID:12004
- C:\Windows\System32\moKuhwZ.exe
  C:\Windows\System32\moKuhwZ.exe
  2⤵
  PID:4340
- C:\Windows\System32\IXUiqLD.exe
  C:\Windows\System32\IXUiqLD.exe
  2⤵
  PID:11272
- C:\Windows\System32\pNplIAr.exe
  C:\Windows\System32\pNplIAr.exe
  2⤵
  PID:12224
- C:\Windows\System32\PYOrEFy.exe
  C:\Windows\System32\PYOrEFy.exe
  2⤵
  PID:11428
- C:\Windows\System32\kynlkfp.exe
  C:\Windows\System32\kynlkfp.exe
  2⤵
  PID:4004
- C:\Windows\System32\BmcOxlq.exe
  C:\Windows\System32\BmcOxlq.exe
  2⤵
  PID:11964
- C:\Windows\System32\cfTKeFl.exe
  C:\Windows\System32\cfTKeFl.exe
  2⤵
  PID:12088
- C:\Windows\System32\jwhdGkp.exe
  C:\Windows\System32\jwhdGkp.exe
  2⤵
  PID:4932
- C:\Windows\System32\qODwBFL.exe
  C:\Windows\System32\qODwBFL.exe
  2⤵
  PID:11356
- C:\Windows\System32\yRMIhKD.exe
  C:\Windows\System32\yRMIhKD.exe
  2⤵
  PID:448
- C:\Windows\System32\AGxjCBG.exe
  C:\Windows\System32\AGxjCBG.exe
  2⤵
  PID:11284
- C:\Windows\System32\lAsOSne.exe
  C:\Windows\System32\lAsOSne.exe
  2⤵
  PID:12340
- C:\Windows\System32\cCQbWHJ.exe
  C:\Windows\System32\cCQbWHJ.exe
  2⤵
  PID:12364
- C:\Windows\System32\HNRqdNi.exe
  C:\Windows\System32\HNRqdNi.exe
  2⤵
  PID:12408
- C:\Windows\System32\CwhqtLO.exe
  C:\Windows\System32\CwhqtLO.exe
  2⤵
  PID:12424
- C:\Windows\System32\CpYSxyx.exe
  C:\Windows\System32\CpYSxyx.exe
  2⤵
  PID:12448
- C:\Windows\System32\hTaqchx.exe
  C:\Windows\System32\hTaqchx.exe
  2⤵
  PID:12472
- C:\Windows\System32\AuQYVjq.exe
  C:\Windows\System32\AuQYVjq.exe
  2⤵
  PID:12500
- C:\Windows\System32\GjUmxNC.exe
  C:\Windows\System32\GjUmxNC.exe
  2⤵
  PID:12532
- C:\Windows\System32\bFeSZVj.exe
  C:\Windows\System32\bFeSZVj.exe
  2⤵
  PID:12556
- C:\Windows\System32\rpPRYOM.exe
  C:\Windows\System32\rpPRYOM.exe
  2⤵
  PID:12572
- C:\Windows\System32\oLuvUFx.exe
  C:\Windows\System32\oLuvUFx.exe
  2⤵
  PID:12600
- C:\Windows\System32\giNCNMt.exe
  C:\Windows\System32\giNCNMt.exe
  2⤵
  PID:12620
- C:\Windows\System32\XqiCRMB.exe
  C:\Windows\System32\XqiCRMB.exe
  2⤵
  PID:12644
- C:\Windows\System32\KlWCjZo.exe
  C:\Windows\System32\KlWCjZo.exe
  2⤵
  PID:12696
- C:\Windows\System32\kgKDdIZ.exe
  C:\Windows\System32\kgKDdIZ.exe
  2⤵
  PID:12744
- C:\Windows\System32\gEwbFXP.exe
  C:\Windows\System32\gEwbFXP.exe
  2⤵
  PID:12768
- C:\Windows\System32\hoEWXsH.exe
  C:\Windows\System32\hoEWXsH.exe
  2⤵
  PID:12800
- C:\Windows\System32\wjmUcAG.exe
  C:\Windows\System32\wjmUcAG.exe
  2⤵
  PID:12824
- C:\Windows\System32\HYioJVJ.exe
  C:\Windows\System32\HYioJVJ.exe
  2⤵
  PID:12852
- C:\Windows\System32\SErMLpT.exe
  C:\Windows\System32\SErMLpT.exe
  2⤵
  PID:12876
- C:\Windows\System32\lsPgRTJ.exe
  C:\Windows\System32\lsPgRTJ.exe
  2⤵
  PID:12904
- C:\Windows\System32\GctQLYP.exe
  C:\Windows\System32\GctQLYP.exe
  2⤵
  PID:12932
- C:\Windows\System32\VSVTaWW.exe
  C:\Windows\System32\VSVTaWW.exe
  2⤵
  PID:12952
- C:\Windows\System32\dAWdUtX.exe
  C:\Windows\System32\dAWdUtX.exe
  2⤵
  PID:12992
- C:\Windows\System32\scqkngq.exe
  C:\Windows\System32\scqkngq.exe
  2⤵
  PID:13032
- C:\Windows\System32\oWrcPbG.exe
  C:\Windows\System32\oWrcPbG.exe
  2⤵
  PID:13056
- C:\Windows\System32\LQvwevb.exe
  C:\Windows\System32\LQvwevb.exe
  2⤵
  PID:13088
- C:\Windows\System32\ufKDkNf.exe
  C:\Windows\System32\ufKDkNf.exe
  2⤵
  PID:13124
- C:\Windows\System32\jGZhaRv.exe
  C:\Windows\System32\jGZhaRv.exe
  2⤵
  PID:13152
- C:\Windows\System32\dZePQTO.exe
  C:\Windows\System32\dZePQTO.exe
  2⤵
  PID:13176
- C:\Windows\System32\ccFpgEH.exe
  C:\Windows\System32\ccFpgEH.exe
  2⤵
  PID:13208
- C:\Windows\System32\SENlCmq.exe
  C:\Windows\System32\SENlCmq.exe
  2⤵
  PID:13228

Network

DNS

196.249.167.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

196.249.167.52.in-addr.arpa

IN PTR

Response
DNS

224.107.17.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

224.107.17.2.in-addr.arpa

IN PTR

Response

224.107.17.2.in-addr.arpa

IN PTR

a2-17-107-224deploystaticakamaitechnologiescom
DNS

69.31.126.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

69.31.126.40.in-addr.arpa

IN PTR

Response
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

104.219.191.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

104.219.191.52.in-addr.arpa

IN PTR

Response
DNS

86.23.85.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

86.23.85.13.in-addr.arpa

IN PTR

Response
DNS

171.39.242.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

171.39.242.20.in-addr.arpa

IN PTR

Response
DNS

23.236.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

23.236.111.52.in-addr.arpa

IN PTR

Response
DNS

152.107.17.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

152.107.17.2.in-addr.arpa

IN PTR

Response

152.107.17.2.in-addr.arpa

IN PTR

a2-17-107-152deploystaticakamaitechnologiescom
DNS

15.173.189.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

15.173.189.20.in-addr.arpa

IN PTR

No results found

8.8.8.8:53

196.249.167.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

196.249.167.52.in-addr.arpa
8.8.8.8:53

224.107.17.2.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

224.107.17.2.in-addr.arpa
8.8.8.8:53

69.31.126.40.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

69.31.126.40.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

104.219.191.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

104.219.191.52.in-addr.arpa
8.8.8.8:53

86.23.85.13.in-addr.arpa

dns

70 B
144 B
1
1

DNS Request

86.23.85.13.in-addr.arpa
8.8.8.8:53

171.39.242.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

171.39.242.20.in-addr.arpa
8.8.8.8:53

23.236.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

23.236.111.52.in-addr.arpa
8.8.8.8:53

152.107.17.2.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

152.107.17.2.in-addr.arpa
8.8.8.8:53

15.173.189.20.in-addr.arpa

dns

72 B
1

DNS Request

15.173.189.20.in-addr.arpa

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\CexClpK.exe

Filesize
1.9MB

MD5
3e3382cb9ddc90856f870445eab30e9a

SHA1
78972f55b57a17835dc41f09339cbca880ae4e06

SHA256
79efcdb7515cdbf2c42edfb6a9dccf8f78a5c5935005ede3126d25d5b4361b92

SHA512
f1dfb7604a08f2a5e6757868aca788e0cc224002d34788c2e7124235330bb56f29ad32c6c23275becdde5c3358da4426289e344d2a97c85257e8439c49504a08

Download Submit
C:\Windows\System32\DTuwZFn.exe

Filesize
1.9MB

MD5
17604d8f5a71f3d5bd298dcea7fdb3bb

SHA1
b742db838c91e1076747dc2edcd7dfd8dae61bdf

SHA256
7bc0a64eb77021ae9de4ffa1675c02df9fc5e1195553bac677a7af08b66ba7f8

SHA512
214cbb55c91af9c5047d1e108b32c568c3f3dbe7258129caf03260ab149701117123747de5387713e30f33f0b8a8dc16e8ad4aca44a896451f062ada6158fd2d

Download Submit
C:\Windows\System32\DxLwGnw.exe

Filesize
1.9MB

MD5
b8b761d658a2abfbd3d1ee74d075b296

SHA1
1dad240831426ea200af2ae10eb3c7ae50ef8429

SHA256
1b15025888558920b6c6788cbeea5313f2b14d0e685145907f50c0a1bf20151b

SHA512
53c36a86b70c9346dc31c83794a1aece33cbc4ee62942c1a83f6fa8a17b96c59fecdb355f671b808a39f1f521ee2be1363930cbe9475fcc554acc609cfb8a319

Download Submit
C:\Windows\System32\FFSfhwv.exe

Filesize
1.9MB

MD5
4379ad470736a4c5ed537848d49c8a56

SHA1
6cc290b058d8c10d8f272c8fd6ae5ebef53d44ea

SHA256
b68eca9e95d18c198605bb4051edd73e34ef8d1fb681afaa15199abed25fa626

SHA512
1ce875b5f89b089080807c14be797a89603b375d6b0819cfb1657dcd8cd7581cea1dbecaeeca222e357688941ca81cb8f152f7649dabafc8aa75157d4df827df

Download Submit
C:\Windows\System32\IaauUqp.exe

Filesize
1.9MB

MD5
3517275430ba0907fa52410bd6bed527

SHA1
883a352e108802ad02de31bd088dc6490e54dbd8

SHA256
932d21f8bb9957946b9fad536a2dee25ddd47568b26e50e673c6768eca825dbc

SHA512
0f7bab292b100d4702ddaa008187ff7e7f0ee2a0715de360940be609850f97b0bc2456aa5cb17a0f2756f8cb38c4fd01815b047c03ef7b8ee58120e737aa321b

Download Submit
C:\Windows\System32\JVnNZFI.exe

Filesize
1.9MB

MD5
42e96fc1eaae599077de27e2025d8316

SHA1
41064d46175a85e17dd8a40bb57b3e4d8e7a33ed

SHA256
544981b2b9bfb0f06f40943e4bf09229409a6b93fee2cbe7b6c3bc2041031f9d

SHA512
b09a88ce53dac70077df055167fc3f0c76e35e8c348211f4229d663ab812c091573e48ad88359d2fe1e8ad454b6823c80b09000bebfa64a3b93d71d295d6d20f

Download Submit
C:\Windows\System32\JtMUrFI.exe

Filesize
1.9MB

MD5
276271ac5926f1dcb73b8215724d450c

SHA1
d5869f419f21d9178d28f8339d8f41ce64353741

SHA256
da886e4cd377ae12204c5a955a579480727dffc6ea5136df4c5c60cf849d7910

SHA512
30cb8353423fcda7d3edde2b98d2fa12c0f331681b01239a28f2d0bb46d6901ace7d55282ec69d4ae2d19a164a81ed5a15db8b59856b5c31ad12db19380563ad

Download Submit
C:\Windows\System32\KnXMzom.exe

Filesize
1.9MB

MD5
c027af5cc146bc94a27354c0e577e63f

SHA1
936f464f99163ba363689e46b4e902e3592a1c70

SHA256
9b3a080e76ac2789c9fc6ae97f02c6abef69c166be39f8a3a4e90f681de00d07

SHA512
25f9338cba25853f28858fd6a060443d79a6ac28d7d29a40e5bb0736f665ed4ce749d2d24a9ad866c202e1a4ac77efb254a898f37dbd6f5ef00fc0d75cb05844

Download Submit
C:\Windows\System32\LlDSksF.exe

Filesize
1.9MB

MD5
7ca2f6d234bfca9ba24c7687f8d892dd

SHA1
6cedd2cf906751944d76a1b82c10c69d86f5af8b

SHA256
9b3615135afd337a1308d97e73454444ace5947e80b2b50404ade1c355ca47e6

SHA512
6203df07c63452532c20a8dd15b262770cb41750eb511a5cbb0f3d78b576e696d791c706b7a9fb8d7bd03e6d7015f9c50032f81244d048d2d05dd7377adbe553

Download Submit
C:\Windows\System32\MXyjVmi.exe

Filesize
1.9MB

MD5
b6a829032f069834b8ed3fb73164bbe1

SHA1
436aee4c688bf00cf613caf2d6682c633ab57d93

SHA256
82682e8462f52cf766c68f38a5fe1daf3c1de9f4e99e3408de9e2e3c1b6d6c98

SHA512
2b89ce325de370ad950e52dae46a3b8591036e88b0893eedcdeea133ea8b92adb16015073dabbee951b22730b0f554e002eeef5aca8920184cef2a8d619a277e

Download Submit
C:\Windows\System32\NBGtznk.exe

Filesize
1.9MB

MD5
23dccdb9599caeb43f038b7f0bfb52fb

SHA1
c591db39480a1cab7ff7f4060d4fa1860c6b32c1

SHA256
63bca483024ad3f8e21b3f65a9856111e7639a99806b07a67c7d45a147b1060c

SHA512
5847715f6117b85f5a8dab2065bfb8d011b11783304f6523c57b47d54dbb7c6075a8facd6bb9a5a9d2f6ec97db327cd7088a769a2e523134efb2988a352d02c7

Download Submit
C:\Windows\System32\OLAFXSF.exe

Filesize
1.9MB

MD5
00aef48ac6e9cf8b40d76a2f61da68af

SHA1
14a2b87b11015857510310b06e49dfcaa78c85d7

SHA256
a72ef77f33ee810b1374b4080426addddac15c73c73aca4cd921b06d341689ed

SHA512
358902582cd8310b2cfbb5dbc1b3ff805d1a566294ce1d1ed0d57c9881e422e2bb5c689a292b73a2b4e180dc59359f999c5af2c7f7b372f37b36dffb3721f3bb

Download Submit
C:\Windows\System32\PUTMjwv.exe

Filesize
1.9MB

MD5
50e00ef616ceabca12a6dc9e1b9910ad

SHA1
fcf30d18c64e9a998dc886e5cf251ab9c2bd786d

SHA256
20083c1ff1682858cbd627d0ec6d0c1b3b71f6f5215c818badf1fc9aa07615e0

SHA512
bec26e4ba550a8e97a00731ddafaf56b021e0fc103b6d032b05c91efd8bb4dcb6e1109724c3a64bc0d907604b092e8448cfb1e9243ec00e0f0dc8ff240aeae21

Download Submit
C:\Windows\System32\UFfInFb.exe

Filesize
1.9MB

MD5
41411be986d6be859ee3a071dcb7dc48

SHA1
39197110c9a6a7cbcac16621074d8d60c7b183f7

SHA256
2b3688eabeca6527d41eefcc02db313b974deb0cbc2c2d412f52b6d7cde28f5e

SHA512
60a6b6be2d728d7f9ac2d12c3fbc7c8693100cb2673ca1716e764e6745c77d6cb4f64e5fd5a52792704535a5d8b6886eb69eb19521f8d0796f7ac5d504db022c

Download Submit
C:\Windows\System32\VFtLktS.exe

Filesize
1.9MB

MD5
3c352e5dec1667576b2755142c4bcde5

SHA1
f223a8ef1c069441889c34ec7499a3772be20579

SHA256
23629b561037f367875e9bb0f59a3218922f65da55bd370957fa8fcbbee0873b

SHA512
1f37e89544ee24017ffb2f42c004a8b7a71297883a08054b968baefdc492d4b53c0d5552bb53b711f325d8bd28e5a7949ba76e1cd84e2498e4ac4eb95f597868

Download Submit
C:\Windows\System32\VXDlsQs.exe

Filesize
1.9MB

MD5
3a2d9a60527db2c3eb139d230a1a7516

SHA1
f2ea13dc0a685a27e22be03b4415586027d7d85b

SHA256
33f5409e95f2aaf9771623f70e4a51d5bbf5f1e8b2d4c8d8d2412ce11d244e0a

SHA512
1a6ddef0ea3dfbe4a827e93f491af26cf3a16134b551856ab42938cfaf5678ac2b787c766d86afe0158141c4d1f588c418221bb96ec6c62adff42df7e343c205

Download Submit
C:\Windows\System32\XBRGYIK.exe

Filesize
1.9MB

MD5
ef7083d407b157634a4384a17bfaae5c

SHA1
712fbd17ea8a5e9fc188089107f5c8d058004060

SHA256
ca913385a508d6898dcc79d66a1ec03c711079085e585559e383ed938ba78036

SHA512
6341038b10183d6ec0a87bffef1d1104dd4192abaf514eb4de635f59b8bf9453ab0a07f382afb34c1a58350da589c60d3f5aba744aeab756edceea507a641d77

Download Submit
C:\Windows\System32\XpadmEO.exe

Filesize
1.9MB

MD5
f399e7d29744b04d6c6a76d755b5c3ed

SHA1
eb0341f2a8380194ad965a3234fb9943e750d49e

SHA256
238ab32f7c6b151859ec3342822ab215991c2eb27c406acf0bcee38966ff1de8

SHA512
b351273b049e31f7e10805619ea5d7e9bafbc01737209607670f2a866719fcf6ca1edec03c3346afda0ebcdc9598d84c6d418196ca889143de09ab93808ae7fa

Download Submit
C:\Windows\System32\ZiiKjhu.exe

Filesize
1.9MB

MD5
346e828a58388dd378e91d609eace28b

SHA1
21c137df68819277e996d3cc887d5e228e0c31de

SHA256
58b2e4278ae39b39597a6da3dd1e6a97c91aaed674e4cab67c285bc809c4b480

SHA512
65bea0f4a4e4000f80b3aaf3c5943ebf78574af376c25836733e3f1f427754baabb6c023c268dcbc35e2f804f1c3e9ab2ee0fb48d9f7b0d18ba9e3ab7e1efd00

Download Submit
C:\Windows\System32\ZtTBZMj.exe

Filesize
1.9MB

MD5
2de547db3397cab10a418412e30b1ca7

SHA1
9f1ca9b8f573663ada160d2ee1bca7c10a6f7256

SHA256
ed6fd2cfcac791b27e2cac58a1e5b043aa6453090b4fc8b862f3d70f9ed718d7

SHA512
5a0ae2fbd2acaa7338376e6e210b00708fe9ca50d02abb199c29cb34c36106eefb93cf3249febf84ba5cb09526c26b8e105959c09d8234f97ee9c4c73876d9f1

Download Submit
C:\Windows\System32\aIhZYYY.exe

Filesize
1.9MB

MD5
b6de68df268a04e34cc7faad9e503594

SHA1
c5e5f48c569db0622454ffc7bfddf4cf2e290d87

SHA256
579a9412e47cbe53d50f56b8edfcbceef52b59d413fd67aeb978d1b5c5676128

SHA512
ce2fc92b3f6a73458bb23bf66e2d0c5de848e263d58631dbebd19ecb1f163b02fd4710c79880f1a78ecd82f4e9949569a84ceb27771df5a08c00718b33a20546

Download Submit
C:\Windows\System32\euSunSS.exe

Filesize
1.9MB

MD5
28a305d819f85136d1c607443295c162

SHA1
93ff619d2afff9e0d91749901a937c8eaec1bd1a

SHA256
ce45ff97cff61785ed5716cef8b5ce24612009de4b8848590e7ba3deac6ca895

SHA512
b296edb6648eb64cc3dd8e130d22fe0b645b2e4b53ef01a0e4105fa8fea84e9325ac9a120e4fdf024f96df92bc5a0a6c9647f198a307df78841a068cfc41fc03

Download Submit
C:\Windows\System32\ewibYwg.exe

Filesize
1.9MB

MD5
cfc2aa73724b9f73a655fffabb13e06d

SHA1
a6ce7c33d6a147aeb09c329fa917a1d915ebb521

SHA256
86d7f6611232a5820b5d73cdbf761fcffa3207106687f17a7f660c0920e99f12

SHA512
c23ba519874ab5c2dc7787e204b161f46a9d1db1ab68fcc8c1c0898a24da3ea1fc59fe104c3a5e60a46dc0021443e0c585c740b24b17e23daf63417a90f341a0

Download Submit
C:\Windows\System32\fnsxbZI.exe

Filesize
1.9MB

MD5
fe492082b53536e00642503376d5e77d

SHA1
e3f5478abfabfafa88592344daf520632286924c

SHA256
42dea1c6c3edc036f8ee7569ea0eb21d14cbc4b77677a6cfa36de09fec169d56

SHA512
5714eefeb3d6866c460fc777bbfcd36d44771db8216aba067ff3fa5d7190a6479ca12dc1e7e66c0e8b79b2e46566f22453819e4a2511fa3f4c5449ea13913b11

Download Submit
C:\Windows\System32\iEQYgKA.exe

Filesize
1.9MB

MD5
c29da3798b0c527dd7531ff05f2d4521

SHA1
bac06490471ca3a6ea45ea64bb92ac887a0f1435

SHA256
d8f453dd8eea2e8eb5f45c9c2c8d449660a2070f914753c992be1dd39a7ca149

SHA512
0ddd4dab15f923980b3d614422909c6f4717d4a2e9503d554c9aa5a31b5ca327f046ed68d016dc70ff674356beee0ed33c401da2bd7297bd63ff8009f5127655

Download Submit
C:\Windows\System32\iIAptVJ.exe

Filesize
1.9MB

MD5
6232dd693e0c1b44df8453e65809fdea

SHA1
ade50a258555a9470accdb5544567881f1e42df7

SHA256
8350b8ccbd667053d44801f274f80d24f90f4e1044f61452e22e18cf6f9923c2

SHA512
4ba2a754742ba6c53273bae1bd02b4e111418932de31d7a00794c171fb38130cbb9e9f16250fb72001404010fa5efc77e4aedff9f06fa8450e8296faa5cd2aa2

Download Submit
C:\Windows\System32\jJoLNik.exe

Filesize
1.9MB

MD5
59313704e011b81ff8ae64188bb8fced

SHA1
850310bd1299fcc43f45cedff14ccbfe785d570f

SHA256
62f9bdd7b4f7ce256ac607f679bfdb4986d095c6cc44f4a8c28789c92a37e7c0

SHA512
f8116d6d892e067712f2de648890d808c988467bb6207a615efcd02fa606a96046c2df59e2f16dbf2adabd270dbb95d1c4668fb1347d82ac68d8b160d07fc26f

Download Submit
C:\Windows\System32\nNXnbiB.exe

Filesize
1.9MB

MD5
953acc0ff6f2231985ae5e113bbf36de

SHA1
74a930e078483abfb8e09712e11d5e14da415da8

SHA256
54f603130d2ce00428b65559a5373944603aff5d09f9ae3011fc06779774c10f

SHA512
773937cd8871a7b5bc6fd5e05ba88a4b58566d1bcb792fc911d1032a0ae3a9e7f1657c0f591abaf5982c117cb7f63f60b40f8ad1c808761ce4e9538f9da3c096

Download Submit
C:\Windows\System32\sSTCbcs.exe

Filesize
1.9MB

MD5
a22767faf613e3e0275c0e076fc01c27

SHA1
2c249bc09ddcabe8e802c71a29c8300451512512

SHA256
667ae1431a2c7d63a3ece3624271440620b742a8f0f58bb0c3f436d91635e7b5

SHA512
5221455ec4cbea0ccf3a0632f137d2d0583441fc132901f0610def71602b8b69926c69df9b960ef9283869ff223171ee1b2b725803a0aee59dccabf00085762b

Download Submit
C:\Windows\System32\tPqLpzf.exe

Filesize
1.9MB

MD5
9b91a51dc7497b0d94842bb75454cc0d

SHA1
feee6486dc502a60e4aa1f54188fb5b21a287a35

SHA256
b0995048179fccc2f633fa449373f564f51ce089d1d98a41528e0cab4f959d53

SHA512
7ae311e21b9ac1fc1483f0c85c420a0a8ec317324f77028dd31c904383065145475c49b7596aec6a60bac348fe2008ebc96ca23dcbfb0f70dd2d4ff5b9218855

Download Submit
C:\Windows\System32\ulKvSAk.exe

Filesize
1.9MB

MD5
7750f80b33c61fbfbba37b15ad6021c6

SHA1
0359847d2fce8e1dca8d6ecad40290700afb3281

SHA256
aa0fc8e9c94e3599fdd36c529ef80c1cc2319d57fdfd24663f504309fdba8510

SHA512
028e6f13b689e436e4c20895ca6946f7877416fdb124a39207e496c11e6bed03f9f2ea3217f0d3111a0421b5bdafa599b04273998bf0bf505f125d6ed35a887a

Download Submit
C:\Windows\System32\uqdDkEN.exe

Filesize
1.9MB

MD5
c5415f8d36955e279bb40735c611efe4

SHA1
70b95d78745e62b49686993f29a46222126faa1f

SHA256
45510e71a72d3fafc1f632f00e07e97a75f636441990044e076789a38b87635a

SHA512
86f587e9ec84f0b05e91340ffaab02d8d32e3aa0462677fc367e1dd4d3fd79092305e48ffa5899b4ebae2610d268259690296c7d62a109bae40438b11842c39b

Download Submit
C:\Windows\System32\yprKmWm.exe

Filesize
1.9MB

MD5
cf51da7ce62cf0f12fec7ff92ce0de53

SHA1
2dbcc58b9b51c79a94d540c76a1d5f8b3eaa1b22

SHA256
a4fd89853d224faf47d775ca688a3e1c6818ec3d169946a222fdc10c44b89dff

SHA512
405e99fe424aa02275276a249c28b33598f6fadcc114468e9954870f2efc89849ca3de0740a514053f6a115a4280940ba88a37e3711a4eb31ea0c9b392b85255

Download Submit
memory/1412-1983-0x00007FF7BD2D0000-0x00007FF7BD6C1000-memory.dmp

Filesize
3.9MB

Download
memory/1412-1-0x00000262D2BD0000-0x00000262D2BE0000-memory.dmp

Filesize
64KB

Download
memory/1412-0-0x00007FF7BD2D0000-0x00007FF7BD6C1000-memory.dmp

Filesize
3.9MB

Download
memory/1892-2075-0x00007FF757A80000-0x00007FF757E71000-memory.dmp

Filesize
3.9MB

Download
memory/1892-456-0x00007FF757A80000-0x00007FF757E71000-memory.dmp

Filesize
3.9MB

Download
memory/2148-463-0x00007FF73E540000-0x00007FF73E931000-memory.dmp

Filesize
3.9MB

Download
memory/2148-2059-0x00007FF73E540000-0x00007FF73E931000-memory.dmp

Filesize
3.9MB

Download
memory/2152-454-0x00007FF7EFFC0000-0x00007FF7F03B1000-memory.dmp

Filesize
3.9MB

Download
memory/2152-2041-0x00007FF7EFFC0000-0x00007FF7F03B1000-memory.dmp

Filesize
3.9MB

Download
memory/2248-459-0x00007FF6744C0000-0x00007FF6748B1000-memory.dmp

Filesize
3.9MB

Download
memory/2248-2066-0x00007FF6744C0000-0x00007FF6748B1000-memory.dmp

Filesize
3.9MB

Download
memory/2512-2039-0x00007FF600140000-0x00007FF600531000-memory.dmp

Filesize
3.9MB

Download
memory/2512-451-0x00007FF600140000-0x00007FF600531000-memory.dmp

Filesize
3.9MB

Download
memory/2532-2036-0x00007FF6B5E70000-0x00007FF6B6261000-memory.dmp

Filesize
3.9MB

Download
memory/2532-469-0x00007FF6B5E70000-0x00007FF6B6261000-memory.dmp

Filesize
3.9MB

Download
memory/2628-2063-0x00007FF798830000-0x00007FF798C21000-memory.dmp

Filesize
3.9MB

Download
memory/2628-461-0x00007FF798830000-0x00007FF798C21000-memory.dmp

Filesize
3.9MB

Download
memory/2640-2029-0x00007FF6A3500000-0x00007FF6A38F1000-memory.dmp

Filesize
3.9MB

Download
memory/2640-23-0x00007FF6A3500000-0x00007FF6A38F1000-memory.dmp

Filesize
3.9MB

Download
memory/2640-1985-0x00007FF6A3500000-0x00007FF6A38F1000-memory.dmp

Filesize
3.9MB

Download
memory/2948-30-0x00007FF6972F0000-0x00007FF6976E1000-memory.dmp

Filesize
3.9MB

Download
memory/2948-2028-0x00007FF6972F0000-0x00007FF6976E1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-453-0x00007FF7D3BC0000-0x00007FF7D3FB1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-2032-0x00007FF7D3BC0000-0x00007FF7D3FB1000-memory.dmp

Filesize
3.9MB

Download
memory/3148-2065-0x00007FF76A260000-0x00007FF76A651000-memory.dmp

Filesize
3.9MB

Download
memory/3148-460-0x00007FF76A260000-0x00007FF76A651000-memory.dmp

Filesize
3.9MB

Download
memory/3272-31-0x00007FF641850000-0x00007FF641C41000-memory.dmp

Filesize
3.9MB

Download
memory/3272-2018-0x00007FF641850000-0x00007FF641C41000-memory.dmp

Filesize
3.9MB

Download
memory/3272-2038-0x00007FF641850000-0x00007FF641C41000-memory.dmp

Filesize
3.9MB

Download
memory/3404-462-0x00007FF7F07E0000-0x00007FF7F0BD1000-memory.dmp

Filesize
3.9MB

Download
memory/3404-2061-0x00007FF7F07E0000-0x00007FF7F0BD1000-memory.dmp

Filesize
3.9MB

Download
memory/3708-2073-0x00007FF7A47E0000-0x00007FF7A4BD1000-memory.dmp

Filesize
3.9MB

Download
memory/3708-457-0x00007FF7A47E0000-0x00007FF7A4BD1000-memory.dmp

Filesize
3.9MB

Download
memory/3832-2023-0x00007FF606F80000-0x00007FF607371000-memory.dmp

Filesize
3.9MB

Download
memory/3832-16-0x00007FF606F80000-0x00007FF607371000-memory.dmp

Filesize
3.9MB

Download
memory/3948-464-0x00007FF71A5A0000-0x00007FF71A991000-memory.dmp

Filesize
3.9MB

Download
memory/3948-2057-0x00007FF71A5A0000-0x00007FF71A991000-memory.dmp

Filesize
3.9MB

Download
memory/4324-2043-0x00007FF6E6D20000-0x00007FF6E7111000-memory.dmp

Filesize
3.9MB

Download
memory/4324-455-0x00007FF6E6D20000-0x00007FF6E7111000-memory.dmp

Filesize
3.9MB

Download
memory/4564-466-0x00007FF6AAC40000-0x00007FF6AB031000-memory.dmp

Filesize
3.9MB

Download
memory/4564-2053-0x00007FF6AAC40000-0x00007FF6AB031000-memory.dmp

Filesize
3.9MB

Download
memory/4580-2055-0x00007FF6617E0000-0x00007FF661BD1000-memory.dmp

Filesize
3.9MB

Download
memory/4580-465-0x00007FF6617E0000-0x00007FF661BD1000-memory.dmp

Filesize
3.9MB

Download
memory/4624-452-0x00007FF624BD0000-0x00007FF624FC1000-memory.dmp

Filesize
3.9MB

Download
memory/4624-2033-0x00007FF624BD0000-0x00007FF624FC1000-memory.dmp

Filesize
3.9MB

Download
memory/4648-468-0x00007FF7D4C00000-0x00007FF7D4FF1000-memory.dmp

Filesize
3.9MB

Download
memory/4648-2049-0x00007FF7D4C00000-0x00007FF7D4FF1000-memory.dmp

Filesize
3.9MB

Download
memory/4752-2071-0x00007FF7918B0000-0x00007FF791CA1000-memory.dmp

Filesize
3.9MB

Download
memory/4752-458-0x00007FF7918B0000-0x00007FF791CA1000-memory.dmp

Filesize
3.9MB

Download
memory/5064-1984-0x00007FF60D770000-0x00007FF60DB61000-memory.dmp

Filesize
3.9MB

Download
memory/5064-22-0x00007FF60D770000-0x00007FF60DB61000-memory.dmp

Filesize
3.9MB

Download
memory/5064-2025-0x00007FF60D770000-0x00007FF60DB61000-memory.dmp

Filesize
3.9MB

Download
memory/5072-467-0x00007FF666FC0000-0x00007FF6673B1000-memory.dmp

Filesize
3.9MB

Download
memory/5072-2051-0x00007FF666FC0000-0x00007FF6673B1000-memory.dmp

Filesize
3.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.