xmrig | c9897bba081fac867aa8e369691c4b43e83741980877e1a332751ac696d5d96a

Analysis

max time kernel
63s
max time network
58s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 09:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
Size 1.9MB
Sample240613-lc998ssfne
SHA256 c9897bba081fac867aa8e369691c4b43e83741980877e1a332751ac696d5d96a
MD5 7058e685e883ce92ea8d8b7df97fbde0
SHA1 250cfdf389fbd07d07af894eba634138e7cc3ca6
SHA512 a34dba3ead01ffc823a394507a670b9fceb42f4a726924fe73ed803952eacb0b3eb11e9b8094c8f7f457b70c85e5a1ac5a66aa031e43bd429b8c3279ccf314f6
SSDEEP 49152:knw9oUUEEDlOuJv0oD5WBsv5AK6kxGTnburH/:kQUEEZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 50 IoCs

miner

resource	yara_rule
behavioral2/memory/3600-459-0x00007FF665A10000-0x00007FF665E01000-memory.dmp	xmrig
behavioral2/memory/780-465-0x00007FF7174F0000-0x00007FF7178E1000-memory.dmp	xmrig
behavioral2/memory/4344-478-0x00007FF7FD800000-0x00007FF7FDBF1000-memory.dmp	xmrig
behavioral2/memory/2536-482-0x00007FF7B7E70000-0x00007FF7B8261000-memory.dmp	xmrig
behavioral2/memory/3040-497-0x00007FF76C530000-0x00007FF76C921000-memory.dmp	xmrig
behavioral2/memory/1612-507-0x00007FF73F790000-0x00007FF73FB81000-memory.dmp	xmrig
behavioral2/memory/2620-511-0x00007FF73B640000-0x00007FF73BA31000-memory.dmp	xmrig
behavioral2/memory/4180-516-0x00007FF75CF90000-0x00007FF75D381000-memory.dmp	xmrig
behavioral2/memory/2012-518-0x00007FF68D6C0000-0x00007FF68DAB1000-memory.dmp	xmrig
behavioral2/memory/2948-503-0x00007FF670640000-0x00007FF670A31000-memory.dmp	xmrig
behavioral2/memory/1088-489-0x00007FF730600000-0x00007FF7309F1000-memory.dmp	xmrig
behavioral2/memory/1124-483-0x00007FF6EEC40000-0x00007FF6EF031000-memory.dmp	xmrig
behavioral2/memory/2280-525-0x00007FF6A3730000-0x00007FF6A3B21000-memory.dmp	xmrig
behavioral2/memory/5052-524-0x00007FF72F520000-0x00007FF72F911000-memory.dmp	xmrig
behavioral2/memory/4944-526-0x00007FF6F5C50000-0x00007FF6F6041000-memory.dmp	xmrig
behavioral2/memory/3208-529-0x00007FF6C9630000-0x00007FF6C9A21000-memory.dmp	xmrig
behavioral2/memory/2852-531-0x00007FF7D7C90000-0x00007FF7D8081000-memory.dmp	xmrig
behavioral2/memory/3476-534-0x00007FF6AF150000-0x00007FF6AF541000-memory.dmp	xmrig
behavioral2/memory/884-533-0x00007FF6B3B60000-0x00007FF6B3F51000-memory.dmp	xmrig
behavioral2/memory/2596-33-0x00007FF642350000-0x00007FF642741000-memory.dmp	xmrig
behavioral2/memory/4696-17-0x00007FF798490000-0x00007FF798881000-memory.dmp	xmrig
behavioral2/memory/1548-1978-0x00007FF727E20000-0x00007FF728211000-memory.dmp	xmrig
behavioral2/memory/4020-1979-0x00007FF775F60000-0x00007FF776351000-memory.dmp	xmrig
behavioral2/memory/4908-1980-0x00007FF7F6C60000-0x00007FF7F7051000-memory.dmp	xmrig
behavioral2/memory/4696-2012-0x00007FF798490000-0x00007FF798881000-memory.dmp	xmrig
behavioral2/memory/2296-2014-0x00007FF762380000-0x00007FF762771000-memory.dmp	xmrig
behavioral2/memory/2596-2052-0x00007FF642350000-0x00007FF642741000-memory.dmp	xmrig
behavioral2/memory/3600-2056-0x00007FF665A10000-0x00007FF665E01000-memory.dmp	xmrig
behavioral2/memory/780-2058-0x00007FF7174F0000-0x00007FF7178E1000-memory.dmp	xmrig
behavioral2/memory/4908-2054-0x00007FF7F6C60000-0x00007FF7F7051000-memory.dmp	xmrig
behavioral2/memory/2296-2050-0x00007FF762380000-0x00007FF762771000-memory.dmp	xmrig
behavioral2/memory/4696-2048-0x00007FF798490000-0x00007FF798881000-memory.dmp	xmrig
behavioral2/memory/4020-2046-0x00007FF775F60000-0x00007FF776351000-memory.dmp	xmrig
behavioral2/memory/2536-2081-0x00007FF7B7E70000-0x00007FF7B8261000-memory.dmp	xmrig
behavioral2/memory/4344-2082-0x00007FF7FD800000-0x00007FF7FDBF1000-memory.dmp	xmrig
behavioral2/memory/3476-2092-0x00007FF6AF150000-0x00007FF6AF541000-memory.dmp	xmrig
behavioral2/memory/884-2090-0x00007FF6B3B60000-0x00007FF6B3F51000-memory.dmp	xmrig
behavioral2/memory/4944-2088-0x00007FF6F5C50000-0x00007FF6F6041000-memory.dmp	xmrig
behavioral2/memory/2852-2086-0x00007FF7D7C90000-0x00007FF7D8081000-memory.dmp	xmrig
behavioral2/memory/3208-2084-0x00007FF6C9630000-0x00007FF6C9A21000-memory.dmp	xmrig
behavioral2/memory/1088-2077-0x00007FF730600000-0x00007FF7309F1000-memory.dmp	xmrig
behavioral2/memory/3040-2075-0x00007FF76C530000-0x00007FF76C921000-memory.dmp	xmrig
behavioral2/memory/2948-2073-0x00007FF670640000-0x00007FF670A31000-memory.dmp	xmrig
behavioral2/memory/1612-2071-0x00007FF73F790000-0x00007FF73FB81000-memory.dmp	xmrig
behavioral2/memory/2012-2065-0x00007FF68D6C0000-0x00007FF68DAB1000-memory.dmp	xmrig
behavioral2/memory/5052-2063-0x00007FF72F520000-0x00007FF72F911000-memory.dmp	xmrig
behavioral2/memory/1124-2079-0x00007FF6EEC40000-0x00007FF6EF031000-memory.dmp	xmrig
behavioral2/memory/2620-2069-0x00007FF73B640000-0x00007FF73BA31000-memory.dmp	xmrig
behavioral2/memory/4180-2067-0x00007FF75CF90000-0x00007FF75D381000-memory.dmp	xmrig
behavioral2/memory/2280-2061-0x00007FF6A3730000-0x00007FF6A3B21000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4020	mvePrgP.exe
4696	kYxsCbo.exe
4908	yGLtgDQ.exe
2296	fOkJNSM.exe
2596	EGygmtD.exe
3600	ZmGKfru.exe
780	hCFpFeF.exe
4344	mckgEUl.exe
2536	oodccXj.exe
1124	XvwVSjP.exe
1088	RLfEExT.exe
3040	TbHDZoS.exe
2948	yjIahWl.exe
1612	YWsnfbF.exe
2620	EszcHxE.exe
4180	nhTtWpx.exe
2012	LNqHUog.exe
5052	wEiTAtf.exe
2280	CCmTHSh.exe
4944	MCLkSqj.exe
3208	fkoztGK.exe
2852	tHEwqRp.exe
884	MqQnLbh.exe
3476	iVbuANu.exe
2220	dmMRldV.exe
2068	mBCUfqR.exe
2824	bWksAwP.exe
3336	pCHLRfb.exe
3756	oqFftOa.exe
1664	LFiMIKW.exe
2760	ZcTqGUR.exe
3092	WygdzrK.exe
1780	HjdGptu.exe
752	EiAxCoa.exe
3076	QHCjNqK.exe
3888	hZZRUYz.exe
2376	eQijlpS.exe
4984	QWpysFU.exe
1056	EGXrzZe.exe
1668	UZCXQgz.exe
2264	fpGkDOI.exe
1072	PiBlWLk.exe
936	mwpWHuy.exe
4276	giKxySI.exe
3412	UdpXCtz.exe
696	UoYWPTE.exe
3644	GuKeKfR.exe
1296	ETkdOBJ.exe
4460	tgdzkEW.exe
1256	JVxdrNY.exe
4432	SfBSIIo.exe
900	zYdGswr.exe
856	GmMxqvM.exe
2268	Ipnexxi.exe
4972	fnkqzvL.exe
4444	iddCCFM.exe
1252	aWdDfLV.exe
1660	qzlxZic.exe
4284	EzYHFkL.exe
1240	qUikjdL.exe
4672	EfOglIw.exe
1896	wPgbbPx.exe
3632	HVWKDdP.exe
3436	ggVMxDw.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1548-0-0x00007FF727E20000-0x00007FF728211000-memory.dmp	upx
behavioral2/files/0x00080000000233df-4.dat	upx
behavioral2/files/0x00070000000233e4-7.dat	upx
behavioral2/files/0x00070000000233e3-15.dat	upx
behavioral2/files/0x00070000000233e5-21.dat	upx
behavioral2/files/0x00070000000233e6-30.dat	upx
behavioral2/files/0x00070000000233e9-46.dat	upx
behavioral2/files/0x00070000000233ea-51.dat	upx
behavioral2/files/0x00070000000233eb-56.dat	upx
behavioral2/files/0x00070000000233ec-61.dat	upx
behavioral2/files/0x00070000000233ee-69.dat	upx
behavioral2/files/0x00070000000233ef-76.dat	upx
behavioral2/files/0x00070000000233f2-91.dat	upx
behavioral2/files/0x00070000000233f5-104.dat	upx
behavioral2/files/0x00070000000233f7-116.dat	upx
behavioral2/files/0x00070000000233f9-126.dat	upx
behavioral2/files/0x00070000000233fb-136.dat	upx
behavioral2/memory/3600-459-0x00007FF665A10000-0x00007FF665E01000-memory.dmp	upx
behavioral2/memory/780-465-0x00007FF7174F0000-0x00007FF7178E1000-memory.dmp	upx
behavioral2/memory/4344-478-0x00007FF7FD800000-0x00007FF7FDBF1000-memory.dmp	upx
behavioral2/memory/2536-482-0x00007FF7B7E70000-0x00007FF7B8261000-memory.dmp	upx
behavioral2/memory/3040-497-0x00007FF76C530000-0x00007FF76C921000-memory.dmp	upx
behavioral2/memory/1612-507-0x00007FF73F790000-0x00007FF73FB81000-memory.dmp	upx
behavioral2/memory/2620-511-0x00007FF73B640000-0x00007FF73BA31000-memory.dmp	upx
behavioral2/memory/4180-516-0x00007FF75CF90000-0x00007FF75D381000-memory.dmp	upx
behavioral2/memory/2012-518-0x00007FF68D6C0000-0x00007FF68DAB1000-memory.dmp	upx
behavioral2/memory/2948-503-0x00007FF670640000-0x00007FF670A31000-memory.dmp	upx
behavioral2/memory/1088-489-0x00007FF730600000-0x00007FF7309F1000-memory.dmp	upx
behavioral2/memory/1124-483-0x00007FF6EEC40000-0x00007FF6EF031000-memory.dmp	upx
behavioral2/memory/2280-525-0x00007FF6A3730000-0x00007FF6A3B21000-memory.dmp	upx
behavioral2/memory/5052-524-0x00007FF72F520000-0x00007FF72F911000-memory.dmp	upx
behavioral2/memory/4944-526-0x00007FF6F5C50000-0x00007FF6F6041000-memory.dmp	upx
behavioral2/memory/3208-529-0x00007FF6C9630000-0x00007FF6C9A21000-memory.dmp	upx
behavioral2/memory/2852-531-0x00007FF7D7C90000-0x00007FF7D8081000-memory.dmp	upx
behavioral2/memory/3476-534-0x00007FF6AF150000-0x00007FF6AF541000-memory.dmp	upx
behavioral2/memory/884-533-0x00007FF6B3B60000-0x00007FF6B3F51000-memory.dmp	upx
behavioral2/files/0x0007000000023401-166.dat	upx
behavioral2/files/0x0007000000023400-161.dat	upx
behavioral2/files/0x00070000000233ff-156.dat	upx
behavioral2/files/0x00070000000233fe-151.dat	upx
behavioral2/files/0x00070000000233fd-146.dat	upx
behavioral2/files/0x00070000000233fc-141.dat	upx
behavioral2/files/0x00070000000233fa-131.dat	upx
behavioral2/files/0x00070000000233f8-121.dat	upx
behavioral2/files/0x00070000000233f6-111.dat	upx
behavioral2/files/0x00070000000233f4-101.dat	upx
behavioral2/files/0x00070000000233f3-96.dat	upx
behavioral2/files/0x00070000000233f1-86.dat	upx
behavioral2/files/0x00070000000233f0-81.dat	upx
behavioral2/files/0x00070000000233ed-66.dat	upx
behavioral2/files/0x00070000000233e8-41.dat	upx
behavioral2/files/0x00070000000233e7-36.dat	upx
behavioral2/memory/2596-33-0x00007FF642350000-0x00007FF642741000-memory.dmp	upx
behavioral2/memory/2296-23-0x00007FF762380000-0x00007FF762771000-memory.dmp	upx
behavioral2/memory/4908-22-0x00007FF7F6C60000-0x00007FF7F7051000-memory.dmp	upx
behavioral2/memory/4696-17-0x00007FF798490000-0x00007FF798881000-memory.dmp	upx
behavioral2/memory/4020-8-0x00007FF775F60000-0x00007FF776351000-memory.dmp	upx
behavioral2/memory/1548-1978-0x00007FF727E20000-0x00007FF728211000-memory.dmp	upx
behavioral2/memory/4020-1979-0x00007FF775F60000-0x00007FF776351000-memory.dmp	upx
behavioral2/memory/4908-1980-0x00007FF7F6C60000-0x00007FF7F7051000-memory.dmp	upx
behavioral2/memory/4696-2012-0x00007FF798490000-0x00007FF798881000-memory.dmp	upx
behavioral2/memory/2296-2014-0x00007FF762380000-0x00007FF762771000-memory.dmp	upx
behavioral2/memory/2596-2052-0x00007FF642350000-0x00007FF642741000-memory.dmp	upx
behavioral2/memory/3600-2056-0x00007FF665A10000-0x00007FF665E01000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\tgdzkEW.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\dOhgspB.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\UNVojEp.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\jAlMEMw.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\bvByLAb.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\oqxMnbX.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\HsKkEBg.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\szyvsqJ.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\krmbyCW.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\eRBhQRp.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\YEhlkOf.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\hAaaCsS.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\prqpCbR.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\emfgiJx.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\VLRGqtK.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\JySSory.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\swNhIoH.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\EayTuDL.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\vZuTkyM.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\PrWxvdz.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\KvbbxUD.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\cDXuYPg.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\lDQXSkj.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\mfPsEPm.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\cFpokMD.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\dqekWUB.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\UoYWPTE.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\KOOKEFQ.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\IqScJeN.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\hJSEiIF.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\FvMSovG.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\wFbTHqJ.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\PRNpTZy.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\lFiqMUk.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\kYxsCbo.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\ErXekUt.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\QpdbDbW.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\fdBzPLJ.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\RTEvumF.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\HvRFFkQ.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\cgGdTNG.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\MVQAOEs.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\tOCvgZx.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\ZSAdWWj.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\mqhdMEk.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\XAIiZme.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\wkKDsAo.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\wmGGINK.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\KafKjuw.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\pCHLRfb.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\DatLFcM.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\rAdITeI.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\nIfZrSI.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\ibBkOkE.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\haClbui.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\DaHDgTb.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\YIvKoad.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\XiOJBxN.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\nYHZNFl.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\GlaYEon.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\xnqPJUq.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\XPsSEuw.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\WAoRbjL.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
File created	C:\Windows\System32\uExEkEp.exe	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 4020	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	81
PID 1548 wrote to memory of 4020	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	81
PID 1548 wrote to memory of 4696	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	82
PID 1548 wrote to memory of 4696	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	82
PID 1548 wrote to memory of 4908	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	83
PID 1548 wrote to memory of 4908	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	83
PID 1548 wrote to memory of 2296	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	84
PID 1548 wrote to memory of 2296	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	84
PID 1548 wrote to memory of 2596	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	85
PID 1548 wrote to memory of 2596	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	85
PID 1548 wrote to memory of 3600	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	86
PID 1548 wrote to memory of 3600	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	86
PID 1548 wrote to memory of 780	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	87
PID 1548 wrote to memory of 780	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	87
PID 1548 wrote to memory of 4344	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	88
PID 1548 wrote to memory of 4344	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	88
PID 1548 wrote to memory of 2536	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	89
PID 1548 wrote to memory of 2536	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	89
PID 1548 wrote to memory of 1124	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	90
PID 1548 wrote to memory of 1124	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	90
PID 1548 wrote to memory of 1088	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	91
PID 1548 wrote to memory of 1088	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	91
PID 1548 wrote to memory of 3040	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	92
PID 1548 wrote to memory of 3040	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	92
PID 1548 wrote to memory of 2948	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	93
PID 1548 wrote to memory of 2948	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	93
PID 1548 wrote to memory of 1612	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	94
PID 1548 wrote to memory of 1612	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	94
PID 1548 wrote to memory of 2620	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	95
PID 1548 wrote to memory of 2620	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	95
PID 1548 wrote to memory of 4180	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	96
PID 1548 wrote to memory of 4180	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	96
PID 1548 wrote to memory of 2012	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	97
PID 1548 wrote to memory of 2012	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	97
PID 1548 wrote to memory of 5052	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	98
PID 1548 wrote to memory of 5052	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	98
PID 1548 wrote to memory of 2280	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	99
PID 1548 wrote to memory of 2280	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	99
PID 1548 wrote to memory of 4944	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	100
PID 1548 wrote to memory of 4944	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	100
PID 1548 wrote to memory of 3208	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	101
PID 1548 wrote to memory of 3208	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	101
PID 1548 wrote to memory of 2852	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	102
PID 1548 wrote to memory of 2852	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	102
PID 1548 wrote to memory of 884	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	103
PID 1548 wrote to memory of 884	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	103
PID 1548 wrote to memory of 3476	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	104
PID 1548 wrote to memory of 3476	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	104
PID 1548 wrote to memory of 2220	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	105
PID 1548 wrote to memory of 2220	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	105
PID 1548 wrote to memory of 2068	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	106
PID 1548 wrote to memory of 2068	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	106
PID 1548 wrote to memory of 2824	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	107
PID 1548 wrote to memory of 2824	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	107
PID 1548 wrote to memory of 3336	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	108
PID 1548 wrote to memory of 3336	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	108
PID 1548 wrote to memory of 3756	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	109
PID 1548 wrote to memory of 3756	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	109
PID 1548 wrote to memory of 1664	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	110
PID 1548 wrote to memory of 1664	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	110
PID 1548 wrote to memory of 2760	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	111
PID 1548 wrote to memory of 2760	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	111
PID 1548 wrote to memory of 3092	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	112
PID 1548 wrote to memory of 3092	1548	7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe	112

C:\Users\Admin\AppData\Local\Temp\7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7058e685e883ce92ea8d8b7df97fbde0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\System32\mvePrgP.exe
  C:\Windows\System32\mvePrgP.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System32\kYxsCbo.exe
  C:\Windows\System32\kYxsCbo.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System32\yGLtgDQ.exe
  C:\Windows\System32\yGLtgDQ.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System32\fOkJNSM.exe
  C:\Windows\System32\fOkJNSM.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System32\EGygmtD.exe
  C:\Windows\System32\EGygmtD.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System32\ZmGKfru.exe
  C:\Windows\System32\ZmGKfru.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System32\hCFpFeF.exe
  C:\Windows\System32\hCFpFeF.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System32\mckgEUl.exe
  C:\Windows\System32\mckgEUl.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System32\oodccXj.exe
  C:\Windows\System32\oodccXj.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System32\XvwVSjP.exe
  C:\Windows\System32\XvwVSjP.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System32\RLfEExT.exe
  C:\Windows\System32\RLfEExT.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System32\TbHDZoS.exe
  C:\Windows\System32\TbHDZoS.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System32\yjIahWl.exe
  C:\Windows\System32\yjIahWl.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System32\YWsnfbF.exe
  C:\Windows\System32\YWsnfbF.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System32\EszcHxE.exe
  C:\Windows\System32\EszcHxE.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System32\nhTtWpx.exe
  C:\Windows\System32\nhTtWpx.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System32\LNqHUog.exe
  C:\Windows\System32\LNqHUog.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System32\wEiTAtf.exe
  C:\Windows\System32\wEiTAtf.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System32\CCmTHSh.exe
  C:\Windows\System32\CCmTHSh.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System32\MCLkSqj.exe
  C:\Windows\System32\MCLkSqj.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System32\fkoztGK.exe
  C:\Windows\System32\fkoztGK.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System32\tHEwqRp.exe
  C:\Windows\System32\tHEwqRp.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System32\MqQnLbh.exe
  C:\Windows\System32\MqQnLbh.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System32\iVbuANu.exe
  C:\Windows\System32\iVbuANu.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System32\dmMRldV.exe
  C:\Windows\System32\dmMRldV.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System32\mBCUfqR.exe
  C:\Windows\System32\mBCUfqR.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System32\bWksAwP.exe
  C:\Windows\System32\bWksAwP.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System32\pCHLRfb.exe
  C:\Windows\System32\pCHLRfb.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System32\oqFftOa.exe
  C:\Windows\System32\oqFftOa.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System32\LFiMIKW.exe
  C:\Windows\System32\LFiMIKW.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System32\ZcTqGUR.exe
  C:\Windows\System32\ZcTqGUR.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System32\WygdzrK.exe
  C:\Windows\System32\WygdzrK.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System32\HjdGptu.exe
  C:\Windows\System32\HjdGptu.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System32\EiAxCoa.exe
  C:\Windows\System32\EiAxCoa.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System32\QHCjNqK.exe
  C:\Windows\System32\QHCjNqK.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System32\hZZRUYz.exe
  C:\Windows\System32\hZZRUYz.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System32\eQijlpS.exe
  C:\Windows\System32\eQijlpS.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System32\QWpysFU.exe
  C:\Windows\System32\QWpysFU.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System32\EGXrzZe.exe
  C:\Windows\System32\EGXrzZe.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System32\UZCXQgz.exe
  C:\Windows\System32\UZCXQgz.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System32\fpGkDOI.exe
  C:\Windows\System32\fpGkDOI.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System32\PiBlWLk.exe
  C:\Windows\System32\PiBlWLk.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System32\mwpWHuy.exe
  C:\Windows\System32\mwpWHuy.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System32\giKxySI.exe
  C:\Windows\System32\giKxySI.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System32\UdpXCtz.exe
  C:\Windows\System32\UdpXCtz.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System32\UoYWPTE.exe
  C:\Windows\System32\UoYWPTE.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System32\GuKeKfR.exe
  C:\Windows\System32\GuKeKfR.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System32\ETkdOBJ.exe
  C:\Windows\System32\ETkdOBJ.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System32\tgdzkEW.exe
  C:\Windows\System32\tgdzkEW.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System32\JVxdrNY.exe
  C:\Windows\System32\JVxdrNY.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System32\SfBSIIo.exe
  C:\Windows\System32\SfBSIIo.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System32\zYdGswr.exe
  C:\Windows\System32\zYdGswr.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System32\GmMxqvM.exe
  C:\Windows\System32\GmMxqvM.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System32\Ipnexxi.exe
  C:\Windows\System32\Ipnexxi.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System32\fnkqzvL.exe
  C:\Windows\System32\fnkqzvL.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System32\iddCCFM.exe
  C:\Windows\System32\iddCCFM.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System32\aWdDfLV.exe
  C:\Windows\System32\aWdDfLV.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System32\qzlxZic.exe
  C:\Windows\System32\qzlxZic.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System32\EzYHFkL.exe
  C:\Windows\System32\EzYHFkL.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System32\qUikjdL.exe
  C:\Windows\System32\qUikjdL.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System32\EfOglIw.exe
  C:\Windows\System32\EfOglIw.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System32\wPgbbPx.exe
  C:\Windows\System32\wPgbbPx.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System32\HVWKDdP.exe
  C:\Windows\System32\HVWKDdP.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System32\ggVMxDw.exe
  C:\Windows\System32\ggVMxDw.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System32\fSimMGC.exe
  C:\Windows\System32\fSimMGC.exe
  2⤵
  PID:1964
- C:\Windows\System32\MLcIEZw.exe
  C:\Windows\System32\MLcIEZw.exe
  2⤵
  PID:448
- C:\Windows\System32\nLdyUvo.exe
  C:\Windows\System32\nLdyUvo.exe
  2⤵
  PID:756
- C:\Windows\System32\kZvOHMq.exe
  C:\Windows\System32\kZvOHMq.exe
  2⤵
  PID:1808
- C:\Windows\System32\ibBkOkE.exe
  C:\Windows\System32\ibBkOkE.exe
  2⤵
  PID:4524
- C:\Windows\System32\tIpmOcO.exe
  C:\Windows\System32\tIpmOcO.exe
  2⤵
  PID:1468
- C:\Windows\System32\nnXNohv.exe
  C:\Windows\System32\nnXNohv.exe
  2⤵
  PID:2944
- C:\Windows\System32\EWKmoOv.exe
  C:\Windows\System32\EWKmoOv.exe
  2⤵
  PID:4448
- C:\Windows\System32\QhTWHMn.exe
  C:\Windows\System32\QhTWHMn.exe
  2⤵
  PID:2544
- C:\Windows\System32\sMzbyzW.exe
  C:\Windows\System32\sMzbyzW.exe
  2⤵
  PID:4212
- C:\Windows\System32\qbeUsBf.exe
  C:\Windows\System32\qbeUsBf.exe
  2⤵
  PID:2180
- C:\Windows\System32\uFLETxl.exe
  C:\Windows\System32\uFLETxl.exe
  2⤵
  PID:680
- C:\Windows\System32\TuDhVQQ.exe
  C:\Windows\System32\TuDhVQQ.exe
  2⤵
  PID:4380
- C:\Windows\System32\SwbylCg.exe
  C:\Windows\System32\SwbylCg.exe
  2⤵
  PID:3544
- C:\Windows\System32\PtMzoBd.exe
  C:\Windows\System32\PtMzoBd.exe
  2⤵
  PID:2336
- C:\Windows\System32\nYHZNFl.exe
  C:\Windows\System32\nYHZNFl.exe
  2⤵
  PID:4872
- C:\Windows\System32\fjFDDdA.exe
  C:\Windows\System32\fjFDDdA.exe
  2⤵
  PID:4928
- C:\Windows\System32\daaaXKa.exe
  C:\Windows\System32\daaaXKa.exe
  2⤵
  PID:4980
- C:\Windows\System32\OUcQtQz.exe
  C:\Windows\System32\OUcQtQz.exe
  2⤵
  PID:4652
- C:\Windows\System32\KGLARRt.exe
  C:\Windows\System32\KGLARRt.exe
  2⤵
  PID:4072
- C:\Windows\System32\qLVpIcu.exe
  C:\Windows\System32\qLVpIcu.exe
  2⤵
  PID:2928
- C:\Windows\System32\krmbyCW.exe
  C:\Windows\System32\krmbyCW.exe
  2⤵
  PID:4708
- C:\Windows\System32\uDvPMPu.exe
  C:\Windows\System32\uDvPMPu.exe
  2⤵
  PID:4540
- C:\Windows\System32\OrHfAHN.exe
  C:\Windows\System32\OrHfAHN.exe
  2⤵
  PID:1168
- C:\Windows\System32\pjaWRyA.exe
  C:\Windows\System32\pjaWRyA.exe
  2⤵
  PID:2156
- C:\Windows\System32\xjIWFnJ.exe
  C:\Windows\System32\xjIWFnJ.exe
  2⤵
  PID:2976
- C:\Windows\System32\jTVshlg.exe
  C:\Windows\System32\jTVshlg.exe
  2⤵
  PID:3652
- C:\Windows\System32\ZsADvNh.exe
  C:\Windows\System32\ZsADvNh.exe
  2⤵
  PID:232
- C:\Windows\System32\bdGsykq.exe
  C:\Windows\System32\bdGsykq.exe
  2⤵
  PID:3140
- C:\Windows\System32\aHmGpJk.exe
  C:\Windows\System32\aHmGpJk.exe
  2⤵
  PID:4880
- C:\Windows\System32\bYfvdzU.exe
  C:\Windows\System32\bYfvdzU.exe
  2⤵
  PID:2348
- C:\Windows\System32\bIxjZmg.exe
  C:\Windows\System32\bIxjZmg.exe
  2⤵
  PID:2684
- C:\Windows\System32\pKunkYG.exe
  C:\Windows\System32\pKunkYG.exe
  2⤵
  PID:4628
- C:\Windows\System32\xqJluQs.exe
  C:\Windows\System32\xqJluQs.exe
  2⤵
  PID:2020
- C:\Windows\System32\yZhTuEd.exe
  C:\Windows\System32\yZhTuEd.exe
  2⤵
  PID:4128
- C:\Windows\System32\ynwQvCH.exe
  C:\Windows\System32\ynwQvCH.exe
  2⤵
  PID:3176
- C:\Windows\System32\HvRFFkQ.exe
  C:\Windows\System32\HvRFFkQ.exe
  2⤵
  PID:700
- C:\Windows\System32\MvQYALp.exe
  C:\Windows\System32\MvQYALp.exe
  2⤵
  PID:3604
- C:\Windows\System32\cMwcgfs.exe
  C:\Windows\System32\cMwcgfs.exe
  2⤵
  PID:5132
- C:\Windows\System32\PHqBGYs.exe
  C:\Windows\System32\PHqBGYs.exe
  2⤵
  PID:5160
- C:\Windows\System32\dkzKIhf.exe
  C:\Windows\System32\dkzKIhf.exe
  2⤵
  PID:5188
- C:\Windows\System32\qeggOHo.exe
  C:\Windows\System32\qeggOHo.exe
  2⤵
  PID:5228
- C:\Windows\System32\ywOPEey.exe
  C:\Windows\System32\ywOPEey.exe
  2⤵
  PID:5256
- C:\Windows\System32\OywDUeC.exe
  C:\Windows\System32\OywDUeC.exe
  2⤵
  PID:5272
- C:\Windows\System32\eRBhQRp.exe
  C:\Windows\System32\eRBhQRp.exe
  2⤵
  PID:5300
- C:\Windows\System32\MkKNFcP.exe
  C:\Windows\System32\MkKNFcP.exe
  2⤵
  PID:5340
- C:\Windows\System32\ZzTXsbD.exe
  C:\Windows\System32\ZzTXsbD.exe
  2⤵
  PID:5356
- C:\Windows\System32\YFgPxFV.exe
  C:\Windows\System32\YFgPxFV.exe
  2⤵
  PID:5396
- C:\Windows\System32\lyJGkuV.exe
  C:\Windows\System32\lyJGkuV.exe
  2⤵
  PID:5412
- C:\Windows\System32\nkrbYsa.exe
  C:\Windows\System32\nkrbYsa.exe
  2⤵
  PID:5440
- C:\Windows\System32\QShCHEY.exe
  C:\Windows\System32\QShCHEY.exe
  2⤵
  PID:5468
- C:\Windows\System32\VXGRfEe.exe
  C:\Windows\System32\VXGRfEe.exe
  2⤵
  PID:5496
- C:\Windows\System32\HPrQBIQ.exe
  C:\Windows\System32\HPrQBIQ.exe
  2⤵
  PID:5536
- C:\Windows\System32\vteXOjx.exe
  C:\Windows\System32\vteXOjx.exe
  2⤵
  PID:5564
- C:\Windows\System32\DuxXzmH.exe
  C:\Windows\System32\DuxXzmH.exe
  2⤵
  PID:5580
- C:\Windows\System32\PbjqMQR.exe
  C:\Windows\System32\PbjqMQR.exe
  2⤵
  PID:5608
- C:\Windows\System32\VpdpPmX.exe
  C:\Windows\System32\VpdpPmX.exe
  2⤵
  PID:5636
- C:\Windows\System32\zQvUDGF.exe
  C:\Windows\System32\zQvUDGF.exe
  2⤵
  PID:5672
- C:\Windows\System32\unAXaGg.exe
  C:\Windows\System32\unAXaGg.exe
  2⤵
  PID:5692
- C:\Windows\System32\kkZlfVQ.exe
  C:\Windows\System32\kkZlfVQ.exe
  2⤵
  PID:5732
- C:\Windows\System32\gzsgbIK.exe
  C:\Windows\System32\gzsgbIK.exe
  2⤵
  PID:5748
- C:\Windows\System32\kAGtbJj.exe
  C:\Windows\System32\kAGtbJj.exe
  2⤵
  PID:5776
- C:\Windows\System32\qZfJDJr.exe
  C:\Windows\System32\qZfJDJr.exe
  2⤵
  PID:5816
- C:\Windows\System32\JZWPHir.exe
  C:\Windows\System32\JZWPHir.exe
  2⤵
  PID:5832
- C:\Windows\System32\QQDlMBg.exe
  C:\Windows\System32\QQDlMBg.exe
  2⤵
  PID:5860
- C:\Windows\System32\uvCPjmo.exe
  C:\Windows\System32\uvCPjmo.exe
  2⤵
  PID:5928
- C:\Windows\System32\qdmxPDJ.exe
  C:\Windows\System32\qdmxPDJ.exe
  2⤵
  PID:5944
- C:\Windows\System32\NoHjYjI.exe
  C:\Windows\System32\NoHjYjI.exe
  2⤵
  PID:5972
- C:\Windows\System32\HlAuyqe.exe
  C:\Windows\System32\HlAuyqe.exe
  2⤵
  PID:5988
- C:\Windows\System32\xBWvjzZ.exe
  C:\Windows\System32\xBWvjzZ.exe
  2⤵
  PID:6024
- C:\Windows\System32\tbCjEuZ.exe
  C:\Windows\System32\tbCjEuZ.exe
  2⤵
  PID:6052
- C:\Windows\System32\ZNAnYbK.exe
  C:\Windows\System32\ZNAnYbK.exe
  2⤵
  PID:6076
- C:\Windows\System32\VSZVflK.exe
  C:\Windows\System32\VSZVflK.exe
  2⤵
  PID:6100
- C:\Windows\System32\mPWgnXm.exe
  C:\Windows\System32\mPWgnXm.exe
  2⤵
  PID:6132
- C:\Windows\System32\tOvPpFL.exe
  C:\Windows\System32\tOvPpFL.exe
  2⤵
  PID:3920
- C:\Windows\System32\WnkyApO.exe
  C:\Windows\System32\WnkyApO.exe
  2⤵
  PID:3564
- C:\Windows\System32\GHNvmpI.exe
  C:\Windows\System32\GHNvmpI.exe
  2⤵
  PID:2384
- C:\Windows\System32\VDsiemr.exe
  C:\Windows\System32\VDsiemr.exe
  2⤵
  PID:2756
- C:\Windows\System32\HBrKPSd.exe
  C:\Windows\System32\HBrKPSd.exe
  2⤵
  PID:5208
- C:\Windows\System32\OOjzRpB.exe
  C:\Windows\System32\OOjzRpB.exe
  2⤵
  PID:5236
- C:\Windows\System32\jAlMEMw.exe
  C:\Windows\System32\jAlMEMw.exe
  2⤵
  PID:5332
- C:\Windows\System32\EayTuDL.exe
  C:\Windows\System32\EayTuDL.exe
  2⤵
  PID:4412
- C:\Windows\System32\YAhgaCL.exe
  C:\Windows\System32\YAhgaCL.exe
  2⤵
  PID:5528
- C:\Windows\System32\oVVhRKm.exe
  C:\Windows\System32\oVVhRKm.exe
  2⤵
  PID:5592
- C:\Windows\System32\bXkhvJH.exe
  C:\Windows\System32\bXkhvJH.exe
  2⤵
  PID:1836
- C:\Windows\System32\TLiKsAj.exe
  C:\Windows\System32\TLiKsAj.exe
  2⤵
  PID:3852
- C:\Windows\System32\cASknAv.exe
  C:\Windows\System32\cASknAv.exe
  2⤵
  PID:5764
- C:\Windows\System32\gNPXQsg.exe
  C:\Windows\System32\gNPXQsg.exe
  2⤵
  PID:4684
- C:\Windows\System32\uExEkEp.exe
  C:\Windows\System32\uExEkEp.exe
  2⤵
  PID:5824
- C:\Windows\System32\WmirKMn.exe
  C:\Windows\System32\WmirKMn.exe
  2⤵
  PID:5808
- C:\Windows\System32\ACdazWZ.exe
  C:\Windows\System32\ACdazWZ.exe
  2⤵
  PID:5848
- C:\Windows\System32\ZWhlqpB.exe
  C:\Windows\System32\ZWhlqpB.exe
  2⤵
  PID:4840
- C:\Windows\System32\DBJIupr.exe
  C:\Windows\System32\DBJIupr.exe
  2⤵
  PID:5936
- C:\Windows\System32\ExDJUKK.exe
  C:\Windows\System32\ExDJUKK.exe
  2⤵
  PID:5940
- C:\Windows\System32\KIxEhsu.exe
  C:\Windows\System32\KIxEhsu.exe
  2⤵
  PID:6068
- C:\Windows\System32\qTGfbkc.exe
  C:\Windows\System32\qTGfbkc.exe
  2⤵
  PID:6004
- C:\Windows\System32\ekAYRQW.exe
  C:\Windows\System32\ekAYRQW.exe
  2⤵
  PID:2148
- C:\Windows\System32\bLUfPXT.exe
  C:\Windows\System32\bLUfPXT.exe
  2⤵
  PID:1340
- C:\Windows\System32\mcEJMpN.exe
  C:\Windows\System32\mcEJMpN.exe
  2⤵
  PID:5148
- C:\Windows\System32\rmhjBqJ.exe
  C:\Windows\System32\rmhjBqJ.exe
  2⤵
  PID:5352
- C:\Windows\System32\eUfJiqK.exe
  C:\Windows\System32\eUfJiqK.exe
  2⤵
  PID:3952
- C:\Windows\System32\kIdjuad.exe
  C:\Windows\System32\kIdjuad.exe
  2⤵
  PID:5652
- C:\Windows\System32\EHiWoHO.exe
  C:\Windows\System32\EHiWoHO.exe
  2⤵
  PID:1916
- C:\Windows\System32\JDRRsfl.exe
  C:\Windows\System32\JDRRsfl.exe
  2⤵
  PID:5760
- C:\Windows\System32\MaQFbCG.exe
  C:\Windows\System32\MaQFbCG.exe
  2⤵
  PID:1588
- C:\Windows\System32\jneDPPs.exe
  C:\Windows\System32\jneDPPs.exe
  2⤵
  PID:4080
- C:\Windows\System32\vhfvdSn.exe
  C:\Windows\System32\vhfvdSn.exe
  2⤵
  PID:5624
- C:\Windows\System32\oSYmIQH.exe
  C:\Windows\System32\oSYmIQH.exe
  2⤵
  PID:2632
- C:\Windows\System32\uXteTgc.exe
  C:\Windows\System32\uXteTgc.exe
  2⤵
  PID:6064
- C:\Windows\System32\EwdRwcB.exe
  C:\Windows\System32\EwdRwcB.exe
  2⤵
  PID:6092
- C:\Windows\System32\IkeMkCR.exe
  C:\Windows\System32\IkeMkCR.exe
  2⤵
  PID:1288
- C:\Windows\System32\uxnvsMS.exe
  C:\Windows\System32\uxnvsMS.exe
  2⤵
  PID:5428
- C:\Windows\System32\ZnOiCam.exe
  C:\Windows\System32\ZnOiCam.exe
  2⤵
  PID:5004
- C:\Windows\System32\csBYhLJ.exe
  C:\Windows\System32\csBYhLJ.exe
  2⤵
  PID:5172
- C:\Windows\System32\fWrBzIO.exe
  C:\Windows\System32\fWrBzIO.exe
  2⤵
  PID:3132
- C:\Windows\System32\cTYNhZB.exe
  C:\Windows\System32\cTYNhZB.exe
  2⤵
  PID:2744
- C:\Windows\System32\LrKClVy.exe
  C:\Windows\System32\LrKClVy.exe
  2⤵
  PID:5924
- C:\Windows\System32\DpqgBCn.exe
  C:\Windows\System32\DpqgBCn.exe
  2⤵
  PID:1424
- C:\Windows\System32\rAbPNyr.exe
  C:\Windows\System32\rAbPNyr.exe
  2⤵
  PID:212
- C:\Windows\System32\eqXSGzr.exe
  C:\Windows\System32\eqXSGzr.exe
  2⤵
  PID:6148
- C:\Windows\System32\kvKHlUI.exe
  C:\Windows\System32\kvKHlUI.exe
  2⤵
  PID:6168
- C:\Windows\System32\faMGkXr.exe
  C:\Windows\System32\faMGkXr.exe
  2⤵
  PID:6192
- C:\Windows\System32\rcUbsev.exe
  C:\Windows\System32\rcUbsev.exe
  2⤵
  PID:6212
- C:\Windows\System32\xspTago.exe
  C:\Windows\System32\xspTago.exe
  2⤵
  PID:6320
- C:\Windows\System32\CcpoSfp.exe
  C:\Windows\System32\CcpoSfp.exe
  2⤵
  PID:6336
- C:\Windows\System32\lgZQVEw.exe
  C:\Windows\System32\lgZQVEw.exe
  2⤵
  PID:6356
- C:\Windows\System32\YEhlkOf.exe
  C:\Windows\System32\YEhlkOf.exe
  2⤵
  PID:6380
- C:\Windows\System32\rripdIc.exe
  C:\Windows\System32\rripdIc.exe
  2⤵
  PID:6396
- C:\Windows\System32\WmicCuF.exe
  C:\Windows\System32\WmicCuF.exe
  2⤵
  PID:6448
- C:\Windows\System32\NpnAueZ.exe
  C:\Windows\System32\NpnAueZ.exe
  2⤵
  PID:6480
- C:\Windows\System32\elWeDjT.exe
  C:\Windows\System32\elWeDjT.exe
  2⤵
  PID:6504
- C:\Windows\System32\SiNYPQk.exe
  C:\Windows\System32\SiNYPQk.exe
  2⤵
  PID:6524
- C:\Windows\System32\BsFEToV.exe
  C:\Windows\System32\BsFEToV.exe
  2⤵
  PID:6560
- C:\Windows\System32\VefJycb.exe
  C:\Windows\System32\VefJycb.exe
  2⤵
  PID:6588
- C:\Windows\System32\zTiRHhm.exe
  C:\Windows\System32\zTiRHhm.exe
  2⤵
  PID:6612
- C:\Windows\System32\UGInsAq.exe
  C:\Windows\System32\UGInsAq.exe
  2⤵
  PID:6628
- C:\Windows\System32\qutAJFE.exe
  C:\Windows\System32\qutAJFE.exe
  2⤵
  PID:6644
- C:\Windows\System32\SrEsXzn.exe
  C:\Windows\System32\SrEsXzn.exe
  2⤵
  PID:6668
- C:\Windows\System32\emfgiJx.exe
  C:\Windows\System32\emfgiJx.exe
  2⤵
  PID:6712
- C:\Windows\System32\CFmZjyr.exe
  C:\Windows\System32\CFmZjyr.exe
  2⤵
  PID:6768
- C:\Windows\System32\PlWjOOm.exe
  C:\Windows\System32\PlWjOOm.exe
  2⤵
  PID:6792
- C:\Windows\System32\nVSuwgh.exe
  C:\Windows\System32\nVSuwgh.exe
  2⤵
  PID:6828
- C:\Windows\System32\KOOKEFQ.exe
  C:\Windows\System32\KOOKEFQ.exe
  2⤵
  PID:6844
- C:\Windows\System32\XVSxwsr.exe
  C:\Windows\System32\XVSxwsr.exe
  2⤵
  PID:6896
- C:\Windows\System32\ElHOPsf.exe
  C:\Windows\System32\ElHOPsf.exe
  2⤵
  PID:6912
- C:\Windows\System32\FjRspsA.exe
  C:\Windows\System32\FjRspsA.exe
  2⤵
  PID:6928
- C:\Windows\System32\UVVKojD.exe
  C:\Windows\System32\UVVKojD.exe
  2⤵
  PID:6956
- C:\Windows\System32\fMzDjJa.exe
  C:\Windows\System32\fMzDjJa.exe
  2⤵
  PID:6980
- C:\Windows\System32\NNGAWRG.exe
  C:\Windows\System32\NNGAWRG.exe
  2⤵
  PID:7000
- C:\Windows\System32\anyipcf.exe
  C:\Windows\System32\anyipcf.exe
  2⤵
  PID:7028
- C:\Windows\System32\WoGxwTe.exe
  C:\Windows\System32\WoGxwTe.exe
  2⤵
  PID:7048
- C:\Windows\System32\MCJqgtl.exe
  C:\Windows\System32\MCJqgtl.exe
  2⤵
  PID:7096
- C:\Windows\System32\nQBGlAG.exe
  C:\Windows\System32\nQBGlAG.exe
  2⤵
  PID:7124
- C:\Windows\System32\ErXekUt.exe
  C:\Windows\System32\ErXekUt.exe
  2⤵
  PID:7148
- C:\Windows\System32\vmNLBHM.exe
  C:\Windows\System32\vmNLBHM.exe
  2⤵
  PID:5952
- C:\Windows\System32\BwvffiI.exe
  C:\Windows\System32\BwvffiI.exe
  2⤵
  PID:6228
- C:\Windows\System32\mXovjOR.exe
  C:\Windows\System32\mXovjOR.exe
  2⤵
  PID:6204
- C:\Windows\System32\rXRsZoa.exe
  C:\Windows\System32\rXRsZoa.exe
  2⤵
  PID:6288
- C:\Windows\System32\sDQuUDI.exe
  C:\Windows\System32\sDQuUDI.exe
  2⤵
  PID:6388
- C:\Windows\System32\zttDKGh.exe
  C:\Windows\System32\zttDKGh.exe
  2⤵
  PID:6420
- C:\Windows\System32\cWmmgiN.exe
  C:\Windows\System32\cWmmgiN.exe
  2⤵
  PID:6496
- C:\Windows\System32\MSjQspz.exe
  C:\Windows\System32\MSjQspz.exe
  2⤵
  PID:6576
- C:\Windows\System32\wFmaaPm.exe
  C:\Windows\System32\wFmaaPm.exe
  2⤵
  PID:6664
- C:\Windows\System32\QbfbJoD.exe
  C:\Windows\System32\QbfbJoD.exe
  2⤵
  PID:6708
- C:\Windows\System32\XCUgynu.exe
  C:\Windows\System32\XCUgynu.exe
  2⤵
  PID:6752
- C:\Windows\System32\sFzPiQx.exe
  C:\Windows\System32\sFzPiQx.exe
  2⤵
  PID:6836
- C:\Windows\System32\cdYENUu.exe
  C:\Windows\System32\cdYENUu.exe
  2⤵
  PID:6864
- C:\Windows\System32\NdjlCmw.exe
  C:\Windows\System32\NdjlCmw.exe
  2⤵
  PID:6952
- C:\Windows\System32\fgyhBkf.exe
  C:\Windows\System32\fgyhBkf.exe
  2⤵
  PID:7020
- C:\Windows\System32\LfMPUyK.exe
  C:\Windows\System32\LfMPUyK.exe
  2⤵
  PID:7060
- C:\Windows\System32\vkThSlB.exe
  C:\Windows\System32\vkThSlB.exe
  2⤵
  PID:7112
- C:\Windows\System32\WFdhecL.exe
  C:\Windows\System32\WFdhecL.exe
  2⤵
  PID:6160
- C:\Windows\System32\ZWPNJrc.exe
  C:\Windows\System32\ZWPNJrc.exe
  2⤵
  PID:6308
- C:\Windows\System32\hAaaCsS.exe
  C:\Windows\System32\hAaaCsS.exe
  2⤵
  PID:6476
- C:\Windows\System32\METiqRW.exe
  C:\Windows\System32\METiqRW.exe
  2⤵
  PID:6584
- C:\Windows\System32\inCJoTU.exe
  C:\Windows\System32\inCJoTU.exe
  2⤵
  PID:6680
- C:\Windows\System32\GMIqzrn.exe
  C:\Windows\System32\GMIqzrn.exe
  2⤵
  PID:6744
- C:\Windows\System32\GDxHmtd.exe
  C:\Windows\System32\GDxHmtd.exe
  2⤵
  PID:7016
- C:\Windows\System32\QpdbDbW.exe
  C:\Windows\System32\QpdbDbW.exe
  2⤵
  PID:7088
- C:\Windows\System32\mprRwpH.exe
  C:\Windows\System32\mprRwpH.exe
  2⤵
  PID:6328
- C:\Windows\System32\NXsOEip.exe
  C:\Windows\System32\NXsOEip.exe
  2⤵
  PID:6652
- C:\Windows\System32\iIfCjXx.exe
  C:\Windows\System32\iIfCjXx.exe
  2⤵
  PID:6904
- C:\Windows\System32\ruOBtQv.exe
  C:\Windows\System32\ruOBtQv.exe
  2⤵
  PID:6164
- C:\Windows\System32\zzffkmi.exe
  C:\Windows\System32\zzffkmi.exe
  2⤵
  PID:7188
- C:\Windows\System32\qVJKFyQ.exe
  C:\Windows\System32\qVJKFyQ.exe
  2⤵
  PID:7224
- C:\Windows\System32\FBFrKze.exe
  C:\Windows\System32\FBFrKze.exe
  2⤵
  PID:7272
- C:\Windows\System32\Rgzlunm.exe
  C:\Windows\System32\Rgzlunm.exe
  2⤵
  PID:7292
- C:\Windows\System32\bjSZiMK.exe
  C:\Windows\System32\bjSZiMK.exe
  2⤵
  PID:7316
- C:\Windows\System32\NflCsau.exe
  C:\Windows\System32\NflCsau.exe
  2⤵
  PID:7344
- C:\Windows\System32\priUhpI.exe
  C:\Windows\System32\priUhpI.exe
  2⤵
  PID:7408
- C:\Windows\System32\OjplUBV.exe
  C:\Windows\System32\OjplUBV.exe
  2⤵
  PID:7432
- C:\Windows\System32\PvlhMml.exe
  C:\Windows\System32\PvlhMml.exe
  2⤵
  PID:7476
- C:\Windows\System32\joNsGht.exe
  C:\Windows\System32\joNsGht.exe
  2⤵
  PID:7492
- C:\Windows\System32\nBcVNng.exe
  C:\Windows\System32\nBcVNng.exe
  2⤵
  PID:7512
- C:\Windows\System32\dzuLXiv.exe
  C:\Windows\System32\dzuLXiv.exe
  2⤵
  PID:7532
- C:\Windows\System32\cDXuYPg.exe
  C:\Windows\System32\cDXuYPg.exe
  2⤵
  PID:7548
- C:\Windows\System32\heawrFC.exe
  C:\Windows\System32\heawrFC.exe
  2⤵
  PID:7564
- C:\Windows\System32\SmxLjWU.exe
  C:\Windows\System32\SmxLjWU.exe
  2⤵
  PID:7588
- C:\Windows\System32\irwXkBu.exe
  C:\Windows\System32\irwXkBu.exe
  2⤵
  PID:7636
- C:\Windows\System32\pVMyRdw.exe
  C:\Windows\System32\pVMyRdw.exe
  2⤵
  PID:7664
- C:\Windows\System32\LCGMBSY.exe
  C:\Windows\System32\LCGMBSY.exe
  2⤵
  PID:7692
- C:\Windows\System32\FOZSgWV.exe
  C:\Windows\System32\FOZSgWV.exe
  2⤵
  PID:7720
- C:\Windows\System32\YnLwbQI.exe
  C:\Windows\System32\YnLwbQI.exe
  2⤵
  PID:7760
- C:\Windows\System32\mXllAcf.exe
  C:\Windows\System32\mXllAcf.exe
  2⤵
  PID:7788
- C:\Windows\System32\zNtlnzd.exe
  C:\Windows\System32\zNtlnzd.exe
  2⤵
  PID:7828
- C:\Windows\System32\OuBjpEx.exe
  C:\Windows\System32\OuBjpEx.exe
  2⤵
  PID:7856
- C:\Windows\System32\CazSfWr.exe
  C:\Windows\System32\CazSfWr.exe
  2⤵
  PID:7884
- C:\Windows\System32\OBnFgPS.exe
  C:\Windows\System32\OBnFgPS.exe
  2⤵
  PID:7900
- C:\Windows\System32\IqScJeN.exe
  C:\Windows\System32\IqScJeN.exe
  2⤵
  PID:7928
- C:\Windows\System32\NPwmosH.exe
  C:\Windows\System32\NPwmosH.exe
  2⤵
  PID:7948
- C:\Windows\System32\PVITOcd.exe
  C:\Windows\System32\PVITOcd.exe
  2⤵
  PID:7988
- C:\Windows\System32\JHDRgdG.exe
  C:\Windows\System32\JHDRgdG.exe
  2⤵
  PID:8012
- C:\Windows\System32\OhEmKOB.exe
  C:\Windows\System32\OhEmKOB.exe
  2⤵
  PID:8032
- C:\Windows\System32\quIyEqV.exe
  C:\Windows\System32\quIyEqV.exe
  2⤵
  PID:8068
- C:\Windows\System32\YfgzHMt.exe
  C:\Windows\System32\YfgzHMt.exe
  2⤵
  PID:8096
- C:\Windows\System32\Dgffwii.exe
  C:\Windows\System32\Dgffwii.exe
  2⤵
  PID:8120
- C:\Windows\System32\LUieUKO.exe
  C:\Windows\System32\LUieUKO.exe
  2⤵
  PID:8164
- C:\Windows\System32\hJSEiIF.exe
  C:\Windows\System32\hJSEiIF.exe
  2⤵
  PID:8188
- C:\Windows\System32\pkfuTzU.exe
  C:\Windows\System32\pkfuTzU.exe
  2⤵
  PID:6968
- C:\Windows\System32\VlbGLlL.exe
  C:\Windows\System32\VlbGLlL.exe
  2⤵
  PID:7220
- C:\Windows\System32\bTGkPWA.exe
  C:\Windows\System32\bTGkPWA.exe
  2⤵
  PID:7308
- C:\Windows\System32\xFssAAO.exe
  C:\Windows\System32\xFssAAO.exe
  2⤵
  PID:7360
- C:\Windows\System32\rawpdbU.exe
  C:\Windows\System32\rawpdbU.exe
  2⤵
  PID:7444
- C:\Windows\System32\nAMwMov.exe
  C:\Windows\System32\nAMwMov.exe
  2⤵
  PID:7460
- C:\Windows\System32\lQyYdGf.exe
  C:\Windows\System32\lQyYdGf.exe
  2⤵
  PID:7556
- C:\Windows\System32\PClrJbs.exe
  C:\Windows\System32\PClrJbs.exe
  2⤵
  PID:7596
- C:\Windows\System32\IzbtLDr.exe
  C:\Windows\System32\IzbtLDr.exe
  2⤵
  PID:7676
- C:\Windows\System32\lluLDgB.exe
  C:\Windows\System32\lluLDgB.exe
  2⤵
  PID:7740
- C:\Windows\System32\fqEpKZX.exe
  C:\Windows\System32\fqEpKZX.exe
  2⤵
  PID:7812
- C:\Windows\System32\NpqcUvI.exe
  C:\Windows\System32\NpqcUvI.exe
  2⤵
  PID:7852
- C:\Windows\System32\sGMvZTN.exe
  C:\Windows\System32\sGMvZTN.exe
  2⤵
  PID:7972
- C:\Windows\System32\nwQioBQ.exe
  C:\Windows\System32\nwQioBQ.exe
  2⤵
  PID:8024
- C:\Windows\System32\mqhdMEk.exe
  C:\Windows\System32\mqhdMEk.exe
  2⤵
  PID:8080
- C:\Windows\System32\AMlTVNd.exe
  C:\Windows\System32\AMlTVNd.exe
  2⤵
  PID:8116
- C:\Windows\System32\tUmKrQc.exe
  C:\Windows\System32\tUmKrQc.exe
  2⤵
  PID:8172
- C:\Windows\System32\gFjFKOa.exe
  C:\Windows\System32\gFjFKOa.exe
  2⤵
  PID:7204
- C:\Windows\System32\ZrFDkpd.exe
  C:\Windows\System32\ZrFDkpd.exe
  2⤵
  PID:7324
- C:\Windows\System32\mfvvZDT.exe
  C:\Windows\System32\mfvvZDT.exe
  2⤵
  PID:7500
- C:\Windows\System32\rXUJTbe.exe
  C:\Windows\System32\rXUJTbe.exe
  2⤵
  PID:7716
- C:\Windows\System32\YaHnfuc.exe
  C:\Windows\System32\YaHnfuc.exe
  2⤵
  PID:7744
- C:\Windows\System32\XAIiZme.exe
  C:\Windows\System32\XAIiZme.exe
  2⤵
  PID:7996
- C:\Windows\System32\WnRZffa.exe
  C:\Windows\System32\WnRZffa.exe
  2⤵
  PID:8160
- C:\Windows\System32\cViTDei.exe
  C:\Windows\System32\cViTDei.exe
  2⤵
  PID:7540
- C:\Windows\System32\cMzpqFw.exe
  C:\Windows\System32\cMzpqFw.exe
  2⤵
  PID:7896
- C:\Windows\System32\haClbui.exe
  C:\Windows\System32\haClbui.exe
  2⤵
  PID:7176
- C:\Windows\System32\ifdBfxF.exe
  C:\Windows\System32\ifdBfxF.exe
  2⤵
  PID:8264
- C:\Windows\System32\krSbjHl.exe
  C:\Windows\System32\krSbjHl.exe
  2⤵
  PID:8320
- C:\Windows\System32\TeKATJi.exe
  C:\Windows\System32\TeKATJi.exe
  2⤵
  PID:8356
- C:\Windows\System32\JfQtvnv.exe
  C:\Windows\System32\JfQtvnv.exe
  2⤵
  PID:8372
- C:\Windows\System32\FvMSovG.exe
  C:\Windows\System32\FvMSovG.exe
  2⤵
  PID:8388
- C:\Windows\System32\uZJyNXj.exe
  C:\Windows\System32\uZJyNXj.exe
  2⤵
  PID:8404
- C:\Windows\System32\GWgkRKw.exe
  C:\Windows\System32\GWgkRKw.exe
  2⤵
  PID:8420
- C:\Windows\System32\bvByLAb.exe
  C:\Windows\System32\bvByLAb.exe
  2⤵
  PID:8436
- C:\Windows\System32\OLsxvkX.exe
  C:\Windows\System32\OLsxvkX.exe
  2⤵
  PID:8452
- C:\Windows\System32\RGNCmOX.exe
  C:\Windows\System32\RGNCmOX.exe
  2⤵
  PID:8468
- C:\Windows\System32\ydbwHkI.exe
  C:\Windows\System32\ydbwHkI.exe
  2⤵
  PID:8484
- C:\Windows\System32\hhmNsdJ.exe
  C:\Windows\System32\hhmNsdJ.exe
  2⤵
  PID:8504
- C:\Windows\System32\DaHDgTb.exe
  C:\Windows\System32\DaHDgTb.exe
  2⤵
  PID:8520
- C:\Windows\System32\iWkevsv.exe
  C:\Windows\System32\iWkevsv.exe
  2⤵
  PID:8536
- C:\Windows\System32\dBXhLje.exe
  C:\Windows\System32\dBXhLje.exe
  2⤵
  PID:8584
- C:\Windows\System32\MwWTgWr.exe
  C:\Windows\System32\MwWTgWr.exe
  2⤵
  PID:8604
- C:\Windows\System32\umtKumc.exe
  C:\Windows\System32\umtKumc.exe
  2⤵
  PID:8752
- C:\Windows\System32\geKCnLp.exe
  C:\Windows\System32\geKCnLp.exe
  2⤵
  PID:8808
- C:\Windows\System32\sFjbxhW.exe
  C:\Windows\System32\sFjbxhW.exe
  2⤵
  PID:8848
- C:\Windows\System32\wdkdEVt.exe
  C:\Windows\System32\wdkdEVt.exe
  2⤵
  PID:8864
- C:\Windows\System32\xRGPNwJ.exe
  C:\Windows\System32\xRGPNwJ.exe
  2⤵
  PID:8884
- C:\Windows\System32\WbauoTP.exe
  C:\Windows\System32\WbauoTP.exe
  2⤵
  PID:8920
- C:\Windows\System32\OISlHsR.exe
  C:\Windows\System32\OISlHsR.exe
  2⤵
  PID:8948
- C:\Windows\System32\UTJaMDx.exe
  C:\Windows\System32\UTJaMDx.exe
  2⤵
  PID:8980
- C:\Windows\System32\JrRxrpR.exe
  C:\Windows\System32\JrRxrpR.exe
  2⤵
  PID:9008
- C:\Windows\System32\lJFTJQM.exe
  C:\Windows\System32\lJFTJQM.exe
  2⤵
  PID:9048
- C:\Windows\System32\nHIPjdS.exe
  C:\Windows\System32\nHIPjdS.exe
  2⤵
  PID:9064
- C:\Windows\System32\FaqHMGG.exe
  C:\Windows\System32\FaqHMGG.exe
  2⤵
  PID:9092
- C:\Windows\System32\vPFonsj.exe
  C:\Windows\System32\vPFonsj.exe
  2⤵
  PID:9120
- C:\Windows\System32\jJumwZw.exe
  C:\Windows\System32\jJumwZw.exe
  2⤵
  PID:9140
- C:\Windows\System32\rRUkOKo.exe
  C:\Windows\System32\rRUkOKo.exe
  2⤵
  PID:9168
- C:\Windows\System32\hKBSZKK.exe
  C:\Windows\System32\hKBSZKK.exe
  2⤵
  PID:9188
- C:\Windows\System32\ZNrLgFs.exe
  C:\Windows\System32\ZNrLgFs.exe
  2⤵
  PID:9204
- C:\Windows\System32\qKvRJyr.exe
  C:\Windows\System32\qKvRJyr.exe
  2⤵
  PID:6180
- C:\Windows\System32\IDnipOl.exe
  C:\Windows\System32\IDnipOl.exe
  2⤵
  PID:8196
- C:\Windows\System32\MfItJpk.exe
  C:\Windows\System32\MfItJpk.exe
  2⤵
  PID:8236
- C:\Windows\System32\EyxAgEC.exe
  C:\Windows\System32\EyxAgEC.exe
  2⤵
  PID:8480
- C:\Windows\System32\oMIgGKu.exe
  C:\Windows\System32\oMIgGKu.exe
  2⤵
  PID:8556
- C:\Windows\System32\dmARIKo.exe
  C:\Windows\System32\dmARIKo.exe
  2⤵
  PID:8276
- C:\Windows\System32\mEnsgWQ.exe
  C:\Windows\System32\mEnsgWQ.exe
  2⤵
  PID:8416
- C:\Windows\System32\oawxVic.exe
  C:\Windows\System32\oawxVic.exe
  2⤵
  PID:8580
- C:\Windows\System32\NYJsYYT.exe
  C:\Windows\System32\NYJsYYT.exe
  2⤵
  PID:8652
- C:\Windows\System32\RQSsfSn.exe
  C:\Windows\System32\RQSsfSn.exe
  2⤵
  PID:8704
- C:\Windows\System32\HJMXobo.exe
  C:\Windows\System32\HJMXobo.exe
  2⤵
  PID:8728
- C:\Windows\System32\cgGdTNG.exe
  C:\Windows\System32\cgGdTNG.exe
  2⤵
  PID:8772
- C:\Windows\System32\qjfrVIz.exe
  C:\Windows\System32\qjfrVIz.exe
  2⤵
  PID:8860
- C:\Windows\System32\zCKordx.exe
  C:\Windows\System32\zCKordx.exe
  2⤵
  PID:8944
- C:\Windows\System32\koQRjhl.exe
  C:\Windows\System32\koQRjhl.exe
  2⤵
  PID:9024
- C:\Windows\System32\NtWxkzu.exe
  C:\Windows\System32\NtWxkzu.exe
  2⤵
  PID:9104
- C:\Windows\System32\hXtiLEU.exe
  C:\Windows\System32\hXtiLEU.exe
  2⤵
  PID:9160
- C:\Windows\System32\fdBzPLJ.exe
  C:\Windows\System32\fdBzPLJ.exe
  2⤵
  PID:8200
- C:\Windows\System32\hTmeWmP.exe
  C:\Windows\System32\hTmeWmP.exe
  2⤵
  PID:8272
- C:\Windows\System32\IGMVSPx.exe
  C:\Windows\System32\IGMVSPx.exe
  2⤵
  PID:8368
- C:\Windows\System32\lSNycLh.exe
  C:\Windows\System32\lSNycLh.exe
  2⤵
  PID:8412
- C:\Windows\System32\qbWdQNg.exe
  C:\Windows\System32\qbWdQNg.exe
  2⤵
  PID:8516
- C:\Windows\System32\oqxMnbX.exe
  C:\Windows\System32\oqxMnbX.exe
  2⤵
  PID:8712
- C:\Windows\System32\rOixHju.exe
  C:\Windows\System32\rOixHju.exe
  2⤵
  PID:8856
- C:\Windows\System32\zvqIBSB.exe
  C:\Windows\System32\zvqIBSB.exe
  2⤵
  PID:9132
- C:\Windows\System32\QTIHPQc.exe
  C:\Windows\System32\QTIHPQc.exe
  2⤵
  PID:8240
- C:\Windows\System32\DEMEaPd.exe
  C:\Windows\System32\DEMEaPd.exe
  2⤵
  PID:8528
- C:\Windows\System32\JoMqMht.exe
  C:\Windows\System32\JoMqMht.exe
  2⤵
  PID:8340
- C:\Windows\System32\NCyarIH.exe
  C:\Windows\System32\NCyarIH.exe
  2⤵
  PID:8976
- C:\Windows\System32\DatLFcM.exe
  C:\Windows\System32\DatLFcM.exe
  2⤵
  PID:8244
- C:\Windows\System32\fmGHPdH.exe
  C:\Windows\System32\fmGHPdH.exe
  2⤵
  PID:9056
- C:\Windows\System32\dOhgspB.exe
  C:\Windows\System32\dOhgspB.exe
  2⤵
  PID:8296
- C:\Windows\System32\MgjNMQi.exe
  C:\Windows\System32\MgjNMQi.exe
  2⤵
  PID:9244
- C:\Windows\System32\lnxXFTY.exe
  C:\Windows\System32\lnxXFTY.exe
  2⤵
  PID:9260
- C:\Windows\System32\pklCvRW.exe
  C:\Windows\System32\pklCvRW.exe
  2⤵
  PID:9288
- C:\Windows\System32\rmzwGmE.exe
  C:\Windows\System32\rmzwGmE.exe
  2⤵
  PID:9328
- C:\Windows\System32\sXyJzqB.exe
  C:\Windows\System32\sXyJzqB.exe
  2⤵
  PID:9352
- C:\Windows\System32\AVLYZCG.exe
  C:\Windows\System32\AVLYZCG.exe
  2⤵
  PID:9380
- C:\Windows\System32\glHtOCm.exe
  C:\Windows\System32\glHtOCm.exe
  2⤵
  PID:9412
- C:\Windows\System32\fWmCzll.exe
  C:\Windows\System32\fWmCzll.exe
  2⤵
  PID:9436
- C:\Windows\System32\MkDHuJs.exe
  C:\Windows\System32\MkDHuJs.exe
  2⤵
  PID:9468
- C:\Windows\System32\DhEixpk.exe
  C:\Windows\System32\DhEixpk.exe
  2⤵
  PID:9504
- C:\Windows\System32\fOXXEDD.exe
  C:\Windows\System32\fOXXEDD.exe
  2⤵
  PID:9524
- C:\Windows\System32\KFShIqc.exe
  C:\Windows\System32\KFShIqc.exe
  2⤵
  PID:9568
- C:\Windows\System32\ODmjbvV.exe
  C:\Windows\System32\ODmjbvV.exe
  2⤵
  PID:9584
- C:\Windows\System32\rCftEVo.exe
  C:\Windows\System32\rCftEVo.exe
  2⤵
  PID:9612
- C:\Windows\System32\ZJdkwDy.exe
  C:\Windows\System32\ZJdkwDy.exe
  2⤵
  PID:9628
- C:\Windows\System32\DJuZnjE.exe
  C:\Windows\System32\DJuZnjE.exe
  2⤵
  PID:9660
- C:\Windows\System32\CtauUKX.exe
  C:\Windows\System32\CtauUKX.exe
  2⤵
  PID:9684
- C:\Windows\System32\VLRGqtK.exe
  C:\Windows\System32\VLRGqtK.exe
  2⤵
  PID:9732
- C:\Windows\System32\ZQLWJtI.exe
  C:\Windows\System32\ZQLWJtI.exe
  2⤵
  PID:9752
- C:\Windows\System32\wHFaSTm.exe
  C:\Windows\System32\wHFaSTm.exe
  2⤵
  PID:9768
- C:\Windows\System32\lUfnGpc.exe
  C:\Windows\System32\lUfnGpc.exe
  2⤵
  PID:9796
- C:\Windows\System32\aAzisej.exe
  C:\Windows\System32\aAzisej.exe
  2⤵
  PID:9824
- C:\Windows\System32\YfzOFbO.exe
  C:\Windows\System32\YfzOFbO.exe
  2⤵
  PID:9848
- C:\Windows\System32\wkKDsAo.exe
  C:\Windows\System32\wkKDsAo.exe
  2⤵
  PID:9872
- C:\Windows\System32\tEwRAgB.exe
  C:\Windows\System32\tEwRAgB.exe
  2⤵
  PID:9900
- C:\Windows\System32\mTtFbYD.exe
  C:\Windows\System32\mTtFbYD.exe
  2⤵
  PID:9924
- C:\Windows\System32\GeTTqMP.exe
  C:\Windows\System32\GeTTqMP.exe
  2⤵
  PID:9976
- C:\Windows\System32\uGqYyzo.exe
  C:\Windows\System32\uGqYyzo.exe
  2⤵
  PID:10004
- C:\Windows\System32\WEsZqhE.exe
  C:\Windows\System32\WEsZqhE.exe
  2⤵
  PID:10028
- C:\Windows\System32\iPmkfCy.exe
  C:\Windows\System32\iPmkfCy.exe
  2⤵
  PID:10052
- C:\Windows\System32\XBlJRpU.exe
  C:\Windows\System32\XBlJRpU.exe
  2⤵
  PID:10088
- C:\Windows\System32\JzTITOl.exe
  C:\Windows\System32\JzTITOl.exe
  2⤵
  PID:10116
- C:\Windows\System32\txzwQyP.exe
  C:\Windows\System32\txzwQyP.exe
  2⤵
  PID:10144
- C:\Windows\System32\eRbdtqt.exe
  C:\Windows\System32\eRbdtqt.exe
  2⤵
  PID:10160
- C:\Windows\System32\CuIigCW.exe
  C:\Windows\System32\CuIigCW.exe
  2⤵
  PID:10192
- C:\Windows\System32\mLQwGvk.exe
  C:\Windows\System32\mLQwGvk.exe
  2⤵
  PID:10232
- C:\Windows\System32\CxRRgSA.exe
  C:\Windows\System32\CxRRgSA.exe
  2⤵
  PID:9240
- C:\Windows\System32\Rzedwct.exe
  C:\Windows\System32\Rzedwct.exe
  2⤵
  PID:2428
- C:\Windows\System32\ofDfRSx.exe
  C:\Windows\System32\ofDfRSx.exe
  2⤵
  PID:9388
- C:\Windows\System32\PyaSNhm.exe
  C:\Windows\System32\PyaSNhm.exe
  2⤵
  PID:9432
- C:\Windows\System32\cyLMxUO.exe
  C:\Windows\System32\cyLMxUO.exe
  2⤵
  PID:9480
- C:\Windows\System32\wWmbCzH.exe
  C:\Windows\System32\wWmbCzH.exe
  2⤵
  PID:9512
- C:\Windows\System32\lmCThWo.exe
  C:\Windows\System32\lmCThWo.exe
  2⤵
  PID:9552
- C:\Windows\System32\YIvKoad.exe
  C:\Windows\System32\YIvKoad.exe
  2⤵
  PID:9608
- C:\Windows\System32\GlaYEon.exe
  C:\Windows\System32\GlaYEon.exe
  2⤵
  PID:9676
- C:\Windows\System32\wrfaeoY.exe
  C:\Windows\System32\wrfaeoY.exe
  2⤵
  PID:9748
- C:\Windows\System32\QfOEUiQ.exe
  C:\Windows\System32\QfOEUiQ.exe
  2⤵
  PID:9780
- C:\Windows\System32\uUbGnBW.exe
  C:\Windows\System32\uUbGnBW.exe
  2⤵
  PID:9808
- C:\Windows\System32\tszWPae.exe
  C:\Windows\System32\tszWPae.exe
  2⤵
  PID:9948
- C:\Windows\System32\mcgOhwo.exe
  C:\Windows\System32\mcgOhwo.exe
  2⤵
  PID:10000
- C:\Windows\System32\MkXctBC.exe
  C:\Windows\System32\MkXctBC.exe
  2⤵
  PID:10044
- C:\Windows\System32\tWfGjuu.exe
  C:\Windows\System32\tWfGjuu.exe
  2⤵
  PID:10128
- C:\Windows\System32\sOqZRVG.exe
  C:\Windows\System32\sOqZRVG.exe
  2⤵
  PID:10212
- C:\Windows\System32\wmGGINK.exe
  C:\Windows\System32\wmGGINK.exe
  2⤵
  PID:9276
- C:\Windows\System32\ZyRnyhr.exe
  C:\Windows\System32\ZyRnyhr.exe
  2⤵
  PID:3972
- C:\Windows\System32\UNVojEp.exe
  C:\Windows\System32\UNVojEp.exe
  2⤵
  PID:9464
- C:\Windows\System32\neWMufg.exe
  C:\Windows\System32\neWMufg.exe
  2⤵
  PID:9532
- C:\Windows\System32\CWXlXyO.exe
  C:\Windows\System32\CWXlXyO.exe
  2⤵
  PID:9652
- C:\Windows\System32\kkdulVL.exe
  C:\Windows\System32\kkdulVL.exe
  2⤵
  PID:9856
- C:\Windows\System32\CfOtNed.exe
  C:\Windows\System32\CfOtNed.exe
  2⤵
  PID:9968
- C:\Windows\System32\RdVXrCW.exe
  C:\Windows\System32\RdVXrCW.exe
  2⤵
  PID:9220
- C:\Windows\System32\hjLMHAn.exe
  C:\Windows\System32\hjLMHAn.exe
  2⤵
  PID:8972
- C:\Windows\System32\oMtHXpR.exe
  C:\Windows\System32\oMtHXpR.exe
  2⤵
  PID:368
- C:\Windows\System32\hYJcofn.exe
  C:\Windows\System32\hYJcofn.exe
  2⤵
  PID:1284
- C:\Windows\System32\VdtJWvf.exe
  C:\Windows\System32\VdtJWvf.exe
  2⤵
  PID:4888
- C:\Windows\System32\IxewIsm.exe
  C:\Windows\System32\IxewIsm.exe
  2⤵
  PID:9540
- C:\Windows\System32\sxviVcj.exe
  C:\Windows\System32\sxviVcj.exe
  2⤵
  PID:10200
- C:\Windows\System32\kukwEJG.exe
  C:\Windows\System32\kukwEJG.exe
  2⤵
  PID:10256
- C:\Windows\System32\pTCHpND.exe
  C:\Windows\System32\pTCHpND.exe
  2⤵
  PID:10284
- C:\Windows\System32\mfPsEPm.exe
  C:\Windows\System32\mfPsEPm.exe
  2⤵
  PID:10300
- C:\Windows\System32\edZTVTe.exe
  C:\Windows\System32\edZTVTe.exe
  2⤵
  PID:10320
- C:\Windows\System32\QcabiPz.exe
  C:\Windows\System32\QcabiPz.exe
  2⤵
  PID:10368
- C:\Windows\System32\HWKlMFk.exe
  C:\Windows\System32\HWKlMFk.exe
  2⤵
  PID:10404
- C:\Windows\System32\pWRKMOZ.exe
  C:\Windows\System32\pWRKMOZ.exe
  2⤵
  PID:10420
- C:\Windows\System32\prqpCbR.exe
  C:\Windows\System32\prqpCbR.exe
  2⤵
  PID:10444
- C:\Windows\System32\meAVnxa.exe
  C:\Windows\System32\meAVnxa.exe
  2⤵
  PID:10468
- C:\Windows\System32\DqDrrYw.exe
  C:\Windows\System32\DqDrrYw.exe
  2⤵
  PID:10496
- C:\Windows\System32\gKttjZd.exe
  C:\Windows\System32\gKttjZd.exe
  2⤵
  PID:10520
- C:\Windows\System32\nHjYlvZ.exe
  C:\Windows\System32\nHjYlvZ.exe
  2⤵
  PID:10548
- C:\Windows\System32\glzxzuS.exe
  C:\Windows\System32\glzxzuS.exe
  2⤵
  PID:10576
- C:\Windows\System32\ZMazbjY.exe
  C:\Windows\System32\ZMazbjY.exe
  2⤵
  PID:10600
- C:\Windows\System32\ZSClGRz.exe
  C:\Windows\System32\ZSClGRz.exe
  2⤵
  PID:10628
- C:\Windows\System32\KLrMEQi.exe
  C:\Windows\System32\KLrMEQi.exe
  2⤵
  PID:10652
- C:\Windows\System32\pqbAjkP.exe
  C:\Windows\System32\pqbAjkP.exe
  2⤵
  PID:10680
- C:\Windows\System32\qaMvjPH.exe
  C:\Windows\System32\qaMvjPH.exe
  2⤵
  PID:10728
- C:\Windows\System32\vZuTkyM.exe
  C:\Windows\System32\vZuTkyM.exe
  2⤵
  PID:10744
- C:\Windows\System32\qgkNWyc.exe
  C:\Windows\System32\qgkNWyc.exe
  2⤵
  PID:10764
- C:\Windows\System32\TpcyzEP.exe
  C:\Windows\System32\TpcyzEP.exe
  2⤵
  PID:10792
- C:\Windows\System32\RTEvumF.exe
  C:\Windows\System32\RTEvumF.exe
  2⤵
  PID:10832
- C:\Windows\System32\wooErZp.exe
  C:\Windows\System32\wooErZp.exe
  2⤵
  PID:10872
- C:\Windows\System32\LtJTGbS.exe
  C:\Windows\System32\LtJTGbS.exe
  2⤵
  PID:10896
- C:\Windows\System32\weBDOuO.exe
  C:\Windows\System32\weBDOuO.exe
  2⤵
  PID:10920
- C:\Windows\System32\rAgdYVJ.exe
  C:\Windows\System32\rAgdYVJ.exe
  2⤵
  PID:10944
- C:\Windows\System32\xctgObf.exe
  C:\Windows\System32\xctgObf.exe
  2⤵
  PID:10972
- C:\Windows\System32\eaYTdwf.exe
  C:\Windows\System32\eaYTdwf.exe
  2⤵
  PID:11008
- C:\Windows\System32\lNQCQIh.exe
  C:\Windows\System32\lNQCQIh.exe
  2⤵
  PID:11028
- C:\Windows\System32\kMAsyfX.exe
  C:\Windows\System32\kMAsyfX.exe
  2⤵
  PID:11068
- C:\Windows\System32\zTWSmxS.exe
  C:\Windows\System32\zTWSmxS.exe
  2⤵
  PID:11100
- C:\Windows\System32\bloXZcY.exe
  C:\Windows\System32\bloXZcY.exe
  2⤵
  PID:11116
- C:\Windows\System32\JzVlQCf.exe
  C:\Windows\System32\JzVlQCf.exe
  2⤵
  PID:11156
- C:\Windows\System32\SIFgfZX.exe
  C:\Windows\System32\SIFgfZX.exe
  2⤵
  PID:11184
- C:\Windows\System32\qPZhuEZ.exe
  C:\Windows\System32\qPZhuEZ.exe
  2⤵
  PID:11212
- C:\Windows\System32\nzWsGOL.exe
  C:\Windows\System32\nzWsGOL.exe
  2⤵
  PID:11236
- C:\Windows\System32\mroUmuj.exe
  C:\Windows\System32\mroUmuj.exe
  2⤵
  PID:11260
- C:\Windows\System32\HsKkEBg.exe
  C:\Windows\System32\HsKkEBg.exe
  2⤵
  PID:10296
- C:\Windows\System32\yauttzA.exe
  C:\Windows\System32\yauttzA.exe
  2⤵
  PID:10392
- C:\Windows\System32\zupDoOP.exe
  C:\Windows\System32\zupDoOP.exe
  2⤵
  PID:10440
- C:\Windows\System32\ZGuxVDy.exe
  C:\Windows\System32\ZGuxVDy.exe
  2⤵
  PID:10492
- C:\Windows\System32\MVQAOEs.exe
  C:\Windows\System32\MVQAOEs.exe
  2⤵
  PID:10508
- C:\Windows\System32\afKseMT.exe
  C:\Windows\System32\afKseMT.exe
  2⤵
  PID:10572
- C:\Windows\System32\aAIVQGp.exe
  C:\Windows\System32\aAIVQGp.exe
  2⤵
  PID:10676
- C:\Windows\System32\PrWxvdz.exe
  C:\Windows\System32\PrWxvdz.exe
  2⤵
  PID:10704
- C:\Windows\System32\ahzbOSW.exe
  C:\Windows\System32\ahzbOSW.exe
  2⤵
  PID:10756
- C:\Windows\System32\msLDgeT.exe
  C:\Windows\System32\msLDgeT.exe
  2⤵
  PID:10880
- C:\Windows\System32\DtSmrGU.exe
  C:\Windows\System32\DtSmrGU.exe
  2⤵
  PID:10916
- C:\Windows\System32\RgpRsjB.exe
  C:\Windows\System32\RgpRsjB.exe
  2⤵
  PID:10964
- C:\Windows\System32\wvfqbHp.exe
  C:\Windows\System32\wvfqbHp.exe
  2⤵
  PID:11056
- C:\Windows\System32\HAvAnsj.exe
  C:\Windows\System32\HAvAnsj.exe
  2⤵
  PID:11084
- C:\Windows\System32\swwZteU.exe
  C:\Windows\System32\swwZteU.exe
  2⤵
  PID:11152
- C:\Windows\System32\xnqPJUq.exe
  C:\Windows\System32\xnqPJUq.exe
  2⤵
  PID:11196
- C:\Windows\System32\voyRctR.exe
  C:\Windows\System32\voyRctR.exe
  2⤵
  PID:10312
- C:\Windows\System32\LmiqbIQ.exe
  C:\Windows\System32\LmiqbIQ.exe
  2⤵
  PID:10452
- C:\Windows\System32\inssuxk.exe
  C:\Windows\System32\inssuxk.exe
  2⤵
  PID:10584
- C:\Windows\System32\RYXrnjt.exe
  C:\Windows\System32\RYXrnjt.exe
  2⤵
  PID:10716
- C:\Windows\System32\bWPHrEx.exe
  C:\Windows\System32\bWPHrEx.exe
  2⤵
  PID:10812
- C:\Windows\System32\wFbTHqJ.exe
  C:\Windows\System32\wFbTHqJ.exe
  2⤵
  PID:10932
- C:\Windows\System32\KjcGnYt.exe
  C:\Windows\System32\KjcGnYt.exe
  2⤵
  PID:11132
- C:\Windows\System32\pCDkDWR.exe
  C:\Windows\System32\pCDkDWR.exe
  2⤵
  PID:10316
- C:\Windows\System32\OhZFfPq.exe
  C:\Windows\System32\OhZFfPq.exe
  2⤵
  PID:10528
- C:\Windows\System32\yFSJLaa.exe
  C:\Windows\System32\yFSJLaa.exe
  2⤵
  PID:10620
- C:\Windows\System32\LSOEByk.exe
  C:\Windows\System32\LSOEByk.exe
  2⤵
  PID:11000
- C:\Windows\System32\ilZfGYa.exe
  C:\Windows\System32\ilZfGYa.exe
  2⤵
  PID:10856
- C:\Windows\System32\cFpokMD.exe
  C:\Windows\System32\cFpokMD.exe
  2⤵
  PID:11280
- C:\Windows\System32\hVJNhdF.exe
  C:\Windows\System32\hVJNhdF.exe
  2⤵
  PID:11324
- C:\Windows\System32\mWJcQdn.exe
  C:\Windows\System32\mWJcQdn.exe
  2⤵
  PID:11344
- C:\Windows\System32\ZqPSWSD.exe
  C:\Windows\System32\ZqPSWSD.exe
  2⤵
  PID:11372
- C:\Windows\System32\WANEcnE.exe
  C:\Windows\System32\WANEcnE.exe
  2⤵
  PID:11400
- C:\Windows\System32\WAoRbjL.exe
  C:\Windows\System32\WAoRbjL.exe
  2⤵
  PID:11440
- C:\Windows\System32\brSfXMm.exe
  C:\Windows\System32\brSfXMm.exe
  2⤵
  PID:11460
- C:\Windows\System32\QYJrLsZ.exe
  C:\Windows\System32\QYJrLsZ.exe
  2⤵
  PID:11484
- C:\Windows\System32\KafKjuw.exe
  C:\Windows\System32\KafKjuw.exe
  2⤵
  PID:11524
- C:\Windows\System32\KqQldWp.exe
  C:\Windows\System32\KqQldWp.exe
  2⤵
  PID:11540
- C:\Windows\System32\gzZmCbm.exe
  C:\Windows\System32\gzZmCbm.exe
  2⤵
  PID:11560
- C:\Windows\System32\QvSqwPw.exe
  C:\Windows\System32\QvSqwPw.exe
  2⤵
  PID:11584
- C:\Windows\System32\AeAgIig.exe
  C:\Windows\System32\AeAgIig.exe
  2⤵
  PID:11620
- C:\Windows\System32\eXSlTUR.exe
  C:\Windows\System32\eXSlTUR.exe
  2⤵
  PID:11656
- C:\Windows\System32\HKtSQDA.exe
  C:\Windows\System32\HKtSQDA.exe
  2⤵
  PID:11676
- C:\Windows\System32\YehJBSK.exe
  C:\Windows\System32\YehJBSK.exe
  2⤵
  PID:11712
- C:\Windows\System32\qqQVFRq.exe
  C:\Windows\System32\qqQVFRq.exe
  2⤵
  PID:11736
- C:\Windows\System32\zwWZxXZ.exe
  C:\Windows\System32\zwWZxXZ.exe
  2⤵
  PID:11756
- C:\Windows\System32\COBePhj.exe
  C:\Windows\System32\COBePhj.exe
  2⤵
  PID:11796
- C:\Windows\System32\CVnCFyY.exe
  C:\Windows\System32\CVnCFyY.exe
  2⤵
  PID:11824
- C:\Windows\System32\JaxmGhk.exe
  C:\Windows\System32\JaxmGhk.exe
  2⤵
  PID:11844
- C:\Windows\System32\jguvzLY.exe
  C:\Windows\System32\jguvzLY.exe
  2⤵
  PID:11872
- C:\Windows\System32\IoooIjV.exe
  C:\Windows\System32\IoooIjV.exe
  2⤵
  PID:11920
- C:\Windows\System32\oPYMxNO.exe
  C:\Windows\System32\oPYMxNO.exe
  2⤵
  PID:11940
- C:\Windows\System32\aNEJvwn.exe
  C:\Windows\System32\aNEJvwn.exe
  2⤵
  PID:11964
- C:\Windows\System32\PRNpTZy.exe
  C:\Windows\System32\PRNpTZy.exe
  2⤵
  PID:11984
- C:\Windows\System32\jICPRLP.exe
  C:\Windows\System32\jICPRLP.exe
  2⤵
  PID:12016
- C:\Windows\System32\hLaJjoU.exe
  C:\Windows\System32\hLaJjoU.exe
  2⤵
  PID:12036
- C:\Windows\System32\eyWsKOn.exe
  C:\Windows\System32\eyWsKOn.exe
  2⤵
  PID:12056
- C:\Windows\System32\GEABPBl.exe
  C:\Windows\System32\GEABPBl.exe
  2⤵
  PID:12084
- C:\Windows\System32\gTKZtQg.exe
  C:\Windows\System32\gTKZtQg.exe
  2⤵
  PID:12104
- C:\Windows\System32\bAFqzEj.exe
  C:\Windows\System32\bAFqzEj.exe
  2⤵
  PID:12124
- C:\Windows\System32\oJgWJIQ.exe
  C:\Windows\System32\oJgWJIQ.exe
  2⤵
  PID:12168
- C:\Windows\System32\aXxaKuo.exe
  C:\Windows\System32\aXxaKuo.exe
  2⤵
  PID:12212
- C:\Windows\System32\MJYfLBL.exe
  C:\Windows\System32\MJYfLBL.exe
  2⤵
  PID:12232
- C:\Windows\System32\lDQXSkj.exe
  C:\Windows\System32\lDQXSkj.exe
  2⤵
  PID:12260
- C:\Windows\System32\SFLVRzA.exe
  C:\Windows\System32\SFLVRzA.exe
  2⤵
  PID:3804
- C:\Windows\System32\KwmhcAT.exe
  C:\Windows\System32\KwmhcAT.exe
  2⤵
  PID:11384
- C:\Windows\System32\dqekWUB.exe
  C:\Windows\System32\dqekWUB.exe
  2⤵
  PID:11424
- C:\Windows\System32\kNlLXAz.exe
  C:\Windows\System32\kNlLXAz.exe
  2⤵
  PID:11512
- C:\Windows\System32\JySSory.exe
  C:\Windows\System32\JySSory.exe
  2⤵
  PID:11576
- C:\Windows\System32\UfJDoCw.exe
  C:\Windows\System32\UfJDoCw.exe
  2⤵
  PID:11648
- C:\Windows\System32\qXRFJCe.exe
  C:\Windows\System32\qXRFJCe.exe
  2⤵
  PID:11664
- C:\Windows\System32\cqVkqPm.exe
  C:\Windows\System32\cqVkqPm.exe
  2⤵
  PID:11780
- C:\Windows\System32\fpTtmPu.exe
  C:\Windows\System32\fpTtmPu.exe
  2⤵
  PID:11816
- C:\Windows\System32\dSAXPzD.exe
  C:\Windows\System32\dSAXPzD.exe
  2⤵
  PID:11856
- C:\Windows\System32\ntSpPQZ.exe
  C:\Windows\System32\ntSpPQZ.exe
  2⤵
  PID:11928
- C:\Windows\System32\LUSnNRY.exe
  C:\Windows\System32\LUSnNRY.exe
  2⤵
  PID:12032
- C:\Windows\System32\XiOJBxN.exe
  C:\Windows\System32\XiOJBxN.exe
  2⤵
  PID:12116
- C:\Windows\System32\ZOymzba.exe
  C:\Windows\System32\ZOymzba.exe
  2⤵
  PID:12132
- C:\Windows\System32\tLuJMvV.exe
  C:\Windows\System32\tLuJMvV.exe
  2⤵
  PID:12208
- C:\Windows\System32\eBYaphX.exe
  C:\Windows\System32\eBYaphX.exe
  2⤵
  PID:12276
- C:\Windows\System32\HHkWlpa.exe
  C:\Windows\System32\HHkWlpa.exe
  2⤵
  PID:11448
- C:\Windows\System32\JkAOrZU.exe
  C:\Windows\System32\JkAOrZU.exe
  2⤵
  PID:11536
- C:\Windows\System32\PGwfVek.exe
  C:\Windows\System32\PGwfVek.exe
  2⤵
  PID:11752
- C:\Windows\System32\arjIpoj.exe
  C:\Windows\System32\arjIpoj.exe
  2⤵
  PID:11840
- C:\Windows\System32\PBIaDlS.exe
  C:\Windows\System32\PBIaDlS.exe
  2⤵
  PID:12028
- C:\Windows\System32\HmUCNJC.exe
  C:\Windows\System32\HmUCNJC.exe
  2⤵
  PID:12136
- C:\Windows\System32\awdPHOh.exe
  C:\Windows\System32\awdPHOh.exe
  2⤵
  PID:12228
- C:\Windows\System32\tQWhDnO.exe
  C:\Windows\System32\tQWhDnO.exe
  2⤵
  PID:11644
- C:\Windows\System32\SJKxGdx.exe
  C:\Windows\System32\SJKxGdx.exe
  2⤵
  PID:11956
- C:\Windows\System32\GOmwKmP.exe
  C:\Windows\System32\GOmwKmP.exe
  2⤵
  PID:11600
- C:\Windows\System32\bmeCoRQ.exe
  C:\Windows\System32\bmeCoRQ.exe
  2⤵
  PID:12240
- C:\Windows\System32\DUZJtWa.exe
  C:\Windows\System32\DUZJtWa.exe
  2⤵
  PID:12300
- C:\Windows\System32\VIkbrbp.exe
  C:\Windows\System32\VIkbrbp.exe
  2⤵
  PID:12324
- C:\Windows\System32\XPsSEuw.exe
  C:\Windows\System32\XPsSEuw.exe
  2⤵
  PID:12352
- C:\Windows\System32\BhRfTVl.exe
  C:\Windows\System32\BhRfTVl.exe
  2⤵
  PID:12392
- C:\Windows\System32\GYSldUP.exe
  C:\Windows\System32\GYSldUP.exe
  2⤵
  PID:12420
- C:\Windows\System32\lxDYzqa.exe
  C:\Windows\System32\lxDYzqa.exe
  2⤵
  PID:12436
- C:\Windows\System32\lJLaKru.exe
  C:\Windows\System32\lJLaKru.exe
  2⤵
  PID:12464
- C:\Windows\System32\dLHDBvC.exe
  C:\Windows\System32\dLHDBvC.exe
  2⤵
  PID:12504
- C:\Windows\System32\JMhFKTF.exe
  C:\Windows\System32\JMhFKTF.exe
  2⤵
  PID:12520
- C:\Windows\System32\AoSXcbd.exe
  C:\Windows\System32\AoSXcbd.exe
  2⤵
  PID:12552
- C:\Windows\System32\kWITIAs.exe
  C:\Windows\System32\kWITIAs.exe
  2⤵
  PID:12588
- C:\Windows\System32\rAdITeI.exe
  C:\Windows\System32\rAdITeI.exe
  2⤵
  PID:12612
- C:\Windows\System32\tOCvgZx.exe
  C:\Windows\System32\tOCvgZx.exe
  2⤵
  PID:12632
- C:\Windows\System32\nIfZrSI.exe
  C:\Windows\System32\nIfZrSI.exe
  2⤵
  PID:12652
- C:\Windows\System32\OmNtgDs.exe
  C:\Windows\System32\OmNtgDs.exe
  2⤵
  PID:12680
- C:\Windows\System32\JMPRUhQ.exe
  C:\Windows\System32\JMPRUhQ.exe
  2⤵
  PID:12704
- C:\Windows\System32\JZGseHW.exe
  C:\Windows\System32\JZGseHW.exe
  2⤵
  PID:12744
- C:\Windows\System32\LIIaGze.exe
  C:\Windows\System32\LIIaGze.exe
  2⤵
  PID:12776
- C:\Windows\System32\EgLoRCs.exe
  C:\Windows\System32\EgLoRCs.exe
  2⤵
  PID:12808
- C:\Windows\System32\wDkGYob.exe
  C:\Windows\System32\wDkGYob.exe
  2⤵
  PID:12836
- C:\Windows\System32\VMIWwuc.exe
  C:\Windows\System32\VMIWwuc.exe
  2⤵
  PID:12868
- C:\Windows\System32\JgvRvWa.exe
  C:\Windows\System32\JgvRvWa.exe
  2⤵
  PID:12884
- C:\Windows\System32\VcsgTYN.exe
  C:\Windows\System32\VcsgTYN.exe
  2⤵
  PID:12904
- C:\Windows\System32\hTsaApv.exe
  C:\Windows\System32\hTsaApv.exe
  2⤵
  PID:12944
- C:\Windows\System32\uGuwJbu.exe
  C:\Windows\System32\uGuwJbu.exe
  2⤵
  PID:12968
- C:\Windows\System32\jYnPVPe.exe
  C:\Windows\System32\jYnPVPe.exe
  2⤵
  PID:12988
- C:\Windows\System32\uOTyOJt.exe
  C:\Windows\System32\uOTyOJt.exe
  2⤵
  PID:13012
- C:\Windows\System32\bQHeReQ.exe
  C:\Windows\System32\bQHeReQ.exe
  2⤵
  PID:13060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

CCmTHSh.exe

Path C:\Windows\System32\CCmTHSh.exe
Size 1.9MB
SHA256 87b8e32f590c5ec9d4b02b1bc474ba2beda601c67592404baaef45ffcf88e40a
MD5 363451e10c620910f12ddda4c3378fc6
SHA1 5ff1bb4074e821c65f259ba211bfdbb19c7e7131
SHA512 765d85531a3a7a9e4ad68953009dfc4847ce3dc89149efab55a918110be4eadaf029067b39fd8462c5cafdd111a1a8c48b8458809d80ce00f0c2b1ef2222a7b6
SSDEEP 49152:knw9oUUEEDlOuJv0oD5WBsv5AK6kxGTnburH+:kQUEEg
MD5 SHA1 SHA512 SSDEEP

Submit Download

EGygmtD.exe

Path C:\Windows\System32\EGygmtD.exe
Size 1.9MB
SHA256 ed36f97e0ffc71a1571a506eb015d240282a4c7cc22a1e1dfb149b46457d01d1
MD5 56f022261b0ad6246813b2c3a2980479
SHA1 acb882cfe1e33dcb55d5b71178d1b3fe58cc42d2
SHA512 58f96ca485e61bdf1ae0703c0d7aa67f38112997d7eef571ff06295cc6773f45be1e30982599a920f38f322ab8be508fcac8b6eb168ec5a1bc2c7c57522a1a36
SSDEEP 49152:knw9oUUEEDlOuJv0oD5WBsv5AK6kxGTnburHV4:kQUEE8
MD5 SHA1 SHA512 SSDEEP

Submit Download

EszcHxE.exe

Path C:\Windows\System32\EszcHxE.exe
Size 1.9MB
SHA256 8fa13e0fd4fb8747bd1d7608a161960755080779ef521fc86c73c6f0d58fc1f0
MD5 f1a00f108980ebc48b9c1448f501cd9b
SHA1 f62c13bcac889af60e375521f49794843fe8286d
SHA512 b8bd765b54aee36024e4b1e645ee45e8b5ce238d9f211cad3ebda899203dd25c364f42a388445356f3b5918a0f334682e8ffe1acc05c6d355fc0940a528c19ee
SSDEEP 49152:knw9oUUEEDlOuJv0oD5WBsv5AK6kxGTnburHs:kQUEEO
MD5 SHA1 SHA512 SSDEEP

Submit Download

LFiMIKW.exe

Path C:\Windows\System32\LFiMIKW.exe
Size 1.9MB
SHA256 186ccdb62695c62d0c9be88e9ecdd3e8fc5e09a19aa5210a688bc6b7834cc299
MD5 ad17159ed13ab6c7e04476390d4c571f
SHA1 ce8c0205a3ec6e12e767338b6226b0cdda4d9bc2
SHA512 2cea45608096e66950c847c3af974dd844f35d40ad8d58d5e7513265092ce79751873f29b89c764f2595bf15de362ab1dbef58af9d66a31e0005163824dd5b45
SSDEEP 49152:knw9oUUEEDlOuJv0oD5WBsv5AK6kxGTnburHf:kQUEEB
MD5 SHA1 SHA512 SSDEEP

Submit Download

LNqHUog.exe

Path C:\Windows\System32\LNqHUog.exe
Size 1.9MB
SHA256 e749a9f3a5b8fa1240993a817191dfa3d928f2721a913fbf56254ebe29ebe057
MD5 c95ec47bc8c90a39192545f8f0f8ed9a
SHA1 cf5bbc2207455808a01d695a960fcbc858c50c8a
SHA512 2618d11118fe9261748622ea6b51c369647e343f5794bfde7ce6ebad4045cdddac2fe3d54cf1dd87d8291c174996f1b86567e992d86e155bb1322b17e6d8dc43
SSDEEP 49152:knw9oUUEEDlOuJv0oD5WBsv5AK6kxGTnburHJ:kQUEE/
MD5 SHA1 SHA512 SSDEEP

Submit Download

MCLkSqj.exe

Path C:\Windows\System32\MCLkSqj.exe
Size 1.9MB
SHA256 ac9e47a80ca71328069ac8ff0557d0d7b40ef6fb8793a61fc052ca3b0af78d7e
MD5 0c9dd4b98440a7b224a6616048dd3350
SHA1 9bcbfc1b8d498da1ff122ce0b71a8fabcd026d95
SHA512 21d8cc1009b7c892bfb689af190731e9ed25b1a3d595a079b41adbe2e6565e0768078be2f37863ebc7efa12b1af4fa4ce982331d64213b1225d263d4477fe84f
SSDEEP 49152:knw9oUUEEDlOuJv0oD5WBsv5AK6kxGTnburHT:kQUEEV
MD5 SHA1 SHA512 SSDEEP

Submit Download

MqQnLbh.exe

Path C:\Windows\System32\MqQnLbh.exe
Size 1.9MB
SHA256 c6d1106100a00261ffb9f7393442219510c74a89645d559899b5a20b947db281
MD5 c9b3b0e3f53612dd0c021747060e1294
SHA1 09dabdc5d3c05fe4c95cdbb29ff2726ff6bd67ba
SHA512 bb366e4cb0becb03e733069573294714906ca62d4f6e5969dee54347d3042fa1e0290cc8ec0850c3a8b4a9002e37550653a9d956bda379a0c4ba4ec42ff32056
SSDEEP 49152:knw9oUUEEDlOuJv0oD5WBsv5AK6kxGTnburHh:kQUEEr
MD5 SHA1 SHA512 SSDEEP

Submit Download

RLfEExT.exe

Path C:\Windows\System32\RLfEExT.exe
Size 1.9MB
SHA256 3b9a8d6d3ea8bd8d95755ff4543b78c50f324b1d0b0512376709ba4f4c375a6f
MD5 c454270b5beb1aa2afa8dcdf2c06ab8f
SHA1 6bdfbfb97851cf8f3d334ffde3b06c3ea4d60b98
SHA512 817e6f69deaf154829d64791e3a739e3695daefb055089289b2ed613f99db13ce172a710a1ea6174c356d2a98acdc4660ff3f4a969e201c1477819f3e1729e2a
SSDEEP 49152:knw9oUUEEDlOuJv0oD5WBsv5AK6kxGTnburHs:kQUEES
MD5 SHA1 SHA512 SSDEEP

Submit Download

TbHDZoS.exe

Path C:\Windows\System32\TbHDZoS.exe
Size 1.9MB
SHA256 6e59ab2e31eb5004ec50947d605d3aec53cc51f4206277cfed28a3247ee143cd
MD5 f339aac702da2bf2593c292010e5cd1a
SHA1 ee0c9f2f77192ccfc8d0ed10a63f8ec741a03468
SHA512 adebcceb35c123b17e76d3070c6d71ee3fa08ff0e7a57438db16f4b05b82d75dd5dc55d2cc926ce681a53d8d012ed121b3bc4cec015f1787b74188219dee2d2e
SSDEEP 49152:knw9oUUEEDlOuJv0oD5WBsv5AK6kxGTnburHm:kQUEEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

WygdzrK.exe

Path C:\Windows\System32\WygdzrK.exe
Size 1.9MB
SHA256 b8205a720c38c82c80afe41449ab7137d190ab2a0aa3c983732992635a7f9cbe
MD5 80f7cd5f8bbaa35215ecb12275591866
SHA1 8ec1a1ed5d454c397d7e15bc7387f1c2ffb678c2
SHA512 2b7847d27cf290b86e90a1881423195e1b4dc65f05c4266a7d65e6c33aaee1997807b093672a7c329fa246610f0829ff66d3bfaea2d7a867c510a6c29b11917c
SSDEEP 49152:knw9oUUEEDlOuJv0oD5WBsv5AK6kxGTnburHN:kQUEEz
MD5 SHA1 SHA512 SSDEEP

Submit Download

XvwVSjP.exe

Path C:\Windows\System32\XvwVSjP.exe
Size 1.9MB
SHA256 25d6f54824cf55284ce338cd824c73a1ca0bb898376526cb42ca6b8418b8912f
MD5 f469db06bb2ee3e2244818c3be9986e6
SHA1 1657780fc7e92ce167882d25144190bb19493eae
SHA512 07e40ff7b1372dbbceeced46302387af218751940fe3827fb1d120e56bbb0e3a5dc25c57145c25d428c15129de33c537e2b36cc942529dc3abadbf34c0778a74
SSDEEP 49152:knw9oUUEEDlOuJv0oD5WBsv5AK6kxGTnburH6:kQUEEk
MD5 SHA1 SHA512 SSDEEP

Submit Download

YWsnfbF.exe

Path C:\Windows\System32\YWsnfbF.exe
Size 1.9MB
SHA256 612e14f9cadbc0d6814163cc6d727a57f659c213f3ab6effaa593d17c12f7f60
MD5 85e642cc9b1949441cff7800bbc18533
SHA1 57a5b17803aaebcc07f9bf4f3689d20df5bce6ef
SHA512 55c31360bab4625105114346eb1ad5004b1c2ae79cfc29e32d79d4a1b4d1c7700aefd54ca0f30a8cf9a5d31c0d3f76af5eb318446d9ae0fdca3c40bdfcc834a7
SSDEEP 49152:knw9oUUEEDlOuJv0oD5WBsv5AK6kxGTnburHN:kQUEE/
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZcTqGUR.exe

Path C:\Windows\System32\ZcTqGUR.exe
Size 1.9MB
SHA256 9fa3adc309a05846eded6e714b418f9fdd309062b8439c9295dd6e8359c67ca5
MD5 aebd8c92d36f280f2a658288bdc35a86
SHA1 a36614d1e0ac050619b19976ed7d045e9d4ddfb8
SHA512 0486f8c31d595bd21f304d618f501dee5fab617ef186010eba6a75c3350332d5a4d8405fb734c86c5a0b64678dee42f16fc8efbfc70fdd5ea3121806075ed36d
SSDEEP 49152:knw9oUUEEDlOuJv0oD5WBsv5AK6kxGTnburHQ:kQUEEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZmGKfru.exe

Path C:\Windows\System32\ZmGKfru.exe
Size 1.9MB
SHA256 d5c494a3d90d32b1e89dac1be5f709cce1f2ed25c5ae772d0e7431051744bf21
MD5 f045674f45c995e78929e9f82d5f4005
SHA1 39d3418efe78d9ec1862a23c08aac954daf80f5f
SHA512 1baf8aba0314dd6fda12f4470f2cdd362452077795a140ba178d75ea5842803c9a6956b447831d80495de25615d2b89dcb2e8659a300bbb48316aef432919866
SSDEEP 49152:knw9oUUEEDlOuJv0oD5WBsv5AK6kxGTnburHX:kQUEEh
MD5 SHA1 SHA512 SSDEEP

Submit Download

bWksAwP.exe

Path C:\Windows\System32\bWksAwP.exe
Size 1.9MB
SHA256 b5820fd45a8d793c76d4fe981e4e3b713bb829968850c2f2554aea323269fbd4
MD5 5d27da8978f8556c80b5c47a988fda23
SHA1 8c44ef526abbf93c311bf5d10f23cd6e53b5349d
SHA512 ec5ebace688f3b6ba0818081fe4efb277d06287dcf379503029621d8eceff57a20bd4089b65f5139c24d3dec5f474a99ba31ad1928f035d3aae565c6720343c2
SSDEEP 49152:knw9oUUEEDlOuJv0oD5WBsv5AK6kxGTnburHD:kQUEE5
MD5 SHA1 SHA512 SSDEEP

Submit Download

dmMRldV.exe

Path C:\Windows\System32\dmMRldV.exe
Size 1.9MB
SHA256 034079e1d6da4fee1b91209653229c2fb0b9f1ec1392c5b184a575402a4fdd02
MD5 9be44bd89fbfb96490360392773fd99e
SHA1 8ea412b0f9cfc64c24c4df9e9bae7b9b4c88cd2a
SHA512 5c46281d809715e96691f9a0313a41192f20468a8a66c6938d1204c5fd5d5ae81be1695b755cd9b750c9f71f211eaf767ac35fe018f794f453989b2c95218fc9
SSDEEP 49152:knw9oUUEEDlOuJv0oD5WBsv5AK6kxGTnburHQ:kQUEEK
MD5 SHA1 SHA512 SSDEEP

Submit Download

fOkJNSM.exe

Path C:\Windows\System32\fOkJNSM.exe
Size 1.9MB
SHA256 781b3f25ccb3a9352fbea5f14fd0caf2adcb88962002a29a682ec888a0230531
MD5 3c2071f270db3df72a6691c26d59db15
SHA1 33f02661253259a934b7ae30d29226e856ef7888
SHA512 b9c50ed5d1f0b8de34fb677cc0fe0aa725de3138186fbb47adb7e5cd697031c467d450e00823038d22b2744d84132574a5004192c695776a7246353446934bec
SSDEEP 49152:knw9oUUEEDlOuJv0oD5WBsv5AK6kxGTnburHA:kQUEEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

fkoztGK.exe

Path C:\Windows\System32\fkoztGK.exe
Size 1.9MB
SHA256 cfd414a8a1a43c6da9497d1f957d9ee59aea6530cf6bb5290073b4f80c6ceb9a
MD5 2785cf5f9f30992435ee6ec684927c98
SHA1 07eebd9f22154b695b1e009f8691d78b3d66152b
SHA512 ef7c3d7c7343663cbb59d3e418bad517cbcca76f0b59251925146e1b95f226694587d3a96b72a57939d00cc7b1ed2603ffe790de3bbf940ae8599b5e2d102cfa
SSDEEP 49152:knw9oUUEEDlOuJv0oD5WBsv5AK6kxGTnburHy:kQUEEA
MD5 SHA1 SHA512 SSDEEP

Submit Download

hCFpFeF.exe

Path C:\Windows\System32\hCFpFeF.exe
Size 1.9MB
SHA256 da33f98affc19383a0b00459b18a3a0651245d3accc762b1e517b748a0d6c66b
MD5 ff42438360ffb19cc3d96017c51b8a2f
SHA1 5e6f4175b9b1862e69fd1410c630544c85dd4b01
SHA512 6a8edee723e52216c4db3017f7a6e8c9b80fa2f5e98a1d559824bae5a80c9946d3918a5bbb5d0014c70f788eaed7f4ef61305dc8eae528fe6c065ee9c9e37391
SSDEEP 49152:knw9oUUEEDlOuJv0oD5WBsv5AK6kxGTnburH9:kQUEE7
MD5 SHA1 SHA512 SSDEEP

Submit Download

iVbuANu.exe

Path C:\Windows\System32\iVbuANu.exe
Size 1.9MB
SHA256 b5c88752cecb6afd19526a07c792c9bda8ef538c7a045732139bb1b2161b15fd
MD5 e038595e0bae00a872d57cdd4e455ec5
SHA1 7af76b50738c7e7aee2c94cbad32120217fa688d
SHA512 9c27874d9e8c5b9be33d0f7f778421c7de4b40332697759830aba611ed45daf46149762c4d6c3cbfe038d19a7e46265cd0ac5b84246d0125f8acf5d202695e88
SSDEEP 49152:knw9oUUEEDlOuJv0oD5WBsv5AK6kxGTnburH6:kQUEEg
MD5 SHA1 SHA512 SSDEEP

Submit Download

kYxsCbo.exe

Path C:\Windows\System32\kYxsCbo.exe
Size 1.9MB
SHA256 08f782c0cd6fe030385f04e43706d3ab7e7272f48dc91d46c8cc4045c193cbd3
MD5 7f032485dcc340b33fe2d3c9b4ce2c07
SHA1 3648e1ff4d9b0d71e9567b3eeb210a15182f559f
SHA512 2dff46231a8a05d1e9c0121a394ceca4e0a907f44f88b50b2ca8cc3a6f30f1f45447288763e856a42921d4bae80a04bab4b4188218731a8c62d2b9957b1da90e
SSDEEP 49152:knw9oUUEEDlOuJv0oD5WBsv5AK6kxGTnburHu:kQUEEU
MD5 SHA1 SHA512 SSDEEP

Submit Download

mBCUfqR.exe

Path C:\Windows\System32\mBCUfqR.exe
Size 1.9MB
SHA256 aab5a98682b48b3b28e85c18070bf2ff533b9996eff3515f22170b95d17f23fb
MD5 e4458db5b64f16a7de47fd5c3c656afd
SHA1 95488511f117f4695a44093a0ff6035820401f0c
SHA512 704b0d3a0b2de50c7402e2f70f2fb2bcaf3d00ca87181d5985efdc054cab0317ac465885161a13b8364215fdd7e4138907767e47bec2d7312c90a78a005dae68
SSDEEP 49152:knw9oUUEEDlOuJv0oD5WBsv5AK6kxGTnburHg:kQUEEa
MD5 SHA1 SHA512 SSDEEP

Submit Download

mckgEUl.exe

Path C:\Windows\System32\mckgEUl.exe
Size 1.9MB
SHA256 5edfa0a959ba5b0fa5a61f17f55551229bd722f14904074c67ea410b30ac4498
MD5 df34a1f37957072ffdf49c1e68f7fd8f
SHA1 09c4a2d8e40b536b77c523638b6ff4b88746dad7
SHA512 dfe4ee50db3aa05e6c764888c1d5865888f77a5cd40581546188862341d6e0f8a856649f75b42ec7d766975fb86cafddbc7f4be2145d72549b31bd74f79b17a2
SSDEEP 49152:knw9oUUEEDlOuJv0oD5WBsv5AK6kxGTnburHe:kQUEEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

mvePrgP.exe

Path C:\Windows\System32\mvePrgP.exe
Size 1.9MB
SHA256 f22a8aefdfb4719aaf0e78691779dde1608b7fc8115cb65a8a0de2c916a3d4cb
MD5 d0cdc014a69f895cc98f646c630fb284
SHA1 c53d73c4b9d8f422a58bf1bff1559c0d1c6d5edc
SHA512 5f0c74017797904608a90eb4315a42d72826aace8f320e86d7d750ff93758229accd548041d28b89baf3e883e6c76b9e1264ff9a708365d84173d8d5d8aadfd6
SSDEEP 49152:knw9oUUEEDlOuJv0oD5WBsv5AK6kxGTnburHx:kQUEE/
MD5 SHA1 SHA512 SSDEEP

Submit Download

nhTtWpx.exe

Path C:\Windows\System32\nhTtWpx.exe
Size 1.9MB
SHA256 abe005e10d0955a9cd935c2c909ff278296ad928886dae76fdc46adb0bed4fc7
MD5 e2096203ff18c23ef0a2a39f9858b27a
SHA1 ff12796fa62250f55c2f83538d06f554de514b53
SHA512 15b63924e9a79543627ebda1f1aea0b4b5a10f8e69c6e1d49854fe57015faf1c9c958c645563ddcf0c346832632f23967efb90e9a2e2fd42063d2aa1e7574b5c
SSDEEP 49152:knw9oUUEEDlOuJv0oD5WBsv5AK6kxGTnburH2:kQUEE4
MD5 SHA1 SHA512 SSDEEP

Submit Download

oodccXj.exe

Path C:\Windows\System32\oodccXj.exe
Size 1.9MB
SHA256 7fa01a37c9330a06bf023e886b9fa449910ea8866d878eb12b4cf8eb277995e9
MD5 6e7eb4682e1431845bd3fdc9ce2bccdd
SHA1 b59c86c442bbfcdacaeb5e47fccfa69c9480d5f3
SHA512 3b517665b6935913199e64f2283772d60a15945f789472669cb09a9c0c5ead1c3b2af93f6e173447d5599c54a9bfc10e3df28c953166d95a35576a741c8ade73
SSDEEP 49152:knw9oUUEEDlOuJv0oD5WBsv5AK6kxGTnburHO:kQUEE4
MD5 SHA1 SHA512 SSDEEP

Submit Download

oqFftOa.exe

Path C:\Windows\System32\oqFftOa.exe
Size 1.9MB
SHA256 be686982bca1cf3d4090315a996947e7ec4856f7764f8865aef657421bcba131
MD5 2d732384050441f0e7e27ec228798b93
SHA1 645b1eb657af4990fa5cfa47580c0b9a5bb9b4db
SHA512 82d8a896a4b97ea54507201d320bc4e1a1d474984ba1acbe4d274b1692b8c756ff8537bfac5683779dc6b9d7478fddb9398fd52d561a8d02998e5146ca601d45
SSDEEP 49152:knw9oUUEEDlOuJv0oD5WBsv5AK6kxGTnburHm:kQUEEA
MD5 SHA1 SHA512 SSDEEP

Submit Download

pCHLRfb.exe

Path C:\Windows\System32\pCHLRfb.exe
Size 1.9MB
SHA256 a1b506d8070934891ba0955e7eddbf57bf03de70651bd10c7d176f37c2175234
MD5 510c3f29b14057f13ccc6c3d551c7df4
SHA1 295f32b3d0015de12f7191a691b1e7ea4daa389e
SHA512 6ecb119282ec0ca75ab283b6915455ba9a6e437b24daa05707737308c81be0e29af5b0179a49990b664331be463d7d14d458caf4a845ff8c6050a8c27a9c0ce1
SSDEEP 49152:knw9oUUEEDlOuJv0oD5WBsv5AK6kxGTnburHc:kQUEEy
MD5 SHA1 SHA512 SSDEEP

Submit Download

tHEwqRp.exe

Path C:\Windows\System32\tHEwqRp.exe
Size 1.9MB
SHA256 9f3e8d9208a54e9b16d77dae1a01d1c0335ea44a4417692a02d8d0d2ff62cb79
MD5 aa8587e3dff4a4f540c4a8994cce1d4e
SHA1 25e8dad9e0646ce93ffba6476aacc99546cec083
SHA512 6f1fd40d8cbc9eb2912bd020f6a5feac45796b152c78d2691aaedb9da128809dbd24c118a486e269c9db93ef7c9353ec235c9a1649ea75981c955350c0859c51
SSDEEP 49152:knw9oUUEEDlOuJv0oD5WBsv5AK6kxGTnburH+:kQUEE0
MD5 SHA1 SHA512 SSDEEP

Submit Download

wEiTAtf.exe

Path C:\Windows\System32\wEiTAtf.exe
Size 1.9MB
SHA256 a4d3bc8d2d03f676f53f11194413a160704928ef4085305237fd82888fa0c93b
MD5 23b82489abc6964127bc7eb978fe970b
SHA1 ad4a932834a81eaa8e639301f3685ab2ad594df0
SHA512 9d1ae374d71f952aa2137fb43d0cc4aaa13a64d742bc7cfdbe308e2661b52adc9f49511b1dbf0fd57acdbe3a7f42ff5a3af8cc1c940df643c2f0bdf5e2a86685
SSDEEP 49152:knw9oUUEEDlOuJv0oD5WBsv5AK6kxGTnburH1:kQUEEX
MD5 SHA1 SHA512 SSDEEP

Submit Download

yGLtgDQ.exe

Path C:\Windows\System32\yGLtgDQ.exe
Size 1.9MB
SHA256 bbe0ae2b8524abdf64f696b33ddab281f9527d1b573d478cb1cc9e058c9eae31
MD5 c12d17603aeff038ba43eac2dd5395b5
SHA1 1e1699af4692fd839e5923c422c9a68a0b15e822
SHA512 cd650cc9b7ca0c7c207a9b5cec801e999c302c6b956597eb955ef5424a9788daa69622bba19e5f7da077ed6e57080df581df6ea279e517c2d568b13be3bcdc46
SSDEEP 49152:knw9oUUEEDlOuJv0oD5WBsv5AK6kxGTnburHy:kQUEEU
MD5 SHA1 SHA512 SSDEEP

Submit Download

yjIahWl.exe

Path C:\Windows\System32\yjIahWl.exe
Size 1.9MB
SHA256 a926ee75fad12ea35273e947a6e7cd1b96b6aaedf9de054170f7532b8d676c0c
MD5 d183fb22ade446539e4df46259973089
SHA1 68f38df3eddf06458a6d22e979757b8c24637109
SHA512 a91354bb77f40e1a590196b3adcc28613ca0107befb898bcbd2e5ca10320173d8998964a2dbe7da8d0be123e9b8b8553fc3794fdc54c63524c744f0f90044dad
SSDEEP 49152:knw9oUUEEDlOuJv0oD5WBsv5AK6kxGTnburHb:kQUEEB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/780-2058-0x00007FF7174F0000-0x00007FF7178E1000-memory.dmp

Download

memory/780-465-0x00007FF7174F0000-0x00007FF7178E1000-memory.dmp

Download

memory/884-533-0x00007FF6B3B60000-0x00007FF6B3F51000-memory.dmp

Download

memory/884-2090-0x00007FF6B3B60000-0x00007FF6B3F51000-memory.dmp

Download

memory/1088-2077-0x00007FF730600000-0x00007FF7309F1000-memory.dmp

Download

memory/1088-489-0x00007FF730600000-0x00007FF7309F1000-memory.dmp

Download

memory/1124-2079-0x00007FF6EEC40000-0x00007FF6EF031000-memory.dmp

Download

memory/1124-483-0x00007FF6EEC40000-0x00007FF6EF031000-memory.dmp

Download

memory/1548-0-0x00007FF727E20000-0x00007FF728211000-memory.dmp

Download

memory/1548-1978-0x00007FF727E20000-0x00007FF728211000-memory.dmp

Download

memory/1548-1-0x000002344A4E0000-0x000002344A4F0000-memory.dmp

Download

memory/1612-2071-0x00007FF73F790000-0x00007FF73FB81000-memory.dmp

Download

memory/1612-507-0x00007FF73F790000-0x00007FF73FB81000-memory.dmp

Download

memory/2012-518-0x00007FF68D6C0000-0x00007FF68DAB1000-memory.dmp

Download

memory/2012-2065-0x00007FF68D6C0000-0x00007FF68DAB1000-memory.dmp

Download

memory/2280-525-0x00007FF6A3730000-0x00007FF6A3B21000-memory.dmp

Download

memory/2280-2061-0x00007FF6A3730000-0x00007FF6A3B21000-memory.dmp

Download

memory/2296-23-0x00007FF762380000-0x00007FF762771000-memory.dmp

Download

memory/2296-2050-0x00007FF762380000-0x00007FF762771000-memory.dmp

Download

memory/2296-2014-0x00007FF762380000-0x00007FF762771000-memory.dmp

Download

memory/2536-482-0x00007FF7B7E70000-0x00007FF7B8261000-memory.dmp

Download

memory/2536-2081-0x00007FF7B7E70000-0x00007FF7B8261000-memory.dmp

Download

memory/2596-2052-0x00007FF642350000-0x00007FF642741000-memory.dmp

Download

memory/2596-33-0x00007FF642350000-0x00007FF642741000-memory.dmp

Download

memory/2620-2069-0x00007FF73B640000-0x00007FF73BA31000-memory.dmp

Download

memory/2620-511-0x00007FF73B640000-0x00007FF73BA31000-memory.dmp

Download

memory/2852-531-0x00007FF7D7C90000-0x00007FF7D8081000-memory.dmp

Download

memory/2852-2086-0x00007FF7D7C90000-0x00007FF7D8081000-memory.dmp

Download

memory/2948-2073-0x00007FF670640000-0x00007FF670A31000-memory.dmp

Download

memory/2948-503-0x00007FF670640000-0x00007FF670A31000-memory.dmp

Download

memory/3040-2075-0x00007FF76C530000-0x00007FF76C921000-memory.dmp

Download

memory/3040-497-0x00007FF76C530000-0x00007FF76C921000-memory.dmp

Download

memory/3208-529-0x00007FF6C9630000-0x00007FF6C9A21000-memory.dmp

Download

memory/3208-2084-0x00007FF6C9630000-0x00007FF6C9A21000-memory.dmp

Download

memory/3476-534-0x00007FF6AF150000-0x00007FF6AF541000-memory.dmp

Download

memory/3476-2092-0x00007FF6AF150000-0x00007FF6AF541000-memory.dmp

Download

memory/3600-2056-0x00007FF665A10000-0x00007FF665E01000-memory.dmp

Download

memory/3600-459-0x00007FF665A10000-0x00007FF665E01000-memory.dmp

Download

memory/4020-1979-0x00007FF775F60000-0x00007FF776351000-memory.dmp

Download

memory/4020-2046-0x00007FF775F60000-0x00007FF776351000-memory.dmp

Download

memory/4020-8-0x00007FF775F60000-0x00007FF776351000-memory.dmp

Download

memory/4180-2067-0x00007FF75CF90000-0x00007FF75D381000-memory.dmp

Download

memory/4180-516-0x00007FF75CF90000-0x00007FF75D381000-memory.dmp

Download

memory/4344-2082-0x00007FF7FD800000-0x00007FF7FDBF1000-memory.dmp

Download

memory/4344-478-0x00007FF7FD800000-0x00007FF7FDBF1000-memory.dmp

Download

memory/4696-2048-0x00007FF798490000-0x00007FF798881000-memory.dmp

Download

memory/4696-17-0x00007FF798490000-0x00007FF798881000-memory.dmp

Download

memory/4696-2012-0x00007FF798490000-0x00007FF798881000-memory.dmp

Download

memory/4908-22-0x00007FF7F6C60000-0x00007FF7F7051000-memory.dmp

Download

memory/4908-2054-0x00007FF7F6C60000-0x00007FF7F7051000-memory.dmp

Download

memory/4908-1980-0x00007FF7F6C60000-0x00007FF7F7051000-memory.dmp

Download

memory/4944-2088-0x00007FF6F5C50000-0x00007FF6F6041000-memory.dmp

Download

memory/4944-526-0x00007FF6F5C50000-0x00007FF6F6041000-memory.dmp

Download

memory/5052-2063-0x00007FF72F520000-0x00007FF72F911000-memory.dmp

Download

memory/5052-524-0x00007FF72F520000-0x00007FF72F911000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads