xmrig | a0a47c3ab8c99281b2d9eec1eaae2c6b4d5b17ee7b6ee4fca598c7d48bfaaa97

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 08:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
Size 3.3MB
Sample240613-kk16vsvgkm
SHA256 a0a47c3ab8c99281b2d9eec1eaae2c6b4d5b17ee7b6ee4fca598c7d48bfaaa97
MD5 6d9d1b254c6323f36353bfc81d233f20
SHA1 a4c85a31d632b61a9b6fa21aa96d3dfece6d67a2
SHA512 0b4935bf43525439cd5aa3f22c2484ccfec18c0caf89e58cad8a1e4d7542958c3c6c0f81fca39debee71d01b7bc17c2dad39fbafbcbe832814195e1d5f9112f5
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4i:wFWPClFy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2800-0-0x00007FF786380000-0x00007FF786775000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fc-8.dat	xmrig
behavioral2/files/0x00080000000233f7-11.dat	xmrig
behavioral2/files/0x00090000000233e8-5.dat	xmrig
behavioral2/files/0x00070000000233fe-27.dat	xmrig
behavioral2/files/0x0007000000023400-35.dat	xmrig
behavioral2/files/0x0007000000023401-40.dat	xmrig
behavioral2/files/0x0007000000023402-45.dat	xmrig
behavioral2/files/0x0007000000023403-50.dat	xmrig
behavioral2/files/0x0007000000023405-60.dat	xmrig
behavioral2/files/0x0007000000023407-73.dat	xmrig
behavioral2/files/0x000700000002340b-93.dat	xmrig
behavioral2/files/0x0007000000023410-115.dat	xmrig
behavioral2/files/0x0007000000023412-128.dat	xmrig
behavioral2/files/0x0007000000023415-142.dat	xmrig
behavioral2/memory/4484-671-0x00007FF6F49D0000-0x00007FF6F4DC5000-memory.dmp	xmrig
behavioral2/memory/2836-670-0x00007FF635F00000-0x00007FF6362F5000-memory.dmp	xmrig
behavioral2/memory/2136-672-0x00007FF7B8DF0000-0x00007FF7B91E5000-memory.dmp	xmrig
behavioral2/memory/2424-673-0x00007FF655F60000-0x00007FF656355000-memory.dmp	xmrig
behavioral2/memory/3936-674-0x00007FF7A6C50000-0x00007FF7A7045000-memory.dmp	xmrig
behavioral2/memory/1740-676-0x00007FF7B6760000-0x00007FF7B6B55000-memory.dmp	xmrig
behavioral2/memory/1644-675-0x00007FF697000000-0x00007FF6973F5000-memory.dmp	xmrig
behavioral2/memory/2616-685-0x00007FF710D60000-0x00007FF711155000-memory.dmp	xmrig
behavioral2/memory/2180-689-0x00007FF67E8C0000-0x00007FF67ECB5000-memory.dmp	xmrig
behavioral2/memory/400-706-0x00007FF7E9290000-0x00007FF7E9685000-memory.dmp	xmrig
behavioral2/memory/3084-714-0x00007FF65B7F0000-0x00007FF65BBE5000-memory.dmp	xmrig
behavioral2/memory/2952-721-0x00007FF70E940000-0x00007FF70ED35000-memory.dmp	xmrig
behavioral2/memory/2200-724-0x00007FF7A9F10000-0x00007FF7AA305000-memory.dmp	xmrig
behavioral2/memory/3852-725-0x00007FF775090000-0x00007FF775485000-memory.dmp	xmrig
behavioral2/memory/4432-731-0x00007FF7600E0000-0x00007FF7604D5000-memory.dmp	xmrig
behavioral2/memory/5112-742-0x00007FF7077C0000-0x00007FF707BB5000-memory.dmp	xmrig
behavioral2/memory/3764-747-0x00007FF7DD7B0000-0x00007FF7DDBA5000-memory.dmp	xmrig
behavioral2/memory/4324-736-0x00007FF7614A0000-0x00007FF761895000-memory.dmp	xmrig
behavioral2/memory/4944-729-0x00007FF79B6F0000-0x00007FF79BAE5000-memory.dmp	xmrig
behavioral2/memory/1344-701-0x00007FF604730000-0x00007FF604B25000-memory.dmp	xmrig
behavioral2/memory/3996-696-0x00007FF796100000-0x00007FF7964F5000-memory.dmp	xmrig
behavioral2/memory/3584-690-0x00007FF665980000-0x00007FF665D75000-memory.dmp	xmrig
behavioral2/memory/2268-679-0x00007FF6C3740000-0x00007FF6C3B35000-memory.dmp	xmrig
behavioral2/files/0x0007000000023419-163.dat	xmrig
behavioral2/files/0x0007000000023418-158.dat	xmrig
behavioral2/files/0x0007000000023417-153.dat	xmrig
behavioral2/files/0x0007000000023416-148.dat	xmrig
behavioral2/files/0x0007000000023414-138.dat	xmrig
behavioral2/files/0x0007000000023413-133.dat	xmrig
behavioral2/files/0x0007000000023411-123.dat	xmrig
behavioral2/files/0x000700000002340f-112.dat	xmrig
behavioral2/files/0x000700000002340e-108.dat	xmrig
behavioral2/files/0x000700000002340d-102.dat	xmrig
behavioral2/files/0x000700000002340c-98.dat	xmrig
behavioral2/files/0x000700000002340a-88.dat	xmrig
behavioral2/files/0x0007000000023409-82.dat	xmrig
behavioral2/files/0x0007000000023408-78.dat	xmrig
behavioral2/files/0x0007000000023406-68.dat	xmrig
behavioral2/files/0x0007000000023404-57.dat	xmrig
behavioral2/files/0x00070000000233ff-32.dat	xmrig
behavioral2/files/0x00070000000233fd-22.dat	xmrig
behavioral2/memory/548-16-0x00007FF66D6F0000-0x00007FF66DAE5000-memory.dmp	xmrig
behavioral2/memory/5112-1918-0x00007FF7077C0000-0x00007FF707BB5000-memory.dmp	xmrig
behavioral2/memory/548-1917-0x00007FF66D6F0000-0x00007FF66DAE5000-memory.dmp	xmrig
behavioral2/memory/2836-1919-0x00007FF635F00000-0x00007FF6362F5000-memory.dmp	xmrig
behavioral2/memory/2136-1925-0x00007FF7B8DF0000-0x00007FF7B91E5000-memory.dmp	xmrig
behavioral2/memory/2616-1928-0x00007FF710D60000-0x00007FF711155000-memory.dmp	xmrig
behavioral2/memory/1644-1927-0x00007FF697000000-0x00007FF6973F5000-memory.dmp	xmrig
behavioral2/memory/3764-1926-0x00007FF7DD7B0000-0x00007FF7DDBA5000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
548	TygpnsY.exe
5112	TZmUgIs.exe
2836	zesUcQQ.exe
3764	URAtZQA.exe
4484	VUtEpFB.exe
2136	KHvigDX.exe
2424	BCAYCDa.exe
3936	wLdPHjT.exe
1644	OEBbiHi.exe
1740	xYBjGtB.exe
2268	xLJBkhq.exe
2616	BiDCXpH.exe
2180	gGkkqAY.exe
3584	cqrVbPH.exe
3996	bunfoue.exe
1344	ZJgRpUz.exe
400	ixPbgMn.exe
3084	otHZqhr.exe
2952	OfPwXBb.exe
2200	kWwEEhl.exe
3852	sqeNxlY.exe
4944	mafuHiJ.exe
4432	VnmkKCy.exe
4324	plyCvJk.exe
2264	fovrqhK.exe
4116	WmHTCCH.exe
208	CtwmqHL.exe
3760	hCgKVip.exe
1352	LREbjFm.exe
4380	swSCbZZ.exe
3260	QYRcOcl.exe
4088	dsBCocp.exe
496	jneaLmL.exe
3288	YWHxxmb.exe
4596	iRipulv.exe
1888	SZETASL.exe
1632	ceicBiV.exe
3600	WzjKSaQ.exe
2964	tVFbyGh.exe
5068	gWUJfdx.exe
5092	mvcnIst.exe
3124	ENpGmqh.exe
1116	NefVRuD.exe
2844	YywnRUL.exe
3928	ykjyJMe.exe
3432	WkNPxeA.exe
4976	llekMoT.exe
1744	JDMEpIV.exe
1264	QDAsqyw.exe
2440	PyGALSO.exe
3056	kvfXRHI.exe
2152	eVNASAL.exe
2660	rAaCdqF.exe
4424	jfnWLKk.exe
5056	ZsAQyCy.exe
4440	AlemGDa.exe
3404	yjumTKb.exe
1372	DaymFxw.exe
3248	aDhnubp.exe
2728	OVqJJIL.exe
1012	oMpzdyV.exe
4152	qoSpCqT.exe
5016	IlDyJCU.exe
1764	EGZHoLY.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2800-0-0x00007FF786380000-0x00007FF786775000-memory.dmp	upx
behavioral2/files/0x00070000000233fc-8.dat	upx
behavioral2/files/0x00080000000233f7-11.dat	upx
behavioral2/files/0x00090000000233e8-5.dat	upx
behavioral2/files/0x00070000000233fe-27.dat	upx
behavioral2/files/0x0007000000023400-35.dat	upx
behavioral2/files/0x0007000000023401-40.dat	upx
behavioral2/files/0x0007000000023402-45.dat	upx
behavioral2/files/0x0007000000023403-50.dat	upx
behavioral2/files/0x0007000000023405-60.dat	upx
behavioral2/files/0x0007000000023407-73.dat	upx
behavioral2/files/0x000700000002340b-93.dat	upx
behavioral2/files/0x0007000000023410-115.dat	upx
behavioral2/files/0x0007000000023412-128.dat	upx
behavioral2/files/0x0007000000023415-142.dat	upx
behavioral2/memory/4484-671-0x00007FF6F49D0000-0x00007FF6F4DC5000-memory.dmp	upx
behavioral2/memory/2836-670-0x00007FF635F00000-0x00007FF6362F5000-memory.dmp	upx
behavioral2/memory/2136-672-0x00007FF7B8DF0000-0x00007FF7B91E5000-memory.dmp	upx
behavioral2/memory/2424-673-0x00007FF655F60000-0x00007FF656355000-memory.dmp	upx
behavioral2/memory/3936-674-0x00007FF7A6C50000-0x00007FF7A7045000-memory.dmp	upx
behavioral2/memory/1740-676-0x00007FF7B6760000-0x00007FF7B6B55000-memory.dmp	upx
behavioral2/memory/1644-675-0x00007FF697000000-0x00007FF6973F5000-memory.dmp	upx
behavioral2/memory/2616-685-0x00007FF710D60000-0x00007FF711155000-memory.dmp	upx
behavioral2/memory/2180-689-0x00007FF67E8C0000-0x00007FF67ECB5000-memory.dmp	upx
behavioral2/memory/400-706-0x00007FF7E9290000-0x00007FF7E9685000-memory.dmp	upx
behavioral2/memory/3084-714-0x00007FF65B7F0000-0x00007FF65BBE5000-memory.dmp	upx
behavioral2/memory/2952-721-0x00007FF70E940000-0x00007FF70ED35000-memory.dmp	upx
behavioral2/memory/2200-724-0x00007FF7A9F10000-0x00007FF7AA305000-memory.dmp	upx
behavioral2/memory/3852-725-0x00007FF775090000-0x00007FF775485000-memory.dmp	upx
behavioral2/memory/4432-731-0x00007FF7600E0000-0x00007FF7604D5000-memory.dmp	upx
behavioral2/memory/5112-742-0x00007FF7077C0000-0x00007FF707BB5000-memory.dmp	upx
behavioral2/memory/3764-747-0x00007FF7DD7B0000-0x00007FF7DDBA5000-memory.dmp	upx
behavioral2/memory/4324-736-0x00007FF7614A0000-0x00007FF761895000-memory.dmp	upx
behavioral2/memory/4944-729-0x00007FF79B6F0000-0x00007FF79BAE5000-memory.dmp	upx
behavioral2/memory/1344-701-0x00007FF604730000-0x00007FF604B25000-memory.dmp	upx
behavioral2/memory/3996-696-0x00007FF796100000-0x00007FF7964F5000-memory.dmp	upx
behavioral2/memory/3584-690-0x00007FF665980000-0x00007FF665D75000-memory.dmp	upx
behavioral2/memory/2268-679-0x00007FF6C3740000-0x00007FF6C3B35000-memory.dmp	upx
behavioral2/files/0x0007000000023419-163.dat	upx
behavioral2/files/0x0007000000023418-158.dat	upx
behavioral2/files/0x0007000000023417-153.dat	upx
behavioral2/files/0x0007000000023416-148.dat	upx
behavioral2/files/0x0007000000023414-138.dat	upx
behavioral2/files/0x0007000000023413-133.dat	upx
behavioral2/files/0x0007000000023411-123.dat	upx
behavioral2/files/0x000700000002340f-112.dat	upx
behavioral2/files/0x000700000002340e-108.dat	upx
behavioral2/files/0x000700000002340d-102.dat	upx
behavioral2/files/0x000700000002340c-98.dat	upx
behavioral2/files/0x000700000002340a-88.dat	upx
behavioral2/files/0x0007000000023409-82.dat	upx
behavioral2/files/0x0007000000023408-78.dat	upx
behavioral2/files/0x0007000000023406-68.dat	upx
behavioral2/files/0x0007000000023404-57.dat	upx
behavioral2/files/0x00070000000233ff-32.dat	upx
behavioral2/files/0x00070000000233fd-22.dat	upx
behavioral2/memory/548-16-0x00007FF66D6F0000-0x00007FF66DAE5000-memory.dmp	upx
behavioral2/memory/5112-1918-0x00007FF7077C0000-0x00007FF707BB5000-memory.dmp	upx
behavioral2/memory/548-1917-0x00007FF66D6F0000-0x00007FF66DAE5000-memory.dmp	upx
behavioral2/memory/2836-1919-0x00007FF635F00000-0x00007FF6362F5000-memory.dmp	upx
behavioral2/memory/2136-1925-0x00007FF7B8DF0000-0x00007FF7B91E5000-memory.dmp	upx
behavioral2/memory/2616-1928-0x00007FF710D60000-0x00007FF711155000-memory.dmp	upx
behavioral2/memory/1644-1927-0x00007FF697000000-0x00007FF6973F5000-memory.dmp	upx
behavioral2/memory/3764-1926-0x00007FF7DD7B0000-0x00007FF7DDBA5000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\tPuCVbC.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\QKIHLKu.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\rwFqykz.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\ZbFNWKM.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\kQFLLyd.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\dPPTzXY.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\URFoLRl.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\MQeoYJV.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\DEYQqTE.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\iSIcaEJ.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\ylusDyG.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\yFwmXSC.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\vybXKqt.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\USljmrZ.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\tPtHReH.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\rpWtUdd.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\JKProNf.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\ZywteRk.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\XjwNrVc.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\WzjKSaQ.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\PMqnQRq.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\eHjjRbL.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\YPLTnyU.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\DGZJKKP.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\jmtZuLM.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\bunfoue.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\mtWGgvi.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\DfTyqxQ.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\YxwYyBP.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\VwSsXAM.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\UNagBjX.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\nQZyVxl.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\KabbWxB.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\IJVMDmB.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\xIPzRsb.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\trTkLZG.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\aNckJaT.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\DbuzPek.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\ZJgRpUz.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\PyGALSO.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\TozLAqf.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\wVWcsEu.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\EOrzQSq.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\YhxwGPs.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\ajOhXaX.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\ZbenmoC.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\KHvigDX.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\kLGNKtJ.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\mrIOvmG.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\anBcwGN.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\WwkacqX.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\uSIhIQB.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\EhDzIuO.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\OwoBKQD.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\BQsriAx.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\cqrVbPH.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\CZKCgRy.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\vxwBLKi.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\bsVzTEK.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\wAwTkXf.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\ArLHJAk.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\fFvGmno.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\HeBDPAP.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
File created	C:\Windows\System32\XHIhovR.exe	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 548	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	82
PID 2800 wrote to memory of 548	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	82
PID 2800 wrote to memory of 5112	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	83
PID 2800 wrote to memory of 5112	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	83
PID 2800 wrote to memory of 2836	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	84
PID 2800 wrote to memory of 2836	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	84
PID 2800 wrote to memory of 3764	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	85
PID 2800 wrote to memory of 3764	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	85
PID 2800 wrote to memory of 4484	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	86
PID 2800 wrote to memory of 4484	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	86
PID 2800 wrote to memory of 2136	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	87
PID 2800 wrote to memory of 2136	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	87
PID 2800 wrote to memory of 2424	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	88
PID 2800 wrote to memory of 2424	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	88
PID 2800 wrote to memory of 3936	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	89
PID 2800 wrote to memory of 3936	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	89
PID 2800 wrote to memory of 1644	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	90
PID 2800 wrote to memory of 1644	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	90
PID 2800 wrote to memory of 1740	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	91
PID 2800 wrote to memory of 1740	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	91
PID 2800 wrote to memory of 2268	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	92
PID 2800 wrote to memory of 2268	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	92
PID 2800 wrote to memory of 2616	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	93
PID 2800 wrote to memory of 2616	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	93
PID 2800 wrote to memory of 2180	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	94
PID 2800 wrote to memory of 2180	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	94
PID 2800 wrote to memory of 3584	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	95
PID 2800 wrote to memory of 3584	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	95
PID 2800 wrote to memory of 3996	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	96
PID 2800 wrote to memory of 3996	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	96
PID 2800 wrote to memory of 1344	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	97
PID 2800 wrote to memory of 1344	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	97
PID 2800 wrote to memory of 400	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	98
PID 2800 wrote to memory of 400	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	98
PID 2800 wrote to memory of 3084	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	99
PID 2800 wrote to memory of 3084	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	99
PID 2800 wrote to memory of 2952	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	100
PID 2800 wrote to memory of 2952	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	100
PID 2800 wrote to memory of 2200	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	101
PID 2800 wrote to memory of 2200	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	101
PID 2800 wrote to memory of 3852	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	102
PID 2800 wrote to memory of 3852	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	102
PID 2800 wrote to memory of 4944	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	103
PID 2800 wrote to memory of 4944	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	103
PID 2800 wrote to memory of 4432	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	104
PID 2800 wrote to memory of 4432	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	104
PID 2800 wrote to memory of 4324	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	105
PID 2800 wrote to memory of 4324	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	105
PID 2800 wrote to memory of 2264	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	106
PID 2800 wrote to memory of 2264	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	106
PID 2800 wrote to memory of 4116	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	107
PID 2800 wrote to memory of 4116	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	107
PID 2800 wrote to memory of 208	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	108
PID 2800 wrote to memory of 208	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	108
PID 2800 wrote to memory of 3760	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	109
PID 2800 wrote to memory of 3760	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	109
PID 2800 wrote to memory of 1352	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	110
PID 2800 wrote to memory of 1352	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	110
PID 2800 wrote to memory of 4380	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	111
PID 2800 wrote to memory of 4380	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	111
PID 2800 wrote to memory of 3260	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	112
PID 2800 wrote to memory of 3260	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	112
PID 2800 wrote to memory of 4088	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	113
PID 2800 wrote to memory of 4088	2800	6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe	113

C:\Users\Admin\AppData\Local\Temp\6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6d9d1b254c6323f36353bfc81d233f20_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\System32\TygpnsY.exe
  C:\Windows\System32\TygpnsY.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System32\TZmUgIs.exe
  C:\Windows\System32\TZmUgIs.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System32\zesUcQQ.exe
  C:\Windows\System32\zesUcQQ.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System32\URAtZQA.exe
  C:\Windows\System32\URAtZQA.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System32\VUtEpFB.exe
  C:\Windows\System32\VUtEpFB.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System32\KHvigDX.exe
  C:\Windows\System32\KHvigDX.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System32\BCAYCDa.exe
  C:\Windows\System32\BCAYCDa.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System32\wLdPHjT.exe
  C:\Windows\System32\wLdPHjT.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System32\OEBbiHi.exe
  C:\Windows\System32\OEBbiHi.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System32\xYBjGtB.exe
  C:\Windows\System32\xYBjGtB.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System32\xLJBkhq.exe
  C:\Windows\System32\xLJBkhq.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System32\BiDCXpH.exe
  C:\Windows\System32\BiDCXpH.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System32\gGkkqAY.exe
  C:\Windows\System32\gGkkqAY.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System32\cqrVbPH.exe
  C:\Windows\System32\cqrVbPH.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System32\bunfoue.exe
  C:\Windows\System32\bunfoue.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System32\ZJgRpUz.exe
  C:\Windows\System32\ZJgRpUz.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System32\ixPbgMn.exe
  C:\Windows\System32\ixPbgMn.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System32\otHZqhr.exe
  C:\Windows\System32\otHZqhr.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System32\OfPwXBb.exe
  C:\Windows\System32\OfPwXBb.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System32\kWwEEhl.exe
  C:\Windows\System32\kWwEEhl.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System32\sqeNxlY.exe
  C:\Windows\System32\sqeNxlY.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System32\mafuHiJ.exe
  C:\Windows\System32\mafuHiJ.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System32\VnmkKCy.exe
  C:\Windows\System32\VnmkKCy.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System32\plyCvJk.exe
  C:\Windows\System32\plyCvJk.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System32\fovrqhK.exe
  C:\Windows\System32\fovrqhK.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System32\WmHTCCH.exe
  C:\Windows\System32\WmHTCCH.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System32\CtwmqHL.exe
  C:\Windows\System32\CtwmqHL.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System32\hCgKVip.exe
  C:\Windows\System32\hCgKVip.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System32\LREbjFm.exe
  C:\Windows\System32\LREbjFm.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System32\swSCbZZ.exe
  C:\Windows\System32\swSCbZZ.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System32\QYRcOcl.exe
  C:\Windows\System32\QYRcOcl.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System32\dsBCocp.exe
  C:\Windows\System32\dsBCocp.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System32\jneaLmL.exe
  C:\Windows\System32\jneaLmL.exe
  2⤵
  - Executes dropped EXE
  PID:496
- C:\Windows\System32\YWHxxmb.exe
  C:\Windows\System32\YWHxxmb.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System32\iRipulv.exe
  C:\Windows\System32\iRipulv.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System32\SZETASL.exe
  C:\Windows\System32\SZETASL.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System32\ceicBiV.exe
  C:\Windows\System32\ceicBiV.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System32\WzjKSaQ.exe
  C:\Windows\System32\WzjKSaQ.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System32\tVFbyGh.exe
  C:\Windows\System32\tVFbyGh.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System32\gWUJfdx.exe
  C:\Windows\System32\gWUJfdx.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System32\mvcnIst.exe
  C:\Windows\System32\mvcnIst.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System32\ENpGmqh.exe
  C:\Windows\System32\ENpGmqh.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System32\NefVRuD.exe
  C:\Windows\System32\NefVRuD.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System32\YywnRUL.exe
  C:\Windows\System32\YywnRUL.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System32\ykjyJMe.exe
  C:\Windows\System32\ykjyJMe.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System32\WkNPxeA.exe
  C:\Windows\System32\WkNPxeA.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System32\llekMoT.exe
  C:\Windows\System32\llekMoT.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System32\JDMEpIV.exe
  C:\Windows\System32\JDMEpIV.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System32\QDAsqyw.exe
  C:\Windows\System32\QDAsqyw.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System32\PyGALSO.exe
  C:\Windows\System32\PyGALSO.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System32\kvfXRHI.exe
  C:\Windows\System32\kvfXRHI.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System32\eVNASAL.exe
  C:\Windows\System32\eVNASAL.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System32\rAaCdqF.exe
  C:\Windows\System32\rAaCdqF.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System32\jfnWLKk.exe
  C:\Windows\System32\jfnWLKk.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System32\ZsAQyCy.exe
  C:\Windows\System32\ZsAQyCy.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System32\AlemGDa.exe
  C:\Windows\System32\AlemGDa.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System32\yjumTKb.exe
  C:\Windows\System32\yjumTKb.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System32\DaymFxw.exe
  C:\Windows\System32\DaymFxw.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System32\aDhnubp.exe
  C:\Windows\System32\aDhnubp.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System32\OVqJJIL.exe
  C:\Windows\System32\OVqJJIL.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System32\oMpzdyV.exe
  C:\Windows\System32\oMpzdyV.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System32\qoSpCqT.exe
  C:\Windows\System32\qoSpCqT.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System32\IlDyJCU.exe
  C:\Windows\System32\IlDyJCU.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System32\EGZHoLY.exe
  C:\Windows\System32\EGZHoLY.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System32\kfZwUho.exe
  C:\Windows\System32\kfZwUho.exe
  2⤵
  PID:4908
- C:\Windows\System32\GFlThMk.exe
  C:\Windows\System32\GFlThMk.exe
  2⤵
  PID:2840
- C:\Windows\System32\CaACmuo.exe
  C:\Windows\System32\CaACmuo.exe
  2⤵
  PID:2524
- C:\Windows\System32\mZYQpfn.exe
  C:\Windows\System32\mZYQpfn.exe
  2⤵
  PID:2428
- C:\Windows\System32\FSXeSnh.exe
  C:\Windows\System32\FSXeSnh.exe
  2⤵
  PID:604
- C:\Windows\System32\iSIcaEJ.exe
  C:\Windows\System32\iSIcaEJ.exe
  2⤵
  PID:3744
- C:\Windows\System32\BXgUiHt.exe
  C:\Windows\System32\BXgUiHt.exe
  2⤵
  PID:1184
- C:\Windows\System32\oudCMai.exe
  C:\Windows\System32\oudCMai.exe
  2⤵
  PID:1836
- C:\Windows\System32\tGndJpy.exe
  C:\Windows\System32\tGndJpy.exe
  2⤵
  PID:4912
- C:\Windows\System32\KJrPywL.exe
  C:\Windows\System32\KJrPywL.exe
  2⤵
  PID:1784
- C:\Windows\System32\zHaCSbe.exe
  C:\Windows\System32\zHaCSbe.exe
  2⤵
  PID:2648
- C:\Windows\System32\bsKMTgD.exe
  C:\Windows\System32\bsKMTgD.exe
  2⤵
  PID:2112
- C:\Windows\System32\KkTdSFO.exe
  C:\Windows\System32\KkTdSFO.exe
  2⤵
  PID:4448
- C:\Windows\System32\KeYYfQj.exe
  C:\Windows\System32\KeYYfQj.exe
  2⤵
  PID:2636
- C:\Windows\System32\WHLBspH.exe
  C:\Windows\System32\WHLBspH.exe
  2⤵
  PID:4056
- C:\Windows\System32\DDnuMes.exe
  C:\Windows\System32\DDnuMes.exe
  2⤵
  PID:2656
- C:\Windows\System32\eDBdMQN.exe
  C:\Windows\System32\eDBdMQN.exe
  2⤵
  PID:4536
- C:\Windows\System32\mcwyLaO.exe
  C:\Windows\System32\mcwyLaO.exe
  2⤵
  PID:3504
- C:\Windows\System32\ykWcDnh.exe
  C:\Windows\System32\ykWcDnh.exe
  2⤵
  PID:1124
- C:\Windows\System32\feUQxgE.exe
  C:\Windows\System32\feUQxgE.exe
  2⤵
  PID:1060
- C:\Windows\System32\NyRkssJ.exe
  C:\Windows\System32\NyRkssJ.exe
  2⤵
  PID:3520
- C:\Windows\System32\QmWOUKp.exe
  C:\Windows\System32\QmWOUKp.exe
  2⤵
  PID:2060
- C:\Windows\System32\wdsYCeQ.exe
  C:\Windows\System32\wdsYCeQ.exe
  2⤵
  PID:4308
- C:\Windows\System32\obMKMae.exe
  C:\Windows\System32\obMKMae.exe
  2⤵
  PID:4580
- C:\Windows\System32\CZYhJEc.exe
  C:\Windows\System32\CZYhJEc.exe
  2⤵
  PID:3264
- C:\Windows\System32\GbNdKQV.exe
  C:\Windows\System32\GbNdKQV.exe
  2⤵
  PID:4712
- C:\Windows\System32\MFsClEv.exe
  C:\Windows\System32\MFsClEv.exe
  2⤵
  PID:3044
- C:\Windows\System32\maOjlqM.exe
  C:\Windows\System32\maOjlqM.exe
  2⤵
  PID:5136
- C:\Windows\System32\JKFmeNL.exe
  C:\Windows\System32\JKFmeNL.exe
  2⤵
  PID:5164
- C:\Windows\System32\JaihGbR.exe
  C:\Windows\System32\JaihGbR.exe
  2⤵
  PID:5192
- C:\Windows\System32\ymGVVGY.exe
  C:\Windows\System32\ymGVVGY.exe
  2⤵
  PID:5220
- C:\Windows\System32\tVSjKCc.exe
  C:\Windows\System32\tVSjKCc.exe
  2⤵
  PID:5248
- C:\Windows\System32\XHIhovR.exe
  C:\Windows\System32\XHIhovR.exe
  2⤵
  PID:5276
- C:\Windows\System32\WKYlPqy.exe
  C:\Windows\System32\WKYlPqy.exe
  2⤵
  PID:5304
- C:\Windows\System32\UdovZZH.exe
  C:\Windows\System32\UdovZZH.exe
  2⤵
  PID:5332
- C:\Windows\System32\jZdyIho.exe
  C:\Windows\System32\jZdyIho.exe
  2⤵
  PID:5368
- C:\Windows\System32\maYBsUC.exe
  C:\Windows\System32\maYBsUC.exe
  2⤵
  PID:5388
- C:\Windows\System32\dBBLAsc.exe
  C:\Windows\System32\dBBLAsc.exe
  2⤵
  PID:5424
- C:\Windows\System32\mIUSIhU.exe
  C:\Windows\System32\mIUSIhU.exe
  2⤵
  PID:5444
- C:\Windows\System32\ISSBhOQ.exe
  C:\Windows\System32\ISSBhOQ.exe
  2⤵
  PID:5472
- C:\Windows\System32\SzJvVdt.exe
  C:\Windows\System32\SzJvVdt.exe
  2⤵
  PID:5500
- C:\Windows\System32\DYwMxtE.exe
  C:\Windows\System32\DYwMxtE.exe
  2⤵
  PID:5528
- C:\Windows\System32\eZFGGgd.exe
  C:\Windows\System32\eZFGGgd.exe
  2⤵
  PID:5556
- C:\Windows\System32\ytzazFn.exe
  C:\Windows\System32\ytzazFn.exe
  2⤵
  PID:5584
- C:\Windows\System32\kKMMuLE.exe
  C:\Windows\System32\kKMMuLE.exe
  2⤵
  PID:5620
- C:\Windows\System32\IJVMDmB.exe
  C:\Windows\System32\IJVMDmB.exe
  2⤵
  PID:5640
- C:\Windows\System32\rySCszO.exe
  C:\Windows\System32\rySCszO.exe
  2⤵
  PID:5668
- C:\Windows\System32\MHEYHlf.exe
  C:\Windows\System32\MHEYHlf.exe
  2⤵
  PID:5696
- C:\Windows\System32\TAICKPA.exe
  C:\Windows\System32\TAICKPA.exe
  2⤵
  PID:5724
- C:\Windows\System32\FNylgdU.exe
  C:\Windows\System32\FNylgdU.exe
  2⤵
  PID:5752
- C:\Windows\System32\nMphJqV.exe
  C:\Windows\System32\nMphJqV.exe
  2⤵
  PID:5780
- C:\Windows\System32\QAWokQV.exe
  C:\Windows\System32\QAWokQV.exe
  2⤵
  PID:5808
- C:\Windows\System32\rGaTrpL.exe
  C:\Windows\System32\rGaTrpL.exe
  2⤵
  PID:5836
- C:\Windows\System32\hDDGwnG.exe
  C:\Windows\System32\hDDGwnG.exe
  2⤵
  PID:5864
- C:\Windows\System32\GICLAlp.exe
  C:\Windows\System32\GICLAlp.exe
  2⤵
  PID:5904
- C:\Windows\System32\TozLAqf.exe
  C:\Windows\System32\TozLAqf.exe
  2⤵
  PID:5920
- C:\Windows\System32\mtWGgvi.exe
  C:\Windows\System32\mtWGgvi.exe
  2⤵
  PID:5960
- C:\Windows\System32\eyMPBDL.exe
  C:\Windows\System32\eyMPBDL.exe
  2⤵
  PID:5976
- C:\Windows\System32\uzdiDHj.exe
  C:\Windows\System32\uzdiDHj.exe
  2⤵
  PID:6004
- C:\Windows\System32\cHbFDyH.exe
  C:\Windows\System32\cHbFDyH.exe
  2⤵
  PID:6032
- C:\Windows\System32\ZpEPsCB.exe
  C:\Windows\System32\ZpEPsCB.exe
  2⤵
  PID:6060
- C:\Windows\System32\gHqDvKz.exe
  C:\Windows\System32\gHqDvKz.exe
  2⤵
  PID:6088
- C:\Windows\System32\BTCfcdF.exe
  C:\Windows\System32\BTCfcdF.exe
  2⤵
  PID:6116
- C:\Windows\System32\eNCvBVU.exe
  C:\Windows\System32\eNCvBVU.exe
  2⤵
  PID:4048
- C:\Windows\System32\nnkMhHg.exe
  C:\Windows\System32\nnkMhHg.exe
  2⤵
  PID:3632
- C:\Windows\System32\USYcACy.exe
  C:\Windows\System32\USYcACy.exe
  2⤵
  PID:5152
- C:\Windows\System32\NKclqDk.exe
  C:\Windows\System32\NKclqDk.exe
  2⤵
  PID:5200
- C:\Windows\System32\WpbnBSn.exe
  C:\Windows\System32\WpbnBSn.exe
  2⤵
  PID:5296
- C:\Windows\System32\kYuekpr.exe
  C:\Windows\System32\kYuekpr.exe
  2⤵
  PID:5348
- C:\Windows\System32\IcTpwqc.exe
  C:\Windows\System32\IcTpwqc.exe
  2⤵
  PID:5404
- C:\Windows\System32\fTrtmgI.exe
  C:\Windows\System32\fTrtmgI.exe
  2⤵
  PID:5452
- C:\Windows\System32\UKWTTdw.exe
  C:\Windows\System32\UKWTTdw.exe
  2⤵
  PID:5520
- C:\Windows\System32\ikgocFu.exe
  C:\Windows\System32\ikgocFu.exe
  2⤵
  PID:5600
- C:\Windows\System32\rTfMzzc.exe
  C:\Windows\System32\rTfMzzc.exe
  2⤵
  PID:5648
- C:\Windows\System32\ulEeOFd.exe
  C:\Windows\System32\ulEeOFd.exe
  2⤵
  PID:5716
- C:\Windows\System32\GlQGfAc.exe
  C:\Windows\System32\GlQGfAc.exe
  2⤵
  PID:5796
- C:\Windows\System32\MaukLKX.exe
  C:\Windows\System32\MaukLKX.exe
  2⤵
  PID:5852
- C:\Windows\System32\YlEwlfl.exe
  C:\Windows\System32\YlEwlfl.exe
  2⤵
  PID:5916
- C:\Windows\System32\oPhHAOV.exe
  C:\Windows\System32\oPhHAOV.exe
  2⤵
  PID:5992
- C:\Windows\System32\RevMZHI.exe
  C:\Windows\System32\RevMZHI.exe
  2⤵
  PID:6040
- C:\Windows\System32\bnarIGb.exe
  C:\Windows\System32\bnarIGb.exe
  2⤵
  PID:6108
- C:\Windows\System32\rHiwSaf.exe
  C:\Windows\System32\rHiwSaf.exe
  2⤵
  PID:5124
- C:\Windows\System32\VmncwkF.exe
  C:\Windows\System32\VmncwkF.exe
  2⤵
  PID:5312
- C:\Windows\System32\ooqYWNA.exe
  C:\Windows\System32\ooqYWNA.exe
  2⤵
  PID:5376
- C:\Windows\System32\zqhEVnl.exe
  C:\Windows\System32\zqhEVnl.exe
  2⤵
  PID:5628
- C:\Windows\System32\sNjuRMq.exe
  C:\Windows\System32\sNjuRMq.exe
  2⤵
  PID:5684
- C:\Windows\System32\JvGBxXH.exe
  C:\Windows\System32\JvGBxXH.exe
  2⤵
  PID:5896
- C:\Windows\System32\nfnRafu.exe
  C:\Windows\System32\nfnRafu.exe
  2⤵
  PID:6012
- C:\Windows\System32\SdDMcvg.exe
  C:\Windows\System32\SdDMcvg.exe
  2⤵
  PID:5044
- C:\Windows\System32\zdDsEqF.exe
  C:\Windows\System32\zdDsEqF.exe
  2⤵
  PID:896
- C:\Windows\System32\GTtQhAN.exe
  C:\Windows\System32\GTtQhAN.exe
  2⤵
  PID:6160
- C:\Windows\System32\ZdWtgqc.exe
  C:\Windows\System32\ZdWtgqc.exe
  2⤵
  PID:6188
- C:\Windows\System32\KsCmjja.exe
  C:\Windows\System32\KsCmjja.exe
  2⤵
  PID:6224
- C:\Windows\System32\TnldFOG.exe
  C:\Windows\System32\TnldFOG.exe
  2⤵
  PID:6244
- C:\Windows\System32\qfiXQOU.exe
  C:\Windows\System32\qfiXQOU.exe
  2⤵
  PID:6272
- C:\Windows\System32\USvGNsR.exe
  C:\Windows\System32\USvGNsR.exe
  2⤵
  PID:6300
- C:\Windows\System32\ZiYMReg.exe
  C:\Windows\System32\ZiYMReg.exe
  2⤵
  PID:6328
- C:\Windows\System32\QjWLTqM.exe
  C:\Windows\System32\QjWLTqM.exe
  2⤵
  PID:6356
- C:\Windows\System32\HeOItbi.exe
  C:\Windows\System32\HeOItbi.exe
  2⤵
  PID:6384
- C:\Windows\System32\CZKCgRy.exe
  C:\Windows\System32\CZKCgRy.exe
  2⤵
  PID:6412
- C:\Windows\System32\HDzUVVF.exe
  C:\Windows\System32\HDzUVVF.exe
  2⤵
  PID:6440
- C:\Windows\System32\Rrydanh.exe
  C:\Windows\System32\Rrydanh.exe
  2⤵
  PID:6468
- C:\Windows\System32\cxedJQk.exe
  C:\Windows\System32\cxedJQk.exe
  2⤵
  PID:6496
- C:\Windows\System32\UbpPdeZ.exe
  C:\Windows\System32\UbpPdeZ.exe
  2⤵
  PID:6524
- C:\Windows\System32\QGhkibB.exe
  C:\Windows\System32\QGhkibB.exe
  2⤵
  PID:6552
- C:\Windows\System32\hxEtVwO.exe
  C:\Windows\System32\hxEtVwO.exe
  2⤵
  PID:6580
- C:\Windows\System32\SKHJoZB.exe
  C:\Windows\System32\SKHJoZB.exe
  2⤵
  PID:6608
- C:\Windows\System32\jcESkQZ.exe
  C:\Windows\System32\jcESkQZ.exe
  2⤵
  PID:6644
- C:\Windows\System32\aBtEUdk.exe
  C:\Windows\System32\aBtEUdk.exe
  2⤵
  PID:6664
- C:\Windows\System32\jOhaLbn.exe
  C:\Windows\System32\jOhaLbn.exe
  2⤵
  PID:6692
- C:\Windows\System32\wVWcsEu.exe
  C:\Windows\System32\wVWcsEu.exe
  2⤵
  PID:6720
- C:\Windows\System32\cNpqHuv.exe
  C:\Windows\System32\cNpqHuv.exe
  2⤵
  PID:6748
- C:\Windows\System32\bwiAqxV.exe
  C:\Windows\System32\bwiAqxV.exe
  2⤵
  PID:6776
- C:\Windows\System32\aOCVQCt.exe
  C:\Windows\System32\aOCVQCt.exe
  2⤵
  PID:6804
- C:\Windows\System32\XjwNrVc.exe
  C:\Windows\System32\XjwNrVc.exe
  2⤵
  PID:6832
- C:\Windows\System32\TyeUoWP.exe
  C:\Windows\System32\TyeUoWP.exe
  2⤵
  PID:6860
- C:\Windows\System32\meqzWqh.exe
  C:\Windows\System32\meqzWqh.exe
  2⤵
  PID:6900
- C:\Windows\System32\AxxixJR.exe
  C:\Windows\System32\AxxixJR.exe
  2⤵
  PID:6916
- C:\Windows\System32\DfTyqxQ.exe
  C:\Windows\System32\DfTyqxQ.exe
  2⤵
  PID:6944
- C:\Windows\System32\xwcTzUX.exe
  C:\Windows\System32\xwcTzUX.exe
  2⤵
  PID:6972
- C:\Windows\System32\LzgHVxq.exe
  C:\Windows\System32\LzgHVxq.exe
  2⤵
  PID:7000
- C:\Windows\System32\QivelZw.exe
  C:\Windows\System32\QivelZw.exe
  2⤵
  PID:7028
- C:\Windows\System32\yPSHSjv.exe
  C:\Windows\System32\yPSHSjv.exe
  2⤵
  PID:7056
- C:\Windows\System32\EbXhclj.exe
  C:\Windows\System32\EbXhclj.exe
  2⤵
  PID:7084
- C:\Windows\System32\SfcVqyT.exe
  C:\Windows\System32\SfcVqyT.exe
  2⤵
  PID:7112
- C:\Windows\System32\zZoogAE.exe
  C:\Windows\System32\zZoogAE.exe
  2⤵
  PID:7140
- C:\Windows\System32\IfXUHJz.exe
  C:\Windows\System32\IfXUHJz.exe
  2⤵
  PID:5536
- C:\Windows\System32\vxwBLKi.exe
  C:\Windows\System32\vxwBLKi.exe
  2⤵
  PID:5928
- C:\Windows\System32\USljmrZ.exe
  C:\Windows\System32\USljmrZ.exe
  2⤵
  PID:4820
- C:\Windows\System32\KbgndTL.exe
  C:\Windows\System32\KbgndTL.exe
  2⤵
  PID:6152
- C:\Windows\System32\bsVzTEK.exe
  C:\Windows\System32\bsVzTEK.exe
  2⤵
  PID:6220
- C:\Windows\System32\oIxaVqP.exe
  C:\Windows\System32\oIxaVqP.exe
  2⤵
  PID:2444
- C:\Windows\System32\zAFVIBM.exe
  C:\Windows\System32\zAFVIBM.exe
  2⤵
  PID:6348
- C:\Windows\System32\gpBemCn.exe
  C:\Windows\System32\gpBemCn.exe
  2⤵
  PID:6400
- C:\Windows\System32\GqAWaSp.exe
  C:\Windows\System32\GqAWaSp.exe
  2⤵
  PID:6448
- C:\Windows\System32\TnMWAON.exe
  C:\Windows\System32\TnMWAON.exe
  2⤵
  PID:6516
- C:\Windows\System32\kFDavNP.exe
  C:\Windows\System32\kFDavNP.exe
  2⤵
  PID:6572
- C:\Windows\System32\PKrLXZn.exe
  C:\Windows\System32\PKrLXZn.exe
  2⤵
  PID:6660
- C:\Windows\System32\PMqnQRq.exe
  C:\Windows\System32\PMqnQRq.exe
  2⤵
  PID:6796
- C:\Windows\System32\TmkIOZt.exe
  C:\Windows\System32\TmkIOZt.exe
  2⤵
  PID:6852
- C:\Windows\System32\qmKNCNy.exe
  C:\Windows\System32\qmKNCNy.exe
  2⤵
  PID:4400
- C:\Windows\System32\VsjTIXn.exe
  C:\Windows\System32\VsjTIXn.exe
  2⤵
  PID:6992
- C:\Windows\System32\DGppkvv.exe
  C:\Windows\System32\DGppkvv.exe
  2⤵
  PID:7048
- C:\Windows\System32\KvchQWq.exe
  C:\Windows\System32\KvchQWq.exe
  2⤵
  PID:4608
- C:\Windows\System32\qPVVfci.exe
  C:\Windows\System32\qPVVfci.exe
  2⤵
  PID:7148
- C:\Windows\System32\YxwYyBP.exe
  C:\Windows\System32\YxwYyBP.exe
  2⤵
  PID:5888
- C:\Windows\System32\gVYJrYM.exe
  C:\Windows\System32\gVYJrYM.exe
  2⤵
  PID:2040
- C:\Windows\System32\SOkcDzY.exe
  C:\Windows\System32\SOkcDzY.exe
  2⤵
  PID:6240
- C:\Windows\System32\EsRXvYz.exe
  C:\Windows\System32\EsRXvYz.exe
  2⤵
  PID:6404
- C:\Windows\System32\eHjjRbL.exe
  C:\Windows\System32\eHjjRbL.exe
  2⤵
  PID:6640
- C:\Windows\System32\skZOBir.exe
  C:\Windows\System32\skZOBir.exe
  2⤵
  PID:6712
- C:\Windows\System32\BXfJWaN.exe
  C:\Windows\System32\BXfJWaN.exe
  2⤵
  PID:3880
- C:\Windows\System32\YTpznUU.exe
  C:\Windows\System32\YTpznUU.exe
  2⤵
  PID:936
- C:\Windows\System32\nVOGYfE.exe
  C:\Windows\System32\nVOGYfE.exe
  2⤵
  PID:4844
- C:\Windows\System32\UKCIPDu.exe
  C:\Windows\System32\UKCIPDu.exe
  2⤵
  PID:3532
- C:\Windows\System32\mHtjcwt.exe
  C:\Windows\System32\mHtjcwt.exe
  2⤵
  PID:544
- C:\Windows\System32\KrkJRQA.exe
  C:\Windows\System32\KrkJRQA.exe
  2⤵
  PID:6892
- C:\Windows\System32\fDypknL.exe
  C:\Windows\System32\fDypknL.exe
  2⤵
  PID:3448
- C:\Windows\System32\UXNMjPE.exe
  C:\Windows\System32\UXNMjPE.exe
  2⤵
  PID:6488
- C:\Windows\System32\jBdYWEU.exe
  C:\Windows\System32\jBdYWEU.exe
  2⤵
  PID:1312
- C:\Windows\System32\QBLMlCH.exe
  C:\Windows\System32\QBLMlCH.exe
  2⤵
  PID:6824
- C:\Windows\System32\eqwrdhp.exe
  C:\Windows\System32\eqwrdhp.exe
  2⤵
  PID:4196
- C:\Windows\System32\xspiTxb.exe
  C:\Windows\System32\xspiTxb.exe
  2⤵
  PID:7072
- C:\Windows\System32\ePoZDqt.exe
  C:\Windows\System32\ePoZDqt.exe
  2⤵
  PID:3972
- C:\Windows\System32\gqDhwFv.exe
  C:\Windows\System32\gqDhwFv.exe
  2⤵
  PID:3672
- C:\Windows\System32\wkdqjXC.exe
  C:\Windows\System32\wkdqjXC.exe
  2⤵
  PID:7172
- C:\Windows\System32\UymcTFt.exe
  C:\Windows\System32\UymcTFt.exe
  2⤵
  PID:7192
- C:\Windows\System32\fNJnTpI.exe
  C:\Windows\System32\fNJnTpI.exe
  2⤵
  PID:7224
- C:\Windows\System32\nNLkuee.exe
  C:\Windows\System32\nNLkuee.exe
  2⤵
  PID:7260
- C:\Windows\System32\zLUfjJP.exe
  C:\Windows\System32\zLUfjJP.exe
  2⤵
  PID:7292
- C:\Windows\System32\CbdNMRU.exe
  C:\Windows\System32\CbdNMRU.exe
  2⤵
  PID:7336
- C:\Windows\System32\AmsHRYW.exe
  C:\Windows\System32\AmsHRYW.exe
  2⤵
  PID:7408
- C:\Windows\System32\fRoPbuS.exe
  C:\Windows\System32\fRoPbuS.exe
  2⤵
  PID:7440
- C:\Windows\System32\lCucYKt.exe
  C:\Windows\System32\lCucYKt.exe
  2⤵
  PID:7488
- C:\Windows\System32\WwkacqX.exe
  C:\Windows\System32\WwkacqX.exe
  2⤵
  PID:7504
- C:\Windows\System32\rQKisVj.exe
  C:\Windows\System32\rQKisVj.exe
  2⤵
  PID:7552
- C:\Windows\System32\xIPzRsb.exe
  C:\Windows\System32\xIPzRsb.exe
  2⤵
  PID:7592
- C:\Windows\System32\qHiWkDE.exe
  C:\Windows\System32\qHiWkDE.exe
  2⤵
  PID:7628
- C:\Windows\System32\mbvvnSa.exe
  C:\Windows\System32\mbvvnSa.exe
  2⤵
  PID:7648
- C:\Windows\System32\IXUYFEl.exe
  C:\Windows\System32\IXUYFEl.exe
  2⤵
  PID:7676
- C:\Windows\System32\AWDBrDw.exe
  C:\Windows\System32\AWDBrDw.exe
  2⤵
  PID:7704
- C:\Windows\System32\YuKvRNl.exe
  C:\Windows\System32\YuKvRNl.exe
  2⤵
  PID:7732
- C:\Windows\System32\byCJjGM.exe
  C:\Windows\System32\byCJjGM.exe
  2⤵
  PID:7768
- C:\Windows\System32\vNSkstN.exe
  C:\Windows\System32\vNSkstN.exe
  2⤵
  PID:7796
- C:\Windows\System32\xTVcxZS.exe
  C:\Windows\System32\xTVcxZS.exe
  2⤵
  PID:7824
- C:\Windows\System32\WkGTwlF.exe
  C:\Windows\System32\WkGTwlF.exe
  2⤵
  PID:7864
- C:\Windows\System32\aVAvTJV.exe
  C:\Windows\System32\aVAvTJV.exe
  2⤵
  PID:7884
- C:\Windows\System32\ZbFNWKM.exe
  C:\Windows\System32\ZbFNWKM.exe
  2⤵
  PID:7908
- C:\Windows\System32\ynMAJhN.exe
  C:\Windows\System32\ynMAJhN.exe
  2⤵
  PID:7952
- C:\Windows\System32\DnUqQmS.exe
  C:\Windows\System32\DnUqQmS.exe
  2⤵
  PID:7968
- C:\Windows\System32\sfvmhTS.exe
  C:\Windows\System32\sfvmhTS.exe
  2⤵
  PID:8000
- C:\Windows\System32\UimezyD.exe
  C:\Windows\System32\UimezyD.exe
  2⤵
  PID:8028
- C:\Windows\System32\qciqGrf.exe
  C:\Windows\System32\qciqGrf.exe
  2⤵
  PID:8056
- C:\Windows\System32\QaFcfcb.exe
  C:\Windows\System32\QaFcfcb.exe
  2⤵
  PID:8084
- C:\Windows\System32\NTDzWje.exe
  C:\Windows\System32\NTDzWje.exe
  2⤵
  PID:8112
- C:\Windows\System32\XiZiwoY.exe
  C:\Windows\System32\XiZiwoY.exe
  2⤵
  PID:8140
- C:\Windows\System32\ihBZGxr.exe
  C:\Windows\System32\ihBZGxr.exe
  2⤵
  PID:8168
- C:\Windows\System32\xaqQXGj.exe
  C:\Windows\System32\xaqQXGj.exe
  2⤵
  PID:4664
- C:\Windows\System32\jVgHRFq.exe
  C:\Windows\System32\jVgHRFq.exe
  2⤵
  PID:7212
- C:\Windows\System32\aaqnKvo.exe
  C:\Windows\System32\aaqnKvo.exe
  2⤵
  PID:7420
- C:\Windows\System32\YyVpFbo.exe
  C:\Windows\System32\YyVpFbo.exe
  2⤵
  PID:7100
- C:\Windows\System32\yKnNPPR.exe
  C:\Windows\System32\yKnNPPR.exe
  2⤵
  PID:7396
- C:\Windows\System32\xEpzjkn.exe
  C:\Windows\System32\xEpzjkn.exe
  2⤵
  PID:7524
- C:\Windows\System32\aRXmVAk.exe
  C:\Windows\System32\aRXmVAk.exe
  2⤵
  PID:7612
- C:\Windows\System32\fCWhvMM.exe
  C:\Windows\System32\fCWhvMM.exe
  2⤵
  PID:7672
- C:\Windows\System32\jBwHyAF.exe
  C:\Windows\System32\jBwHyAF.exe
  2⤵
  PID:7728
- C:\Windows\System32\kQFLLyd.exe
  C:\Windows\System32\kQFLLyd.exe
  2⤵
  PID:7804
- C:\Windows\System32\aUGFERy.exe
  C:\Windows\System32\aUGFERy.exe
  2⤵
  PID:7880
- C:\Windows\System32\rCfQucS.exe
  C:\Windows\System32\rCfQucS.exe
  2⤵
  PID:7924
- C:\Windows\System32\MbnrLkh.exe
  C:\Windows\System32\MbnrLkh.exe
  2⤵
  PID:7996
- C:\Windows\System32\XZqMvnJ.exe
  C:\Windows\System32\XZqMvnJ.exe
  2⤵
  PID:8048
- C:\Windows\System32\pyLhLVx.exe
  C:\Windows\System32\pyLhLVx.exe
  2⤵
  PID:8104
- C:\Windows\System32\wnzQHsQ.exe
  C:\Windows\System32\wnzQHsQ.exe
  2⤵
  PID:8188
- C:\Windows\System32\GwhvRrd.exe
  C:\Windows\System32\GwhvRrd.exe
  2⤵
  PID:7220
- C:\Windows\System32\gIYjYpz.exe
  C:\Windows\System32\gIYjYpz.exe
  2⤵
  PID:116
- C:\Windows\System32\DdDMQFH.exe
  C:\Windows\System32\DdDMQFH.exe
  2⤵
  PID:7560
- C:\Windows\System32\zduJVmg.exe
  C:\Windows\System32\zduJVmg.exe
  2⤵
  PID:7668
- C:\Windows\System32\OFGDJXq.exe
  C:\Windows\System32\OFGDJXq.exe
  2⤵
  PID:7724
- C:\Windows\System32\CrYiWNe.exe
  C:\Windows\System32\CrYiWNe.exe
  2⤵
  PID:7892
- C:\Windows\System32\UYPiaLq.exe
  C:\Windows\System32\UYPiaLq.exe
  2⤵
  PID:6980
- C:\Windows\System32\GnjqBlN.exe
  C:\Windows\System32\GnjqBlN.exe
  2⤵
  PID:8132
- C:\Windows\System32\QiyJGsh.exe
  C:\Windows\System32\QiyJGsh.exe
  2⤵
  PID:6812
- C:\Windows\System32\LaOpRpl.exe
  C:\Windows\System32\LaOpRpl.exe
  2⤵
  PID:2284
- C:\Windows\System32\WQEopAT.exe
  C:\Windows\System32\WQEopAT.exe
  2⤵
  PID:7932
- C:\Windows\System32\tPtHReH.exe
  C:\Windows\System32\tPtHReH.exe
  2⤵
  PID:1924
- C:\Windows\System32\HJPdsHw.exe
  C:\Windows\System32\HJPdsHw.exe
  2⤵
  PID:7716
- C:\Windows\System32\ywFfTCz.exe
  C:\Windows\System32\ywFfTCz.exe
  2⤵
  PID:3552
- C:\Windows\System32\VwSsXAM.exe
  C:\Windows\System32\VwSsXAM.exe
  2⤵
  PID:7660
- C:\Windows\System32\wlwMZYQ.exe
  C:\Windows\System32\wlwMZYQ.exe
  2⤵
  PID:8212
- C:\Windows\System32\zEjYEQQ.exe
  C:\Windows\System32\zEjYEQQ.exe
  2⤵
  PID:8240
- C:\Windows\System32\KGVfkHq.exe
  C:\Windows\System32\KGVfkHq.exe
  2⤵
  PID:8268
- C:\Windows\System32\KAKBCwP.exe
  C:\Windows\System32\KAKBCwP.exe
  2⤵
  PID:8296
- C:\Windows\System32\oTtZbDU.exe
  C:\Windows\System32\oTtZbDU.exe
  2⤵
  PID:8324
- C:\Windows\System32\BqRkLyW.exe
  C:\Windows\System32\BqRkLyW.exe
  2⤵
  PID:8352
- C:\Windows\System32\JBckmIu.exe
  C:\Windows\System32\JBckmIu.exe
  2⤵
  PID:8380
- C:\Windows\System32\AfSvGVZ.exe
  C:\Windows\System32\AfSvGVZ.exe
  2⤵
  PID:8408
- C:\Windows\System32\kumXZPo.exe
  C:\Windows\System32\kumXZPo.exe
  2⤵
  PID:8436
- C:\Windows\System32\vNrRwVY.exe
  C:\Windows\System32\vNrRwVY.exe
  2⤵
  PID:8464
- C:\Windows\System32\xWRxTlg.exe
  C:\Windows\System32\xWRxTlg.exe
  2⤵
  PID:8492
- C:\Windows\System32\VsEczbs.exe
  C:\Windows\System32\VsEczbs.exe
  2⤵
  PID:8508
- C:\Windows\System32\kGGdAYB.exe
  C:\Windows\System32\kGGdAYB.exe
  2⤵
  PID:8536
- C:\Windows\System32\aOICvfO.exe
  C:\Windows\System32\aOICvfO.exe
  2⤵
  PID:8580
- C:\Windows\System32\UQzUYTT.exe
  C:\Windows\System32\UQzUYTT.exe
  2⤵
  PID:8608
- C:\Windows\System32\OPBVZfg.exe
  C:\Windows\System32\OPBVZfg.exe
  2⤵
  PID:8636
- C:\Windows\System32\PkVBqDX.exe
  C:\Windows\System32\PkVBqDX.exe
  2⤵
  PID:8664
- C:\Windows\System32\vbSnQtJ.exe
  C:\Windows\System32\vbSnQtJ.exe
  2⤵
  PID:8692
- C:\Windows\System32\sfMtwog.exe
  C:\Windows\System32\sfMtwog.exe
  2⤵
  PID:8720
- C:\Windows\System32\tnNwqtG.exe
  C:\Windows\System32\tnNwqtG.exe
  2⤵
  PID:8748
- C:\Windows\System32\SjRAtZr.exe
  C:\Windows\System32\SjRAtZr.exe
  2⤵
  PID:8776
- C:\Windows\System32\IkaCgQH.exe
  C:\Windows\System32\IkaCgQH.exe
  2⤵
  PID:8804
- C:\Windows\System32\RwjMtHi.exe
  C:\Windows\System32\RwjMtHi.exe
  2⤵
  PID:8832
- C:\Windows\System32\Quutmva.exe
  C:\Windows\System32\Quutmva.exe
  2⤵
  PID:8860
- C:\Windows\System32\mDJySER.exe
  C:\Windows\System32\mDJySER.exe
  2⤵
  PID:8888
- C:\Windows\System32\BwXcsGc.exe
  C:\Windows\System32\BwXcsGc.exe
  2⤵
  PID:8916
- C:\Windows\System32\uGNjfJd.exe
  C:\Windows\System32\uGNjfJd.exe
  2⤵
  PID:8944
- C:\Windows\System32\wotZchn.exe
  C:\Windows\System32\wotZchn.exe
  2⤵
  PID:8972
- C:\Windows\System32\qZlSpYZ.exe
  C:\Windows\System32\qZlSpYZ.exe
  2⤵
  PID:9000
- C:\Windows\System32\NSTLzwG.exe
  C:\Windows\System32\NSTLzwG.exe
  2⤵
  PID:9028
- C:\Windows\System32\CLNRfte.exe
  C:\Windows\System32\CLNRfte.exe
  2⤵
  PID:9060
- C:\Windows\System32\cLbZPXJ.exe
  C:\Windows\System32\cLbZPXJ.exe
  2⤵
  PID:9088
- C:\Windows\System32\MHKrFMt.exe
  C:\Windows\System32\MHKrFMt.exe
  2⤵
  PID:9116
- C:\Windows\System32\vhttXwD.exe
  C:\Windows\System32\vhttXwD.exe
  2⤵
  PID:9144
- C:\Windows\System32\RKuBHZX.exe
  C:\Windows\System32\RKuBHZX.exe
  2⤵
  PID:9192
- C:\Windows\System32\JutmKXZ.exe
  C:\Windows\System32\JutmKXZ.exe
  2⤵
  PID:9208
- C:\Windows\System32\ylusDyG.exe
  C:\Windows\System32\ylusDyG.exe
  2⤵
  PID:8236
- C:\Windows\System32\aQZpiXJ.exe
  C:\Windows\System32\aQZpiXJ.exe
  2⤵
  PID:8308
- C:\Windows\System32\ChwZDrN.exe
  C:\Windows\System32\ChwZDrN.exe
  2⤵
  PID:8372
- C:\Windows\System32\GkhQgne.exe
  C:\Windows\System32\GkhQgne.exe
  2⤵
  PID:8432
- C:\Windows\System32\YQrSBqB.exe
  C:\Windows\System32\YQrSBqB.exe
  2⤵
  PID:8504
- C:\Windows\System32\iakDMiI.exe
  C:\Windows\System32\iakDMiI.exe
  2⤵
  PID:8568
- C:\Windows\System32\KmHKupZ.exe
  C:\Windows\System32\KmHKupZ.exe
  2⤵
  PID:8632
- C:\Windows\System32\HCAiiXB.exe
  C:\Windows\System32\HCAiiXB.exe
  2⤵
  PID:8704
- C:\Windows\System32\hMsylke.exe
  C:\Windows\System32\hMsylke.exe
  2⤵
  PID:8768
- C:\Windows\System32\MuXAXRq.exe
  C:\Windows\System32\MuXAXRq.exe
  2⤵
  PID:8828
- C:\Windows\System32\VWciFNh.exe
  C:\Windows\System32\VWciFNh.exe
  2⤵
  PID:8900
- C:\Windows\System32\vqidTtL.exe
  C:\Windows\System32\vqidTtL.exe
  2⤵
  PID:8956
- C:\Windows\System32\cAJTBkc.exe
  C:\Windows\System32\cAJTBkc.exe
  2⤵
  PID:4468
- C:\Windows\System32\LwuIMck.exe
  C:\Windows\System32\LwuIMck.exe
  2⤵
  PID:6792
- C:\Windows\System32\urVpayr.exe
  C:\Windows\System32\urVpayr.exe
  2⤵
  PID:9136
- C:\Windows\System32\hQAFHHv.exe
  C:\Windows\System32\hQAFHHv.exe
  2⤵
  PID:9200
- C:\Windows\System32\gKlEOlN.exe
  C:\Windows\System32\gKlEOlN.exe
  2⤵
  PID:8292
- C:\Windows\System32\CjjVASO.exe
  C:\Windows\System32\CjjVASO.exe
  2⤵
  PID:8460
- C:\Windows\System32\XcDLnrh.exe
  C:\Windows\System32\XcDLnrh.exe
  2⤵
  PID:8620
- C:\Windows\System32\vsTMlmQ.exe
  C:\Windows\System32\vsTMlmQ.exe
  2⤵
  PID:8760
- C:\Windows\System32\aAixDZk.exe
  C:\Windows\System32\aAixDZk.exe
  2⤵
  PID:8912
- C:\Windows\System32\LctoQKf.exe
  C:\Windows\System32\LctoQKf.exe
  2⤵
  PID:9056
- C:\Windows\System32\jFtjzAm.exe
  C:\Windows\System32\jFtjzAm.exe
  2⤵
  PID:9172
- C:\Windows\System32\YFnxlXw.exe
  C:\Windows\System32\YFnxlXw.exe
  2⤵
  PID:8524
- C:\Windows\System32\YjlPgMA.exe
  C:\Windows\System32\YjlPgMA.exe
  2⤵
  PID:8880
- C:\Windows\System32\QaPBJdh.exe
  C:\Windows\System32\QaPBJdh.exe
  2⤵
  PID:2056
- C:\Windows\System32\ARamtaq.exe
  C:\Windows\System32\ARamtaq.exe
  2⤵
  PID:9012
- C:\Windows\System32\UNagBjX.exe
  C:\Windows\System32\UNagBjX.exe
  2⤵
  PID:8824
- C:\Windows\System32\IKJKvfL.exe
  C:\Windows\System32\IKJKvfL.exe
  2⤵
  PID:9240
- C:\Windows\System32\NKUtoSn.exe
  C:\Windows\System32\NKUtoSn.exe
  2⤵
  PID:9268
- C:\Windows\System32\JZbDYyU.exe
  C:\Windows\System32\JZbDYyU.exe
  2⤵
  PID:9296
- C:\Windows\System32\cYDVCVY.exe
  C:\Windows\System32\cYDVCVY.exe
  2⤵
  PID:9324
- C:\Windows\System32\rwpaGoO.exe
  C:\Windows\System32\rwpaGoO.exe
  2⤵
  PID:9352
- C:\Windows\System32\eRDrcOg.exe
  C:\Windows\System32\eRDrcOg.exe
  2⤵
  PID:9380
- C:\Windows\System32\URwxemW.exe
  C:\Windows\System32\URwxemW.exe
  2⤵
  PID:9408
- C:\Windows\System32\dPPTzXY.exe
  C:\Windows\System32\dPPTzXY.exe
  2⤵
  PID:9436
- C:\Windows\System32\NwKCICY.exe
  C:\Windows\System32\NwKCICY.exe
  2⤵
  PID:9464
- C:\Windows\System32\cfyPXST.exe
  C:\Windows\System32\cfyPXST.exe
  2⤵
  PID:9492
- C:\Windows\System32\azUDJSh.exe
  C:\Windows\System32\azUDJSh.exe
  2⤵
  PID:9520
- C:\Windows\System32\rpWtUdd.exe
  C:\Windows\System32\rpWtUdd.exe
  2⤵
  PID:9548
- C:\Windows\System32\NkIcGVL.exe
  C:\Windows\System32\NkIcGVL.exe
  2⤵
  PID:9576
- C:\Windows\System32\uyRcLai.exe
  C:\Windows\System32\uyRcLai.exe
  2⤵
  PID:9604
- C:\Windows\System32\yFwmXSC.exe
  C:\Windows\System32\yFwmXSC.exe
  2⤵
  PID:9632
- C:\Windows\System32\uaNRIYo.exe
  C:\Windows\System32\uaNRIYo.exe
  2⤵
  PID:9660
- C:\Windows\System32\YPLTnyU.exe
  C:\Windows\System32\YPLTnyU.exe
  2⤵
  PID:9688
- C:\Windows\System32\yDAkcnG.exe
  C:\Windows\System32\yDAkcnG.exe
  2⤵
  PID:9716
- C:\Windows\System32\OMsUETB.exe
  C:\Windows\System32\OMsUETB.exe
  2⤵
  PID:9744
- C:\Windows\System32\LDoWWZS.exe
  C:\Windows\System32\LDoWWZS.exe
  2⤵
  PID:9772
- C:\Windows\System32\cZwZJzc.exe
  C:\Windows\System32\cZwZJzc.exe
  2⤵
  PID:9804
- C:\Windows\System32\ZgvzJvp.exe
  C:\Windows\System32\ZgvzJvp.exe
  2⤵
  PID:9832
- C:\Windows\System32\EzuoRUy.exe
  C:\Windows\System32\EzuoRUy.exe
  2⤵
  PID:9860
- C:\Windows\System32\pMyiLJo.exe
  C:\Windows\System32\pMyiLJo.exe
  2⤵
  PID:9888
- C:\Windows\System32\iZuKIZr.exe
  C:\Windows\System32\iZuKIZr.exe
  2⤵
  PID:9916
- C:\Windows\System32\lsxmcHu.exe
  C:\Windows\System32\lsxmcHu.exe
  2⤵
  PID:9944
- C:\Windows\System32\OTGxBtp.exe
  C:\Windows\System32\OTGxBtp.exe
  2⤵
  PID:9972
- C:\Windows\System32\wfViXYV.exe
  C:\Windows\System32\wfViXYV.exe
  2⤵
  PID:10000
- C:\Windows\System32\DRmSBvc.exe
  C:\Windows\System32\DRmSBvc.exe
  2⤵
  PID:10028
- C:\Windows\System32\ajBMteL.exe
  C:\Windows\System32\ajBMteL.exe
  2⤵
  PID:10056
- C:\Windows\System32\HMIhVDH.exe
  C:\Windows\System32\HMIhVDH.exe
  2⤵
  PID:10084
- C:\Windows\System32\SfpxueH.exe
  C:\Windows\System32\SfpxueH.exe
  2⤵
  PID:10112
- C:\Windows\System32\umPgqSW.exe
  C:\Windows\System32\umPgqSW.exe
  2⤵
  PID:10140
- C:\Windows\System32\Acffzfo.exe
  C:\Windows\System32\Acffzfo.exe
  2⤵
  PID:10168
- C:\Windows\System32\BOzCunB.exe
  C:\Windows\System32\BOzCunB.exe
  2⤵
  PID:10196
- C:\Windows\System32\DqIDjyS.exe
  C:\Windows\System32\DqIDjyS.exe
  2⤵
  PID:10224
- C:\Windows\System32\eTtTwSd.exe
  C:\Windows\System32\eTtTwSd.exe
  2⤵
  PID:9252
- C:\Windows\System32\xqTGKWQ.exe
  C:\Windows\System32\xqTGKWQ.exe
  2⤵
  PID:9316
- C:\Windows\System32\XDAFdVX.exe
  C:\Windows\System32\XDAFdVX.exe
  2⤵
  PID:9376
- C:\Windows\System32\MFpHScG.exe
  C:\Windows\System32\MFpHScG.exe
  2⤵
  PID:9432
- C:\Windows\System32\AnhGVnI.exe
  C:\Windows\System32\AnhGVnI.exe
  2⤵
  PID:9504
- C:\Windows\System32\ExKvtJM.exe
  C:\Windows\System32\ExKvtJM.exe
  2⤵
  PID:9568
- C:\Windows\System32\qaHVlWN.exe
  C:\Windows\System32\qaHVlWN.exe
  2⤵
  PID:9628
- C:\Windows\System32\bOzlJpL.exe
  C:\Windows\System32\bOzlJpL.exe
  2⤵
  PID:9700
- C:\Windows\System32\VxnNPaj.exe
  C:\Windows\System32\VxnNPaj.exe
  2⤵
  PID:9816
- C:\Windows\System32\EOrzQSq.exe
  C:\Windows\System32\EOrzQSq.exe
  2⤵
  PID:9852
- C:\Windows\System32\bxnpNnP.exe
  C:\Windows\System32\bxnpNnP.exe
  2⤵
  PID:9912
- C:\Windows\System32\JVjySiZ.exe
  C:\Windows\System32\JVjySiZ.exe
  2⤵
  PID:9984
- C:\Windows\System32\wZLQEjm.exe
  C:\Windows\System32\wZLQEjm.exe
  2⤵
  PID:10052
- C:\Windows\System32\SHJpjKj.exe
  C:\Windows\System32\SHJpjKj.exe
  2⤵
  PID:10108
- C:\Windows\System32\JVhipLN.exe
  C:\Windows\System32\JVhipLN.exe
  2⤵
  PID:10180
- C:\Windows\System32\GAiTsHi.exe
  C:\Windows\System32\GAiTsHi.exe
  2⤵
  PID:9232
- C:\Windows\System32\HvXrgdb.exe
  C:\Windows\System32\HvXrgdb.exe
  2⤵
  PID:9372
- C:\Windows\System32\dyIxQUR.exe
  C:\Windows\System32\dyIxQUR.exe
  2⤵
  PID:9532
- C:\Windows\System32\gKGimvi.exe
  C:\Windows\System32\gKGimvi.exe
  2⤵
  PID:9684
- C:\Windows\System32\JEOGzXm.exe
  C:\Windows\System32\JEOGzXm.exe
  2⤵
  PID:1424
- C:\Windows\System32\ZmCCKkK.exe
  C:\Windows\System32\ZmCCKkK.exe
  2⤵
  PID:7468
- C:\Windows\System32\gCKpBaq.exe
  C:\Windows\System32\gCKpBaq.exe
  2⤵
  PID:9900
- C:\Windows\System32\uSIhIQB.exe
  C:\Windows\System32\uSIhIQB.exe
  2⤵
  PID:10044
- C:\Windows\System32\WzfhvZf.exe
  C:\Windows\System32\WzfhvZf.exe
  2⤵
  PID:10208
- C:\Windows\System32\gPkLnAl.exe
  C:\Windows\System32\gPkLnAl.exe
  2⤵
  PID:9484
- C:\Windows\System32\trTkLZG.exe
  C:\Windows\System32\trTkLZG.exe
  2⤵
  PID:4676
- C:\Windows\System32\JKProNf.exe
  C:\Windows\System32\JKProNf.exe
  2⤵
  PID:9880
- C:\Windows\System32\lEAYkgU.exe
  C:\Windows\System32\lEAYkgU.exe
  2⤵
  PID:9292
- C:\Windows\System32\MDqZKQN.exe
  C:\Windows\System32\MDqZKQN.exe
  2⤵
  PID:1596
- C:\Windows\System32\EhDzIuO.exe
  C:\Windows\System32\EhDzIuO.exe
  2⤵
  PID:9800
- C:\Windows\System32\yffOMKj.exe
  C:\Windows\System32\yffOMKj.exe
  2⤵
  PID:10256
- C:\Windows\System32\aNckJaT.exe
  C:\Windows\System32\aNckJaT.exe
  2⤵
  PID:10284
- C:\Windows\System32\DwTzevt.exe
  C:\Windows\System32\DwTzevt.exe
  2⤵
  PID:10312
- C:\Windows\System32\PbdkrJk.exe
  C:\Windows\System32\PbdkrJk.exe
  2⤵
  PID:10344
- C:\Windows\System32\veFwHjx.exe
  C:\Windows\System32\veFwHjx.exe
  2⤵
  PID:10372
- C:\Windows\System32\oGDIvGA.exe
  C:\Windows\System32\oGDIvGA.exe
  2⤵
  PID:10400
- C:\Windows\System32\eUWSINK.exe
  C:\Windows\System32\eUWSINK.exe
  2⤵
  PID:10432
- C:\Windows\System32\OwoBKQD.exe
  C:\Windows\System32\OwoBKQD.exe
  2⤵
  PID:10460
- C:\Windows\System32\drOiAjM.exe
  C:\Windows\System32\drOiAjM.exe
  2⤵
  PID:10488
- C:\Windows\System32\ZTxrKWc.exe
  C:\Windows\System32\ZTxrKWc.exe
  2⤵
  PID:10516
- C:\Windows\System32\wAwTkXf.exe
  C:\Windows\System32\wAwTkXf.exe
  2⤵
  PID:10544
- C:\Windows\System32\GbEwlcJ.exe
  C:\Windows\System32\GbEwlcJ.exe
  2⤵
  PID:10572
- C:\Windows\System32\ENprfpI.exe
  C:\Windows\System32\ENprfpI.exe
  2⤵
  PID:10600
- C:\Windows\System32\cZzSghl.exe
  C:\Windows\System32\cZzSghl.exe
  2⤵
  PID:10632
- C:\Windows\System32\GndnJlj.exe
  C:\Windows\System32\GndnJlj.exe
  2⤵
  PID:10660
- C:\Windows\System32\ECdNflr.exe
  C:\Windows\System32\ECdNflr.exe
  2⤵
  PID:10688
- C:\Windows\System32\aIXbYDv.exe
  C:\Windows\System32\aIXbYDv.exe
  2⤵
  PID:10716
- C:\Windows\System32\AHAeszY.exe
  C:\Windows\System32\AHAeszY.exe
  2⤵
  PID:10744
- C:\Windows\System32\bnhaMyy.exe
  C:\Windows\System32\bnhaMyy.exe
  2⤵
  PID:10772
- C:\Windows\System32\RlQbQZt.exe
  C:\Windows\System32\RlQbQZt.exe
  2⤵
  PID:10800
- C:\Windows\System32\OAZdSIw.exe
  C:\Windows\System32\OAZdSIw.exe
  2⤵
  PID:10828
- C:\Windows\System32\LRoaTlb.exe
  C:\Windows\System32\LRoaTlb.exe
  2⤵
  PID:10856
- C:\Windows\System32\dkQcYVV.exe
  C:\Windows\System32\dkQcYVV.exe
  2⤵
  PID:10884
- C:\Windows\System32\PHaMvlC.exe
  C:\Windows\System32\PHaMvlC.exe
  2⤵
  PID:10912
- C:\Windows\System32\PwCayFp.exe
  C:\Windows\System32\PwCayFp.exe
  2⤵
  PID:10948
- C:\Windows\System32\oUxscty.exe
  C:\Windows\System32\oUxscty.exe
  2⤵
  PID:10968
- C:\Windows\System32\OFmaczT.exe
  C:\Windows\System32\OFmaczT.exe
  2⤵
  PID:10996
- C:\Windows\System32\eKTkYAm.exe
  C:\Windows\System32\eKTkYAm.exe
  2⤵
  PID:11024
- C:\Windows\System32\ArLHJAk.exe
  C:\Windows\System32\ArLHJAk.exe
  2⤵
  PID:11040
- C:\Windows\System32\eWEtsrS.exe
  C:\Windows\System32\eWEtsrS.exe
  2⤵
  PID:11080
- C:\Windows\System32\TSpjcbh.exe
  C:\Windows\System32\TSpjcbh.exe
  2⤵
  PID:11108
- C:\Windows\System32\ihIBHPe.exe
  C:\Windows\System32\ihIBHPe.exe
  2⤵
  PID:11140
- C:\Windows\System32\TarPYVE.exe
  C:\Windows\System32\TarPYVE.exe
  2⤵
  PID:11164
- C:\Windows\System32\BQsriAx.exe
  C:\Windows\System32\BQsriAx.exe
  2⤵
  PID:11192
- C:\Windows\System32\fFvGmno.exe
  C:\Windows\System32\fFvGmno.exe
  2⤵
  PID:11208
- C:\Windows\System32\XWRqjNS.exe
  C:\Windows\System32\XWRqjNS.exe
  2⤵
  PID:11252
- C:\Windows\System32\nKZjVRn.exe
  C:\Windows\System32\nKZjVRn.exe
  2⤵
  PID:10268
- C:\Windows\System32\MWwJQOi.exe
  C:\Windows\System32\MWwJQOi.exe
  2⤵
  PID:10324
- C:\Windows\System32\dLjrKfS.exe
  C:\Windows\System32\dLjrKfS.exe
  2⤵
  PID:10368
- C:\Windows\System32\HUzPidN.exe
  C:\Windows\System32\HUzPidN.exe
  2⤵
  PID:10452
- C:\Windows\System32\fGXbTAG.exe
  C:\Windows\System32\fGXbTAG.exe
  2⤵
  PID:10536
- C:\Windows\System32\yfabyhk.exe
  C:\Windows\System32\yfabyhk.exe
  2⤵
  PID:10584
- C:\Windows\System32\yFdYNdV.exe
  C:\Windows\System32\yFdYNdV.exe
  2⤵
  PID:10644
- C:\Windows\System32\bgoTWao.exe
  C:\Windows\System32\bgoTWao.exe
  2⤵
  PID:10700
- C:\Windows\System32\lFDjqDA.exe
  C:\Windows\System32\lFDjqDA.exe
  2⤵
  PID:10768
- C:\Windows\System32\CTeTdFI.exe
  C:\Windows\System32\CTeTdFI.exe
  2⤵
  PID:10820
- C:\Windows\System32\zriLJFT.exe
  C:\Windows\System32\zriLJFT.exe
  2⤵
  PID:10936
- C:\Windows\System32\yaUGWFT.exe
  C:\Windows\System32\yaUGWFT.exe
  2⤵
  PID:11008
- C:\Windows\System32\mTboTWP.exe
  C:\Windows\System32\mTboTWP.exe
  2⤵
  PID:11064
- C:\Windows\System32\LlgEjDk.exe
  C:\Windows\System32\LlgEjDk.exe
  2⤵
  PID:11132
- C:\Windows\System32\YGTTpvy.exe
  C:\Windows\System32\YGTTpvy.exe
  2⤵
  PID:11160
- C:\Windows\System32\zmZgmii.exe
  C:\Windows\System32\zmZgmii.exe
  2⤵
  PID:11232
- C:\Windows\System32\YmmWmrq.exe
  C:\Windows\System32\YmmWmrq.exe
  2⤵
  PID:10396
- C:\Windows\System32\MmgZVyq.exe
  C:\Windows\System32\MmgZVyq.exe
  2⤵
  PID:10528
- C:\Windows\System32\NJWVzqH.exe
  C:\Windows\System32\NJWVzqH.exe
  2⤵
  PID:10612
- C:\Windows\System32\uexBKOR.exe
  C:\Windows\System32\uexBKOR.exe
  2⤵
  PID:10740
- C:\Windows\System32\CuwyGdr.exe
  C:\Windows\System32\CuwyGdr.exe
  2⤵
  PID:10964
- C:\Windows\System32\vybXKqt.exe
  C:\Windows\System32\vybXKqt.exe
  2⤵
  PID:11092
- C:\Windows\System32\eCuDyAv.exe
  C:\Windows\System32\eCuDyAv.exe
  2⤵
  PID:11204
- C:\Windows\System32\hGsofxJ.exe
  C:\Windows\System32\hGsofxJ.exe
  2⤵
  PID:10596
- C:\Windows\System32\ptpPFDH.exe
  C:\Windows\System32\ptpPFDH.exe
  2⤵
  PID:11020
- C:\Windows\System32\grFUiVJ.exe
  C:\Windows\System32\grFUiVJ.exe
  2⤵
  PID:11116
- C:\Windows\System32\POUzsNG.exe
  C:\Windows\System32\POUzsNG.exe
  2⤵
  PID:10924
- C:\Windows\System32\tCZFQSK.exe
  C:\Windows\System32\tCZFQSK.exe
  2⤵
  PID:11292
- C:\Windows\System32\YAqmsnS.exe
  C:\Windows\System32\YAqmsnS.exe
  2⤵
  PID:11308
- C:\Windows\System32\UXLkwiV.exe
  C:\Windows\System32\UXLkwiV.exe
  2⤵
  PID:11328
- C:\Windows\System32\lboEdyp.exe
  C:\Windows\System32\lboEdyp.exe
  2⤵
  PID:11364
- C:\Windows\System32\bBsnHXX.exe
  C:\Windows\System32\bBsnHXX.exe
  2⤵
  PID:11396
- C:\Windows\System32\tPuCVbC.exe
  C:\Windows\System32\tPuCVbC.exe
  2⤵
  PID:11420
- C:\Windows\System32\YhxwGPs.exe
  C:\Windows\System32\YhxwGPs.exe
  2⤵
  PID:11452
- C:\Windows\System32\VRelvvP.exe
  C:\Windows\System32\VRelvvP.exe
  2⤵
  PID:11484
- C:\Windows\System32\KNYkdSM.exe
  C:\Windows\System32\KNYkdSM.exe
  2⤵
  PID:11508
- C:\Windows\System32\FrClqRH.exe
  C:\Windows\System32\FrClqRH.exe
  2⤵
  PID:11540
- C:\Windows\System32\CCdUSWi.exe
  C:\Windows\System32\CCdUSWi.exe
  2⤵
  PID:11572
- C:\Windows\System32\wwMiinS.exe
  C:\Windows\System32\wwMiinS.exe
  2⤵
  PID:11588
- C:\Windows\System32\BRLGwSf.exe
  C:\Windows\System32\BRLGwSf.exe
  2⤵
  PID:11628
- C:\Windows\System32\GlviGjI.exe
  C:\Windows\System32\GlviGjI.exe
  2⤵
  PID:11656
- C:\Windows\System32\ruYXrQy.exe
  C:\Windows\System32\ruYXrQy.exe
  2⤵
  PID:11672
- C:\Windows\System32\vsZdNWa.exe
  C:\Windows\System32\vsZdNWa.exe
  2⤵
  PID:11700
- C:\Windows\System32\nQZyVxl.exe
  C:\Windows\System32\nQZyVxl.exe
  2⤵
  PID:11740
- C:\Windows\System32\QbpHYwx.exe
  C:\Windows\System32\QbpHYwx.exe
  2⤵
  PID:11768
- C:\Windows\System32\URFoLRl.exe
  C:\Windows\System32\URFoLRl.exe
  2⤵
  PID:11796
- C:\Windows\System32\MwhMrxt.exe
  C:\Windows\System32\MwhMrxt.exe
  2⤵
  PID:11824
- C:\Windows\System32\eouoxmM.exe
  C:\Windows\System32\eouoxmM.exe
  2⤵
  PID:11852
- C:\Windows\System32\EutBxLd.exe
  C:\Windows\System32\EutBxLd.exe
  2⤵
  PID:11868
- C:\Windows\System32\nRpzqJi.exe
  C:\Windows\System32\nRpzqJi.exe
  2⤵
  PID:11900
- C:\Windows\System32\EHnpuhI.exe
  C:\Windows\System32\EHnpuhI.exe
  2⤵
  PID:11936
- C:\Windows\System32\GdRmqZB.exe
  C:\Windows\System32\GdRmqZB.exe
  2⤵
  PID:11952
- C:\Windows\System32\GYIsznv.exe
  C:\Windows\System32\GYIsznv.exe
  2⤵
  PID:11980
- C:\Windows\System32\fNKWyGl.exe
  C:\Windows\System32\fNKWyGl.exe
  2⤵
  PID:12012
- C:\Windows\System32\nnBWSTP.exe
  C:\Windows\System32\nnBWSTP.exe
  2⤵
  PID:12048
- C:\Windows\System32\iNnhxuZ.exe
  C:\Windows\System32\iNnhxuZ.exe
  2⤵
  PID:12076
- C:\Windows\System32\keXTXrv.exe
  C:\Windows\System32\keXTXrv.exe
  2⤵
  PID:12104
- C:\Windows\System32\gQDBChx.exe
  C:\Windows\System32\gQDBChx.exe
  2⤵
  PID:12124
- C:\Windows\System32\Qvkronn.exe
  C:\Windows\System32\Qvkronn.exe
  2⤵
  PID:12160
- C:\Windows\System32\RCfDPEc.exe
  C:\Windows\System32\RCfDPEc.exe
  2⤵
  PID:12188
- C:\Windows\System32\OlFxRhg.exe
  C:\Windows\System32\OlFxRhg.exe
  2⤵
  PID:12216
- C:\Windows\System32\bHhUfiG.exe
  C:\Windows\System32\bHhUfiG.exe
  2⤵
  PID:12236
- C:\Windows\System32\RuPpShY.exe
  C:\Windows\System32\RuPpShY.exe
  2⤵
  PID:12260
- C:\Windows\System32\yDAErHW.exe
  C:\Windows\System32\yDAErHW.exe
  2⤵
  PID:11268
- C:\Windows\System32\rWHAbFG.exe
  C:\Windows\System32\rWHAbFG.exe
  2⤵
  PID:11320
- C:\Windows\System32\laaUmdS.exe
  C:\Windows\System32\laaUmdS.exe
  2⤵
  PID:11404
- C:\Windows\System32\QYyvtbS.exe
  C:\Windows\System32\QYyvtbS.exe
  2⤵
  PID:11440
- C:\Windows\System32\DGzDTra.exe
  C:\Windows\System32\DGzDTra.exe
  2⤵
  PID:11548
- C:\Windows\System32\jpNKtPL.exe
  C:\Windows\System32\jpNKtPL.exe
  2⤵
  PID:11580
- C:\Windows\System32\BFGGpcH.exe
  C:\Windows\System32\BFGGpcH.exe
  2⤵
  PID:11652
- C:\Windows\System32\NZhHWtH.exe
  C:\Windows\System32\NZhHWtH.exe
  2⤵
  PID:11712
- C:\Windows\System32\mvpznhF.exe
  C:\Windows\System32\mvpznhF.exe
  2⤵
  PID:11808
- C:\Windows\System32\yRDHRvI.exe
  C:\Windows\System32\yRDHRvI.exe
  2⤵
  PID:11860
- C:\Windows\System32\gQsTYAL.exe
  C:\Windows\System32\gQsTYAL.exe
  2⤵
  PID:11932
- C:\Windows\System32\ajOhXaX.exe
  C:\Windows\System32\ajOhXaX.exe
  2⤵
  PID:11968
- C:\Windows\System32\cDMrEdL.exe
  C:\Windows\System32\cDMrEdL.exe
  2⤵
  PID:12056
- C:\Windows\System32\ZHEhcWp.exe
  C:\Windows\System32\ZHEhcWp.exe
  2⤵
  PID:12132
- C:\Windows\System32\ffvkHys.exe
  C:\Windows\System32\ffvkHys.exe
  2⤵
  PID:12184
- C:\Windows\System32\GRGaOJB.exe
  C:\Windows\System32\GRGaOJB.exe
  2⤵
  PID:12252
- C:\Windows\System32\lnQUSGG.exe
  C:\Windows\System32\lnQUSGG.exe
  2⤵
  PID:11300
- C:\Windows\System32\AmDlohE.exe
  C:\Windows\System32\AmDlohE.exe
  2⤵
  PID:11476
- C:\Windows\System32\kAQcWBh.exe
  C:\Windows\System32\kAQcWBh.exe
  2⤵
  PID:11604
- C:\Windows\System32\TSbLxnO.exe
  C:\Windows\System32\TSbLxnO.exe
  2⤵
  PID:11764
- C:\Windows\System32\CWwdWkm.exe
  C:\Windows\System32\CWwdWkm.exe
  2⤵
  PID:11884
- C:\Windows\System32\LqIMKDf.exe
  C:\Windows\System32\LqIMKDf.exe
  2⤵
  PID:12044
- C:\Windows\System32\QKIHLKu.exe
  C:\Windows\System32\QKIHLKu.exe
  2⤵
  PID:12144
- C:\Windows\System32\ZcOvApB.exe
  C:\Windows\System32\ZcOvApB.exe
  2⤵
  PID:12224
- C:\Windows\System32\VuurBfa.exe
  C:\Windows\System32\VuurBfa.exe
  2⤵
  PID:3916
- C:\Windows\System32\dVzEXgl.exe
  C:\Windows\System32\dVzEXgl.exe
  2⤵
  PID:12008
- C:\Windows\System32\JJZnTkO.exe
  C:\Windows\System32\JJZnTkO.exe
  2⤵
  PID:4864
- C:\Windows\System32\KabbWxB.exe
  C:\Windows\System32\KabbWxB.exe
  2⤵
  PID:11836
- C:\Windows\System32\HeBDPAP.exe
  C:\Windows\System32\HeBDPAP.exe
  2⤵
  PID:12088
- C:\Windows\System32\AYktAVm.exe
  C:\Windows\System32\AYktAVm.exe
  2⤵
  PID:12308
- C:\Windows\System32\ZbenmoC.exe
  C:\Windows\System32\ZbenmoC.exe
  2⤵
  PID:12328
- C:\Windows\System32\clAKrbN.exe
  C:\Windows\System32\clAKrbN.exe
  2⤵
  PID:12356
- C:\Windows\System32\DYXYhod.exe
  C:\Windows\System32\DYXYhod.exe
  2⤵
  PID:12392
- C:\Windows\System32\LObxSba.exe
  C:\Windows\System32\LObxSba.exe
  2⤵
  PID:12408
- C:\Windows\System32\CGeBeYN.exe
  C:\Windows\System32\CGeBeYN.exe
  2⤵
  PID:12448
- C:\Windows\System32\JCnyToz.exe
  C:\Windows\System32\JCnyToz.exe
  2⤵
  PID:12464
- C:\Windows\System32\bQUyUXS.exe
  C:\Windows\System32\bQUyUXS.exe
  2⤵
  PID:12504
- C:\Windows\System32\HFxgPFu.exe
  C:\Windows\System32\HFxgPFu.exe
  2⤵
  PID:12532
- C:\Windows\System32\zvluoJW.exe
  C:\Windows\System32\zvluoJW.exe
  2⤵
  PID:12564
- C:\Windows\System32\uHZVvYf.exe
  C:\Windows\System32\uHZVvYf.exe
  2⤵
  PID:12612
- C:\Windows\System32\wIXSpWj.exe
  C:\Windows\System32\wIXSpWj.exe
  2⤵
  PID:12628
- C:\Windows\System32\TWKStxb.exe
  C:\Windows\System32\TWKStxb.exe
  2⤵
  PID:12644
- C:\Windows\System32\wHTsRgk.exe
  C:\Windows\System32\wHTsRgk.exe
  2⤵
  PID:12684
- C:\Windows\System32\IqhmOnb.exe
  C:\Windows\System32\IqhmOnb.exe
  2⤵
  PID:12712
- C:\Windows\System32\wJjzICo.exe
  C:\Windows\System32\wJjzICo.exe
  2⤵
  PID:12744
- C:\Windows\System32\ENVvnDI.exe
  C:\Windows\System32\ENVvnDI.exe
  2⤵
  PID:12772
- C:\Windows\System32\MQeoYJV.exe
  C:\Windows\System32\MQeoYJV.exe
  2⤵
  PID:12788
- C:\Windows\System32\XIHJFig.exe
  C:\Windows\System32\XIHJFig.exe
  2⤵
  PID:12828
- C:\Windows\System32\anBcwGN.exe
  C:\Windows\System32\anBcwGN.exe
  2⤵
  PID:12852
- C:\Windows\System32\KqWrmNt.exe
  C:\Windows\System32\KqWrmNt.exe
  2⤵
  PID:12884
- C:\Windows\System32\YkNrBHf.exe
  C:\Windows\System32\YkNrBHf.exe
  2⤵
  PID:12904
- C:\Windows\System32\qdnPBkL.exe
  C:\Windows\System32\qdnPBkL.exe
  2⤵
  PID:12928
- C:\Windows\System32\DSDtoxK.exe
  C:\Windows\System32\DSDtoxK.exe
  2⤵
  PID:12968
- C:\Windows\System32\WYBWHWc.exe
  C:\Windows\System32\WYBWHWc.exe
  2⤵
  PID:12984
- C:\Windows\System32\eATxaKT.exe
  C:\Windows\System32\eATxaKT.exe
  2⤵
  PID:13012
- C:\Windows\System32\pljqAFM.exe
  C:\Windows\System32\pljqAFM.exe
  2⤵
  PID:13040
- C:\Windows\System32\qazxLGB.exe
  C:\Windows\System32\qazxLGB.exe
  2⤵
  PID:13080
- C:\Windows\System32\ETsSCyR.exe
  C:\Windows\System32\ETsSCyR.exe
  2⤵
  PID:13108
- C:\Windows\System32\veYxrhB.exe
  C:\Windows\System32\veYxrhB.exe
  2⤵
  PID:13124
- C:\Windows\System32\xmjquOA.exe
  C:\Windows\System32\xmjquOA.exe
  2⤵
  PID:13164
- C:\Windows\System32\DGZJKKP.exe
  C:\Windows\System32\DGZJKKP.exe
  2⤵
  PID:13192
- C:\Windows\System32\DbuzPek.exe
  C:\Windows\System32\DbuzPek.exe
  2⤵
  PID:13224
- C:\Windows\System32\QzWsVGO.exe
  C:\Windows\System32\QzWsVGO.exe
  2⤵
  PID:13248
- C:\Windows\System32\BdatXgN.exe
  C:\Windows\System32\BdatXgN.exe
  2⤵
  PID:13276
- C:\Windows\System32\XZQpokd.exe
  C:\Windows\System32\XZQpokd.exe
  2⤵
  PID:13304
- C:\Windows\System32\rwFqykz.exe
  C:\Windows\System32\rwFqykz.exe
  2⤵
  PID:12340
- C:\Windows\System32\kRGnDtc.exe
  C:\Windows\System32\kRGnDtc.exe
  2⤵
  PID:12380
- C:\Windows\System32\kLGNKtJ.exe
  C:\Windows\System32\kLGNKtJ.exe
  2⤵
  PID:12432
- C:\Windows\System32\pDmAXFQ.exe
  C:\Windows\System32\pDmAXFQ.exe
  2⤵
  PID:12496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BCAYCDa.exe

Path C:\Windows\System32\BCAYCDa.exe
Size 3.3MB
SHA256 b3e6ff3d3bb425d8b923f8c8170bfb6d73eb653aae74b92a9a7bd6ef524a2af6
MD5 b6e8eebb7b74c078db1a6f2d78896aa0
SHA1 a28f63db533ab829cf7c6094817a58001b610799
SHA512 4aaf9bdb7c8069167cc1356698220582611887d9d345d9a3349e08c5c94396608c19930267061a9b7ddea0e91027cb99952f608a053bbd541047f3972f0490d3
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc42:wFWPClFm
MD5 SHA1 SHA512 SSDEEP

Submit Download

BiDCXpH.exe

Path C:\Windows\System32\BiDCXpH.exe
Size 3.3MB
SHA256 e1b97280526c86bf8c55c11e6db36b86c282a60eb1d16a4ef0e6f66c1092e64c
MD5 461689e4ae56ed72d4eb9d1683b97100
SHA1 be794190611f69a6801d2b0ec81597c1d3e95a08
SHA512 a65d44b16b4debaaff104feb1b94d1e52c1ce23a8a314f396fad2dc1c1525cd002c98c0b8546cb4f60c9ce64880030b404083ff654da104987671a2fd2fb5730
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4i:wFWPClFS
MD5 SHA1 SHA512 SSDEEP

Submit Download

CtwmqHL.exe

Path C:\Windows\System32\CtwmqHL.exe
Size 3.3MB
SHA256 7265b372759c60441d009aa8e3de3fbba41c01dbba242fadc5d7c34cce3efdd9
MD5 6e58c8199d103b99d2cd8395fbdbcbba
SHA1 a3f44ada982c5006af75b35b3ca4a18e587558f7
SHA512 c034c53385a3661952e51bb2ebbeee3c78ac3415e1ba1de3179959e9c968a8bb7742b397e064365e8045f4504f85e31c5d3277cd77ad37548ed86d0a04969274
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc44:wFWPClFo
MD5 SHA1 SHA512 SSDEEP

Submit Download

KHvigDX.exe

Path C:\Windows\System32\KHvigDX.exe
Size 3.3MB
SHA256 70a38529dc261a5ff562b216ecea0503b6e66f3695516a17ebbf0283b4318cba
MD5 a9bc9f2e718b1d3914e3f2cb40f54634
SHA1 457c2831d2f518fa0c2ee8eccae040bf26b0e5bc
SHA512 783d625eaf41de66dc31212b4aaabd994d2d73825992bc0c7bf7d9cbde0b769847fea7501207eb5fe916f9353ca1a62b6e7d84da71c691bf032e815424dae495
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4r:wFWPClFb
MD5 SHA1 SHA512 SSDEEP

Submit Download

LREbjFm.exe

Path C:\Windows\System32\LREbjFm.exe
Size 3.3MB
SHA256 d22b4b7a1b19ec62163ac1a020df95a62e49d9b741bfcce4e1a98d028a1b26e2
MD5 432d6a8e116c23a9da4ef52a6e7dbc78
SHA1 0159acbd6ab38feec310c0d11c4053f696fcb05f
SHA512 0b9615256d1c66e2cccdfb9285164216c5196830a61f1b0f3957731be94f237f0e80727b467de38bfcabf618f9cb4a2d8b933b1d95f16171ebecf04212065ad1
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4+:wFWPClFO
MD5 SHA1 SHA512 SSDEEP

Submit Download

OEBbiHi.exe

Path C:\Windows\System32\OEBbiHi.exe
Size 3.3MB
SHA256 93b083755f1156efd982d0038d440be10eeec5cb5e50fd4b66ce2d859c5f07bd
MD5 66e7ceb6bdb0fe9f6dfc89c70dbe12d5
SHA1 521f194a81b2ef24375199147e42afd5c8b68c18
SHA512 3f28f9eda7a1373e653d57f6fc6fab43d971dae28ec647eca65dde087809f25a3370996da0802419668a2fc128beb3c2e5b6575fc5bd14bd60a3b6434c44b54b
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4d:wFWPClFN
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfPwXBb.exe

Path C:\Windows\System32\OfPwXBb.exe
Size 3.3MB
SHA256 b02a8a559e410e7934a60c5bd41dffe6aa62a7a537b1d9a5dfffb0a510b7a30e
MD5 975d2893114ef4e151331c1717b5c830
SHA1 d5fc6d49bcc3a93a8c3aeb8088fc57465376481b
SHA512 049f5a9b352596cdab6faf9d44f7ac68698d4ce2402cbad07d58d5b7e68c016639c3621ec9675c98948c014575de2048ee87ae005845bda135406481d7e98d16
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4Q:wFWPClFg
MD5 SHA1 SHA512 SSDEEP

Submit Download

QYRcOcl.exe

Path C:\Windows\System32\QYRcOcl.exe
Size 3.3MB
SHA256 42c1f18b769dbf749e69f7dbff052271a56fa04df0e095c89e18674cb8762e8c
MD5 fc9a60cb67e74a52a18b2f2fc652eab3
SHA1 bc0732afdc744802dba78ab89947f962de24ac1d
SHA512 1b101302fe1654fc297ebbf29873dcc4c57a90eb98cef07c970309cf393107bda168a2425329ddbc6f4707027db1fdfc85dccc60a7df6d2b9010f1112f51fe75
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4o:wFWPClF4
MD5 SHA1 SHA512 SSDEEP

Submit Download

TZmUgIs.exe

Path C:\Windows\System32\TZmUgIs.exe
Size 3.3MB
SHA256 bd2fdf99e59aee92148bdf4b473d130417c2909fb3eddca1bb41824b2bf7170d
MD5 729281a6b82f44e07cb59471fe041381
SHA1 16e32b0097c49e7ba6e94029387f2d225b76d5bc
SHA512 af78aa5f47bcc54c06deb19b6bf66419478a06b87b88cee19f1dbb2346e26f113b38715f0c4168ade693bcefd91bad241acbaa0fa580735741c55b1009f97f93
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4m:wFWPClF2
MD5 SHA1 SHA512 SSDEEP

Submit Download

TygpnsY.exe

Path C:\Windows\System32\TygpnsY.exe
Size 3.3MB
SHA256 5cd5103d365e77e6ca5d4763eed331f38250a99c42f994c18d34f66b092bdf47
MD5 62f75c52f09a42d31aeb2a0814e20c48
SHA1 e344a73658ab81b5962b74fbd8cedab83f90da2d
SHA512 6f28710450b6f1d2498a1b7981f1fbf98076225116e39e55af27c9874beca2e99d7322b9e6287aa18aa78aa18aa3e4533214508f0e4664a5170d8cb1a6fc18af
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4Y:wFWPClFI
MD5 SHA1 SHA512 SSDEEP

Submit Download

URAtZQA.exe

Path C:\Windows\System32\URAtZQA.exe
Size 3.3MB
SHA256 52cbb1bb3fa0ad0e8cf4792bc08a3aa8b45dbf0d301dea22f133f7b6bba704b3
MD5 f595079603d6f8434849649fd0f6e6d6
SHA1 6888cf9a6d023830d3bcf37120022918d12f8428
SHA512 598da4a90cc76f7e3847b9c637bd0fe074a33c1fc4ee2c304440e4f2b74566caf156d3c4467b5e23a3ce9a28ac22395a116d62eb72718d44d092ea14110d2990
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4s:wFWPClFc
MD5 SHA1 SHA512 SSDEEP

Submit Download

VUtEpFB.exe

Path C:\Windows\System32\VUtEpFB.exe
Size 3.3MB
SHA256 50e978f0cb5984445212d8ee37e5ed3d09fab283f66dc76648774b1c53e96585
MD5 74975f513eec3f7b00a44ff3fbef79b7
SHA1 b6b5bfbf902712f99a24427c8e4caa0c5604bcc5
SHA512 16bfe10862ad25ca22a36808ff51f94f57dd612d390e7ff77a33c19941290ac877cde75c212640ccb6e78a3ce1e99260dda2a06acc188140e622c4d5dc33d2c6
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4V:wFWPClFl
MD5 SHA1 SHA512 SSDEEP

Submit Download

VnmkKCy.exe

Path C:\Windows\System32\VnmkKCy.exe
Size 3.3MB
SHA256 d5570ca8c0854903febb3c16ae235775d1c2e0ff931606bc507e98481a1882a1
MD5 f7064e200dca24522f3ecbe0cf0f22e3
SHA1 a669a9dbba48343337c1156de877b350e85ee88e
SHA512 c02c4ddda0382db6dbb1f5c4ad8578d7be84db0183cdc393a6b756633f1e1069b40844a0d24924becd0006fafba73cfe8bc7d67ffecfd1edd560e67500975509
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4E:wFWPClFU
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmHTCCH.exe

Path C:\Windows\System32\WmHTCCH.exe
Size 3.3MB
SHA256 19c4b7f2b22ba85a8d4ceed4459eb318b8da58a74e4c5c50ce4e53aaeb3849d8
MD5 66b711c5883bd314e4bab86dd870661c
SHA1 cce924a3b803a69773343b8a24070c5ad08dc83d
SHA512 eab44fbd7ff549ce19f32a16008e3335ce224242dc647617701624ba393cfa64829c5f414ebaa571470c947bf69c4bc1c259d7def5a28549fe378c876b2baaa7
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4s:wFWPClFc
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZJgRpUz.exe

Path C:\Windows\System32\ZJgRpUz.exe
Size 3.3MB
SHA256 84bbfb2f1beca413841824a8ea5a775a5a8d020763fdbde9db4292fbfd849472
MD5 9a435ffa5883c273d2382d2c950bf388
SHA1 1d826aab369e63e5352327b36f0ef7d4a38bfb80
SHA512 12e0ad7856d759f1a54d581a267b3573380083408278ab395711ed2b52780d889ad72cbd4f338b90a25d13a6bc353fdda14efb0c9151052c6022b31e078643a4
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4g:wFWPClFw
MD5 SHA1 SHA512 SSDEEP

Submit Download

bunfoue.exe

Path C:\Windows\System32\bunfoue.exe
Size 3.3MB
SHA256 03eafc28c3f1c72e96c4c697ce8a972c8ac9db849f3ea27c7f68cfe9a44a5555
MD5 53b4ba8e8771a6c3972222ce5601a6a5
SHA1 855d8d69fcd515e266510348a6d4f4dfbbafe9e5
SHA512 ffe4e0866f6911d8a715fb4933b4f2ddf601333af1d997b543d7a00b4e7dc3d1be7e0d787bf338c63a1cec62e4117e293d2ade9b557b3922fe29dac09a192516
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4z:wFWPClFD
MD5 SHA1 SHA512 SSDEEP

Submit Download

cqrVbPH.exe

Path C:\Windows\System32\cqrVbPH.exe
Size 3.3MB
SHA256 fa2a855a72b1b771562947bb21f689fdbc22d15059199b89a79c7be133ce9543
MD5 5dab2424f1bd70b56d36abb1677a7edf
SHA1 8f6c1d252ec16780a2632026fc4fad552e6748d3
SHA512 e06b51ec18b2ee05ff715aed895b11d22bf19416ff5177922ddfa131d0035a46d7da5b462e452068ccae9c025fde83d07cbc85e44e36a658867bcb009ef893b2
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4w:wFWPClFA
MD5 SHA1 SHA512 SSDEEP

Submit Download

dsBCocp.exe

Path C:\Windows\System32\dsBCocp.exe
Size 3.3MB
SHA256 2201340a6e6d2e5a95ef0e32a5354f7f16f0a4c2fdde814fe16b82f75b2fa6d7
MD5 3a12e52c1ac52ed5de59f5c85de072a6
SHA1 1e5a497f0c99e645b480a708e9044ac2e44b1788
SHA512 facd17463c50576fa6579aaba6fa49d342dfc5d5dc130c265ebeeb2f25280de73190a3622525062d230c45f1fb65d8653611c0a1baacef034fd2e6e8ae3486ba
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc42:wFWPClFG
MD5 SHA1 SHA512 SSDEEP

Submit Download

fovrqhK.exe

Path C:\Windows\System32\fovrqhK.exe
Size 3.3MB
SHA256 486092022f8f74273d558ba60115fb6b7c93624cd591cd02e5f067d390dc6f05
MD5 e56a68e40f226ab5371a3989cd1772de
SHA1 36fc5716371dfedc6107722a4c35260c7a3ccdc6
SHA512 e4708e51b5a8372f0686c9a7bc59cc2dc1a9c06a8f57a1cdfcddd37c21e9523fcb7bfd664e1dc306de76ab65633143e91f556004267ea03c0ec880348b1c427e
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc49:wFWPClFt
MD5 SHA1 SHA512 SSDEEP

Submit Download

gGkkqAY.exe

Path C:\Windows\System32\gGkkqAY.exe
Size 3.3MB
SHA256 03bad64bf0b461fae161ebb8b0a64799d33c2a9c64f1775eeef585ddae40f05d
MD5 b00f0e95c21f7e7d2b8fab7ee2a380f1
SHA1 3dd19a711f6c12723cf846a1d67bc688dc738ea5
SHA512 771619d9458e1841d45a25155ecfd19667d713c6d1b0b099eec7cd8ee13a679f9f726cb442196a2ebfe065c4cc1a0c7ee3a82b016905777d0cf499419e5b0663
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc41:wFWPClFl
MD5 SHA1 SHA512 SSDEEP

Submit Download

hCgKVip.exe

Path C:\Windows\System32\hCgKVip.exe
Size 3.3MB
SHA256 5bcd025165a1fa2620756c92899205f8d1bda9851e9a14836a640c0bd6d61cff
MD5 6b37a54cddc42b0eca384dc2a0c8b208
SHA1 367698bddce07be65fd180eb9bc5c49aab6d1760
SHA512 13b811a74ca3686f6c1ca7bb111f081085a6adfac29e7182a89022a8970a4fcab8f69553ebb8554a21aa897fe0e38eacf9358517ed67b993e816fda735b8371f
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4W:wFWPClFG
MD5 SHA1 SHA512 SSDEEP

Submit Download

ixPbgMn.exe

Path C:\Windows\System32\ixPbgMn.exe
Size 3.3MB
SHA256 4cc36965e1e3c552e0afec6cd72a29ee253b4441dc6f1ec609946c59dca898a7
MD5 d2fd19230527db4ce65f61a9ad0ce6be
SHA1 3f90383833589b9d20b9467872f69749c0ea8552
SHA512 6889f6a41c4f18ac7761b2cfd2db98e8a906bb8445b0d2b0a80f424153d7f6ea0fc0920f99d9bd1ada9e44dcce473135a267fbb3d85796a95b9450f026b2f516
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4J:wFWPClF5
MD5 SHA1 SHA512 SSDEEP

Submit Download

kWwEEhl.exe

Path C:\Windows\System32\kWwEEhl.exe
Size 3.3MB
SHA256 71789fccf72371043d8115b92ae3bb4fe07d4ef0dd52c9a15c0a47370195d4ba
MD5 457eec99f6291a418c9d142a27d877ce
SHA1 6d2e7a9fc464bfe89319fc648ea68329dca6dcf1
SHA512 fcfd5982a7505164b2971ad3f93101990a671a89ed9e122f6344884e3fad10d31452cf759dd5f6ccc6979cf3ced2253d30ee878c795f86173e3e6c9a6207ab72
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4U:wFWPClFk
MD5 SHA1 SHA512 SSDEEP

Submit Download

mafuHiJ.exe

Path C:\Windows\System32\mafuHiJ.exe
Size 3.3MB
SHA256 29b2bb50af69aa7480efc86f5cc61a6694fae02d175238c4bda435bbec43db85
MD5 b8c8c4c2ea22df9468fa0d6f324d0785
SHA1 44070b35df71e086e587165b493663b8320da00b
SHA512 f2c17643a7c6efe85c70d78cb0f7640909f531aa339ad39933071528dcfb2c9d2fb92fd2cd261060e2c7e1618d57973c9923aad7d624be96aea3706b53b4b6e6
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4N:wFWPClF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

otHZqhr.exe

Path C:\Windows\System32\otHZqhr.exe
Size 3.3MB
SHA256 969a4eb31f7ebc77adfbb5d5cf74a11369f19853a3b7e39252943d5cb444be25
MD5 66d51c1f5e7969c8be669fc15e779de6
SHA1 82a23d69d589870e772bd5f91ae22869998705a8
SHA512 84bf2082164ff6d914141263a750fb7a111c799308c6a8533f6e8772d0f781b4b6a607228cd581bc16b513672844a599cf28c4bfb569ce78bf2214d8abf9fb9e
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4o:wFWPClFY
MD5 SHA1 SHA512 SSDEEP

Submit Download

plyCvJk.exe

Path C:\Windows\System32\plyCvJk.exe
Size 3.3MB
SHA256 fb3d1eef5da48db3c2d45b1fe2c6619eb2730674ae5ba54f9ec4375145bedc89
MD5 45c4054867a102a0f24244ff060c1506
SHA1 d56b88c5ad20fb511337d0704f8e3b089a32f022
SHA512 df0f680beebc1cde6b51c44d78707ade6f1b99581ae3e7be4c6e5d9ffecf9da04e38091a7ba3aa9031c4d3b1d94e36454cdadeaaae1a89e7d08f59ac9fc86d23
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc42:wFWPClFG
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqeNxlY.exe

Path C:\Windows\System32\sqeNxlY.exe
Size 3.3MB
SHA256 37bec7baa603d156a3d85721d030d85ec77580f2648ee7e3dd8ed58ed0a3fa98
MD5 92ba50a61bfa2b5ac3c8f3884654d74e
SHA1 3ffbee1b7f863f94ee740eed6f837833a70d41d5
SHA512 88762049a26d9834028cf23736f7855f237b801a5abd6b19cfc3efc32d0227b07f8499ad4148ab1c169460347ad7eb04dccb492f33e25d50f4120fd31da14025
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4f:wFWPClFv
MD5 SHA1 SHA512 SSDEEP

Submit Download

swSCbZZ.exe

Path C:\Windows\System32\swSCbZZ.exe
Size 3.3MB
SHA256 d90733a86deb215de13ed023d34f931c09eb7248df347a77f395cf0627aca3d9
MD5 a3ff6edf250312b6c0a22b0919d83dd8
SHA1 fb75d9a2fe4c947b3279c29fdfc16bfed9b104ec
SHA512 98d962e6021274ac831b7990ec593c08373098759cf3c2cd5a2d0552ed491016fdaf77bdae6738187daf9243f91ef05a772e285c8562b45a2b53b7f046d95911
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc40:wFWPClFE
MD5 SHA1 SHA512 SSDEEP

Submit Download

wLdPHjT.exe

Path C:\Windows\System32\wLdPHjT.exe
Size 3.3MB
SHA256 c790aed9d1c116aa6ea4b1f717c1303304a9a59bc0db0b1cdbfe16d163a84d75
MD5 1294f96fe3b7982a1fa3dd9d307a4a47
SHA1 ac24c7572f557525f131f2dc96d74092ce405c71
SHA512 b10512a3a171ad4789a519a34dc1ad31ced13c0a48f53761d2f9dca2379fe5c55caedcd6e37a5a7a514fdc1b7a86125785d6a69e46538e537ecca880c75fa118
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4E:wFWPClF0
MD5 SHA1 SHA512 SSDEEP

Submit Download

xLJBkhq.exe

Path C:\Windows\System32\xLJBkhq.exe
Size 3.3MB
SHA256 989002321090bfa6886d9139132263569d9ec733fc5244679a4a7fbdf89b94dd
MD5 3cc637f22c245baf61dc7e28134c9037
SHA1 ab30c8b1bfd9dd86081ce9c6249c026d7ad4ef51
SHA512 b6cde7fefadbee5dd15932ecc2e201e4a80d083fbd82850f57f89d3e896177c951d64d524a9ec9b4ec2e3700b3afebf990b566adb179dfc14f0ca8a7aab1fb78
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4x:wFWPClFh
MD5 SHA1 SHA512 SSDEEP

Submit Download

xYBjGtB.exe

Path C:\Windows\System32\xYBjGtB.exe
Size 3.3MB
SHA256 0fe985bf65a2f05a7245a50a41a46ce50fe7450dd2e78d2f24fbb7a21cf5025d
MD5 d9a0646fb556064e415447deb8f657d2
SHA1 3cad9a84287d9ccb3dcb48eacbd868869d509e0c
SHA512 c4aacf517339ae2b2f0b01d28cd0c9f013b83074f3d967c085df3b918440f77ce1621af9702f98253728a1c6c3b46531bb396722ff4a124ccc0380a694510c42
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4L:wFWPClFb
MD5 SHA1 SHA512 SSDEEP

Submit Download

zesUcQQ.exe

Path C:\Windows\System32\zesUcQQ.exe
Size 3.3MB
SHA256 4b78105f40a837a92b3d9b1e607345f08a59606b731210dd777879455ce8dd1c
MD5 76e6e052b96b744d92bd097063937cbc
SHA1 bf765ffd4bceb0ceab715995fe030c9eed9d9a19
SHA512 123e2436c22836ca5503c19dd2c0ee0b15e461fdd3560857409d056df7d5c5b6f8ab65d6c0f1035fa7b0eb754791ff91d6af297ef444de1d465153f8da17068c
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4O:wFWPClF+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/400-706-0x00007FF7E9290000-0x00007FF7E9685000-memory.dmp

Download

memory/400-1938-0x00007FF7E9290000-0x00007FF7E9685000-memory.dmp

Download

memory/548-1917-0x00007FF66D6F0000-0x00007FF66DAE5000-memory.dmp

Download

memory/548-16-0x00007FF66D6F0000-0x00007FF66DAE5000-memory.dmp

Download

memory/1344-1939-0x00007FF604730000-0x00007FF604B25000-memory.dmp

Download

memory/1344-701-0x00007FF604730000-0x00007FF604B25000-memory.dmp

Download

memory/1644-1927-0x00007FF697000000-0x00007FF6973F5000-memory.dmp

Download

memory/1644-675-0x00007FF697000000-0x00007FF6973F5000-memory.dmp

Download

memory/1740-1920-0x00007FF7B6760000-0x00007FF7B6B55000-memory.dmp

Download

memory/1740-676-0x00007FF7B6760000-0x00007FF7B6B55000-memory.dmp

Download

memory/2136-1925-0x00007FF7B8DF0000-0x00007FF7B91E5000-memory.dmp

Download

memory/2136-672-0x00007FF7B8DF0000-0x00007FF7B91E5000-memory.dmp

Download

memory/2180-689-0x00007FF67E8C0000-0x00007FF67ECB5000-memory.dmp

Download

memory/2180-1932-0x00007FF67E8C0000-0x00007FF67ECB5000-memory.dmp

Download

memory/2200-1940-0x00007FF7A9F10000-0x00007FF7AA305000-memory.dmp

Download

memory/2200-724-0x00007FF7A9F10000-0x00007FF7AA305000-memory.dmp

Download

memory/2268-1924-0x00007FF6C3740000-0x00007FF6C3B35000-memory.dmp

Download

memory/2268-679-0x00007FF6C3740000-0x00007FF6C3B35000-memory.dmp

Download

memory/2424-1922-0x00007FF655F60000-0x00007FF656355000-memory.dmp

Download

memory/2424-673-0x00007FF655F60000-0x00007FF656355000-memory.dmp

Download

memory/2616-1928-0x00007FF710D60000-0x00007FF711155000-memory.dmp

Download

memory/2616-685-0x00007FF710D60000-0x00007FF711155000-memory.dmp

Download

memory/2800-0-0x00007FF786380000-0x00007FF786775000-memory.dmp

Download

memory/2800-1-0x000002AC17B10000-0x000002AC17B20000-memory.dmp

Download

memory/2836-670-0x00007FF635F00000-0x00007FF6362F5000-memory.dmp

Download

memory/2836-1919-0x00007FF635F00000-0x00007FF6362F5000-memory.dmp

Download

memory/2952-721-0x00007FF70E940000-0x00007FF70ED35000-memory.dmp

Download

memory/2952-1936-0x00007FF70E940000-0x00007FF70ED35000-memory.dmp

Download

memory/3084-714-0x00007FF65B7F0000-0x00007FF65BBE5000-memory.dmp

Download

memory/3084-1937-0x00007FF65B7F0000-0x00007FF65BBE5000-memory.dmp

Download

memory/3584-690-0x00007FF665980000-0x00007FF665D75000-memory.dmp

Download

memory/3584-1931-0x00007FF665980000-0x00007FF665D75000-memory.dmp

Download

memory/3764-1926-0x00007FF7DD7B0000-0x00007FF7DDBA5000-memory.dmp

Download

memory/3764-747-0x00007FF7DD7B0000-0x00007FF7DDBA5000-memory.dmp

Download

memory/3852-1935-0x00007FF775090000-0x00007FF775485000-memory.dmp

Download

memory/3852-725-0x00007FF775090000-0x00007FF775485000-memory.dmp

Download

memory/3936-1921-0x00007FF7A6C50000-0x00007FF7A7045000-memory.dmp

Download

memory/3936-674-0x00007FF7A6C50000-0x00007FF7A7045000-memory.dmp

Download

memory/3996-1933-0x00007FF796100000-0x00007FF7964F5000-memory.dmp

Download

memory/3996-696-0x00007FF796100000-0x00007FF7964F5000-memory.dmp

Download

memory/4324-1934-0x00007FF7614A0000-0x00007FF761895000-memory.dmp

Download

memory/4324-736-0x00007FF7614A0000-0x00007FF761895000-memory.dmp

Download

memory/4432-1929-0x00007FF7600E0000-0x00007FF7604D5000-memory.dmp

Download

memory/4432-731-0x00007FF7600E0000-0x00007FF7604D5000-memory.dmp

Download

memory/4484-1923-0x00007FF6F49D0000-0x00007FF6F4DC5000-memory.dmp

Download

memory/4484-671-0x00007FF6F49D0000-0x00007FF6F4DC5000-memory.dmp

Download

memory/4944-1930-0x00007FF79B6F0000-0x00007FF79BAE5000-memory.dmp

Download

memory/4944-729-0x00007FF79B6F0000-0x00007FF79BAE5000-memory.dmp

Download

memory/5112-742-0x00007FF7077C0000-0x00007FF707BB5000-memory.dmp

Download

memory/5112-1918-0x00007FF7077C0000-0x00007FF707BB5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads