xmrig | 2884570af800d39bab8f9575e5e69d27e92391cf9dd01b1d1b1e57223f795a46

Analysis

max time kernel
64s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 01:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
Size 1.9MB
Sample240614-brglcszbpd
SHA256 2884570af800d39bab8f9575e5e69d27e92391cf9dd01b1d1b1e57223f795a46
MD5 96a3350e8f48517a249df902a219b140
SHA1 53706ad5822326f86cbaf38456fb81c203d02a4e
SHA512 c4da7d8fd85880e46f04d5afe3c48b990ffc50eb83570db5cba4b48512e9473921f48ab89823d24410854a6b54c6370c060f049f0f7ab167c8d5de11adf133fd
SSDEEP 49152:knw9oUUEEDl37jcqdt3uB3AXqMTwi4/1k:kQUEEx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/996-457-0x00007FF6772A0000-0x00007FF677691000-memory.dmp	xmrig
behavioral2/memory/4460-458-0x00007FF6A80C0000-0x00007FF6A84B1000-memory.dmp	xmrig
behavioral2/memory/3652-459-0x00007FF63C770000-0x00007FF63CB61000-memory.dmp	xmrig
behavioral2/memory/1624-460-0x00007FF63A880000-0x00007FF63AC71000-memory.dmp	xmrig
behavioral2/memory/4228-461-0x00007FF626FE0000-0x00007FF6273D1000-memory.dmp	xmrig
behavioral2/memory/3968-462-0x00007FF6E0BB0000-0x00007FF6E0FA1000-memory.dmp	xmrig
behavioral2/memory/3892-463-0x00007FF7FD830000-0x00007FF7FDC21000-memory.dmp	xmrig
behavioral2/memory/956-22-0x00007FF6B7F20000-0x00007FF6B8311000-memory.dmp	xmrig
behavioral2/memory/2528-464-0x00007FF6D00C0000-0x00007FF6D04B1000-memory.dmp	xmrig
behavioral2/memory/3456-471-0x00007FF65F8E0000-0x00007FF65FCD1000-memory.dmp	xmrig
behavioral2/memory/2620-482-0x00007FF72ADA0000-0x00007FF72B191000-memory.dmp	xmrig
behavioral2/memory/2136-480-0x00007FF7605E0000-0x00007FF7609D1000-memory.dmp	xmrig
behavioral2/memory/3616-487-0x00007FF73A890000-0x00007FF73AC81000-memory.dmp	xmrig
behavioral2/memory/1500-479-0x00007FF619500000-0x00007FF6198F1000-memory.dmp	xmrig
behavioral2/memory/2720-493-0x00007FF673BB0000-0x00007FF673FA1000-memory.dmp	xmrig
behavioral2/memory/3988-495-0x00007FF727EF0000-0x00007FF7282E1000-memory.dmp	xmrig
behavioral2/memory/3044-497-0x00007FF63AAA0000-0x00007FF63AE91000-memory.dmp	xmrig
behavioral2/memory/4548-503-0x00007FF786F20000-0x00007FF787311000-memory.dmp	xmrig
behavioral2/memory/2196-544-0x00007FF77B510000-0x00007FF77B901000-memory.dmp	xmrig
behavioral2/memory/1804-548-0x00007FF79E3B0000-0x00007FF79E7A1000-memory.dmp	xmrig
behavioral2/memory/3368-474-0x00007FF7C59C0000-0x00007FF7C5DB1000-memory.dmp	xmrig
behavioral2/memory/2560-467-0x00007FF642310000-0x00007FF642701000-memory.dmp	xmrig
behavioral2/memory/4136-1990-0x00007FF6E4E90000-0x00007FF6E5281000-memory.dmp	xmrig
behavioral2/memory/1492-2023-0x00007FF78CD30000-0x00007FF78D121000-memory.dmp	xmrig
behavioral2/memory/2236-2029-0x00007FF769510000-0x00007FF769901000-memory.dmp	xmrig
behavioral2/memory/1492-2033-0x00007FF78CD30000-0x00007FF78D121000-memory.dmp	xmrig
behavioral2/memory/956-2032-0x00007FF6B7F20000-0x00007FF6B8311000-memory.dmp	xmrig
behavioral2/memory/996-2035-0x00007FF6772A0000-0x00007FF677691000-memory.dmp	xmrig
behavioral2/memory/4460-2037-0x00007FF6A80C0000-0x00007FF6A84B1000-memory.dmp	xmrig
behavioral2/memory/3652-2040-0x00007FF63C770000-0x00007FF63CB61000-memory.dmp	xmrig
behavioral2/memory/2620-2062-0x00007FF72ADA0000-0x00007FF72B191000-memory.dmp	xmrig
behavioral2/memory/2720-2067-0x00007FF673BB0000-0x00007FF673FA1000-memory.dmp	xmrig
behavioral2/memory/2196-2073-0x00007FF77B510000-0x00007FF77B901000-memory.dmp	xmrig
behavioral2/memory/1804-2075-0x00007FF79E3B0000-0x00007FF79E7A1000-memory.dmp	xmrig
behavioral2/memory/3044-2071-0x00007FF63AAA0000-0x00007FF63AE91000-memory.dmp	xmrig
behavioral2/memory/3988-2065-0x00007FF727EF0000-0x00007FF7282E1000-memory.dmp	xmrig
behavioral2/memory/4548-2070-0x00007FF786F20000-0x00007FF787311000-memory.dmp	xmrig
behavioral2/memory/2136-2063-0x00007FF7605E0000-0x00007FF7609D1000-memory.dmp	xmrig
behavioral2/memory/3616-2060-0x00007FF73A890000-0x00007FF73AC81000-memory.dmp	xmrig
behavioral2/memory/1500-2058-0x00007FF619500000-0x00007FF6198F1000-memory.dmp	xmrig
behavioral2/memory/3368-2056-0x00007FF7C59C0000-0x00007FF7C5DB1000-memory.dmp	xmrig
behavioral2/memory/4228-2052-0x00007FF626FE0000-0x00007FF6273D1000-memory.dmp	xmrig
behavioral2/memory/3892-2049-0x00007FF7FD830000-0x00007FF7FDC21000-memory.dmp	xmrig
behavioral2/memory/3968-2048-0x00007FF6E0BB0000-0x00007FF6E0FA1000-memory.dmp	xmrig
behavioral2/memory/2528-2046-0x00007FF6D00C0000-0x00007FF6D04B1000-memory.dmp	xmrig
behavioral2/memory/3456-2042-0x00007FF65F8E0000-0x00007FF65FCD1000-memory.dmp	xmrig
behavioral2/memory/1624-2054-0x00007FF63A880000-0x00007FF63AC71000-memory.dmp	xmrig
behavioral2/memory/2560-2044-0x00007FF642310000-0x00007FF642701000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2236	bSqFAln.exe
1492	qWvWjcK.exe
956	Hnegxab.exe
996	cVVJZLd.exe
4460	DSKEISs.exe
3652	FseYeyY.exe
1624	gLnLyWe.exe
4228	PUsdnhm.exe
3968	JjCEzkH.exe
3892	XsVfvAa.exe
2528	yRJSXAC.exe
2560	NkeCnts.exe
3456	TamiXBm.exe
3368	uMARSvq.exe
1500	DwsXzZD.exe
2136	ZqWwCoR.exe
2620	umyncNu.exe
3616	bVVMgMc.exe
2720	TfAjUxd.exe
3988	mqAobdW.exe
3044	pwQWbgJ.exe
4548	ASpWSwD.exe
2196	MrBPpqr.exe
1804	fByHPIx.exe
376	tGgNtrx.exe
1620	stdLGgz.exe
4584	VdmlJuN.exe
620	fXDHMrA.exe
380	TPiLNhx.exe
4260	ykuNUnV.exe
1740	QaIrfJq.exe
336	kDfDJOF.exe
2176	NjTmvFh.exe
3440	cTOVwkS.exe
3228	rqxMkPU.exe
1012	WUojBHd.exe
3760	VSVpGuu.exe
2284	WStnJpZ.exe
4528	VcfjRqW.exe
2044	UpccbGk.exe
3208	WvazRvF.exe
1072	RPvJwOT.exe
2380	YnDzdRZ.exe
820	PlqbAvk.exe
4844	ZOXxCmc.exe
824	uvFXsfN.exe
1232	PJqbLPM.exe
3712	CSAJmKR.exe
2244	rCVnXVX.exe
4012	KlHYDEW.exe
4356	MzftCRB.exe
404	cxAGIVV.exe
4336	CFhGKUh.exe
4128	kQroxOT.exe
4560	RJZEdZW.exe
548	ZRdDJgE.exe
1052	YqmiqWL.exe
4800	MAVfrGk.exe
3088	pQlTXrU.exe
4420	SkoYMKV.exe
2968	ZyWrBRZ.exe
864	ioTUjET.exe
456	yPVRouR.exe
2676	sYmKWFG.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4136-0-0x00007FF6E4E90000-0x00007FF6E5281000-memory.dmp	upx
behavioral2/files/0x00070000000233cd-8.dat	upx
behavioral2/files/0x00070000000233ce-23.dat	upx
behavioral2/files/0x00070000000233d2-39.dat	upx
behavioral2/files/0x00070000000233d3-44.dat	upx
behavioral2/files/0x00070000000233d5-54.dat	upx
behavioral2/files/0x00070000000233d6-59.dat	upx
behavioral2/files/0x00070000000233d7-64.dat	upx
behavioral2/files/0x00070000000233d9-72.dat	upx
behavioral2/files/0x00070000000233da-79.dat	upx
behavioral2/files/0x00070000000233dc-87.dat	upx
behavioral2/files/0x00070000000233dd-94.dat	upx
behavioral2/files/0x00070000000233e1-114.dat	upx
behavioral2/files/0x00070000000233e3-124.dat	upx
behavioral2/files/0x00070000000233e5-134.dat	upx
behavioral2/memory/996-457-0x00007FF6772A0000-0x00007FF677691000-memory.dmp	upx
behavioral2/memory/4460-458-0x00007FF6A80C0000-0x00007FF6A84B1000-memory.dmp	upx
behavioral2/memory/3652-459-0x00007FF63C770000-0x00007FF63CB61000-memory.dmp	upx
behavioral2/memory/1624-460-0x00007FF63A880000-0x00007FF63AC71000-memory.dmp	upx
behavioral2/files/0x00070000000233eb-164.dat	upx
behavioral2/files/0x00070000000233ea-159.dat	upx
behavioral2/files/0x00070000000233e9-154.dat	upx
behavioral2/files/0x00070000000233e8-149.dat	upx
behavioral2/files/0x00070000000233e7-144.dat	upx
behavioral2/files/0x00070000000233e6-139.dat	upx
behavioral2/files/0x00070000000233e4-129.dat	upx
behavioral2/files/0x00070000000233e2-119.dat	upx
behavioral2/files/0x00070000000233e0-109.dat	upx
behavioral2/files/0x00070000000233df-104.dat	upx
behavioral2/files/0x00070000000233de-99.dat	upx
behavioral2/memory/4228-461-0x00007FF626FE0000-0x00007FF6273D1000-memory.dmp	upx
behavioral2/files/0x00070000000233db-84.dat	upx
behavioral2/memory/3968-462-0x00007FF6E0BB0000-0x00007FF6E0FA1000-memory.dmp	upx
behavioral2/memory/3892-463-0x00007FF7FD830000-0x00007FF7FDC21000-memory.dmp	upx
behavioral2/files/0x00070000000233d8-69.dat	upx
behavioral2/files/0x00070000000233d4-49.dat	upx
behavioral2/files/0x00070000000233d0-34.dat	upx
behavioral2/files/0x00070000000233cf-29.dat	upx
behavioral2/memory/956-22-0x00007FF6B7F20000-0x00007FF6B8311000-memory.dmp	upx
behavioral2/files/0x00080000000233c9-13.dat	upx
behavioral2/memory/1492-12-0x00007FF78CD30000-0x00007FF78D121000-memory.dmp	upx
behavioral2/files/0x0006000000023276-10.dat	upx
behavioral2/memory/2236-7-0x00007FF769510000-0x00007FF769901000-memory.dmp	upx
behavioral2/memory/2528-464-0x00007FF6D00C0000-0x00007FF6D04B1000-memory.dmp	upx
behavioral2/memory/3456-471-0x00007FF65F8E0000-0x00007FF65FCD1000-memory.dmp	upx
behavioral2/memory/2620-482-0x00007FF72ADA0000-0x00007FF72B191000-memory.dmp	upx
behavioral2/memory/2136-480-0x00007FF7605E0000-0x00007FF7609D1000-memory.dmp	upx
behavioral2/memory/3616-487-0x00007FF73A890000-0x00007FF73AC81000-memory.dmp	upx
behavioral2/memory/1500-479-0x00007FF619500000-0x00007FF6198F1000-memory.dmp	upx
behavioral2/memory/2720-493-0x00007FF673BB0000-0x00007FF673FA1000-memory.dmp	upx
behavioral2/memory/3988-495-0x00007FF727EF0000-0x00007FF7282E1000-memory.dmp	upx
behavioral2/memory/3044-497-0x00007FF63AAA0000-0x00007FF63AE91000-memory.dmp	upx
behavioral2/memory/4548-503-0x00007FF786F20000-0x00007FF787311000-memory.dmp	upx
behavioral2/memory/2196-544-0x00007FF77B510000-0x00007FF77B901000-memory.dmp	upx
behavioral2/memory/1804-548-0x00007FF79E3B0000-0x00007FF79E7A1000-memory.dmp	upx
behavioral2/memory/3368-474-0x00007FF7C59C0000-0x00007FF7C5DB1000-memory.dmp	upx
behavioral2/memory/2560-467-0x00007FF642310000-0x00007FF642701000-memory.dmp	upx
behavioral2/memory/4136-1990-0x00007FF6E4E90000-0x00007FF6E5281000-memory.dmp	upx
behavioral2/memory/1492-2023-0x00007FF78CD30000-0x00007FF78D121000-memory.dmp	upx
behavioral2/memory/2236-2029-0x00007FF769510000-0x00007FF769901000-memory.dmp	upx
behavioral2/memory/1492-2033-0x00007FF78CD30000-0x00007FF78D121000-memory.dmp	upx
behavioral2/memory/956-2032-0x00007FF6B7F20000-0x00007FF6B8311000-memory.dmp	upx
behavioral2/memory/996-2035-0x00007FF6772A0000-0x00007FF677691000-memory.dmp	upx
behavioral2/memory/4460-2037-0x00007FF6A80C0000-0x00007FF6A84B1000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\vgRIqdj.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\nBvuziJ.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\XHUCWiT.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\cINoqkN.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\ASpWSwD.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\yLwXuvA.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\yaJUtJY.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\PuXGdeA.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\DYClMpw.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\diZxlul.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\OQDzETj.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\BxBKeEQ.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\RRZlXIo.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\lakeNwL.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\LKjYeRC.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\pJzEVfo.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\bbKlqIN.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\JfFrMgx.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\maMeIYQ.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\pQlTXrU.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\AKIXqmV.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\XXUKvXT.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\IoXvHbV.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\nzdnjiU.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\JHSgUMd.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\GHOvnyF.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\uuFtmqh.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\Owstbcm.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\hKuEjyN.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\gLyzyxl.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\ZuRcVgP.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\OszPrmQ.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\fHMxnnI.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\ebagoNi.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\vPuyruz.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\aSGakmO.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\UMjqlZH.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\pivPjye.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\MLGXSIE.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\VkDsevD.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\ToyDkFV.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\XZynmCW.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\LUMPZNh.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\sMiXEzQ.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\WAVjTUV.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\wXSDEXM.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\kByoMqI.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\ILRZcOy.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\IrVIvmZ.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\KeKwQMv.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\tUbphwz.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\FwkovPU.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\tmIgUPd.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\iQhnfHb.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\eIDRyaE.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\jizlgFw.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\DQxnGKl.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\Miwlidw.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\QuhZkqG.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\byXwpTu.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\FnUkLMn.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\qvdixCF.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\tfXULRW.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
File created	C:\Windows\System32\rSaHIsK.exe	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 2236	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	82
PID 4136 wrote to memory of 2236	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	82
PID 4136 wrote to memory of 1492	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	83
PID 4136 wrote to memory of 1492	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	83
PID 4136 wrote to memory of 956	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	84
PID 4136 wrote to memory of 956	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	84
PID 4136 wrote to memory of 996	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	85
PID 4136 wrote to memory of 996	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	85
PID 4136 wrote to memory of 4460	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	86
PID 4136 wrote to memory of 4460	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	86
PID 4136 wrote to memory of 3652	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	87
PID 4136 wrote to memory of 3652	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	87
PID 4136 wrote to memory of 1624	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	88
PID 4136 wrote to memory of 1624	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	88
PID 4136 wrote to memory of 4228	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	89
PID 4136 wrote to memory of 4228	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	89
PID 4136 wrote to memory of 3968	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	90
PID 4136 wrote to memory of 3968	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	90
PID 4136 wrote to memory of 3892	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	91
PID 4136 wrote to memory of 3892	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	91
PID 4136 wrote to memory of 2528	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	92
PID 4136 wrote to memory of 2528	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	92
PID 4136 wrote to memory of 2560	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	93
PID 4136 wrote to memory of 2560	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	93
PID 4136 wrote to memory of 3456	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	94
PID 4136 wrote to memory of 3456	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	94
PID 4136 wrote to memory of 3368	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	95
PID 4136 wrote to memory of 3368	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	95
PID 4136 wrote to memory of 1500	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	96
PID 4136 wrote to memory of 1500	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	96
PID 4136 wrote to memory of 2136	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	97
PID 4136 wrote to memory of 2136	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	97
PID 4136 wrote to memory of 2620	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	98
PID 4136 wrote to memory of 2620	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	98
PID 4136 wrote to memory of 3616	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	99
PID 4136 wrote to memory of 3616	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	99
PID 4136 wrote to memory of 2720	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	100
PID 4136 wrote to memory of 2720	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	100
PID 4136 wrote to memory of 3988	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	101
PID 4136 wrote to memory of 3988	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	101
PID 4136 wrote to memory of 3044	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	102
PID 4136 wrote to memory of 3044	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	102
PID 4136 wrote to memory of 4548	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	103
PID 4136 wrote to memory of 4548	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	103
PID 4136 wrote to memory of 2196	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	104
PID 4136 wrote to memory of 2196	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	104
PID 4136 wrote to memory of 1804	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	105
PID 4136 wrote to memory of 1804	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	105
PID 4136 wrote to memory of 376	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	106
PID 4136 wrote to memory of 376	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	106
PID 4136 wrote to memory of 1620	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	107
PID 4136 wrote to memory of 1620	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	107
PID 4136 wrote to memory of 4584	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	108
PID 4136 wrote to memory of 4584	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	108
PID 4136 wrote to memory of 620	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	109
PID 4136 wrote to memory of 620	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	109
PID 4136 wrote to memory of 380	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	110
PID 4136 wrote to memory of 380	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	110
PID 4136 wrote to memory of 4260	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	111
PID 4136 wrote to memory of 4260	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	111
PID 4136 wrote to memory of 1740	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	112
PID 4136 wrote to memory of 1740	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	112
PID 4136 wrote to memory of 336	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	113
PID 4136 wrote to memory of 336	4136	96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe	113

C:\Users\Admin\AppData\Local\Temp\96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\96a3350e8f48517a249df902a219b140_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\System32\bSqFAln.exe
  C:\Windows\System32\bSqFAln.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System32\qWvWjcK.exe
  C:\Windows\System32\qWvWjcK.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System32\Hnegxab.exe
  C:\Windows\System32\Hnegxab.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System32\cVVJZLd.exe
  C:\Windows\System32\cVVJZLd.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System32\DSKEISs.exe
  C:\Windows\System32\DSKEISs.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System32\FseYeyY.exe
  C:\Windows\System32\FseYeyY.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System32\gLnLyWe.exe
  C:\Windows\System32\gLnLyWe.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System32\PUsdnhm.exe
  C:\Windows\System32\PUsdnhm.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System32\JjCEzkH.exe
  C:\Windows\System32\JjCEzkH.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System32\XsVfvAa.exe
  C:\Windows\System32\XsVfvAa.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System32\yRJSXAC.exe
  C:\Windows\System32\yRJSXAC.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System32\NkeCnts.exe
  C:\Windows\System32\NkeCnts.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System32\TamiXBm.exe
  C:\Windows\System32\TamiXBm.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System32\uMARSvq.exe
  C:\Windows\System32\uMARSvq.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System32\DwsXzZD.exe
  C:\Windows\System32\DwsXzZD.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System32\ZqWwCoR.exe
  C:\Windows\System32\ZqWwCoR.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System32\umyncNu.exe
  C:\Windows\System32\umyncNu.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System32\bVVMgMc.exe
  C:\Windows\System32\bVVMgMc.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System32\TfAjUxd.exe
  C:\Windows\System32\TfAjUxd.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System32\mqAobdW.exe
  C:\Windows\System32\mqAobdW.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System32\pwQWbgJ.exe
  C:\Windows\System32\pwQWbgJ.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System32\ASpWSwD.exe
  C:\Windows\System32\ASpWSwD.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System32\MrBPpqr.exe
  C:\Windows\System32\MrBPpqr.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System32\fByHPIx.exe
  C:\Windows\System32\fByHPIx.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System32\tGgNtrx.exe
  C:\Windows\System32\tGgNtrx.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System32\stdLGgz.exe
  C:\Windows\System32\stdLGgz.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System32\VdmlJuN.exe
  C:\Windows\System32\VdmlJuN.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System32\fXDHMrA.exe
  C:\Windows\System32\fXDHMrA.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System32\TPiLNhx.exe
  C:\Windows\System32\TPiLNhx.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System32\ykuNUnV.exe
  C:\Windows\System32\ykuNUnV.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System32\QaIrfJq.exe
  C:\Windows\System32\QaIrfJq.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System32\kDfDJOF.exe
  C:\Windows\System32\kDfDJOF.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System32\NjTmvFh.exe
  C:\Windows\System32\NjTmvFh.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System32\cTOVwkS.exe
  C:\Windows\System32\cTOVwkS.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System32\rqxMkPU.exe
  C:\Windows\System32\rqxMkPU.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System32\WUojBHd.exe
  C:\Windows\System32\WUojBHd.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System32\VSVpGuu.exe
  C:\Windows\System32\VSVpGuu.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System32\WStnJpZ.exe
  C:\Windows\System32\WStnJpZ.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System32\VcfjRqW.exe
  C:\Windows\System32\VcfjRqW.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System32\UpccbGk.exe
  C:\Windows\System32\UpccbGk.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System32\WvazRvF.exe
  C:\Windows\System32\WvazRvF.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System32\RPvJwOT.exe
  C:\Windows\System32\RPvJwOT.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System32\YnDzdRZ.exe
  C:\Windows\System32\YnDzdRZ.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System32\PlqbAvk.exe
  C:\Windows\System32\PlqbAvk.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System32\ZOXxCmc.exe
  C:\Windows\System32\ZOXxCmc.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System32\uvFXsfN.exe
  C:\Windows\System32\uvFXsfN.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System32\PJqbLPM.exe
  C:\Windows\System32\PJqbLPM.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System32\CSAJmKR.exe
  C:\Windows\System32\CSAJmKR.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System32\rCVnXVX.exe
  C:\Windows\System32\rCVnXVX.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System32\KlHYDEW.exe
  C:\Windows\System32\KlHYDEW.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System32\MzftCRB.exe
  C:\Windows\System32\MzftCRB.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System32\cxAGIVV.exe
  C:\Windows\System32\cxAGIVV.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System32\CFhGKUh.exe
  C:\Windows\System32\CFhGKUh.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System32\kQroxOT.exe
  C:\Windows\System32\kQroxOT.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System32\RJZEdZW.exe
  C:\Windows\System32\RJZEdZW.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System32\ZRdDJgE.exe
  C:\Windows\System32\ZRdDJgE.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System32\YqmiqWL.exe
  C:\Windows\System32\YqmiqWL.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System32\MAVfrGk.exe
  C:\Windows\System32\MAVfrGk.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System32\pQlTXrU.exe
  C:\Windows\System32\pQlTXrU.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System32\SkoYMKV.exe
  C:\Windows\System32\SkoYMKV.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System32\ZyWrBRZ.exe
  C:\Windows\System32\ZyWrBRZ.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System32\ioTUjET.exe
  C:\Windows\System32\ioTUjET.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System32\yPVRouR.exe
  C:\Windows\System32\yPVRouR.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System32\sYmKWFG.exe
  C:\Windows\System32\sYmKWFG.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System32\pPHdAFV.exe
  C:\Windows\System32\pPHdAFV.exe
  2⤵
  PID:1372
- C:\Windows\System32\gDsXedC.exe
  C:\Windows\System32\gDsXedC.exe
  2⤵
  PID:3620
- C:\Windows\System32\gyCPQXi.exe
  C:\Windows\System32\gyCPQXi.exe
  2⤵
  PID:1388
- C:\Windows\System32\gObDKKH.exe
  C:\Windows\System32\gObDKKH.exe
  2⤵
  PID:2384
- C:\Windows\System32\TFlIvQM.exe
  C:\Windows\System32\TFlIvQM.exe
  2⤵
  PID:3472
- C:\Windows\System32\RnDoSjU.exe
  C:\Windows\System32\RnDoSjU.exe
  2⤵
  PID:772
- C:\Windows\System32\kTqptRX.exe
  C:\Windows\System32\kTqptRX.exe
  2⤵
  PID:2124
- C:\Windows\System32\CUNXWVQ.exe
  C:\Windows\System32\CUNXWVQ.exe
  2⤵
  PID:3752
- C:\Windows\System32\QXLZZjl.exe
  C:\Windows\System32\QXLZZjl.exe
  2⤵
  PID:2156
- C:\Windows\System32\lHtTScs.exe
  C:\Windows\System32\lHtTScs.exe
  2⤵
  PID:1644
- C:\Windows\System32\qIXlOJT.exe
  C:\Windows\System32\qIXlOJT.exe
  2⤵
  PID:1488
- C:\Windows\System32\fkguGwV.exe
  C:\Windows\System32\fkguGwV.exe
  2⤵
  PID:3152
- C:\Windows\System32\spPKdGf.exe
  C:\Windows\System32\spPKdGf.exe
  2⤵
  PID:4348
- C:\Windows\System32\vtTQIuA.exe
  C:\Windows\System32\vtTQIuA.exe
  2⤵
  PID:4652
- C:\Windows\System32\nzdnjiU.exe
  C:\Windows\System32\nzdnjiU.exe
  2⤵
  PID:1260
- C:\Windows\System32\ZMEtfqS.exe
  C:\Windows\System32\ZMEtfqS.exe
  2⤵
  PID:3020
- C:\Windows\System32\gTjXaeE.exe
  C:\Windows\System32\gTjXaeE.exe
  2⤵
  PID:1768
- C:\Windows\System32\QuhZkqG.exe
  C:\Windows\System32\QuhZkqG.exe
  2⤵
  PID:3460
- C:\Windows\System32\JcVLGwD.exe
  C:\Windows\System32\JcVLGwD.exe
  2⤵
  PID:4508
- C:\Windows\System32\QQtIVPd.exe
  C:\Windows\System32\QQtIVPd.exe
  2⤵
  PID:3552
- C:\Windows\System32\OeVRqxe.exe
  C:\Windows\System32\OeVRqxe.exe
  2⤵
  PID:3644
- C:\Windows\System32\pGuFAtW.exe
  C:\Windows\System32\pGuFAtW.exe
  2⤵
  PID:3144
- C:\Windows\System32\tXZxIMA.exe
  C:\Windows\System32\tXZxIMA.exe
  2⤵
  PID:4860
- C:\Windows\System32\RRZlXIo.exe
  C:\Windows\System32\RRZlXIo.exe
  2⤵
  PID:2028
- C:\Windows\System32\mfaRjoO.exe
  C:\Windows\System32\mfaRjoO.exe
  2⤵
  PID:1524
- C:\Windows\System32\luhIjDY.exe
  C:\Windows\System32\luhIjDY.exe
  2⤵
  PID:4380
- C:\Windows\System32\Miwlidw.exe
  C:\Windows\System32\Miwlidw.exe
  2⤵
  PID:5140
- C:\Windows\System32\OJezbsp.exe
  C:\Windows\System32\OJezbsp.exe
  2⤵
  PID:5168
- C:\Windows\System32\bCKvorH.exe
  C:\Windows\System32\bCKvorH.exe
  2⤵
  PID:5196
- C:\Windows\System32\EHvIWPy.exe
  C:\Windows\System32\EHvIWPy.exe
  2⤵
  PID:5224
- C:\Windows\System32\biaOWyH.exe
  C:\Windows\System32\biaOWyH.exe
  2⤵
  PID:5252
- C:\Windows\System32\tQmyuQP.exe
  C:\Windows\System32\tQmyuQP.exe
  2⤵
  PID:5280
- C:\Windows\System32\oaGfeVb.exe
  C:\Windows\System32\oaGfeVb.exe
  2⤵
  PID:5308
- C:\Windows\System32\WfjADlS.exe
  C:\Windows\System32\WfjADlS.exe
  2⤵
  PID:5336
- C:\Windows\System32\bcQgcvs.exe
  C:\Windows\System32\bcQgcvs.exe
  2⤵
  PID:5364
- C:\Windows\System32\JCdhZRj.exe
  C:\Windows\System32\JCdhZRj.exe
  2⤵
  PID:5392
- C:\Windows\System32\WqaVrdV.exe
  C:\Windows\System32\WqaVrdV.exe
  2⤵
  PID:5420
- C:\Windows\System32\cgkzgdx.exe
  C:\Windows\System32\cgkzgdx.exe
  2⤵
  PID:5448
- C:\Windows\System32\JnrzujN.exe
  C:\Windows\System32\JnrzujN.exe
  2⤵
  PID:5476
- C:\Windows\System32\LntcfhS.exe
  C:\Windows\System32\LntcfhS.exe
  2⤵
  PID:5504
- C:\Windows\System32\aLreIgs.exe
  C:\Windows\System32\aLreIgs.exe
  2⤵
  PID:5532
- C:\Windows\System32\MUZdVQI.exe
  C:\Windows\System32\MUZdVQI.exe
  2⤵
  PID:5572
- C:\Windows\System32\oXLNKoM.exe
  C:\Windows\System32\oXLNKoM.exe
  2⤵
  PID:5588
- C:\Windows\System32\dCdChHn.exe
  C:\Windows\System32\dCdChHn.exe
  2⤵
  PID:5616
- C:\Windows\System32\dTQKwXG.exe
  C:\Windows\System32\dTQKwXG.exe
  2⤵
  PID:5644
- C:\Windows\System32\sMJYnXJ.exe
  C:\Windows\System32\sMJYnXJ.exe
  2⤵
  PID:5672
- C:\Windows\System32\IrVIvmZ.exe
  C:\Windows\System32\IrVIvmZ.exe
  2⤵
  PID:5700
- C:\Windows\System32\nZzlhax.exe
  C:\Windows\System32\nZzlhax.exe
  2⤵
  PID:5728
- C:\Windows\System32\aFxXURw.exe
  C:\Windows\System32\aFxXURw.exe
  2⤵
  PID:5756
- C:\Windows\System32\OszPrmQ.exe
  C:\Windows\System32\OszPrmQ.exe
  2⤵
  PID:5784
- C:\Windows\System32\pjrnsNH.exe
  C:\Windows\System32\pjrnsNH.exe
  2⤵
  PID:5812
- C:\Windows\System32\dRHFBlA.exe
  C:\Windows\System32\dRHFBlA.exe
  2⤵
  PID:5840
- C:\Windows\System32\FwkovPU.exe
  C:\Windows\System32\FwkovPU.exe
  2⤵
  PID:5868
- C:\Windows\System32\LNrvnul.exe
  C:\Windows\System32\LNrvnul.exe
  2⤵
  PID:5896
- C:\Windows\System32\uJloVHQ.exe
  C:\Windows\System32\uJloVHQ.exe
  2⤵
  PID:5924
- C:\Windows\System32\SUICCAz.exe
  C:\Windows\System32\SUICCAz.exe
  2⤵
  PID:5952
- C:\Windows\System32\lakeNwL.exe
  C:\Windows\System32\lakeNwL.exe
  2⤵
  PID:5980
- C:\Windows\System32\rKGzuyz.exe
  C:\Windows\System32\rKGzuyz.exe
  2⤵
  PID:6008
- C:\Windows\System32\CJduSAG.exe
  C:\Windows\System32\CJduSAG.exe
  2⤵
  PID:6036
- C:\Windows\System32\dFAugXL.exe
  C:\Windows\System32\dFAugXL.exe
  2⤵
  PID:6064
- C:\Windows\System32\sMiXEzQ.exe
  C:\Windows\System32\sMiXEzQ.exe
  2⤵
  PID:6092
- C:\Windows\System32\USJROhP.exe
  C:\Windows\System32\USJROhP.exe
  2⤵
  PID:6120
- C:\Windows\System32\rYZtWuC.exe
  C:\Windows\System32\rYZtWuC.exe
  2⤵
  PID:4052
- C:\Windows\System32\LKjYeRC.exe
  C:\Windows\System32\LKjYeRC.exe
  2⤵
  PID:4972
- C:\Windows\System32\zwUONob.exe
  C:\Windows\System32\zwUONob.exe
  2⤵
  PID:4824
- C:\Windows\System32\uqAnhur.exe
  C:\Windows\System32\uqAnhur.exe
  2⤵
  PID:1444
- C:\Windows\System32\LKxIkPO.exe
  C:\Windows\System32\LKxIkPO.exe
  2⤵
  PID:5304
- C:\Windows\System32\YyXaNTc.exe
  C:\Windows\System32\YyXaNTc.exe
  2⤵
  PID:5360
- C:\Windows\System32\BpIgexd.exe
  C:\Windows\System32\BpIgexd.exe
  2⤵
  PID:5404
- C:\Windows\System32\CTcJomv.exe
  C:\Windows\System32\CTcJomv.exe
  2⤵
  PID:5436
- C:\Windows\System32\AtWnfHf.exe
  C:\Windows\System32\AtWnfHf.exe
  2⤵
  PID:5548
- C:\Windows\System32\jxZRCUC.exe
  C:\Windows\System32\jxZRCUC.exe
  2⤵
  PID:5668
- C:\Windows\System32\sbkyOwi.exe
  C:\Windows\System32\sbkyOwi.exe
  2⤵
  PID:4956
- C:\Windows\System32\BxBKeEQ.exe
  C:\Windows\System32\BxBKeEQ.exe
  2⤵
  PID:5752
- C:\Windows\System32\IBlThat.exe
  C:\Windows\System32\IBlThat.exe
  2⤵
  PID:5772
- C:\Windows\System32\ZJHPkdB.exe
  C:\Windows\System32\ZJHPkdB.exe
  2⤵
  PID:3860
- C:\Windows\System32\kpfEzjV.exe
  C:\Windows\System32\kpfEzjV.exe
  2⤵
  PID:5884
- C:\Windows\System32\tmIgUPd.exe
  C:\Windows\System32\tmIgUPd.exe
  2⤵
  PID:2128
- C:\Windows\System32\HPXIiwq.exe
  C:\Windows\System32\HPXIiwq.exe
  2⤵
  PID:5012
- C:\Windows\System32\XfMMZAJ.exe
  C:\Windows\System32\XfMMZAJ.exe
  2⤵
  PID:6048
- C:\Windows\System32\KQBjKJB.exe
  C:\Windows\System32\KQBjKJB.exe
  2⤵
  PID:3004
- C:\Windows\System32\ENIpEoA.exe
  C:\Windows\System32\ENIpEoA.exe
  2⤵
  PID:6132
- C:\Windows\System32\lHBjpLa.exe
  C:\Windows\System32\lHBjpLa.exe
  2⤵
  PID:3560
- C:\Windows\System32\rqvAQeX.exe
  C:\Windows\System32\rqvAQeX.exe
  2⤵
  PID:2984
- C:\Windows\System32\KCxbRuH.exe
  C:\Windows\System32\KCxbRuH.exe
  2⤵
  PID:3492
- C:\Windows\System32\dpAVVhc.exe
  C:\Windows\System32\dpAVVhc.exe
  2⤵
  PID:5208
- C:\Windows\System32\yDGvlTv.exe
  C:\Windows\System32\yDGvlTv.exe
  2⤵
  PID:388
- C:\Windows\System32\hmUeUkX.exe
  C:\Windows\System32\hmUeUkX.exe
  2⤵
  PID:5052
- C:\Windows\System32\iQhnfHb.exe
  C:\Windows\System32\iQhnfHb.exe
  2⤵
  PID:5220
- C:\Windows\System32\ltdwsRq.exe
  C:\Windows\System32\ltdwsRq.exe
  2⤵
  PID:5712
- C:\Windows\System32\WAVjTUV.exe
  C:\Windows\System32\WAVjTUV.exe
  2⤵
  PID:3148
- C:\Windows\System32\wWGgkLV.exe
  C:\Windows\System32\wWGgkLV.exe
  2⤵
  PID:6032
- C:\Windows\System32\JzJwPML.exe
  C:\Windows\System32\JzJwPML.exe
  2⤵
  PID:5948
- C:\Windows\System32\vgRIqdj.exe
  C:\Windows\System32\vgRIqdj.exe
  2⤵
  PID:1192
- C:\Windows\System32\XCYCvZe.exe
  C:\Windows\System32\XCYCvZe.exe
  2⤵
  PID:5240
- C:\Windows\System32\FvVYgBF.exe
  C:\Windows\System32\FvVYgBF.exe
  2⤵
  PID:5488
- C:\Windows\System32\sxWoyyx.exe
  C:\Windows\System32\sxWoyyx.exe
  2⤵
  PID:5268
- C:\Windows\System32\eIDRyaE.exe
  C:\Windows\System32\eIDRyaE.exe
  2⤵
  PID:768
- C:\Windows\System32\BfPjbfw.exe
  C:\Windows\System32\BfPjbfw.exe
  2⤵
  PID:2956
- C:\Windows\System32\LQXojMs.exe
  C:\Windows\System32\LQXojMs.exe
  2⤵
  PID:5320
- C:\Windows\System32\JHSgUMd.exe
  C:\Windows\System32\JHSgUMd.exe
  2⤵
  PID:2564
- C:\Windows\System32\HpcAtfH.exe
  C:\Windows\System32\HpcAtfH.exe
  2⤵
  PID:6052
- C:\Windows\System32\ligctBu.exe
  C:\Windows\System32\ligctBu.exe
  2⤵
  PID:5584
- C:\Windows\System32\PDAmykN.exe
  C:\Windows\System32\PDAmykN.exe
  2⤵
  PID:6168
- C:\Windows\System32\SDeqeCz.exe
  C:\Windows\System32\SDeqeCz.exe
  2⤵
  PID:6188
- C:\Windows\System32\pivPjye.exe
  C:\Windows\System32\pivPjye.exe
  2⤵
  PID:6204
- C:\Windows\System32\nxjqobB.exe
  C:\Windows\System32\nxjqobB.exe
  2⤵
  PID:6260
- C:\Windows\System32\PqclXNl.exe
  C:\Windows\System32\PqclXNl.exe
  2⤵
  PID:6288
- C:\Windows\System32\wKjxCno.exe
  C:\Windows\System32\wKjxCno.exe
  2⤵
  PID:6316
- C:\Windows\System32\dJWyoUg.exe
  C:\Windows\System32\dJWyoUg.exe
  2⤵
  PID:6344
- C:\Windows\System32\OkGJwYi.exe
  C:\Windows\System32\OkGJwYi.exe
  2⤵
  PID:6372
- C:\Windows\System32\KSVAVOW.exe
  C:\Windows\System32\KSVAVOW.exe
  2⤵
  PID:6392
- C:\Windows\System32\GHOvnyF.exe
  C:\Windows\System32\GHOvnyF.exe
  2⤵
  PID:6412
- C:\Windows\System32\FqOgHzD.exe
  C:\Windows\System32\FqOgHzD.exe
  2⤵
  PID:6444
- C:\Windows\System32\sRyDzjf.exe
  C:\Windows\System32\sRyDzjf.exe
  2⤵
  PID:6464
- C:\Windows\System32\lMUCnry.exe
  C:\Windows\System32\lMUCnry.exe
  2⤵
  PID:6480
- C:\Windows\System32\lRqOQqU.exe
  C:\Windows\System32\lRqOQqU.exe
  2⤵
  PID:6524
- C:\Windows\System32\NCPDjsn.exe
  C:\Windows\System32\NCPDjsn.exe
  2⤵
  PID:6540
- C:\Windows\System32\LZzhrvR.exe
  C:\Windows\System32\LZzhrvR.exe
  2⤵
  PID:6584
- C:\Windows\System32\dIKNiYs.exe
  C:\Windows\System32\dIKNiYs.exe
  2⤵
  PID:6616
- C:\Windows\System32\SPsBygt.exe
  C:\Windows\System32\SPsBygt.exe
  2⤵
  PID:6632
- C:\Windows\System32\PuXGdeA.exe
  C:\Windows\System32\PuXGdeA.exe
  2⤵
  PID:6656
- C:\Windows\System32\gMgAmFp.exe
  C:\Windows\System32\gMgAmFp.exe
  2⤵
  PID:6704
- C:\Windows\System32\witZSbp.exe
  C:\Windows\System32\witZSbp.exe
  2⤵
  PID:6720
- C:\Windows\System32\RLgeDUY.exe
  C:\Windows\System32\RLgeDUY.exe
  2⤵
  PID:6740
- C:\Windows\System32\PUXcaEZ.exe
  C:\Windows\System32\PUXcaEZ.exe
  2⤵
  PID:6772
- C:\Windows\System32\ZmCNmMt.exe
  C:\Windows\System32\ZmCNmMt.exe
  2⤵
  PID:6792
- C:\Windows\System32\HCjqpMU.exe
  C:\Windows\System32\HCjqpMU.exe
  2⤵
  PID:6816
- C:\Windows\System32\pJzEVfo.exe
  C:\Windows\System32\pJzEVfo.exe
  2⤵
  PID:6860
- C:\Windows\System32\NOIKoqN.exe
  C:\Windows\System32\NOIKoqN.exe
  2⤵
  PID:6904
- C:\Windows\System32\BwbNnnj.exe
  C:\Windows\System32\BwbNnnj.exe
  2⤵
  PID:6924
- C:\Windows\System32\RlXtyNR.exe
  C:\Windows\System32\RlXtyNR.exe
  2⤵
  PID:6944
- C:\Windows\System32\VcOBaqT.exe
  C:\Windows\System32\VcOBaqT.exe
  2⤵
  PID:6968
- C:\Windows\System32\nqfmgbt.exe
  C:\Windows\System32\nqfmgbt.exe
  2⤵
  PID:6988
- C:\Windows\System32\UwrKriK.exe
  C:\Windows\System32\UwrKriK.exe
  2⤵
  PID:7016
- C:\Windows\System32\LYgxlGm.exe
  C:\Windows\System32\LYgxlGm.exe
  2⤵
  PID:7056
- C:\Windows\System32\vOLAAju.exe
  C:\Windows\System32\vOLAAju.exe
  2⤵
  PID:7100
- C:\Windows\System32\DobrtcR.exe
  C:\Windows\System32\DobrtcR.exe
  2⤵
  PID:7128
- C:\Windows\System32\skBLtLM.exe
  C:\Windows\System32\skBLtLM.exe
  2⤵
  PID:7144
- C:\Windows\System32\TErkvgt.exe
  C:\Windows\System32\TErkvgt.exe
  2⤵
  PID:6156
- C:\Windows\System32\JHilVHI.exe
  C:\Windows\System32\JHilVHI.exe
  2⤵
  PID:6180
- C:\Windows\System32\evZIrSq.exe
  C:\Windows\System32\evZIrSq.exe
  2⤵
  PID:6280
- C:\Windows\System32\uemVfcO.exe
  C:\Windows\System32\uemVfcO.exe
  2⤵
  PID:6356
- C:\Windows\System32\DYQfGxI.exe
  C:\Windows\System32\DYQfGxI.exe
  2⤵
  PID:6404
- C:\Windows\System32\IMEAgpR.exe
  C:\Windows\System32\IMEAgpR.exe
  2⤵
  PID:6488
- C:\Windows\System32\ONzbcdk.exe
  C:\Windows\System32\ONzbcdk.exe
  2⤵
  PID:6548
- C:\Windows\System32\DoUNfGD.exe
  C:\Windows\System32\DoUNfGD.exe
  2⤵
  PID:6596
- C:\Windows\System32\pseImCw.exe
  C:\Windows\System32\pseImCw.exe
  2⤵
  PID:6624
- C:\Windows\System32\jQlAErO.exe
  C:\Windows\System32\jQlAErO.exe
  2⤵
  PID:6736
- C:\Windows\System32\WAXlsVV.exe
  C:\Windows\System32\WAXlsVV.exe
  2⤵
  PID:6800
- C:\Windows\System32\rCxCQri.exe
  C:\Windows\System32\rCxCQri.exe
  2⤵
  PID:6884
- C:\Windows\System32\TpWGxss.exe
  C:\Windows\System32\TpWGxss.exe
  2⤵
  PID:6912
- C:\Windows\System32\nwZBxjD.exe
  C:\Windows\System32\nwZBxjD.exe
  2⤵
  PID:6960
- C:\Windows\System32\mxzWmCt.exe
  C:\Windows\System32\mxzWmCt.exe
  2⤵
  PID:7108
- C:\Windows\System32\lYGBpmm.exe
  C:\Windows\System32\lYGBpmm.exe
  2⤵
  PID:6200
- C:\Windows\System32\XKXuXfI.exe
  C:\Windows\System32\XKXuXfI.exe
  2⤵
  PID:6244
- C:\Windows\System32\xtXZuuz.exe
  C:\Windows\System32\xtXZuuz.exe
  2⤵
  PID:6408
- C:\Windows\System32\NSsoYpo.exe
  C:\Windows\System32\NSsoYpo.exe
  2⤵
  PID:6536
- C:\Windows\System32\nBvuziJ.exe
  C:\Windows\System32\nBvuziJ.exe
  2⤵
  PID:6680
- C:\Windows\System32\TIOxpDF.exe
  C:\Windows\System32\TIOxpDF.exe
  2⤵
  PID:1152
- C:\Windows\System32\oTsypUi.exe
  C:\Windows\System32\oTsypUi.exe
  2⤵
  PID:6936
- C:\Windows\System32\JLKmxOj.exe
  C:\Windows\System32\JLKmxOj.exe
  2⤵
  PID:7120
- C:\Windows\System32\esoBnqW.exe
  C:\Windows\System32\esoBnqW.exe
  2⤵
  PID:6184
- C:\Windows\System32\yRXYzhk.exe
  C:\Windows\System32\yRXYzhk.exe
  2⤵
  PID:6688
- C:\Windows\System32\uuFtmqh.exe
  C:\Windows\System32\uuFtmqh.exe
  2⤵
  PID:7140
- C:\Windows\System32\KtyVVKB.exe
  C:\Windows\System32\KtyVVKB.exe
  2⤵
  PID:6648
- C:\Windows\System32\dghRBdz.exe
  C:\Windows\System32\dghRBdz.exe
  2⤵
  PID:7180
- C:\Windows\System32\mZbUGjF.exe
  C:\Windows\System32\mZbUGjF.exe
  2⤵
  PID:7204
- C:\Windows\System32\RahKdtN.exe
  C:\Windows\System32\RahKdtN.exe
  2⤵
  PID:7232
- C:\Windows\System32\gyfIYLV.exe
  C:\Windows\System32\gyfIYLV.exe
  2⤵
  PID:7248
- C:\Windows\System32\QgNGlZj.exe
  C:\Windows\System32\QgNGlZj.exe
  2⤵
  PID:7272
- C:\Windows\System32\hlNckBB.exe
  C:\Windows\System32\hlNckBB.exe
  2⤵
  PID:7296
- C:\Windows\System32\wXSDEXM.exe
  C:\Windows\System32\wXSDEXM.exe
  2⤵
  PID:7316
- C:\Windows\System32\ftNpYTC.exe
  C:\Windows\System32\ftNpYTC.exe
  2⤵
  PID:7372
- C:\Windows\System32\EdXWMvF.exe
  C:\Windows\System32\EdXWMvF.exe
  2⤵
  PID:7392
- C:\Windows\System32\DYClMpw.exe
  C:\Windows\System32\DYClMpw.exe
  2⤵
  PID:7408
- C:\Windows\System32\jizlgFw.exe
  C:\Windows\System32\jizlgFw.exe
  2⤵
  PID:7428
- C:\Windows\System32\GtrvHYD.exe
  C:\Windows\System32\GtrvHYD.exe
  2⤵
  PID:7476
- C:\Windows\System32\pslTWWQ.exe
  C:\Windows\System32\pslTWWQ.exe
  2⤵
  PID:7496
- C:\Windows\System32\KcBvcTD.exe
  C:\Windows\System32\KcBvcTD.exe
  2⤵
  PID:7532
- C:\Windows\System32\ofzNRUh.exe
  C:\Windows\System32\ofzNRUh.exe
  2⤵
  PID:7572
- C:\Windows\System32\czBjNIT.exe
  C:\Windows\System32\czBjNIT.exe
  2⤵
  PID:7600
- C:\Windows\System32\IUSGIwm.exe
  C:\Windows\System32\IUSGIwm.exe
  2⤵
  PID:7632
- C:\Windows\System32\CeUyvnt.exe
  C:\Windows\System32\CeUyvnt.exe
  2⤵
  PID:7648
- C:\Windows\System32\zjsWdtP.exe
  C:\Windows\System32\zjsWdtP.exe
  2⤵
  PID:7680
- C:\Windows\System32\KbjnNFW.exe
  C:\Windows\System32\KbjnNFW.exe
  2⤵
  PID:7716
- C:\Windows\System32\dZOpRJR.exe
  C:\Windows\System32\dZOpRJR.exe
  2⤵
  PID:7732
- C:\Windows\System32\bbKlqIN.exe
  C:\Windows\System32\bbKlqIN.exe
  2⤵
  PID:7772
- C:\Windows\System32\JEisSlB.exe
  C:\Windows\System32\JEisSlB.exe
  2⤵
  PID:7800
- C:\Windows\System32\CxjGpxD.exe
  C:\Windows\System32\CxjGpxD.exe
  2⤵
  PID:7824
- C:\Windows\System32\THwxZTj.exe
  C:\Windows\System32\THwxZTj.exe
  2⤵
  PID:7844
- C:\Windows\System32\aIqWIzq.exe
  C:\Windows\System32\aIqWIzq.exe
  2⤵
  PID:7860
- C:\Windows\System32\rRHOapt.exe
  C:\Windows\System32\rRHOapt.exe
  2⤵
  PID:7908
- C:\Windows\System32\STXYjKV.exe
  C:\Windows\System32\STXYjKV.exe
  2⤵
  PID:7940
- C:\Windows\System32\AwUUPml.exe
  C:\Windows\System32\AwUUPml.exe
  2⤵
  PID:7964
- C:\Windows\System32\mAtlVhZ.exe
  C:\Windows\System32\mAtlVhZ.exe
  2⤵
  PID:8008
- C:\Windows\System32\EAGGhen.exe
  C:\Windows\System32\EAGGhen.exe
  2⤵
  PID:8028
- C:\Windows\System32\wEbXbVX.exe
  C:\Windows\System32\wEbXbVX.exe
  2⤵
  PID:8052
- C:\Windows\System32\EqGdNnA.exe
  C:\Windows\System32\EqGdNnA.exe
  2⤵
  PID:8072
- C:\Windows\System32\pEqHhtX.exe
  C:\Windows\System32\pEqHhtX.exe
  2⤵
  PID:8112
- C:\Windows\System32\fRfrREK.exe
  C:\Windows\System32\fRfrREK.exe
  2⤵
  PID:8136
- C:\Windows\System32\swpXIzv.exe
  C:\Windows\System32\swpXIzv.exe
  2⤵
  PID:8164
- C:\Windows\System32\mIBWMnA.exe
  C:\Windows\System32\mIBWMnA.exe
  2⤵
  PID:8184
- C:\Windows\System32\xkcmRof.exe
  C:\Windows\System32\xkcmRof.exe
  2⤵
  PID:7268
- C:\Windows\System32\pecArnE.exe
  C:\Windows\System32\pecArnE.exe
  2⤵
  PID:7312
- C:\Windows\System32\snApnqZ.exe
  C:\Windows\System32\snApnqZ.exe
  2⤵
  PID:7344
- C:\Windows\System32\yxiTVel.exe
  C:\Windows\System32\yxiTVel.exe
  2⤵
  PID:7460
- C:\Windows\System32\lrffrmx.exe
  C:\Windows\System32\lrffrmx.exe
  2⤵
  PID:7436
- C:\Windows\System32\qcYFMLw.exe
  C:\Windows\System32\qcYFMLw.exe
  2⤵
  PID:7560
- C:\Windows\System32\qPgUEeR.exe
  C:\Windows\System32\qPgUEeR.exe
  2⤵
  PID:7624
- C:\Windows\System32\zuulqYM.exe
  C:\Windows\System32\zuulqYM.exe
  2⤵
  PID:7692
- C:\Windows\System32\AdqxKtd.exe
  C:\Windows\System32\AdqxKtd.exe
  2⤵
  PID:7756
- C:\Windows\System32\fTTHLfW.exe
  C:\Windows\System32\fTTHLfW.exe
  2⤵
  PID:7812
- C:\Windows\System32\HCjutgZ.exe
  C:\Windows\System32\HCjutgZ.exe
  2⤵
  PID:7876
- C:\Windows\System32\sRUeCpQ.exe
  C:\Windows\System32\sRUeCpQ.exe
  2⤵
  PID:7972
- C:\Windows\System32\byXwpTu.exe
  C:\Windows\System32\byXwpTu.exe
  2⤵
  PID:8016
- C:\Windows\System32\gbygFlG.exe
  C:\Windows\System32\gbygFlG.exe
  2⤵
  PID:8040
- C:\Windows\System32\WLJWjvl.exe
  C:\Windows\System32\WLJWjvl.exe
  2⤵
  PID:8144
- C:\Windows\System32\DaRQOMl.exe
  C:\Windows\System32\DaRQOMl.exe
  2⤵
  PID:7176
- C:\Windows\System32\ebagoNi.exe
  C:\Windows\System32\ebagoNi.exe
  2⤵
  PID:7292
- C:\Windows\System32\zpoUxbZ.exe
  C:\Windows\System32\zpoUxbZ.exe
  2⤵
  PID:7444
- C:\Windows\System32\UHsyUzf.exe
  C:\Windows\System32\UHsyUzf.exe
  2⤵
  PID:7544
- C:\Windows\System32\Lzczwkr.exe
  C:\Windows\System32\Lzczwkr.exe
  2⤵
  PID:7584
- C:\Windows\System32\aarcXfO.exe
  C:\Windows\System32\aarcXfO.exe
  2⤵
  PID:7836
- C:\Windows\System32\htexyVV.exe
  C:\Windows\System32\htexyVV.exe
  2⤵
  PID:8108
- C:\Windows\System32\hLxgoKH.exe
  C:\Windows\System32\hLxgoKH.exe
  2⤵
  PID:7308
- C:\Windows\System32\IXNlvqF.exe
  C:\Windows\System32\IXNlvqF.exe
  2⤵
  PID:7424
- C:\Windows\System32\dSrlJIr.exe
  C:\Windows\System32\dSrlJIr.exe
  2⤵
  PID:8172
- C:\Windows\System32\FnUkLMn.exe
  C:\Windows\System32\FnUkLMn.exe
  2⤵
  PID:7388
- C:\Windows\System32\VeEXKbW.exe
  C:\Windows\System32\VeEXKbW.exe
  2⤵
  PID:8200
- C:\Windows\System32\ZmkjczO.exe
  C:\Windows\System32\ZmkjczO.exe
  2⤵
  PID:8248
- C:\Windows\System32\PcBLCxG.exe
  C:\Windows\System32\PcBLCxG.exe
  2⤵
  PID:8268
- C:\Windows\System32\FIabDCe.exe
  C:\Windows\System32\FIabDCe.exe
  2⤵
  PID:8284
- C:\Windows\System32\GveHuku.exe
  C:\Windows\System32\GveHuku.exe
  2⤵
  PID:8304
- C:\Windows\System32\cqSgGTp.exe
  C:\Windows\System32\cqSgGTp.exe
  2⤵
  PID:8328
- C:\Windows\System32\TIWVLWN.exe
  C:\Windows\System32\TIWVLWN.exe
  2⤵
  PID:8372
- C:\Windows\System32\zNkMunF.exe
  C:\Windows\System32\zNkMunF.exe
  2⤵
  PID:8388
- C:\Windows\System32\VRgolYj.exe
  C:\Windows\System32\VRgolYj.exe
  2⤵
  PID:8428
- C:\Windows\System32\OSqQmDc.exe
  C:\Windows\System32\OSqQmDc.exe
  2⤵
  PID:8448
- C:\Windows\System32\WHXhcUD.exe
  C:\Windows\System32\WHXhcUD.exe
  2⤵
  PID:8480
- C:\Windows\System32\vPuyruz.exe
  C:\Windows\System32\vPuyruz.exe
  2⤵
  PID:8496
- C:\Windows\System32\dqgyoRx.exe
  C:\Windows\System32\dqgyoRx.exe
  2⤵
  PID:8520
- C:\Windows\System32\kFioFgX.exe
  C:\Windows\System32\kFioFgX.exe
  2⤵
  PID:8672
- C:\Windows\System32\nXAArAv.exe
  C:\Windows\System32\nXAArAv.exe
  2⤵
  PID:8688
- C:\Windows\System32\NwPAvPv.exe
  C:\Windows\System32\NwPAvPv.exe
  2⤵
  PID:8704
- C:\Windows\System32\XbXYBFX.exe
  C:\Windows\System32\XbXYBFX.exe
  2⤵
  PID:8764
- C:\Windows\System32\xDToSbt.exe
  C:\Windows\System32\xDToSbt.exe
  2⤵
  PID:8792
- C:\Windows\System32\lmdVIOM.exe
  C:\Windows\System32\lmdVIOM.exe
  2⤵
  PID:8808
- C:\Windows\System32\QOWzCfz.exe
  C:\Windows\System32\QOWzCfz.exe
  2⤵
  PID:8848
- C:\Windows\System32\zabzQgI.exe
  C:\Windows\System32\zabzQgI.exe
  2⤵
  PID:8912
- C:\Windows\System32\HAvHtFK.exe
  C:\Windows\System32\HAvHtFK.exe
  2⤵
  PID:8940
- C:\Windows\System32\qvdixCF.exe
  C:\Windows\System32\qvdixCF.exe
  2⤵
  PID:8968
- C:\Windows\System32\mjHtBur.exe
  C:\Windows\System32\mjHtBur.exe
  2⤵
  PID:8996
- C:\Windows\System32\dyvKCnk.exe
  C:\Windows\System32\dyvKCnk.exe
  2⤵
  PID:9012
- C:\Windows\System32\tDXLRAJ.exe
  C:\Windows\System32\tDXLRAJ.exe
  2⤵
  PID:9032
- C:\Windows\System32\HHohEuq.exe
  C:\Windows\System32\HHohEuq.exe
  2⤵
  PID:9060
- C:\Windows\System32\hxNRCcg.exe
  C:\Windows\System32\hxNRCcg.exe
  2⤵
  PID:9084
- C:\Windows\System32\ZWcgCam.exe
  C:\Windows\System32\ZWcgCam.exe
  2⤵
  PID:9124
- C:\Windows\System32\CRcVnph.exe
  C:\Windows\System32\CRcVnph.exe
  2⤵
  PID:9144
- C:\Windows\System32\XHUCWiT.exe
  C:\Windows\System32\XHUCWiT.exe
  2⤵
  PID:9204
- C:\Windows\System32\cBCdtWv.exe
  C:\Windows\System32\cBCdtWv.exe
  2⤵
  PID:7664
- C:\Windows\System32\tCgGrIj.exe
  C:\Windows\System32\tCgGrIj.exe
  2⤵
  PID:8216
- C:\Windows\System32\lkxqRFN.exe
  C:\Windows\System32\lkxqRFN.exe
  2⤵
  PID:8300
- C:\Windows\System32\MyAQpfo.exe
  C:\Windows\System32\MyAQpfo.exe
  2⤵
  PID:8316
- C:\Windows\System32\DzMyYGQ.exe
  C:\Windows\System32\DzMyYGQ.exe
  2⤵
  PID:8380
- C:\Windows\System32\aSGakmO.exe
  C:\Windows\System32\aSGakmO.exe
  2⤵
  PID:8440
- C:\Windows\System32\WCcYAvi.exe
  C:\Windows\System32\WCcYAvi.exe
  2⤵
  PID:8564
- C:\Windows\System32\jDjgdac.exe
  C:\Windows\System32\jDjgdac.exe
  2⤵
  PID:8488
- C:\Windows\System32\brGGZXS.exe
  C:\Windows\System32\brGGZXS.exe
  2⤵
  PID:8612
- C:\Windows\System32\yLwXuvA.exe
  C:\Windows\System32\yLwXuvA.exe
  2⤵
  PID:8644
- C:\Windows\System32\qHDSPGv.exe
  C:\Windows\System32\qHDSPGv.exe
  2⤵
  PID:8580
- C:\Windows\System32\SkJWhSf.exe
  C:\Windows\System32\SkJWhSf.exe
  2⤵
  PID:8700
- C:\Windows\System32\EMqPGyG.exe
  C:\Windows\System32\EMqPGyG.exe
  2⤵
  PID:8748
- C:\Windows\System32\nrBgVGP.exe
  C:\Windows\System32\nrBgVGP.exe
  2⤵
  PID:8840
- C:\Windows\System32\ZebkVWz.exe
  C:\Windows\System32\ZebkVWz.exe
  2⤵
  PID:8884
- C:\Windows\System32\jpnzjVs.exe
  C:\Windows\System32\jpnzjVs.exe
  2⤵
  PID:8984
- C:\Windows\System32\psFcnjy.exe
  C:\Windows\System32\psFcnjy.exe
  2⤵
  PID:9004
- C:\Windows\System32\UUxHUIl.exe
  C:\Windows\System32\UUxHUIl.exe
  2⤵
  PID:9072
- C:\Windows\System32\GINCpVd.exe
  C:\Windows\System32\GINCpVd.exe
  2⤵
  PID:9104
- C:\Windows\System32\FVwZaxi.exe
  C:\Windows\System32\FVwZaxi.exe
  2⤵
  PID:9212
- C:\Windows\System32\JfFrMgx.exe
  C:\Windows\System32\JfFrMgx.exe
  2⤵
  PID:8196
- C:\Windows\System32\YTNelUH.exe
  C:\Windows\System32\YTNelUH.exe
  2⤵
  PID:8468
- C:\Windows\System32\PhEaUyY.exe
  C:\Windows\System32\PhEaUyY.exe
  2⤵
  PID:8680
- C:\Windows\System32\uXVynYL.exe
  C:\Windows\System32\uXVynYL.exe
  2⤵
  PID:8624
- C:\Windows\System32\gGBWMnU.exe
  C:\Windows\System32\gGBWMnU.exe
  2⤵
  PID:8776
- C:\Windows\System32\DQxnGKl.exe
  C:\Windows\System32\DQxnGKl.exe
  2⤵
  PID:8964
- C:\Windows\System32\HCFpYbZ.exe
  C:\Windows\System32\HCFpYbZ.exe
  2⤵
  PID:9112
- C:\Windows\System32\MmPmAkk.exe
  C:\Windows\System32\MmPmAkk.exe
  2⤵
  PID:8260
- C:\Windows\System32\NfWQIDc.exe
  C:\Windows\System32\NfWQIDc.exe
  2⤵
  PID:8408
- C:\Windows\System32\fBSaUBk.exe
  C:\Windows\System32\fBSaUBk.exe
  2⤵
  PID:8876
- C:\Windows\System32\pDdMrUh.exe
  C:\Windows\System32\pDdMrUh.exe
  2⤵
  PID:9168
- C:\Windows\System32\EzQiZod.exe
  C:\Windows\System32\EzQiZod.exe
  2⤵
  PID:8504
- C:\Windows\System32\TutLZev.exe
  C:\Windows\System32\TutLZev.exe
  2⤵
  PID:9040
- C:\Windows\System32\ECsOalC.exe
  C:\Windows\System32\ECsOalC.exe
  2⤵
  PID:9236
- C:\Windows\System32\GLcVhqB.exe
  C:\Windows\System32\GLcVhqB.exe
  2⤵
  PID:9272
- C:\Windows\System32\mZeGmqt.exe
  C:\Windows\System32\mZeGmqt.exe
  2⤵
  PID:9292
- C:\Windows\System32\tfXULRW.exe
  C:\Windows\System32\tfXULRW.exe
  2⤵
  PID:9316
- C:\Windows\System32\ZKxVPND.exe
  C:\Windows\System32\ZKxVPND.exe
  2⤵
  PID:9336
- C:\Windows\System32\NcXhohB.exe
  C:\Windows\System32\NcXhohB.exe
  2⤵
  PID:9356
- C:\Windows\System32\ZPllElc.exe
  C:\Windows\System32\ZPllElc.exe
  2⤵
  PID:9396
- C:\Windows\System32\AVJLcDf.exe
  C:\Windows\System32\AVJLcDf.exe
  2⤵
  PID:9416
- C:\Windows\System32\HdkYJff.exe
  C:\Windows\System32\HdkYJff.exe
  2⤵
  PID:9440
- C:\Windows\System32\EiKrOpG.exe
  C:\Windows\System32\EiKrOpG.exe
  2⤵
  PID:9476
- C:\Windows\System32\ctKUMak.exe
  C:\Windows\System32\ctKUMak.exe
  2⤵
  PID:9516
- C:\Windows\System32\LZWBRko.exe
  C:\Windows\System32\LZWBRko.exe
  2⤵
  PID:9556
- C:\Windows\System32\qYVfEtr.exe
  C:\Windows\System32\qYVfEtr.exe
  2⤵
  PID:9576
- C:\Windows\System32\eczlDui.exe
  C:\Windows\System32\eczlDui.exe
  2⤵
  PID:9592
- C:\Windows\System32\UNYXYzq.exe
  C:\Windows\System32\UNYXYzq.exe
  2⤵
  PID:9620
- C:\Windows\System32\sBeZwkv.exe
  C:\Windows\System32\sBeZwkv.exe
  2⤵
  PID:9640
- C:\Windows\System32\Pzzufcq.exe
  C:\Windows\System32\Pzzufcq.exe
  2⤵
  PID:9668
- C:\Windows\System32\KhAfjkY.exe
  C:\Windows\System32\KhAfjkY.exe
  2⤵
  PID:9688
- C:\Windows\System32\bXwbpls.exe
  C:\Windows\System32\bXwbpls.exe
  2⤵
  PID:9736
- C:\Windows\System32\NdplmPv.exe
  C:\Windows\System32\NdplmPv.exe
  2⤵
  PID:9756
- C:\Windows\System32\yGJOwHk.exe
  C:\Windows\System32\yGJOwHk.exe
  2⤵
  PID:9792
- C:\Windows\System32\IYclkYo.exe
  C:\Windows\System32\IYclkYo.exe
  2⤵
  PID:9836
- C:\Windows\System32\lnirVfo.exe
  C:\Windows\System32\lnirVfo.exe
  2⤵
  PID:9860
- C:\Windows\System32\FvCABya.exe
  C:\Windows\System32\FvCABya.exe
  2⤵
  PID:9884
- C:\Windows\System32\QTdmWDM.exe
  C:\Windows\System32\QTdmWDM.exe
  2⤵
  PID:9908
- C:\Windows\System32\vvDRsGi.exe
  C:\Windows\System32\vvDRsGi.exe
  2⤵
  PID:9960
- C:\Windows\System32\eLiqYsm.exe
  C:\Windows\System32\eLiqYsm.exe
  2⤵
  PID:9976
- C:\Windows\System32\cwDZoxO.exe
  C:\Windows\System32\cwDZoxO.exe
  2⤵
  PID:9996
- C:\Windows\System32\vbNCCFL.exe
  C:\Windows\System32\vbNCCFL.exe
  2⤵
  PID:10024
- C:\Windows\System32\Owstbcm.exe
  C:\Windows\System32\Owstbcm.exe
  2⤵
  PID:10048
- C:\Windows\System32\AKIXqmV.exe
  C:\Windows\System32\AKIXqmV.exe
  2⤵
  PID:10084
- C:\Windows\System32\uwFyAxZ.exe
  C:\Windows\System32\uwFyAxZ.exe
  2⤵
  PID:10120
- C:\Windows\System32\qcaNiuj.exe
  C:\Windows\System32\qcaNiuj.exe
  2⤵
  PID:10144
- C:\Windows\System32\VdSmbFK.exe
  C:\Windows\System32\VdSmbFK.exe
  2⤵
  PID:10176
- C:\Windows\System32\OKsEJYs.exe
  C:\Windows\System32\OKsEJYs.exe
  2⤵
  PID:10196
- C:\Windows\System32\nqTWtlu.exe
  C:\Windows\System32\nqTWtlu.exe
  2⤵
  PID:10216
- C:\Windows\System32\rSaHIsK.exe
  C:\Windows\System32\rSaHIsK.exe
  2⤵
  PID:9080
- C:\Windows\System32\kByoMqI.exe
  C:\Windows\System32\kByoMqI.exe
  2⤵
  PID:9256
- C:\Windows\System32\hKuEjyN.exe
  C:\Windows\System32\hKuEjyN.exe
  2⤵
  PID:9352
- C:\Windows\System32\rOWPwCk.exe
  C:\Windows\System32\rOWPwCk.exe
  2⤵
  PID:9432
- C:\Windows\System32\wDpZPWl.exe
  C:\Windows\System32\wDpZPWl.exe
  2⤵
  PID:9508
- C:\Windows\System32\OhOBKvN.exe
  C:\Windows\System32\OhOBKvN.exe
  2⤵
  PID:9568
- C:\Windows\System32\QGuUjTe.exe
  C:\Windows\System32\QGuUjTe.exe
  2⤵
  PID:9680
- C:\Windows\System32\XXUKvXT.exe
  C:\Windows\System32\XXUKvXT.exe
  2⤵
  PID:9720
- C:\Windows\System32\swYepzC.exe
  C:\Windows\System32\swYepzC.exe
  2⤵
  PID:9744
- C:\Windows\System32\ezXqkLf.exe
  C:\Windows\System32\ezXqkLf.exe
  2⤵
  PID:2552
- C:\Windows\System32\GGtKHmD.exe
  C:\Windows\System32\GGtKHmD.exe
  2⤵
  PID:5564
- C:\Windows\System32\xjNVTSw.exe
  C:\Windows\System32\xjNVTSw.exe
  2⤵
  PID:1580
- C:\Windows\System32\eKXZmqP.exe
  C:\Windows\System32\eKXZmqP.exe
  2⤵
  PID:9968
- C:\Windows\System32\DeXLPbV.exe
  C:\Windows\System32\DeXLPbV.exe
  2⤵
  PID:10004
- C:\Windows\System32\qJTAPgm.exe
  C:\Windows\System32\qJTAPgm.exe
  2⤵
  PID:10064
- C:\Windows\System32\WGgDEhe.exe
  C:\Windows\System32\WGgDEhe.exe
  2⤵
  PID:10100
- C:\Windows\System32\cINoqkN.exe
  C:\Windows\System32\cINoqkN.exe
  2⤵
  PID:10156
- C:\Windows\System32\EuGTyTF.exe
  C:\Windows\System32\EuGTyTF.exe
  2⤵
  PID:10212
- C:\Windows\System32\FeyetdH.exe
  C:\Windows\System32\FeyetdH.exe
  2⤵
  PID:9280
- C:\Windows\System32\ilgCrHc.exe
  C:\Windows\System32\ilgCrHc.exe
  2⤵
  PID:9452
- C:\Windows\System32\WUPymqX.exe
  C:\Windows\System32\WUPymqX.exe
  2⤵
  PID:9748
- C:\Windows\System32\LUMPZNh.exe
  C:\Windows\System32\LUMPZNh.exe
  2⤵
  PID:5640
- C:\Windows\System32\MLGXSIE.exe
  C:\Windows\System32\MLGXSIE.exe
  2⤵
  PID:9904
- C:\Windows\System32\NUfQlqq.exe
  C:\Windows\System32\NUfQlqq.exe
  2⤵
  PID:10112
- C:\Windows\System32\YpCiPhr.exe
  C:\Windows\System32\YpCiPhr.exe
  2⤵
  PID:10204
- C:\Windows\System32\MBgJHjy.exe
  C:\Windows\System32\MBgJHjy.exe
  2⤵
  PID:9500
- C:\Windows\System32\bTvnMWT.exe
  C:\Windows\System32\bTvnMWT.exe
  2⤵
  PID:9952
- C:\Windows\System32\WmKkPkz.exe
  C:\Windows\System32\WmKkPkz.exe
  2⤵
  PID:9252
- C:\Windows\System32\jhANMZR.exe
  C:\Windows\System32\jhANMZR.exe
  2⤵
  PID:9844
- C:\Windows\System32\qkVkVfn.exe
  C:\Windows\System32\qkVkVfn.exe
  2⤵
  PID:10036
- C:\Windows\System32\zQaXCww.exe
  C:\Windows\System32\zQaXCww.exe
  2⤵
  PID:10272
- C:\Windows\System32\OIqnROd.exe
  C:\Windows\System32\OIqnROd.exe
  2⤵
  PID:10300
- C:\Windows\System32\fHeVdJW.exe
  C:\Windows\System32\fHeVdJW.exe
  2⤵
  PID:10320
- C:\Windows\System32\IAaRSiL.exe
  C:\Windows\System32\IAaRSiL.exe
  2⤵
  PID:10360
- C:\Windows\System32\nGVzrqO.exe
  C:\Windows\System32\nGVzrqO.exe
  2⤵
  PID:10384
- C:\Windows\System32\DaBRvSa.exe
  C:\Windows\System32\DaBRvSa.exe
  2⤵
  PID:10404
- C:\Windows\System32\JMWtbTr.exe
  C:\Windows\System32\JMWtbTr.exe
  2⤵
  PID:10452
- C:\Windows\System32\qGDfVFX.exe
  C:\Windows\System32\qGDfVFX.exe
  2⤵
  PID:10472
- C:\Windows\System32\XLBJLkN.exe
  C:\Windows\System32\XLBJLkN.exe
  2⤵
  PID:10492
- C:\Windows\System32\USwgwgd.exe
  C:\Windows\System32\USwgwgd.exe
  2⤵
  PID:10532
- C:\Windows\System32\dZIPYxz.exe
  C:\Windows\System32\dZIPYxz.exe
  2⤵
  PID:10560
- C:\Windows\System32\VkDsevD.exe
  C:\Windows\System32\VkDsevD.exe
  2⤵
  PID:10584
- C:\Windows\System32\lHkFnvE.exe
  C:\Windows\System32\lHkFnvE.exe
  2⤵
  PID:10616
- C:\Windows\System32\FBYkKiT.exe
  C:\Windows\System32\FBYkKiT.exe
  2⤵
  PID:10632
- C:\Windows\System32\KaIRzZE.exe
  C:\Windows\System32\KaIRzZE.exe
  2⤵
  PID:10660
- C:\Windows\System32\wrWiCWx.exe
  C:\Windows\System32\wrWiCWx.exe
  2⤵
  PID:10680
- C:\Windows\System32\umbgKDd.exe
  C:\Windows\System32\umbgKDd.exe
  2⤵
  PID:10704
- C:\Windows\System32\CwJfHZO.exe
  C:\Windows\System32\CwJfHZO.exe
  2⤵
  PID:10760
- C:\Windows\System32\ToyDkFV.exe
  C:\Windows\System32\ToyDkFV.exe
  2⤵
  PID:10784
- C:\Windows\System32\bpPNQPQ.exe
  C:\Windows\System32\bpPNQPQ.exe
  2⤵
  PID:10800
- C:\Windows\System32\NSbETEO.exe
  C:\Windows\System32\NSbETEO.exe
  2⤵
  PID:10840
- C:\Windows\System32\LdRRESf.exe
  C:\Windows\System32\LdRRESf.exe
  2⤵
  PID:10856
- C:\Windows\System32\rvQbXgz.exe
  C:\Windows\System32\rvQbXgz.exe
  2⤵
  PID:10908
- C:\Windows\System32\GPkbpfm.exe
  C:\Windows\System32\GPkbpfm.exe
  2⤵
  PID:10924
- C:\Windows\System32\biyCMGE.exe
  C:\Windows\System32\biyCMGE.exe
  2⤵
  PID:10940
- C:\Windows\System32\evaxkzM.exe
  C:\Windows\System32\evaxkzM.exe
  2⤵
  PID:10980
- C:\Windows\System32\ralsNIO.exe
  C:\Windows\System32\ralsNIO.exe
  2⤵
  PID:11004
- C:\Windows\System32\wdmIHCz.exe
  C:\Windows\System32\wdmIHCz.exe
  2⤵
  PID:11032
- C:\Windows\System32\tElVTCy.exe
  C:\Windows\System32\tElVTCy.exe
  2⤵
  PID:11056
- C:\Windows\System32\TZPTwFk.exe
  C:\Windows\System32\TZPTwFk.exe
  2⤵
  PID:11084
- C:\Windows\System32\cFegPYi.exe
  C:\Windows\System32\cFegPYi.exe
  2⤵
  PID:11116
- C:\Windows\System32\NGnQLPZ.exe
  C:\Windows\System32\NGnQLPZ.exe
  2⤵
  PID:11148
- C:\Windows\System32\ebAXZVY.exe
  C:\Windows\System32\ebAXZVY.exe
  2⤵
  PID:11176
- C:\Windows\System32\cjSSYaS.exe
  C:\Windows\System32\cjSSYaS.exe
  2⤵
  PID:11200
- C:\Windows\System32\tcZDbar.exe
  C:\Windows\System32\tcZDbar.exe
  2⤵
  PID:11228
- C:\Windows\System32\pWfDvVM.exe
  C:\Windows\System32\pWfDvVM.exe
  2⤵
  PID:10264
- C:\Windows\System32\IoXvHbV.exe
  C:\Windows\System32\IoXvHbV.exe
  2⤵
  PID:10280
- C:\Windows\System32\VKCmalA.exe
  C:\Windows\System32\VKCmalA.exe
  2⤵
  PID:10340
- C:\Windows\System32\auHkVza.exe
  C:\Windows\System32\auHkVza.exe
  2⤵
  PID:10400
- C:\Windows\System32\Xvukvle.exe
  C:\Windows\System32\Xvukvle.exe
  2⤵
  PID:10460
- C:\Windows\System32\lmrtpKi.exe
  C:\Windows\System32\lmrtpKi.exe
  2⤵
  PID:10488
- C:\Windows\System32\ZWkdhOH.exe
  C:\Windows\System32\ZWkdhOH.exe
  2⤵
  PID:10568
- C:\Windows\System32\CDbTuWC.exe
  C:\Windows\System32\CDbTuWC.exe
  2⤵
  PID:10644
- C:\Windows\System32\MumbPtE.exe
  C:\Windows\System32\MumbPtE.exe
  2⤵
  PID:10712
- C:\Windows\System32\diZxlul.exe
  C:\Windows\System32\diZxlul.exe
  2⤵
  PID:10796
- C:\Windows\System32\fvJDmmb.exe
  C:\Windows\System32\fvJDmmb.exe
  2⤵
  PID:10852
- C:\Windows\System32\PnvUlhh.exe
  C:\Windows\System32\PnvUlhh.exe
  2⤵
  PID:10892
- C:\Windows\System32\VMihDyQ.exe
  C:\Windows\System32\VMihDyQ.exe
  2⤵
  PID:10972
- C:\Windows\System32\IKNmVKT.exe
  C:\Windows\System32\IKNmVKT.exe
  2⤵
  PID:11040
- C:\Windows\System32\YQdcrEz.exe
  C:\Windows\System32\YQdcrEz.exe
  2⤵
  PID:11096
- C:\Windows\System32\qPMIwIQ.exe
  C:\Windows\System32\qPMIwIQ.exe
  2⤵
  PID:11172
- C:\Windows\System32\opDTPUb.exe
  C:\Windows\System32\opDTPUb.exe
  2⤵
  PID:11216
- C:\Windows\System32\QpYqdYf.exe
  C:\Windows\System32\QpYqdYf.exe
  2⤵
  PID:10356
- C:\Windows\System32\PmyFTLJ.exe
  C:\Windows\System32\PmyFTLJ.exe
  2⤵
  PID:10468
- C:\Windows\System32\lMHhNFM.exe
  C:\Windows\System32\lMHhNFM.exe
  2⤵
  PID:10612
- C:\Windows\System32\bxIqZQA.exe
  C:\Windows\System32\bxIqZQA.exe
  2⤵
  PID:10768
- C:\Windows\System32\maMeIYQ.exe
  C:\Windows\System32\maMeIYQ.exe
  2⤵
  PID:10936
- C:\Windows\System32\aJlQBrL.exe
  C:\Windows\System32\aJlQBrL.exe
  2⤵
  PID:11044
- C:\Windows\System32\fuKovna.exe
  C:\Windows\System32\fuKovna.exe
  2⤵
  PID:11136
- C:\Windows\System32\VNKBPRB.exe
  C:\Windows\System32\VNKBPRB.exe
  2⤵
  PID:5192
- C:\Windows\System32\qvHGYub.exe
  C:\Windows\System32\qvHGYub.exe
  2⤵
  PID:10548
- C:\Windows\System32\kvlHUtk.exe
  C:\Windows\System32\kvlHUtk.exe
  2⤵
  PID:10952
- C:\Windows\System32\XMyxEjw.exe
  C:\Windows\System32\XMyxEjw.exe
  2⤵
  PID:11092
- C:\Windows\System32\zNsoGdg.exe
  C:\Windows\System32\zNsoGdg.exe
  2⤵
  PID:4968
- C:\Windows\System32\SQtHall.exe
  C:\Windows\System32\SQtHall.exe
  2⤵
  PID:2532
- C:\Windows\System32\CiuNNEH.exe
  C:\Windows\System32\CiuNNEH.exe
  2⤵
  PID:11292
- C:\Windows\System32\vNTlrJq.exe
  C:\Windows\System32\vNTlrJq.exe
  2⤵
  PID:11324
- C:\Windows\System32\uyhjsvF.exe
  C:\Windows\System32\uyhjsvF.exe
  2⤵
  PID:11348
- C:\Windows\System32\esqlUsQ.exe
  C:\Windows\System32\esqlUsQ.exe
  2⤵
  PID:11380
- C:\Windows\System32\UxVytpm.exe
  C:\Windows\System32\UxVytpm.exe
  2⤵
  PID:11404
- C:\Windows\System32\HLVCjcJ.exe
  C:\Windows\System32\HLVCjcJ.exe
  2⤵
  PID:11436
- C:\Windows\System32\QJJXlbY.exe
  C:\Windows\System32\QJJXlbY.exe
  2⤵
  PID:11460
- C:\Windows\System32\FovdfSY.exe
  C:\Windows\System32\FovdfSY.exe
  2⤵
  PID:11476
- C:\Windows\System32\gLyzyxl.exe
  C:\Windows\System32\gLyzyxl.exe
  2⤵
  PID:11524
- C:\Windows\System32\yaGBxlH.exe
  C:\Windows\System32\yaGBxlH.exe
  2⤵
  PID:11544
- C:\Windows\System32\zCqWiQw.exe
  C:\Windows\System32\zCqWiQw.exe
  2⤵
  PID:11568
- C:\Windows\System32\ORvdwhC.exe
  C:\Windows\System32\ORvdwhC.exe
  2⤵
  PID:11596
- C:\Windows\System32\sWxuQOd.exe
  C:\Windows\System32\sWxuQOd.exe
  2⤵
  PID:11624
- C:\Windows\System32\NFrwmfB.exe
  C:\Windows\System32\NFrwmfB.exe
  2⤵
  PID:11664
- C:\Windows\System32\hZeGOei.exe
  C:\Windows\System32\hZeGOei.exe
  2⤵
  PID:11684
- C:\Windows\System32\QmpMfxz.exe
  C:\Windows\System32\QmpMfxz.exe
  2⤵
  PID:11708
- C:\Windows\System32\zXqOfNc.exe
  C:\Windows\System32\zXqOfNc.exe
  2⤵
  PID:11736
- C:\Windows\System32\OQDzETj.exe
  C:\Windows\System32\OQDzETj.exe
  2⤵
  PID:11764
- C:\Windows\System32\wVOEsmU.exe
  C:\Windows\System32\wVOEsmU.exe
  2⤵
  PID:11784
- C:\Windows\System32\AFtfcsn.exe
  C:\Windows\System32\AFtfcsn.exe
  2⤵
  PID:11808
- C:\Windows\System32\zQzaIus.exe
  C:\Windows\System32\zQzaIus.exe
  2⤵
  PID:11868
- C:\Windows\System32\SLIMLzl.exe
  C:\Windows\System32\SLIMLzl.exe
  2⤵
  PID:11884
- C:\Windows\System32\sOvaHNR.exe
  C:\Windows\System32\sOvaHNR.exe
  2⤵
  PID:11912
- C:\Windows\System32\KeKwQMv.exe
  C:\Windows\System32\KeKwQMv.exe
  2⤵
  PID:11944
- C:\Windows\System32\xeTOebt.exe
  C:\Windows\System32\xeTOebt.exe
  2⤵
  PID:11980
- C:\Windows\System32\wOxMpCK.exe
  C:\Windows\System32\wOxMpCK.exe
  2⤵
  PID:12000
- C:\Windows\System32\orkqXwa.exe
  C:\Windows\System32\orkqXwa.exe
  2⤵
  PID:12016
- C:\Windows\System32\OqoInZy.exe
  C:\Windows\System32\OqoInZy.exe
  2⤵
  PID:12052
- C:\Windows\System32\moUNAwk.exe
  C:\Windows\System32\moUNAwk.exe
  2⤵
  PID:12080
- C:\Windows\System32\RGCQedn.exe
  C:\Windows\System32\RGCQedn.exe
  2⤵
  PID:12104
- C:\Windows\System32\SaqSSmg.exe
  C:\Windows\System32\SaqSSmg.exe
  2⤵
  PID:12128
- C:\Windows\System32\dirEVSt.exe
  C:\Windows\System32\dirEVSt.exe
  2⤵
  PID:12156
- C:\Windows\System32\AxOcdRC.exe
  C:\Windows\System32\AxOcdRC.exe
  2⤵
  PID:12192
- C:\Windows\System32\mncWHQN.exe
  C:\Windows\System32\mncWHQN.exe
  2⤵
  PID:12224
- C:\Windows\System32\DhoYvLR.exe
  C:\Windows\System32\DhoYvLR.exe
  2⤵
  PID:12252
- C:\Windows\System32\GecglyT.exe
  C:\Windows\System32\GecglyT.exe
  2⤵
  PID:2324
- C:\Windows\System32\FwlgZwB.exe
  C:\Windows\System32\FwlgZwB.exe
  2⤵
  PID:11280
- C:\Windows\System32\QYXXGKq.exe
  C:\Windows\System32\QYXXGKq.exe
  2⤵
  PID:11360
- C:\Windows\System32\vUaRKRl.exe
  C:\Windows\System32\vUaRKRl.exe
  2⤵
  PID:11424
- C:\Windows\System32\ATqQjij.exe
  C:\Windows\System32\ATqQjij.exe
  2⤵
  PID:11500
- C:\Windows\System32\MgBxKGn.exe
  C:\Windows\System32\MgBxKGn.exe
  2⤵
  PID:11560
- C:\Windows\System32\arNnuOT.exe
  C:\Windows\System32\arNnuOT.exe
  2⤵
  PID:11644
- C:\Windows\System32\dHBGGdK.exe
  C:\Windows\System32\dHBGGdK.exe
  2⤵
  PID:11692
- C:\Windows\System32\lmdFCiu.exe
  C:\Windows\System32\lmdFCiu.exe
  2⤵
  PID:11760
- C:\Windows\System32\PdwZWQQ.exe
  C:\Windows\System32\PdwZWQQ.exe
  2⤵
  PID:11796
- C:\Windows\System32\VggbeGB.exe
  C:\Windows\System32\VggbeGB.exe
  2⤵
  PID:11860
- C:\Windows\System32\CBeftmD.exe
  C:\Windows\System32\CBeftmD.exe
  2⤵
  PID:2356
- C:\Windows\System32\lSrrKfu.exe
  C:\Windows\System32\lSrrKfu.exe
  2⤵
  PID:11956
- C:\Windows\System32\FruxEgm.exe
  C:\Windows\System32\FruxEgm.exe
  2⤵
  PID:12008
- C:\Windows\System32\nDyLqkF.exe
  C:\Windows\System32\nDyLqkF.exe
  2⤵
  PID:12060
- C:\Windows\System32\zJnxKBu.exe
  C:\Windows\System32\zJnxKBu.exe
  2⤵
  PID:12140
- C:\Windows\System32\sIDmqEV.exe
  C:\Windows\System32\sIDmqEV.exe
  2⤵
  PID:12236
- C:\Windows\System32\SoUjnHz.exe
  C:\Windows\System32\SoUjnHz.exe
  2⤵
  PID:11276
- C:\Windows\System32\tUbphwz.exe
  C:\Windows\System32\tUbphwz.exe
  2⤵
  PID:11456
- C:\Windows\System32\MSNlXZD.exe
  C:\Windows\System32\MSNlXZD.exe
  2⤵
  PID:11584
- C:\Windows\System32\PfhQOLF.exe
  C:\Windows\System32\PfhQOLF.exe
  2⤵
  PID:11804
- C:\Windows\System32\fdkZSKw.exe
  C:\Windows\System32\fdkZSKw.exe
  2⤵
  PID:11892
- C:\Windows\System32\AptKryz.exe
  C:\Windows\System32\AptKryz.exe
  2⤵
  PID:11992
- C:\Windows\System32\cuzEbOY.exe
  C:\Windows\System32\cuzEbOY.exe
  2⤵
  PID:12112
- C:\Windows\System32\ZbkxTHD.exe
  C:\Windows\System32\ZbkxTHD.exe
  2⤵
  PID:10740
- C:\Windows\System32\oGgZOFb.exe
  C:\Windows\System32\oGgZOFb.exe
  2⤵
  PID:11388
- C:\Windows\System32\OvVeuGt.exe
  C:\Windows\System32\OvVeuGt.exe
  2⤵
  PID:11680
- C:\Windows\System32\gZjxCGo.exe
  C:\Windows\System32\gZjxCGo.exe
  2⤵
  PID:3780
- C:\Windows\System32\XNkBGlr.exe
  C:\Windows\System32\XNkBGlr.exe
  2⤵
  PID:11700
- C:\Windows\System32\SvjhXTg.exe
  C:\Windows\System32\SvjhXTg.exe
  2⤵
  PID:11964
- C:\Windows\System32\sdbOlcz.exe
  C:\Windows\System32\sdbOlcz.exe
  2⤵
  PID:12304
- C:\Windows\System32\BOvUOXQ.exe
  C:\Windows\System32\BOvUOXQ.exe
  2⤵
  PID:12332
- C:\Windows\System32\UGNIrLA.exe
  C:\Windows\System32\UGNIrLA.exe
  2⤵
  PID:12352
- C:\Windows\System32\PeLJkzg.exe
  C:\Windows\System32\PeLJkzg.exe
  2⤵
  PID:12380
- C:\Windows\System32\ZuRcVgP.exe
  C:\Windows\System32\ZuRcVgP.exe
  2⤵
  PID:12416
- C:\Windows\System32\zsYHbeL.exe
  C:\Windows\System32\zsYHbeL.exe
  2⤵
  PID:12444
- C:\Windows\System32\NCEbrHg.exe
  C:\Windows\System32\NCEbrHg.exe
  2⤵
  PID:12472
- C:\Windows\System32\NzVcGwI.exe
  C:\Windows\System32\NzVcGwI.exe
  2⤵
  PID:12508
- C:\Windows\System32\aCwiakh.exe
  C:\Windows\System32\aCwiakh.exe
  2⤵
  PID:12528
- C:\Windows\System32\upkqVRH.exe
  C:\Windows\System32\upkqVRH.exe
  2⤵
  PID:12560
- C:\Windows\System32\cXCxXVi.exe
  C:\Windows\System32\cXCxXVi.exe
  2⤵
  PID:12584
- C:\Windows\System32\JwCTmDE.exe
  C:\Windows\System32\JwCTmDE.exe
  2⤵
  PID:12616
- C:\Windows\System32\dgWnXXl.exe
  C:\Windows\System32\dgWnXXl.exe
  2⤵
  PID:12648
- C:\Windows\System32\HOKnxbq.exe
  C:\Windows\System32\HOKnxbq.exe
  2⤵
  PID:12668
- C:\Windows\System32\cceWFyq.exe
  C:\Windows\System32\cceWFyq.exe
  2⤵
  PID:12708
- C:\Windows\System32\hNphRCp.exe
  C:\Windows\System32\hNphRCp.exe
  2⤵
  PID:12732
- C:\Windows\System32\chbBYcq.exe
  C:\Windows\System32\chbBYcq.exe
  2⤵
  PID:12752
- C:\Windows\System32\DCvqcYm.exe
  C:\Windows\System32\DCvqcYm.exe
  2⤵
  PID:12772
- C:\Windows\System32\sMZFnFD.exe
  C:\Windows\System32\sMZFnFD.exe
  2⤵
  PID:12800
- C:\Windows\System32\QlpIktL.exe
  C:\Windows\System32\QlpIktL.exe
  2⤵
  PID:12840
- C:\Windows\System32\ZmtSAwa.exe
  C:\Windows\System32\ZmtSAwa.exe
  2⤵
  PID:12880
- C:\Windows\System32\KhKKhQz.exe
  C:\Windows\System32\KhKKhQz.exe
  2⤵
  PID:12896
- C:\Windows\System32\zrlBQRT.exe
  C:\Windows\System32\zrlBQRT.exe
  2⤵
  PID:12936
- C:\Windows\System32\bsNvPQF.exe
  C:\Windows\System32\bsNvPQF.exe
  2⤵
  PID:12960
- C:\Windows\System32\UMjqlZH.exe
  C:\Windows\System32\UMjqlZH.exe
  2⤵
  PID:12984
- C:\Windows\System32\SzFCnxC.exe
  C:\Windows\System32\SzFCnxC.exe
  2⤵
  PID:13008
- C:\Windows\System32\TDrTJJi.exe
  C:\Windows\System32\TDrTJJi.exe
  2⤵
  PID:13036
- C:\Windows\System32\CANfwOl.exe
  C:\Windows\System32\CANfwOl.exe
  2⤵
  PID:13072
- C:\Windows\System32\fHMxnnI.exe
  C:\Windows\System32\fHMxnnI.exe
  2⤵
  PID:13100
- C:\Windows\System32\byuIKrC.exe
  C:\Windows\System32\byuIKrC.exe
  2⤵
  PID:13132
- C:\Windows\System32\lOMtwWF.exe
  C:\Windows\System32\lOMtwWF.exe
  2⤵
  PID:13280
- C:\Windows\System32\dnxvvxd.exe
  C:\Windows\System32\dnxvvxd.exe
  2⤵
  PID:13296
- C:\Windows\System32\cxrtrCv.exe
  C:\Windows\System32\cxrtrCv.exe
  2⤵
  PID:12320
- C:\Windows\System32\dDXZVnl.exe
  C:\Windows\System32\dDXZVnl.exe
  2⤵
  PID:12412
- C:\Windows\System32\nbbZoOH.exe
  C:\Windows\System32\nbbZoOH.exe
  2⤵
  PID:12460
- C:\Windows\System32\DPPoaaO.exe
  C:\Windows\System32\DPPoaaO.exe
  2⤵
  PID:12520
- C:\Windows\System32\kNsKgDY.exe
  C:\Windows\System32\kNsKgDY.exe
  2⤵
  PID:12632
- C:\Windows\System32\UWJKJpl.exe
  C:\Windows\System32\UWJKJpl.exe
  2⤵
  PID:12688
- C:\Windows\System32\PDTupUt.exe
  C:\Windows\System32\PDTupUt.exe
  2⤵
  PID:12748
- C:\Windows\System32\JVypLBF.exe
  C:\Windows\System32\JVypLBF.exe
  2⤵
  PID:12764
- C:\Windows\System32\XZynmCW.exe
  C:\Windows\System32\XZynmCW.exe
  2⤵
  PID:12872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

ASpWSwD.exe

Path C:\Windows\System32\ASpWSwD.exe
Size 1.9MB
SHA256 e94e26326e2292955aee8383c2ade03d2fc6c85ce69fd9dbf7f5f240227a3e64
MD5 8b8752c6a28a3abdc936bdf52a8efc26
SHA1 89a53c95e92a90f4c48f1c4a9db8f96d2e086373
SHA512 37463c3d902bb4a272793f5715832c88b7f9baa64a1e376bff08e019b84491d1cbe1681314f73bc9d379967fd7e91d51be08d981cbe1bb3e27a80a5279cbabce
SSDEEP 49152:knw9oUUEEDl37jcqdt3uB3AXqMTwi4/1V:kQUEE2
MD5 SHA1 SHA512 SSDEEP

Submit Download

DSKEISs.exe

Path C:\Windows\System32\DSKEISs.exe
Size 1.9MB
SHA256 9d1029a7ee60b2960e42fc36f6935f0ce8526dd589daf7d11cb8b4ee7ef1b8da
MD5 8ba380a09ee5b0bb2fe1a10e820f5c0a
SHA1 f0ca4fd5a50422deedf62e86907e75294636e833
SHA512 43c8977da066c7e53a78a93cc5e2761498afdda150c27ba26a0feb1616b86f96a19edfa6c790078c1a4ff15f2190558fb318cdfdec67f0954c87f97d6f4a9ff3
SSDEEP 49152:knw9oUUEEDl37jcqdt3uB3AXqMTwi4/1U:kQUEEd
MD5 SHA1 SHA512 SSDEEP

Submit Download

DwsXzZD.exe

Path C:\Windows\System32\DwsXzZD.exe
Size 1.9MB
SHA256 e627204d4be8407748e6f5c4b131d18a879e65d4e2b7b544df74c00bb9cf2f82
MD5 0e1aa0525e981078169970ffeff4bfa2
SHA1 5aa19de9da7199fe0effb5715e81827fcb0b60d2
SHA512 927b83909770f463d62f3d155e8fb6f08f0db590874b648981bdeee824614adea79474fddf3e9b10cd10874dd9babf8a8b1d8c875f19e805a9cc77aa22733814
SSDEEP 49152:knw9oUUEEDl37jcqdt3uB3AXqMTwi4/1n:kQUEEW
MD5 SHA1 SHA512 SSDEEP

Submit Download

FseYeyY.exe

Path C:\Windows\System32\FseYeyY.exe
Size 1.9MB
SHA256 feba12d80837d144170cb6080117f7509fe13a692c67e5fb3e84771b4842714e
MD5 35b360947a0f89c708bc0a03f9747896
SHA1 f1ad713feea4aaab9c8237f7b544b36a33125ee6
SHA512 ca81df77e10663ba89f62ae82be24ecca196251a2fd0417ef184a70ac24f4dc86816e95da91b0a6ddedb4f22b3c69e56df3b5c8f518e889dfe4791ab5c658c63
SSDEEP 49152:knw9oUUEEDl37jcqdt3uB3AXqMTwi4/1S:kQUEE9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hnegxab.exe

Path C:\Windows\System32\Hnegxab.exe
Size 1.9MB
SHA256 118fc2c4601bc007a4e7ed71ae4c95f4c43288049734006a86d7bed3d480f6b5
MD5 9e6acac8a655225a607f61cd1861402b
SHA1 ac825a8ddbe8940cd7b5594fa4965673dec2f02d
SHA512 63c7eee3be53e1141c3301afcb33547945287e7baf490f2dbf5cf25afae69519209b32cf74e72a622bfda6de117e98f9f58a11af5d54bc8f451c0904457951c9
SSDEEP 49152:knw9oUUEEDl37jcqdt3uB3AXqMTwi4/11:kQUEEs
MD5 SHA1 SHA512 SSDEEP

Submit Download

JjCEzkH.exe

Path C:\Windows\System32\JjCEzkH.exe
Size 1.9MB
SHA256 350826d12a0922c112a2425f9aa1bb13a288f42512311989e3f0dc3370303188
MD5 49cff3fb9bb69235aff2dbe3e7459413
SHA1 0bad7a6a6d9b898d24745115ff8dcf1ab7ce12d1
SHA512 45e66511126f50bf2bac328bcad5b8c5b0c1494131ec473d50f7401de38396c6050aaa67d81b4ef7457b6471070afe88a491c31fa51b4ac4da7c95d3f9bdad93
SSDEEP 49152:knw9oUUEEDl37jcqdt3uB3AXqMTwi4/1L:kQUEEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

MrBPpqr.exe

Path C:\Windows\System32\MrBPpqr.exe
Size 1.9MB
SHA256 482e772b32694556a0446091c0a3c94d8d01010b53d95cbf008b62f399e9796f
MD5 c30a53d9f08c775e06b47dcab054caea
SHA1 084f31fe31322c5315123bff69508f0ff044c9a9
SHA512 4b4624b7087692f00038a10443aa26eebb82a25f1a1c55dc04db0de0e00699f255f1768b76f0a7470036402b167a9b2a20ad400cf8521bdbac532c9f5adf496f
SSDEEP 49152:knw9oUUEEDl37jcqdt3uB3AXqMTwi4/1hm:kQUEE9
MD5 SHA1 SHA512 SSDEEP

Submit Download

NkeCnts.exe

Path C:\Windows\System32\NkeCnts.exe
Size 1.9MB
SHA256 7d28f043240c28a2ed38a7288e9f8aadfdb1cc8d8ba46ac3b40c31f57c5cac38
MD5 1cc395f700cf194ce0ab1779ea8a4425
SHA1 6da98f2d9b9179d1eba9c55bade454465b30bfba
SHA512 01e8b1b32735cfc635986cab73711ae83ab0ca264c370d979ba184c7820d4da9f3c49e03643de7f88f4ea41e0c88d5c3308eeb38426bfd7336a48b411713ed44
SSDEEP 49152:knw9oUUEEDl37jcqdt3uB3AXqMTwi4/1z:kQUEEg
MD5 SHA1 SHA512 SSDEEP

Submit Download

PUsdnhm.exe

Path C:\Windows\System32\PUsdnhm.exe
Size 1.9MB
SHA256 8147caeaf4df17aff1bc05c24131d8807d2c0ef8b48904012ff540fa23f8938d
MD5 4f5e428000a3e0e1270b699c8dd8fc98
SHA1 6e0321ffa6a265cd3f75d88d5328f3b82bde5a85
SHA512 89e848fef79d8240079c14fbc1c4957381623366933af58d0e62cc825c8eab399db6828b07b8a71bc87d2f3c8b820c7d381372ab07cab6bea64cd14b0c8bc5af
SSDEEP 49152:knw9oUUEEDl37jcqdt3uB3AXqMTwi4/1L:kQUEEo
MD5 SHA1 SHA512 SSDEEP

Submit Download

QaIrfJq.exe

Path C:\Windows\System32\QaIrfJq.exe
Size 1.9MB
SHA256 7ede6b37dc02024a22a69bece171af587632152b1e7063177a4e34043b5da7cf
MD5 121df54ac5b72c112e8cfd79ddf6750a
SHA1 1821bd9f796434536a7d717c147ebfa1827634b9
SHA512 383619429f1d20c85e994dd98daabf0e7f881ff54b15639030ead76bdcdb7a5648fe6f7243ac4cec1e40a9e285d91d18ead4b50254341054ba8189a5c14c87d2
SSDEEP 49152:knw9oUUEEDl37jcqdt3uB3AXqMTwi4/1E:kQUEEV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TPiLNhx.exe

Path C:\Windows\System32\TPiLNhx.exe
Size 1.9MB
SHA256 cdb66716cd20b1f34a0586c1cabc8b522e3f4aa3b334e88a93b9e7cc54aed22c
MD5 852c41bf9683af53441e8aa1d823cdfb
SHA1 f83e739dc6896f24189c577a27f8bbf7af421208
SHA512 1f6138eb4056dcfb86ecb719d77cf7f7b3a1e91cf06173f589833bb7a36e58acf0a2f9117e3f8a8568546c13ce9f158260c98cf8e30c79c713ba09d9143781d6
SSDEEP 49152:knw9oUUEEDl37jcqdt3uB3AXqMTwi4/1K:kQUEED
MD5 SHA1 SHA512 SSDEEP

Submit Download

TamiXBm.exe

Path C:\Windows\System32\TamiXBm.exe
Size 1.9MB
SHA256 1f68dffff49e30782468fbc6bb368987ff24554a052269c37fcfc72bc35ca0d7
MD5 b60ab31fa387caec458f8f3aac0f5b28
SHA1 6876461cfb00e1b2f5449ca8b2b036195366068f
SHA512 7a9dfc684602f5ca887c7a6044bba83742c9fe5ccaa3074647d93c5d5a051c5122e79f727fe3a296d9b744591d4000e556e76a3a7175b43ce54d6279238db8f5
SSDEEP 49152:knw9oUUEEDl37jcqdt3uB3AXqMTwi4/1i:kQUEEr
MD5 SHA1 SHA512 SSDEEP

Submit Download

TfAjUxd.exe

Path C:\Windows\System32\TfAjUxd.exe
Size 1.9MB
SHA256 a67c3eaa05286735f7e95683f5bc9c2cd7c29319b961bda132c5af5437ac8ed1
MD5 a62684778a6a00154f33bc9200619d49
SHA1 ad88c6feea777a7e718a3ca438dd72081c0dd92b
SHA512 63d26c1d39f480f10e43a22ec4092a443991c9a4c620e7e33397c07d0a7ec08ce5607106d3d512caa5db5281f53e2baab0d728721f7b4e4e302dc917bba442fd
SSDEEP 49152:knw9oUUEEDl37jcqdt3uB3AXqMTwi4/17:kQUEE2
MD5 SHA1 SHA512 SSDEEP

Submit Download

VdmlJuN.exe

Path C:\Windows\System32\VdmlJuN.exe
Size 1.9MB
SHA256 1117550ddd54e4cc53b88487c73997654de91c59f47755c5ee7081faeaefe0cb
MD5 db139bb675b457fdafed2c42a92779d3
SHA1 4a36e5e4be7b4f17d56101b127003a49c4896513
SHA512 a0c2e91880ade2cb370c7f6ecad8ac954cece0c554ee849eab81731ef62858a3e8193e208ff4e550b2bdef6528657200e1b08c808c82e0327e79aa53eceb0758
SSDEEP 49152:knw9oUUEEDl37jcqdt3uB3AXqMTwi4/1t:kQUEE4
MD5 SHA1 SHA512 SSDEEP

Submit Download

XsVfvAa.exe

Path C:\Windows\System32\XsVfvAa.exe
Size 1.9MB
SHA256 a1bce433d181acb8033c504c39d25cbc6f3141b9e594806738e59577b4baebf3
MD5 c38451fd607a40ad6ec9e0ca6cb72f2e
SHA1 e9f4a0b67ff221d0d5b95770888920ebee23267d
SHA512 c619e50c7166a122016f9483919198f367f752d36ee28579053c4eb63627328dbd21ca23f9a3efde4489e4fa9f08222bd915d9bf361cde1047cdb4de3a270bb4
SSDEEP 49152:knw9oUUEEDl37jcqdt3uB3AXqMTwi4/1F:kQUEE6
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZqWwCoR.exe

Path C:\Windows\System32\ZqWwCoR.exe
Size 1.9MB
SHA256 9cd47fcf461f791d79f0c9baa00a428867ee16757002a0e525c3aed4ab281ac7
MD5 77b784b3f455efc4b5da341a429d8a67
SHA1 91b565483fb84b0398d7ff6526293fe13973aa24
SHA512 fb6689a6336ac2db2a423d29225045f53669ba796121459479eba87b865eaae496e83c9742047386fba4b7a261aecb243364ba2f1e4697ab5e4da3d60ea8d26d
SSDEEP 49152:knw9oUUEEDl37jcqdt3uB3AXqMTwi4/1j:kQUEEs
MD5 SHA1 SHA512 SSDEEP

Submit Download

bSqFAln.exe

Path C:\Windows\System32\bSqFAln.exe
Size 1.9MB
SHA256 a7fa92fcd4c0f1b6be5b1a43c7e3f695ec28fd0f1fca4a064e39cc5ea75c151f
MD5 faf0617a5aa8b3c2b0b0ec40ad361c94
SHA1 3bdb9b317c931578b87297bd2f28dc4a1ca6bfab
SHA512 6d43e4c1ee13b73d213cc09684301292a64704189bbbce6d5daa050e386534003fcd123934090650f656bea99d47ccd7cc71a84052c80f5947d115484f74727d
SSDEEP 49152:knw9oUUEEDl37jcqdt3uB3AXqMTwi4/1h:kQUEEQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

bVVMgMc.exe

Path C:\Windows\System32\bVVMgMc.exe
Size 1.9MB
SHA256 fbdf23ef23d9400c51314447514b771618e813bfe0c854e4b2376b83b3e5c0b5
MD5 855279027a4a8ffe103ea5ae00eb8453
SHA1 8d6fe73cbf437de4bb19dec94ff7c6ab1caa2c39
SHA512 7bff0597fca5ab53a008d840814c362f3aa038472dd4ebe065bbecaf3b70534803efe0a5da9c13d925c62dbac48f8a4a6aa62f5029f633987e882e163c80500a
SSDEEP 49152:knw9oUUEEDl37jcqdt3uB3AXqMTwi4/1n:kQUEE8
MD5 SHA1 SHA512 SSDEEP

Submit Download

cVVJZLd.exe

Path C:\Windows\System32\cVVJZLd.exe
Size 1.9MB
SHA256 9a40dd6c65073c0b7ab99ea9e457b8915261434dff87a591e16b0c1956863f9f
MD5 ec44a7b507af608a3821cbe7851e5734
SHA1 0396417732cd99c59502a513fe7da06d2f988dda
SHA512 78d22318ff4fee545b2d74418b8cf2317bf378790da1e052dc6a14529c2a1e69e03434f9a5a87f26b0de5ece6493da3270b83deee42443df5047cda834329bc8
SSDEEP 49152:knw9oUUEEDl37jcqdt3uB3AXqMTwi4/10:kQUEED
MD5 SHA1 SHA512 SSDEEP

Submit Download

fByHPIx.exe

Path C:\Windows\System32\fByHPIx.exe
Size 1.9MB
SHA256 352be412af55365a860c547fba6c9ad76a66efdbfef2c1e95aea06f4957d9b14
MD5 e5dfba832c1b63e9309be9427d7145fc
SHA1 6ed3c863672a13b5fa9da51cd8706e417819b9f1
SHA512 61e6e17e6dad6e1496517224b7d61b3145f696c453d4a08898e69a12c9fcfa01854a94fe85b09ae66b5564bc34671a401606fe23d0e87f55f4ade441e7a6762d
SSDEEP 49152:knw9oUUEEDl37jcqdt3uB3AXqMTwi4/1E:kQUEEn
MD5 SHA1 SHA512 SSDEEP

Submit Download

fXDHMrA.exe

Path C:\Windows\System32\fXDHMrA.exe
Size 1.9MB
SHA256 5fce5963c4a3cd380a8b1f0628efa59d58e34593ce5f730a021468a02f9a77d8
MD5 d46bce2cb54f73bda7c2221190249405
SHA1 57f32cd43233280e50f2c609109ebb4cbf25131d
SHA512 a70a04d080bebbe4c31475cd67c2b3d2020f3192406d90fa12f7cc524608a6be598fe0e92a92203507cfed2dfce56ac05ca0fac40c2660422ea4bf3c4486ac71
SSDEEP 49152:knw9oUUEEDl37jcqdt3uB3AXqMTwi4/17:kQUEEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

gLnLyWe.exe

Path C:\Windows\System32\gLnLyWe.exe
Size 1.9MB
SHA256 d58738579c2aad192d1d5ad16f50a65291425e1937489aab563beab8a1bab0f9
MD5 77a8a55cd7ebd4bc266608fc78274d95
SHA1 4fd2d161ce6bafb02a25d3f66ebac767bc19b7dc
SHA512 b51e7ff6b7750e3def36cd347777a00c6cf2210ef6048a67114175cd05bf42fff5a4c3349c916466bb8d83f326d8d7b482fde46b2b7e87a913cac3596a15dc83
SSDEEP 49152:knw9oUUEEDl37jcqdt3uB3AXqMTwi4/1z:kQUEEu
MD5 SHA1 SHA512 SSDEEP

Submit Download

kDfDJOF.exe

Path C:\Windows\System32\kDfDJOF.exe
Size 1.9MB
SHA256 0ca75f2ea4428779ef4d9e20bb5f5fd7a711aec8e5649e29462c1ddf11cc20d6
MD5 40b1f58463cd74fc044dafef012f7f9d
SHA1 5b8c247966f11f45f06cea77433fde9bb9433814
SHA512 036a0b9774402bc5401c3b85ee772f0ad03ab70c00cd9788d3799fe93d72fade69c9f5b9b85ecd35e1e4c21022fda96d2544610e2e025d94322cf01e08baee55
SSDEEP 49152:knw9oUUEEDl37jcqdt3uB3AXqMTwi4/1K:kQUEE9
MD5 SHA1 SHA512 SSDEEP

Submit Download

mqAobdW.exe

Path C:\Windows\System32\mqAobdW.exe
Size 1.9MB
SHA256 c58892b8f46365ffc3e4e6ccadb7ed41fa040bcf130cbe878d674b32940b4532
MD5 798dc4829704fc1ae34bffcbeae5c1fa
SHA1 c0af5e0ae4259da1208e1e3f16ffe44592e49aa3
SHA512 9d0a826efe4a212125ce4fc98c5fa60eca43478d19e3a5c2ac7c9e481795d9251e91ef1ee9198c493a4e4af86674e2e56e1b07e28b3d80e2ad96961d42e8f8c9
SSDEEP 49152:knw9oUUEEDl37jcqdt3uB3AXqMTwi4/1U:kQUEEv
MD5 SHA1 SHA512 SSDEEP

Submit Download

pwQWbgJ.exe

Path C:\Windows\System32\pwQWbgJ.exe
Size 1.9MB
SHA256 5febb9a7941e680aec0f11201471deddeaa18d209f2c24d960572beaff54e30b
MD5 a89a1916e26f8b5fffdbf58974a8ad6f
SHA1 e7ae91fbc37e065a3f92ac2aa346435324b53e93
SHA512 10fb93bad43d242fcbdfb15176a564ab44db29235cc14eaa4ba8f5d9c334a293fd4231f1339a81010d61c83da6e5aa7d00a33960c28ad3f6eba3a63403d68a9f
SSDEEP 49152:knw9oUUEEDl37jcqdt3uB3AXqMTwi4/16:kQUEEf
MD5 SHA1 SHA512 SSDEEP

Submit Download

qWvWjcK.exe

Path C:\Windows\System32\qWvWjcK.exe
Size 1.9MB
SHA256 8ddde315dd5a52ee2c75de08a97f69cf248e28a2e16966416f6b6c9676d94310
MD5 6429f672c91d2afe0b5c1617f0465fb9
SHA1 1f2a6b853e7e379147f9d5398f880bb3509306be
SHA512 9d38e6efe3ef64df18c538de4112ed9c1064e4e7d64d16ef7a07be692e030c41d0e06db0e7d234481a991315338197653d76c2a21dff45f7a33323e43c3270e1
SSDEEP 49152:knw9oUUEEDl37jcqdt3uB3AXqMTwi4/1x:kQUEEO
MD5 SHA1 SHA512 SSDEEP

Submit Download

stdLGgz.exe

Path C:\Windows\System32\stdLGgz.exe
Size 1.9MB
SHA256 3ca371e8918a403eb33679aaaa52c5e813afadf1518835d867add14b83768e6a
MD5 fef0efc119392f35a59ce61622e7b481
SHA1 578b74e3611d3b265e1ceab67f113f3b57c336b4
SHA512 86bbeaf003af4758ca895d619b151b2948858ae9d6cc04e2f7615d2af6bb15360efc316396084bb369feb48d4f1bb676ea522d4a044c2a2d8085742f278f483d
SSDEEP 49152:knw9oUUEEDl37jcqdt3uB3AXqMTwi4/1V:kQUEES
MD5 SHA1 SHA512 SSDEEP

Submit Download

tGgNtrx.exe

Path C:\Windows\System32\tGgNtrx.exe
Size 1.9MB
SHA256 e3c8c8ed7f17f3fc8137a314171ebd8e91a7822fe3b0591adc46d884cb7d3a35
MD5 892320d652b11354e4f203c98b7364d8
SHA1 46cbe4934ff4d4be6841712ac6ff6c85a6f8d010
SHA512 14d0b50d3f249857f5f3f066e7841a1cbdfa679c63eca2f1dd705721ec5a30d20362affc9825bf0ce90056163f636f01668bd5a0dac78d2c0f151c88126c8be1
SSDEEP 49152:knw9oUUEEDl37jcqdt3uB3AXqMTwi4/1X:kQUEEa
MD5 SHA1 SHA512 SSDEEP

Submit Download

uMARSvq.exe

Path C:\Windows\System32\uMARSvq.exe
Size 1.9MB
SHA256 e3f70ac986219ae84b9414a6df97be84974924cab0cb087a983280ccc5ebfb62
MD5 dfc8296ac54c2dc607bd847e63e16cb1
SHA1 69d78818432e4e18737c1658efedde72e02b59b1
SHA512 d143ea342adbf94f761ec921eb85383f5f5d48bb3ab202946fd6725dfcb563b51d08fdeebd8bde4448bb6010909004f8beedb7c8f5a94ac58ef754935187bc8b
SSDEEP 49152:knw9oUUEEDl37jcqdt3uB3AXqMTwi4/19:kQUEEy
MD5 SHA1 SHA512 SSDEEP

Submit Download

umyncNu.exe

Path C:\Windows\System32\umyncNu.exe
Size 1.9MB
SHA256 543e7188c8d1738b9419740462402d7e9bf2abe7b206ae858b35e6aaee5828ab
MD5 5879ff1ae0ac7ecbc9c54983a9733ec5
SHA1 f50ee151b57c7d7091959be51fe8897e4205ba36
SHA512 2b9edfaa6be81d9d0c6ed82ad1473bfb76642717159725875c34b7470e06ae5c722da6ad1073977703bc6e1b309f4d612d6e54cfcdffc706ec3e8437c54b1761
SSDEEP 49152:knw9oUUEEDl37jcqdt3uB3AXqMTwi4/1C:kQUEEP
MD5 SHA1 SHA512 SSDEEP

Submit Download

yRJSXAC.exe

Path C:\Windows\System32\yRJSXAC.exe
Size 1.9MB
SHA256 1ade0ed8af3bc4feedfa9236a6ea76132e04b70a985805031f0b8bb9b2046704
MD5 d1768f2e200e7e9b30641a0b9222b0c7
SHA1 205988ed38768f26d0c4f0213b14230bcfd01b64
SHA512 94aaad1c530f5b2a72bda88eca4d6002975b4da7917f11fe72d518faa6a1d5bef97dbf69b1d30e9f59f3755ae9f679425729ebe22cdbdface82803ff20c4df8a
SSDEEP 49152:knw9oUUEEDl37jcqdt3uB3AXqMTwi4/1/:kQUEEu
MD5 SHA1 SHA512 SSDEEP

Submit Download

ykuNUnV.exe

Path C:\Windows\System32\ykuNUnV.exe
Size 1.9MB
SHA256 5d1d5275bf3bae9e2b217fef38e009ab171f7433cef69d0fe3ad97cb582004cc
MD5 d86b787f713d06e7d43c752acb8fd24d
SHA1 06a3e44c6e7e9f6aa95bc0d3699537523a4be7b1
SHA512 494f1dc284fd4ef63fe3e9856e213e44e382a5780914da77b943aab799ce3ce230edb7783684b470ebd80b6622a357ac12c3c2ea309e19be0b3a913a7698250a
SSDEEP 49152:knw9oUUEEDl37jcqdt3uB3AXqMTwi4/1n:kQUEEY
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/956-22-0x00007FF6B7F20000-0x00007FF6B8311000-memory.dmp

Download

memory/956-2032-0x00007FF6B7F20000-0x00007FF6B8311000-memory.dmp

Download

memory/996-2035-0x00007FF6772A0000-0x00007FF677691000-memory.dmp

Download

memory/996-457-0x00007FF6772A0000-0x00007FF677691000-memory.dmp

Download

memory/1492-2033-0x00007FF78CD30000-0x00007FF78D121000-memory.dmp

Download

memory/1492-12-0x00007FF78CD30000-0x00007FF78D121000-memory.dmp

Download

memory/1492-2023-0x00007FF78CD30000-0x00007FF78D121000-memory.dmp

Download

memory/1500-479-0x00007FF619500000-0x00007FF6198F1000-memory.dmp

Download

memory/1500-2058-0x00007FF619500000-0x00007FF6198F1000-memory.dmp

Download

memory/1624-2054-0x00007FF63A880000-0x00007FF63AC71000-memory.dmp

Download

memory/1624-460-0x00007FF63A880000-0x00007FF63AC71000-memory.dmp

Download

memory/1804-2075-0x00007FF79E3B0000-0x00007FF79E7A1000-memory.dmp

Download

memory/1804-548-0x00007FF79E3B0000-0x00007FF79E7A1000-memory.dmp

Download

memory/2136-480-0x00007FF7605E0000-0x00007FF7609D1000-memory.dmp

Download

memory/2136-2063-0x00007FF7605E0000-0x00007FF7609D1000-memory.dmp

Download

memory/2196-544-0x00007FF77B510000-0x00007FF77B901000-memory.dmp

Download

memory/2196-2073-0x00007FF77B510000-0x00007FF77B901000-memory.dmp

Download

memory/2236-2029-0x00007FF769510000-0x00007FF769901000-memory.dmp

Download

memory/2236-7-0x00007FF769510000-0x00007FF769901000-memory.dmp

Download

memory/2528-464-0x00007FF6D00C0000-0x00007FF6D04B1000-memory.dmp

Download

memory/2528-2046-0x00007FF6D00C0000-0x00007FF6D04B1000-memory.dmp

Download

memory/2560-2044-0x00007FF642310000-0x00007FF642701000-memory.dmp

Download

memory/2560-467-0x00007FF642310000-0x00007FF642701000-memory.dmp

Download

memory/2620-2062-0x00007FF72ADA0000-0x00007FF72B191000-memory.dmp

Download

memory/2620-482-0x00007FF72ADA0000-0x00007FF72B191000-memory.dmp

Download

memory/2720-493-0x00007FF673BB0000-0x00007FF673FA1000-memory.dmp

Download

memory/2720-2067-0x00007FF673BB0000-0x00007FF673FA1000-memory.dmp

Download

memory/3044-497-0x00007FF63AAA0000-0x00007FF63AE91000-memory.dmp

Download

memory/3044-2071-0x00007FF63AAA0000-0x00007FF63AE91000-memory.dmp

Download

memory/3368-474-0x00007FF7C59C0000-0x00007FF7C5DB1000-memory.dmp

Download

memory/3368-2056-0x00007FF7C59C0000-0x00007FF7C5DB1000-memory.dmp

Download

memory/3456-471-0x00007FF65F8E0000-0x00007FF65FCD1000-memory.dmp

Download

memory/3456-2042-0x00007FF65F8E0000-0x00007FF65FCD1000-memory.dmp

Download

memory/3616-487-0x00007FF73A890000-0x00007FF73AC81000-memory.dmp

Download

memory/3616-2060-0x00007FF73A890000-0x00007FF73AC81000-memory.dmp

Download

memory/3652-459-0x00007FF63C770000-0x00007FF63CB61000-memory.dmp

Download

memory/3652-2040-0x00007FF63C770000-0x00007FF63CB61000-memory.dmp

Download

memory/3892-2049-0x00007FF7FD830000-0x00007FF7FDC21000-memory.dmp

Download

memory/3892-463-0x00007FF7FD830000-0x00007FF7FDC21000-memory.dmp

Download

memory/3968-462-0x00007FF6E0BB0000-0x00007FF6E0FA1000-memory.dmp

Download

memory/3968-2048-0x00007FF6E0BB0000-0x00007FF6E0FA1000-memory.dmp

Download

memory/3988-2065-0x00007FF727EF0000-0x00007FF7282E1000-memory.dmp

Download

memory/3988-495-0x00007FF727EF0000-0x00007FF7282E1000-memory.dmp

Download

memory/4136-1990-0x00007FF6E4E90000-0x00007FF6E5281000-memory.dmp

Download

memory/4136-1-0x000002ACC7490000-0x000002ACC74A0000-memory.dmp

Download

memory/4136-0-0x00007FF6E4E90000-0x00007FF6E5281000-memory.dmp

Download

memory/4228-2052-0x00007FF626FE0000-0x00007FF6273D1000-memory.dmp

Download

memory/4228-461-0x00007FF626FE0000-0x00007FF6273D1000-memory.dmp

Download

memory/4460-458-0x00007FF6A80C0000-0x00007FF6A84B1000-memory.dmp

Download

memory/4460-2037-0x00007FF6A80C0000-0x00007FF6A84B1000-memory.dmp

Download

memory/4548-2070-0x00007FF786F20000-0x00007FF787311000-memory.dmp

Download

memory/4548-503-0x00007FF786F20000-0x00007FF787311000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads