xmrig | f405068e3123e0fff86be40bc6347c5f8e6f67dbfa4fdd1ab55dfc63ed0d3a04

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
Size 2.7MB
Sample240607-sr7afsbc95
SHA256 f405068e3123e0fff86be40bc6347c5f8e6f67dbfa4fdd1ab55dfc63ed0d3a04
MD5 66c5343d03a15f621807861be1793b50
SHA1 88f2c54a0070482096d8fcd064e00d2267b4e1ae
SHA512 8f17787df73178cd66f66072fe9099f240f20b7b4ed8863139ae31e6d187884d5ec485ee24ea68a3ba430ce9197586d4fea3f1fc8180bf68d152639929f98546
SSDEEP 49152:w0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzJlR1dqo5LlG5:w0GnJMOWPClFdx6e0EALKWVTffZiPAcm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3648-0-0x00007FF7E5D90000-0x00007FF7E6185000-memory.dmp	xmrig
behavioral2/files/0x000800000002342d-5.dat	xmrig
behavioral2/files/0x0007000000023432-7.dat	xmrig
behavioral2/files/0x0007000000023431-10.dat	xmrig
behavioral2/memory/1212-9-0x00007FF6D76C0000-0x00007FF6D7AB5000-memory.dmp	xmrig
behavioral2/memory/3096-14-0x00007FF77D7C0000-0x00007FF77DBB5000-memory.dmp	xmrig
behavioral2/files/0x0007000000023433-24.dat	xmrig
behavioral2/files/0x0007000000023434-30.dat	xmrig
behavioral2/files/0x0007000000023435-35.dat	xmrig
behavioral2/files/0x0007000000023436-40.dat	xmrig
behavioral2/files/0x0007000000023437-45.dat	xmrig
behavioral2/files/0x0007000000023438-48.dat	xmrig
behavioral2/files/0x0007000000023439-53.dat	xmrig
behavioral2/files/0x000700000002343a-58.dat	xmrig
behavioral2/files/0x000700000002343c-70.dat	xmrig
behavioral2/files/0x000700000002343d-75.dat	xmrig
behavioral2/files/0x000700000002343e-80.dat	xmrig
behavioral2/files/0x0007000000023440-88.dat	xmrig
behavioral2/files/0x0007000000023441-95.dat	xmrig
behavioral2/files/0x0007000000023444-110.dat	xmrig
behavioral2/files/0x0007000000023446-120.dat	xmrig
behavioral2/files/0x0007000000023448-130.dat	xmrig
behavioral2/files/0x000700000002344b-143.dat	xmrig
behavioral2/files/0x000700000002344d-155.dat	xmrig
behavioral2/files/0x000700000002344f-165.dat	xmrig
behavioral2/memory/2296-539-0x00007FF781500000-0x00007FF7818F5000-memory.dmp	xmrig
behavioral2/files/0x000700000002344e-160.dat	xmrig
behavioral2/files/0x000700000002344c-150.dat	xmrig
behavioral2/files/0x000700000002344a-140.dat	xmrig
behavioral2/files/0x0007000000023449-135.dat	xmrig
behavioral2/files/0x0007000000023447-125.dat	xmrig
behavioral2/files/0x0007000000023445-115.dat	xmrig
behavioral2/files/0x0007000000023443-105.dat	xmrig
behavioral2/files/0x0007000000023442-100.dat	xmrig
behavioral2/files/0x000700000002343f-85.dat	xmrig
behavioral2/files/0x000700000002343b-65.dat	xmrig
behavioral2/memory/4984-26-0x00007FF6DA150000-0x00007FF6DA545000-memory.dmp	xmrig
behavioral2/memory/1208-16-0x00007FF71BC30000-0x00007FF71C025000-memory.dmp	xmrig
behavioral2/memory/3536-540-0x00007FF6F7FB0000-0x00007FF6F83A5000-memory.dmp	xmrig
behavioral2/memory/4476-541-0x00007FF6ABC90000-0x00007FF6AC085000-memory.dmp	xmrig
behavioral2/memory/2264-542-0x00007FF687C10000-0x00007FF688005000-memory.dmp	xmrig
behavioral2/memory/3472-543-0x00007FF7267C0000-0x00007FF726BB5000-memory.dmp	xmrig
behavioral2/memory/2260-544-0x00007FF7E4500000-0x00007FF7E48F5000-memory.dmp	xmrig
behavioral2/memory/876-550-0x00007FF7CEF10000-0x00007FF7CF305000-memory.dmp	xmrig
behavioral2/memory/1464-555-0x00007FF7247A0000-0x00007FF724B95000-memory.dmp	xmrig
behavioral2/memory/2392-560-0x00007FF678E90000-0x00007FF679285000-memory.dmp	xmrig
behavioral2/memory/552-573-0x00007FF6DD950000-0x00007FF6DDD45000-memory.dmp	xmrig
behavioral2/memory/420-583-0x00007FF761340000-0x00007FF761735000-memory.dmp	xmrig
behavioral2/memory/548-591-0x00007FF6F4080000-0x00007FF6F4475000-memory.dmp	xmrig
behavioral2/memory/4728-605-0x00007FF634770000-0x00007FF634B65000-memory.dmp	xmrig
behavioral2/memory/4116-595-0x00007FF60EFF0000-0x00007FF60F3E5000-memory.dmp	xmrig
behavioral2/memory/3584-618-0x00007FF648420000-0x00007FF648815000-memory.dmp	xmrig
behavioral2/memory/1608-621-0x00007FF7796A0000-0x00007FF779A95000-memory.dmp	xmrig
behavioral2/memory/4780-624-0x00007FF76E100000-0x00007FF76E4F5000-memory.dmp	xmrig
behavioral2/memory/3412-614-0x00007FF76EED0000-0x00007FF76F2C5000-memory.dmp	xmrig
behavioral2/memory/60-611-0x00007FF7EF2D0000-0x00007FF7EF6C5000-memory.dmp	xmrig
behavioral2/memory/220-575-0x00007FF75B9B0000-0x00007FF75BDA5000-memory.dmp	xmrig
behavioral2/memory/3648-1909-0x00007FF7E5D90000-0x00007FF7E6185000-memory.dmp	xmrig
behavioral2/memory/1212-1910-0x00007FF6D76C0000-0x00007FF6D7AB5000-memory.dmp	xmrig
behavioral2/memory/3096-1911-0x00007FF77D7C0000-0x00007FF77DBB5000-memory.dmp	xmrig
behavioral2/memory/1208-1912-0x00007FF71BC30000-0x00007FF71C025000-memory.dmp	xmrig
behavioral2/memory/1212-1913-0x00007FF6D76C0000-0x00007FF6D7AB5000-memory.dmp	xmrig
behavioral2/memory/1208-1915-0x00007FF71BC30000-0x00007FF71C025000-memory.dmp	xmrig
behavioral2/memory/3096-1914-0x00007FF77D7C0000-0x00007FF77DBB5000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1212	KjsOghQ.exe
3096	kGUqjTW.exe
1208	NZXyepl.exe
4984	aMrXOkt.exe
2296	CPlCfED.exe
3536	vForckp.exe
4476	DEJcpeg.exe
2264	dPPICFq.exe
3472	FbnzKLx.exe
2260	kvLpoGq.exe
876	KtXkWdD.exe
1464	oqpDSKw.exe
2392	jOFpBtD.exe
552	oeHyCfU.exe
220	jRFCoQW.exe
420	tpANoAl.exe
548	UlfckUI.exe
4116	EeglnTY.exe
4728	UrpUyfL.exe
60	xJqGKHU.exe
3412	HoiXAsv.exe
3584	TFbyuWv.exe
1608	bZLPsCY.exe
4780	CImOEmx.exe
744	NVkwPGd.exe
3600	FnXdxgI.exe
2036	RwtzbkT.exe
3524	mCWqqyf.exe
3996	zZNkVyL.exe
4060	scatuEB.exe
1108	oZgEJTe.exe
912	ZYHkGqu.exe
1100	EtHXZKk.exe
4508	uullWbN.exe
2056	svvKcgA.exe
2436	NOFKedb.exe
2724	kcUTuTB.exe
3304	WteVsSA.exe
2988	qFEvBzY.exe
1756	PfxPDAC.exe
5016	epWqrWm.exe
4664	aMlTnmq.exe
3464	oOtJVvb.exe
3140	czZdlqI.exe
2996	sNCOuUv.exe
1368	oJeGprT.exe
3656	xRFBKgB.exe
4900	KuslPTX.exe
2700	dyHGtdX.exe
2832	HaprHlH.exe
3048	uOPtMlU.exe
4568	bTFLlAT.exe
4340	coPUQLL.exe
4324	ZblNLBn.exe
3632	MmPPgYC.exe
3160	hVclkLh.exe
4796	GYPyGDv.exe
2104	xjeeBzt.exe
1284	NcYeayF.exe
1872	pMvHXVD.exe
2720	lcetGOr.exe
2032	uibWIMi.exe
3964	RLfpVTR.exe
664	RcUEjix.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3648-0-0x00007FF7E5D90000-0x00007FF7E6185000-memory.dmp	upx
behavioral2/files/0x000800000002342d-5.dat	upx
behavioral2/files/0x0007000000023432-7.dat	upx
behavioral2/files/0x0007000000023431-10.dat	upx
behavioral2/memory/1212-9-0x00007FF6D76C0000-0x00007FF6D7AB5000-memory.dmp	upx
behavioral2/memory/3096-14-0x00007FF77D7C0000-0x00007FF77DBB5000-memory.dmp	upx
behavioral2/files/0x0007000000023433-24.dat	upx
behavioral2/files/0x0007000000023434-30.dat	upx
behavioral2/files/0x0007000000023435-35.dat	upx
behavioral2/files/0x0007000000023436-40.dat	upx
behavioral2/files/0x0007000000023437-45.dat	upx
behavioral2/files/0x0007000000023438-48.dat	upx
behavioral2/files/0x0007000000023439-53.dat	upx
behavioral2/files/0x000700000002343a-58.dat	upx
behavioral2/files/0x000700000002343c-70.dat	upx
behavioral2/files/0x000700000002343d-75.dat	upx
behavioral2/files/0x000700000002343e-80.dat	upx
behavioral2/files/0x0007000000023440-88.dat	upx
behavioral2/files/0x0007000000023441-95.dat	upx
behavioral2/files/0x0007000000023444-110.dat	upx
behavioral2/files/0x0007000000023446-120.dat	upx
behavioral2/files/0x0007000000023448-130.dat	upx
behavioral2/files/0x000700000002344b-143.dat	upx
behavioral2/files/0x000700000002344d-155.dat	upx
behavioral2/files/0x000700000002344f-165.dat	upx
behavioral2/memory/2296-539-0x00007FF781500000-0x00007FF7818F5000-memory.dmp	upx
behavioral2/files/0x000700000002344e-160.dat	upx
behavioral2/files/0x000700000002344c-150.dat	upx
behavioral2/files/0x000700000002344a-140.dat	upx
behavioral2/files/0x0007000000023449-135.dat	upx
behavioral2/files/0x0007000000023447-125.dat	upx
behavioral2/files/0x0007000000023445-115.dat	upx
behavioral2/files/0x0007000000023443-105.dat	upx
behavioral2/files/0x0007000000023442-100.dat	upx
behavioral2/files/0x000700000002343f-85.dat	upx
behavioral2/files/0x000700000002343b-65.dat	upx
behavioral2/memory/4984-26-0x00007FF6DA150000-0x00007FF6DA545000-memory.dmp	upx
behavioral2/memory/1208-16-0x00007FF71BC30000-0x00007FF71C025000-memory.dmp	upx
behavioral2/memory/3536-540-0x00007FF6F7FB0000-0x00007FF6F83A5000-memory.dmp	upx
behavioral2/memory/4476-541-0x00007FF6ABC90000-0x00007FF6AC085000-memory.dmp	upx
behavioral2/memory/2264-542-0x00007FF687C10000-0x00007FF688005000-memory.dmp	upx
behavioral2/memory/3472-543-0x00007FF7267C0000-0x00007FF726BB5000-memory.dmp	upx
behavioral2/memory/2260-544-0x00007FF7E4500000-0x00007FF7E48F5000-memory.dmp	upx
behavioral2/memory/876-550-0x00007FF7CEF10000-0x00007FF7CF305000-memory.dmp	upx
behavioral2/memory/1464-555-0x00007FF7247A0000-0x00007FF724B95000-memory.dmp	upx
behavioral2/memory/2392-560-0x00007FF678E90000-0x00007FF679285000-memory.dmp	upx
behavioral2/memory/552-573-0x00007FF6DD950000-0x00007FF6DDD45000-memory.dmp	upx
behavioral2/memory/420-583-0x00007FF761340000-0x00007FF761735000-memory.dmp	upx
behavioral2/memory/548-591-0x00007FF6F4080000-0x00007FF6F4475000-memory.dmp	upx
behavioral2/memory/4728-605-0x00007FF634770000-0x00007FF634B65000-memory.dmp	upx
behavioral2/memory/4116-595-0x00007FF60EFF0000-0x00007FF60F3E5000-memory.dmp	upx
behavioral2/memory/3584-618-0x00007FF648420000-0x00007FF648815000-memory.dmp	upx
behavioral2/memory/1608-621-0x00007FF7796A0000-0x00007FF779A95000-memory.dmp	upx
behavioral2/memory/4780-624-0x00007FF76E100000-0x00007FF76E4F5000-memory.dmp	upx
behavioral2/memory/3412-614-0x00007FF76EED0000-0x00007FF76F2C5000-memory.dmp	upx
behavioral2/memory/60-611-0x00007FF7EF2D0000-0x00007FF7EF6C5000-memory.dmp	upx
behavioral2/memory/220-575-0x00007FF75B9B0000-0x00007FF75BDA5000-memory.dmp	upx
behavioral2/memory/3648-1909-0x00007FF7E5D90000-0x00007FF7E6185000-memory.dmp	upx
behavioral2/memory/1212-1910-0x00007FF6D76C0000-0x00007FF6D7AB5000-memory.dmp	upx
behavioral2/memory/3096-1911-0x00007FF77D7C0000-0x00007FF77DBB5000-memory.dmp	upx
behavioral2/memory/1208-1912-0x00007FF71BC30000-0x00007FF71C025000-memory.dmp	upx
behavioral2/memory/1212-1913-0x00007FF6D76C0000-0x00007FF6D7AB5000-memory.dmp	upx
behavioral2/memory/1208-1915-0x00007FF71BC30000-0x00007FF71C025000-memory.dmp	upx
behavioral2/memory/3096-1914-0x00007FF77D7C0000-0x00007FF77DBB5000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\MTmZsMU.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\rijalec.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\NVnSXwU.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\gtPyCuR.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\oFaGUeu.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\DzSvqTp.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\AEQsrGF.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\ZblNLBn.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\JnWDlfK.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\WeLOEPy.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\NhvwYor.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\taCnrMX.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\wlhizth.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\hhSvDML.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\QMRpYQW.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\fjVhLvW.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\XiWwRjP.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\cyvFcpP.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\fwCtHMi.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\kholaza.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\YUpgXIG.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\LfdFeoW.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\bWdNwIq.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\wXhlJwK.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\VHIMuCm.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\AogVspN.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\UtDopUh.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\KmzVYSm.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\unLqjKS.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\ZSJlVlc.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\cMrSBFH.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\SubjLzs.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\DtCsWzs.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\ycgZZzM.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\KtchFTD.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\oOlyioE.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\diMlGAI.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\PgRUBwh.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\pjzCUEd.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\AotLPcE.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\fcFnGvL.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\PsPVJlR.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\czZdlqI.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\CCCdRYM.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\NVnwEIj.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\vnXiupn.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\HtiuFRh.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\eydCTTI.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\NcYeayF.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\iRjNpTS.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\NphrZjS.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\iouBszI.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\LodlTOO.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\hzmdfVq.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\ICFRmOx.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\pqoczfp.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\WzsyyhE.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\sNCOuUv.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\lDgWXoX.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\OdBNIla.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\NPIUQfT.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\XjfyXeX.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\bwzkYGX.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
File created	C:\Windows\System32\RpHbmYe.exe	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 1212	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	82
PID 3648 wrote to memory of 1212	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	82
PID 3648 wrote to memory of 3096	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	83
PID 3648 wrote to memory of 3096	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	83
PID 3648 wrote to memory of 1208	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	84
PID 3648 wrote to memory of 1208	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	84
PID 3648 wrote to memory of 4984	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	85
PID 3648 wrote to memory of 4984	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	85
PID 3648 wrote to memory of 2296	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	86
PID 3648 wrote to memory of 2296	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	86
PID 3648 wrote to memory of 3536	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	87
PID 3648 wrote to memory of 3536	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	87
PID 3648 wrote to memory of 4476	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	88
PID 3648 wrote to memory of 4476	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	88
PID 3648 wrote to memory of 2264	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	89
PID 3648 wrote to memory of 2264	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	89
PID 3648 wrote to memory of 3472	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	90
PID 3648 wrote to memory of 3472	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	90
PID 3648 wrote to memory of 2260	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	91
PID 3648 wrote to memory of 2260	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	91
PID 3648 wrote to memory of 876	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	92
PID 3648 wrote to memory of 876	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	92
PID 3648 wrote to memory of 1464	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	93
PID 3648 wrote to memory of 1464	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	93
PID 3648 wrote to memory of 2392	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	94
PID 3648 wrote to memory of 2392	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	94
PID 3648 wrote to memory of 552	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	95
PID 3648 wrote to memory of 552	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	95
PID 3648 wrote to memory of 220	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	96
PID 3648 wrote to memory of 220	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	96
PID 3648 wrote to memory of 420	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	97
PID 3648 wrote to memory of 420	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	97
PID 3648 wrote to memory of 548	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	98
PID 3648 wrote to memory of 548	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	98
PID 3648 wrote to memory of 4116	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	99
PID 3648 wrote to memory of 4116	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	99
PID 3648 wrote to memory of 4728	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	100
PID 3648 wrote to memory of 4728	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	100
PID 3648 wrote to memory of 60	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	101
PID 3648 wrote to memory of 60	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	101
PID 3648 wrote to memory of 3412	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	102
PID 3648 wrote to memory of 3412	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	102
PID 3648 wrote to memory of 3584	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	103
PID 3648 wrote to memory of 3584	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	103
PID 3648 wrote to memory of 1608	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	104
PID 3648 wrote to memory of 1608	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	104
PID 3648 wrote to memory of 4780	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	105
PID 3648 wrote to memory of 4780	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	105
PID 3648 wrote to memory of 744	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	106
PID 3648 wrote to memory of 744	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	106
PID 3648 wrote to memory of 3600	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	107
PID 3648 wrote to memory of 3600	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	107
PID 3648 wrote to memory of 2036	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	108
PID 3648 wrote to memory of 2036	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	108
PID 3648 wrote to memory of 3524	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	109
PID 3648 wrote to memory of 3524	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	109
PID 3648 wrote to memory of 3996	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	110
PID 3648 wrote to memory of 3996	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	110
PID 3648 wrote to memory of 4060	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	111
PID 3648 wrote to memory of 4060	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	111
PID 3648 wrote to memory of 1108	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	112
PID 3648 wrote to memory of 1108	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	112
PID 3648 wrote to memory of 912	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	113
PID 3648 wrote to memory of 912	3648	66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe	113

C:\Users\Admin\AppData\Local\Temp\66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\66c5343d03a15f621807861be1793b50_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Windows\System32\KjsOghQ.exe
  C:\Windows\System32\KjsOghQ.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System32\kGUqjTW.exe
  C:\Windows\System32\kGUqjTW.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System32\NZXyepl.exe
  C:\Windows\System32\NZXyepl.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System32\aMrXOkt.exe
  C:\Windows\System32\aMrXOkt.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System32\CPlCfED.exe
  C:\Windows\System32\CPlCfED.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System32\vForckp.exe
  C:\Windows\System32\vForckp.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System32\DEJcpeg.exe
  C:\Windows\System32\DEJcpeg.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System32\dPPICFq.exe
  C:\Windows\System32\dPPICFq.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System32\FbnzKLx.exe
  C:\Windows\System32\FbnzKLx.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System32\kvLpoGq.exe
  C:\Windows\System32\kvLpoGq.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System32\KtXkWdD.exe
  C:\Windows\System32\KtXkWdD.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System32\oqpDSKw.exe
  C:\Windows\System32\oqpDSKw.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System32\jOFpBtD.exe
  C:\Windows\System32\jOFpBtD.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System32\oeHyCfU.exe
  C:\Windows\System32\oeHyCfU.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System32\jRFCoQW.exe
  C:\Windows\System32\jRFCoQW.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System32\tpANoAl.exe
  C:\Windows\System32\tpANoAl.exe
  2⤵
  - Executes dropped EXE
  PID:420
- C:\Windows\System32\UlfckUI.exe
  C:\Windows\System32\UlfckUI.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System32\EeglnTY.exe
  C:\Windows\System32\EeglnTY.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System32\UrpUyfL.exe
  C:\Windows\System32\UrpUyfL.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System32\xJqGKHU.exe
  C:\Windows\System32\xJqGKHU.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System32\HoiXAsv.exe
  C:\Windows\System32\HoiXAsv.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System32\TFbyuWv.exe
  C:\Windows\System32\TFbyuWv.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System32\bZLPsCY.exe
  C:\Windows\System32\bZLPsCY.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System32\CImOEmx.exe
  C:\Windows\System32\CImOEmx.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System32\NVkwPGd.exe
  C:\Windows\System32\NVkwPGd.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System32\FnXdxgI.exe
  C:\Windows\System32\FnXdxgI.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System32\RwtzbkT.exe
  C:\Windows\System32\RwtzbkT.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System32\mCWqqyf.exe
  C:\Windows\System32\mCWqqyf.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System32\zZNkVyL.exe
  C:\Windows\System32\zZNkVyL.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System32\scatuEB.exe
  C:\Windows\System32\scatuEB.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System32\oZgEJTe.exe
  C:\Windows\System32\oZgEJTe.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System32\ZYHkGqu.exe
  C:\Windows\System32\ZYHkGqu.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System32\EtHXZKk.exe
  C:\Windows\System32\EtHXZKk.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System32\uullWbN.exe
  C:\Windows\System32\uullWbN.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System32\svvKcgA.exe
  C:\Windows\System32\svvKcgA.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System32\NOFKedb.exe
  C:\Windows\System32\NOFKedb.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System32\kcUTuTB.exe
  C:\Windows\System32\kcUTuTB.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System32\WteVsSA.exe
  C:\Windows\System32\WteVsSA.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System32\qFEvBzY.exe
  C:\Windows\System32\qFEvBzY.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System32\PfxPDAC.exe
  C:\Windows\System32\PfxPDAC.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System32\epWqrWm.exe
  C:\Windows\System32\epWqrWm.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System32\aMlTnmq.exe
  C:\Windows\System32\aMlTnmq.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System32\oOtJVvb.exe
  C:\Windows\System32\oOtJVvb.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System32\czZdlqI.exe
  C:\Windows\System32\czZdlqI.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System32\sNCOuUv.exe
  C:\Windows\System32\sNCOuUv.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System32\oJeGprT.exe
  C:\Windows\System32\oJeGprT.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System32\xRFBKgB.exe
  C:\Windows\System32\xRFBKgB.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System32\KuslPTX.exe
  C:\Windows\System32\KuslPTX.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System32\dyHGtdX.exe
  C:\Windows\System32\dyHGtdX.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System32\HaprHlH.exe
  C:\Windows\System32\HaprHlH.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System32\uOPtMlU.exe
  C:\Windows\System32\uOPtMlU.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System32\bTFLlAT.exe
  C:\Windows\System32\bTFLlAT.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System32\coPUQLL.exe
  C:\Windows\System32\coPUQLL.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System32\ZblNLBn.exe
  C:\Windows\System32\ZblNLBn.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System32\MmPPgYC.exe
  C:\Windows\System32\MmPPgYC.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System32\hVclkLh.exe
  C:\Windows\System32\hVclkLh.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System32\GYPyGDv.exe
  C:\Windows\System32\GYPyGDv.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System32\xjeeBzt.exe
  C:\Windows\System32\xjeeBzt.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System32\NcYeayF.exe
  C:\Windows\System32\NcYeayF.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System32\pMvHXVD.exe
  C:\Windows\System32\pMvHXVD.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System32\lcetGOr.exe
  C:\Windows\System32\lcetGOr.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System32\uibWIMi.exe
  C:\Windows\System32\uibWIMi.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System32\RLfpVTR.exe
  C:\Windows\System32\RLfpVTR.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System32\RcUEjix.exe
  C:\Windows\System32\RcUEjix.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System32\txgHAJp.exe
  C:\Windows\System32\txgHAJp.exe
  2⤵
  PID:704
- C:\Windows\System32\rjrkmMB.exe
  C:\Windows\System32\rjrkmMB.exe
  2⤵
  PID:4380
- C:\Windows\System32\HWNUFkp.exe
  C:\Windows\System32\HWNUFkp.exe
  2⤵
  PID:5056
- C:\Windows\System32\CCrHiiS.exe
  C:\Windows\System32\CCrHiiS.exe
  2⤵
  PID:1400
- C:\Windows\System32\EkUBgYM.exe
  C:\Windows\System32\EkUBgYM.exe
  2⤵
  PID:1972
- C:\Windows\System32\LrxqACd.exe
  C:\Windows\System32\LrxqACd.exe
  2⤵
  PID:2756
- C:\Windows\System32\wNOsLkj.exe
  C:\Windows\System32\wNOsLkj.exe
  2⤵
  PID:3768
- C:\Windows\System32\PuJBaCR.exe
  C:\Windows\System32\PuJBaCR.exe
  2⤵
  PID:3764
- C:\Windows\System32\DfPBxXd.exe
  C:\Windows\System32\DfPBxXd.exe
  2⤵
  PID:688
- C:\Windows\System32\lLpAoDR.exe
  C:\Windows\System32\lLpAoDR.exe
  2⤵
  PID:1420
- C:\Windows\System32\JkTOIgU.exe
  C:\Windows\System32\JkTOIgU.exe
  2⤵
  PID:3696
- C:\Windows\System32\zVNMHCv.exe
  C:\Windows\System32\zVNMHCv.exe
  2⤵
  PID:5116
- C:\Windows\System32\VRUcTHw.exe
  C:\Windows\System32\VRUcTHw.exe
  2⤵
  PID:2968
- C:\Windows\System32\MTmZsMU.exe
  C:\Windows\System32\MTmZsMU.exe
  2⤵
  PID:1380
- C:\Windows\System32\IOXNXbb.exe
  C:\Windows\System32\IOXNXbb.exe
  2⤵
  PID:2808
- C:\Windows\System32\dxaQUjb.exe
  C:\Windows\System32\dxaQUjb.exe
  2⤵
  PID:2472
- C:\Windows\System32\WTdMAqi.exe
  C:\Windows\System32\WTdMAqi.exe
  2⤵
  PID:4252
- C:\Windows\System32\rBBhAcJ.exe
  C:\Windows\System32\rBBhAcJ.exe
  2⤵
  PID:3084
- C:\Windows\System32\tIHVMpo.exe
  C:\Windows\System32\tIHVMpo.exe
  2⤵
  PID:3728
- C:\Windows\System32\PFCIBlp.exe
  C:\Windows\System32\PFCIBlp.exe
  2⤵
  PID:996
- C:\Windows\System32\JnaoVvN.exe
  C:\Windows\System32\JnaoVvN.exe
  2⤵
  PID:4764
- C:\Windows\System32\waatiXh.exe
  C:\Windows\System32\waatiXh.exe
  2⤵
  PID:5052
- C:\Windows\System32\hLZEUDW.exe
  C:\Windows\System32\hLZEUDW.exe
  2⤵
  PID:1588
- C:\Windows\System32\QaKVgPG.exe
  C:\Windows\System32\QaKVgPG.exe
  2⤵
  PID:4328
- C:\Windows\System32\xxqDXhg.exe
  C:\Windows\System32\xxqDXhg.exe
  2⤵
  PID:1848
- C:\Windows\System32\wutEIub.exe
  C:\Windows\System32\wutEIub.exe
  2⤵
  PID:2112
- C:\Windows\System32\OeYELts.exe
  C:\Windows\System32\OeYELts.exe
  2⤵
  PID:1556
- C:\Windows\System32\WVlkthM.exe
  C:\Windows\System32\WVlkthM.exe
  2⤵
  PID:5144
- C:\Windows\System32\VOatRgT.exe
  C:\Windows\System32\VOatRgT.exe
  2⤵
  PID:5172
- C:\Windows\System32\diMlGAI.exe
  C:\Windows\System32\diMlGAI.exe
  2⤵
  PID:5200
- C:\Windows\System32\UtDopUh.exe
  C:\Windows\System32\UtDopUh.exe
  2⤵
  PID:5228
- C:\Windows\System32\kVNAnQd.exe
  C:\Windows\System32\kVNAnQd.exe
  2⤵
  PID:5256
- C:\Windows\System32\UosqINW.exe
  C:\Windows\System32\UosqINW.exe
  2⤵
  PID:5284
- C:\Windows\System32\TRiBqnX.exe
  C:\Windows\System32\TRiBqnX.exe
  2⤵
  PID:5312
- C:\Windows\System32\CbwGrTr.exe
  C:\Windows\System32\CbwGrTr.exe
  2⤵
  PID:5340
- C:\Windows\System32\XxuUqMq.exe
  C:\Windows\System32\XxuUqMq.exe
  2⤵
  PID:5368
- C:\Windows\System32\rlvbJvP.exe
  C:\Windows\System32\rlvbJvP.exe
  2⤵
  PID:5396
- C:\Windows\System32\lDgWXoX.exe
  C:\Windows\System32\lDgWXoX.exe
  2⤵
  PID:5424
- C:\Windows\System32\MJPjwWb.exe
  C:\Windows\System32\MJPjwWb.exe
  2⤵
  PID:5452
- C:\Windows\System32\AFdKjwr.exe
  C:\Windows\System32\AFdKjwr.exe
  2⤵
  PID:5480
- C:\Windows\System32\ZQUUQiW.exe
  C:\Windows\System32\ZQUUQiW.exe
  2⤵
  PID:5508
- C:\Windows\System32\BsgzTcS.exe
  C:\Windows\System32\BsgzTcS.exe
  2⤵
  PID:5536
- C:\Windows\System32\YycvJHm.exe
  C:\Windows\System32\YycvJHm.exe
  2⤵
  PID:5564
- C:\Windows\System32\XVBywuW.exe
  C:\Windows\System32\XVBywuW.exe
  2⤵
  PID:5592
- C:\Windows\System32\ianTIdH.exe
  C:\Windows\System32\ianTIdH.exe
  2⤵
  PID:5620
- C:\Windows\System32\pWZRgPa.exe
  C:\Windows\System32\pWZRgPa.exe
  2⤵
  PID:5648
- C:\Windows\System32\rijalec.exe
  C:\Windows\System32\rijalec.exe
  2⤵
  PID:5676
- C:\Windows\System32\cehRufu.exe
  C:\Windows\System32\cehRufu.exe
  2⤵
  PID:5704
- C:\Windows\System32\xBZgRqg.exe
  C:\Windows\System32\xBZgRqg.exe
  2⤵
  PID:5732
- C:\Windows\System32\xzkCwxH.exe
  C:\Windows\System32\xzkCwxH.exe
  2⤵
  PID:5760
- C:\Windows\System32\qNvBTuQ.exe
  C:\Windows\System32\qNvBTuQ.exe
  2⤵
  PID:5788
- C:\Windows\System32\MjdiTgC.exe
  C:\Windows\System32\MjdiTgC.exe
  2⤵
  PID:5816
- C:\Windows\System32\nDzGHfC.exe
  C:\Windows\System32\nDzGHfC.exe
  2⤵
  PID:5844
- C:\Windows\System32\BBVtvUn.exe
  C:\Windows\System32\BBVtvUn.exe
  2⤵
  PID:5872
- C:\Windows\System32\LOtwNRU.exe
  C:\Windows\System32\LOtwNRU.exe
  2⤵
  PID:5900
- C:\Windows\System32\qkyuxbp.exe
  C:\Windows\System32\qkyuxbp.exe
  2⤵
  PID:5928
- C:\Windows\System32\iwUdsey.exe
  C:\Windows\System32\iwUdsey.exe
  2⤵
  PID:5956
- C:\Windows\System32\FxchWzR.exe
  C:\Windows\System32\FxchWzR.exe
  2⤵
  PID:5984
- C:\Windows\System32\PbinNIr.exe
  C:\Windows\System32\PbinNIr.exe
  2⤵
  PID:6012
- C:\Windows\System32\CSNlDTQ.exe
  C:\Windows\System32\CSNlDTQ.exe
  2⤵
  PID:6040
- C:\Windows\System32\LfdFeoW.exe
  C:\Windows\System32\LfdFeoW.exe
  2⤵
  PID:6068
- C:\Windows\System32\UIouuUQ.exe
  C:\Windows\System32\UIouuUQ.exe
  2⤵
  PID:6096
- C:\Windows\System32\XYLudWK.exe
  C:\Windows\System32\XYLudWK.exe
  2⤵
  PID:6124
- C:\Windows\System32\SpqBetO.exe
  C:\Windows\System32\SpqBetO.exe
  2⤵
  PID:3896
- C:\Windows\System32\HiZrzKR.exe
  C:\Windows\System32\HiZrzKR.exe
  2⤵
  PID:4444
- C:\Windows\System32\EEeLiiq.exe
  C:\Windows\System32\EEeLiiq.exe
  2⤵
  PID:3804
- C:\Windows\System32\cMrSBFH.exe
  C:\Windows\System32\cMrSBFH.exe
  2⤵
  PID:5132
- C:\Windows\System32\QSdPyPD.exe
  C:\Windows\System32\QSdPyPD.exe
  2⤵
  PID:5212
- C:\Windows\System32\FayaVVu.exe
  C:\Windows\System32\FayaVVu.exe
  2⤵
  PID:5244
- C:\Windows\System32\xugFzuB.exe
  C:\Windows\System32\xugFzuB.exe
  2⤵
  PID:5324
- C:\Windows\System32\qMbcgjy.exe
  C:\Windows\System32\qMbcgjy.exe
  2⤵
  PID:5384
- C:\Windows\System32\mCHmyhZ.exe
  C:\Windows\System32\mCHmyhZ.exe
  2⤵
  PID:5448
- C:\Windows\System32\jhIffyN.exe
  C:\Windows\System32\jhIffyN.exe
  2⤵
  PID:5504
- C:\Windows\System32\NHUcWqu.exe
  C:\Windows\System32\NHUcWqu.exe
  2⤵
  PID:5552
- C:\Windows\System32\qAyAWhM.exe
  C:\Windows\System32\qAyAWhM.exe
  2⤵
  PID:5632
- C:\Windows\System32\mqItHiZ.exe
  C:\Windows\System32\mqItHiZ.exe
  2⤵
  PID:5700
- C:\Windows\System32\CrjUWbH.exe
  C:\Windows\System32\CrjUWbH.exe
  2⤵
  PID:5748
- C:\Windows\System32\OjQwJxn.exe
  C:\Windows\System32\OjQwJxn.exe
  2⤵
  PID:5812
- C:\Windows\System32\AQSwgrL.exe
  C:\Windows\System32\AQSwgrL.exe
  2⤵
  PID:5860
- C:\Windows\System32\XdLMxDL.exe
  C:\Windows\System32\XdLMxDL.exe
  2⤵
  PID:5916
- C:\Windows\System32\tXrQUdM.exe
  C:\Windows\System32\tXrQUdM.exe
  2⤵
  PID:5972
- C:\Windows\System32\FcOipQp.exe
  C:\Windows\System32\FcOipQp.exe
  2⤵
  PID:6052
- C:\Windows\System32\duFoXRj.exe
  C:\Windows\System32\duFoXRj.exe
  2⤵
  PID:6108
- C:\Windows\System32\zWKxHmt.exe
  C:\Windows\System32\zWKxHmt.exe
  2⤵
  PID:1544
- C:\Windows\System32\KZueqoZ.exe
  C:\Windows\System32\KZueqoZ.exe
  2⤵
  PID:5140
- C:\Windows\System32\WpKTagb.exe
  C:\Windows\System32\WpKTagb.exe
  2⤵
  PID:5216
- C:\Windows\System32\IaegSJw.exe
  C:\Windows\System32\IaegSJw.exe
  2⤵
  PID:4948
- C:\Windows\System32\UMyJWHV.exe
  C:\Windows\System32\UMyJWHV.exe
  2⤵
  PID:2572
- C:\Windows\System32\WMZxLfb.exe
  C:\Windows\System32\WMZxLfb.exe
  2⤵
  PID:5560
- C:\Windows\System32\FpanoGH.exe
  C:\Windows\System32\FpanoGH.exe
  2⤵
  PID:2464
- C:\Windows\System32\BZeWcTb.exe
  C:\Windows\System32\BZeWcTb.exe
  2⤵
  PID:5720
- C:\Windows\System32\ivKZusZ.exe
  C:\Windows\System32\ivKZusZ.exe
  2⤵
  PID:5832
- C:\Windows\System32\jmzbtBY.exe
  C:\Windows\System32\jmzbtBY.exe
  2⤵
  PID:5968
- C:\Windows\System32\krQtYUV.exe
  C:\Windows\System32\krQtYUV.exe
  2⤵
  PID:4484
- C:\Windows\System32\JrPbcds.exe
  C:\Windows\System32\JrPbcds.exe
  2⤵
  PID:4656
- C:\Windows\System32\CirpQcS.exe
  C:\Windows\System32\CirpQcS.exe
  2⤵
  PID:2396
- C:\Windows\System32\VFefiYY.exe
  C:\Windows\System32\VFefiYY.exe
  2⤵
  PID:3620
- C:\Windows\System32\fkDfrlW.exe
  C:\Windows\System32\fkDfrlW.exe
  2⤵
  PID:1604
- C:\Windows\System32\SubjLzs.exe
  C:\Windows\System32\SubjLzs.exe
  2⤵
  PID:4588
- C:\Windows\System32\DeohBgw.exe
  C:\Windows\System32\DeohBgw.exe
  2⤵
  PID:5840
- C:\Windows\System32\KOuQkWW.exe
  C:\Windows\System32\KOuQkWW.exe
  2⤵
  PID:5980
- C:\Windows\System32\cUcOuhh.exe
  C:\Windows\System32\cUcOuhh.exe
  2⤵
  PID:4196
- C:\Windows\System32\KPzCyoR.exe
  C:\Windows\System32\KPzCyoR.exe
  2⤵
  PID:5104
- C:\Windows\System32\vzFGPOe.exe
  C:\Windows\System32\vzFGPOe.exe
  2⤵
  PID:3520
- C:\Windows\System32\NVgpGJW.exe
  C:\Windows\System32\NVgpGJW.exe
  2⤵
  PID:4416
- C:\Windows\System32\WEGPuQU.exe
  C:\Windows\System32\WEGPuQU.exe
  2⤵
  PID:1332
- C:\Windows\System32\vyceylS.exe
  C:\Windows\System32\vyceylS.exe
  2⤵
  PID:3312
- C:\Windows\System32\XpOOByj.exe
  C:\Windows\System32\XpOOByj.exe
  2⤵
  PID:6168
- C:\Windows\System32\eOkynYV.exe
  C:\Windows\System32\eOkynYV.exe
  2⤵
  PID:6208
- C:\Windows\System32\uRFbvoF.exe
  C:\Windows\System32\uRFbvoF.exe
  2⤵
  PID:6244
- C:\Windows\System32\OuPjuLG.exe
  C:\Windows\System32\OuPjuLG.exe
  2⤵
  PID:6264
- C:\Windows\System32\fKiKZcv.exe
  C:\Windows\System32\fKiKZcv.exe
  2⤵
  PID:6312
- C:\Windows\System32\aONZgfw.exe
  C:\Windows\System32\aONZgfw.exe
  2⤵
  PID:6344
- C:\Windows\System32\CoXWFgV.exe
  C:\Windows\System32\CoXWFgV.exe
  2⤵
  PID:6372
- C:\Windows\System32\BJXaiFd.exe
  C:\Windows\System32\BJXaiFd.exe
  2⤵
  PID:6396
- C:\Windows\System32\CCCdRYM.exe
  C:\Windows\System32\CCCdRYM.exe
  2⤵
  PID:6436
- C:\Windows\System32\lpiUHlu.exe
  C:\Windows\System32\lpiUHlu.exe
  2⤵
  PID:6556
- C:\Windows\System32\khuhqTv.exe
  C:\Windows\System32\khuhqTv.exe
  2⤵
  PID:6584
- C:\Windows\System32\KRcgYLC.exe
  C:\Windows\System32\KRcgYLC.exe
  2⤵
  PID:6624
- C:\Windows\System32\awrtjaG.exe
  C:\Windows\System32\awrtjaG.exe
  2⤵
  PID:6676
- C:\Windows\System32\LFybAVE.exe
  C:\Windows\System32\LFybAVE.exe
  2⤵
  PID:6712
- C:\Windows\System32\QMRpYQW.exe
  C:\Windows\System32\QMRpYQW.exe
  2⤵
  PID:6744
- C:\Windows\System32\DFAiQHe.exe
  C:\Windows\System32\DFAiQHe.exe
  2⤵
  PID:6760
- C:\Windows\System32\nXwiKOh.exe
  C:\Windows\System32\nXwiKOh.exe
  2⤵
  PID:6800
- C:\Windows\System32\AVntivG.exe
  C:\Windows\System32\AVntivG.exe
  2⤵
  PID:6828
- C:\Windows\System32\SjXOpwG.exe
  C:\Windows\System32\SjXOpwG.exe
  2⤵
  PID:6856
- C:\Windows\System32\ybMOimm.exe
  C:\Windows\System32\ybMOimm.exe
  2⤵
  PID:6884
- C:\Windows\System32\dmovtSI.exe
  C:\Windows\System32\dmovtSI.exe
  2⤵
  PID:6912
- C:\Windows\System32\fcACIjZ.exe
  C:\Windows\System32\fcACIjZ.exe
  2⤵
  PID:6928
- C:\Windows\System32\PxEAHAA.exe
  C:\Windows\System32\PxEAHAA.exe
  2⤵
  PID:6956
- C:\Windows\System32\QaZFJxP.exe
  C:\Windows\System32\QaZFJxP.exe
  2⤵
  PID:6996
- C:\Windows\System32\dtgdgFX.exe
  C:\Windows\System32\dtgdgFX.exe
  2⤵
  PID:7012
- C:\Windows\System32\ljFjaRe.exe
  C:\Windows\System32\ljFjaRe.exe
  2⤵
  PID:7052
- C:\Windows\System32\PklacVh.exe
  C:\Windows\System32\PklacVh.exe
  2⤵
  PID:7080
- C:\Windows\System32\glPmjWE.exe
  C:\Windows\System32\glPmjWE.exe
  2⤵
  PID:7096
- C:\Windows\System32\FOdhLGX.exe
  C:\Windows\System32\FOdhLGX.exe
  2⤵
  PID:7136
- C:\Windows\System32\PJOIDSF.exe
  C:\Windows\System32\PJOIDSF.exe
  2⤵
  PID:7164
- C:\Windows\System32\XCqJEXs.exe
  C:\Windows\System32\XCqJEXs.exe
  2⤵
  PID:4120
- C:\Windows\System32\PgRUBwh.exe
  C:\Windows\System32\PgRUBwh.exe
  2⤵
  PID:2140
- C:\Windows\System32\qVTYyyy.exe
  C:\Windows\System32\qVTYyyy.exe
  2⤵
  PID:6188
- C:\Windows\System32\ZSJlVlc.exe
  C:\Windows\System32\ZSJlVlc.exe
  2⤵
  PID:6280
- C:\Windows\System32\zOPiFmN.exe
  C:\Windows\System32\zOPiFmN.exe
  2⤵
  PID:6340
- C:\Windows\System32\GpfmBus.exe
  C:\Windows\System32\GpfmBus.exe
  2⤵
  PID:6368
- C:\Windows\System32\YtfGrKB.exe
  C:\Windows\System32\YtfGrKB.exe
  2⤵
  PID:4204
- C:\Windows\System32\NBcflIK.exe
  C:\Windows\System32\NBcflIK.exe
  2⤵
  PID:6420
- C:\Windows\System32\hzmdfVq.exe
  C:\Windows\System32\hzmdfVq.exe
  2⤵
  PID:6596
- C:\Windows\System32\Hfjwrjb.exe
  C:\Windows\System32\Hfjwrjb.exe
  2⤵
  PID:6688
- C:\Windows\System32\bWdNwIq.exe
  C:\Windows\System32\bWdNwIq.exe
  2⤵
  PID:6740
- C:\Windows\System32\NTRAwfe.exe
  C:\Windows\System32\NTRAwfe.exe
  2⤵
  PID:6840
- C:\Windows\System32\sSZEotZ.exe
  C:\Windows\System32\sSZEotZ.exe
  2⤵
  PID:6904
- C:\Windows\System32\csrfbnF.exe
  C:\Windows\System32\csrfbnF.exe
  2⤵
  PID:6944
- C:\Windows\System32\HKtagYV.exe
  C:\Windows\System32\HKtagYV.exe
  2⤵
  PID:7004
- C:\Windows\System32\LYmfByW.exe
  C:\Windows\System32\LYmfByW.exe
  2⤵
  PID:7092
- C:\Windows\System32\KLXTgZB.exe
  C:\Windows\System32\KLXTgZB.exe
  2⤵
  PID:7132
- C:\Windows\System32\jYUxBoE.exe
  C:\Windows\System32\jYUxBoE.exe
  2⤵
  PID:2544
- C:\Windows\System32\LTUOqDa.exe
  C:\Windows\System32\LTUOqDa.exe
  2⤵
  PID:6360
- C:\Windows\System32\CDrTxDb.exe
  C:\Windows\System32\CDrTxDb.exe
  2⤵
  PID:5784
- C:\Windows\System32\TeecVsj.exe
  C:\Windows\System32\TeecVsj.exe
  2⤵
  PID:6576
- C:\Windows\System32\LzuVdPO.exe
  C:\Windows\System32\LzuVdPO.exe
  2⤵
  PID:6780
- C:\Windows\System32\nTVwJax.exe
  C:\Windows\System32\nTVwJax.exe
  2⤵
  PID:6948
- C:\Windows\System32\jJOYifq.exe
  C:\Windows\System32\jJOYifq.exe
  2⤵
  PID:7032
- C:\Windows\System32\ajryYlA.exe
  C:\Windows\System32\ajryYlA.exe
  2⤵
  PID:6260
- C:\Windows\System32\dublcer.exe
  C:\Windows\System32\dublcer.exe
  2⤵
  PID:6356
- C:\Windows\System32\TdMdewi.exe
  C:\Windows\System32\TdMdewi.exe
  2⤵
  PID:6564
- C:\Windows\System32\fwYWwyz.exe
  C:\Windows\System32\fwYWwyz.exe
  2⤵
  PID:7112
- C:\Windows\System32\UeuBqiT.exe
  C:\Windows\System32\UeuBqiT.exe
  2⤵
  PID:6876
- C:\Windows\System32\hXBAvjw.exe
  C:\Windows\System32\hXBAvjw.exe
  2⤵
  PID:7172
- C:\Windows\System32\ppgwUTr.exe
  C:\Windows\System32\ppgwUTr.exe
  2⤵
  PID:7188
- C:\Windows\System32\pMiSMph.exe
  C:\Windows\System32\pMiSMph.exe
  2⤵
  PID:7204
- C:\Windows\System32\KnIFbKv.exe
  C:\Windows\System32\KnIFbKv.exe
  2⤵
  PID:7228
- C:\Windows\System32\xmeTgCw.exe
  C:\Windows\System32\xmeTgCw.exe
  2⤵
  PID:7264
- C:\Windows\System32\cPZBFah.exe
  C:\Windows\System32\cPZBFah.exe
  2⤵
  PID:7304
- C:\Windows\System32\QPMFDNo.exe
  C:\Windows\System32\QPMFDNo.exe
  2⤵
  PID:7344
- C:\Windows\System32\tOXdjlj.exe
  C:\Windows\System32\tOXdjlj.exe
  2⤵
  PID:7360
- C:\Windows\System32\isxzdJk.exe
  C:\Windows\System32\isxzdJk.exe
  2⤵
  PID:7376
- C:\Windows\System32\uuPUFol.exe
  C:\Windows\System32\uuPUFol.exe
  2⤵
  PID:7400
- C:\Windows\System32\wBCqdEf.exe
  C:\Windows\System32\wBCqdEf.exe
  2⤵
  PID:7448
- C:\Windows\System32\xZtTsgt.exe
  C:\Windows\System32\xZtTsgt.exe
  2⤵
  PID:7472
- C:\Windows\System32\HlScCyI.exe
  C:\Windows\System32\HlScCyI.exe
  2⤵
  PID:7512
- C:\Windows\System32\oLanQLC.exe
  C:\Windows\System32\oLanQLC.exe
  2⤵
  PID:7528
- C:\Windows\System32\mAVjHtp.exe
  C:\Windows\System32\mAVjHtp.exe
  2⤵
  PID:7572
- C:\Windows\System32\xnFcwaG.exe
  C:\Windows\System32\xnFcwaG.exe
  2⤵
  PID:7596
- C:\Windows\System32\GycKOtv.exe
  C:\Windows\System32\GycKOtv.exe
  2⤵
  PID:7628
- C:\Windows\System32\QwYgdGB.exe
  C:\Windows\System32\QwYgdGB.exe
  2⤵
  PID:7656
- C:\Windows\System32\NdiUEHb.exe
  C:\Windows\System32\NdiUEHb.exe
  2⤵
  PID:7684
- C:\Windows\System32\WDeGvwg.exe
  C:\Windows\System32\WDeGvwg.exe
  2⤵
  PID:7712
- C:\Windows\System32\HISCrlc.exe
  C:\Windows\System32\HISCrlc.exe
  2⤵
  PID:7736
- C:\Windows\System32\MSGKPyh.exe
  C:\Windows\System32\MSGKPyh.exe
  2⤵
  PID:7760
- C:\Windows\System32\XsZPzdQ.exe
  C:\Windows\System32\XsZPzdQ.exe
  2⤵
  PID:7796
- C:\Windows\System32\NVnwEIj.exe
  C:\Windows\System32\NVnwEIj.exe
  2⤵
  PID:7824
- C:\Windows\System32\KBPyTVC.exe
  C:\Windows\System32\KBPyTVC.exe
  2⤵
  PID:7840
- C:\Windows\System32\LQdetFP.exe
  C:\Windows\System32\LQdetFP.exe
  2⤵
  PID:7868
- C:\Windows\System32\HRxYocY.exe
  C:\Windows\System32\HRxYocY.exe
  2⤵
  PID:7908
- C:\Windows\System32\JKmZBjo.exe
  C:\Windows\System32\JKmZBjo.exe
  2⤵
  PID:7936
- C:\Windows\System32\yzymqfM.exe
  C:\Windows\System32\yzymqfM.exe
  2⤵
  PID:7952
- C:\Windows\System32\IRIjUXD.exe
  C:\Windows\System32\IRIjUXD.exe
  2⤵
  PID:7992
- C:\Windows\System32\DlPStmI.exe
  C:\Windows\System32\DlPStmI.exe
  2⤵
  PID:8016
- C:\Windows\System32\pjzCUEd.exe
  C:\Windows\System32\pjzCUEd.exe
  2⤵
  PID:8048
- C:\Windows\System32\LIMwtMH.exe
  C:\Windows\System32\LIMwtMH.exe
  2⤵
  PID:8076
- C:\Windows\System32\uGyxUdz.exe
  C:\Windows\System32\uGyxUdz.exe
  2⤵
  PID:8092
- C:\Windows\System32\ojWzWCs.exe
  C:\Windows\System32\ojWzWCs.exe
  2⤵
  PID:8132
- C:\Windows\System32\RqcTjCM.exe
  C:\Windows\System32\RqcTjCM.exe
  2⤵
  PID:8164
- C:\Windows\System32\GYfNNxg.exe
  C:\Windows\System32\GYfNNxg.exe
  2⤵
  PID:8188
- C:\Windows\System32\HOpnzOv.exe
  C:\Windows\System32\HOpnzOv.exe
  2⤵
  PID:7200
- C:\Windows\System32\vxEHNhW.exe
  C:\Windows\System32\vxEHNhW.exe
  2⤵
  PID:7300
- C:\Windows\System32\qGUjfnD.exe
  C:\Windows\System32\qGUjfnD.exe
  2⤵
  PID:7424
- C:\Windows\System32\TjhjYyH.exe
  C:\Windows\System32\TjhjYyH.exe
  2⤵
  PID:7504
- C:\Windows\System32\wFQIpPY.exe
  C:\Windows\System32\wFQIpPY.exe
  2⤵
  PID:7560
- C:\Windows\System32\lFahGbz.exe
  C:\Windows\System32\lFahGbz.exe
  2⤵
  PID:7640
- C:\Windows\System32\EKOIexc.exe
  C:\Windows\System32\EKOIexc.exe
  2⤵
  PID:7676
- C:\Windows\System32\QdYcPnt.exe
  C:\Windows\System32\QdYcPnt.exe
  2⤵
  PID:7720
- C:\Windows\System32\LodlTOO.exe
  C:\Windows\System32\LodlTOO.exe
  2⤵
  PID:7808
- C:\Windows\System32\biYQLER.exe
  C:\Windows\System32\biYQLER.exe
  2⤵
  PID:7860
- C:\Windows\System32\PNAMFqP.exe
  C:\Windows\System32\PNAMFqP.exe
  2⤵
  PID:7976
- C:\Windows\System32\QfjJeUi.exe
  C:\Windows\System32\QfjJeUi.exe
  2⤵
  PID:3516
- C:\Windows\System32\pUEouMf.exe
  C:\Windows\System32\pUEouMf.exe
  2⤵
  PID:8068
- C:\Windows\System32\ZrFjpxw.exe
  C:\Windows\System32\ZrFjpxw.exe
  2⤵
  PID:8144
- C:\Windows\System32\luUJdGw.exe
  C:\Windows\System32\luUJdGw.exe
  2⤵
  PID:7256
- C:\Windows\System32\fjVhLvW.exe
  C:\Windows\System32\fjVhLvW.exe
  2⤵
  PID:7432
- C:\Windows\System32\RoMxNiW.exe
  C:\Windows\System32\RoMxNiW.exe
  2⤵
  PID:7652
- C:\Windows\System32\BEbHfIs.exe
  C:\Windows\System32\BEbHfIs.exe
  2⤵
  PID:7780
- C:\Windows\System32\iaFOtkA.exe
  C:\Windows\System32\iaFOtkA.exe
  2⤵
  PID:7888
- C:\Windows\System32\RZqCogr.exe
  C:\Windows\System32\RZqCogr.exe
  2⤵
  PID:7968
- C:\Windows\System32\XcikQSa.exe
  C:\Windows\System32\XcikQSa.exe
  2⤵
  PID:7296
- C:\Windows\System32\VLkIRCn.exe
  C:\Windows\System32\VLkIRCn.exe
  2⤵
  PID:7224
- C:\Windows\System32\cGjtOkr.exe
  C:\Windows\System32\cGjtOkr.exe
  2⤵
  PID:7836
- C:\Windows\System32\XiWwRjP.exe
  C:\Windows\System32\XiWwRjP.exe
  2⤵
  PID:6496
- C:\Windows\System32\knFEqko.exe
  C:\Windows\System32\knFEqko.exe
  2⤵
  PID:8108
- C:\Windows\System32\mlpyFNG.exe
  C:\Windows\System32\mlpyFNG.exe
  2⤵
  PID:7556
- C:\Windows\System32\ZrRvOLg.exe
  C:\Windows\System32\ZrRvOLg.exe
  2⤵
  PID:6484
- C:\Windows\System32\ICFRmOx.exe
  C:\Windows\System32\ICFRmOx.exe
  2⤵
  PID:8024
- C:\Windows\System32\xfzayJG.exe
  C:\Windows\System32\xfzayJG.exe
  2⤵
  PID:7460
- C:\Windows\System32\DdBJAhU.exe
  C:\Windows\System32\DdBJAhU.exe
  2⤵
  PID:8220
- C:\Windows\System32\AvCUMjU.exe
  C:\Windows\System32\AvCUMjU.exe
  2⤵
  PID:8236
- C:\Windows\System32\NKxoSwo.exe
  C:\Windows\System32\NKxoSwo.exe
  2⤵
  PID:8284
- C:\Windows\System32\trlXjKa.exe
  C:\Windows\System32\trlXjKa.exe
  2⤵
  PID:8300
- C:\Windows\System32\hokKcMp.exe
  C:\Windows\System32\hokKcMp.exe
  2⤵
  PID:8332
- C:\Windows\System32\bBieDTh.exe
  C:\Windows\System32\bBieDTh.exe
  2⤵
  PID:8360
- C:\Windows\System32\yTshUOe.exe
  C:\Windows\System32\yTshUOe.exe
  2⤵
  PID:8380
- C:\Windows\System32\jjbTGqB.exe
  C:\Windows\System32\jjbTGqB.exe
  2⤵
  PID:8432
- C:\Windows\System32\jqVlZRO.exe
  C:\Windows\System32\jqVlZRO.exe
  2⤵
  PID:8460
- C:\Windows\System32\caHhPba.exe
  C:\Windows\System32\caHhPba.exe
  2⤵
  PID:8476
- C:\Windows\System32\vYtIemA.exe
  C:\Windows\System32\vYtIemA.exe
  2⤵
  PID:8504
- C:\Windows\System32\fNCgPjo.exe
  C:\Windows\System32\fNCgPjo.exe
  2⤵
  PID:8536
- C:\Windows\System32\pqoczfp.exe
  C:\Windows\System32\pqoczfp.exe
  2⤵
  PID:8576
- C:\Windows\System32\SkalQuK.exe
  C:\Windows\System32\SkalQuK.exe
  2⤵
  PID:8592
- C:\Windows\System32\GYHAvmo.exe
  C:\Windows\System32\GYHAvmo.exe
  2⤵
  PID:8632
- C:\Windows\System32\OdBNIla.exe
  C:\Windows\System32\OdBNIla.exe
  2⤵
  PID:8660
- C:\Windows\System32\zKfIGeB.exe
  C:\Windows\System32\zKfIGeB.exe
  2⤵
  PID:8708
- C:\Windows\System32\aqKwiaB.exe
  C:\Windows\System32\aqKwiaB.exe
  2⤵
  PID:8740
- C:\Windows\System32\cQfWYpn.exe
  C:\Windows\System32\cQfWYpn.exe
  2⤵
  PID:8760
- C:\Windows\System32\jzYNXJV.exe
  C:\Windows\System32\jzYNXJV.exe
  2⤵
  PID:8820
- C:\Windows\System32\RvTaNJT.exe
  C:\Windows\System32\RvTaNJT.exe
  2⤵
  PID:8856
- C:\Windows\System32\htOlJMY.exe
  C:\Windows\System32\htOlJMY.exe
  2⤵
  PID:8872
- C:\Windows\System32\roAoJRu.exe
  C:\Windows\System32\roAoJRu.exe
  2⤵
  PID:8908
- C:\Windows\System32\QleyqGB.exe
  C:\Windows\System32\QleyqGB.exe
  2⤵
  PID:8948
- C:\Windows\System32\vnXiupn.exe
  C:\Windows\System32\vnXiupn.exe
  2⤵
  PID:8972
- C:\Windows\System32\ODkfzwC.exe
  C:\Windows\System32\ODkfzwC.exe
  2⤵
  PID:9008
- C:\Windows\System32\LNfDoXD.exe
  C:\Windows\System32\LNfDoXD.exe
  2⤵
  PID:9048
- C:\Windows\System32\rPeQrpO.exe
  C:\Windows\System32\rPeQrpO.exe
  2⤵
  PID:9080
- C:\Windows\System32\MmwWgmL.exe
  C:\Windows\System32\MmwWgmL.exe
  2⤵
  PID:9112
- C:\Windows\System32\NVnSXwU.exe
  C:\Windows\System32\NVnSXwU.exe
  2⤵
  PID:9148
- C:\Windows\System32\DtCsWzs.exe
  C:\Windows\System32\DtCsWzs.exe
  2⤵
  PID:9196
- C:\Windows\System32\ujLjSvA.exe
  C:\Windows\System32\ujLjSvA.exe
  2⤵
  PID:2224
- C:\Windows\System32\NbYGLOj.exe
  C:\Windows\System32\NbYGLOj.exe
  2⤵
  PID:8244
- C:\Windows\System32\AexqiPO.exe
  C:\Windows\System32\AexqiPO.exe
  2⤵
  PID:8292
- C:\Windows\System32\HgejWxE.exe
  C:\Windows\System32\HgejWxE.exe
  2⤵
  PID:8448
- C:\Windows\System32\UawFniE.exe
  C:\Windows\System32\UawFniE.exe
  2⤵
  PID:8532
- C:\Windows\System32\AIZeWTe.exe
  C:\Windows\System32\AIZeWTe.exe
  2⤵
  PID:8608
- C:\Windows\System32\BgmYgEh.exe
  C:\Windows\System32\BgmYgEh.exe
  2⤵
  PID:8656
- C:\Windows\System32\SoNwRaP.exe
  C:\Windows\System32\SoNwRaP.exe
  2⤵
  PID:8772
- C:\Windows\System32\aKUYAmU.exe
  C:\Windows\System32\aKUYAmU.exe
  2⤵
  PID:8868
- C:\Windows\System32\WXOyxCc.exe
  C:\Windows\System32\WXOyxCc.exe
  2⤵
  PID:8904
- C:\Windows\System32\JZGdtnM.exe
  C:\Windows\System32\JZGdtnM.exe
  2⤵
  PID:8996
- C:\Windows\System32\grRWnis.exe
  C:\Windows\System32\grRWnis.exe
  2⤵
  PID:9092
- C:\Windows\System32\MMmDxAJ.exe
  C:\Windows\System32\MMmDxAJ.exe
  2⤵
  PID:9184
- C:\Windows\System32\cUuKqDa.exe
  C:\Windows\System32\cUuKqDa.exe
  2⤵
  PID:8328
- C:\Windows\System32\uaCTAAs.exe
  C:\Windows\System32\uaCTAAs.exe
  2⤵
  PID:8496
- C:\Windows\System32\xtIjROP.exe
  C:\Windows\System32\xtIjROP.exe
  2⤵
  PID:8648
- C:\Windows\System32\OiDQJiD.exe
  C:\Windows\System32\OiDQJiD.exe
  2⤵
  PID:8864
- C:\Windows\System32\UURngYZ.exe
  C:\Windows\System32\UURngYZ.exe
  2⤵
  PID:9072
- C:\Windows\System32\KZErfol.exe
  C:\Windows\System32\KZErfol.exe
  2⤵
  PID:8368
- C:\Windows\System32\umaSBvy.exe
  C:\Windows\System32\umaSBvy.exe
  2⤵
  PID:8728
- C:\Windows\System32\kcCoWpR.exe
  C:\Windows\System32\kcCoWpR.exe
  2⤵
  PID:4512
- C:\Windows\System32\iRjNpTS.exe
  C:\Windows\System32\iRjNpTS.exe
  2⤵
  PID:9268
- C:\Windows\System32\fxmLPhx.exe
  C:\Windows\System32\fxmLPhx.exe
  2⤵
  PID:9300
- C:\Windows\System32\gtPyCuR.exe
  C:\Windows\System32\gtPyCuR.exe
  2⤵
  PID:9328
- C:\Windows\System32\MKDRThY.exe
  C:\Windows\System32\MKDRThY.exe
  2⤵
  PID:9356
- C:\Windows\System32\wCTzPpM.exe
  C:\Windows\System32\wCTzPpM.exe
  2⤵
  PID:9384
- C:\Windows\System32\QpKbEkT.exe
  C:\Windows\System32\QpKbEkT.exe
  2⤵
  PID:9412
- C:\Windows\System32\HidMrGB.exe
  C:\Windows\System32\HidMrGB.exe
  2⤵
  PID:9440
- C:\Windows\System32\NKQaAsy.exe
  C:\Windows\System32\NKQaAsy.exe
  2⤵
  PID:9472
- C:\Windows\System32\tnreWBO.exe
  C:\Windows\System32\tnreWBO.exe
  2⤵
  PID:9500
- C:\Windows\System32\HaOYYpd.exe
  C:\Windows\System32\HaOYYpd.exe
  2⤵
  PID:9528
- C:\Windows\System32\cyvFcpP.exe
  C:\Windows\System32\cyvFcpP.exe
  2⤵
  PID:9556
- C:\Windows\System32\oFaGUeu.exe
  C:\Windows\System32\oFaGUeu.exe
  2⤵
  PID:9584
- C:\Windows\System32\UMRYHJT.exe
  C:\Windows\System32\UMRYHJT.exe
  2⤵
  PID:9616
- C:\Windows\System32\BkTkeZK.exe
  C:\Windows\System32\BkTkeZK.exe
  2⤵
  PID:9644
- C:\Windows\System32\cWLnUsV.exe
  C:\Windows\System32\cWLnUsV.exe
  2⤵
  PID:9672
- C:\Windows\System32\KmzVYSm.exe
  C:\Windows\System32\KmzVYSm.exe
  2⤵
  PID:9700
- C:\Windows\System32\BpcQJWI.exe
  C:\Windows\System32\BpcQJWI.exe
  2⤵
  PID:9732
- C:\Windows\System32\TfQBZwL.exe
  C:\Windows\System32\TfQBZwL.exe
  2⤵
  PID:9760
- C:\Windows\System32\PFtTJgv.exe
  C:\Windows\System32\PFtTJgv.exe
  2⤵
  PID:9788
- C:\Windows\System32\CTjDnmy.exe
  C:\Windows\System32\CTjDnmy.exe
  2⤵
  PID:9816
- C:\Windows\System32\CpdAHaF.exe
  C:\Windows\System32\CpdAHaF.exe
  2⤵
  PID:9844
- C:\Windows\System32\ALwwmAp.exe
  C:\Windows\System32\ALwwmAp.exe
  2⤵
  PID:9872
- C:\Windows\System32\qosIDfr.exe
  C:\Windows\System32\qosIDfr.exe
  2⤵
  PID:9908
- C:\Windows\System32\PKFkoLp.exe
  C:\Windows\System32\PKFkoLp.exe
  2⤵
  PID:9936
- C:\Windows\System32\PdeeBYi.exe
  C:\Windows\System32\PdeeBYi.exe
  2⤵
  PID:9964
- C:\Windows\System32\YOUyaxc.exe
  C:\Windows\System32\YOUyaxc.exe
  2⤵
  PID:9992
- C:\Windows\System32\sNaprkU.exe
  C:\Windows\System32\sNaprkU.exe
  2⤵
  PID:10028
- C:\Windows\System32\BhWPvyl.exe
  C:\Windows\System32\BhWPvyl.exe
  2⤵
  PID:10048
- C:\Windows\System32\yWTMale.exe
  C:\Windows\System32\yWTMale.exe
  2⤵
  PID:10084
- C:\Windows\System32\NRSLaCC.exe
  C:\Windows\System32\NRSLaCC.exe
  2⤵
  PID:10112
- C:\Windows\System32\NPIUQfT.exe
  C:\Windows\System32\NPIUQfT.exe
  2⤵
  PID:10144
- C:\Windows\System32\xeFfSoQ.exe
  C:\Windows\System32\xeFfSoQ.exe
  2⤵
  PID:10172
- C:\Windows\System32\pyZOHWY.exe
  C:\Windows\System32\pyZOHWY.exe
  2⤵
  PID:10204
- C:\Windows\System32\qHRixNh.exe
  C:\Windows\System32\qHRixNh.exe
  2⤵
  PID:10232
- C:\Windows\System32\slySXUB.exe
  C:\Windows\System32\slySXUB.exe
  2⤵
  PID:9260
- C:\Windows\System32\rnLnPGE.exe
  C:\Windows\System32\rnLnPGE.exe
  2⤵
  PID:9340
- C:\Windows\System32\wEvybuS.exe
  C:\Windows\System32\wEvybuS.exe
  2⤵
  PID:932
- C:\Windows\System32\FEBfezp.exe
  C:\Windows\System32\FEBfezp.exe
  2⤵
  PID:9424
- C:\Windows\System32\WzsyyhE.exe
  C:\Windows\System32\WzsyyhE.exe
  2⤵
  PID:9492
- C:\Windows\System32\ywysRve.exe
  C:\Windows\System32\ywysRve.exe
  2⤵
  PID:9552
- C:\Windows\System32\AotLPcE.exe
  C:\Windows\System32\AotLPcE.exe
  2⤵
  PID:9656
- C:\Windows\System32\YFZBEHz.exe
  C:\Windows\System32\YFZBEHz.exe
  2⤵
  PID:9724
- C:\Windows\System32\rMWEFmu.exe
  C:\Windows\System32\rMWEFmu.exe
  2⤵
  PID:9784
- C:\Windows\System32\cXnBJKn.exe
  C:\Windows\System32\cXnBJKn.exe
  2⤵
  PID:9840
- C:\Windows\System32\jtokYSp.exe
  C:\Windows\System32\jtokYSp.exe
  2⤵
  PID:9920
- C:\Windows\System32\DzSvqTp.exe
  C:\Windows\System32\DzSvqTp.exe
  2⤵
  PID:9984
- C:\Windows\System32\vIDWrWe.exe
  C:\Windows\System32\vIDWrWe.exe
  2⤵
  PID:10044
- C:\Windows\System32\WjBudyw.exe
  C:\Windows\System32\WjBudyw.exe
  2⤵
  PID:10124
- C:\Windows\System32\jDDTfAL.exe
  C:\Windows\System32\jDDTfAL.exe
  2⤵
  PID:10196
- C:\Windows\System32\lVufHaP.exe
  C:\Windows\System32\lVufHaP.exe
  2⤵
  PID:9256
- C:\Windows\System32\RznDphe.exe
  C:\Windows\System32\RznDphe.exe
  2⤵
  PID:4440
- C:\Windows\System32\HmbMPnP.exe
  C:\Windows\System32\HmbMPnP.exe
  2⤵
  PID:9540
- C:\Windows\System32\PovyTKp.exe
  C:\Windows\System32\PovyTKp.exe
  2⤵
  PID:9716
- C:\Windows\System32\NphrZjS.exe
  C:\Windows\System32\NphrZjS.exe
  2⤵
  PID:9868
- C:\Windows\System32\WdeJRKt.exe
  C:\Windows\System32\WdeJRKt.exe
  2⤵
  PID:10036
- C:\Windows\System32\aSahNaA.exe
  C:\Windows\System32\aSahNaA.exe
  2⤵
  PID:10184
- C:\Windows\System32\brcsNER.exe
  C:\Windows\System32\brcsNER.exe
  2⤵
  PID:9456
- C:\Windows\System32\OiFSihg.exe
  C:\Windows\System32\OiFSihg.exe
  2⤵
  PID:9828
- C:\Windows\System32\bpSHFpj.exe
  C:\Windows\System32\bpSHFpj.exe
  2⤵
  PID:10168
- C:\Windows\System32\dltQpaQ.exe
  C:\Windows\System32\dltQpaQ.exe
  2⤵
  PID:9976
- C:\Windows\System32\jyfKCnz.exe
  C:\Windows\System32\jyfKCnz.exe
  2⤵
  PID:9780
- C:\Windows\System32\mBoDFts.exe
  C:\Windows\System32\mBoDFts.exe
  2⤵
  PID:10264
- C:\Windows\System32\glntBHH.exe
  C:\Windows\System32\glntBHH.exe
  2⤵
  PID:10292
- C:\Windows\System32\zjpKClt.exe
  C:\Windows\System32\zjpKClt.exe
  2⤵
  PID:10320
- C:\Windows\System32\CSqzHgO.exe
  C:\Windows\System32\CSqzHgO.exe
  2⤵
  PID:10348
- C:\Windows\System32\neMjhNd.exe
  C:\Windows\System32\neMjhNd.exe
  2⤵
  PID:10376
- C:\Windows\System32\fwCtHMi.exe
  C:\Windows\System32\fwCtHMi.exe
  2⤵
  PID:10408
- C:\Windows\System32\VAvHDSo.exe
  C:\Windows\System32\VAvHDSo.exe
  2⤵
  PID:10436
- C:\Windows\System32\UokVXVs.exe
  C:\Windows\System32\UokVXVs.exe
  2⤵
  PID:10464
- C:\Windows\System32\GZxNHWt.exe
  C:\Windows\System32\GZxNHWt.exe
  2⤵
  PID:10492
- C:\Windows\System32\WqHiVDE.exe
  C:\Windows\System32\WqHiVDE.exe
  2⤵
  PID:10520
- C:\Windows\System32\foZIywX.exe
  C:\Windows\System32\foZIywX.exe
  2⤵
  PID:10548
- C:\Windows\System32\xxogMkb.exe
  C:\Windows\System32\xxogMkb.exe
  2⤵
  PID:10576
- C:\Windows\System32\NrEkUbZ.exe
  C:\Windows\System32\NrEkUbZ.exe
  2⤵
  PID:10604
- C:\Windows\System32\pMylsIQ.exe
  C:\Windows\System32\pMylsIQ.exe
  2⤵
  PID:10632
- C:\Windows\System32\SMYLPkX.exe
  C:\Windows\System32\SMYLPkX.exe
  2⤵
  PID:10660
- C:\Windows\System32\jufBpVh.exe
  C:\Windows\System32\jufBpVh.exe
  2⤵
  PID:10688
- C:\Windows\System32\xIApEJq.exe
  C:\Windows\System32\xIApEJq.exe
  2⤵
  PID:10716
- C:\Windows\System32\JGYeAzk.exe
  C:\Windows\System32\JGYeAzk.exe
  2⤵
  PID:10752
- C:\Windows\System32\hWHhwbj.exe
  C:\Windows\System32\hWHhwbj.exe
  2⤵
  PID:10780
- C:\Windows\System32\kWTrKZY.exe
  C:\Windows\System32\kWTrKZY.exe
  2⤵
  PID:10808
- C:\Windows\System32\LSLASNg.exe
  C:\Windows\System32\LSLASNg.exe
  2⤵
  PID:10836
- C:\Windows\System32\hRTkMGs.exe
  C:\Windows\System32\hRTkMGs.exe
  2⤵
  PID:10864
- C:\Windows\System32\psaQJwu.exe
  C:\Windows\System32\psaQJwu.exe
  2⤵
  PID:10892
- C:\Windows\System32\xTQqYUX.exe
  C:\Windows\System32\xTQqYUX.exe
  2⤵
  PID:10924
- C:\Windows\System32\wZNhuDW.exe
  C:\Windows\System32\wZNhuDW.exe
  2⤵
  PID:10952
- C:\Windows\System32\zlSqVXK.exe
  C:\Windows\System32\zlSqVXK.exe
  2⤵
  PID:10980
- C:\Windows\System32\nWdbwAa.exe
  C:\Windows\System32\nWdbwAa.exe
  2⤵
  PID:11008
- C:\Windows\System32\AEQsrGF.exe
  C:\Windows\System32\AEQsrGF.exe
  2⤵
  PID:11036
- C:\Windows\System32\OvEagdz.exe
  C:\Windows\System32\OvEagdz.exe
  2⤵
  PID:11064
- C:\Windows\System32\ycgZZzM.exe
  C:\Windows\System32\ycgZZzM.exe
  2⤵
  PID:11092
- C:\Windows\System32\EteSHlV.exe
  C:\Windows\System32\EteSHlV.exe
  2⤵
  PID:11120
- C:\Windows\System32\CcrqhYf.exe
  C:\Windows\System32\CcrqhYf.exe
  2⤵
  PID:11148
- C:\Windows\System32\mMGwvka.exe
  C:\Windows\System32\mMGwvka.exe
  2⤵
  PID:11176
- C:\Windows\System32\YSYLWrS.exe
  C:\Windows\System32\YSYLWrS.exe
  2⤵
  PID:11212
- C:\Windows\System32\JLPAbMb.exe
  C:\Windows\System32\JLPAbMb.exe
  2⤵
  PID:11252
- C:\Windows\System32\MtSXGav.exe
  C:\Windows\System32\MtSXGav.exe
  2⤵
  PID:10304
- C:\Windows\System32\HLuSjxR.exe
  C:\Windows\System32\HLuSjxR.exe
  2⤵
  PID:10392
- C:\Windows\System32\hhSvDML.exe
  C:\Windows\System32\hhSvDML.exe
  2⤵
  PID:10456
- C:\Windows\System32\lJzmZgk.exe
  C:\Windows\System32\lJzmZgk.exe
  2⤵
  PID:10516
- C:\Windows\System32\yvVqrcQ.exe
  C:\Windows\System32\yvVqrcQ.exe
  2⤵
  PID:10572
- C:\Windows\System32\nWegJdq.exe
  C:\Windows\System32\nWegJdq.exe
  2⤵
  PID:10644
- C:\Windows\System32\tRcKxZm.exe
  C:\Windows\System32\tRcKxZm.exe
  2⤵
  PID:10712
- C:\Windows\System32\zmQjuNg.exe
  C:\Windows\System32\zmQjuNg.exe
  2⤵
  PID:10792
- C:\Windows\System32\KamhHEH.exe
  C:\Windows\System32\KamhHEH.exe
  2⤵
  PID:10856
- C:\Windows\System32\pjYPobR.exe
  C:\Windows\System32\pjYPobR.exe
  2⤵
  PID:10888
- C:\Windows\System32\kKorbyj.exe
  C:\Windows\System32\kKorbyj.exe
  2⤵
  PID:10964
- C:\Windows\System32\VbLkAML.exe
  C:\Windows\System32\VbLkAML.exe
  2⤵
  PID:11028
- C:\Windows\System32\iGxeWSH.exe
  C:\Windows\System32\iGxeWSH.exe
  2⤵
  PID:11088
- C:\Windows\System32\QvzpvcW.exe
  C:\Windows\System32\QvzpvcW.exe
  2⤵
  PID:11160
- C:\Windows\System32\aMBTgGm.exe
  C:\Windows\System32\aMBTgGm.exe
  2⤵
  PID:11248
- C:\Windows\System32\VDESerA.exe
  C:\Windows\System32\VDESerA.exe
  2⤵
  PID:10364
- C:\Windows\System32\EWsUlWe.exe
  C:\Windows\System32\EWsUlWe.exe
  2⤵
  PID:10512
- C:\Windows\System32\tfkShjA.exe
  C:\Windows\System32\tfkShjA.exe
  2⤵
  PID:10672
- C:\Windows\System32\BseSYZA.exe
  C:\Windows\System32\BseSYZA.exe
  2⤵
  PID:10832
- C:\Windows\System32\XjfyXeX.exe
  C:\Windows\System32\XjfyXeX.exe
  2⤵
  PID:10948
- C:\Windows\System32\diWuLRl.exe
  C:\Windows\System32\diWuLRl.exe
  2⤵
  PID:11136
- C:\Windows\System32\gAoiWtR.exe
  C:\Windows\System32\gAoiWtR.exe
  2⤵
  PID:10344
- C:\Windows\System32\rvmaPFn.exe
  C:\Windows\System32\rvmaPFn.exe
  2⤵
  PID:10628
- C:\Windows\System32\NmXmUMX.exe
  C:\Windows\System32\NmXmUMX.exe
  2⤵
  PID:11060
- C:\Windows\System32\hWyjSUZ.exe
  C:\Windows\System32\hWyjSUZ.exe
  2⤵
  PID:10568
- C:\Windows\System32\HgVgPTE.exe
  C:\Windows\System32\HgVgPTE.exe
  2⤵
  PID:10276
- C:\Windows\System32\JLTbVzL.exe
  C:\Windows\System32\JLTbVzL.exe
  2⤵
  PID:10920
- C:\Windows\System32\KLfimUT.exe
  C:\Windows\System32\KLfimUT.exe
  2⤵
  PID:11288
- C:\Windows\System32\XbfkDGf.exe
  C:\Windows\System32\XbfkDGf.exe
  2⤵
  PID:11316
- C:\Windows\System32\lMEggoA.exe
  C:\Windows\System32\lMEggoA.exe
  2⤵
  PID:11344
- C:\Windows\System32\ctPYEoS.exe
  C:\Windows\System32\ctPYEoS.exe
  2⤵
  PID:11372
- C:\Windows\System32\jDWzNMQ.exe
  C:\Windows\System32\jDWzNMQ.exe
  2⤵
  PID:11400
- C:\Windows\System32\IzZfWrP.exe
  C:\Windows\System32\IzZfWrP.exe
  2⤵
  PID:11428
- C:\Windows\System32\tRsGsBF.exe
  C:\Windows\System32\tRsGsBF.exe
  2⤵
  PID:11456
- C:\Windows\System32\vwzvfOG.exe
  C:\Windows\System32\vwzvfOG.exe
  2⤵
  PID:11484
- C:\Windows\System32\spXSHsh.exe
  C:\Windows\System32\spXSHsh.exe
  2⤵
  PID:11516
- C:\Windows\System32\kMGeKch.exe
  C:\Windows\System32\kMGeKch.exe
  2⤵
  PID:11544
- C:\Windows\System32\YUMArnh.exe
  C:\Windows\System32\YUMArnh.exe
  2⤵
  PID:11572
- C:\Windows\System32\HaRAIyF.exe
  C:\Windows\System32\HaRAIyF.exe
  2⤵
  PID:11600
- C:\Windows\System32\GwfgBcj.exe
  C:\Windows\System32\GwfgBcj.exe
  2⤵
  PID:11632
- C:\Windows\System32\tDseCBr.exe
  C:\Windows\System32\tDseCBr.exe
  2⤵
  PID:11660
- C:\Windows\System32\siIEAoG.exe
  C:\Windows\System32\siIEAoG.exe
  2⤵
  PID:11676
- C:\Windows\System32\yViHXbd.exe
  C:\Windows\System32\yViHXbd.exe
  2⤵
  PID:11728
- C:\Windows\System32\yCyRzxv.exe
  C:\Windows\System32\yCyRzxv.exe
  2⤵
  PID:11748
- C:\Windows\System32\uJDudZr.exe
  C:\Windows\System32\uJDudZr.exe
  2⤵
  PID:11784
- C:\Windows\System32\PMUjXAI.exe
  C:\Windows\System32\PMUjXAI.exe
  2⤵
  PID:11812
- C:\Windows\System32\dPBrwss.exe
  C:\Windows\System32\dPBrwss.exe
  2⤵
  PID:11840
- C:\Windows\System32\kholaza.exe
  C:\Windows\System32\kholaza.exe
  2⤵
  PID:11868
- C:\Windows\System32\JnWDlfK.exe
  C:\Windows\System32\JnWDlfK.exe
  2⤵
  PID:11896
- C:\Windows\System32\DMvehTx.exe
  C:\Windows\System32\DMvehTx.exe
  2⤵
  PID:11924
- C:\Windows\System32\nfYwqQk.exe
  C:\Windows\System32\nfYwqQk.exe
  2⤵
  PID:11952
- C:\Windows\System32\KpFuvYy.exe
  C:\Windows\System32\KpFuvYy.exe
  2⤵
  PID:11980
- C:\Windows\System32\yKQXshF.exe
  C:\Windows\System32\yKQXshF.exe
  2⤵
  PID:12020
- C:\Windows\System32\avSinYs.exe
  C:\Windows\System32\avSinYs.exe
  2⤵
  PID:12036
- C:\Windows\System32\npUNDUc.exe
  C:\Windows\System32\npUNDUc.exe
  2⤵
  PID:12060
- C:\Windows\System32\TffJeUD.exe
  C:\Windows\System32\TffJeUD.exe
  2⤵
  PID:12088
- C:\Windows\System32\vvGcarq.exe
  C:\Windows\System32\vvGcarq.exe
  2⤵
  PID:12120
- C:\Windows\System32\JBBmzxp.exe
  C:\Windows\System32\JBBmzxp.exe
  2⤵
  PID:12148
- C:\Windows\System32\EZTRutg.exe
  C:\Windows\System32\EZTRutg.exe
  2⤵
  PID:12176
- C:\Windows\System32\liKHMba.exe
  C:\Windows\System32\liKHMba.exe
  2⤵
  PID:12204
- C:\Windows\System32\aoBgHcA.exe
  C:\Windows\System32\aoBgHcA.exe
  2⤵
  PID:12232
- C:\Windows\System32\KIKhQUb.exe
  C:\Windows\System32\KIKhQUb.exe
  2⤵
  PID:12260
- C:\Windows\System32\iuwTwpB.exe
  C:\Windows\System32\iuwTwpB.exe
  2⤵
  PID:11272
- C:\Windows\System32\tqDFXvm.exe
  C:\Windows\System32\tqDFXvm.exe
  2⤵
  PID:11356
- C:\Windows\System32\mkbiREX.exe
  C:\Windows\System32\mkbiREX.exe
  2⤵
  PID:11392
- C:\Windows\System32\hxJdgKd.exe
  C:\Windows\System32\hxJdgKd.exe
  2⤵
  PID:11452
- C:\Windows\System32\ESgaScy.exe
  C:\Windows\System32\ESgaScy.exe
  2⤵
  PID:11528
- C:\Windows\System32\WeLOEPy.exe
  C:\Windows\System32\WeLOEPy.exe
  2⤵
  PID:11592
- C:\Windows\System32\hYMFFJO.exe
  C:\Windows\System32\hYMFFJO.exe
  2⤵
  PID:11656
- C:\Windows\System32\wUHuJop.exe
  C:\Windows\System32\wUHuJop.exe
  2⤵
  PID:11740
- C:\Windows\System32\tfQDgvC.exe
  C:\Windows\System32\tfQDgvC.exe
  2⤵
  PID:11808
- C:\Windows\System32\AfPBpgr.exe
  C:\Windows\System32\AfPBpgr.exe
  2⤵
  PID:11880
- C:\Windows\System32\bwzkYGX.exe
  C:\Windows\System32\bwzkYGX.exe
  2⤵
  PID:11944
- C:\Windows\System32\WjBkvvX.exe
  C:\Windows\System32\WjBkvvX.exe
  2⤵
  PID:12016
- C:\Windows\System32\KmYVHpb.exe
  C:\Windows\System32\KmYVHpb.exe
  2⤵
  PID:12080
- C:\Windows\System32\dkjZAQN.exe
  C:\Windows\System32\dkjZAQN.exe
  2⤵
  PID:12140
- C:\Windows\System32\dpHeoOt.exe
  C:\Windows\System32\dpHeoOt.exe
  2⤵
  PID:12200
- C:\Windows\System32\QnrXEos.exe
  C:\Windows\System32\QnrXEos.exe
  2⤵
  PID:12272
- C:\Windows\System32\flaASAv.exe
  C:\Windows\System32\flaASAv.exe
  2⤵
  PID:11368
- C:\Windows\System32\EpgeeEU.exe
  C:\Windows\System32\EpgeeEU.exe
  2⤵
  PID:11512
- C:\Windows\System32\NZEbMHj.exe
  C:\Windows\System32\NZEbMHj.exe
  2⤵
  PID:11700
- C:\Windows\System32\GwTDqJw.exe
  C:\Windows\System32\GwTDqJw.exe
  2⤵
  PID:11860
- C:\Windows\System32\VvvzSxn.exe
  C:\Windows\System32\VvvzSxn.exe
  2⤵
  PID:12000
- C:\Windows\System32\xgmloHU.exe
  C:\Windows\System32\xgmloHU.exe
  2⤵
  PID:12104
- C:\Windows\System32\YbbwWht.exe
  C:\Windows\System32\YbbwWht.exe
  2⤵
  PID:12252
- C:\Windows\System32\VsueTVa.exe
  C:\Windows\System32\VsueTVa.exe
  2⤵
  PID:11508
- C:\Windows\System32\KRxXVxg.exe
  C:\Windows\System32\KRxXVxg.exe
  2⤵
  PID:11936
- C:\Windows\System32\sgVamDV.exe
  C:\Windows\System32\sgVamDV.exe
  2⤵
  PID:12228
- C:\Windows\System32\tNzQTiy.exe
  C:\Windows\System32\tNzQTiy.exe
  2⤵
  PID:12068
- C:\Windows\System32\EjDgulc.exe
  C:\Windows\System32\EjDgulc.exe
  2⤵
  PID:11852
- C:\Windows\System32\rDpiXBO.exe
  C:\Windows\System32\rDpiXBO.exe
  2⤵
  PID:12316
- C:\Windows\System32\zWNlDxL.exe
  C:\Windows\System32\zWNlDxL.exe
  2⤵
  PID:12344
- C:\Windows\System32\vvwRipk.exe
  C:\Windows\System32\vvwRipk.exe
  2⤵
  PID:12372
- C:\Windows\System32\unLqjKS.exe
  C:\Windows\System32\unLqjKS.exe
  2⤵
  PID:12400
- C:\Windows\System32\fAfBJvf.exe
  C:\Windows\System32\fAfBJvf.exe
  2⤵
  PID:12428
- C:\Windows\System32\jlUnKQm.exe
  C:\Windows\System32\jlUnKQm.exe
  2⤵
  PID:12456
- C:\Windows\System32\mITEKQG.exe
  C:\Windows\System32\mITEKQG.exe
  2⤵
  PID:12484
- C:\Windows\System32\jjqpWqR.exe
  C:\Windows\System32\jjqpWqR.exe
  2⤵
  PID:12512
- C:\Windows\System32\wXhlJwK.exe
  C:\Windows\System32\wXhlJwK.exe
  2⤵
  PID:12536
- C:\Windows\System32\ezvaglo.exe
  C:\Windows\System32\ezvaglo.exe
  2⤵
  PID:12568
- C:\Windows\System32\pCraEQg.exe
  C:\Windows\System32\pCraEQg.exe
  2⤵
  PID:12596
- C:\Windows\System32\IwWwbye.exe
  C:\Windows\System32\IwWwbye.exe
  2⤵
  PID:12624
- C:\Windows\System32\fOLMQvA.exe
  C:\Windows\System32\fOLMQvA.exe
  2⤵
  PID:12652
- C:\Windows\System32\NhvwYor.exe
  C:\Windows\System32\NhvwYor.exe
  2⤵
  PID:12680
- C:\Windows\System32\rtVyxxA.exe
  C:\Windows\System32\rtVyxxA.exe
  2⤵
  PID:12708
- C:\Windows\System32\bzOKpCV.exe
  C:\Windows\System32\bzOKpCV.exe
  2⤵
  PID:12736
- C:\Windows\System32\YcNNdfV.exe
  C:\Windows\System32\YcNNdfV.exe
  2⤵
  PID:12764
- C:\Windows\System32\RZDYjsg.exe
  C:\Windows\System32\RZDYjsg.exe
  2⤵
  PID:12792
- C:\Windows\System32\pXhmDxg.exe
  C:\Windows\System32\pXhmDxg.exe
  2⤵
  PID:12820
- C:\Windows\System32\YZEKnFj.exe
  C:\Windows\System32\YZEKnFj.exe
  2⤵
  PID:12848
- C:\Windows\System32\wDilUSe.exe
  C:\Windows\System32\wDilUSe.exe
  2⤵
  PID:12876
- C:\Windows\System32\DGTUHcu.exe
  C:\Windows\System32\DGTUHcu.exe
  2⤵
  PID:12904
- C:\Windows\System32\ZUcccyV.exe
  C:\Windows\System32\ZUcccyV.exe
  2⤵
  PID:12932
- C:\Windows\System32\YUpgXIG.exe
  C:\Windows\System32\YUpgXIG.exe
  2⤵
  PID:12960
- C:\Windows\System32\ZkJjLCA.exe
  C:\Windows\System32\ZkJjLCA.exe
  2⤵
  PID:12988
- C:\Windows\System32\hWkiCHJ.exe
  C:\Windows\System32\hWkiCHJ.exe
  2⤵
  PID:13016
- C:\Windows\System32\fcFnGvL.exe
  C:\Windows\System32\fcFnGvL.exe
  2⤵
  PID:13044
- C:\Windows\System32\iouBszI.exe
  C:\Windows\System32\iouBszI.exe
  2⤵
  PID:13072
- C:\Windows\System32\OdehawX.exe
  C:\Windows\System32\OdehawX.exe
  2⤵
  PID:13100
- C:\Windows\System32\taCnrMX.exe
  C:\Windows\System32\taCnrMX.exe
  2⤵
  PID:13128
- C:\Windows\System32\NCbtVFx.exe
  C:\Windows\System32\NCbtVFx.exe
  2⤵
  PID:13156
- C:\Windows\System32\AiwYOdP.exe
  C:\Windows\System32\AiwYOdP.exe
  2⤵
  PID:13204
- C:\Windows\System32\fFUPxbr.exe
  C:\Windows\System32\fFUPxbr.exe
  2⤵
  PID:13244
- C:\Windows\System32\YTFwFKW.exe
  C:\Windows\System32\YTFwFKW.exe
  2⤵
  PID:13296
- C:\Windows\System32\rWpdzbE.exe
  C:\Windows\System32\rWpdzbE.exe
  2⤵
  PID:12336
- C:\Windows\System32\VHIMuCm.exe
  C:\Windows\System32\VHIMuCm.exe
  2⤵
  PID:12476
- C:\Windows\System32\mtspThT.exe
  C:\Windows\System32\mtspThT.exe
  2⤵
  PID:12524
- C:\Windows\System32\CAYYWHs.exe
  C:\Windows\System32\CAYYWHs.exe
  2⤵
  PID:12636
- C:\Windows\System32\PsPVJlR.exe
  C:\Windows\System32\PsPVJlR.exe
  2⤵
  PID:12704
- C:\Windows\System32\TOGrMSI.exe
  C:\Windows\System32\TOGrMSI.exe
  2⤵
  PID:12784
- C:\Windows\System32\LOftMlU.exe
  C:\Windows\System32\LOftMlU.exe
  2⤵
  PID:12860
- C:\Windows\System32\pQbirVC.exe
  C:\Windows\System32\pQbirVC.exe
  2⤵
  PID:12928
- C:\Windows\System32\QnxKWLU.exe
  C:\Windows\System32\QnxKWLU.exe
  2⤵
  PID:12980
- C:\Windows\System32\LljpZOJ.exe
  C:\Windows\System32\LljpZOJ.exe
  2⤵
  PID:13112
- C:\Windows\System32\FmbVEzX.exe
  C:\Windows\System32\FmbVEzX.exe
  2⤵
  PID:13188
- C:\Windows\System32\Jusyyip.exe
  C:\Windows\System32\Jusyyip.exe
  2⤵
  PID:12308
- C:\Windows\System32\WmzsyeB.exe
  C:\Windows\System32\WmzsyeB.exe
  2⤵
  PID:12496
- C:\Windows\System32\sirMgrB.exe
  C:\Windows\System32\sirMgrB.exe
  2⤵
  PID:12760
- C:\Windows\System32\Xzgoxeh.exe
  C:\Windows\System32\Xzgoxeh.exe
  2⤵
  PID:13168
- C:\Windows\System32\KtchFTD.exe
  C:\Windows\System32\KtchFTD.exe
  2⤵
  PID:11992
- C:\Windows\System32\TqUUUQG.exe
  C:\Windows\System32\TqUUUQG.exe
  2⤵
  PID:4408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

CImOEmx.exe

Path C:\Windows\System32\CImOEmx.exe
Size 2.7MB
SHA256 488c20d7aaa6ace0e951ce6b2d7e2bd08cd19f4b21316ea92fba9245944b0784
MD5 cd386ddfa8dd73fdcdb9e67e23736bfe
SHA1 b1ce5c383b5623e3b67a81c58075fac5daca3b0a
SHA512 9582e024d0b5955bef22cb9bf355bc55fb44b234afba9b5e666af48282b90063ad98dcb9efa57f8b93232d9ab68e7086212f0ed7f5ff92f5c09beee5b60a9893
SSDEEP 49152:w0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzJlR1dqo5LlG6:w0GnJMOWPClFdx6e0EALKWVTffZiPAcj
MD5 SHA1 SHA512 SSDEEP

Submit Download

CPlCfED.exe

Path C:\Windows\System32\CPlCfED.exe
Size 2.7MB
SHA256 459ca0ed8ec89e43906c5012e4359472f89cac0d25566584fae9a3e7900fdc6f
MD5 1ecc277eff2c3de5f4ccabe39214087b
SHA1 a429528f84311c2e874b69fe9a97cc343ad629ba
SHA512 642b93503648f954910618f33afdfa8a6b595dc948ee740c7875c85ae1a5fd8a805c5b8d6274e3723789b8efb32b4261d122604feefc5cc78cb901f60f6cc936
SSDEEP 49152:w0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzJlR1dqo5LlGS:w0GnJMOWPClFdx6e0EALKWVTffZiPAc1
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEJcpeg.exe

Path C:\Windows\System32\DEJcpeg.exe
Size 2.7MB
SHA256 e95e15ba682ed1989964473aac200821ec52306874e3b4432780c399e32f8347
MD5 83fe26df63b33451feede40f59625a5a
SHA1 1ca4592a3cd7718dc37bc758d32cae20c0360a0b
SHA512 2eb06bb082eb61f18dec8031ae9b90f3b9ca220ac9148025f383d567a5c19a5469325fa61bd52f0a758cf8160e686e0c2ef73fa40dc0076e20b31d09b3739df6
SSDEEP 49152:w0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzJlR1dqo5LlG7:w0GnJMOWPClFdx6e0EALKWVTffZiPAcU
MD5 SHA1 SHA512 SSDEEP

Submit Download

EeglnTY.exe

Path C:\Windows\System32\EeglnTY.exe
Size 2.7MB
SHA256 4accde6d0e44ebeb062a85f747f84be5b3a2da32adddb328c15a518d3b2d7102
MD5 a56222a7c8374dc69818d7a0010e973e
SHA1 ef381db8ebfe3e700ee65ada6de414dc12c52f04
SHA512 59edd5cfa49c7f905d04ca72028e5ffdd0152753299bd8ff549bba152a7bc91b9e1470c8353525329d84844d90302430c0db5280cdc81cd10678a298776c2d3e
SSDEEP 49152:w0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzJlR1dqo5LlGu:w0GnJMOWPClFdx6e0EALKWVTffZiPAcf
MD5 SHA1 SHA512 SSDEEP

Submit Download

FbnzKLx.exe

Path C:\Windows\System32\FbnzKLx.exe
Size 2.7MB
SHA256 9e3f11fc7f89bf5ed19c7772b5076ec50118353da9c33bef80988ee5e406984d
MD5 bd8606c448c4dda534128f6cd400b9a8
SHA1 12676c4d1fc95b1626e53f2b7eddcbcd1e6691c9
SHA512 d4f3df60c5f19a2b43f6b631fc195acf169ab197b324fe7eff922e38772f27ab5beaf621602ba8c885f2675eaa3e39ec0d336f2a3765910af26ccdf1e2880cf0
SSDEEP 49152:w0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzJlR1dqo5LlGu:w0GnJMOWPClFdx6e0EALKWVTffZiPAcN
MD5 SHA1 SHA512 SSDEEP

Submit Download

FnXdxgI.exe

Path C:\Windows\System32\FnXdxgI.exe
Size 2.7MB
SHA256 eb92618267a7f346bc754fd941fcd4c844289478a7511474c118d36158bba2f9
MD5 15e33cc662a54bd5f8e7e8b76c8f8d1b
SHA1 4d6551fa4b0bdbc07353e7332316342e73fe90c6
SHA512 b90ea2d940d71af005040411e159ef0502bd7257262eb0fd4c7cec27e46727bd2728b9345a07331c772ca3e1b5cddd28bae01be4d8e5e6ff54cc8e07c4fdc55c
SSDEEP 49152:w0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzJlR1dqo5LlGS:w0GnJMOWPClFdx6e0EALKWVTffZiPAcD
MD5 SHA1 SHA512 SSDEEP

Submit Download

HoiXAsv.exe

Path C:\Windows\System32\HoiXAsv.exe
Size 2.7MB
SHA256 f40de239a616a01f4b969d51b7022ad9fe8ec5d3933797aca1b8a954dc07b06e
MD5 046eeeaf7a7f64d4d4cd9eee9008c519
SHA1 258294856b31651c3b6ed374ae00e243d9d4293a
SHA512 12c0776c7ba119e034180a6d53f73854cf1ea166f5b2f6055c2fd795645baeed667c1d120f84043dc2d859bd7a611399888b8ee9a08744877b1b01a96e1ea19c
SSDEEP 49152:w0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzJlR1dqo5LlG0:w0GnJMOWPClFdx6e0EALKWVTffZiPAcr
MD5 SHA1 SHA512 SSDEEP

Submit Download

KjsOghQ.exe

Path C:\Windows\System32\KjsOghQ.exe
Size 2.7MB
SHA256 068cc9b236a8826a5d1600713658a39ea383cf7a4c948754b631a09cd22f28ef
MD5 04221c67a14a3c9d1a4824581b24af47
SHA1 22bdc688c469df2287f2f2346e7fcf2a1004cd66
SHA512 8ed1cf747e9e91a029595898595af1b096e23d4435e7b6244fdf0906960cfbc29c6bf7e4b57752af1ae0d98093fc7910e7e90ab7b6e246210ada9161a3a2f80f
SSDEEP 49152:w0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzJlR1dqo5LlGD:w0GnJMOWPClFdx6e0EALKWVTffZiPAcM
MD5 SHA1 SHA512 SSDEEP

Submit Download

KtXkWdD.exe

Path C:\Windows\System32\KtXkWdD.exe
Size 2.7MB
SHA256 acb75cb743de5222959a54bdc01b065c8b1aa06fb00ec0f7d709b7904841617f
MD5 f61f998a6249416f42a144997fec4051
SHA1 8cfb43f4665928040365439369ced59c9066b721
SHA512 fff10103b988208477e3237daaa311418eff40e38008092957b5b2b642a2dd3a2524735496f4d82f6e315f59bd6465d3427effdf91accb83e87c6aaa826c9a09
SSDEEP 49152:w0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzJlR1dqo5LlGf:w0GnJMOWPClFdx6e0EALKWVTffZiPAcY
MD5 SHA1 SHA512 SSDEEP

Submit Download

NVkwPGd.exe

Path C:\Windows\System32\NVkwPGd.exe
Size 2.7MB
SHA256 a8c6d7f123bf282549b61a13077943c7a42153f713966188ce6f5ca1f3404456
MD5 5c41047e9e7ef5d785ea93f1587dc0e6
SHA1 7b5e4f8b93f928f4a547bd0b230a8e2f76d03508
SHA512 70dbe13196624c3f4ede23df5a006bd3f912e002e29f1140e1fc0db0fb664b8bbccd34ed04525d88fc53f3588ffa3acaf59c1b47b4f8d269878f5111ca0095c2
SSDEEP 49152:w0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzJlR1dqo5LlGn:w0GnJMOWPClFdx6e0EALKWVTffZiPAcs
MD5 SHA1 SHA512 SSDEEP

Submit Download

NZXyepl.exe

Path C:\Windows\System32\NZXyepl.exe
Size 2.7MB
SHA256 e8e1b56dd067d85cdfa0ca96f55b31d861e7033740ba1c7940def03c2971cf1e
MD5 e68bd2d3bd8ede9c5c861be5989b9c70
SHA1 1c52a41ac481153714ad9d61e71a0b07ed760747
SHA512 d221643db3935a847bf211b1688b36d54e0e3adec82b22d646367bac5874509ed1fdc5cb16ff4f69ae50b1364d4717142deaee1a4de24fd0c6ed164addc9664a
SSDEEP 49152:w0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzJlR1dqo5LlGf:w0GnJMOWPClFdx6e0EALKWVTffZiPAcc
MD5 SHA1 SHA512 SSDEEP

Submit Download

RwtzbkT.exe

Path C:\Windows\System32\RwtzbkT.exe
Size 2.7MB
SHA256 a2922419cfec3bca8a0f26de780f6d41f4a5a4d9c65c8aed2cdd7e26b0780aa3
MD5 3002e5f51f42cf764721a7dc9ccb67c7
SHA1 6d6f6ff43b445eba636682a3220efc1866e3e32d
SHA512 adc77ec817c70a9d8bd7ad2e19c7be87a86499f63a8dbdaa30e5f796bc68960c808473065c837283af9e59c58e373e8c944b0200ef1bc2e542e3490afbda0a8f
SSDEEP 49152:w0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzJlR1dqo5LlGQ:w0GnJMOWPClFdx6e0EALKWVTffZiPAcL
MD5 SHA1 SHA512 SSDEEP

Submit Download

TFbyuWv.exe

Path C:\Windows\System32\TFbyuWv.exe
Size 2.7MB
SHA256 94c1c45a6bb73148cc0e13038513fe414372bd4128ddb131fcd24de96003d854
MD5 979d7107f99bb42527de7e7e0fde21d2
SHA1 40399554c676a39368590cffa45a0c4f999b153b
SHA512 2501349770bf9e74c02e3f61edda63d64ccd5adcf3ca75b22ef9411ba753b88109b0d6f776f59d2b4929b9ad91a52ff51aa25ee397093b3ed69fa6fd40ee5043
SSDEEP 49152:w0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzJlR1dqo5LlG7:w0GnJMOWPClFdx6e0EALKWVTffZiPAcC
MD5 SHA1 SHA512 SSDEEP

Submit Download

UlfckUI.exe

Path C:\Windows\System32\UlfckUI.exe
Size 2.7MB
SHA256 42bbc9f89f787d655a843270b415d3a0821cc32a51b961675ec8fd9d2612d660
MD5 f230bf98e12627437cff21c347489527
SHA1 c9e8f6fa8166784e71587d2938e31b910ade41bd
SHA512 4c0e06dc848fdbcad8be124227ab58235e4fa6493c945ce28aa5f96ae919d813bb94915d0b7e6ac80e25cddb09cccf16603b744f82b54c5c4d39016a6786d0de
SSDEEP 49152:w0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzJlR1dqo5LlGci:w0GnJMOWPClFdx6e0EALKWVTffZiPAcW
MD5 SHA1 SHA512 SSDEEP

Submit Download

UrpUyfL.exe

Path C:\Windows\System32\UrpUyfL.exe
Size 2.7MB
SHA256 c8ea74bcf836e17c1700bb085178a3cb4cfa081b5475b7e1e5e988fbd4c64f46
MD5 707d1a206f950d3ab13b29784a0defa7
SHA1 9b9c2ae1569e26ffb3063ef7bc38f333eac57fa0
SHA512 ce7b9bd1002c9341c62ab575e2d10f02ef8310c5c5671827b2215e6e9a0ed20364bdb3a7aee3a8fac0792576c9583904774ecadf5bbae79e21a1026870457f36
SSDEEP 49152:w0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzJlR1dqo5LlGI:w0GnJMOWPClFdx6e0EALKWVTffZiPAcj
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZYHkGqu.exe

Path C:\Windows\System32\ZYHkGqu.exe
Size 2.7MB
SHA256 66e4fd2fbab57d6f14cc8bb7029da9f688d3b05b5274de16ef54c04523144a57
MD5 890006909d6816bafe6eabf6080544b6
SHA1 1343dbb6de49cd0b82b5295dffebe1034211c438
SHA512 456cdbd0e419afdc052c8f407375a8a563fcaa97be71c190200c6ce61edd20eb6b7abd51a547374f71fcab0adb90c425faf9201c7b64043a6d18463eb15a86a2
SSDEEP 49152:w0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzJlR1dqo5LlGZ:w0GnJMOWPClFdx6e0EALKWVTffZiPAco
MD5 SHA1 SHA512 SSDEEP

Submit Download

aMrXOkt.exe

Path C:\Windows\System32\aMrXOkt.exe
Size 2.7MB
SHA256 30e6cbfc81712bcec02447af9c71ef5e2f27224863a4d8b7e6bc1c2d5397a6fd
MD5 9ba58220427cd5dac6346b6b367690c5
SHA1 7959b37798778ca9b9ba10e286d851f642efde24
SHA512 05ad0802a4cb46a8c997ee1f3d364be0209c009b4c7e5309794822fcc75151fd0eea49a5841c523244ca7b048f7d73b3b91dfb392e449fe5b5304c9f51a67971
SSDEEP 49152:w0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzJlR1dqo5LlGm:w0GnJMOWPClFdx6e0EALKWVTffZiPAcn
MD5 SHA1 SHA512 SSDEEP

Submit Download

bZLPsCY.exe

Path C:\Windows\System32\bZLPsCY.exe
Size 2.7MB
SHA256 7cbe63fb600f440dd0cd2226e9e4a7d27fa944eabcf75637b0d0d5b509bf945b
MD5 872734c624f025d29ec40703ad9d9290
SHA1 7a17a4446d18a5d9e48f100fbb67cff914535c88
SHA512 add5547e7ed2186eddec1413042a1ac7da621ee20b9ee3c9c2b540c7bacbf6377e9a0e1e88619228389f99b29664a977e78eb96f9d8f25f8100eb9649584b4df
SSDEEP 49152:w0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzJlR1dqo5LlGy:w0GnJMOWPClFdx6e0EALKWVTffZiPAcR
MD5 SHA1 SHA512 SSDEEP

Submit Download

dPPICFq.exe

Path C:\Windows\System32\dPPICFq.exe
Size 2.7MB
SHA256 324736d5ece6c32da997aa7487a88fd5341a1d488b3b550700b1c84643badf08
MD5 d182a4ba78d2d9a8d716d8e8b8f82f15
SHA1 972a5d119941b0f63eac0bcc00a6b5b28229aaca
SHA512 ebddc4a6a4a76eb0e010838d78a85c381c6f42f5952f8f05fba0bff2a4350b2c1c9fd9b31bdde9901695407892759bfa2058af2d8dd0b2ea1d6fd3d52dc50bcf
SSDEEP 49152:w0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzJlR1dqo5LlGO:w0GnJMOWPClFdx6e0EALKWVTffZiPAcf
MD5 SHA1 SHA512 SSDEEP

Submit Download

jOFpBtD.exe

Path C:\Windows\System32\jOFpBtD.exe
Size 2.7MB
SHA256 f6c8cb8fe88a833d8a4f596c58ed534d95046788cfbbaef919ad4f62e969acc5
MD5 485012f8a386b2b5d1d6fff63faba823
SHA1 1bc03ad9f0e389bca8048ae28a303345d9e84974
SHA512 1ef9abc8203847d57ff8909a71794fd852baba283078cd8b98489286a3210ee84732b1d277c3dbdfd2d50bbe77a5a70e589bc5f168ad11032d25c272ced3d34d
SSDEEP 49152:w0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzJlR1dqo5LlG0:w0GnJMOWPClFdx6e0EALKWVTffZiPAcT
MD5 SHA1 SHA512 SSDEEP

Submit Download

jRFCoQW.exe

Path C:\Windows\System32\jRFCoQW.exe
Size 2.7MB
SHA256 0a5b86738660eeffe803cc658b49f9e2cfb309623c216e932bd386a0ed0a7361
MD5 ecb7b22cf9b0d383ccce0e2fc8a3db9d
SHA1 a731943a958cc8105f3a49d7748d44c4ea4972dd
SHA512 e53aa69aee4d3e7dcae01237f87dc057c096075d2248d005da331a3d76fbf91bb1b2e04fa9b37ebc0b21803cf671c1503726e8b712225279f444874933d520d0
SSDEEP 49152:w0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzJlR1dqo5LlGL:w0GnJMOWPClFdx6e0EALKWVTffZiPAco
MD5 SHA1 SHA512 SSDEEP

Submit Download

kGUqjTW.exe

Path C:\Windows\System32\kGUqjTW.exe
Size 2.7MB
SHA256 f22462f29f234e9043dccc16d0ccb2106fd164784de77a0315e443cfb67578f0
MD5 3fbd87c2ae3b8c74ec51bacddcdc21bd
SHA1 57618b72eaa4b68963a3bd1de8a8308437a1b016
SHA512 7f5752748d54ecf2ceea9df317a88b28f6cb0e2a800f1d21d443d031bdb8b8c6a875014b10d7abbfa7770015a19ce4af50f7f6f5ada43bf79b7d1556d22bcd7b
SSDEEP 49152:w0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzJlR1dqo5LlGV:w0GnJMOWPClFdx6e0EALKWVTffZiPAcU
MD5 SHA1 SHA512 SSDEEP

Submit Download

kvLpoGq.exe

Path C:\Windows\System32\kvLpoGq.exe
Size 2.7MB
SHA256 dbc63e97d14335804a02b4a69257d80855f52ee54aacc32a336c6fc147abdbc2
MD5 5c5d7ac94b0e0e2c0fb1e6e66da85cdd
SHA1 f773fe2357dfced40ee7f4ab532ee53350b37db6
SHA512 672a60e08131770d37820e54c6caf2469ccac4203dacd0c6618f6d60435a50c20b10a242e2f0cb90bb40d1232696279b685ffbaed23699f921470b94805f2976
SSDEEP 49152:w0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzJlR1dqo5LlGJ:w0GnJMOWPClFdx6e0EALKWVTffZiPAcg
MD5 SHA1 SHA512 SSDEEP

Submit Download

mCWqqyf.exe

Path C:\Windows\System32\mCWqqyf.exe
Size 2.7MB
SHA256 47a002b0d22e0e91fe9fbf6b3250d380b91d8065699ecde26e368546083a04f9
MD5 64b32ab97d6e494c619cfbc40d42eda1
SHA1 2aa92b593f2a85ab03534211fd7d8ad6a8fba655
SHA512 d6f1a69be8848d35a3bf6357fe210fd5f9318f9848eb442590df16c1222be92ddda88a4eee182156b1fc81fb486abeb34d4f1f6a0d0237f7d43e7fbddb2b496e
SSDEEP 49152:w0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzJlR1dqo5LlGO:w0GnJMOWPClFdx6e0EALKWVTffZiPAc7
MD5 SHA1 SHA512 SSDEEP

Submit Download

oZgEJTe.exe

Path C:\Windows\System32\oZgEJTe.exe
Size 2.7MB
SHA256 a12c4cee6bfd05f139292d819a7cae6bc608277a50894b795466af246cd2242f
MD5 d47420a6329401d1b544f8f462a8d700
SHA1 23fb940ed9b7e84dc2a80d0baa80ab9cf54786b9
SHA512 206fa2b41d4685baca92c03be11c867cf4ccb69bcf2ac4749063910f7db40f0e4b9111ecadc5c5ddb3cc8a3dd71f911fd55e6883af8ea4e2abbe45ee5171e1fa
SSDEEP 49152:w0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzJlR1dqo5LlGk:w0GnJMOWPClFdx6e0EALKWVTffZiPAcb
MD5 SHA1 SHA512 SSDEEP

Submit Download

oeHyCfU.exe

Path C:\Windows\System32\oeHyCfU.exe
Size 2.7MB
SHA256 eb3848d4965b0a57d97cf5a262926a4eb20406fb72aa896cedb2aa40a3138b3b
MD5 31d29b895c8279be0ceb24af6a7b1dc5
SHA1 561e41550ca2a9e3ff7086266e8d7946d9003a45
SHA512 d4437034c44b207509530799940da20e34b79ed29a7ef31182aeb86b0ac2e79405fab23f7370ff8739064d54e486ee7f66adfe1f322a1d7979b02da97624f0cf
SSDEEP 49152:w0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzJlR1dqo5LlGX:w0GnJMOWPClFdx6e0EALKWVTffZiPAca
MD5 SHA1 SHA512 SSDEEP

Submit Download

oqpDSKw.exe

Path C:\Windows\System32\oqpDSKw.exe
Size 2.7MB
SHA256 4b831e5730db27ab7460c42a171cc363ef89d119f93b659b8a19c76d3bc50ad4
MD5 56c0241a174d4c39fc4cd767490f79b1
SHA1 12807fac3d9abda84b699509cb790e137a0336ed
SHA512 d551ea9b9e1a3d03cd91de1ded0e74d580decaee2d71f3c1250eee507224b34f770dc8a2063d1901d82506f2a90e04e515db9cd23c910f375ed215b4253850f2
SSDEEP 49152:w0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzJlR1dqo5LlGZ:w0GnJMOWPClFdx6e0EALKWVTffZiPAcE
MD5 SHA1 SHA512 SSDEEP

Submit Download

scatuEB.exe

Path C:\Windows\System32\scatuEB.exe
Size 2.7MB
SHA256 5c11494ce28407454aa01f5e5b93924bd50bea177d1e8d36469ac4c347ea4c57
MD5 5f5c5276bb5a57aa19591f6434daf5a2
SHA1 918a237c21b6106928403bcfe5a5ab73a50a3563
SHA512 0f3731c3ea4ab9b98d683422d8c9146d01abd5bb6eecffbc32f03833057536fdb3c36facba29c4bb402e7435e5ca4ca27b73045d8ef916877f5f757e8ef2615e
SSDEEP 49152:w0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzJlR1dqo5LlGv:w0GnJMOWPClFdx6e0EALKWVTffZiPAcO
MD5 SHA1 SHA512 SSDEEP

Submit Download

tpANoAl.exe

Path C:\Windows\System32\tpANoAl.exe
Size 2.7MB
SHA256 a832e72297718352d45c712b0126522d30cabdfc9f13a62afb3d4b17ec87d92a
MD5 ab76adbacc67f6d92978261265808229
SHA1 d2f579c14aca9f9e8589f3f5efa02ea7d74989d9
SHA512 03ab1b349255114d9b58c68d4c126e83b455d27257762523ac5ff28b2341596cdf30d3dcd08224826497396b537719bcb518c2c93617773b2347dfa786339d9b
SSDEEP 49152:w0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzJlR1dqo5LlG9:w0GnJMOWPClFdx6e0EALKWVTffZiPAcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

vForckp.exe

Path C:\Windows\System32\vForckp.exe
Size 2.7MB
SHA256 4ef33bc4c2d1b9cc396e198a98a7b6301be857ce3a9ef5614606838b3ac7a0ed
MD5 e629fc34521f46efd304e61392b4b7f9
SHA1 813867407ff38ec2d2bd7153dfb6897caf2114ba
SHA512 49635748b47db67aadd53189714474b77335ffe2287082b854172977e8522f13327cbdb4999035327f97f8611c9dffe92441edccb6639cf4936149cb20c4c31a
SSDEEP 49152:w0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzJlR1dqo5LlGs:w0GnJMOWPClFdx6e0EALKWVTffZiPAcJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

xJqGKHU.exe

Path C:\Windows\System32\xJqGKHU.exe
Size 2.7MB
SHA256 c43cc0b9a2d44c08c802bb17f8cfcf92dd998a831e465710bb1b29b56051f320
MD5 dd12629593d918e42f41722befc849fc
SHA1 03eb37cfd00d930b834c6d87aa04d3565b96c232
SHA512 34ab3bdc13cc8eff9e1510b817515c4d86a52c762d80ba6a1c2d0b670c62e4eee9a6888c17988e56a8b4fcb0f83c16dd5bcd138ca8bc2c1126624e9c136e0366
SSDEEP 49152:w0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzJlR1dqo5LlG8h:w0GnJMOWPClFdx6e0EALKWVTffZiPAcJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

zZNkVyL.exe

Path C:\Windows\System32\zZNkVyL.exe
Size 2.7MB
SHA256 0776fdb79457ee1915d3e401506055be0946f09ee60c2febb3e315badcf84641
MD5 b2456edcb972fa2c7e273059ac71f7e9
SHA1 1d96d6e142390c4cd673f9bc4a673c7554327edd
SHA512 49c68bc150db9f710b79240819cab0cc6d010150e01a62107897d3f54c8b53e4237d56ba4515cbe77333e99dd48f277efc7420746164644959f2f6ee2540bfcb
SSDEEP 49152:w0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzJlR1dqo5LlGF:w0GnJMOWPClFdx6e0EALKWVTffZiPAcC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/60-1932-0x00007FF7EF2D0000-0x00007FF7EF6C5000-memory.dmp

Download

memory/60-611-0x00007FF7EF2D0000-0x00007FF7EF6C5000-memory.dmp

Download

memory/220-1921-0x00007FF75B9B0000-0x00007FF75BDA5000-memory.dmp

Download

memory/220-575-0x00007FF75B9B0000-0x00007FF75BDA5000-memory.dmp

Download

memory/420-1920-0x00007FF761340000-0x00007FF761735000-memory.dmp

Download

memory/420-583-0x00007FF761340000-0x00007FF761735000-memory.dmp

Download

memory/548-591-0x00007FF6F4080000-0x00007FF6F4475000-memory.dmp

Download

memory/548-1930-0x00007FF6F4080000-0x00007FF6F4475000-memory.dmp

Download

memory/552-1922-0x00007FF6DD950000-0x00007FF6DDD45000-memory.dmp

Download

memory/552-573-0x00007FF6DD950000-0x00007FF6DDD45000-memory.dmp

Download

memory/876-550-0x00007FF7CEF10000-0x00007FF7CF305000-memory.dmp

Download

memory/876-1925-0x00007FF7CEF10000-0x00007FF7CF305000-memory.dmp

Download

memory/1208-1912-0x00007FF71BC30000-0x00007FF71C025000-memory.dmp

Download

memory/1208-1915-0x00007FF71BC30000-0x00007FF71C025000-memory.dmp

Download

memory/1208-16-0x00007FF71BC30000-0x00007FF71C025000-memory.dmp

Download

memory/1212-1913-0x00007FF6D76C0000-0x00007FF6D7AB5000-memory.dmp

Download

memory/1212-9-0x00007FF6D76C0000-0x00007FF6D7AB5000-memory.dmp

Download

memory/1212-1910-0x00007FF6D76C0000-0x00007FF6D7AB5000-memory.dmp

Download

memory/1464-555-0x00007FF7247A0000-0x00007FF724B95000-memory.dmp

Download

memory/1464-1924-0x00007FF7247A0000-0x00007FF724B95000-memory.dmp

Download

memory/1608-621-0x00007FF7796A0000-0x00007FF779A95000-memory.dmp

Download

memory/1608-1935-0x00007FF7796A0000-0x00007FF779A95000-memory.dmp

Download

memory/2260-1926-0x00007FF7E4500000-0x00007FF7E48F5000-memory.dmp

Download

memory/2260-544-0x00007FF7E4500000-0x00007FF7E48F5000-memory.dmp

Download

memory/2264-542-0x00007FF687C10000-0x00007FF688005000-memory.dmp

Download

memory/2264-1927-0x00007FF687C10000-0x00007FF688005000-memory.dmp

Download

memory/2296-1917-0x00007FF781500000-0x00007FF7818F5000-memory.dmp

Download

memory/2296-539-0x00007FF781500000-0x00007FF7818F5000-memory.dmp

Download

memory/2392-560-0x00007FF678E90000-0x00007FF679285000-memory.dmp

Download

memory/2392-1923-0x00007FF678E90000-0x00007FF679285000-memory.dmp

Download

memory/3096-1911-0x00007FF77D7C0000-0x00007FF77DBB5000-memory.dmp

Download

memory/3096-14-0x00007FF77D7C0000-0x00007FF77DBB5000-memory.dmp

Download

memory/3096-1914-0x00007FF77D7C0000-0x00007FF77DBB5000-memory.dmp

Download

memory/3412-1933-0x00007FF76EED0000-0x00007FF76F2C5000-memory.dmp

Download

memory/3412-614-0x00007FF76EED0000-0x00007FF76F2C5000-memory.dmp

Download

memory/3472-543-0x00007FF7267C0000-0x00007FF726BB5000-memory.dmp

Download

memory/3472-1929-0x00007FF7267C0000-0x00007FF726BB5000-memory.dmp

Download

memory/3536-1916-0x00007FF6F7FB0000-0x00007FF6F83A5000-memory.dmp

Download

memory/3536-540-0x00007FF6F7FB0000-0x00007FF6F83A5000-memory.dmp

Download

memory/3584-1934-0x00007FF648420000-0x00007FF648815000-memory.dmp

Download

memory/3584-618-0x00007FF648420000-0x00007FF648815000-memory.dmp

Download

memory/3648-1-0x00000213E9AD0000-0x00000213E9AE0000-memory.dmp

Download

memory/3648-0-0x00007FF7E5D90000-0x00007FF7E6185000-memory.dmp

Download

memory/3648-1909-0x00007FF7E5D90000-0x00007FF7E6185000-memory.dmp

Download

memory/4116-1928-0x00007FF60EFF0000-0x00007FF60F3E5000-memory.dmp

Download

memory/4116-595-0x00007FF60EFF0000-0x00007FF60F3E5000-memory.dmp

Download

memory/4476-1919-0x00007FF6ABC90000-0x00007FF6AC085000-memory.dmp

Download

memory/4476-541-0x00007FF6ABC90000-0x00007FF6AC085000-memory.dmp

Download

memory/4728-1931-0x00007FF634770000-0x00007FF634B65000-memory.dmp

Download

memory/4728-605-0x00007FF634770000-0x00007FF634B65000-memory.dmp

Download

memory/4780-1936-0x00007FF76E100000-0x00007FF76E4F5000-memory.dmp

Download

memory/4780-624-0x00007FF76E100000-0x00007FF76E4F5000-memory.dmp

Download

memory/4984-26-0x00007FF6DA150000-0x00007FF6DA545000-memory.dmp

Download

memory/4984-1918-0x00007FF6DA150000-0x00007FF6DA545000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads