xmrig | 92ade129a00bacfcf4a93672b29c3771824fd0aaa75440a826ad931c0b95fdf1

Analysis

max time kernel
124s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 14:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
Size 3.3MB
Sample240613-rg7b2asbrd
SHA256 92ade129a00bacfcf4a93672b29c3771824fd0aaa75440a826ad931c0b95fdf1
MD5 82a7fc5aea1251658e6d35c704cdb300
SHA1 72f315313e5c08f77a27c7c31bf5e14ffd61a778
SHA512 bbbff9551f59fd0fcb6df072d9fe5ed1137e37fd3e2e7150024f76ab8d565daaa751d2e221406e5e04dc9814125fdbf25bc49824b69d8d86bcab0b8f68c34bd5
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc42:wFWPClFm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1928-0-0x00007FF6D2690000-0x00007FF6D2A85000-memory.dmp	xmrig
behavioral2/files/0x0009000000023669-5.dat	xmrig
behavioral2/files/0x0007000000023670-7.dat	xmrig
behavioral2/files/0x000800000002366f-15.dat	xmrig
behavioral2/memory/1572-12-0x00007FF721180000-0x00007FF721575000-memory.dmp	xmrig
behavioral2/memory/4068-11-0x00007FF625000000-0x00007FF6253F5000-memory.dmp	xmrig
behavioral2/files/0x0007000000023671-27.dat	xmrig
behavioral2/files/0x0007000000023672-29.dat	xmrig
behavioral2/files/0x0007000000023673-35.dat	xmrig
behavioral2/files/0x0007000000023674-40.dat	xmrig
behavioral2/files/0x0007000000023675-43.dat	xmrig
behavioral2/files/0x0007000000023676-50.dat	xmrig
behavioral2/files/0x0007000000023677-55.dat	xmrig
behavioral2/files/0x000700000002367a-68.dat	xmrig
behavioral2/files/0x000700000002367d-85.dat	xmrig
behavioral2/files/0x000700000002367f-95.dat	xmrig
behavioral2/files/0x0007000000023681-104.dat	xmrig
behavioral2/files/0x0007000000023683-115.dat	xmrig
behavioral2/files/0x0007000000023686-128.dat	xmrig
behavioral2/files/0x0007000000023688-140.dat	xmrig
behavioral2/files/0x000700000002368c-158.dat	xmrig
behavioral2/files/0x000700000002368d-165.dat	xmrig
behavioral2/files/0x000700000002368b-155.dat	xmrig
behavioral2/files/0x000700000002368a-150.dat	xmrig
behavioral2/files/0x0007000000023689-145.dat	xmrig
behavioral2/memory/1956-747-0x00007FF66EF10000-0x00007FF66F305000-memory.dmp	xmrig
behavioral2/files/0x0007000000023687-135.dat	xmrig
behavioral2/files/0x0007000000023685-125.dat	xmrig
behavioral2/files/0x0007000000023684-120.dat	xmrig
behavioral2/files/0x0007000000023682-110.dat	xmrig
behavioral2/files/0x0007000000023680-100.dat	xmrig
behavioral2/files/0x000700000002367e-90.dat	xmrig
behavioral2/files/0x000700000002367c-80.dat	xmrig
behavioral2/files/0x000700000002367b-75.dat	xmrig
behavioral2/files/0x0007000000023679-65.dat	xmrig
behavioral2/files/0x0007000000023678-63.dat	xmrig
behavioral2/memory/1432-32-0x00007FF6884D0000-0x00007FF6888C5000-memory.dmp	xmrig
behavioral2/memory/2032-25-0x00007FF677FE0000-0x00007FF6783D5000-memory.dmp	xmrig
behavioral2/memory/4432-748-0x00007FF706960000-0x00007FF706D55000-memory.dmp	xmrig
behavioral2/memory/3704-749-0x00007FF6B1BA0000-0x00007FF6B1F95000-memory.dmp	xmrig
behavioral2/memory/4608-750-0x00007FF7B0400000-0x00007FF7B07F5000-memory.dmp	xmrig
behavioral2/memory/2668-751-0x00007FF7B9D00000-0x00007FF7BA0F5000-memory.dmp	xmrig
behavioral2/memory/3664-752-0x00007FF6901E0000-0x00007FF6905D5000-memory.dmp	xmrig
behavioral2/memory/2644-753-0x00007FF66CEF0000-0x00007FF66D2E5000-memory.dmp	xmrig
behavioral2/memory/2532-754-0x00007FF67A3B0000-0x00007FF67A7A5000-memory.dmp	xmrig
behavioral2/memory/4896-760-0x00007FF7C5220000-0x00007FF7C5615000-memory.dmp	xmrig
behavioral2/memory/3112-769-0x00007FF765850000-0x00007FF765C45000-memory.dmp	xmrig
behavioral2/memory/4428-773-0x00007FF7663B0000-0x00007FF7667A5000-memory.dmp	xmrig
behavioral2/memory/3508-778-0x00007FF61A380000-0x00007FF61A775000-memory.dmp	xmrig
behavioral2/memory/3012-796-0x00007FF6F2FE0000-0x00007FF6F33D5000-memory.dmp	xmrig
behavioral2/memory/4320-793-0x00007FF711990000-0x00007FF711D85000-memory.dmp	xmrig
behavioral2/memory/2600-790-0x00007FF7FD9A0000-0x00007FF7FDD95000-memory.dmp	xmrig
behavioral2/memory/3860-789-0x00007FF71E8F0000-0x00007FF71ECE5000-memory.dmp	xmrig
behavioral2/memory/2052-784-0x00007FF6E6D70000-0x00007FF6E7165000-memory.dmp	xmrig
behavioral2/memory/2408-798-0x00007FF7880E0000-0x00007FF7884D5000-memory.dmp	xmrig
behavioral2/memory/3716-804-0x00007FF731390000-0x00007FF731785000-memory.dmp	xmrig
behavioral2/memory/3440-805-0x00007FF7E4A70000-0x00007FF7E4E65000-memory.dmp	xmrig
behavioral2/memory/1928-1892-0x00007FF6D2690000-0x00007FF6D2A85000-memory.dmp	xmrig
behavioral2/memory/4068-1893-0x00007FF625000000-0x00007FF6253F5000-memory.dmp	xmrig
behavioral2/memory/1572-1894-0x00007FF721180000-0x00007FF721575000-memory.dmp	xmrig
behavioral2/memory/1928-1895-0x00007FF6D2690000-0x00007FF6D2A85000-memory.dmp	xmrig
behavioral2/memory/4068-1896-0x00007FF625000000-0x00007FF6253F5000-memory.dmp	xmrig
behavioral2/memory/2032-1897-0x00007FF677FE0000-0x00007FF6783D5000-memory.dmp	xmrig
behavioral2/memory/1572-1898-0x00007FF721180000-0x00007FF721575000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4068	xheahyc.exe
1572	RVPmCul.exe
2032	DFYzPfj.exe
1432	TgUDQdW.exe
1956	pnZcjkk.exe
3440	UcvBGom.exe
4432	YVMUGCs.exe
3704	Hkkxfmy.exe
4608	TksezWc.exe
2668	WNAQkRV.exe
3664	pwdGCzC.exe
2644	DzTptKP.exe
2532	HzCKScL.exe
4896	GBBwrzw.exe
3112	tgkTAFC.exe
4428	zQtRIrg.exe
3508	xnHrQCz.exe
2052	CHpYnrT.exe
3860	jvLEMCR.exe
2600	YBYDGOZ.exe
4320	GpWjBEO.exe
3012	SXwOEkG.exe
2408	zfUwsDX.exe
3716	jXQFdUU.exe
4444	NpptRNG.exe
2256	VONSWnF.exe
1400	oRSXYOB.exe
3896	vEkatmM.exe
4900	mrqNPvC.exe
4452	kZpCCfC.exe
1340	meqgxXH.exe
624	UaImYhe.exe
3472	RMXTbJh.exe
3156	pBocCWf.exe
536	GnMclnV.exe
2340	PjOJKtO.exe
4008	njOXxpi.exe
4536	rqLOVDU.exe
4940	hEgKgsb.exe
3260	MYyqyvS.exe
4356	KlWLuJB.exe
3892	fNfNZWy.exe
3104	jgHDlyO.exe
2728	whYuBcw.exe
4988	VnWmoZR.exe
1160	AFpHTQp.exe
4668	bbmSlim.exe
5072	GcpLOoe.exe
2308	hozdINw.exe
2756	knqDRNe.exe
4028	jfEDhNu.exe
4416	dOJaDPB.exe
1688	zveRkaA.exe
2688	NOLwOvo.exe
4228	nYTwYES.exe
3196	mTmcSbB.exe
4164	frPbVYd.exe
4620	IbXxvvG.exe
2484	mCzVQQR.exe
4756	GIlIuML.exe
2088	rSCFWvq.exe
4852	ymTfcOD.exe
4972	sHrAwIK.exe
4516	RzHebut.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1928-0-0x00007FF6D2690000-0x00007FF6D2A85000-memory.dmp	upx
behavioral2/files/0x0009000000023669-5.dat	upx
behavioral2/files/0x0007000000023670-7.dat	upx
behavioral2/files/0x000800000002366f-15.dat	upx
behavioral2/memory/1572-12-0x00007FF721180000-0x00007FF721575000-memory.dmp	upx
behavioral2/memory/4068-11-0x00007FF625000000-0x00007FF6253F5000-memory.dmp	upx
behavioral2/files/0x0007000000023671-27.dat	upx
behavioral2/files/0x0007000000023672-29.dat	upx
behavioral2/files/0x0007000000023673-35.dat	upx
behavioral2/files/0x0007000000023674-40.dat	upx
behavioral2/files/0x0007000000023675-43.dat	upx
behavioral2/files/0x0007000000023676-50.dat	upx
behavioral2/files/0x0007000000023677-55.dat	upx
behavioral2/files/0x000700000002367a-68.dat	upx
behavioral2/files/0x000700000002367d-85.dat	upx
behavioral2/files/0x000700000002367f-95.dat	upx
behavioral2/files/0x0007000000023681-104.dat	upx
behavioral2/files/0x0007000000023683-115.dat	upx
behavioral2/files/0x0007000000023686-128.dat	upx
behavioral2/files/0x0007000000023688-140.dat	upx
behavioral2/files/0x000700000002368c-158.dat	upx
behavioral2/files/0x000700000002368d-165.dat	upx
behavioral2/files/0x000700000002368b-155.dat	upx
behavioral2/files/0x000700000002368a-150.dat	upx
behavioral2/files/0x0007000000023689-145.dat	upx
behavioral2/memory/1956-747-0x00007FF66EF10000-0x00007FF66F305000-memory.dmp	upx
behavioral2/files/0x0007000000023687-135.dat	upx
behavioral2/files/0x0007000000023685-125.dat	upx
behavioral2/files/0x0007000000023684-120.dat	upx
behavioral2/files/0x0007000000023682-110.dat	upx
behavioral2/files/0x0007000000023680-100.dat	upx
behavioral2/files/0x000700000002367e-90.dat	upx
behavioral2/files/0x000700000002367c-80.dat	upx
behavioral2/files/0x000700000002367b-75.dat	upx
behavioral2/files/0x0007000000023679-65.dat	upx
behavioral2/files/0x0007000000023678-63.dat	upx
behavioral2/memory/1432-32-0x00007FF6884D0000-0x00007FF6888C5000-memory.dmp	upx
behavioral2/memory/2032-25-0x00007FF677FE0000-0x00007FF6783D5000-memory.dmp	upx
behavioral2/memory/4432-748-0x00007FF706960000-0x00007FF706D55000-memory.dmp	upx
behavioral2/memory/3704-749-0x00007FF6B1BA0000-0x00007FF6B1F95000-memory.dmp	upx
behavioral2/memory/4608-750-0x00007FF7B0400000-0x00007FF7B07F5000-memory.dmp	upx
behavioral2/memory/2668-751-0x00007FF7B9D00000-0x00007FF7BA0F5000-memory.dmp	upx
behavioral2/memory/3664-752-0x00007FF6901E0000-0x00007FF6905D5000-memory.dmp	upx
behavioral2/memory/2644-753-0x00007FF66CEF0000-0x00007FF66D2E5000-memory.dmp	upx
behavioral2/memory/2532-754-0x00007FF67A3B0000-0x00007FF67A7A5000-memory.dmp	upx
behavioral2/memory/4896-760-0x00007FF7C5220000-0x00007FF7C5615000-memory.dmp	upx
behavioral2/memory/3112-769-0x00007FF765850000-0x00007FF765C45000-memory.dmp	upx
behavioral2/memory/4428-773-0x00007FF7663B0000-0x00007FF7667A5000-memory.dmp	upx
behavioral2/memory/3508-778-0x00007FF61A380000-0x00007FF61A775000-memory.dmp	upx
behavioral2/memory/3012-796-0x00007FF6F2FE0000-0x00007FF6F33D5000-memory.dmp	upx
behavioral2/memory/4320-793-0x00007FF711990000-0x00007FF711D85000-memory.dmp	upx
behavioral2/memory/2600-790-0x00007FF7FD9A0000-0x00007FF7FDD95000-memory.dmp	upx
behavioral2/memory/3860-789-0x00007FF71E8F0000-0x00007FF71ECE5000-memory.dmp	upx
behavioral2/memory/2052-784-0x00007FF6E6D70000-0x00007FF6E7165000-memory.dmp	upx
behavioral2/memory/2408-798-0x00007FF7880E0000-0x00007FF7884D5000-memory.dmp	upx
behavioral2/memory/3716-804-0x00007FF731390000-0x00007FF731785000-memory.dmp	upx
behavioral2/memory/3440-805-0x00007FF7E4A70000-0x00007FF7E4E65000-memory.dmp	upx
behavioral2/memory/1928-1892-0x00007FF6D2690000-0x00007FF6D2A85000-memory.dmp	upx
behavioral2/memory/4068-1893-0x00007FF625000000-0x00007FF6253F5000-memory.dmp	upx
behavioral2/memory/1572-1894-0x00007FF721180000-0x00007FF721575000-memory.dmp	upx
behavioral2/memory/1928-1895-0x00007FF6D2690000-0x00007FF6D2A85000-memory.dmp	upx
behavioral2/memory/4068-1896-0x00007FF625000000-0x00007FF6253F5000-memory.dmp	upx
behavioral2/memory/2032-1897-0x00007FF677FE0000-0x00007FF6783D5000-memory.dmp	upx
behavioral2/memory/1572-1898-0x00007FF721180000-0x00007FF721575000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\ESXcaIt.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\RHClyCv.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\BHtrZXI.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\NRhZVSO.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\kOkhqhe.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\GcpLOoe.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\ICyJkmC.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\XzqARYh.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\ixuTwpS.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\cfwlapp.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\YwuxiZy.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\GIUswrN.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\zTbOXDH.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\UzbcGEQ.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\unzGlHo.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\SmEopZA.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\DuECRFV.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\YYXDfdX.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\HBdlTIA.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\KekpPKB.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\ryWxBbO.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\ORViqFf.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\vfXAVsf.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\dhsSRvq.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\NQSDDJn.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\nOotDbL.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\PYtvnEQ.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\AIleGVP.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\vKfaJOA.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\FlrhSHX.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\OJIMVFg.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\vEhtJRP.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\IEqgaCG.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\wgzLLun.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\ndcgLvS.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\YBYDGOZ.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\FZwEiiz.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\fJsCjFj.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\GGpZTcM.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\GQqLZTN.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\hJgrbwy.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\lyQcmdS.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\sfAuhda.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\xnHrQCz.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\mCzVQQR.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\UASMfGz.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\yXqZUFi.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\awekWdP.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\xHGbwcV.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\SWUXpot.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\AKlFwmB.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\sRQspnP.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\nhRJUWN.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\uuklVks.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\Wppvfqt.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\lYABvDr.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\dRIKhlx.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\bYgSeUi.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\bbmSlim.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\YplRrUq.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\pVngOoa.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\XyJnHOB.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\VgHKmhT.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
File created	C:\Windows\System32\GBBwrzw.exe	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 4068	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	90
PID 1928 wrote to memory of 4068	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	90
PID 1928 wrote to memory of 1572	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	91
PID 1928 wrote to memory of 1572	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	91
PID 1928 wrote to memory of 2032	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	92
PID 1928 wrote to memory of 2032	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	92
PID 1928 wrote to memory of 1432	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	93
PID 1928 wrote to memory of 1432	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	93
PID 1928 wrote to memory of 1956	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	94
PID 1928 wrote to memory of 1956	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	94
PID 1928 wrote to memory of 3440	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	95
PID 1928 wrote to memory of 3440	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	95
PID 1928 wrote to memory of 4432	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	96
PID 1928 wrote to memory of 4432	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	96
PID 1928 wrote to memory of 3704	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	97
PID 1928 wrote to memory of 3704	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	97
PID 1928 wrote to memory of 4608	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	98
PID 1928 wrote to memory of 4608	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	98
PID 1928 wrote to memory of 2668	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	99
PID 1928 wrote to memory of 2668	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	99
PID 1928 wrote to memory of 3664	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	100
PID 1928 wrote to memory of 3664	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	100
PID 1928 wrote to memory of 2644	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	101
PID 1928 wrote to memory of 2644	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	101
PID 1928 wrote to memory of 2532	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	102
PID 1928 wrote to memory of 2532	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	102
PID 1928 wrote to memory of 4896	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	103
PID 1928 wrote to memory of 4896	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	103
PID 1928 wrote to memory of 3112	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	104
PID 1928 wrote to memory of 3112	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	104
PID 1928 wrote to memory of 4428	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	105
PID 1928 wrote to memory of 4428	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	105
PID 1928 wrote to memory of 3508	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	106
PID 1928 wrote to memory of 3508	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	106
PID 1928 wrote to memory of 2052	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	107
PID 1928 wrote to memory of 2052	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	107
PID 1928 wrote to memory of 3860	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	108
PID 1928 wrote to memory of 3860	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	108
PID 1928 wrote to memory of 2600	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	109
PID 1928 wrote to memory of 2600	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	109
PID 1928 wrote to memory of 4320	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	110
PID 1928 wrote to memory of 4320	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	110
PID 1928 wrote to memory of 3012	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	111
PID 1928 wrote to memory of 3012	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	111
PID 1928 wrote to memory of 2408	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	112
PID 1928 wrote to memory of 2408	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	112
PID 1928 wrote to memory of 3716	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	113
PID 1928 wrote to memory of 3716	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	113
PID 1928 wrote to memory of 4444	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	114
PID 1928 wrote to memory of 4444	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	114
PID 1928 wrote to memory of 2256	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	115
PID 1928 wrote to memory of 2256	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	115
PID 1928 wrote to memory of 1400	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	116
PID 1928 wrote to memory of 1400	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	116
PID 1928 wrote to memory of 3896	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	117
PID 1928 wrote to memory of 3896	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	117
PID 1928 wrote to memory of 4900	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	118
PID 1928 wrote to memory of 4900	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	118
PID 1928 wrote to memory of 4452	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	119
PID 1928 wrote to memory of 4452	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	119
PID 1928 wrote to memory of 1340	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	120
PID 1928 wrote to memory of 1340	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	120
PID 1928 wrote to memory of 624	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	121
PID 1928 wrote to memory of 624	1928	82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe	121

C:\Users\Admin\AppData\Local\Temp\82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\82a7fc5aea1251658e6d35c704cdb300_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\System32\xheahyc.exe
  C:\Windows\System32\xheahyc.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System32\RVPmCul.exe
  C:\Windows\System32\RVPmCul.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System32\DFYzPfj.exe
  C:\Windows\System32\DFYzPfj.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System32\TgUDQdW.exe
  C:\Windows\System32\TgUDQdW.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System32\pnZcjkk.exe
  C:\Windows\System32\pnZcjkk.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System32\UcvBGom.exe
  C:\Windows\System32\UcvBGom.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System32\YVMUGCs.exe
  C:\Windows\System32\YVMUGCs.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System32\Hkkxfmy.exe
  C:\Windows\System32\Hkkxfmy.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System32\TksezWc.exe
  C:\Windows\System32\TksezWc.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System32\WNAQkRV.exe
  C:\Windows\System32\WNAQkRV.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System32\pwdGCzC.exe
  C:\Windows\System32\pwdGCzC.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System32\DzTptKP.exe
  C:\Windows\System32\DzTptKP.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System32\HzCKScL.exe
  C:\Windows\System32\HzCKScL.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System32\GBBwrzw.exe
  C:\Windows\System32\GBBwrzw.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System32\tgkTAFC.exe
  C:\Windows\System32\tgkTAFC.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System32\zQtRIrg.exe
  C:\Windows\System32\zQtRIrg.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System32\xnHrQCz.exe
  C:\Windows\System32\xnHrQCz.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System32\CHpYnrT.exe
  C:\Windows\System32\CHpYnrT.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System32\jvLEMCR.exe
  C:\Windows\System32\jvLEMCR.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System32\YBYDGOZ.exe
  C:\Windows\System32\YBYDGOZ.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System32\GpWjBEO.exe
  C:\Windows\System32\GpWjBEO.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System32\SXwOEkG.exe
  C:\Windows\System32\SXwOEkG.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System32\zfUwsDX.exe
  C:\Windows\System32\zfUwsDX.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System32\jXQFdUU.exe
  C:\Windows\System32\jXQFdUU.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System32\NpptRNG.exe
  C:\Windows\System32\NpptRNG.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System32\VONSWnF.exe
  C:\Windows\System32\VONSWnF.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System32\oRSXYOB.exe
  C:\Windows\System32\oRSXYOB.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System32\vEkatmM.exe
  C:\Windows\System32\vEkatmM.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System32\mrqNPvC.exe
  C:\Windows\System32\mrqNPvC.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System32\kZpCCfC.exe
  C:\Windows\System32\kZpCCfC.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System32\meqgxXH.exe
  C:\Windows\System32\meqgxXH.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System32\UaImYhe.exe
  C:\Windows\System32\UaImYhe.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System32\RMXTbJh.exe
  C:\Windows\System32\RMXTbJh.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System32\pBocCWf.exe
  C:\Windows\System32\pBocCWf.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System32\GnMclnV.exe
  C:\Windows\System32\GnMclnV.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System32\PjOJKtO.exe
  C:\Windows\System32\PjOJKtO.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System32\njOXxpi.exe
  C:\Windows\System32\njOXxpi.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System32\rqLOVDU.exe
  C:\Windows\System32\rqLOVDU.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System32\hEgKgsb.exe
  C:\Windows\System32\hEgKgsb.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System32\MYyqyvS.exe
  C:\Windows\System32\MYyqyvS.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System32\KlWLuJB.exe
  C:\Windows\System32\KlWLuJB.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System32\fNfNZWy.exe
  C:\Windows\System32\fNfNZWy.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System32\jgHDlyO.exe
  C:\Windows\System32\jgHDlyO.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System32\whYuBcw.exe
  C:\Windows\System32\whYuBcw.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System32\VnWmoZR.exe
  C:\Windows\System32\VnWmoZR.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System32\AFpHTQp.exe
  C:\Windows\System32\AFpHTQp.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System32\bbmSlim.exe
  C:\Windows\System32\bbmSlim.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System32\GcpLOoe.exe
  C:\Windows\System32\GcpLOoe.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System32\hozdINw.exe
  C:\Windows\System32\hozdINw.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System32\knqDRNe.exe
  C:\Windows\System32\knqDRNe.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System32\jfEDhNu.exe
  C:\Windows\System32\jfEDhNu.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System32\dOJaDPB.exe
  C:\Windows\System32\dOJaDPB.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System32\zveRkaA.exe
  C:\Windows\System32\zveRkaA.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System32\NOLwOvo.exe
  C:\Windows\System32\NOLwOvo.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System32\nYTwYES.exe
  C:\Windows\System32\nYTwYES.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System32\mTmcSbB.exe
  C:\Windows\System32\mTmcSbB.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System32\frPbVYd.exe
  C:\Windows\System32\frPbVYd.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System32\IbXxvvG.exe
  C:\Windows\System32\IbXxvvG.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System32\mCzVQQR.exe
  C:\Windows\System32\mCzVQQR.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System32\GIlIuML.exe
  C:\Windows\System32\GIlIuML.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System32\rSCFWvq.exe
  C:\Windows\System32\rSCFWvq.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System32\ymTfcOD.exe
  C:\Windows\System32\ymTfcOD.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System32\sHrAwIK.exe
  C:\Windows\System32\sHrAwIK.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System32\RzHebut.exe
  C:\Windows\System32\RzHebut.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System32\RHXmiNQ.exe
  C:\Windows\System32\RHXmiNQ.exe
  2⤵
  PID:1584
- C:\Windows\System32\XRJwyvg.exe
  C:\Windows\System32\XRJwyvg.exe
  2⤵
  PID:4860
- C:\Windows\System32\QjyYccS.exe
  C:\Windows\System32\QjyYccS.exe
  2⤵
  PID:2852
- C:\Windows\System32\MqttmVa.exe
  C:\Windows\System32\MqttmVa.exe
  2⤵
  PID:5148
- C:\Windows\System32\LQegHjV.exe
  C:\Windows\System32\LQegHjV.exe
  2⤵
  PID:5176
- C:\Windows\System32\uoVtqPP.exe
  C:\Windows\System32\uoVtqPP.exe
  2⤵
  PID:5204
- C:\Windows\System32\IEqgaCG.exe
  C:\Windows\System32\IEqgaCG.exe
  2⤵
  PID:5232
- C:\Windows\System32\YjedLTD.exe
  C:\Windows\System32\YjedLTD.exe
  2⤵
  PID:5260
- C:\Windows\System32\DXmKQqn.exe
  C:\Windows\System32\DXmKQqn.exe
  2⤵
  PID:5288
- C:\Windows\System32\bnZTvVP.exe
  C:\Windows\System32\bnZTvVP.exe
  2⤵
  PID:5316
- C:\Windows\System32\ydhFcxF.exe
  C:\Windows\System32\ydhFcxF.exe
  2⤵
  PID:5344
- C:\Windows\System32\gGpxOlh.exe
  C:\Windows\System32\gGpxOlh.exe
  2⤵
  PID:5372
- C:\Windows\System32\GHLEHQD.exe
  C:\Windows\System32\GHLEHQD.exe
  2⤵
  PID:5400
- C:\Windows\System32\vDzMxnr.exe
  C:\Windows\System32\vDzMxnr.exe
  2⤵
  PID:5428
- C:\Windows\System32\ShVGNts.exe
  C:\Windows\System32\ShVGNts.exe
  2⤵
  PID:5456
- C:\Windows\System32\QdzwVAp.exe
  C:\Windows\System32\QdzwVAp.exe
  2⤵
  PID:5484
- C:\Windows\System32\agbiRfk.exe
  C:\Windows\System32\agbiRfk.exe
  2⤵
  PID:5512
- C:\Windows\System32\bmBmNeB.exe
  C:\Windows\System32\bmBmNeB.exe
  2⤵
  PID:5540
- C:\Windows\System32\OpYegbL.exe
  C:\Windows\System32\OpYegbL.exe
  2⤵
  PID:5568
- C:\Windows\System32\sLeSZik.exe
  C:\Windows\System32\sLeSZik.exe
  2⤵
  PID:5596
- C:\Windows\System32\OPHyGqv.exe
  C:\Windows\System32\OPHyGqv.exe
  2⤵
  PID:5624
- C:\Windows\System32\FkNpLWB.exe
  C:\Windows\System32\FkNpLWB.exe
  2⤵
  PID:5652
- C:\Windows\System32\RxOIwyH.exe
  C:\Windows\System32\RxOIwyH.exe
  2⤵
  PID:5680
- C:\Windows\System32\nFwETgN.exe
  C:\Windows\System32\nFwETgN.exe
  2⤵
  PID:5708
- C:\Windows\System32\XFrdGEk.exe
  C:\Windows\System32\XFrdGEk.exe
  2⤵
  PID:5736
- C:\Windows\System32\bnoNonl.exe
  C:\Windows\System32\bnoNonl.exe
  2⤵
  PID:5764
- C:\Windows\System32\gCRXGId.exe
  C:\Windows\System32\gCRXGId.exe
  2⤵
  PID:5792
- C:\Windows\System32\eiSZqRg.exe
  C:\Windows\System32\eiSZqRg.exe
  2⤵
  PID:5820
- C:\Windows\System32\lRFeRWa.exe
  C:\Windows\System32\lRFeRWa.exe
  2⤵
  PID:5848
- C:\Windows\System32\zKPRAmQ.exe
  C:\Windows\System32\zKPRAmQ.exe
  2⤵
  PID:5876
- C:\Windows\System32\pFCeKpS.exe
  C:\Windows\System32\pFCeKpS.exe
  2⤵
  PID:5904
- C:\Windows\System32\gUiktTj.exe
  C:\Windows\System32\gUiktTj.exe
  2⤵
  PID:5932
- C:\Windows\System32\xwYPsCL.exe
  C:\Windows\System32\xwYPsCL.exe
  2⤵
  PID:5960
- C:\Windows\System32\LTDLvJz.exe
  C:\Windows\System32\LTDLvJz.exe
  2⤵
  PID:5988
- C:\Windows\System32\wgzLLun.exe
  C:\Windows\System32\wgzLLun.exe
  2⤵
  PID:6016
- C:\Windows\System32\QiXWQLX.exe
  C:\Windows\System32\QiXWQLX.exe
  2⤵
  PID:6044
- C:\Windows\System32\cBNusCb.exe
  C:\Windows\System32\cBNusCb.exe
  2⤵
  PID:6072
- C:\Windows\System32\JiJaxAT.exe
  C:\Windows\System32\JiJaxAT.exe
  2⤵
  PID:6100
- C:\Windows\System32\OrQAqIY.exe
  C:\Windows\System32\OrQAqIY.exe
  2⤵
  PID:6128
- C:\Windows\System32\ReJDrXw.exe
  C:\Windows\System32\ReJDrXw.exe
  2⤵
  PID:1152
- C:\Windows\System32\IKeNtyf.exe
  C:\Windows\System32\IKeNtyf.exe
  2⤵
  PID:804
- C:\Windows\System32\PTnfPsY.exe
  C:\Windows\System32\PTnfPsY.exe
  2⤵
  PID:4908
- C:\Windows\System32\ueqRkVx.exe
  C:\Windows\System32\ueqRkVx.exe
  2⤵
  PID:2344
- C:\Windows\System32\rfgcAfJ.exe
  C:\Windows\System32\rfgcAfJ.exe
  2⤵
  PID:5132
- C:\Windows\System32\GtpYTJD.exe
  C:\Windows\System32\GtpYTJD.exe
  2⤵
  PID:5188
- C:\Windows\System32\PvtkXEH.exe
  C:\Windows\System32\PvtkXEH.exe
  2⤵
  PID:5280
- C:\Windows\System32\MmghWbJ.exe
  C:\Windows\System32\MmghWbJ.exe
  2⤵
  PID:5328
- C:\Windows\System32\GQOBSSo.exe
  C:\Windows\System32\GQOBSSo.exe
  2⤵
  PID:5392
- C:\Windows\System32\xaLDisf.exe
  C:\Windows\System32\xaLDisf.exe
  2⤵
  PID:5504
- C:\Windows\System32\xIbCpDS.exe
  C:\Windows\System32\xIbCpDS.exe
  2⤵
  PID:5532
- C:\Windows\System32\CfLardV.exe
  C:\Windows\System32\CfLardV.exe
  2⤵
  PID:5576
- C:\Windows\System32\cGnRDNe.exe
  C:\Windows\System32\cGnRDNe.exe
  2⤵
  PID:5672
- C:\Windows\System32\NGeKYQl.exe
  C:\Windows\System32\NGeKYQl.exe
  2⤵
  PID:5720
- C:\Windows\System32\PwfTVHg.exe
  C:\Windows\System32\PwfTVHg.exe
  2⤵
  PID:5784
- C:\Windows\System32\qZLiyLR.exe
  C:\Windows\System32\qZLiyLR.exe
  2⤵
  PID:5856
- C:\Windows\System32\zPeAZWz.exe
  C:\Windows\System32\zPeAZWz.exe
  2⤵
  PID:5916
- C:\Windows\System32\qDscpcx.exe
  C:\Windows\System32\qDscpcx.exe
  2⤵
  PID:5968
- C:\Windows\System32\vIJnJMZ.exe
  C:\Windows\System32\vIJnJMZ.exe
  2⤵
  PID:6064
- C:\Windows\System32\WMEohDh.exe
  C:\Windows\System32\WMEohDh.exe
  2⤵
  PID:6112
- C:\Windows\System32\axldJPn.exe
  C:\Windows\System32\axldJPn.exe
  2⤵
  PID:4980
- C:\Windows\System32\LfarbBc.exe
  C:\Windows\System32\LfarbBc.exe
  2⤵
  PID:2520
- C:\Windows\System32\imPExuM.exe
  C:\Windows\System32\imPExuM.exe
  2⤵
  PID:5216
- C:\Windows\System32\WnHBpof.exe
  C:\Windows\System32\WnHBpof.exe
  2⤵
  PID:5380
- C:\Windows\System32\stlzPNa.exe
  C:\Windows\System32\stlzPNa.exe
  2⤵
  PID:5588
- C:\Windows\System32\wowqpUi.exe
  C:\Windows\System32\wowqpUi.exe
  2⤵
  PID:5688
- C:\Windows\System32\CyeUeau.exe
  C:\Windows\System32\CyeUeau.exe
  2⤵
  PID:5800
- C:\Windows\System32\zKxvfqe.exe
  C:\Windows\System32\zKxvfqe.exe
  2⤵
  PID:6028
- C:\Windows\System32\wzPWhOk.exe
  C:\Windows\System32\wzPWhOk.exe
  2⤵
  PID:6140
- C:\Windows\System32\GShCRBL.exe
  C:\Windows\System32\GShCRBL.exe
  2⤵
  PID:6172
- C:\Windows\System32\XtrAeLv.exe
  C:\Windows\System32\XtrAeLv.exe
  2⤵
  PID:6196
- C:\Windows\System32\nykYPmN.exe
  C:\Windows\System32\nykYPmN.exe
  2⤵
  PID:6232
- C:\Windows\System32\yrWeeXn.exe
  C:\Windows\System32\yrWeeXn.exe
  2⤵
  PID:6260
- C:\Windows\System32\mThyWrk.exe
  C:\Windows\System32\mThyWrk.exe
  2⤵
  PID:6288
- C:\Windows\System32\SWUXpot.exe
  C:\Windows\System32\SWUXpot.exe
  2⤵
  PID:6316
- C:\Windows\System32\vTTueCU.exe
  C:\Windows\System32\vTTueCU.exe
  2⤵
  PID:6340
- C:\Windows\System32\QonwYxl.exe
  C:\Windows\System32\QonwYxl.exe
  2⤵
  PID:6372
- C:\Windows\System32\zTbOXDH.exe
  C:\Windows\System32\zTbOXDH.exe
  2⤵
  PID:6408
- C:\Windows\System32\cwVjIEh.exe
  C:\Windows\System32\cwVjIEh.exe
  2⤵
  PID:6428
- C:\Windows\System32\ftOgAJN.exe
  C:\Windows\System32\ftOgAJN.exe
  2⤵
  PID:6456
- C:\Windows\System32\nuHyMnr.exe
  C:\Windows\System32\nuHyMnr.exe
  2⤵
  PID:6484
- C:\Windows\System32\CSfwqtg.exe
  C:\Windows\System32\CSfwqtg.exe
  2⤵
  PID:6512
- C:\Windows\System32\BxbSHwg.exe
  C:\Windows\System32\BxbSHwg.exe
  2⤵
  PID:6540
- C:\Windows\System32\OArTUrV.exe
  C:\Windows\System32\OArTUrV.exe
  2⤵
  PID:6568
- C:\Windows\System32\DHxwRzm.exe
  C:\Windows\System32\DHxwRzm.exe
  2⤵
  PID:6592
- C:\Windows\System32\vKfaJOA.exe
  C:\Windows\System32\vKfaJOA.exe
  2⤵
  PID:6624
- C:\Windows\System32\XjiUDYu.exe
  C:\Windows\System32\XjiUDYu.exe
  2⤵
  PID:6664
- C:\Windows\System32\VmAgpet.exe
  C:\Windows\System32\VmAgpet.exe
  2⤵
  PID:6680
- C:\Windows\System32\AKlFwmB.exe
  C:\Windows\System32\AKlFwmB.exe
  2⤵
  PID:6708
- C:\Windows\System32\YhNIUpP.exe
  C:\Windows\System32\YhNIUpP.exe
  2⤵
  PID:6736
- C:\Windows\System32\tRiGdGI.exe
  C:\Windows\System32\tRiGdGI.exe
  2⤵
  PID:6764
- C:\Windows\System32\unNoXkR.exe
  C:\Windows\System32\unNoXkR.exe
  2⤵
  PID:6792
- C:\Windows\System32\faIlEYD.exe
  C:\Windows\System32\faIlEYD.exe
  2⤵
  PID:6816
- C:\Windows\System32\dPmonne.exe
  C:\Windows\System32\dPmonne.exe
  2⤵
  PID:6848
- C:\Windows\System32\BFJUveM.exe
  C:\Windows\System32\BFJUveM.exe
  2⤵
  PID:6876
- C:\Windows\System32\TiPnDHA.exe
  C:\Windows\System32\TiPnDHA.exe
  2⤵
  PID:6904
- C:\Windows\System32\NaDIhQb.exe
  C:\Windows\System32\NaDIhQb.exe
  2⤵
  PID:6932
- C:\Windows\System32\fytSXcO.exe
  C:\Windows\System32\fytSXcO.exe
  2⤵
  PID:6960
- C:\Windows\System32\nHVYRwk.exe
  C:\Windows\System32\nHVYRwk.exe
  2⤵
  PID:6988
- C:\Windows\System32\fNQysMs.exe
  C:\Windows\System32\fNQysMs.exe
  2⤵
  PID:7016
- C:\Windows\System32\gAtooeO.exe
  C:\Windows\System32\gAtooeO.exe
  2⤵
  PID:7044
- C:\Windows\System32\tLHjamd.exe
  C:\Windows\System32\tLHjamd.exe
  2⤵
  PID:7072
- C:\Windows\System32\FlrhSHX.exe
  C:\Windows\System32\FlrhSHX.exe
  2⤵
  PID:7100
- C:\Windows\System32\bpNdZgi.exe
  C:\Windows\System32\bpNdZgi.exe
  2⤵
  PID:7128
- C:\Windows\System32\rkWtkin.exe
  C:\Windows\System32\rkWtkin.exe
  2⤵
  PID:7156
- C:\Windows\System32\NSGWdHP.exe
  C:\Windows\System32\NSGWdHP.exe
  2⤵
  PID:3868
- C:\Windows\System32\oitmNUa.exe
  C:\Windows\System32\oitmNUa.exe
  2⤵
  PID:5408
- C:\Windows\System32\eFngdjU.exe
  C:\Windows\System32\eFngdjU.exe
  2⤵
  PID:5748
- C:\Windows\System32\ocQhFnE.exe
  C:\Windows\System32\ocQhFnE.exe
  2⤵
  PID:6052
- C:\Windows\System32\vXSDcvF.exe
  C:\Windows\System32\vXSDcvF.exe
  2⤵
  PID:6204
- C:\Windows\System32\hSVYApc.exe
  C:\Windows\System32\hSVYApc.exe
  2⤵
  PID:6296
- C:\Windows\System32\xTNLBuX.exe
  C:\Windows\System32\xTNLBuX.exe
  2⤵
  PID:6336
- C:\Windows\System32\ryWxBbO.exe
  C:\Windows\System32\ryWxBbO.exe
  2⤵
  PID:6404
- C:\Windows\System32\JmjlYkU.exe
  C:\Windows\System32\JmjlYkU.exe
  2⤵
  PID:6492
- C:\Windows\System32\cRWqIwD.exe
  C:\Windows\System32\cRWqIwD.exe
  2⤵
  PID:6524
- C:\Windows\System32\WdbPkMt.exe
  C:\Windows\System32\WdbPkMt.exe
  2⤵
  PID:6580
- C:\Windows\System32\PjKrYYl.exe
  C:\Windows\System32\PjKrYYl.exe
  2⤵
  PID:6656
- C:\Windows\System32\lJhJYeG.exe
  C:\Windows\System32\lJhJYeG.exe
  2⤵
  PID:3848
- C:\Windows\System32\tltpVQa.exe
  C:\Windows\System32\tltpVQa.exe
  2⤵
  PID:6772
- C:\Windows\System32\FZwEiiz.exe
  C:\Windows\System32\FZwEiiz.exe
  2⤵
  PID:6832
- C:\Windows\System32\kPVxgEO.exe
  C:\Windows\System32\kPVxgEO.exe
  2⤵
  PID:6896
- C:\Windows\System32\tmAmtlw.exe
  C:\Windows\System32\tmAmtlw.exe
  2⤵
  PID:6968
- C:\Windows\System32\FLGfNAl.exe
  C:\Windows\System32\FLGfNAl.exe
  2⤵
  PID:7036
- C:\Windows\System32\mdLsGMJ.exe
  C:\Windows\System32\mdLsGMJ.exe
  2⤵
  PID:4948
- C:\Windows\System32\BpmSmCV.exe
  C:\Windows\System32\BpmSmCV.exe
  2⤵
  PID:7120
- C:\Windows\System32\fPVeCaC.exe
  C:\Windows\System32\fPVeCaC.exe
  2⤵
  PID:5168
- C:\Windows\System32\qIstPKX.exe
  C:\Windows\System32\qIstPKX.exe
  2⤵
  PID:5888
- C:\Windows\System32\XmwWvAK.exe
  C:\Windows\System32\XmwWvAK.exe
  2⤵
  PID:6240
- C:\Windows\System32\kkturPj.exe
  C:\Windows\System32\kkturPj.exe
  2⤵
  PID:6384
- C:\Windows\System32\yAFZUAT.exe
  C:\Windows\System32\yAFZUAT.exe
  2⤵
  PID:6560
- C:\Windows\System32\aogSMLJ.exe
  C:\Windows\System32\aogSMLJ.exe
  2⤵
  PID:6676
- C:\Windows\System32\OdTUOEG.exe
  C:\Windows\System32\OdTUOEG.exe
  2⤵
  PID:6784
- C:\Windows\System32\vuQrZvl.exe
  C:\Windows\System32\vuQrZvl.exe
  2⤵
  PID:6980
- C:\Windows\System32\yAiarGF.exe
  C:\Windows\System32\yAiarGF.exe
  2⤵
  PID:7084
- C:\Windows\System32\PeBgEjB.exe
  C:\Windows\System32\PeBgEjB.exe
  2⤵
  PID:5520
- C:\Windows\System32\druspDD.exe
  C:\Windows\System32\druspDD.exe
  2⤵
  PID:6356
- C:\Windows\System32\lkUVZpH.exe
  C:\Windows\System32\lkUVZpH.exe
  2⤵
  PID:7192
- C:\Windows\System32\ojLlhhr.exe
  C:\Windows\System32\ojLlhhr.exe
  2⤵
  PID:7236
- C:\Windows\System32\hhJRXug.exe
  C:\Windows\System32\hhJRXug.exe
  2⤵
  PID:7252
- C:\Windows\System32\uWnwYZP.exe
  C:\Windows\System32\uWnwYZP.exe
  2⤵
  PID:7280
- C:\Windows\System32\jspvvKf.exe
  C:\Windows\System32\jspvvKf.exe
  2⤵
  PID:7308
- C:\Windows\System32\tMhvyUz.exe
  C:\Windows\System32\tMhvyUz.exe
  2⤵
  PID:7336
- C:\Windows\System32\XjwxgNU.exe
  C:\Windows\System32\XjwxgNU.exe
  2⤵
  PID:7364
- C:\Windows\System32\jfYNHOP.exe
  C:\Windows\System32\jfYNHOP.exe
  2⤵
  PID:7392
- C:\Windows\System32\nQJdvFM.exe
  C:\Windows\System32\nQJdvFM.exe
  2⤵
  PID:7420
- C:\Windows\System32\Bcvehfy.exe
  C:\Windows\System32\Bcvehfy.exe
  2⤵
  PID:7448
- C:\Windows\System32\khIDLQr.exe
  C:\Windows\System32\khIDLQr.exe
  2⤵
  PID:7476
- C:\Windows\System32\PwJxLVr.exe
  C:\Windows\System32\PwJxLVr.exe
  2⤵
  PID:7504
- C:\Windows\System32\dmLiTkq.exe
  C:\Windows\System32\dmLiTkq.exe
  2⤵
  PID:7532
- C:\Windows\System32\iWYMIIJ.exe
  C:\Windows\System32\iWYMIIJ.exe
  2⤵
  PID:7560
- C:\Windows\System32\IZvCMnZ.exe
  C:\Windows\System32\IZvCMnZ.exe
  2⤵
  PID:7588
- C:\Windows\System32\RmifDaS.exe
  C:\Windows\System32\RmifDaS.exe
  2⤵
  PID:7616
- C:\Windows\System32\nxpEgvV.exe
  C:\Windows\System32\nxpEgvV.exe
  2⤵
  PID:7652
- C:\Windows\System32\IzUwsSE.exe
  C:\Windows\System32\IzUwsSE.exe
  2⤵
  PID:7672
- C:\Windows\System32\hMSUprY.exe
  C:\Windows\System32\hMSUprY.exe
  2⤵
  PID:7700
- C:\Windows\System32\RtQfGbN.exe
  C:\Windows\System32\RtQfGbN.exe
  2⤵
  PID:7728
- C:\Windows\System32\QlePznI.exe
  C:\Windows\System32\QlePznI.exe
  2⤵
  PID:7764
- C:\Windows\System32\aWSgATv.exe
  C:\Windows\System32\aWSgATv.exe
  2⤵
  PID:7784
- C:\Windows\System32\OfXCvOZ.exe
  C:\Windows\System32\OfXCvOZ.exe
  2⤵
  PID:7812
- C:\Windows\System32\zincuig.exe
  C:\Windows\System32\zincuig.exe
  2⤵
  PID:7840
- C:\Windows\System32\PheNxgE.exe
  C:\Windows\System32\PheNxgE.exe
  2⤵
  PID:7868
- C:\Windows\System32\ZDaFbGI.exe
  C:\Windows\System32\ZDaFbGI.exe
  2⤵
  PID:7896
- C:\Windows\System32\DuECRFV.exe
  C:\Windows\System32\DuECRFV.exe
  2⤵
  PID:7924
- C:\Windows\System32\svHYFZW.exe
  C:\Windows\System32\svHYFZW.exe
  2⤵
  PID:7952
- C:\Windows\System32\fBiJtlz.exe
  C:\Windows\System32\fBiJtlz.exe
  2⤵
  PID:8120
- C:\Windows\System32\AuvBkEj.exe
  C:\Windows\System32\AuvBkEj.exe
  2⤵
  PID:8140
- C:\Windows\System32\FrhIciy.exe
  C:\Windows\System32\FrhIciy.exe
  2⤵
  PID:8172
- C:\Windows\System32\yNFXmaP.exe
  C:\Windows\System32\yNFXmaP.exe
  2⤵
  PID:8188
- C:\Windows\System32\njRhggl.exe
  C:\Windows\System32\njRhggl.exe
  2⤵
  PID:6644
- C:\Windows\System32\thnXnhl.exe
  C:\Windows\System32\thnXnhl.exe
  2⤵
  PID:2296
- C:\Windows\System32\ZOSLubV.exe
  C:\Windows\System32\ZOSLubV.exe
  2⤵
  PID:6164
- C:\Windows\System32\rYKluzX.exe
  C:\Windows\System32\rYKluzX.exe
  2⤵
  PID:7228
- C:\Windows\System32\ZUwRGUC.exe
  C:\Windows\System32\ZUwRGUC.exe
  2⤵
  PID:7288
- C:\Windows\System32\RWdZpLY.exe
  C:\Windows\System32\RWdZpLY.exe
  2⤵
  PID:4508
- C:\Windows\System32\ahtdHLq.exe
  C:\Windows\System32\ahtdHLq.exe
  2⤵
  PID:7344
- C:\Windows\System32\EePwlBO.exe
  C:\Windows\System32\EePwlBO.exe
  2⤵
  PID:7400
- C:\Windows\System32\aEnHTOr.exe
  C:\Windows\System32\aEnHTOr.exe
  2⤵
  PID:7596
- C:\Windows\System32\TErLPdf.exe
  C:\Windows\System32\TErLPdf.exe
  2⤵
  PID:7660
- C:\Windows\System32\UzbcGEQ.exe
  C:\Windows\System32\UzbcGEQ.exe
  2⤵
  PID:7680
- C:\Windows\System32\UreuEiV.exe
  C:\Windows\System32\UreuEiV.exe
  2⤵
  PID:1248
- C:\Windows\System32\JQYhqLt.exe
  C:\Windows\System32\JQYhqLt.exe
  2⤵
  PID:7780
- C:\Windows\System32\ORViqFf.exe
  C:\Windows\System32\ORViqFf.exe
  2⤵
  PID:7796
- C:\Windows\System32\NQSDDJn.exe
  C:\Windows\System32\NQSDDJn.exe
  2⤵
  PID:7820
- C:\Windows\System32\ioUlTrC.exe
  C:\Windows\System32\ioUlTrC.exe
  2⤵
  PID:7852
- C:\Windows\System32\PcKtOUc.exe
  C:\Windows\System32\PcKtOUc.exe
  2⤵
  PID:1924
- C:\Windows\System32\XnZyfCF.exe
  C:\Windows\System32\XnZyfCF.exe
  2⤵
  PID:7936
- C:\Windows\System32\ryxkhDo.exe
  C:\Windows\System32\ryxkhDo.exe
  2⤵
  PID:900
- C:\Windows\System32\rDxVRoB.exe
  C:\Windows\System32\rDxVRoB.exe
  2⤵
  PID:2860
- C:\Windows\System32\kbWDwCU.exe
  C:\Windows\System32\kbWDwCU.exe
  2⤵
  PID:8060
- C:\Windows\System32\FIxuElo.exe
  C:\Windows\System32\FIxuElo.exe
  2⤵
  PID:8132
- C:\Windows\System32\ZxktSjI.exe
  C:\Windows\System32\ZxktSjI.exe
  2⤵
  PID:6860
- C:\Windows\System32\jvtPKlD.exe
  C:\Windows\System32\jvtPKlD.exe
  2⤵
  PID:8036
- C:\Windows\System32\gPqOqYE.exe
  C:\Windows\System32\gPqOqYE.exe
  2⤵
  PID:7272
- C:\Windows\System32\cPqLdlx.exe
  C:\Windows\System32\cPqLdlx.exe
  2⤵
  PID:7300
- C:\Windows\System32\PSFFCAE.exe
  C:\Windows\System32\PSFFCAE.exe
  2⤵
  PID:4236
- C:\Windows\System32\btoCMQK.exe
  C:\Windows\System32\btoCMQK.exe
  2⤵
  PID:7512
- C:\Windows\System32\awekWdP.exe
  C:\Windows\System32\awekWdP.exe
  2⤵
  PID:1660
- C:\Windows\System32\fkhrEmX.exe
  C:\Windows\System32\fkhrEmX.exe
  2⤵
  PID:1104
- C:\Windows\System32\TtLHTBJ.exe
  C:\Windows\System32\TtLHTBJ.exe
  2⤵
  PID:7432
- C:\Windows\System32\aSZDgtr.exe
  C:\Windows\System32\aSZDgtr.exe
  2⤵
  PID:552
- C:\Windows\System32\pFQaGeQ.exe
  C:\Windows\System32\pFQaGeQ.exe
  2⤵
  PID:396
- C:\Windows\System32\WheAZMs.exe
  C:\Windows\System32\WheAZMs.exe
  2⤵
  PID:4932
- C:\Windows\System32\BRYJPKO.exe
  C:\Windows\System32\BRYJPKO.exe
  2⤵
  PID:8084
- C:\Windows\System32\pGpogqa.exe
  C:\Windows\System32\pGpogqa.exe
  2⤵
  PID:4000
- C:\Windows\System32\lYABvDr.exe
  C:\Windows\System32\lYABvDr.exe
  2⤵
  PID:5024
- C:\Windows\System32\kappQgf.exe
  C:\Windows\System32\kappQgf.exe
  2⤵
  PID:7496
- C:\Windows\System32\GQqLZTN.exe
  C:\Windows\System32\GQqLZTN.exe
  2⤵
  PID:4612
- C:\Windows\System32\XYiXvzX.exe
  C:\Windows\System32\XYiXvzX.exe
  2⤵
  PID:4484
- C:\Windows\System32\ICyJkmC.exe
  C:\Windows\System32\ICyJkmC.exe
  2⤵
  PID:4124
- C:\Windows\System32\HsLoBSW.exe
  C:\Windows\System32\HsLoBSW.exe
  2⤵
  PID:8052
- C:\Windows\System32\oxuVDnK.exe
  C:\Windows\System32\oxuVDnK.exe
  2⤵
  PID:7740
- C:\Windows\System32\hoJYZmt.exe
  C:\Windows\System32\hoJYZmt.exe
  2⤵
  PID:6856
- C:\Windows\System32\SMOEVWf.exe
  C:\Windows\System32\SMOEVWf.exe
  2⤵
  PID:460
- C:\Windows\System32\lyQcmdS.exe
  C:\Windows\System32\lyQcmdS.exe
  2⤵
  PID:8220
- C:\Windows\System32\gOAISeH.exe
  C:\Windows\System32\gOAISeH.exe
  2⤵
  PID:8248
- C:\Windows\System32\IotmSeE.exe
  C:\Windows\System32\IotmSeE.exe
  2⤵
  PID:8276
- C:\Windows\System32\WIDEgjG.exe
  C:\Windows\System32\WIDEgjG.exe
  2⤵
  PID:8292
- C:\Windows\System32\MLOWYDA.exe
  C:\Windows\System32\MLOWYDA.exe
  2⤵
  PID:8332
- C:\Windows\System32\iTfxkDn.exe
  C:\Windows\System32\iTfxkDn.exe
  2⤵
  PID:8352
- C:\Windows\System32\dggrxkd.exe
  C:\Windows\System32\dggrxkd.exe
  2⤵
  PID:8380
- C:\Windows\System32\kzVCAHG.exe
  C:\Windows\System32\kzVCAHG.exe
  2⤵
  PID:8408
- C:\Windows\System32\BOMlYWX.exe
  C:\Windows\System32\BOMlYWX.exe
  2⤵
  PID:8444
- C:\Windows\System32\XzqARYh.exe
  C:\Windows\System32\XzqARYh.exe
  2⤵
  PID:8460
- C:\Windows\System32\TBgktWi.exe
  C:\Windows\System32\TBgktWi.exe
  2⤵
  PID:8496
- C:\Windows\System32\HVWsfGx.exe
  C:\Windows\System32\HVWsfGx.exe
  2⤵
  PID:8528
- C:\Windows\System32\eDUfJBn.exe
  C:\Windows\System32\eDUfJBn.exe
  2⤵
  PID:8544
- C:\Windows\System32\VzCjkcG.exe
  C:\Windows\System32\VzCjkcG.exe
  2⤵
  PID:8592
- C:\Windows\System32\dRIKhlx.exe
  C:\Windows\System32\dRIKhlx.exe
  2⤵
  PID:8616
- C:\Windows\System32\ZIYleBn.exe
  C:\Windows\System32\ZIYleBn.exe
  2⤵
  PID:8648
- C:\Windows\System32\vJuVccZ.exe
  C:\Windows\System32\vJuVccZ.exe
  2⤵
  PID:8664
- C:\Windows\System32\YYXDfdX.exe
  C:\Windows\System32\YYXDfdX.exe
  2⤵
  PID:8716
- C:\Windows\System32\dHqIjMy.exe
  C:\Windows\System32\dHqIjMy.exe
  2⤵
  PID:8736
- C:\Windows\System32\AOGXfYE.exe
  C:\Windows\System32\AOGXfYE.exe
  2⤵
  PID:8756
- C:\Windows\System32\ESXcaIt.exe
  C:\Windows\System32\ESXcaIt.exe
  2⤵
  PID:8784
- C:\Windows\System32\ZCAKmUM.exe
  C:\Windows\System32\ZCAKmUM.exe
  2⤵
  PID:8808
- C:\Windows\System32\VkTYeur.exe
  C:\Windows\System32\VkTYeur.exe
  2⤵
  PID:8840
- C:\Windows\System32\YLQSJiJ.exe
  C:\Windows\System32\YLQSJiJ.exe
  2⤵
  PID:8864
- C:\Windows\System32\tmmQBnq.exe
  C:\Windows\System32\tmmQBnq.exe
  2⤵
  PID:8912
- C:\Windows\System32\ieqtLJC.exe
  C:\Windows\System32\ieqtLJC.exe
  2⤵
  PID:8984
- C:\Windows\System32\nptBCRb.exe
  C:\Windows\System32\nptBCRb.exe
  2⤵
  PID:9008
- C:\Windows\System32\xHGbwcV.exe
  C:\Windows\System32\xHGbwcV.exe
  2⤵
  PID:9044
- C:\Windows\System32\hSYAUOQ.exe
  C:\Windows\System32\hSYAUOQ.exe
  2⤵
  PID:9072
- C:\Windows\System32\RGzHnWR.exe
  C:\Windows\System32\RGzHnWR.exe
  2⤵
  PID:9100
- C:\Windows\System32\qxSOgCR.exe
  C:\Windows\System32\qxSOgCR.exe
  2⤵
  PID:9124
- C:\Windows\System32\NOvmFYY.exe
  C:\Windows\System32\NOvmFYY.exe
  2⤵
  PID:9148
- C:\Windows\System32\gaQJXcA.exe
  C:\Windows\System32\gaQJXcA.exe
  2⤵
  PID:9172
- C:\Windows\System32\xKjtFiR.exe
  C:\Windows\System32\xKjtFiR.exe
  2⤵
  PID:9192
- C:\Windows\System32\CdFipkM.exe
  C:\Windows\System32\CdFipkM.exe
  2⤵
  PID:8212
- C:\Windows\System32\nOotDbL.exe
  C:\Windows\System32\nOotDbL.exe
  2⤵
  PID:8288
- C:\Windows\System32\DTBfWwj.exe
  C:\Windows\System32\DTBfWwj.exe
  2⤵
  PID:8312
- C:\Windows\System32\CFivgUQ.exe
  C:\Windows\System32\CFivgUQ.exe
  2⤵
  PID:8404
- C:\Windows\System32\CCRlkfu.exe
  C:\Windows\System32\CCRlkfu.exe
  2⤵
  PID:8508
- C:\Windows\System32\hsGXHXW.exe
  C:\Windows\System32\hsGXHXW.exe
  2⤵
  PID:8584
- C:\Windows\System32\MqsxSHv.exe
  C:\Windows\System32\MqsxSHv.exe
  2⤵
  PID:8656
- C:\Windows\System32\DppJycD.exe
  C:\Windows\System32\DppJycD.exe
  2⤵
  PID:8696
- C:\Windows\System32\DTtjfTi.exe
  C:\Windows\System32\DTtjfTi.exe
  2⤵
  PID:8776
- C:\Windows\System32\KPqYIAU.exe
  C:\Windows\System32\KPqYIAU.exe
  2⤵
  PID:8800
- C:\Windows\System32\UsAlvmu.exe
  C:\Windows\System32\UsAlvmu.exe
  2⤵
  PID:8920
- C:\Windows\System32\FtgKXmr.exe
  C:\Windows\System32\FtgKXmr.exe
  2⤵
  PID:8996
- C:\Windows\System32\NuqqCrC.exe
  C:\Windows\System32\NuqqCrC.exe
  2⤵
  PID:9096
- C:\Windows\System32\sRQspnP.exe
  C:\Windows\System32\sRQspnP.exe
  2⤵
  PID:2036
- C:\Windows\System32\JreKQsx.exe
  C:\Windows\System32\JreKQsx.exe
  2⤵
  PID:8268
- C:\Windows\System32\RHClyCv.exe
  C:\Windows\System32\RHClyCv.exe
  2⤵
  PID:8324
- C:\Windows\System32\iADGADN.exe
  C:\Windows\System32\iADGADN.exe
  2⤵
  PID:8640
- C:\Windows\System32\GTLQHOR.exe
  C:\Windows\System32\GTLQHOR.exe
  2⤵
  PID:8748
- C:\Windows\System32\nBUeyLf.exe
  C:\Windows\System32\nBUeyLf.exe
  2⤵
  PID:9132
- C:\Windows\System32\veZOTBp.exe
  C:\Windows\System32\veZOTBp.exe
  2⤵
  PID:8576
- C:\Windows\System32\OiNOnPZ.exe
  C:\Windows\System32\OiNOnPZ.exe
  2⤵
  PID:9032
- C:\Windows\System32\ixuTwpS.exe
  C:\Windows\System32\ixuTwpS.exe
  2⤵
  PID:8260
- C:\Windows\System32\YYcNKrU.exe
  C:\Windows\System32\YYcNKrU.exe
  2⤵
  PID:8820
- C:\Windows\System32\nhRJUWN.exe
  C:\Windows\System32\nhRJUWN.exe
  2⤵
  PID:8580
- C:\Windows\System32\tQYAZFe.exe
  C:\Windows\System32\tQYAZFe.exe
  2⤵
  PID:8604
- C:\Windows\System32\OJIMVFg.exe
  C:\Windows\System32\OJIMVFg.exe
  2⤵
  PID:9224
- C:\Windows\System32\cfwlapp.exe
  C:\Windows\System32\cfwlapp.exe
  2⤵
  PID:9240
- C:\Windows\System32\KmSeFwR.exe
  C:\Windows\System32\KmSeFwR.exe
  2⤵
  PID:9276
- C:\Windows\System32\sxGBqpn.exe
  C:\Windows\System32\sxGBqpn.exe
  2⤵
  PID:9300
- C:\Windows\System32\fIIFJML.exe
  C:\Windows\System32\fIIFJML.exe
  2⤵
  PID:9340
- C:\Windows\System32\GbSdSFb.exe
  C:\Windows\System32\GbSdSFb.exe
  2⤵
  PID:9364
- C:\Windows\System32\cpSlRWK.exe
  C:\Windows\System32\cpSlRWK.exe
  2⤵
  PID:9380
- C:\Windows\System32\CoXRuIV.exe
  C:\Windows\System32\CoXRuIV.exe
  2⤵
  PID:9416
- C:\Windows\System32\noPFypT.exe
  C:\Windows\System32\noPFypT.exe
  2⤵
  PID:9448
- C:\Windows\System32\KnptFeK.exe
  C:\Windows\System32\KnptFeK.exe
  2⤵
  PID:9472
- C:\Windows\System32\srjCLSr.exe
  C:\Windows\System32\srjCLSr.exe
  2⤵
  PID:9500
- C:\Windows\System32\qDzZUAW.exe
  C:\Windows\System32\qDzZUAW.exe
  2⤵
  PID:9528
- C:\Windows\System32\vfXAVsf.exe
  C:\Windows\System32\vfXAVsf.exe
  2⤵
  PID:9560
- C:\Windows\System32\QObgPHT.exe
  C:\Windows\System32\QObgPHT.exe
  2⤵
  PID:9576
- C:\Windows\System32\mKkOvNA.exe
  C:\Windows\System32\mKkOvNA.exe
  2⤵
  PID:9616
- C:\Windows\System32\iylIWWW.exe
  C:\Windows\System32\iylIWWW.exe
  2⤵
  PID:9644
- C:\Windows\System32\nJBlZvu.exe
  C:\Windows\System32\nJBlZvu.exe
  2⤵
  PID:9664
- C:\Windows\System32\uNBBzRN.exe
  C:\Windows\System32\uNBBzRN.exe
  2⤵
  PID:9688
- C:\Windows\System32\UASMfGz.exe
  C:\Windows\System32\UASMfGz.exe
  2⤵
  PID:9744
- C:\Windows\System32\TQMbEzz.exe
  C:\Windows\System32\TQMbEzz.exe
  2⤵
  PID:9760
- C:\Windows\System32\SmVJNCg.exe
  C:\Windows\System32\SmVJNCg.exe
  2⤵
  PID:9788
- C:\Windows\System32\UZmHcIQ.exe
  C:\Windows\System32\UZmHcIQ.exe
  2⤵
  PID:9804
- C:\Windows\System32\yXqZUFi.exe
  C:\Windows\System32\yXqZUFi.exe
  2⤵
  PID:9844
- C:\Windows\System32\aZagauP.exe
  C:\Windows\System32\aZagauP.exe
  2⤵
  PID:9868
- C:\Windows\System32\lyGGNDn.exe
  C:\Windows\System32\lyGGNDn.exe
  2⤵
  PID:9900
- C:\Windows\System32\yWosVLL.exe
  C:\Windows\System32\yWosVLL.exe
  2⤵
  PID:9932
- C:\Windows\System32\NHYmNhD.exe
  C:\Windows\System32\NHYmNhD.exe
  2⤵
  PID:9960
- C:\Windows\System32\JwGRxYG.exe
  C:\Windows\System32\JwGRxYG.exe
  2⤵
  PID:9984
- C:\Windows\System32\zAtWZce.exe
  C:\Windows\System32\zAtWZce.exe
  2⤵
  PID:10020
- C:\Windows\System32\uCSMTpk.exe
  C:\Windows\System32\uCSMTpk.exe
  2⤵
  PID:10052
- C:\Windows\System32\RBHsEAt.exe
  C:\Windows\System32\RBHsEAt.exe
  2⤵
  PID:10076
- C:\Windows\System32\tOruspn.exe
  C:\Windows\System32\tOruspn.exe
  2⤵
  PID:10100
- C:\Windows\System32\OKUIIwH.exe
  C:\Windows\System32\OKUIIwH.exe
  2⤵
  PID:10124
- C:\Windows\System32\uuklVks.exe
  C:\Windows\System32\uuklVks.exe
  2⤵
  PID:10148
- C:\Windows\System32\ndcgLvS.exe
  C:\Windows\System32\ndcgLvS.exe
  2⤵
  PID:10168
- C:\Windows\System32\usZwuhd.exe
  C:\Windows\System32\usZwuhd.exe
  2⤵
  PID:10228
- C:\Windows\System32\hcKjtUp.exe
  C:\Windows\System32\hcKjtUp.exe
  2⤵
  PID:9084
- C:\Windows\System32\LrltcBe.exe
  C:\Windows\System32\LrltcBe.exe
  2⤵
  PID:9260
- C:\Windows\System32\sfAuhda.exe
  C:\Windows\System32\sfAuhda.exe
  2⤵
  PID:9348
- C:\Windows\System32\WJNXbBv.exe
  C:\Windows\System32\WJNXbBv.exe
  2⤵
  PID:9408
- C:\Windows\System32\QUBwjsi.exe
  C:\Windows\System32\QUBwjsi.exe
  2⤵
  PID:9428
- C:\Windows\System32\XyeXebQ.exe
  C:\Windows\System32\XyeXebQ.exe
  2⤵
  PID:9512
- C:\Windows\System32\rplPWkw.exe
  C:\Windows\System32\rplPWkw.exe
  2⤵
  PID:9568
- C:\Windows\System32\dajCVQW.exe
  C:\Windows\System32\dajCVQW.exe
  2⤵
  PID:9636
- C:\Windows\System32\mEvzXcO.exe
  C:\Windows\System32\mEvzXcO.exe
  2⤵
  PID:9712
- C:\Windows\System32\glBJWwV.exe
  C:\Windows\System32\glBJWwV.exe
  2⤵
  PID:9800
- C:\Windows\System32\UHlEzHc.exe
  C:\Windows\System32\UHlEzHc.exe
  2⤵
  PID:9888
- C:\Windows\System32\yGWSgKj.exe
  C:\Windows\System32\yGWSgKj.exe
  2⤵
  PID:9948
- C:\Windows\System32\BHobliC.exe
  C:\Windows\System32\BHobliC.exe
  2⤵
  PID:10028
- C:\Windows\System32\ovJvhol.exe
  C:\Windows\System32\ovJvhol.exe
  2⤵
  PID:10096
- C:\Windows\System32\YplRrUq.exe
  C:\Windows\System32\YplRrUq.exe
  2⤵
  PID:10184
- C:\Windows\System32\sDSTGoi.exe
  C:\Windows\System32\sDSTGoi.exe
  2⤵
  PID:10236
- C:\Windows\System32\oMpskuu.exe
  C:\Windows\System32\oMpskuu.exe
  2⤵
  PID:9324
- C:\Windows\System32\MYZCkRs.exe
  C:\Windows\System32\MYZCkRs.exe
  2⤵
  PID:9536
- C:\Windows\System32\LDQbfNb.exe
  C:\Windows\System32\LDQbfNb.exe
  2⤵
  PID:9632
- C:\Windows\System32\lBagRJd.exe
  C:\Windows\System32\lBagRJd.exe
  2⤵
  PID:9772
- C:\Windows\System32\ZpXgfox.exe
  C:\Windows\System32\ZpXgfox.exe
  2⤵
  PID:10008
- C:\Windows\System32\iEHZoiR.exe
  C:\Windows\System32\iEHZoiR.exe
  2⤵
  PID:10160
- C:\Windows\System32\SHhhtjc.exe
  C:\Windows\System32\SHhhtjc.exe
  2⤵
  PID:9556
- C:\Windows\System32\cyDhayd.exe
  C:\Windows\System32\cyDhayd.exe
  2⤵
  PID:9992
- C:\Windows\System32\DChdHvS.exe
  C:\Windows\System32\DChdHvS.exe
  2⤵
  PID:9652
- C:\Windows\System32\FigmuEs.exe
  C:\Windows\System32\FigmuEs.exe
  2⤵
  PID:9400
- C:\Windows\System32\gYDibhP.exe
  C:\Windows\System32\gYDibhP.exe
  2⤵
  PID:10272
- C:\Windows\System32\emSsbIX.exe
  C:\Windows\System32\emSsbIX.exe
  2⤵
  PID:10312
- C:\Windows\System32\RlZnJba.exe
  C:\Windows\System32\RlZnJba.exe
  2⤵
  PID:10364
- C:\Windows\System32\FMgiYxd.exe
  C:\Windows\System32\FMgiYxd.exe
  2⤵
  PID:10412
- C:\Windows\System32\ochMjAc.exe
  C:\Windows\System32\ochMjAc.exe
  2⤵
  PID:10444
- C:\Windows\System32\AjyoKnh.exe
  C:\Windows\System32\AjyoKnh.exe
  2⤵
  PID:10488
- C:\Windows\System32\ejDeCUR.exe
  C:\Windows\System32\ejDeCUR.exe
  2⤵
  PID:10520
- C:\Windows\System32\DtGIOnY.exe
  C:\Windows\System32\DtGIOnY.exe
  2⤵
  PID:10556
- C:\Windows\System32\unzGlHo.exe
  C:\Windows\System32\unzGlHo.exe
  2⤵
  PID:10584
- C:\Windows\System32\rzqLMdH.exe
  C:\Windows\System32\rzqLMdH.exe
  2⤵
  PID:10616
- C:\Windows\System32\QVFtcWc.exe
  C:\Windows\System32\QVFtcWc.exe
  2⤵
  PID:10644
- C:\Windows\System32\YFAnYEW.exe
  C:\Windows\System32\YFAnYEW.exe
  2⤵
  PID:10672
- C:\Windows\System32\bcNqQTf.exe
  C:\Windows\System32\bcNqQTf.exe
  2⤵
  PID:10700
- C:\Windows\System32\QHYJVDi.exe
  C:\Windows\System32\QHYJVDi.exe
  2⤵
  PID:10732
- C:\Windows\System32\huKlMWi.exe
  C:\Windows\System32\huKlMWi.exe
  2⤵
  PID:10776
- C:\Windows\System32\EPdllHk.exe
  C:\Windows\System32\EPdllHk.exe
  2⤵
  PID:10804
- C:\Windows\System32\ZMPTfIc.exe
  C:\Windows\System32\ZMPTfIc.exe
  2⤵
  PID:10832
- C:\Windows\System32\hqyjwfQ.exe
  C:\Windows\System32\hqyjwfQ.exe
  2⤵
  PID:10860
- C:\Windows\System32\VuGnFmv.exe
  C:\Windows\System32\VuGnFmv.exe
  2⤵
  PID:10888
- C:\Windows\System32\FGPTuJF.exe
  C:\Windows\System32\FGPTuJF.exe
  2⤵
  PID:10916
- C:\Windows\System32\riUIMbo.exe
  C:\Windows\System32\riUIMbo.exe
  2⤵
  PID:10960
- C:\Windows\System32\zIhpBMZ.exe
  C:\Windows\System32\zIhpBMZ.exe
  2⤵
  PID:10988
- C:\Windows\System32\OOzVtng.exe
  C:\Windows\System32\OOzVtng.exe
  2⤵
  PID:11016
- C:\Windows\System32\GWIqTqW.exe
  C:\Windows\System32\GWIqTqW.exe
  2⤵
  PID:11044
- C:\Windows\System32\kwQnlGw.exe
  C:\Windows\System32\kwQnlGw.exe
  2⤵
  PID:11072
- C:\Windows\System32\rJDNypz.exe
  C:\Windows\System32\rJDNypz.exe
  2⤵
  PID:11100
- C:\Windows\System32\UnTqPZR.exe
  C:\Windows\System32\UnTqPZR.exe
  2⤵
  PID:11128
- C:\Windows\System32\PVVMOIg.exe
  C:\Windows\System32\PVVMOIg.exe
  2⤵
  PID:11156
- C:\Windows\System32\WFDAPwe.exe
  C:\Windows\System32\WFDAPwe.exe
  2⤵
  PID:11184
- C:\Windows\System32\hJgrbwy.exe
  C:\Windows\System32\hJgrbwy.exe
  2⤵
  PID:11212
- C:\Windows\System32\lXOBOGG.exe
  C:\Windows\System32\lXOBOGG.exe
  2⤵
  PID:11256
- C:\Windows\System32\kfLqRlb.exe
  C:\Windows\System32\kfLqRlb.exe
  2⤵
  PID:10268
- C:\Windows\System32\EcnHuEi.exe
  C:\Windows\System32\EcnHuEi.exe
  2⤵
  PID:10392
- C:\Windows\System32\Wppvfqt.exe
  C:\Windows\System32\Wppvfqt.exe
  2⤵
  PID:10500
- C:\Windows\System32\sKneYIh.exe
  C:\Windows\System32\sKneYIh.exe
  2⤵
  PID:10576
- C:\Windows\System32\ucReQGF.exe
  C:\Windows\System32\ucReQGF.exe
  2⤵
  PID:10656
- C:\Windows\System32\mBQfSGL.exe
  C:\Windows\System32\mBQfSGL.exe
  2⤵
  PID:10724
- C:\Windows\System32\XguMYCC.exe
  C:\Windows\System32\XguMYCC.exe
  2⤵
  PID:10828
- C:\Windows\System32\NIhUbew.exe
  C:\Windows\System32\NIhUbew.exe
  2⤵
  PID:10908
- C:\Windows\System32\fJsCjFj.exe
  C:\Windows\System32\fJsCjFj.exe
  2⤵
  PID:10984
- C:\Windows\System32\SiCTaYl.exe
  C:\Windows\System32\SiCTaYl.exe
  2⤵
  PID:11068
- C:\Windows\System32\EcGrMsd.exe
  C:\Windows\System32\EcGrMsd.exe
  2⤵
  PID:11124
- C:\Windows\System32\znRUOhF.exe
  C:\Windows\System32\znRUOhF.exe
  2⤵
  PID:11196
- C:\Windows\System32\rTvnLyL.exe
  C:\Windows\System32\rTvnLyL.exe
  2⤵
  PID:11232
- C:\Windows\System32\ImuVrjs.exe
  C:\Windows\System32\ImuVrjs.exe
  2⤵
  PID:10428
- C:\Windows\System32\uOzgGcH.exe
  C:\Windows\System32\uOzgGcH.exe
  2⤵
  PID:10684
- C:\Windows\System32\yiwCwOo.exe
  C:\Windows\System32\yiwCwOo.exe
  2⤵
  PID:10816
- C:\Windows\System32\pckauXQ.exe
  C:\Windows\System32\pckauXQ.exe
  2⤵
  PID:10980
- C:\Windows\System32\wcKTdZL.exe
  C:\Windows\System32\wcKTdZL.exe
  2⤵
  PID:11152
- C:\Windows\System32\vnTqWpa.exe
  C:\Windows\System32\vnTqWpa.exe
  2⤵
  PID:10360
- C:\Windows\System32\hdwNFnb.exe
  C:\Windows\System32\hdwNFnb.exe
  2⤵
  PID:10772
- C:\Windows\System32\HizNNbW.exe
  C:\Windows\System32\HizNNbW.exe
  2⤵
  PID:11120
- C:\Windows\System32\lNwtecB.exe
  C:\Windows\System32\lNwtecB.exe
  2⤵
  PID:10956
- C:\Windows\System32\gBBSiAT.exe
  C:\Windows\System32\gBBSiAT.exe
  2⤵
  PID:10720
- C:\Windows\System32\YyHAtem.exe
  C:\Windows\System32\YyHAtem.exe
  2⤵
  PID:11292
- C:\Windows\System32\pVngOoa.exe
  C:\Windows\System32\pVngOoa.exe
  2⤵
  PID:11320
- C:\Windows\System32\YmfNmAB.exe
  C:\Windows\System32\YmfNmAB.exe
  2⤵
  PID:11348
- C:\Windows\System32\ckRWPlM.exe
  C:\Windows\System32\ckRWPlM.exe
  2⤵
  PID:11380
- C:\Windows\System32\YwuxiZy.exe
  C:\Windows\System32\YwuxiZy.exe
  2⤵
  PID:11408
- C:\Windows\System32\xCiCXrA.exe
  C:\Windows\System32\xCiCXrA.exe
  2⤵
  PID:11436
- C:\Windows\System32\yhnOfHb.exe
  C:\Windows\System32\yhnOfHb.exe
  2⤵
  PID:11464
- C:\Windows\System32\zsgeXLZ.exe
  C:\Windows\System32\zsgeXLZ.exe
  2⤵
  PID:11492
- C:\Windows\System32\yIveaOR.exe
  C:\Windows\System32\yIveaOR.exe
  2⤵
  PID:11524
- C:\Windows\System32\AKXJZkl.exe
  C:\Windows\System32\AKXJZkl.exe
  2⤵
  PID:11552
- C:\Windows\System32\kNavAdH.exe
  C:\Windows\System32\kNavAdH.exe
  2⤵
  PID:11580
- C:\Windows\System32\LHkVrny.exe
  C:\Windows\System32\LHkVrny.exe
  2⤵
  PID:11608
- C:\Windows\System32\aJHZojx.exe
  C:\Windows\System32\aJHZojx.exe
  2⤵
  PID:11636
- C:\Windows\System32\QcNmAeM.exe
  C:\Windows\System32\QcNmAeM.exe
  2⤵
  PID:11664
- C:\Windows\System32\MChTATv.exe
  C:\Windows\System32\MChTATv.exe
  2⤵
  PID:11692
- C:\Windows\System32\WlYYtIr.exe
  C:\Windows\System32\WlYYtIr.exe
  2⤵
  PID:11720
- C:\Windows\System32\tMmKUze.exe
  C:\Windows\System32\tMmKUze.exe
  2⤵
  PID:11744
- C:\Windows\System32\WXcEyYS.exe
  C:\Windows\System32\WXcEyYS.exe
  2⤵
  PID:11776
- C:\Windows\System32\YoxvTIA.exe
  C:\Windows\System32\YoxvTIA.exe
  2⤵
  PID:11804
- C:\Windows\System32\HBdlTIA.exe
  C:\Windows\System32\HBdlTIA.exe
  2⤵
  PID:11832
- C:\Windows\System32\TuxyMVB.exe
  C:\Windows\System32\TuxyMVB.exe
  2⤵
  PID:11860
- C:\Windows\System32\UVXswsU.exe
  C:\Windows\System32\UVXswsU.exe
  2⤵
  PID:11900
- C:\Windows\System32\bxCjdjX.exe
  C:\Windows\System32\bxCjdjX.exe
  2⤵
  PID:11916
- C:\Windows\System32\UnfXxQn.exe
  C:\Windows\System32\UnfXxQn.exe
  2⤵
  PID:11952
- C:\Windows\System32\nYhmYsQ.exe
  C:\Windows\System32\nYhmYsQ.exe
  2⤵
  PID:11972
- C:\Windows\System32\WkRIeeN.exe
  C:\Windows\System32\WkRIeeN.exe
  2⤵
  PID:12000
- C:\Windows\System32\yAOkwri.exe
  C:\Windows\System32\yAOkwri.exe
  2⤵
  PID:12028
- C:\Windows\System32\KwzCjYV.exe
  C:\Windows\System32\KwzCjYV.exe
  2⤵
  PID:12060
- C:\Windows\System32\vziTJYo.exe
  C:\Windows\System32\vziTJYo.exe
  2⤵
  PID:12088
- C:\Windows\System32\wuFcbOP.exe
  C:\Windows\System32\wuFcbOP.exe
  2⤵
  PID:12120
- C:\Windows\System32\IUIsVml.exe
  C:\Windows\System32\IUIsVml.exe
  2⤵
  PID:12148
- C:\Windows\System32\ggBtKbH.exe
  C:\Windows\System32\ggBtKbH.exe
  2⤵
  PID:12176
- C:\Windows\System32\uClxPph.exe
  C:\Windows\System32\uClxPph.exe
  2⤵
  PID:12204
- C:\Windows\System32\BHtrZXI.exe
  C:\Windows\System32\BHtrZXI.exe
  2⤵
  PID:12232
- C:\Windows\System32\QZrNUTv.exe
  C:\Windows\System32\QZrNUTv.exe
  2⤵
  PID:12264
- C:\Windows\System32\TfEwzlM.exe
  C:\Windows\System32\TfEwzlM.exe
  2⤵
  PID:11288
- C:\Windows\System32\kcDtHBg.exe
  C:\Windows\System32\kcDtHBg.exe
  2⤵
  PID:11360
- C:\Windows\System32\AqWDUMC.exe
  C:\Windows\System32\AqWDUMC.exe
  2⤵
  PID:11448
- C:\Windows\System32\InAvVlp.exe
  C:\Windows\System32\InAvVlp.exe
  2⤵
  PID:11488
- C:\Windows\System32\XHfHcLN.exe
  C:\Windows\System32\XHfHcLN.exe
  2⤵
  PID:11572
- C:\Windows\System32\eBOcYJc.exe
  C:\Windows\System32\eBOcYJc.exe
  2⤵
  PID:11648
- C:\Windows\System32\KRTCuZi.exe
  C:\Windows\System32\KRTCuZi.exe
  2⤵
  PID:11716
- C:\Windows\System32\JwEaNsx.exe
  C:\Windows\System32\JwEaNsx.exe
  2⤵
  PID:11772
- C:\Windows\System32\WTDzDDB.exe
  C:\Windows\System32\WTDzDDB.exe
  2⤵
  PID:11852
- C:\Windows\System32\fXhzGlM.exe
  C:\Windows\System32\fXhzGlM.exe
  2⤵
  PID:11912
- C:\Windows\System32\FSuyYJN.exe
  C:\Windows\System32\FSuyYJN.exe
  2⤵
  PID:11984
- C:\Windows\System32\GmqvNkM.exe
  C:\Windows\System32\GmqvNkM.exe
  2⤵
  PID:12052
- C:\Windows\System32\NRhZVSO.exe
  C:\Windows\System32\NRhZVSO.exe
  2⤵
  PID:12116
- C:\Windows\System32\rrgBVIJ.exe
  C:\Windows\System32\rrgBVIJ.exe
  2⤵
  PID:12172
- C:\Windows\System32\MHhRmzV.exe
  C:\Windows\System32\MHhRmzV.exe
  2⤵
  PID:12260
- C:\Windows\System32\rQcjkrG.exe
  C:\Windows\System32\rQcjkrG.exe
  2⤵
  PID:11392
- C:\Windows\System32\iZzDFnJ.exe
  C:\Windows\System32\iZzDFnJ.exe
  2⤵
  PID:11564
- C:\Windows\System32\SKKaErw.exe
  C:\Windows\System32\SKKaErw.exe
  2⤵
  PID:11728
- C:\Windows\System32\VDwqxuc.exe
  C:\Windows\System32\VDwqxuc.exe
  2⤵
  PID:11884
- C:\Windows\System32\XgFBPcw.exe
  C:\Windows\System32\XgFBPcw.exe
  2⤵
  PID:12040
- C:\Windows\System32\QLJYiff.exe
  C:\Windows\System32\QLJYiff.exe
  2⤵
  PID:12200
- C:\Windows\System32\drUtikN.exe
  C:\Windows\System32\drUtikN.exe
  2⤵
  PID:11516
- C:\Windows\System32\vEhtJRP.exe
  C:\Windows\System32\vEhtJRP.exe
  2⤵
  PID:11844
- C:\Windows\System32\srXaYhN.exe
  C:\Windows\System32\srXaYhN.exe
  2⤵
  PID:11280
- C:\Windows\System32\UrhxKwY.exe
  C:\Windows\System32\UrhxKwY.exe
  2⤵
  PID:11284
- C:\Windows\System32\TevPdyo.exe
  C:\Windows\System32\TevPdyo.exe
  2⤵
  PID:12300
- C:\Windows\System32\EChmLWN.exe
  C:\Windows\System32\EChmLWN.exe
  2⤵
  PID:12328
- C:\Windows\System32\GxVLIrp.exe
  C:\Windows\System32\GxVLIrp.exe
  2⤵
  PID:12356
- C:\Windows\System32\VMVXsLX.exe
  C:\Windows\System32\VMVXsLX.exe
  2⤵
  PID:12384
- C:\Windows\System32\XyJnHOB.exe
  C:\Windows\System32\XyJnHOB.exe
  2⤵
  PID:12412
- C:\Windows\System32\vGuQviJ.exe
  C:\Windows\System32\vGuQviJ.exe
  2⤵
  PID:12440
- C:\Windows\System32\sAZvhYq.exe
  C:\Windows\System32\sAZvhYq.exe
  2⤵
  PID:12468
- C:\Windows\System32\NOIcTJE.exe
  C:\Windows\System32\NOIcTJE.exe
  2⤵
  PID:12496
- C:\Windows\System32\BTvBEYA.exe
  C:\Windows\System32\BTvBEYA.exe
  2⤵
  PID:12528
- C:\Windows\System32\bDFUMcW.exe
  C:\Windows\System32\bDFUMcW.exe
  2⤵
  PID:12556
- C:\Windows\System32\WAGsUOu.exe
  C:\Windows\System32\WAGsUOu.exe
  2⤵
  PID:12584
- C:\Windows\System32\vCmBIco.exe
  C:\Windows\System32\vCmBIco.exe
  2⤵
  PID:12612
- C:\Windows\System32\pquzDJa.exe
  C:\Windows\System32\pquzDJa.exe
  2⤵
  PID:12644
- C:\Windows\System32\vSnqQDm.exe
  C:\Windows\System32\vSnqQDm.exe
  2⤵
  PID:12672
- C:\Windows\System32\zlBgpFQ.exe
  C:\Windows\System32\zlBgpFQ.exe
  2⤵
  PID:12700
- C:\Windows\System32\PqecQHz.exe
  C:\Windows\System32\PqecQHz.exe
  2⤵
  PID:12728
- C:\Windows\System32\rSUcCaP.exe
  C:\Windows\System32\rSUcCaP.exe
  2⤵
  PID:12756
- C:\Windows\System32\DKGaAPI.exe
  C:\Windows\System32\DKGaAPI.exe
  2⤵
  PID:12784
- C:\Windows\System32\RpMwAdq.exe
  C:\Windows\System32\RpMwAdq.exe
  2⤵
  PID:12812
- C:\Windows\System32\gAByoIy.exe
  C:\Windows\System32\gAByoIy.exe
  2⤵
  PID:12840
- C:\Windows\System32\PYtvnEQ.exe
  C:\Windows\System32\PYtvnEQ.exe
  2⤵
  PID:12868
- C:\Windows\System32\qykWQIz.exe
  C:\Windows\System32\qykWQIz.exe
  2⤵
  PID:12896
- C:\Windows\System32\tTmzVKe.exe
  C:\Windows\System32\tTmzVKe.exe
  2⤵
  PID:12924
- C:\Windows\System32\uOcbWrP.exe
  C:\Windows\System32\uOcbWrP.exe
  2⤵
  PID:12952
- C:\Windows\System32\TQfAgbe.exe
  C:\Windows\System32\TQfAgbe.exe
  2⤵
  PID:12980
- C:\Windows\System32\EQmRskc.exe
  C:\Windows\System32\EQmRskc.exe
  2⤵
  PID:13008
- C:\Windows\System32\wiYdkhT.exe
  C:\Windows\System32\wiYdkhT.exe
  2⤵
  PID:13036
- C:\Windows\System32\slMupEg.exe
  C:\Windows\System32\slMupEg.exe
  2⤵
  PID:13064
- C:\Windows\System32\nsnjFPn.exe
  C:\Windows\System32\nsnjFPn.exe
  2⤵
  PID:13092
- C:\Windows\System32\BPTEyjm.exe
  C:\Windows\System32\BPTEyjm.exe
  2⤵
  PID:13120
- C:\Windows\System32\zLNxuXH.exe
  C:\Windows\System32\zLNxuXH.exe
  2⤵
  PID:13148
- C:\Windows\System32\WBYlPij.exe
  C:\Windows\System32\WBYlPij.exe
  2⤵
  PID:13176
- C:\Windows\System32\vRbFwJK.exe
  C:\Windows\System32\vRbFwJK.exe
  2⤵
  PID:13204
- C:\Windows\System32\toWJRLH.exe
  C:\Windows\System32\toWJRLH.exe
  2⤵
  PID:13232
- C:\Windows\System32\HwrXVsD.exe
  C:\Windows\System32\HwrXVsD.exe
  2⤵
  PID:13260
- C:\Windows\System32\utOqbZS.exe
  C:\Windows\System32\utOqbZS.exe
  2⤵
  PID:13292
- C:\Windows\System32\wzEcRgN.exe
  C:\Windows\System32\wzEcRgN.exe
  2⤵
  PID:12292
- C:\Windows\System32\RJMmGuj.exe
  C:\Windows\System32\RJMmGuj.exe
  2⤵
  PID:12368
- C:\Windows\System32\sLuGkdd.exe
  C:\Windows\System32\sLuGkdd.exe
  2⤵
  PID:12432
- C:\Windows\System32\uUJgxZk.exe
  C:\Windows\System32\uUJgxZk.exe
  2⤵
  PID:12492
- C:\Windows\System32\GGpZTcM.exe
  C:\Windows\System32\GGpZTcM.exe
  2⤵
  PID:3300
- C:\Windows\System32\jqrjDdL.exe
  C:\Windows\System32\jqrjDdL.exe
  2⤵
  PID:12548
- C:\Windows\System32\saiABdI.exe
  C:\Windows\System32\saiABdI.exe
  2⤵
  PID:12608
- C:\Windows\System32\dhloANl.exe
  C:\Windows\System32\dhloANl.exe
  2⤵
  PID:12696
- C:\Windows\System32\iqXbzNk.exe
  C:\Windows\System32\iqXbzNk.exe
  2⤵
  PID:12748
- C:\Windows\System32\fDgkjTR.exe
  C:\Windows\System32\fDgkjTR.exe
  2⤵
  PID:12808
- C:\Windows\System32\iQhFNVK.exe
  C:\Windows\System32\iQhFNVK.exe
  2⤵
  PID:12880
- C:\Windows\System32\JoZKBRn.exe
  C:\Windows\System32\JoZKBRn.exe
  2⤵
  PID:12936
- C:\Windows\System32\ngVJMyu.exe
  C:\Windows\System32\ngVJMyu.exe
  2⤵
  PID:13000
- C:\Windows\System32\PuyuZMm.exe
  C:\Windows\System32\PuyuZMm.exe
  2⤵
  PID:13060
- C:\Windows\System32\oTtliNm.exe
  C:\Windows\System32\oTtliNm.exe
  2⤵
  PID:13140
- C:\Windows\System32\wmWEJJP.exe
  C:\Windows\System32\wmWEJJP.exe
  2⤵
  PID:13196
- C:\Windows\System32\IcPFhfR.exe
  C:\Windows\System32\IcPFhfR.exe
  2⤵
  PID:13252
- C:\Windows\System32\LSAGIky.exe
  C:\Windows\System32\LSAGIky.exe
  2⤵
  PID:12324
- C:\Windows\System32\gdpTbPx.exe
  C:\Windows\System32\gdpTbPx.exe
  2⤵
  PID:12460
- C:\Windows\System32\LpUmTGX.exe
  C:\Windows\System32\LpUmTGX.exe
  2⤵
  PID:12520
- C:\Windows\System32\WSJdVJv.exe
  C:\Windows\System32\WSJdVJv.exe
  2⤵
  PID:12668
- C:\Windows\System32\OZppNCL.exe
  C:\Windows\System32\OZppNCL.exe
  2⤵
  PID:12836
- C:\Windows\System32\XiKbCkA.exe
  C:\Windows\System32\XiKbCkA.exe
  2⤵
  PID:12976
- C:\Windows\System32\LsBaFww.exe
  C:\Windows\System32\LsBaFww.exe
  2⤵
  PID:13116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1040,i,15316930299780304231,7592852768794498680,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:8
1⤵
PID:8064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

CHpYnrT.exe

Path C:\Windows\System32\CHpYnrT.exe
Size 3.3MB
SHA256 985dc9111731ffd30f8febc7d64635c57cc76dcc2ea944f227061470b0a22727
MD5 43246397928e43d04750e0bcc771b1d7
SHA1 57f619ed40e2b860ce3f4482c45df887c5001b7b
SHA512 b20ac47d9f3c9b16bd8fe72132b54276b38145587d2534842618cfd59556a4fbcc033d6cd555e4cdfe08934dbb33387cb26c7fddb8a5e03c3d8c21d4ba4c6d81
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4a:wFWPClFq
MD5 SHA1 SHA512 SSDEEP

Submit Download

DFYzPfj.exe

Path C:\Windows\System32\DFYzPfj.exe
Size 3.3MB
SHA256 07c1b886b5cd2bb820583c7c44ce5123df4553cd73bc06d42cd6312cdaefd077
MD5 47c9c276ff9165f89e075eaccb8b8a00
SHA1 472ca239e771569c7fb325e33b653165f78a6225
SHA512 c023fcf93633b0e85d411c21d9e3075c7653947d7cd511fb0df9b1aa7900b6657ac529b3661271455df1e94f1d5f37f19ad83a4ac0a9eaa811f0f5a727e7d7eb
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4H:wFWPClFX
MD5 SHA1 SHA512 SSDEEP

Submit Download

DzTptKP.exe

Path C:\Windows\System32\DzTptKP.exe
Size 3.3MB
SHA256 a06f65219dbcea455382cee56ac7902d3ba8722680a40bb84f2b14964bcd7513
MD5 a7c608a81c8c1b3781888e00ebd8320a
SHA1 b0ffc45ae55058ad2e840ce7f450e0d27ac980a6
SHA512 e400a1cbc2d0c0b12be42f4e795a897c4c16489f54319ccbedb96ca9554b1fae69e8da29de037d50423d1c613b3c613b470047244201b86f0cb7d93e910fb426
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4n:wFWPClF3
MD5 SHA1 SHA512 SSDEEP

Submit Download

GBBwrzw.exe

Path C:\Windows\System32\GBBwrzw.exe
Size 3.3MB
SHA256 c23e6777b7f54a2809e0c9df1259971263f388b57252565424904053ec2f06a5
MD5 974536578c2ba939c6c33ec6d6f4f4db
SHA1 e75384d361b3d04714c5db7a9a53980b84c1c6c1
SHA512 1bd7c2f441872d4705dd059834799b0bdc71ca2e1d5aa88645d98155e9c437933843e88031ec057afb0a9cefac88bd182973d1b9d090587c55c0867e0c5036a0
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4k:wFWPClFU
MD5 SHA1 SHA512 SSDEEP

Submit Download

GpWjBEO.exe

Path C:\Windows\System32\GpWjBEO.exe
Size 3.3MB
SHA256 86558a35d715093b876e18c8248f187605d00b0f105caf48b38803514f1358c1
MD5 4a913026f3da6004ca069b65835dcef1
SHA1 2f82744f072b9e52e32d7a5417aa2fafd7bd348e
SHA512 fb54f4ef0661b3afff465157f5de746001ef951ad484c509ec74bc487a0859e8fbeed6ec74e2fecc75ff892942a48fb931871ef3fdbe5b919bc755d37bdb4d14
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4K:wFWPClFa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hkkxfmy.exe

Path C:\Windows\System32\Hkkxfmy.exe
Size 3.3MB
SHA256 2ae0073e4eded6f4f74a3ad4b86ce0b745dcebed6ebd20afef45495c240dc738
MD5 bfa9b2f0385fe42a7957b4354fe87bc6
SHA1 cec18110bb046db901cc3b0070fff69e437e60af
SHA512 0a17d044229f9c7a559dd693c1cfdcb3e600e740633fb176b5565c9e85f42a7396afabb27cd76dc78cdbbc930c216077c5ffa69dcfa33305b8d15a32ca8f0702
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4H:wFWPClF3
MD5 SHA1 SHA512 SSDEEP

Submit Download

HzCKScL.exe

Path C:\Windows\System32\HzCKScL.exe
Size 3.3MB
SHA256 2de87def84a3553d8bb7ce676c8ba391e1b1812f160256c3f7e25101c5edb8c2
MD5 0534f22c422cb2c183a3580ae112e985
SHA1 b38393f3a835e74bf9f321251516f49bce109fb1
SHA512 cac4cb43ffeff7b9b11f27d7cf0530f4585c762a0c9b1df087b9083ad23201f9541321e6d99c6fc7058349d038e0e4db718c9587302a2450cfd6fad55a780c33
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4i:wFWPClFS
MD5 SHA1 SHA512 SSDEEP

Submit Download

NpptRNG.exe

Path C:\Windows\System32\NpptRNG.exe
Size 3.3MB
SHA256 4ba296876b6dfbef16a7ad947822315c2eb096363e0b51fdfe395f7194028b66
MD5 42e8cdb047002fd95de1009335775dc8
SHA1 bfd0f3355a97fa0ec775e58a309c5df62c7d20cd
SHA512 656b68e1afbbbaeb2abe5ff66ac9e22d4bb565cb2020e9f6828088b769f93ab9e5b7815de3c4be2f8288a4765267bc125bacb5919b40796d37a51babf2f012ad
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4C:wFWPClFy
MD5 SHA1 SHA512 SSDEEP

Submit Download

RVPmCul.exe

Path C:\Windows\System32\RVPmCul.exe
Size 3.3MB
SHA256 586d40062960cbe427f65368f9aef72d7b6fa5aadcdcef22c34e1b1e0dcf7a2d
MD5 8640216d2babdeff881aa6754a19b479
SHA1 699d8cde182469bcf60cde7dc2332236549a03dd
SHA512 1f2ada199de5697ab1c74b9c45d6433928fe36bdd972591d88ecbb9deb98b89e2d8eba6a4c8332595aa028e0aefab7eae2c2975597fdc1cee8e2a5bfedde32f3
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc46:wFWPClFq
MD5 SHA1 SHA512 SSDEEP

Submit Download

SXwOEkG.exe

Path C:\Windows\System32\SXwOEkG.exe
Size 3.3MB
SHA256 e11570b0d46f660c51e3de73b5b6a3074d72b9b8cff317fe73db2bbb988707e8
MD5 f7a8aec1e1653b0aecc875efec3a8a6a
SHA1 09bc7ac93424d91cc273d2d7369c924c80ef95fa
SHA512 fe0491ca800f0827198688c71f1b05675b887e74a2f4214754f84ce693a77fe95a605447e577b15431ffd5b18997b6c3746fc680a3ea6ad4a581cc1cbab9325d
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4T:wFWPClFD
MD5 SHA1 SHA512 SSDEEP

Submit Download

TgUDQdW.exe

Path C:\Windows\System32\TgUDQdW.exe
Size 3.3MB
SHA256 29c3ae40f86262e564ece1deed4b8b289aaa1e0eab5388cb5140bf02917356b8
MD5 e1898840a5450f09b052b7c478a34954
SHA1 217bcb4324036b58641858573a3e55bdfa02dd1d
SHA512 bdb5ccccbc79d2f306801667c5e718f38040e36269243e3cf3db21a5d5925a9a6c090183aa6c0fba4d95e8b1bfff758cc02ef1704dcbd2466d2e1edff5fdf672
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4N:wFWPClFd
MD5 SHA1 SHA512 SSDEEP

Submit Download

TksezWc.exe

Path C:\Windows\System32\TksezWc.exe
Size 3.3MB
SHA256 e39fe5a71aefd892e55ca76a2dc63f707c651c49eac49440ffa266f9161b5545
MD5 eaf03040922d85db12446629b968d1ef
SHA1 121e024d3c58ff6dde1fa9ddf6b6c02e511c0b3c
SHA512 674a1deaa532522da64311e82c4cdb78a25afd07d3f4eae6998f7b7e6246c6a170178dc23bd39b4a626259b843293b5217efaa47b682bdbc4a3e2aae86723e57
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4p:wFWPClF5
MD5 SHA1 SHA512 SSDEEP

Submit Download

UaImYhe.exe

Path C:\Windows\System32\UaImYhe.exe
Size 3.3MB
SHA256 9f21e3faf75205f7a1105d802248d6e81235e23b48843fbe39315eab12e7dd92
MD5 5f061b0e48ff8d2845913a90041723af
SHA1 9919cb6e9b0f31a849197be08dd847a223750dd1
SHA512 b13122834a4576cbf9833e57b1f30a7fda69e1685166de01e74bcc47e85f6106187d6db38da5bf6d72da0ccf5d9fa469c6f2a65b557e4466d81c2be197a4de09
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4H:wFWPClFX
MD5 SHA1 SHA512 SSDEEP

Submit Download

UcvBGom.exe

Path C:\Windows\System32\UcvBGom.exe
Size 3.3MB
SHA256 c30530106d37f91c3966a72245d2425a3fd497899eb7437080efe1584a171dc4
MD5 9128555869e5e124e201999aae7e10ea
SHA1 12d03847f6731b5289c49ff141095753e233b764
SHA512 af8f6d6fe4d63d283f3d67f8e92a363df37ee0acab955c790fbb8348c5307749f811e4d8a5b560e46a09f53ffa16e33929451b90018a67a194e9788a25f59bb4
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4c:wFWPClFs
MD5 SHA1 SHA512 SSDEEP

Submit Download

VONSWnF.exe

Path C:\Windows\System32\VONSWnF.exe
Size 3.3MB
SHA256 c8c4a946b6c33e4945fca71a6ecf33959a4fe4565cebb1fc6d22f79b5e4df467
MD5 d4890fb23fc55c590197adecc1f68ad9
SHA1 621e352c17398da60e84d31f8f67158dd0c9ad3c
SHA512 c2c442b13ebfbe52f8deb9be7f14c8420c198c554fab9edb95582cd5ca13318452d408567f4915ff404a8cad2ee027951a29b6892ea101735c126a95b863595a
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc46:wFWPClFK
MD5 SHA1 SHA512 SSDEEP

Submit Download

WNAQkRV.exe

Path C:\Windows\System32\WNAQkRV.exe
Size 3.3MB
SHA256 2da17c75cffc9c764cab931e7a921c54af9ffa37b7b286bf83f0c654d8c7d1da
MD5 401f3b51e718b51d17340ea8912064dc
SHA1 a01f9896d075da79e63ce0d153ccd44f27ae4cbd
SHA512 13d3759b7a4d46a1019ad54d00037b1791c95d2d748c35d25e296099288187c9cf1d464b459052b94eff42ac566a22ef5975a1d86cc93e12f109362e7b94d1ab
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4W:wFWPClFm
MD5 SHA1 SHA512 SSDEEP

Submit Download

YBYDGOZ.exe

Path C:\Windows\System32\YBYDGOZ.exe
Size 3.3MB
SHA256 0b0c51d9776181115e64b9eb92cb70dcb9b83dbdd2e57be2d1ec4f22b233e5ec
MD5 506444589779b1edf5f4895650f91367
SHA1 615b494445258a047399cef5a0b3b942673fa696
SHA512 72cb60ffb2a6d6cee3b1596baaecbba1a0739d3573b6f32bf269fcb76cf626de99ad958bf56ea43ba04cf217a64550fa7b2cc3de5b980d6875224b977bd3af65
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4D:wFWPClFz
MD5 SHA1 SHA512 SSDEEP

Submit Download

YVMUGCs.exe

Path C:\Windows\System32\YVMUGCs.exe
Size 3.3MB
SHA256 f8f22dabe7f9ed95d81011a06283c64443f93cc020196ab3db7e3b9181b0e1ad
MD5 c91ff3d214899910dbe58b34f0fc3baa
SHA1 673161a12350471aeb72c16f0a7d1712080694a4
SHA512 92814b56e1e4670e69e005359b7b5616e4b91e960a6f1c6530e48cc83041ea2b684b50c042daf1dc4850958c048c0cc53925706d5ba6a6e8deae9acb956b7fb6
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4f:wFWPClFP
MD5 SHA1 SHA512 SSDEEP

Submit Download

jXQFdUU.exe

Path C:\Windows\System32\jXQFdUU.exe
Size 3.3MB
SHA256 6e730a15dbc76a72dcda3a0ab367435b8823d464c940c10bebdb81fe84f8ec26
MD5 ce170fdf82610f8e2d46ab8a274d1794
SHA1 7252b1fc181ebf5a1089c6c0b5d6c5ab354f08dc
SHA512 b3770287151528fdb125fec101898b2284108cfbe0edb3da0238f1da8395ed666ddae5201afee3cbfb0a6b85fed8db5b1e7bee00576e2ef960121e6c335b6f1b
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4f:wFWPClFv
MD5 SHA1 SHA512 SSDEEP

Submit Download

jvLEMCR.exe

Path C:\Windows\System32\jvLEMCR.exe
Size 3.3MB
SHA256 84b7b5150a8846d1962e4124ef03c72aff291beb6e0cc0cbafddc8cd783c601c
MD5 a99fceb822f8eb65e892bb41deef7cb7
SHA1 adab38dfa9940ae88f0b8d8344e97aaacc667d16
SHA512 68a0499ddf722eb48c032915824e5d0700d22fb56d9fa8214908b8ecc216d982b8583129e16f8e39132c8fe2f1b4c7f4efaa76f5d2ddfbcac2ed86f582c1bb5d
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc42:wFWPClFG
MD5 SHA1 SHA512 SSDEEP

Submit Download

kZpCCfC.exe

Path C:\Windows\System32\kZpCCfC.exe
Size 3.3MB
SHA256 fce196ea454365d3d6f310ed835c7c2f85ac7dcd362d4b6266a52ade7f86943b
MD5 a6573de598bac4493c3952d09eb16281
SHA1 383c1909cb104b6de82fd0b137c613c38273f1d1
SHA512 e475ed65d0c235ac78568a09144937b44c6bde651a7e86f0781e0a2cc1c7e814a4ee3bffbba8f0fc2ffd4ce4c491b3dd8d2ddbf35496bb129c396a4829e4533b
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4M:wFWPClF8
MD5 SHA1 SHA512 SSDEEP

Submit Download

meqgxXH.exe

Path C:\Windows\System32\meqgxXH.exe
Size 3.3MB
SHA256 84194f90d05869f0daeff59797c4670b55521c98aef07ea2332c696dbcae7e61
MD5 a9596c190b05c6bcd5c0c82e3a5f6b09
SHA1 444f668b24326dfb746be86fc4940b5169285103
SHA512 87ebd950300324c318cfd8144633817806b54f7915e90154d606cd55625336af90c75757e8b9f2e3897b2465937d1516f0f23a9d63d30438c8aa2187a736ca85
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4c:wFWPClFM
MD5 SHA1 SHA512 SSDEEP

Submit Download

mrqNPvC.exe

Path C:\Windows\System32\mrqNPvC.exe
Size 3.3MB
SHA256 87a65ddde7c1cd502ea7ef4b0e05aad55875c8190280e64331b6978537399a49
MD5 f677ef274daf56edc373cc2b7e8bad8d
SHA1 858878297bbd091252b348eda4bd5db11f0eed59
SHA512 4d30ade5acc637b269e0d21dd086886ec5ca629ded9e3ff374baba987e3a8c36df93b4866e2818d60567470b3ab5060eb4f01d0232d7e7a9c06db0db44701e0f
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4b:wFWPClFr
MD5 SHA1 SHA512 SSDEEP

Submit Download

oRSXYOB.exe

Path C:\Windows\System32\oRSXYOB.exe
Size 3.3MB
SHA256 d562d2d5492dd58a0341b6756e36a22142ab8ed4a32dc74ac628140621cf9f95
MD5 bb2cf979027f5aa32ab35020028489f2
SHA1 3951c8bb94770e2437cfcc1ce6c3680b5fa28497
SHA512 57d26f85288be4e3546263b791d32c7df0310a09fe9b3a93a357d8aec6aaa5db1bcb969bee62eb03a4a19e7af356096417b28abcc7b3518a6f07888591263297
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4x:wFWPClFh
MD5 SHA1 SHA512 SSDEEP

Submit Download

pnZcjkk.exe

Path C:\Windows\System32\pnZcjkk.exe
Size 3.3MB
SHA256 3797f8fbd51db76a2c021320fa795ca7e5e95a8b41837fcdbc8287a5f584eea8
MD5 af864193ce91af60865dfa4b1f49a07f
SHA1 82ce15e47dec2d5f9b85c22216972192f7e1ceb9
SHA512 f97c7c9a6b19cc5a8509efbd18d1ebefc83112a2531d0f19ca647ca443e3f76bf8e8aa23aca9156052fe1dbd877256809e853da9cd2ba020a8cc498bc6b26fe0
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4/:wFWPClFv
MD5 SHA1 SHA512 SSDEEP

Submit Download

pwdGCzC.exe

Path C:\Windows\System32\pwdGCzC.exe
Size 3.3MB
SHA256 37ed24b1a1215f804edee56515fde108e81b8273157786be372d090d8f2ba396
MD5 c8fdfbff39269cfc1dc85069d662f42b
SHA1 fd38f1b06dcb524760d66e67fc9c052a356c6789
SHA512 b96242551073efe0937e23325d758548dccb3ff61d3c5470c40c77e09974df16e206fb55d8324e730793b8077192b4e35b048b7d1b1f29a0f64f293e6c8fae60
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4s:wFWPClFc
MD5 SHA1 SHA512 SSDEEP

Submit Download

tgkTAFC.exe

Path C:\Windows\System32\tgkTAFC.exe
Size 3.3MB
SHA256 6ea0122d31a42ceef37014d4e5835d6715880b287614cf44b12dee223ba32c07
MD5 d08c21770b79cd082fa2325d8d7581d6
SHA1 919ca543bd24bda57c8be3d8183d3f5251d7de9d
SHA512 7a7b192dea6b79fe3953f642604e408948c2d225242050533b74d53cae56a2a2fba5ee513a8925ddb4e066599af3b3c6abd28b54da64e5af0b9ea8a553ad2f04
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4i:wFWPClFy
MD5 SHA1 SHA512 SSDEEP

Submit Download

vEkatmM.exe

Path C:\Windows\System32\vEkatmM.exe
Size 3.3MB
SHA256 ada98161b9d3db49bf945329f743f3e39c01d8e705962247f20c0784b2eb4b6f
MD5 3607aa17fdcf795c8ba1c31e65d07f14
SHA1 d83a3c42fa632f87794d803bf43473e15df2ccea
SHA512 103c8d6c8ef5304d89335c36c8512ff701548b00aaf180e546867b496ea3a5669a7e0b18f7e7cd0ba5cd092524ad9e8db06381ed83857f462d18a1d8f5cc814f
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc49:wFWPClFN
MD5 SHA1 SHA512 SSDEEP

Submit Download

xheahyc.exe

Path C:\Windows\System32\xheahyc.exe
Size 3.3MB
SHA256 077d48c7b3d3be1e1e1387baf14a0363f65462567d76c1c792a856c8e5dd5428
MD5 b7e89566c5f11871a15df18ad55b2572
SHA1 c837bf457b42f71eb50809812d4a94c798d2d01b
SHA512 62721757787123f226259eab6db53a768450c4c4ca937f8c6a664dc3e65f81a7cce819205912065948f83347ce2a8403e9e424a8b21f170b54b112bb8f311113
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4W:wFWPClFG
MD5 SHA1 SHA512 SSDEEP

Submit Download

xnHrQCz.exe

Path C:\Windows\System32\xnHrQCz.exe
Size 3.3MB
SHA256 30f4e2f5676372270fa3c6caef0de6ecd20c9697ab9a59303a7f5ece3dd64455
MD5 96d68794befc14bdf8b31d373f5ec8b3
SHA1 8814433d62aa19c05afc4ed417d5dfc92916ce48
SHA512 2fda132ac483e3bb90eee2ff2136a60bb30eafcb570daee59e733afa7a641104d29a2d403d5f925a66a362da9825f12879be95d58c65386d78ba71c84528bd66
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4x:wFWPClFB
MD5 SHA1 SHA512 SSDEEP

Submit Download

zQtRIrg.exe

Path C:\Windows\System32\zQtRIrg.exe
Size 3.3MB
SHA256 36c1cbbcefb368b55fa17410330e2178fcad9a2b0673120f856ec852f59492aa
MD5 89a010689bd1189595ab73576c5243c5
SHA1 1b48fdee75c2f366f928248f4ab6e5c24879481c
SHA512 e32d7d4060c35923bcb9f1238a0bad6bd09bf06fb6f0c2d78dca12982439055d836c2baeeddb055b1ec62d8307d979e254aa63530eb1ac06ec13b659b5244973
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc48:wFWPClFs
MD5 SHA1 SHA512 SSDEEP

Submit Download

zfUwsDX.exe

Path C:\Windows\System32\zfUwsDX.exe
Size 3.3MB
SHA256 2f9fd2a5327eec6895a2bc0cde1c4626b6a1f4e7513285b5723cac528ef404bb
MD5 cce48b7c516521ed2adf85eec57b565e
SHA1 80231be4040237baef2390e0922d94f67d5ccd22
SHA512 5280145262afcd9d96eb5967fd528d9946a9031b9d9672e6826822a1af102bbd02b5967ee5bcad1e4e608635a153a199d6e45c84f30c7c7f270227e2e86590f4
SSDEEP 98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4p:wFWPClF5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1432-1900-0x00007FF6884D0000-0x00007FF6888C5000-memory.dmp

Download

memory/1432-32-0x00007FF6884D0000-0x00007FF6888C5000-memory.dmp

Download

memory/1572-12-0x00007FF721180000-0x00007FF721575000-memory.dmp

Download

memory/1572-1898-0x00007FF721180000-0x00007FF721575000-memory.dmp

Download

memory/1572-1894-0x00007FF721180000-0x00007FF721575000-memory.dmp

Download

memory/1928-1892-0x00007FF6D2690000-0x00007FF6D2A85000-memory.dmp

Download

memory/1928-0-0x00007FF6D2690000-0x00007FF6D2A85000-memory.dmp

Download

memory/1928-1-0x000002325E260000-0x000002325E270000-memory.dmp

Download

memory/1928-1895-0x00007FF6D2690000-0x00007FF6D2A85000-memory.dmp

Download

memory/1956-1899-0x00007FF66EF10000-0x00007FF66F305000-memory.dmp

Download

memory/1956-747-0x00007FF66EF10000-0x00007FF66F305000-memory.dmp

Download

memory/2032-1897-0x00007FF677FE0000-0x00007FF6783D5000-memory.dmp

Download

memory/2032-25-0x00007FF677FE0000-0x00007FF6783D5000-memory.dmp

Download

memory/2052-1907-0x00007FF6E6D70000-0x00007FF6E7165000-memory.dmp

Download

memory/2052-784-0x00007FF6E6D70000-0x00007FF6E7165000-memory.dmp

Download

memory/2408-798-0x00007FF7880E0000-0x00007FF7884D5000-memory.dmp

Download

memory/2408-1914-0x00007FF7880E0000-0x00007FF7884D5000-memory.dmp

Download

memory/2532-754-0x00007FF67A3B0000-0x00007FF67A7A5000-memory.dmp

Download

memory/2532-1919-0x00007FF67A3B0000-0x00007FF67A7A5000-memory.dmp

Download

memory/2600-1906-0x00007FF7FD9A0000-0x00007FF7FDD95000-memory.dmp

Download

memory/2600-790-0x00007FF7FD9A0000-0x00007FF7FDD95000-memory.dmp

Download

memory/2644-753-0x00007FF66CEF0000-0x00007FF66D2E5000-memory.dmp

Download

memory/2644-1911-0x00007FF66CEF0000-0x00007FF66D2E5000-memory.dmp

Download

memory/2668-751-0x00007FF7B9D00000-0x00007FF7BA0F5000-memory.dmp

Download

memory/2668-1912-0x00007FF7B9D00000-0x00007FF7BA0F5000-memory.dmp

Download

memory/3012-796-0x00007FF6F2FE0000-0x00007FF6F33D5000-memory.dmp

Download

memory/3012-1915-0x00007FF6F2FE0000-0x00007FF6F33D5000-memory.dmp

Download

memory/3112-769-0x00007FF765850000-0x00007FF765C45000-memory.dmp

Download

memory/3112-1909-0x00007FF765850000-0x00007FF765C45000-memory.dmp

Download

memory/3440-805-0x00007FF7E4A70000-0x00007FF7E4E65000-memory.dmp

Download

memory/3440-1901-0x00007FF7E4A70000-0x00007FF7E4E65000-memory.dmp

Download

memory/3508-778-0x00007FF61A380000-0x00007FF61A775000-memory.dmp

Download

memory/3508-1918-0x00007FF61A380000-0x00007FF61A775000-memory.dmp

Download

memory/3664-1905-0x00007FF6901E0000-0x00007FF6905D5000-memory.dmp

Download

memory/3664-752-0x00007FF6901E0000-0x00007FF6905D5000-memory.dmp

Download

memory/3704-749-0x00007FF6B1BA0000-0x00007FF6B1F95000-memory.dmp

Download

memory/3704-1904-0x00007FF6B1BA0000-0x00007FF6B1F95000-memory.dmp

Download

memory/3716-1913-0x00007FF731390000-0x00007FF731785000-memory.dmp

Download

memory/3716-804-0x00007FF731390000-0x00007FF731785000-memory.dmp

Download

memory/3860-789-0x00007FF71E8F0000-0x00007FF71ECE5000-memory.dmp

Download

memory/3860-1917-0x00007FF71E8F0000-0x00007FF71ECE5000-memory.dmp

Download

memory/4068-1893-0x00007FF625000000-0x00007FF6253F5000-memory.dmp

Download

memory/4068-11-0x00007FF625000000-0x00007FF6253F5000-memory.dmp

Download

memory/4068-1896-0x00007FF625000000-0x00007FF6253F5000-memory.dmp

Download

memory/4320-1916-0x00007FF711990000-0x00007FF711D85000-memory.dmp

Download

memory/4320-793-0x00007FF711990000-0x00007FF711D85000-memory.dmp

Download

memory/4428-1908-0x00007FF7663B0000-0x00007FF7667A5000-memory.dmp

Download

memory/4428-773-0x00007FF7663B0000-0x00007FF7667A5000-memory.dmp

Download

memory/4432-1902-0x00007FF706960000-0x00007FF706D55000-memory.dmp

Download

memory/4432-748-0x00007FF706960000-0x00007FF706D55000-memory.dmp

Download

memory/4608-1903-0x00007FF7B0400000-0x00007FF7B07F5000-memory.dmp

Download

memory/4608-750-0x00007FF7B0400000-0x00007FF7B07F5000-memory.dmp

Download

memory/4896-1910-0x00007FF7C5220000-0x00007FF7C5615000-memory.dmp

Download

memory/4896-760-0x00007FF7C5220000-0x00007FF7C5615000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads