xmrig | afba53cc8f9404c068cad48f0ce75296bcfe9f237c71dc64dfb756454c9f7564

Analysis

max time kernel
92s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 04:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
Size 3.2MB
Sample240604-fgf93aec32
SHA256 afba53cc8f9404c068cad48f0ce75296bcfe9f237c71dc64dfb756454c9f7564
MD5 2efc58184d3787d3f274e43f7cd4c410
SHA1 4f1631388f33784e038b4e94f445d4a0b36eb958
SHA512 40a2f0b4569f08b947d12eecdca6c6bb3184884dae8fcede89bd2859bcf513c6c20215892cfb71c51fa6b16180b052ae7d1acd0b0e02203bec50e81a2680de47
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4K:wFWPClFa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/116-0-0x00007FF6A6040000-0x00007FF6A6435000-memory.dmp	xmrig
behavioral2/files/0x0009000000023434-6.dat	xmrig
behavioral2/files/0x0007000000023440-12.dat	xmrig
behavioral2/files/0x0007000000023441-9.dat	xmrig
behavioral2/memory/644-10-0x00007FF6EB560000-0x00007FF6EB955000-memory.dmp	xmrig
behavioral2/files/0x0007000000023442-23.dat	xmrig
behavioral2/files/0x0007000000023443-26.dat	xmrig
behavioral2/files/0x0007000000023444-33.dat	xmrig
behavioral2/files/0x0007000000023445-38.dat	xmrig
behavioral2/files/0x0007000000023447-45.dat	xmrig
behavioral2/files/0x0007000000023448-53.dat	xmrig
behavioral2/files/0x0007000000023449-57.dat	xmrig
behavioral2/memory/3788-61-0x00007FF6DB760000-0x00007FF6DBB55000-memory.dmp	xmrig
behavioral2/memory/5116-62-0x00007FF63F500000-0x00007FF63F8F5000-memory.dmp	xmrig
behavioral2/files/0x000700000002344a-66.dat	xmrig
behavioral2/memory/3500-71-0x00007FF6C78B0000-0x00007FF6C7CA5000-memory.dmp	xmrig
behavioral2/memory/1232-73-0x00007FF6DEA40000-0x00007FF6DEE35000-memory.dmp	xmrig
behavioral2/files/0x000700000002344c-76.dat	xmrig
behavioral2/memory/4340-82-0x00007FF728AA0000-0x00007FF728E95000-memory.dmp	xmrig
behavioral2/files/0x000700000002344d-94.dat	xmrig
behavioral2/files/0x000700000002344e-100.dat	xmrig
behavioral2/files/0x0007000000023450-108.dat	xmrig
behavioral2/files/0x0007000000023454-128.dat	xmrig
behavioral2/files/0x0007000000023457-143.dat	xmrig
behavioral2/files/0x000700000002345a-155.dat	xmrig
behavioral2/files/0x000700000002345c-171.dat	xmrig
behavioral2/memory/4104-680-0x00007FF77A8E0000-0x00007FF77ACD5000-memory.dmp	xmrig
behavioral2/memory/1424-685-0x00007FF6934F0000-0x00007FF6938E5000-memory.dmp	xmrig
behavioral2/memory/4036-698-0x00007FF6495A0000-0x00007FF649995000-memory.dmp	xmrig
behavioral2/memory/4836-691-0x00007FF7FBA20000-0x00007FF7FBE15000-memory.dmp	xmrig
behavioral2/memory/3568-677-0x00007FF632AC0000-0x00007FF632EB5000-memory.dmp	xmrig
behavioral2/memory/4720-674-0x00007FF753050000-0x00007FF753445000-memory.dmp	xmrig
behavioral2/memory/3100-669-0x00007FF6285F0000-0x00007FF6289E5000-memory.dmp	xmrig
behavioral2/files/0x000700000002345e-178.dat	xmrig
behavioral2/files/0x000700000002345d-173.dat	xmrig
behavioral2/files/0x000700000002345b-163.dat	xmrig
behavioral2/files/0x0007000000023459-153.dat	xmrig
behavioral2/files/0x0007000000023458-148.dat	xmrig
behavioral2/files/0x0007000000023456-138.dat	xmrig
behavioral2/files/0x0007000000023455-133.dat	xmrig
behavioral2/files/0x0007000000023453-126.dat	xmrig
behavioral2/files/0x0007000000023452-121.dat	xmrig
behavioral2/files/0x0007000000023451-113.dat	xmrig
behavioral2/files/0x000700000002344f-106.dat	xmrig
behavioral2/memory/3960-103-0x00007FF606C20000-0x00007FF607015000-memory.dmp	xmrig
behavioral2/memory/3268-97-0x00007FF6A4900000-0x00007FF6A4CF5000-memory.dmp	xmrig
behavioral2/memory/456-93-0x00007FF6EF720000-0x00007FF6EFB15000-memory.dmp	xmrig
behavioral2/memory/5040-90-0x00007FF683510000-0x00007FF683905000-memory.dmp	xmrig
behavioral2/memory/2576-86-0x00007FF67CB10000-0x00007FF67CF05000-memory.dmp	xmrig
behavioral2/memory/3560-83-0x00007FF7F28F0000-0x00007FF7F2CE5000-memory.dmp	xmrig
behavioral2/files/0x000700000002344b-79.dat	xmrig
behavioral2/memory/1708-78-0x00007FF741420000-0x00007FF741815000-memory.dmp	xmrig
behavioral2/memory/1544-75-0x00007FF6E0EC0000-0x00007FF6E12B5000-memory.dmp	xmrig
behavioral2/memory/1264-69-0x00007FF779D00000-0x00007FF77A0F5000-memory.dmp	xmrig
behavioral2/memory/1652-65-0x00007FF6296A0000-0x00007FF629A95000-memory.dmp	xmrig
behavioral2/files/0x0007000000023446-43.dat	xmrig
behavioral2/memory/1688-16-0x00007FF653C70000-0x00007FF654065000-memory.dmp	xmrig
behavioral2/memory/116-1456-0x00007FF6A6040000-0x00007FF6A6435000-memory.dmp	xmrig
behavioral2/memory/3268-1898-0x00007FF6A4900000-0x00007FF6A4CF5000-memory.dmp	xmrig
behavioral2/memory/456-1899-0x00007FF6EF720000-0x00007FF6EFB15000-memory.dmp	xmrig
behavioral2/memory/3960-1900-0x00007FF606C20000-0x00007FF607015000-memory.dmp	xmrig
behavioral2/memory/116-1901-0x00007FF6A6040000-0x00007FF6A6435000-memory.dmp	xmrig
behavioral2/memory/644-1902-0x00007FF6EB560000-0x00007FF6EB955000-memory.dmp	xmrig
behavioral2/memory/1688-1903-0x00007FF653C70000-0x00007FF654065000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
644	PuBTZzG.exe
1688	XpzObxm.exe
3788	rJvZarn.exe
5116	FpNHNcr.exe
1652	DJhrXnk.exe
3560	SnPtJbN.exe
1264	lURZZyC.exe
3500	uCAZmSw.exe
1232	TIOoOqM.exe
1544	iXKdACO.exe
1708	Jahhfbt.exe
4340	ZUvOQHL.exe
2576	PnKAuJJ.exe
5040	WJjtkNX.exe
456	brfVFPv.exe
3268	yLBKKQt.exe
3960	FctMHOA.exe
3100	fKnbzMT.exe
4720	RWXqTfw.exe
3568	AuSwmqK.exe
4104	jXNrxHa.exe
1424	ZnQUXTe.exe
4836	zhCieTC.exe
4036	WCrkvzZ.exe
5016	vaGlbwL.exe
5084	aaIeEDz.exe
4824	NzFFtQn.exe
5060	iBFDSqT.exe
2736	Kdcjjru.exe
1396	wpGPgXf.exe
1296	ZQYFrWo.exe
3968	XnRvQvG.exe
1924	JNmXufb.exe
4676	BYWFFIB.exe
5044	LXZXdzu.exe
3228	nwAtAtD.exe
2200	pAWBmDF.exe
3160	lZeXAyR.exe
3704	DyoHhSX.exe
464	SQBlCcu.exe
2432	QHVyjDp.exe
3836	mMBndSU.exe
2136	pUxvIOH.exe
4812	cjTmNBW.exe
1604	YxGQazS.exe
1220	CgoKNaL.exe
3540	zJxqMcl.exe
4440	FnWWlaC.exe
4680	xLJAwEg.exe
3680	bjqQHeF.exe
1364	jXBfKHY.exe
2036	tDWRDqy.exe
4068	vGzKDRd.exe
3768	TeysuLp.exe
2884	qVCORGF.exe
3588	vKYuOYS.exe
1620	LMEMGRj.exe
5012	jDWodMZ.exe
4240	SFtjZQp.exe
2936	YzRXZHx.exe
2452	NkwkePj.exe
3848	ZoRwBVt.exe
3212	XKpgDMm.exe
796	EjLxPTZ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/116-0-0x00007FF6A6040000-0x00007FF6A6435000-memory.dmp	upx
behavioral2/files/0x0009000000023434-6.dat	upx
behavioral2/files/0x0007000000023440-12.dat	upx
behavioral2/files/0x0007000000023441-9.dat	upx
behavioral2/memory/644-10-0x00007FF6EB560000-0x00007FF6EB955000-memory.dmp	upx
behavioral2/files/0x0007000000023442-23.dat	upx
behavioral2/files/0x0007000000023443-26.dat	upx
behavioral2/files/0x0007000000023444-33.dat	upx
behavioral2/files/0x0007000000023445-38.dat	upx
behavioral2/files/0x0007000000023447-45.dat	upx
behavioral2/files/0x0007000000023448-53.dat	upx
behavioral2/files/0x0007000000023449-57.dat	upx
behavioral2/memory/3788-61-0x00007FF6DB760000-0x00007FF6DBB55000-memory.dmp	upx
behavioral2/memory/5116-62-0x00007FF63F500000-0x00007FF63F8F5000-memory.dmp	upx
behavioral2/files/0x000700000002344a-66.dat	upx
behavioral2/memory/3500-71-0x00007FF6C78B0000-0x00007FF6C7CA5000-memory.dmp	upx
behavioral2/memory/1232-73-0x00007FF6DEA40000-0x00007FF6DEE35000-memory.dmp	upx
behavioral2/files/0x000700000002344c-76.dat	upx
behavioral2/memory/4340-82-0x00007FF728AA0000-0x00007FF728E95000-memory.dmp	upx
behavioral2/files/0x000700000002344d-94.dat	upx
behavioral2/files/0x000700000002344e-100.dat	upx
behavioral2/files/0x0007000000023450-108.dat	upx
behavioral2/files/0x0007000000023454-128.dat	upx
behavioral2/files/0x0007000000023457-143.dat	upx
behavioral2/files/0x000700000002345a-155.dat	upx
behavioral2/files/0x000700000002345c-171.dat	upx
behavioral2/memory/4104-680-0x00007FF77A8E0000-0x00007FF77ACD5000-memory.dmp	upx
behavioral2/memory/1424-685-0x00007FF6934F0000-0x00007FF6938E5000-memory.dmp	upx
behavioral2/memory/4036-698-0x00007FF6495A0000-0x00007FF649995000-memory.dmp	upx
behavioral2/memory/4836-691-0x00007FF7FBA20000-0x00007FF7FBE15000-memory.dmp	upx
behavioral2/memory/3568-677-0x00007FF632AC0000-0x00007FF632EB5000-memory.dmp	upx
behavioral2/memory/4720-674-0x00007FF753050000-0x00007FF753445000-memory.dmp	upx
behavioral2/memory/3100-669-0x00007FF6285F0000-0x00007FF6289E5000-memory.dmp	upx
behavioral2/files/0x000700000002345e-178.dat	upx
behavioral2/files/0x000700000002345d-173.dat	upx
behavioral2/files/0x000700000002345b-163.dat	upx
behavioral2/files/0x0007000000023459-153.dat	upx
behavioral2/files/0x0007000000023458-148.dat	upx
behavioral2/files/0x0007000000023456-138.dat	upx
behavioral2/files/0x0007000000023455-133.dat	upx
behavioral2/files/0x0007000000023453-126.dat	upx
behavioral2/files/0x0007000000023452-121.dat	upx
behavioral2/files/0x0007000000023451-113.dat	upx
behavioral2/files/0x000700000002344f-106.dat	upx
behavioral2/memory/3960-103-0x00007FF606C20000-0x00007FF607015000-memory.dmp	upx
behavioral2/memory/3268-97-0x00007FF6A4900000-0x00007FF6A4CF5000-memory.dmp	upx
behavioral2/memory/456-93-0x00007FF6EF720000-0x00007FF6EFB15000-memory.dmp	upx
behavioral2/memory/5040-90-0x00007FF683510000-0x00007FF683905000-memory.dmp	upx
behavioral2/memory/2576-86-0x00007FF67CB10000-0x00007FF67CF05000-memory.dmp	upx
behavioral2/memory/3560-83-0x00007FF7F28F0000-0x00007FF7F2CE5000-memory.dmp	upx
behavioral2/files/0x000700000002344b-79.dat	upx
behavioral2/memory/1708-78-0x00007FF741420000-0x00007FF741815000-memory.dmp	upx
behavioral2/memory/1544-75-0x00007FF6E0EC0000-0x00007FF6E12B5000-memory.dmp	upx
behavioral2/memory/1264-69-0x00007FF779D00000-0x00007FF77A0F5000-memory.dmp	upx
behavioral2/memory/1652-65-0x00007FF6296A0000-0x00007FF629A95000-memory.dmp	upx
behavioral2/files/0x0007000000023446-43.dat	upx
behavioral2/memory/1688-16-0x00007FF653C70000-0x00007FF654065000-memory.dmp	upx
behavioral2/memory/116-1456-0x00007FF6A6040000-0x00007FF6A6435000-memory.dmp	upx
behavioral2/memory/3268-1898-0x00007FF6A4900000-0x00007FF6A4CF5000-memory.dmp	upx
behavioral2/memory/456-1899-0x00007FF6EF720000-0x00007FF6EFB15000-memory.dmp	upx
behavioral2/memory/3960-1900-0x00007FF606C20000-0x00007FF607015000-memory.dmp	upx
behavioral2/memory/116-1901-0x00007FF6A6040000-0x00007FF6A6435000-memory.dmp	upx
behavioral2/memory/644-1902-0x00007FF6EB560000-0x00007FF6EB955000-memory.dmp	upx
behavioral2/memory/1688-1903-0x00007FF653C70000-0x00007FF654065000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\EgdaVKy.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\dtJErff.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\TIOoOqM.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\VxoSDxT.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\qehtJZi.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\kFmufIy.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\VeWxkJP.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\FZdeXfD.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\tHCQsIL.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\zDKURvh.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\TAosPmV.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\XSbSjVC.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\khtshoO.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\gbUtNAL.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\qSuYgUF.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\ZtUDXTy.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\nvpmiuZ.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\FctMHOA.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\DyoHhSX.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\ZoRwBVt.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\sSyvCzh.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\FBfmcEC.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\XnRvQvG.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\TeysuLp.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\yGtnHZv.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\lsdsSDq.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\twywEag.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\YSNfyYN.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\cjTmNBW.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\NChdMoG.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\AQeAgfG.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\ZiRcbee.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\RpeNjVo.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\wDXOGLK.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\HwPModU.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\CEtqHHk.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\pYJhXRD.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\YdBilnN.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\DzzYyYF.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\sCgeYhP.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\pttUkHR.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\ganJjeL.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\CAisZdc.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\tJTPnTP.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\pjoanwe.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\uZjJTrR.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\WCrkvzZ.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\ulSHycL.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\YcBuNgA.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\BUltSSP.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\zXmQcDu.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\zfHVXfw.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\tGyYswh.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\hEqVjet.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\DzRPXtU.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\WfxNCDf.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\DJhrXnk.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\fKnbzMT.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\anbhVqT.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\XZYlwCW.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\SFtjZQp.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\ViBrwHd.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\cgWtuzq.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
File created	C:\Windows\System32\lBqZUVt.exe	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 644	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	82
PID 116 wrote to memory of 644	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	82
PID 116 wrote to memory of 1688	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	83
PID 116 wrote to memory of 1688	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	83
PID 116 wrote to memory of 3788	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	84
PID 116 wrote to memory of 3788	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	84
PID 116 wrote to memory of 5116	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	85
PID 116 wrote to memory of 5116	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	85
PID 116 wrote to memory of 1652	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	86
PID 116 wrote to memory of 1652	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	86
PID 116 wrote to memory of 3560	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	87
PID 116 wrote to memory of 3560	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	87
PID 116 wrote to memory of 1264	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	88
PID 116 wrote to memory of 1264	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	88
PID 116 wrote to memory of 3500	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	89
PID 116 wrote to memory of 3500	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	89
PID 116 wrote to memory of 1232	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	90
PID 116 wrote to memory of 1232	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	90
PID 116 wrote to memory of 1544	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	91
PID 116 wrote to memory of 1544	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	91
PID 116 wrote to memory of 1708	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	92
PID 116 wrote to memory of 1708	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	92
PID 116 wrote to memory of 4340	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	93
PID 116 wrote to memory of 4340	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	93
PID 116 wrote to memory of 2576	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	94
PID 116 wrote to memory of 2576	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	94
PID 116 wrote to memory of 5040	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	95
PID 116 wrote to memory of 5040	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	95
PID 116 wrote to memory of 456	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	96
PID 116 wrote to memory of 456	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	96
PID 116 wrote to memory of 3268	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	97
PID 116 wrote to memory of 3268	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	97
PID 116 wrote to memory of 3960	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	98
PID 116 wrote to memory of 3960	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	98
PID 116 wrote to memory of 3100	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	99
PID 116 wrote to memory of 3100	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	99
PID 116 wrote to memory of 4720	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	100
PID 116 wrote to memory of 4720	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	100
PID 116 wrote to memory of 3568	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	101
PID 116 wrote to memory of 3568	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	101
PID 116 wrote to memory of 4104	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	102
PID 116 wrote to memory of 4104	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	102
PID 116 wrote to memory of 1424	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	103
PID 116 wrote to memory of 1424	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	103
PID 116 wrote to memory of 4836	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	104
PID 116 wrote to memory of 4836	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	104
PID 116 wrote to memory of 4036	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	105
PID 116 wrote to memory of 4036	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	105
PID 116 wrote to memory of 5016	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	106
PID 116 wrote to memory of 5016	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	106
PID 116 wrote to memory of 5084	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	107
PID 116 wrote to memory of 5084	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	107
PID 116 wrote to memory of 4824	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	108
PID 116 wrote to memory of 4824	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	108
PID 116 wrote to memory of 5060	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	109
PID 116 wrote to memory of 5060	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	109
PID 116 wrote to memory of 2736	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	110
PID 116 wrote to memory of 2736	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	110
PID 116 wrote to memory of 1396	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	111
PID 116 wrote to memory of 1396	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	111
PID 116 wrote to memory of 1296	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	112
PID 116 wrote to memory of 1296	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	112
PID 116 wrote to memory of 3968	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	113
PID 116 wrote to memory of 3968	116	2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe	113

C:\Users\Admin\AppData\Local\Temp\2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2efc58184d3787d3f274e43f7cd4c410_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:116
- C:\Windows\System32\PuBTZzG.exe
  C:\Windows\System32\PuBTZzG.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System32\XpzObxm.exe
  C:\Windows\System32\XpzObxm.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System32\rJvZarn.exe
  C:\Windows\System32\rJvZarn.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System32\FpNHNcr.exe
  C:\Windows\System32\FpNHNcr.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System32\DJhrXnk.exe
  C:\Windows\System32\DJhrXnk.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System32\SnPtJbN.exe
  C:\Windows\System32\SnPtJbN.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System32\lURZZyC.exe
  C:\Windows\System32\lURZZyC.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System32\uCAZmSw.exe
  C:\Windows\System32\uCAZmSw.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System32\TIOoOqM.exe
  C:\Windows\System32\TIOoOqM.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System32\iXKdACO.exe
  C:\Windows\System32\iXKdACO.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System32\Jahhfbt.exe
  C:\Windows\System32\Jahhfbt.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System32\ZUvOQHL.exe
  C:\Windows\System32\ZUvOQHL.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System32\PnKAuJJ.exe
  C:\Windows\System32\PnKAuJJ.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System32\WJjtkNX.exe
  C:\Windows\System32\WJjtkNX.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System32\brfVFPv.exe
  C:\Windows\System32\brfVFPv.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System32\yLBKKQt.exe
  C:\Windows\System32\yLBKKQt.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System32\FctMHOA.exe
  C:\Windows\System32\FctMHOA.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System32\fKnbzMT.exe
  C:\Windows\System32\fKnbzMT.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System32\RWXqTfw.exe
  C:\Windows\System32\RWXqTfw.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System32\AuSwmqK.exe
  C:\Windows\System32\AuSwmqK.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System32\jXNrxHa.exe
  C:\Windows\System32\jXNrxHa.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System32\ZnQUXTe.exe
  C:\Windows\System32\ZnQUXTe.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System32\zhCieTC.exe
  C:\Windows\System32\zhCieTC.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System32\WCrkvzZ.exe
  C:\Windows\System32\WCrkvzZ.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System32\vaGlbwL.exe
  C:\Windows\System32\vaGlbwL.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System32\aaIeEDz.exe
  C:\Windows\System32\aaIeEDz.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System32\NzFFtQn.exe
  C:\Windows\System32\NzFFtQn.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System32\iBFDSqT.exe
  C:\Windows\System32\iBFDSqT.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System32\Kdcjjru.exe
  C:\Windows\System32\Kdcjjru.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System32\wpGPgXf.exe
  C:\Windows\System32\wpGPgXf.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System32\ZQYFrWo.exe
  C:\Windows\System32\ZQYFrWo.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System32\XnRvQvG.exe
  C:\Windows\System32\XnRvQvG.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System32\JNmXufb.exe
  C:\Windows\System32\JNmXufb.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System32\BYWFFIB.exe
  C:\Windows\System32\BYWFFIB.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System32\LXZXdzu.exe
  C:\Windows\System32\LXZXdzu.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System32\nwAtAtD.exe
  C:\Windows\System32\nwAtAtD.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System32\pAWBmDF.exe
  C:\Windows\System32\pAWBmDF.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System32\lZeXAyR.exe
  C:\Windows\System32\lZeXAyR.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System32\DyoHhSX.exe
  C:\Windows\System32\DyoHhSX.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System32\SQBlCcu.exe
  C:\Windows\System32\SQBlCcu.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System32\QHVyjDp.exe
  C:\Windows\System32\QHVyjDp.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System32\mMBndSU.exe
  C:\Windows\System32\mMBndSU.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System32\pUxvIOH.exe
  C:\Windows\System32\pUxvIOH.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System32\cjTmNBW.exe
  C:\Windows\System32\cjTmNBW.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System32\YxGQazS.exe
  C:\Windows\System32\YxGQazS.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System32\CgoKNaL.exe
  C:\Windows\System32\CgoKNaL.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System32\zJxqMcl.exe
  C:\Windows\System32\zJxqMcl.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System32\FnWWlaC.exe
  C:\Windows\System32\FnWWlaC.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System32\xLJAwEg.exe
  C:\Windows\System32\xLJAwEg.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System32\bjqQHeF.exe
  C:\Windows\System32\bjqQHeF.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System32\jXBfKHY.exe
  C:\Windows\System32\jXBfKHY.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System32\tDWRDqy.exe
  C:\Windows\System32\tDWRDqy.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System32\vGzKDRd.exe
  C:\Windows\System32\vGzKDRd.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System32\TeysuLp.exe
  C:\Windows\System32\TeysuLp.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System32\qVCORGF.exe
  C:\Windows\System32\qVCORGF.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System32\vKYuOYS.exe
  C:\Windows\System32\vKYuOYS.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System32\LMEMGRj.exe
  C:\Windows\System32\LMEMGRj.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System32\jDWodMZ.exe
  C:\Windows\System32\jDWodMZ.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System32\SFtjZQp.exe
  C:\Windows\System32\SFtjZQp.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System32\YzRXZHx.exe
  C:\Windows\System32\YzRXZHx.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System32\NkwkePj.exe
  C:\Windows\System32\NkwkePj.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System32\ZoRwBVt.exe
  C:\Windows\System32\ZoRwBVt.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System32\XKpgDMm.exe
  C:\Windows\System32\XKpgDMm.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System32\EjLxPTZ.exe
  C:\Windows\System32\EjLxPTZ.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System32\sxHOlTE.exe
  C:\Windows\System32\sxHOlTE.exe
  2⤵
  PID:1348
- C:\Windows\System32\bjyAdyA.exe
  C:\Windows\System32\bjyAdyA.exe
  2⤵
  PID:3016
- C:\Windows\System32\DFmFfip.exe
  C:\Windows\System32\DFmFfip.exe
  2⤵
  PID:4184
- C:\Windows\System32\nOTYBmb.exe
  C:\Windows\System32\nOTYBmb.exe
  2⤵
  PID:4476
- C:\Windows\System32\NdeKSAC.exe
  C:\Windows\System32\NdeKSAC.exe
  2⤵
  PID:4228
- C:\Windows\System32\ygUyipQ.exe
  C:\Windows\System32\ygUyipQ.exe
  2⤵
  PID:1948
- C:\Windows\System32\yKxxyej.exe
  C:\Windows\System32\yKxxyej.exe
  2⤵
  PID:4632
- C:\Windows\System32\TAosPmV.exe
  C:\Windows\System32\TAosPmV.exe
  2⤵
  PID:5008
- C:\Windows\System32\UuvidOi.exe
  C:\Windows\System32\UuvidOi.exe
  2⤵
  PID:2084
- C:\Windows\System32\VxoSDxT.exe
  C:\Windows\System32\VxoSDxT.exe
  2⤵
  PID:1700
- C:\Windows\System32\JagEuDc.exe
  C:\Windows\System32\JagEuDc.exe
  2⤵
  PID:2308
- C:\Windows\System32\QIRmQtD.exe
  C:\Windows\System32\QIRmQtD.exe
  2⤵
  PID:4136
- C:\Windows\System32\wfSMWfj.exe
  C:\Windows\System32\wfSMWfj.exe
  2⤵
  PID:3792
- C:\Windows\System32\eRCLBrQ.exe
  C:\Windows\System32\eRCLBrQ.exe
  2⤵
  PID:1660
- C:\Windows\System32\HzAerCl.exe
  C:\Windows\System32\HzAerCl.exe
  2⤵
  PID:1160
- C:\Windows\System32\YvgAnzl.exe
  C:\Windows\System32\YvgAnzl.exe
  2⤵
  PID:5064
- C:\Windows\System32\hyPDbQD.exe
  C:\Windows\System32\hyPDbQD.exe
  2⤵
  PID:4212
- C:\Windows\System32\QxvTJpa.exe
  C:\Windows\System32\QxvTJpa.exe
  2⤵
  PID:5124
- C:\Windows\System32\TZteazq.exe
  C:\Windows\System32\TZteazq.exe
  2⤵
  PID:5156
- C:\Windows\System32\vQHCYYl.exe
  C:\Windows\System32\vQHCYYl.exe
  2⤵
  PID:5188
- C:\Windows\System32\kHZeart.exe
  C:\Windows\System32\kHZeart.exe
  2⤵
  PID:5204
- C:\Windows\System32\drWzfuq.exe
  C:\Windows\System32\drWzfuq.exe
  2⤵
  PID:5232
- C:\Windows\System32\cfXCUJl.exe
  C:\Windows\System32\cfXCUJl.exe
  2⤵
  PID:5256
- C:\Windows\System32\OFUUdLn.exe
  C:\Windows\System32\OFUUdLn.exe
  2⤵
  PID:5284
- C:\Windows\System32\oHEvyqS.exe
  C:\Windows\System32\oHEvyqS.exe
  2⤵
  PID:5312
- C:\Windows\System32\ybsxBCm.exe
  C:\Windows\System32\ybsxBCm.exe
  2⤵
  PID:5344
- C:\Windows\System32\ahXuZAR.exe
  C:\Windows\System32\ahXuZAR.exe
  2⤵
  PID:5372
- C:\Windows\System32\qklLEah.exe
  C:\Windows\System32\qklLEah.exe
  2⤵
  PID:5400
- C:\Windows\System32\oalMvUi.exe
  C:\Windows\System32\oalMvUi.exe
  2⤵
  PID:5440
- C:\Windows\System32\IguCneW.exe
  C:\Windows\System32\IguCneW.exe
  2⤵
  PID:5456
- C:\Windows\System32\sdKlFNH.exe
  C:\Windows\System32\sdKlFNH.exe
  2⤵
  PID:5484
- C:\Windows\System32\gDgaZoz.exe
  C:\Windows\System32\gDgaZoz.exe
  2⤵
  PID:5508
- C:\Windows\System32\NbjWffN.exe
  C:\Windows\System32\NbjWffN.exe
  2⤵
  PID:5540
- C:\Windows\System32\TmNotvX.exe
  C:\Windows\System32\TmNotvX.exe
  2⤵
  PID:5568
- C:\Windows\System32\RDLIYTZ.exe
  C:\Windows\System32\RDLIYTZ.exe
  2⤵
  PID:5596
- C:\Windows\System32\qZxmlrO.exe
  C:\Windows\System32\qZxmlrO.exe
  2⤵
  PID:5620
- C:\Windows\System32\DChGUnC.exe
  C:\Windows\System32\DChGUnC.exe
  2⤵
  PID:5652
- C:\Windows\System32\ulSHycL.exe
  C:\Windows\System32\ulSHycL.exe
  2⤵
  PID:5680
- C:\Windows\System32\qehtJZi.exe
  C:\Windows\System32\qehtJZi.exe
  2⤵
  PID:5708
- C:\Windows\System32\giZMmJj.exe
  C:\Windows\System32\giZMmJj.exe
  2⤵
  PID:5736
- C:\Windows\System32\LCWCheI.exe
  C:\Windows\System32\LCWCheI.exe
  2⤵
  PID:5764
- C:\Windows\System32\YcBuNgA.exe
  C:\Windows\System32\YcBuNgA.exe
  2⤵
  PID:5792
- C:\Windows\System32\oauwrNZ.exe
  C:\Windows\System32\oauwrNZ.exe
  2⤵
  PID:5820
- C:\Windows\System32\CAisZdc.exe
  C:\Windows\System32\CAisZdc.exe
  2⤵
  PID:5844
- C:\Windows\System32\TQiUkdt.exe
  C:\Windows\System32\TQiUkdt.exe
  2⤵
  PID:5876
- C:\Windows\System32\kYYiWZZ.exe
  C:\Windows\System32\kYYiWZZ.exe
  2⤵
  PID:5904
- C:\Windows\System32\GkVbTnn.exe
  C:\Windows\System32\GkVbTnn.exe
  2⤵
  PID:5932
- C:\Windows\System32\bYrsuUt.exe
  C:\Windows\System32\bYrsuUt.exe
  2⤵
  PID:5956
- C:\Windows\System32\poGFttH.exe
  C:\Windows\System32\poGFttH.exe
  2⤵
  PID:5984
- C:\Windows\System32\tGyYswh.exe
  C:\Windows\System32\tGyYswh.exe
  2⤵
  PID:6016
- C:\Windows\System32\numXTcf.exe
  C:\Windows\System32\numXTcf.exe
  2⤵
  PID:6040
- C:\Windows\System32\REJbKrN.exe
  C:\Windows\System32\REJbKrN.exe
  2⤵
  PID:6068
- C:\Windows\System32\khtshoO.exe
  C:\Windows\System32\khtshoO.exe
  2⤵
  PID:6100
- C:\Windows\System32\jtCegno.exe
  C:\Windows\System32\jtCegno.exe
  2⤵
  PID:6128
- C:\Windows\System32\ZEpEuKS.exe
  C:\Windows\System32\ZEpEuKS.exe
  2⤵
  PID:1592
- C:\Windows\System32\IJpWuNR.exe
  C:\Windows\System32\IJpWuNR.exe
  2⤵
  PID:1648
- C:\Windows\System32\XjjvcCk.exe
  C:\Windows\System32\XjjvcCk.exe
  2⤵
  PID:4780
- C:\Windows\System32\mmgaWKr.exe
  C:\Windows\System32\mmgaWKr.exe
  2⤵
  PID:5132
- C:\Windows\System32\yNoCBYa.exe
  C:\Windows\System32\yNoCBYa.exe
  2⤵
  PID:5196
- C:\Windows\System32\bMCVSBt.exe
  C:\Windows\System32\bMCVSBt.exe
  2⤵
  PID:5264
- C:\Windows\System32\zllqARv.exe
  C:\Windows\System32\zllqARv.exe
  2⤵
  PID:5328
- C:\Windows\System32\EkikXLy.exe
  C:\Windows\System32\EkikXLy.exe
  2⤵
  PID:5380
- C:\Windows\System32\qPpAKbZ.exe
  C:\Windows\System32\qPpAKbZ.exe
  2⤵
  PID:5452
- C:\Windows\System32\htcaEUA.exe
  C:\Windows\System32\htcaEUA.exe
  2⤵
  PID:5524
- C:\Windows\System32\RielIDm.exe
  C:\Windows\System32\RielIDm.exe
  2⤵
  PID:5588
- C:\Windows\System32\GhtgwOH.exe
  C:\Windows\System32\GhtgwOH.exe
  2⤵
  PID:5660
- C:\Windows\System32\iBILAXR.exe
  C:\Windows\System32\iBILAXR.exe
  2⤵
  PID:5720
- C:\Windows\System32\mNjFgEe.exe
  C:\Windows\System32\mNjFgEe.exe
  2⤵
  PID:5800
- C:\Windows\System32\fWmSpUe.exe
  C:\Windows\System32\fWmSpUe.exe
  2⤵
  PID:5868
- C:\Windows\System32\IETVlke.exe
  C:\Windows\System32\IETVlke.exe
  2⤵
  PID:5916
- C:\Windows\System32\ACbJmvI.exe
  C:\Windows\System32\ACbJmvI.exe
  2⤵
  PID:5980
- C:\Windows\System32\mGwsNEo.exe
  C:\Windows\System32\mGwsNEo.exe
  2⤵
  PID:6048
- C:\Windows\System32\hqBcaPX.exe
  C:\Windows\System32\hqBcaPX.exe
  2⤵
  PID:564
- C:\Windows\System32\DIusKGN.exe
  C:\Windows\System32\DIusKGN.exe
  2⤵
  PID:4904
- C:\Windows\System32\cdHcmhx.exe
  C:\Windows\System32\cdHcmhx.exe
  2⤵
  PID:2712
- C:\Windows\System32\FZdeXfD.exe
  C:\Windows\System32\FZdeXfD.exe
  2⤵
  PID:5308
- C:\Windows\System32\RKCcqOb.exe
  C:\Windows\System32\RKCcqOb.exe
  2⤵
  PID:5408
- C:\Windows\System32\eCGNeRs.exe
  C:\Windows\System32\eCGNeRs.exe
  2⤵
  PID:5548
- C:\Windows\System32\mQnzUBz.exe
  C:\Windows\System32\mQnzUBz.exe
  2⤵
  PID:5688
- C:\Windows\System32\pXzkGwX.exe
  C:\Windows\System32\pXzkGwX.exe
  2⤵
  PID:5852
- C:\Windows\System32\RtmIZVN.exe
  C:\Windows\System32\RtmIZVN.exe
  2⤵
  PID:6028
- C:\Windows\System32\uBLwkkC.exe
  C:\Windows\System32\uBLwkkC.exe
  2⤵
  PID:2424
- C:\Windows\System32\jEWzdqq.exe
  C:\Windows\System32\jEWzdqq.exe
  2⤵
  PID:712
- C:\Windows\System32\PcYwhJn.exe
  C:\Windows\System32\PcYwhJn.exe
  2⤵
  PID:1540
- C:\Windows\System32\UcxSYld.exe
  C:\Windows\System32\UcxSYld.exe
  2⤵
  PID:6148
- C:\Windows\System32\JaNNVad.exe
  C:\Windows\System32\JaNNVad.exe
  2⤵
  PID:6176
- C:\Windows\System32\NPStIUr.exe
  C:\Windows\System32\NPStIUr.exe
  2⤵
  PID:6200
- C:\Windows\System32\pYJhXRD.exe
  C:\Windows\System32\pYJhXRD.exe
  2⤵
  PID:6232
- C:\Windows\System32\GPQJkRx.exe
  C:\Windows\System32\GPQJkRx.exe
  2⤵
  PID:6260
- C:\Windows\System32\gbUtNAL.exe
  C:\Windows\System32\gbUtNAL.exe
  2⤵
  PID:6288
- C:\Windows\System32\pXTEWLM.exe
  C:\Windows\System32\pXTEWLM.exe
  2⤵
  PID:6316
- C:\Windows\System32\XhrGbqj.exe
  C:\Windows\System32\XhrGbqj.exe
  2⤵
  PID:6344
- C:\Windows\System32\IWqKDrf.exe
  C:\Windows\System32\IWqKDrf.exe
  2⤵
  PID:6372
- C:\Windows\System32\lFBHwCQ.exe
  C:\Windows\System32\lFBHwCQ.exe
  2⤵
  PID:6400
- C:\Windows\System32\zZRhdxy.exe
  C:\Windows\System32\zZRhdxy.exe
  2⤵
  PID:6440
- C:\Windows\System32\YWrOOcR.exe
  C:\Windows\System32\YWrOOcR.exe
  2⤵
  PID:6456
- C:\Windows\System32\nLpFXHX.exe
  C:\Windows\System32\nLpFXHX.exe
  2⤵
  PID:6484
- C:\Windows\System32\MposWjX.exe
  C:\Windows\System32\MposWjX.exe
  2⤵
  PID:6512
- C:\Windows\System32\FDRmwFS.exe
  C:\Windows\System32\FDRmwFS.exe
  2⤵
  PID:6536
- C:\Windows\System32\prYKqhJ.exe
  C:\Windows\System32\prYKqhJ.exe
  2⤵
  PID:6568
- C:\Windows\System32\gRHkgeV.exe
  C:\Windows\System32\gRHkgeV.exe
  2⤵
  PID:6596
- C:\Windows\System32\DErKmXZ.exe
  C:\Windows\System32\DErKmXZ.exe
  2⤵
  PID:6624
- C:\Windows\System32\ePPCdwo.exe
  C:\Windows\System32\ePPCdwo.exe
  2⤵
  PID:6652
- C:\Windows\System32\NIchaMv.exe
  C:\Windows\System32\NIchaMv.exe
  2⤵
  PID:6680
- C:\Windows\System32\fLxJuUy.exe
  C:\Windows\System32\fLxJuUy.exe
  2⤵
  PID:6708
- C:\Windows\System32\NRUTMkR.exe
  C:\Windows\System32\NRUTMkR.exe
  2⤵
  PID:6736
- C:\Windows\System32\yYbSXil.exe
  C:\Windows\System32\yYbSXil.exe
  2⤵
  PID:6764
- C:\Windows\System32\dXTtnMB.exe
  C:\Windows\System32\dXTtnMB.exe
  2⤵
  PID:6792
- C:\Windows\System32\hEqVjet.exe
  C:\Windows\System32\hEqVjet.exe
  2⤵
  PID:6820
- C:\Windows\System32\ffZaCZb.exe
  C:\Windows\System32\ffZaCZb.exe
  2⤵
  PID:6848
- C:\Windows\System32\qomXNqR.exe
  C:\Windows\System32\qomXNqR.exe
  2⤵
  PID:6876
- C:\Windows\System32\YCzqhYa.exe
  C:\Windows\System32\YCzqhYa.exe
  2⤵
  PID:6908
- C:\Windows\System32\lyUSZPt.exe
  C:\Windows\System32\lyUSZPt.exe
  2⤵
  PID:6932
- C:\Windows\System32\NBJhtAS.exe
  C:\Windows\System32\NBJhtAS.exe
  2⤵
  PID:6972
- C:\Windows\System32\QhPlVsH.exe
  C:\Windows\System32\QhPlVsH.exe
  2⤵
  PID:6988
- C:\Windows\System32\tHCQsIL.exe
  C:\Windows\System32\tHCQsIL.exe
  2⤵
  PID:7028
- C:\Windows\System32\PAnWDdp.exe
  C:\Windows\System32\PAnWDdp.exe
  2⤵
  PID:7044
- C:\Windows\System32\TSIYcqr.exe
  C:\Windows\System32\TSIYcqr.exe
  2⤵
  PID:7072
- C:\Windows\System32\tIgtOfK.exe
  C:\Windows\System32\tIgtOfK.exe
  2⤵
  PID:7100
- C:\Windows\System32\NnFgqQy.exe
  C:\Windows\System32\NnFgqQy.exe
  2⤵
  PID:7128
- C:\Windows\System32\SMzDuXF.exe
  C:\Windows\System32\SMzDuXF.exe
  2⤵
  PID:7156
- C:\Windows\System32\wAWkTDC.exe
  C:\Windows\System32\wAWkTDC.exe
  2⤵
  PID:6108
- C:\Windows\System32\VRTTSRE.exe
  C:\Windows\System32\VRTTSRE.exe
  2⤵
  PID:4008
- C:\Windows\System32\WyQGtHh.exe
  C:\Windows\System32\WyQGtHh.exe
  2⤵
  PID:5752
- C:\Windows\System32\RidIrhV.exe
  C:\Windows\System32\RidIrhV.exe
  2⤵
  PID:6196
- C:\Windows\System32\vWlbvdm.exe
  C:\Windows\System32\vWlbvdm.exe
  2⤵
  PID:1896
- C:\Windows\System32\tJTPnTP.exe
  C:\Windows\System32\tJTPnTP.exe
  2⤵
  PID:2376
- C:\Windows\System32\sLIBWSJ.exe
  C:\Windows\System32\sLIBWSJ.exe
  2⤵
  PID:6392
- C:\Windows\System32\PdbShDf.exe
  C:\Windows\System32\PdbShDf.exe
  2⤵
  PID:1560
- C:\Windows\System32\QIHRfvH.exe
  C:\Windows\System32\QIHRfvH.exe
  2⤵
  PID:6496
- C:\Windows\System32\vNyuOur.exe
  C:\Windows\System32\vNyuOur.exe
  2⤵
  PID:6560
- C:\Windows\System32\lTIBGKh.exe
  C:\Windows\System32\lTIBGKh.exe
  2⤵
  PID:6604
- C:\Windows\System32\LXuzYln.exe
  C:\Windows\System32\LXuzYln.exe
  2⤵
  PID:4056
- C:\Windows\System32\aOXEuuY.exe
  C:\Windows\System32\aOXEuuY.exe
  2⤵
  PID:2260
- C:\Windows\System32\asawhsw.exe
  C:\Windows\System32\asawhsw.exe
  2⤵
  PID:6840
- C:\Windows\System32\MQzljpA.exe
  C:\Windows\System32\MQzljpA.exe
  2⤵
  PID:6860
- C:\Windows\System32\PIxBmzP.exe
  C:\Windows\System32\PIxBmzP.exe
  2⤵
  PID:6916
- C:\Windows\System32\fvLvXBB.exe
  C:\Windows\System32\fvLvXBB.exe
  2⤵
  PID:6980
- C:\Windows\System32\CRugKxk.exe
  C:\Windows\System32\CRugKxk.exe
  2⤵
  PID:7056
- C:\Windows\System32\mhLUtRH.exe
  C:\Windows\System32\mhLUtRH.exe
  2⤵
  PID:7136
- C:\Windows\System32\LieijUc.exe
  C:\Windows\System32\LieijUc.exe
  2⤵
  PID:1732
- C:\Windows\System32\TGBpRzw.exe
  C:\Windows\System32\TGBpRzw.exe
  2⤵
  PID:6208
- C:\Windows\System32\nHbTvcB.exe
  C:\Windows\System32\nHbTvcB.exe
  2⤵
  PID:1704
- C:\Windows\System32\NChdMoG.exe
  C:\Windows\System32\NChdMoG.exe
  2⤵
  PID:3532
- C:\Windows\System32\yLktGaX.exe
  C:\Windows\System32\yLktGaX.exe
  2⤵
  PID:6672
- C:\Windows\System32\YYiSLBU.exe
  C:\Windows\System32\YYiSLBU.exe
  2⤵
  PID:4920
- C:\Windows\System32\anbhVqT.exe
  C:\Windows\System32\anbhVqT.exe
  2⤵
  PID:2364
- C:\Windows\System32\HiYkQOk.exe
  C:\Windows\System32\HiYkQOk.exe
  2⤵
  PID:3308
- C:\Windows\System32\yJdUvBn.exe
  C:\Windows\System32\yJdUvBn.exe
  2⤵
  PID:6744
- C:\Windows\System32\yGtnHZv.exe
  C:\Windows\System32\yGtnHZv.exe
  2⤵
  PID:3708
- C:\Windows\System32\EJzTovl.exe
  C:\Windows\System32\EJzTovl.exe
  2⤵
  PID:3024
- C:\Windows\System32\zXVgFZR.exe
  C:\Windows\System32\zXVgFZR.exe
  2⤵
  PID:4540
- C:\Windows\System32\AxNNFXo.exe
  C:\Windows\System32\AxNNFXo.exe
  2⤵
  PID:1040
- C:\Windows\System32\FADnqTd.exe
  C:\Windows\System32\FADnqTd.exe
  2⤵
  PID:2276
- C:\Windows\System32\kpgjXfF.exe
  C:\Windows\System32\kpgjXfF.exe
  2⤵
  PID:7000
- C:\Windows\System32\kdukiuY.exe
  C:\Windows\System32\kdukiuY.exe
  2⤵
  PID:3820
- C:\Windows\System32\aHLREMS.exe
  C:\Windows\System32\aHLREMS.exe
  2⤵
  PID:6996
- C:\Windows\System32\acsEwWy.exe
  C:\Windows\System32\acsEwWy.exe
  2⤵
  PID:5972
- C:\Windows\System32\WXlnwCU.exe
  C:\Windows\System32\WXlnwCU.exe
  2⤵
  PID:6476
- C:\Windows\System32\iSZvgKw.exe
  C:\Windows\System32\iSZvgKw.exe
  2⤵
  PID:4180
- C:\Windows\System32\ZlpmqIE.exe
  C:\Windows\System32\ZlpmqIE.exe
  2⤵
  PID:6616
- C:\Windows\System32\PzWJMSU.exe
  C:\Windows\System32\PzWJMSU.exe
  2⤵
  PID:4460
- C:\Windows\System32\MzfmQJY.exe
  C:\Windows\System32\MzfmQJY.exe
  2⤵
  PID:4700
- C:\Windows\System32\AIMatLk.exe
  C:\Windows\System32\AIMatLk.exe
  2⤵
  PID:1836
- C:\Windows\System32\PQwYXDx.exe
  C:\Windows\System32\PQwYXDx.exe
  2⤵
  PID:4956
- C:\Windows\System32\GtncJqq.exe
  C:\Windows\System32\GtncJqq.exe
  2⤵
  PID:7064
- C:\Windows\System32\qiDmiWu.exe
  C:\Windows\System32\qiDmiWu.exe
  2⤵
  PID:4980
- C:\Windows\System32\wWobqKg.exe
  C:\Windows\System32\wWobqKg.exe
  2⤵
  PID:7204
- C:\Windows\System32\zDKURvh.exe
  C:\Windows\System32\zDKURvh.exe
  2⤵
  PID:7228
- C:\Windows\System32\pukcRGX.exe
  C:\Windows\System32\pukcRGX.exe
  2⤵
  PID:7264
- C:\Windows\System32\XSbSjVC.exe
  C:\Windows\System32\XSbSjVC.exe
  2⤵
  PID:7316
- C:\Windows\System32\VkexlRD.exe
  C:\Windows\System32\VkexlRD.exe
  2⤵
  PID:7360
- C:\Windows\System32\xIBwmVz.exe
  C:\Windows\System32\xIBwmVz.exe
  2⤵
  PID:7404
- C:\Windows\System32\jEYAgdV.exe
  C:\Windows\System32\jEYAgdV.exe
  2⤵
  PID:7436
- C:\Windows\System32\jqdmJhC.exe
  C:\Windows\System32\jqdmJhC.exe
  2⤵
  PID:7472
- C:\Windows\System32\DITacnH.exe
  C:\Windows\System32\DITacnH.exe
  2⤵
  PID:7512
- C:\Windows\System32\rHJOTUP.exe
  C:\Windows\System32\rHJOTUP.exe
  2⤵
  PID:7536
- C:\Windows\System32\rNwofCB.exe
  C:\Windows\System32\rNwofCB.exe
  2⤵
  PID:7556
- C:\Windows\System32\JAMgPZN.exe
  C:\Windows\System32\JAMgPZN.exe
  2⤵
  PID:7592
- C:\Windows\System32\iUEEpGk.exe
  C:\Windows\System32\iUEEpGk.exe
  2⤵
  PID:7628
- C:\Windows\System32\pjoanwe.exe
  C:\Windows\System32\pjoanwe.exe
  2⤵
  PID:7664
- C:\Windows\System32\plAVSSB.exe
  C:\Windows\System32\plAVSSB.exe
  2⤵
  PID:7708
- C:\Windows\System32\dnSRtoK.exe
  C:\Windows\System32\dnSRtoK.exe
  2⤵
  PID:7736
- C:\Windows\System32\DzRPXtU.exe
  C:\Windows\System32\DzRPXtU.exe
  2⤵
  PID:7768
- C:\Windows\System32\fiFdabh.exe
  C:\Windows\System32\fiFdabh.exe
  2⤵
  PID:7796
- C:\Windows\System32\cjTQIif.exe
  C:\Windows\System32\cjTQIif.exe
  2⤵
  PID:7828
- C:\Windows\System32\KlBIgtg.exe
  C:\Windows\System32\KlBIgtg.exe
  2⤵
  PID:7864
- C:\Windows\System32\ViMizJM.exe
  C:\Windows\System32\ViMizJM.exe
  2⤵
  PID:7888
- C:\Windows\System32\sGSMqEt.exe
  C:\Windows\System32\sGSMqEt.exe
  2⤵
  PID:7904
- C:\Windows\System32\ivWJPDF.exe
  C:\Windows\System32\ivWJPDF.exe
  2⤵
  PID:7944
- C:\Windows\System32\dOHhfgB.exe
  C:\Windows\System32\dOHhfgB.exe
  2⤵
  PID:7976
- C:\Windows\System32\yNApcsL.exe
  C:\Windows\System32\yNApcsL.exe
  2⤵
  PID:8012
- C:\Windows\System32\FWaHZYw.exe
  C:\Windows\System32\FWaHZYw.exe
  2⤵
  PID:8032
- C:\Windows\System32\IWtuDnx.exe
  C:\Windows\System32\IWtuDnx.exe
  2⤵
  PID:8060
- C:\Windows\System32\HlDGRXi.exe
  C:\Windows\System32\HlDGRXi.exe
  2⤵
  PID:8088
- C:\Windows\System32\tGvcKgb.exe
  C:\Windows\System32\tGvcKgb.exe
  2⤵
  PID:8124
- C:\Windows\System32\RQOxFdi.exe
  C:\Windows\System32\RQOxFdi.exe
  2⤵
  PID:8168
- C:\Windows\System32\MKxabBh.exe
  C:\Windows\System32\MKxabBh.exe
  2⤵
  PID:4532
- C:\Windows\System32\MJTNyIz.exe
  C:\Windows\System32\MJTNyIz.exe
  2⤵
  PID:7224
- C:\Windows\System32\ICyzeDq.exe
  C:\Windows\System32\ICyzeDq.exe
  2⤵
  PID:7300
- C:\Windows\System32\GErdAQX.exe
  C:\Windows\System32\GErdAQX.exe
  2⤵
  PID:7432
- C:\Windows\System32\uhtvPen.exe
  C:\Windows\System32\uhtvPen.exe
  2⤵
  PID:3956
- C:\Windows\System32\CKYKnzY.exe
  C:\Windows\System32\CKYKnzY.exe
  2⤵
  PID:7484
- C:\Windows\System32\YfqqCTW.exe
  C:\Windows\System32\YfqqCTW.exe
  2⤵
  PID:7036
- C:\Windows\System32\xBNRJwX.exe
  C:\Windows\System32\xBNRJwX.exe
  2⤵
  PID:7580
- C:\Windows\System32\BMAJrVj.exe
  C:\Windows\System32\BMAJrVj.exe
  2⤵
  PID:7640
- C:\Windows\System32\YdBilnN.exe
  C:\Windows\System32\YdBilnN.exe
  2⤵
  PID:7728
- C:\Windows\System32\cSPTMSz.exe
  C:\Windows\System32\cSPTMSz.exe
  2⤵
  PID:7816
- C:\Windows\System32\DzzYyYF.exe
  C:\Windows\System32\DzzYyYF.exe
  2⤵
  PID:7880
- C:\Windows\System32\wERBXsk.exe
  C:\Windows\System32\wERBXsk.exe
  2⤵
  PID:7956
- C:\Windows\System32\cbzcuZB.exe
  C:\Windows\System32\cbzcuZB.exe
  2⤵
  PID:8024
- C:\Windows\System32\UKlkSja.exe
  C:\Windows\System32\UKlkSja.exe
  2⤵
  PID:8084
- C:\Windows\System32\TmlSyrK.exe
  C:\Windows\System32\TmlSyrK.exe
  2⤵
  PID:8176
- C:\Windows\System32\YwgXnlp.exe
  C:\Windows\System32\YwgXnlp.exe
  2⤵
  PID:7176
- C:\Windows\System32\CFpVpWb.exe
  C:\Windows\System32\CFpVpWb.exe
  2⤵
  PID:7460
- C:\Windows\System32\DShbszg.exe
  C:\Windows\System32\DShbszg.exe
  2⤵
  PID:872
- C:\Windows\System32\XdYFseG.exe
  C:\Windows\System32\XdYFseG.exe
  2⤵
  PID:7624
- C:\Windows\System32\lBqZUVt.exe
  C:\Windows\System32\lBqZUVt.exe
  2⤵
  PID:7788
- C:\Windows\System32\cTUfRqA.exe
  C:\Windows\System32\cTUfRqA.exe
  2⤵
  PID:8020
- C:\Windows\System32\ubOKLil.exe
  C:\Windows\System32\ubOKLil.exe
  2⤵
  PID:6832
- C:\Windows\System32\XULhGjq.exe
  C:\Windows\System32\XULhGjq.exe
  2⤵
  PID:7392
- C:\Windows\System32\AqRvrej.exe
  C:\Windows\System32\AqRvrej.exe
  2⤵
  PID:7732
- C:\Windows\System32\ibnBRGW.exe
  C:\Windows\System32\ibnBRGW.exe
  2⤵
  PID:8148
- C:\Windows\System32\ImPCaOt.exe
  C:\Windows\System32\ImPCaOt.exe
  2⤵
  PID:8008
- C:\Windows\System32\QRuSDkJ.exe
  C:\Windows\System32\QRuSDkJ.exe
  2⤵
  PID:7720
- C:\Windows\System32\sqnIyfv.exe
  C:\Windows\System32\sqnIyfv.exe
  2⤵
  PID:8212
- C:\Windows\System32\hIsutvg.exe
  C:\Windows\System32\hIsutvg.exe
  2⤵
  PID:8228
- C:\Windows\System32\ZiRcbee.exe
  C:\Windows\System32\ZiRcbee.exe
  2⤵
  PID:8256
- C:\Windows\System32\BfaJotv.exe
  C:\Windows\System32\BfaJotv.exe
  2⤵
  PID:8296
- C:\Windows\System32\xYnFLIX.exe
  C:\Windows\System32\xYnFLIX.exe
  2⤵
  PID:8340
- C:\Windows\System32\PINRjRU.exe
  C:\Windows\System32\PINRjRU.exe
  2⤵
  PID:8392
- C:\Windows\System32\mEnxcBC.exe
  C:\Windows\System32\mEnxcBC.exe
  2⤵
  PID:8424
- C:\Windows\System32\MQgNLmX.exe
  C:\Windows\System32\MQgNLmX.exe
  2⤵
  PID:8452
- C:\Windows\System32\DiSrGuM.exe
  C:\Windows\System32\DiSrGuM.exe
  2⤵
  PID:8468
- C:\Windows\System32\HEvWwCh.exe
  C:\Windows\System32\HEvWwCh.exe
  2⤵
  PID:8508
- C:\Windows\System32\tDmAohg.exe
  C:\Windows\System32\tDmAohg.exe
  2⤵
  PID:8536
- C:\Windows\System32\MDgvepX.exe
  C:\Windows\System32\MDgvepX.exe
  2⤵
  PID:8564
- C:\Windows\System32\njthyBK.exe
  C:\Windows\System32\njthyBK.exe
  2⤵
  PID:8592
- C:\Windows\System32\MDqVMIL.exe
  C:\Windows\System32\MDqVMIL.exe
  2⤵
  PID:8620
- C:\Windows\System32\davWfUb.exe
  C:\Windows\System32\davWfUb.exe
  2⤵
  PID:8648
- C:\Windows\System32\gGGqsSZ.exe
  C:\Windows\System32\gGGqsSZ.exe
  2⤵
  PID:8676
- C:\Windows\System32\hVfAtXR.exe
  C:\Windows\System32\hVfAtXR.exe
  2⤵
  PID:8704
- C:\Windows\System32\IbknWVA.exe
  C:\Windows\System32\IbknWVA.exe
  2⤵
  PID:8736
- C:\Windows\System32\vDYgYLV.exe
  C:\Windows\System32\vDYgYLV.exe
  2⤵
  PID:8764
- C:\Windows\System32\xGOTuqc.exe
  C:\Windows\System32\xGOTuqc.exe
  2⤵
  PID:8800
- C:\Windows\System32\rXNRUyH.exe
  C:\Windows\System32\rXNRUyH.exe
  2⤵
  PID:8840
- C:\Windows\System32\nJlIqFd.exe
  C:\Windows\System32\nJlIqFd.exe
  2⤵
  PID:8856
- C:\Windows\System32\RGhLgIg.exe
  C:\Windows\System32\RGhLgIg.exe
  2⤵
  PID:8884
- C:\Windows\System32\wnhKcgJ.exe
  C:\Windows\System32\wnhKcgJ.exe
  2⤵
  PID:8912
- C:\Windows\System32\vyMyWyK.exe
  C:\Windows\System32\vyMyWyK.exe
  2⤵
  PID:8940
- C:\Windows\System32\mNDDuXx.exe
  C:\Windows\System32\mNDDuXx.exe
  2⤵
  PID:8968
- C:\Windows\System32\uVxxnHn.exe
  C:\Windows\System32\uVxxnHn.exe
  2⤵
  PID:8996
- C:\Windows\System32\XvKdioe.exe
  C:\Windows\System32\XvKdioe.exe
  2⤵
  PID:9024
- C:\Windows\System32\zVkmYxR.exe
  C:\Windows\System32\zVkmYxR.exe
  2⤵
  PID:9052
- C:\Windows\System32\uukLqgr.exe
  C:\Windows\System32\uukLqgr.exe
  2⤵
  PID:9080
- C:\Windows\System32\vzsmTbD.exe
  C:\Windows\System32\vzsmTbD.exe
  2⤵
  PID:9108
- C:\Windows\System32\EOmPYFl.exe
  C:\Windows\System32\EOmPYFl.exe
  2⤵
  PID:9136
- C:\Windows\System32\XluRAhd.exe
  C:\Windows\System32\XluRAhd.exe
  2⤵
  PID:9164
- C:\Windows\System32\qypnkWz.exe
  C:\Windows\System32\qypnkWz.exe
  2⤵
  PID:9192
- C:\Windows\System32\iAbidLp.exe
  C:\Windows\System32\iAbidLp.exe
  2⤵
  PID:6804
- C:\Windows\System32\CVVYNfj.exe
  C:\Windows\System32\CVVYNfj.exe
  2⤵
  PID:8248
- C:\Windows\System32\rohGGcS.exe
  C:\Windows\System32\rohGGcS.exe
  2⤵
  PID:8336
- C:\Windows\System32\ocFmGur.exe
  C:\Windows\System32\ocFmGur.exe
  2⤵
  PID:8420
- C:\Windows\System32\UERuiIp.exe
  C:\Windows\System32\UERuiIp.exe
  2⤵
  PID:8480
- C:\Windows\System32\KLmACFv.exe
  C:\Windows\System32\KLmACFv.exe
  2⤵
  PID:8528
- C:\Windows\System32\oAZpZCu.exe
  C:\Windows\System32\oAZpZCu.exe
  2⤵
  PID:8588
- C:\Windows\System32\BKeJsLm.exe
  C:\Windows\System32\BKeJsLm.exe
  2⤵
  PID:8660
- C:\Windows\System32\OYnHBVg.exe
  C:\Windows\System32\OYnHBVg.exe
  2⤵
  PID:8760
- C:\Windows\System32\JlsxTmc.exe
  C:\Windows\System32\JlsxTmc.exe
  2⤵
  PID:8836
- C:\Windows\System32\AQeAgfG.exe
  C:\Windows\System32\AQeAgfG.exe
  2⤵
  PID:8896
- C:\Windows\System32\xhgkpfC.exe
  C:\Windows\System32\xhgkpfC.exe
  2⤵
  PID:9048
- C:\Windows\System32\lGwqrpB.exe
  C:\Windows\System32\lGwqrpB.exe
  2⤵
  PID:9148
- C:\Windows\System32\SNHzkeb.exe
  C:\Windows\System32\SNHzkeb.exe
  2⤵
  PID:8224
- C:\Windows\System32\KTntgCt.exe
  C:\Windows\System32\KTntgCt.exe
  2⤵
  PID:8500
- C:\Windows\System32\cqfVTKe.exe
  C:\Windows\System32\cqfVTKe.exe
  2⤵
  PID:8644
- C:\Windows\System32\OwUnXdH.exe
  C:\Windows\System32\OwUnXdH.exe
  2⤵
  PID:8992
- C:\Windows\System32\nXMKSUj.exe
  C:\Windows\System32\nXMKSUj.exe
  2⤵
  PID:8288
- C:\Windows\System32\WdUrRxH.exe
  C:\Windows\System32\WdUrRxH.exe
  2⤵
  PID:9176
- C:\Windows\System32\qHdyiJU.exe
  C:\Windows\System32\qHdyiJU.exe
  2⤵
  PID:9264
- C:\Windows\System32\pttUkHR.exe
  C:\Windows\System32\pttUkHR.exe
  2⤵
  PID:9284
- C:\Windows\System32\XrRQqtz.exe
  C:\Windows\System32\XrRQqtz.exe
  2⤵
  PID:9312
- C:\Windows\System32\fqhFLBX.exe
  C:\Windows\System32\fqhFLBX.exe
  2⤵
  PID:9340
- C:\Windows\System32\oRcQLHc.exe
  C:\Windows\System32\oRcQLHc.exe
  2⤵
  PID:9368
- C:\Windows\System32\xCVKvaa.exe
  C:\Windows\System32\xCVKvaa.exe
  2⤵
  PID:9400
- C:\Windows\System32\vhynIpc.exe
  C:\Windows\System32\vhynIpc.exe
  2⤵
  PID:9440
- C:\Windows\System32\HhcmouQ.exe
  C:\Windows\System32\HhcmouQ.exe
  2⤵
  PID:9476
- C:\Windows\System32\vVHORKY.exe
  C:\Windows\System32\vVHORKY.exe
  2⤵
  PID:9508
- C:\Windows\System32\jKcRZRU.exe
  C:\Windows\System32\jKcRZRU.exe
  2⤵
  PID:9528
- C:\Windows\System32\TItyLNR.exe
  C:\Windows\System32\TItyLNR.exe
  2⤵
  PID:9556
- C:\Windows\System32\YkVbxev.exe
  C:\Windows\System32\YkVbxev.exe
  2⤵
  PID:9604
- C:\Windows\System32\lsdsSDq.exe
  C:\Windows\System32\lsdsSDq.exe
  2⤵
  PID:9620
- C:\Windows\System32\xDxWzIA.exe
  C:\Windows\System32\xDxWzIA.exe
  2⤵
  PID:9648
- C:\Windows\System32\VafKNei.exe
  C:\Windows\System32\VafKNei.exe
  2⤵
  PID:9676
- C:\Windows\System32\UZWGTPg.exe
  C:\Windows\System32\UZWGTPg.exe
  2⤵
  PID:9700
- C:\Windows\System32\RgkcSRR.exe
  C:\Windows\System32\RgkcSRR.exe
  2⤵
  PID:9728
- C:\Windows\System32\WfxNCDf.exe
  C:\Windows\System32\WfxNCDf.exe
  2⤵
  PID:9748
- C:\Windows\System32\iMUiwFs.exe
  C:\Windows\System32\iMUiwFs.exe
  2⤵
  PID:9788
- C:\Windows\System32\onRjMZO.exe
  C:\Windows\System32\onRjMZO.exe
  2⤵
  PID:9816
- C:\Windows\System32\xivMmFW.exe
  C:\Windows\System32\xivMmFW.exe
  2⤵
  PID:9844
- C:\Windows\System32\BFzuvFM.exe
  C:\Windows\System32\BFzuvFM.exe
  2⤵
  PID:9872
- C:\Windows\System32\pXrIPkg.exe
  C:\Windows\System32\pXrIPkg.exe
  2⤵
  PID:9900
- C:\Windows\System32\gwHKVdr.exe
  C:\Windows\System32\gwHKVdr.exe
  2⤵
  PID:9928
- C:\Windows\System32\OGgLevz.exe
  C:\Windows\System32\OGgLevz.exe
  2⤵
  PID:9956
- C:\Windows\System32\twywEag.exe
  C:\Windows\System32\twywEag.exe
  2⤵
  PID:9984
- C:\Windows\System32\zvKIAbi.exe
  C:\Windows\System32\zvKIAbi.exe
  2⤵
  PID:10012
- C:\Windows\System32\QgJtoBn.exe
  C:\Windows\System32\QgJtoBn.exe
  2⤵
  PID:10044
- C:\Windows\System32\lnMYZzV.exe
  C:\Windows\System32\lnMYZzV.exe
  2⤵
  PID:10072
- C:\Windows\System32\tYuyWFO.exe
  C:\Windows\System32\tYuyWFO.exe
  2⤵
  PID:10100
- C:\Windows\System32\RpeNjVo.exe
  C:\Windows\System32\RpeNjVo.exe
  2⤵
  PID:10120
- C:\Windows\System32\iyIxPSx.exe
  C:\Windows\System32\iyIxPSx.exe
  2⤵
  PID:10144
- C:\Windows\System32\AMKyCqU.exe
  C:\Windows\System32\AMKyCqU.exe
  2⤵
  PID:10184
- C:\Windows\System32\ltJgTVe.exe
  C:\Windows\System32\ltJgTVe.exe
  2⤵
  PID:10204
- C:\Windows\System32\uiHWtVN.exe
  C:\Windows\System32\uiHWtVN.exe
  2⤵
  PID:9224
- C:\Windows\System32\JVEQhhP.exe
  C:\Windows\System32\JVEQhhP.exe
  2⤵
  PID:9280
- C:\Windows\System32\NOBLtuc.exe
  C:\Windows\System32\NOBLtuc.exe
  2⤵
  PID:9352
- C:\Windows\System32\HaJfCOx.exe
  C:\Windows\System32\HaJfCOx.exe
  2⤵
  PID:9424
- C:\Windows\System32\AYtPLXB.exe
  C:\Windows\System32\AYtPLXB.exe
  2⤵
  PID:9516
- C:\Windows\System32\EaffBnH.exe
  C:\Windows\System32\EaffBnH.exe
  2⤵
  PID:9552
- C:\Windows\System32\XzSvvQw.exe
  C:\Windows\System32\XzSvvQw.exe
  2⤵
  PID:9636
- C:\Windows\System32\qhvkCwd.exe
  C:\Windows\System32\qhvkCwd.exe
  2⤵
  PID:9716
- C:\Windows\System32\cTMuhlh.exe
  C:\Windows\System32\cTMuhlh.exe
  2⤵
  PID:9760
- C:\Windows\System32\FkPudJW.exe
  C:\Windows\System32\FkPudJW.exe
  2⤵
  PID:9840
- C:\Windows\System32\vSBdzvJ.exe
  C:\Windows\System32\vSBdzvJ.exe
  2⤵
  PID:9912
- C:\Windows\System32\zURMjSv.exe
  C:\Windows\System32\zURMjSv.exe
  2⤵
  PID:9976
- C:\Windows\System32\ayfUXLZ.exe
  C:\Windows\System32\ayfUXLZ.exe
  2⤵
  PID:10040
- C:\Windows\System32\boyeTzi.exe
  C:\Windows\System32\boyeTzi.exe
  2⤵
  PID:10112
- C:\Windows\System32\jUmSULe.exe
  C:\Windows\System32\jUmSULe.exe
  2⤵
  PID:10136
- C:\Windows\System32\FfjryPu.exe
  C:\Windows\System32\FfjryPu.exe
  2⤵
  PID:10228
- C:\Windows\System32\ljXiJOj.exe
  C:\Windows\System32\ljXiJOj.exe
  2⤵
  PID:9396
- C:\Windows\System32\oLmjTvr.exe
  C:\Windows\System32\oLmjTvr.exe
  2⤵
  PID:9548
- C:\Windows\System32\CarSylB.exe
  C:\Windows\System32\CarSylB.exe
  2⤵
  PID:9712
- C:\Windows\System32\uuijegb.exe
  C:\Windows\System32\uuijegb.exe
  2⤵
  PID:9864
- C:\Windows\System32\sReHSie.exe
  C:\Windows\System32\sReHSie.exe
  2⤵
  PID:10024
- C:\Windows\System32\LOJSvFp.exe
  C:\Windows\System32\LOJSvFp.exe
  2⤵
  PID:10168
- C:\Windows\System32\EattQya.exe
  C:\Windows\System32\EattQya.exe
  2⤵
  PID:9460
- C:\Windows\System32\ViBrwHd.exe
  C:\Windows\System32\ViBrwHd.exe
  2⤵
  PID:9952
- C:\Windows\System32\oliNZjM.exe
  C:\Windows\System32\oliNZjM.exe
  2⤵
  PID:10156
- C:\Windows\System32\DLdKNVE.exe
  C:\Windows\System32\DLdKNVE.exe
  2⤵
  PID:9968
- C:\Windows\System32\veLidYL.exe
  C:\Windows\System32\veLidYL.exe
  2⤵
  PID:4368
- C:\Windows\System32\BUltSSP.exe
  C:\Windows\System32\BUltSSP.exe
  2⤵
  PID:1420
- C:\Windows\System32\qkGWHXe.exe
  C:\Windows\System32\qkGWHXe.exe
  2⤵
  PID:10264
- C:\Windows\System32\xjJSupN.exe
  C:\Windows\System32\xjJSupN.exe
  2⤵
  PID:10292
- C:\Windows\System32\OnnpFwZ.exe
  C:\Windows\System32\OnnpFwZ.exe
  2⤵
  PID:10320
- C:\Windows\System32\LBUFIpX.exe
  C:\Windows\System32\LBUFIpX.exe
  2⤵
  PID:10348
- C:\Windows\System32\XbzaWMJ.exe
  C:\Windows\System32\XbzaWMJ.exe
  2⤵
  PID:10376
- C:\Windows\System32\wDXOGLK.exe
  C:\Windows\System32\wDXOGLK.exe
  2⤵
  PID:10404
- C:\Windows\System32\erbjnaa.exe
  C:\Windows\System32\erbjnaa.exe
  2⤵
  PID:10432
- C:\Windows\System32\EgdaVKy.exe
  C:\Windows\System32\EgdaVKy.exe
  2⤵
  PID:10472
- C:\Windows\System32\eKOZzhE.exe
  C:\Windows\System32\eKOZzhE.exe
  2⤵
  PID:10512
- C:\Windows\System32\mjxUHOd.exe
  C:\Windows\System32\mjxUHOd.exe
  2⤵
  PID:10552
- C:\Windows\System32\QGFSEjZ.exe
  C:\Windows\System32\QGFSEjZ.exe
  2⤵
  PID:10576
- C:\Windows\System32\yKlGZdh.exe
  C:\Windows\System32\yKlGZdh.exe
  2⤵
  PID:10604
- C:\Windows\System32\PRmkWCJ.exe
  C:\Windows\System32\PRmkWCJ.exe
  2⤵
  PID:10640
- C:\Windows\System32\zXmQcDu.exe
  C:\Windows\System32\zXmQcDu.exe
  2⤵
  PID:10660
- C:\Windows\System32\cJOzIuR.exe
  C:\Windows\System32\cJOzIuR.exe
  2⤵
  PID:10700
- C:\Windows\System32\jOtvibJ.exe
  C:\Windows\System32\jOtvibJ.exe
  2⤵
  PID:10724
- C:\Windows\System32\ganJjeL.exe
  C:\Windows\System32\ganJjeL.exe
  2⤵
  PID:10752
- C:\Windows\System32\wcOlWqd.exe
  C:\Windows\System32\wcOlWqd.exe
  2⤵
  PID:10768
- C:\Windows\System32\jmlRMYq.exe
  C:\Windows\System32\jmlRMYq.exe
  2⤵
  PID:10796
- C:\Windows\System32\dVPiEHc.exe
  C:\Windows\System32\dVPiEHc.exe
  2⤵
  PID:10820
- C:\Windows\System32\kFmufIy.exe
  C:\Windows\System32\kFmufIy.exe
  2⤵
  PID:10860
- C:\Windows\System32\PNnoyqe.exe
  C:\Windows\System32\PNnoyqe.exe
  2⤵
  PID:10884
- C:\Windows\System32\ZxCTgfE.exe
  C:\Windows\System32\ZxCTgfE.exe
  2⤵
  PID:10920
- C:\Windows\System32\HwPModU.exe
  C:\Windows\System32\HwPModU.exe
  2⤵
  PID:10948
- C:\Windows\System32\ZLtiIuT.exe
  C:\Windows\System32\ZLtiIuT.exe
  2⤵
  PID:10976
- C:\Windows\System32\hTPuIWw.exe
  C:\Windows\System32\hTPuIWw.exe
  2⤵
  PID:11004
- C:\Windows\System32\tzQLzXT.exe
  C:\Windows\System32\tzQLzXT.exe
  2⤵
  PID:11032
- C:\Windows\System32\Iaxvdrv.exe
  C:\Windows\System32\Iaxvdrv.exe
  2⤵
  PID:11060
- C:\Windows\System32\SurpKZr.exe
  C:\Windows\System32\SurpKZr.exe
  2⤵
  PID:11088
- C:\Windows\System32\fInHcGj.exe
  C:\Windows\System32\fInHcGj.exe
  2⤵
  PID:11116
- C:\Windows\System32\uTrPuDM.exe
  C:\Windows\System32\uTrPuDM.exe
  2⤵
  PID:11144
- C:\Windows\System32\McdELiG.exe
  C:\Windows\System32\McdELiG.exe
  2⤵
  PID:11172
- C:\Windows\System32\WtbQvTh.exe
  C:\Windows\System32\WtbQvTh.exe
  2⤵
  PID:11204
- C:\Windows\System32\tsUDOeu.exe
  C:\Windows\System32\tsUDOeu.exe
  2⤵
  PID:11232
- C:\Windows\System32\vJUMkvX.exe
  C:\Windows\System32\vJUMkvX.exe
  2⤵
  PID:11260
- C:\Windows\System32\kNMzNMR.exe
  C:\Windows\System32\kNMzNMR.exe
  2⤵
  PID:10276
- C:\Windows\System32\sYquFaY.exe
  C:\Windows\System32\sYquFaY.exe
  2⤵
  PID:10368
- C:\Windows\System32\RscnNfF.exe
  C:\Windows\System32\RscnNfF.exe
  2⤵
  PID:10428
- C:\Windows\System32\qSuYgUF.exe
  C:\Windows\System32\qSuYgUF.exe
  2⤵
  PID:10532
- C:\Windows\System32\IlNcccr.exe
  C:\Windows\System32\IlNcccr.exe
  2⤵
  PID:10596
- C:\Windows\System32\QxISwnF.exe
  C:\Windows\System32\QxISwnF.exe
  2⤵
  PID:10668
- C:\Windows\System32\VdheUZC.exe
  C:\Windows\System32\VdheUZC.exe
  2⤵
  PID:10708
- C:\Windows\System32\oifjjlR.exe
  C:\Windows\System32\oifjjlR.exe
  2⤵
  PID:10776
- C:\Windows\System32\EvKfGHk.exe
  C:\Windows\System32\EvKfGHk.exe
  2⤵
  PID:10856
- C:\Windows\System32\kPzcVCx.exe
  C:\Windows\System32\kPzcVCx.exe
  2⤵
  PID:10916
- C:\Windows\System32\dTgXHHV.exe
  C:\Windows\System32\dTgXHHV.exe
  2⤵
  PID:10996
- C:\Windows\System32\XvqBYHF.exe
  C:\Windows\System32\XvqBYHF.exe
  2⤵
  PID:11052
- C:\Windows\System32\FWdEHAA.exe
  C:\Windows\System32\FWdEHAA.exe
  2⤵
  PID:11112
- C:\Windows\System32\UUKqBZN.exe
  C:\Windows\System32\UUKqBZN.exe
  2⤵
  PID:1084
- C:\Windows\System32\zmNijGj.exe
  C:\Windows\System32\zmNijGj.exe
  2⤵
  PID:11224
- C:\Windows\System32\EvLVloo.exe
  C:\Windows\System32\EvLVloo.exe
  2⤵
  PID:10340
- C:\Windows\System32\qtVUrMB.exe
  C:\Windows\System32\qtVUrMB.exe
  2⤵
  PID:10504
- C:\Windows\System32\mypcwTi.exe
  C:\Windows\System32\mypcwTi.exe
  2⤵
  PID:10636
- C:\Windows\System32\WryHRLO.exe
  C:\Windows\System32\WryHRLO.exe
  2⤵
  PID:10764
- C:\Windows\System32\WHYbVma.exe
  C:\Windows\System32\WHYbVma.exe
  2⤵
  PID:3304
- C:\Windows\System32\tiaWnSl.exe
  C:\Windows\System32\tiaWnSl.exe
  2⤵
  PID:11100
- C:\Windows\System32\WqIxxUa.exe
  C:\Windows\System32\WqIxxUa.exe
  2⤵
  PID:11200
- C:\Windows\System32\zyygMbk.exe
  C:\Windows\System32\zyygMbk.exe
  2⤵
  PID:11252
- C:\Windows\System32\WmApqei.exe
  C:\Windows\System32\WmApqei.exe
  2⤵
  PID:1840
- C:\Windows\System32\XXSgJLD.exe
  C:\Windows\System32\XXSgJLD.exe
  2⤵
  PID:10688
- C:\Windows\System32\kzZWoFB.exe
  C:\Windows\System32\kzZWoFB.exe
  2⤵
  PID:4420
- C:\Windows\System32\zfHVXfw.exe
  C:\Windows\System32\zfHVXfw.exe
  2⤵
  PID:3140
- C:\Windows\System32\VeWxkJP.exe
  C:\Windows\System32\VeWxkJP.exe
  2⤵
  PID:11020
- C:\Windows\System32\gDXucEn.exe
  C:\Windows\System32\gDXucEn.exe
  2⤵
  PID:4352
- C:\Windows\System32\XmAkonm.exe
  C:\Windows\System32\XmAkonm.exe
  2⤵
  PID:11276
- C:\Windows\System32\ZkoUmNu.exe
  C:\Windows\System32\ZkoUmNu.exe
  2⤵
  PID:11304
- C:\Windows\System32\XyicLji.exe
  C:\Windows\System32\XyicLji.exe
  2⤵
  PID:11332
- C:\Windows\System32\bgHcdyP.exe
  C:\Windows\System32\bgHcdyP.exe
  2⤵
  PID:11360
- C:\Windows\System32\TlfzRbG.exe
  C:\Windows\System32\TlfzRbG.exe
  2⤵
  PID:11396
- C:\Windows\System32\jExoKzj.exe
  C:\Windows\System32\jExoKzj.exe
  2⤵
  PID:11424
- C:\Windows\System32\uyKKCXB.exe
  C:\Windows\System32\uyKKCXB.exe
  2⤵
  PID:11452
- C:\Windows\System32\cgWtuzq.exe
  C:\Windows\System32\cgWtuzq.exe
  2⤵
  PID:11472
- C:\Windows\System32\rbhJTit.exe
  C:\Windows\System32\rbhJTit.exe
  2⤵
  PID:11508
- C:\Windows\System32\WXflqnF.exe
  C:\Windows\System32\WXflqnF.exe
  2⤵
  PID:11536
- C:\Windows\System32\yMsdZfm.exe
  C:\Windows\System32\yMsdZfm.exe
  2⤵
  PID:11564
- C:\Windows\System32\LLtYhTX.exe
  C:\Windows\System32\LLtYhTX.exe
  2⤵
  PID:11592
- C:\Windows\System32\YPsOXLV.exe
  C:\Windows\System32\YPsOXLV.exe
  2⤵
  PID:11608
- C:\Windows\System32\xWeuoGm.exe
  C:\Windows\System32\xWeuoGm.exe
  2⤵
  PID:11648
- C:\Windows\System32\BKybnum.exe
  C:\Windows\System32\BKybnum.exe
  2⤵
  PID:11676
- C:\Windows\System32\BrUnTOu.exe
  C:\Windows\System32\BrUnTOu.exe
  2⤵
  PID:11704
- C:\Windows\System32\eVDBZDC.exe
  C:\Windows\System32\eVDBZDC.exe
  2⤵
  PID:11732
- C:\Windows\System32\FlLwfGJ.exe
  C:\Windows\System32\FlLwfGJ.exe
  2⤵
  PID:11760
- C:\Windows\System32\Cqsawne.exe
  C:\Windows\System32\Cqsawne.exe
  2⤵
  PID:11788
- C:\Windows\System32\jcBITVE.exe
  C:\Windows\System32\jcBITVE.exe
  2⤵
  PID:11816
- C:\Windows\System32\PtVhNHi.exe
  C:\Windows\System32\PtVhNHi.exe
  2⤵
  PID:11832
- C:\Windows\System32\JGlapwP.exe
  C:\Windows\System32\JGlapwP.exe
  2⤵
  PID:11864
- C:\Windows\System32\NTVKTGU.exe
  C:\Windows\System32\NTVKTGU.exe
  2⤵
  PID:11900
- C:\Windows\System32\dhctDqU.exe
  C:\Windows\System32\dhctDqU.exe
  2⤵
  PID:11920
- C:\Windows\System32\MQfJKpI.exe
  C:\Windows\System32\MQfJKpI.exe
  2⤵
  PID:11956
- C:\Windows\System32\XQpVVuM.exe
  C:\Windows\System32\XQpVVuM.exe
  2⤵
  PID:11976
- C:\Windows\System32\QeSrNLj.exe
  C:\Windows\System32\QeSrNLj.exe
  2⤵
  PID:12012
- C:\Windows\System32\GoITSKI.exe
  C:\Windows\System32\GoITSKI.exe
  2⤵
  PID:12040
- C:\Windows\System32\CEtqHHk.exe
  C:\Windows\System32\CEtqHHk.exe
  2⤵
  PID:12068
- C:\Windows\System32\AUJOkJE.exe
  C:\Windows\System32\AUJOkJE.exe
  2⤵
  PID:12096
- C:\Windows\System32\RzeGqpI.exe
  C:\Windows\System32\RzeGqpI.exe
  2⤵
  PID:12128
- C:\Windows\System32\zxqVaUy.exe
  C:\Windows\System32\zxqVaUy.exe
  2⤵
  PID:12148
- C:\Windows\System32\nQLZdXI.exe
  C:\Windows\System32\nQLZdXI.exe
  2⤵
  PID:12184
- C:\Windows\System32\RsCsTGX.exe
  C:\Windows\System32\RsCsTGX.exe
  2⤵
  PID:12204
- C:\Windows\System32\uZQINVx.exe
  C:\Windows\System32\uZQINVx.exe
  2⤵
  PID:12240
- C:\Windows\System32\VoDSFuO.exe
  C:\Windows\System32\VoDSFuO.exe
  2⤵
  PID:12268
- C:\Windows\System32\QzWlIrz.exe
  C:\Windows\System32\QzWlIrz.exe
  2⤵
  PID:11272
- C:\Windows\System32\LnUgNuE.exe
  C:\Windows\System32\LnUgNuE.exe
  2⤵
  PID:11324
- C:\Windows\System32\aXnmdUD.exe
  C:\Windows\System32\aXnmdUD.exe
  2⤵
  PID:11408
- C:\Windows\System32\mmcEAvp.exe
  C:\Windows\System32\mmcEAvp.exe
  2⤵
  PID:11468
- C:\Windows\System32\KrXuyWL.exe
  C:\Windows\System32\KrXuyWL.exe
  2⤵
  PID:11532
- C:\Windows\System32\DtcBGQo.exe
  C:\Windows\System32\DtcBGQo.exe
  2⤵
  PID:11588
- C:\Windows\System32\bcVJaRO.exe
  C:\Windows\System32\bcVJaRO.exe
  2⤵
  PID:11644
- C:\Windows\System32\gtkPbdh.exe
  C:\Windows\System32\gtkPbdh.exe
  2⤵
  PID:11700
- C:\Windows\System32\RRwCfbE.exe
  C:\Windows\System32\RRwCfbE.exe
  2⤵
  PID:11772
- C:\Windows\System32\gSgBVnq.exe
  C:\Windows\System32\gSgBVnq.exe
  2⤵
  PID:11828
- C:\Windows\System32\OUmxtwr.exe
  C:\Windows\System32\OUmxtwr.exe
  2⤵
  PID:11896
- C:\Windows\System32\sSyvCzh.exe
  C:\Windows\System32\sSyvCzh.exe
  2⤵
  PID:12000
- C:\Windows\System32\ZdowEyW.exe
  C:\Windows\System32\ZdowEyW.exe
  2⤵
  PID:12116
- C:\Windows\System32\gShsmdW.exe
  C:\Windows\System32\gShsmdW.exe
  2⤵
  PID:12168
- C:\Windows\System32\VYHcNlX.exe
  C:\Windows\System32\VYHcNlX.exe
  2⤵
  PID:12264
- C:\Windows\System32\hMDHxvt.exe
  C:\Windows\System32\hMDHxvt.exe
  2⤵
  PID:11356
- C:\Windows\System32\LXRQlsY.exe
  C:\Windows\System32\LXRQlsY.exe
  2⤵
  PID:11492
- C:\Windows\System32\IahEgNW.exe
  C:\Windows\System32\IahEgNW.exe
  2⤵
  PID:12080
- C:\Windows\System32\prpxQgV.exe
  C:\Windows\System32\prpxQgV.exe
  2⤵
  PID:12260
- C:\Windows\System32\KJUcShu.exe
  C:\Windows\System32\KJUcShu.exe
  2⤵
  PID:12024
- C:\Windows\System32\muWslQj.exe
  C:\Windows\System32\muWslQj.exe
  2⤵
  PID:11328
- C:\Windows\System32\vhwgNKC.exe
  C:\Windows\System32\vhwgNKC.exe
  2⤵
  PID:12192
- C:\Windows\System32\CMFpWxi.exe
  C:\Windows\System32\CMFpWxi.exe
  2⤵
  PID:12308
- C:\Windows\System32\MnGjLde.exe
  C:\Windows\System32\MnGjLde.exe
  2⤵
  PID:12344
- C:\Windows\System32\IgTmivR.exe
  C:\Windows\System32\IgTmivR.exe
  2⤵
  PID:12372
- C:\Windows\System32\WPwdODG.exe
  C:\Windows\System32\WPwdODG.exe
  2⤵
  PID:12388
- C:\Windows\System32\xhhhHhs.exe
  C:\Windows\System32\xhhhHhs.exe
  2⤵
  PID:12428
- C:\Windows\System32\TPuDVKj.exe
  C:\Windows\System32\TPuDVKj.exe
  2⤵
  PID:12456
- C:\Windows\System32\qfiTyyA.exe
  C:\Windows\System32\qfiTyyA.exe
  2⤵
  PID:12484
- C:\Windows\System32\NvBJtNT.exe
  C:\Windows\System32\NvBJtNT.exe
  2⤵
  PID:12528
- C:\Windows\System32\UqfmXzm.exe
  C:\Windows\System32\UqfmXzm.exe
  2⤵
  PID:12544
- C:\Windows\System32\pUCITZh.exe
  C:\Windows\System32\pUCITZh.exe
  2⤵
  PID:12568
- C:\Windows\System32\ZtUDXTy.exe
  C:\Windows\System32\ZtUDXTy.exe
  2⤵
  PID:12600
- C:\Windows\System32\dKeviih.exe
  C:\Windows\System32\dKeviih.exe
  2⤵
  PID:12616
- C:\Windows\System32\qgtTzau.exe
  C:\Windows\System32\qgtTzau.exe
  2⤵
  PID:12640
- C:\Windows\System32\YSNfyYN.exe
  C:\Windows\System32\YSNfyYN.exe
  2⤵
  PID:12676
- C:\Windows\System32\zgHSrSE.exe
  C:\Windows\System32\zgHSrSE.exe
  2⤵
  PID:12712
- C:\Windows\System32\uZjJTrR.exe
  C:\Windows\System32\uZjJTrR.exe
  2⤵
  PID:12740
- C:\Windows\System32\tNZjdAu.exe
  C:\Windows\System32\tNZjdAu.exe
  2⤵
  PID:12768
- C:\Windows\System32\DTGiiAe.exe
  C:\Windows\System32\DTGiiAe.exe
  2⤵
  PID:12796
- C:\Windows\System32\xMATLkE.exe
  C:\Windows\System32\xMATLkE.exe
  2⤵
  PID:12824
- C:\Windows\System32\tRKJBrP.exe
  C:\Windows\System32\tRKJBrP.exe
  2⤵
  PID:12852
- C:\Windows\System32\pWKwCpR.exe
  C:\Windows\System32\pWKwCpR.exe
  2⤵
  PID:12872
- C:\Windows\System32\sCgeYhP.exe
  C:\Windows\System32\sCgeYhP.exe
  2⤵
  PID:12908
- C:\Windows\System32\KNzvEye.exe
  C:\Windows\System32\KNzvEye.exe
  2⤵
  PID:12936
- C:\Windows\System32\KVqaTVU.exe
  C:\Windows\System32\KVqaTVU.exe
  2⤵
  PID:12964
- C:\Windows\System32\JQwijTW.exe
  C:\Windows\System32\JQwijTW.exe
  2⤵
  PID:12992
- C:\Windows\System32\LWHUnNx.exe
  C:\Windows\System32\LWHUnNx.exe
  2⤵
  PID:13020
- C:\Windows\System32\HbOnxnP.exe
  C:\Windows\System32\HbOnxnP.exe
  2⤵
  PID:13048
- C:\Windows\System32\iLmacVG.exe
  C:\Windows\System32\iLmacVG.exe
  2⤵
  PID:13076
- C:\Windows\System32\bmkjTQB.exe
  C:\Windows\System32\bmkjTQB.exe
  2⤵
  PID:13104
- C:\Windows\System32\fVeoqLQ.exe
  C:\Windows\System32\fVeoqLQ.exe
  2⤵
  PID:13128
- C:\Windows\System32\iQIVQuG.exe
  C:\Windows\System32\iQIVQuG.exe
  2⤵
  PID:13164
- C:\Windows\System32\WEYmQrw.exe
  C:\Windows\System32\WEYmQrw.exe
  2⤵
  PID:13192
- C:\Windows\System32\ArdmLaW.exe
  C:\Windows\System32\ArdmLaW.exe
  2⤵
  PID:13220
- C:\Windows\System32\SzmMsHe.exe
  C:\Windows\System32\SzmMsHe.exe
  2⤵
  PID:13252
- C:\Windows\System32\ObGqHRA.exe
  C:\Windows\System32\ObGqHRA.exe
  2⤵
  PID:13280
- C:\Windows\System32\EASqtFb.exe
  C:\Windows\System32\EASqtFb.exe
  2⤵
  PID:13296
- C:\Windows\System32\uKhGkRi.exe
  C:\Windows\System32\uKhGkRi.exe
  2⤵
  PID:12296
- C:\Windows\System32\XZYlwCW.exe
  C:\Windows\System32\XZYlwCW.exe
  2⤵
  PID:12356
- C:\Windows\System32\WYTWTNh.exe
  C:\Windows\System32\WYTWTNh.exe
  2⤵
  PID:12472
- C:\Windows\System32\ZOKNnyM.exe
  C:\Windows\System32\ZOKNnyM.exe
  2⤵
  PID:700
- C:\Windows\System32\ZOeIVSL.exe
  C:\Windows\System32\ZOeIVSL.exe
  2⤵
  PID:756
- C:\Windows\System32\VItuNyN.exe
  C:\Windows\System32\VItuNyN.exe
  2⤵
  PID:12560
- C:\Windows\System32\TkcbNtZ.exe
  C:\Windows\System32\TkcbNtZ.exe
  2⤵
  PID:12584
- C:\Windows\System32\lfvBGTK.exe
  C:\Windows\System32\lfvBGTK.exe
  2⤵
  PID:12624
- C:\Windows\System32\FDPBdrj.exe
  C:\Windows\System32\FDPBdrj.exe
  2⤵
  PID:12732
- C:\Windows\System32\NhAsnuW.exe
  C:\Windows\System32\NhAsnuW.exe
  2⤵
  PID:12780
- C:\Windows\System32\vwdcBjD.exe
  C:\Windows\System32\vwdcBjD.exe
  2⤵
  PID:12840
- C:\Windows\System32\KQoSSOi.exe
  C:\Windows\System32\KQoSSOi.exe
  2⤵
  PID:12904
- C:\Windows\System32\uvEPrGy.exe
  C:\Windows\System32\uvEPrGy.exe
  2⤵
  PID:12956
- C:\Windows\System32\vomFcNX.exe
  C:\Windows\System32\vomFcNX.exe
  2⤵
  PID:13016
- C:\Windows\System32\XdjGVko.exe
  C:\Windows\System32\XdjGVko.exe
  2⤵
  PID:13088
- C:\Windows\System32\VNkJEWA.exe
  C:\Windows\System32\VNkJEWA.exe
  2⤵
  PID:13156
- C:\Windows\System32\DNZXaQC.exe
  C:\Windows\System32\DNZXaQC.exe
  2⤵
  PID:13200
- C:\Windows\System32\DstGoqV.exe
  C:\Windows\System32\DstGoqV.exe
  2⤵
  PID:13292
- C:\Windows\System32\NfdknUx.exe
  C:\Windows\System32\NfdknUx.exe
  2⤵
  PID:12328
- C:\Windows\System32\qxPBPBe.exe
  C:\Windows\System32\qxPBPBe.exe
  2⤵
  PID:316
- C:\Windows\System32\fsYpnfV.exe
  C:\Windows\System32\fsYpnfV.exe
  2⤵
  PID:12508
- C:\Windows\System32\ijQLboX.exe
  C:\Windows\System32\ijQLboX.exe
  2⤵
  PID:12704

C:\Windows\system32\BackgroundTaskHost.exe
"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
1⤵
PID:7036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AuSwmqK.exe

Path C:\Windows\System32\AuSwmqK.exe
Size 3.2MB
SHA256 52050555ac82ffe3215435df15279122f274ed7a4cd560c9b2250b1d3347af94
MD5 6dd9d8a520545e440910cfa5a8341eb3
SHA1 73ed8bc0ecd1978d52d45935a76c44e6e91e6a45
SHA512 de4821dbb1bcc7fb7030df768f47bdad8c983baf251570e178c06284a7b4e6048b8e11ad85dee70ecd383c9a9a1a81833de640f2e0e22c1149b7605a1c7f2649
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4i:wFWPClFS
MD5 SHA1 SHA512 SSDEEP

Submit Download

DJhrXnk.exe

Path C:\Windows\System32\DJhrXnk.exe
Size 3.2MB
SHA256 6cb93dfff9d9fe53f54544067f9dc310d20a56d73aaeadc97e009b006505edf6
MD5 2988939c3cfa02af71b3ec8d78c6ae6c
SHA1 ab365ffafa964adb5d3e4378cab2c62ad8222434
SHA512 76625c6e35e549c2698438d70cb983bbcde54f5737c12132f78c43ef593d5baf04b69d26b4b185bf1909a38d4559e3a33069b82d2c6bf32fd1d1aa95600260e8
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4l:wFWPClF1
MD5 SHA1 SHA512 SSDEEP

Submit Download

FctMHOA.exe

Path C:\Windows\System32\FctMHOA.exe
Size 3.2MB
SHA256 2a307cc8a9022bd982b2203aa29d8ed412d8bc2786c086aa8b9750a78ea68879
MD5 705f746604fb56c5415b5cf2a1703c3c
SHA1 8f7a91ca3f209431e4f43e29e48058020eb55bf1
SHA512 9c9bee64704462c9348226b035b0935fc272a7b02a04b8cdbd97760851a5c74bb3bfeebf546757678fd5e76b018e9f2cf7297173837945c3f09dd143b6c754a0
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4G:wFWPClFW
MD5 SHA1 SHA512 SSDEEP

Submit Download

FpNHNcr.exe

Path C:\Windows\System32\FpNHNcr.exe
Size 3.2MB
SHA256 39632765c535760fbb7be104cd4c949e671fceafdb4eb5dbbd34c37dd9cac792
MD5 da6918e6e7c53cc8c9ee5e355a5ee596
SHA1 9ecfbb041751958a79374fb925560e46f5e19421
SHA512 5f231fbddb1f61d1513ab4104d496ac71bd4307f2570aec0d13d6ebb4bf6872f0761ecc8f3be4b30119e17e15247710edc208ae9520c8b8fc2e8083d3bd16ac1
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4O:wFWPClF+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jahhfbt.exe

Path C:\Windows\System32\Jahhfbt.exe
Size 3.2MB
SHA256 671cb9b13b01cd2b9f7ea96328a2dd86ed50d12ac4f03f1671fcbba7e6243b50
MD5 352fb84ad371e60c8d80488f84769019
SHA1 d3dd580df153c5ade0892a6ed58e3514db254eb0
SHA512 2efb99257db7f61ac46ec89e3d4905866ececec3a88adb59554a6cc26d3133a58dd9a281f217179a60eaca3aae6018c3507b11dca7c2836f236a7431ba20a83a
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4h:wFWPClFx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kdcjjru.exe

Path C:\Windows\System32\Kdcjjru.exe
Size 3.2MB
SHA256 c2a3dd73611ee4aecf3a3b70b8bb87b4c30fc4c31833134e2446403721b1314f
MD5 fd85d16b1b5b9674543b34967068f5c2
SHA1 a066331bfb2557faf788e5a87302bd9168d8115c
SHA512 e92dc8f1dc730841ecfc4bc0d35451f80879239a3d90fce26ca053fc1b1de91bdbce50c72c47f6e51ec45700c5195c5403de44cfc913b31612deea24af19a9f2
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4j:wFWPClFT
MD5 SHA1 SHA512 SSDEEP

Submit Download

NzFFtQn.exe

Path C:\Windows\System32\NzFFtQn.exe
Size 3.2MB
SHA256 4f3209d0cde294a0cc06908529ff76242b9d028385c06516931501c79fea4c1c
MD5 3a61992ecea98049616547ee18cddb9e
SHA1 5b76bc81507be345168aad4a4c8297559bccdc85
SHA512 238b97517b4e3577757b4866ddb5972f13d204516e591a13ca881367655abe65a19966812eadbe61f38866be3ca45e497949c0fece062b7e2f36821cfe32f6b1
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4y:wFWPClFC
MD5 SHA1 SHA512 SSDEEP

Submit Download

PnKAuJJ.exe

Path C:\Windows\System32\PnKAuJJ.exe
Size 3.2MB
SHA256 9aeb0c9f8971616e4e40dd67c9c73c37589cd61f8f9bbb4abe3f99d911e465a2
MD5 55b83a2f83040d18a0fee7c08bf12026
SHA1 524ba0faa71e23cf13c10f72e7bdb3ada10806ac
SHA512 d741bfeb413ef21789f1125a105e2105aeb10d7be351f35696c78f981b08e24b0fc1e71f8f0c85ee0821c8eee67902f138a10a3903f7e4ce188fb3f2a4fa529c
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4J:wFWPClFZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

PuBTZzG.exe

Path C:\Windows\System32\PuBTZzG.exe
Size 3.2MB
SHA256 566de478ff97a85fa227744a86c715e01c6cf2674549007ff7236ed1a268d05c
MD5 d1a49a14996ee28bf6244d794585a026
SHA1 4f578bd36285aaf1a0b61dc0e5e8c4248934234a
SHA512 27cd28392fb8bfc8b0e294d6fa0b8fc2be94e309728876e0fcffaa3a366c07dfa72adecabb6fe8661cff38fad90e6aa0a2dfa3dbfbd3673f4cce8d1de58bd6ce
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4j:wFWPClFT
MD5 SHA1 SHA512 SSDEEP

Submit Download

RWXqTfw.exe

Path C:\Windows\System32\RWXqTfw.exe
Size 3.2MB
SHA256 cdd0f11106113d28a28a79d66240bc5ae8658556934ed22fb4aa0036716f2834
MD5 0c082b5603f54c15e32e9919210e3d3a
SHA1 108362f93e001835a0cfd2155f8a87d625307d65
SHA512 423545f0768ede3f5eb59026e16cb3864dfbc0107a9e1f4241d17e3f213238c42f67c7cb6b3c171a79bf277d4c86a7f77b67002c40aff5df55fe4fb3b2ba2c23
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4X:wFWPClFH
MD5 SHA1 SHA512 SSDEEP

Submit Download

SnPtJbN.exe

Path C:\Windows\System32\SnPtJbN.exe
Size 3.2MB
SHA256 b43f0cc7622cc18e995919141c640a9eaa4413859eaaaf6fab3f3479738470d1
MD5 0bd1ead002c5ecb65f22decddea3c2cd
SHA1 01dacc59fb860cf7a8d4c646921f254330b46c10
SHA512 cf4125b36ea002f456c15fbd73ca6f1ccc7812cacdbeb43720de8bade314c43341e4c7a9d4a809858bd4397d156f670a548b349390502461e1d51866f6ef4199
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4q:wFWPClFa
MD5 SHA1 SHA512 SSDEEP

Submit Download

TIOoOqM.exe

Path C:\Windows\System32\TIOoOqM.exe
Size 3.2MB
SHA256 ab487ee9bfb2dd0f023607b42d886074d6762663f917b53ae5756633177c0838
MD5 14dd90c7d246e07c403eee6e1f2ef51b
SHA1 9199195e9a5abffb27c09427964302b8e31e3a29
SHA512 0a8e110e1a2049bdee4d4a285622cad09b30d949011acfb64f97612b9ff1150fe4fe2f7daf6891003693181d2e534074148add2054077116f5d0d4c050aef313
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc45:wFWPClFp
MD5 SHA1 SHA512 SSDEEP

Submit Download

WCrkvzZ.exe

Path C:\Windows\System32\WCrkvzZ.exe
Size 3.2MB
SHA256 862c37bb453b5a0c4ef2d65e3d6045f8d15be547bd3a2f5e0b802d664201218a
MD5 aebf63bb6d6b501fae0ad80c50c764e8
SHA1 cb8dc8ca93c488753e839526fe667488241528c7
SHA512 296bd5378589b5a697d5e4a22155501aa0926785010ea49b66192eecf7ccc2d0ce7beb2aadfa56d6cfb381df8882ea341b377f328add0eca3a7d0aa230dc3298
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4H:wFWPClFX
MD5 SHA1 SHA512 SSDEEP

Submit Download

WJjtkNX.exe

Path C:\Windows\System32\WJjtkNX.exe
Size 3.2MB
SHA256 1309aa218a541ff4f455ca8471b765deebd1581ffaa645b65cd864a42ebd94f8
MD5 b8bd249f9176bf13c0daadcec969922e
SHA1 2e839a98df483e758f3e3ec9e1113caf651eca20
SHA512 18cf3c9c192133c84ceb6a81e417f621dd64314f4ecca4d07b47f7c28df5c6388c8ffb95d55ead1e22148a99c8642b72aa3e4087db414a0fb4e6ab66815122b8
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4w:wFWPClFg
MD5 SHA1 SHA512 SSDEEP

Submit Download

XnRvQvG.exe

Path C:\Windows\System32\XnRvQvG.exe
Size 3.2MB
SHA256 d1480b974226dedf1ce819c9f62649fb7928a329a09588c8d8f55d50c8d98e6f
MD5 ec0a7d66d2449693f4303c36872fcfab
SHA1 b4193806e7f9b52b9d3fdb82601ebca25e979ddb
SHA512 4c4c9b88b5fb66dd1c22630b18b08ab1be58d7e52a60aaf54708029a30af10dbd05778f361a051e616c55fc83c723bc363d6bfdb1d357cf64491061dd1c7a5d2
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4N:wFWPClFd
MD5 SHA1 SHA512 SSDEEP

Submit Download

XpzObxm.exe

Path C:\Windows\System32\XpzObxm.exe
Size 3.2MB
SHA256 3613908b28333f46dba97a4f265403d7d412c22990f5e7901db544e06843a54e
MD5 b0b2316f2b9464020b1eb23255e35651
SHA1 6215bdec9ff6326216f7fada7140b8c0a7a59299
SHA512 8cb0da09e2a0bd14369c29166ae9d15f3a38ce4360ab14b7dea1ef5e05d8fa225bc591c21f437d3ac35ab8161f2775a41ff69a197410292e30c575af63524947
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4p:wFWPClF5
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZQYFrWo.exe

Path C:\Windows\System32\ZQYFrWo.exe
Size 3.2MB
SHA256 9f0fb83251e97658c4b66e788cf859a0eec561513d46a52bffda8fd300d37ebb
MD5 4e14f69cd4c7b76ebaf86d405d11e8f2
SHA1 fbe840fd17de679b20b02c43a32c52fa93b3f6f6
SHA512 d914cdddb309b42c5f4f6ec821abbccf462149464afa87c8a10a19baf2fc1c3c9849d6be3f6d55b622e8d2cb8022437b8d037cc709a7c7a4c2833685ed4f7619
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4A:wFWPClFQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZUvOQHL.exe

Path C:\Windows\System32\ZUvOQHL.exe
Size 3.2MB
SHA256 69acea5bc436d4394b46bed101a42dc8faa1a1f882eab6c69c2c0ccfee65691a
MD5 2a019c23e495be710aff18864eaefe65
SHA1 e7ab9091ad5d45137a0349c68379b088303eba83
SHA512 5e1375176f39fb44dd090b8edb121584d526cba70b9608b0774e96e2085fe9b0cd53e0f5b3104b67b3ec37ab19ec84a1b26858ea73a7e5ba143b78728f8567bd
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4q:wFWPClFa
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZnQUXTe.exe

Path C:\Windows\System32\ZnQUXTe.exe
Size 3.2MB
SHA256 94bdfc7e0451eeb08c02b6e86cfabc049befe35d3d0827c648751077c1062dcd
MD5 8fbedc4f53059a9835bde29d76bf2640
SHA1 ef10f2b401f36db8bb7c8af4970c39454249bc6a
SHA512 ee924e40c92f27d727ce2809c545d35936b5dad9511eac18891370e31a25cc3eb356c8255fa1e5d09df960820a73c8389a110ba63654827f5934c587e440f3a2
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc41:wFWPClFF
MD5 SHA1 SHA512 SSDEEP

Submit Download

aaIeEDz.exe

Path C:\Windows\System32\aaIeEDz.exe
Size 3.2MB
SHA256 8592501d95ebe5a22eb444408f79d094a42d5b395ac1f2e7a2971f9243e870ff
MD5 21c83e1dfe4def65304e269a490afa7d
SHA1 b7d97826088454e63517b1c6e21ac24b8363bbe6
SHA512 ed9937778f548c5d5becd57e6af87fb654d6b5306b744241b0bfa18928bc6f9cd71f5ba6d3d7d48ec5a0da8ba863369f62e0a4ba7c0f69c183d3d382d4c42fc3
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4P:wFWPClF/
MD5 SHA1 SHA512 SSDEEP

Submit Download

brfVFPv.exe

Path C:\Windows\System32\brfVFPv.exe
Size 3.2MB
SHA256 1270357eee5cd768a320c3a925d8d63e41730be3252c0bfed4b4a3a1c9b90cbb
MD5 d69527f0dea58e72960077b2d35dcc21
SHA1 5d7ebb20e067bd4f174ff7ecb6d2bd3587a9932f
SHA512 536fb3f32b233492e4aee97737793c9fbcec4840ace5c5f56a22753372a7dbc4409ce41dfc4a56b381f3569169559b883671e0939f75e86baaeaeae5b8203a87
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc47:wFWPClFr
MD5 SHA1 SHA512 SSDEEP

Submit Download

fKnbzMT.exe

Path C:\Windows\System32\fKnbzMT.exe
Size 3.2MB
SHA256 bf251786068091359d576b9b5dda48952390a824d7098026a8b5b0aa194a8afc
MD5 6a676ca684f243a6689df661dae417a0
SHA1 02658ac9c6d30b51d22ab506b8a2428472568040
SHA512 f0ce53025946ea8feecd54b3c82e83d7c5496a3016bb39b7bc5bccb4f59bb2e31914584e3d485358139f623492b89e4811e64f43193c358eb979dca065a06a44
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4c:wFWPClFs
MD5 SHA1 SHA512 SSDEEP

Submit Download

iBFDSqT.exe

Path C:\Windows\System32\iBFDSqT.exe
Size 3.2MB
SHA256 1c525be07728df490d17db39d0c309b5973ce1d30e986d673da7746f15aa3c31
MD5 1ac590d9d7164e7382362adbeaa824f1
SHA1 f2bf4c92a86ba52bd0b4404b21f069ff75855bd5
SHA512 8181f5b32668ec6aba2d0438ddacf9834480db2e3cedc3b86b8074a33b1a11c4d5494f2a1d2b6b03c01cb296d5e13faceb9275881b661b5577c84ad79431bbbd
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc45:wFWPClFJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

iXKdACO.exe

Path C:\Windows\System32\iXKdACO.exe
Size 3.2MB
SHA256 2307695102df71fafbde95d519664a4133a4636628cb6ed517d44e0ce97dd21c
MD5 0a50c0b8029669e77f18c2b7ba9a73cf
SHA1 9db429685000ff4e90a02ac792f9d3094c783079
SHA512 c79b70301c95f36eb7088c7148fa41e26d049f6b1eae15c7054339da004a32613ec6edcd65d70ccc9636c1d7e95adb0740b4a90bbe3692c6273f91dc0fcffd20
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4G:wFWPClF2
MD5 SHA1 SHA512 SSDEEP

Submit Download

jXNrxHa.exe

Path C:\Windows\System32\jXNrxHa.exe
Size 3.2MB
SHA256 ccc576104c4cb0109b1d2f83fad4a854d3b182b608663afea721824ee2d01ad1
MD5 35aec466a5d99e4981d30e182335a800
SHA1 e5a6a23857ca167f59a8ffa918e732b50c517992
SHA512 e20a203a45f770f0c906919ce18ecfd1b06d9ab1b141d7a879719c8b95019b06b528ecf045493d6586c67786cb72915fb7274966f81c59199ff567d493c6748b
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4v:wFWPClF/
MD5 SHA1 SHA512 SSDEEP

Submit Download

lURZZyC.exe

Path C:\Windows\System32\lURZZyC.exe
Size 3.2MB
SHA256 b42a5460aeec56a4419d781456ccd47ebd4f212a39157feb6d14fbb4051f2364
MD5 8e6e36ac4b124659973b4347b348f768
SHA1 d2638739f8d3002781293288eb5a7abf8eb07495
SHA512 0eddc0921b00cd62523ebf63945ce68ab0bfa42c1f6f369b5bd2c1f4ea101280bbb82a49bc8eb95c88fea72b4f853736c0c4e9dc386c46aea8c470fcf23fa650
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4X:wFWPClFH
MD5 SHA1 SHA512 SSDEEP

Submit Download

rJvZarn.exe

Path C:\Windows\System32\rJvZarn.exe
Size 3.2MB
SHA256 27b548c01fed23e002985dd691c7dc398fa7044211b1fee97c27529e76bd6e24
MD5 0f4451a4eef704d498ae2ecbc422b457
SHA1 3986650d2ebe6ac78f2b56e2b3c69e8e044d21af
SHA512 8cdb8c6f60fd5fc9de1d18d50594fdc0c1cd7a262fe7c17121a43cfb37f7770f4e99ed2d2e014e992ecc92a3de0d614668973b49a70fa9307969b5f89e444633
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4F:wFWPClFV
MD5 SHA1 SHA512 SSDEEP

Submit Download

uCAZmSw.exe

Path C:\Windows\System32\uCAZmSw.exe
Size 3.2MB
SHA256 c7428f41a3afebd2d0b9836ac7660c6a59844b2821fc7a6e7af564016972a137
MD5 7f395f69e8982212fb536ff9d5529a8e
SHA1 302550ac0927deed4a928afcc308dfd4ccdb1266
SHA512 0264356fff412ebbc90ca122ef342233aa47004d7558ec91f706a1529a506b00560a62551aeebd618c24a03859158603bf8b8f1370fc7042c309e12e8b2149fc
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4P:wFWPClFf
MD5 SHA1 SHA512 SSDEEP

Submit Download

vaGlbwL.exe

Path C:\Windows\System32\vaGlbwL.exe
Size 3.2MB
SHA256 c244dc37349cad9509d4ea50b3c1cb433515003a7be937216f788328b75daf1d
MD5 28bb33d234d0997318d277fc4ea54992
SHA1 8f39ea71c95ce4f2043742f12f3369c2db326c11
SHA512 b202f97b94d4ccba4c340780c8136217a0aba54c1c1a496b9878f6725ebb0ed922874db0db6499b5f8be83b62e61a25c15dac8e8b2906ff4fc422ba9f6bc23db
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4a:wFWPClFq
MD5 SHA1 SHA512 SSDEEP

Submit Download

wpGPgXf.exe

Path C:\Windows\System32\wpGPgXf.exe
Size 3.2MB
SHA256 98f33605b75544efe753772bbba1c45e3e00f931b0bb9028424245f21ae2a783
MD5 eb36058ac7767174292e41f238c3b16d
SHA1 b2eb14b2387ab3596edf3d91795f6336fa90f82e
SHA512 a7c7a61083ebb14b672465c35422ca2beb8b7f6584de9ec3aa124068ad0fe4bfbb93a496d3fd7ba1a8fbfd0e8d129922867ede656faf5833bfb6959aac33eabc
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4T:wFWPClFD
MD5 SHA1 SHA512 SSDEEP

Submit Download

yLBKKQt.exe

Path C:\Windows\System32\yLBKKQt.exe
Size 3.2MB
SHA256 aea787cb54e11ee1ddbe026c7658906cf695bfc23eb828fd3dc20bcf69c6a60b
MD5 6e4d42bf61d707b96312cae2a7e70320
SHA1 35b2336b64764ef54f0dde437ee030892857d3bd
SHA512 ec18718827f5d926b339c93f31db2d8fa33cd6280a656a6ef81f904453b46b8a3c8d0d97b192782a82717e068f1cd1faff933dea494a51448a2c7b3a2de757dd
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4c:wFWPClFM
MD5 SHA1 SHA512 SSDEEP

Submit Download

zhCieTC.exe

Path C:\Windows\System32\zhCieTC.exe
Size 3.2MB
SHA256 218caaa88eb7e3c5ca50e3c6b1d0be88b16fd314fd09ac2643d1577d9eb373e2
MD5 01386848f5ab4a00582b2697d7a226a4
SHA1 dd9e562f577be3cbbdb69f6128965e8bae79cc1c
SHA512 4618d752fe3422917ed0eed5c0c68968c677af99a329d9c43084b9aec73a9b8db37ce5eeb83e00277e1a77380c3493a85c8fa79bcaf97bf129ce1cc9ee8251e8
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4t:wFWPClFd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/116-1-0x0000028285A10000-0x0000028285A20000-memory.dmp

Download

memory/116-0-0x00007FF6A6040000-0x00007FF6A6435000-memory.dmp

Download

memory/116-1456-0x00007FF6A6040000-0x00007FF6A6435000-memory.dmp

Download

memory/116-1901-0x00007FF6A6040000-0x00007FF6A6435000-memory.dmp

Download

memory/456-1899-0x00007FF6EF720000-0x00007FF6EFB15000-memory.dmp

Download

memory/456-93-0x00007FF6EF720000-0x00007FF6EFB15000-memory.dmp

Download

memory/456-1916-0x00007FF6EF720000-0x00007FF6EFB15000-memory.dmp

Download

memory/644-1902-0x00007FF6EB560000-0x00007FF6EB955000-memory.dmp

Download

memory/644-10-0x00007FF6EB560000-0x00007FF6EB955000-memory.dmp

Download

memory/1232-73-0x00007FF6DEA40000-0x00007FF6DEE35000-memory.dmp

Download

memory/1232-1912-0x00007FF6DEA40000-0x00007FF6DEE35000-memory.dmp

Download

memory/1264-69-0x00007FF779D00000-0x00007FF77A0F5000-memory.dmp

Download

memory/1264-1907-0x00007FF779D00000-0x00007FF77A0F5000-memory.dmp

Download

memory/1424-685-0x00007FF6934F0000-0x00007FF6938E5000-memory.dmp

Download

memory/1424-1924-0x00007FF6934F0000-0x00007FF6938E5000-memory.dmp

Download

memory/1544-75-0x00007FF6E0EC0000-0x00007FF6E12B5000-memory.dmp

Download

memory/1544-1911-0x00007FF6E0EC0000-0x00007FF6E12B5000-memory.dmp

Download

memory/1652-65-0x00007FF6296A0000-0x00007FF629A95000-memory.dmp

Download

memory/1652-1906-0x00007FF6296A0000-0x00007FF629A95000-memory.dmp

Download

memory/1688-1903-0x00007FF653C70000-0x00007FF654065000-memory.dmp

Download

memory/1688-16-0x00007FF653C70000-0x00007FF654065000-memory.dmp

Download

memory/1708-1910-0x00007FF741420000-0x00007FF741815000-memory.dmp

Download

memory/1708-78-0x00007FF741420000-0x00007FF741815000-memory.dmp

Download

memory/2576-1914-0x00007FF67CB10000-0x00007FF67CF05000-memory.dmp

Download

memory/2576-86-0x00007FF67CB10000-0x00007FF67CF05000-memory.dmp

Download

memory/3100-1918-0x00007FF6285F0000-0x00007FF6289E5000-memory.dmp

Download

memory/3100-669-0x00007FF6285F0000-0x00007FF6289E5000-memory.dmp

Download

memory/3268-1898-0x00007FF6A4900000-0x00007FF6A4CF5000-memory.dmp

Download

memory/3268-1917-0x00007FF6A4900000-0x00007FF6A4CF5000-memory.dmp

Download

memory/3268-97-0x00007FF6A4900000-0x00007FF6A4CF5000-memory.dmp

Download

memory/3500-71-0x00007FF6C78B0000-0x00007FF6C7CA5000-memory.dmp

Download

memory/3500-1909-0x00007FF6C78B0000-0x00007FF6C7CA5000-memory.dmp

Download

memory/3560-83-0x00007FF7F28F0000-0x00007FF7F2CE5000-memory.dmp

Download

memory/3560-1908-0x00007FF7F28F0000-0x00007FF7F2CE5000-memory.dmp

Download

memory/3568-1921-0x00007FF632AC0000-0x00007FF632EB5000-memory.dmp

Download

memory/3568-677-0x00007FF632AC0000-0x00007FF632EB5000-memory.dmp

Download

memory/3788-1904-0x00007FF6DB760000-0x00007FF6DBB55000-memory.dmp

Download

memory/3788-61-0x00007FF6DB760000-0x00007FF6DBB55000-memory.dmp

Download

memory/3960-1900-0x00007FF606C20000-0x00007FF607015000-memory.dmp

Download

memory/3960-103-0x00007FF606C20000-0x00007FF607015000-memory.dmp

Download

memory/3960-1919-0x00007FF606C20000-0x00007FF607015000-memory.dmp

Download

memory/4036-1923-0x00007FF6495A0000-0x00007FF649995000-memory.dmp

Download

memory/4036-698-0x00007FF6495A0000-0x00007FF649995000-memory.dmp

Download

memory/4104-1922-0x00007FF77A8E0000-0x00007FF77ACD5000-memory.dmp

Download

memory/4104-680-0x00007FF77A8E0000-0x00007FF77ACD5000-memory.dmp

Download

memory/4340-1913-0x00007FF728AA0000-0x00007FF728E95000-memory.dmp

Download

memory/4340-82-0x00007FF728AA0000-0x00007FF728E95000-memory.dmp

Download

memory/4720-674-0x00007FF753050000-0x00007FF753445000-memory.dmp

Download

memory/4720-1920-0x00007FF753050000-0x00007FF753445000-memory.dmp

Download

memory/4836-691-0x00007FF7FBA20000-0x00007FF7FBE15000-memory.dmp

Download

memory/4836-1925-0x00007FF7FBA20000-0x00007FF7FBE15000-memory.dmp

Download

memory/5040-1915-0x00007FF683510000-0x00007FF683905000-memory.dmp

Download

memory/5040-90-0x00007FF683510000-0x00007FF683905000-memory.dmp

Download

memory/5116-1905-0x00007FF63F500000-0x00007FF63F8F5000-memory.dmp

Download

memory/5116-62-0x00007FF63F500000-0x00007FF63F8F5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads