xmrig | ddbcc6f5037a0a57bfbd248efe045a5ca08fb4161e0e576bd8adaea0a8dd2bd7

Analysis

max time kernel
125s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
Size 1.1MB
Sample240614-npckvasfmm
SHA256 ddbcc6f5037a0a57bfbd248efe045a5ca08fb4161e0e576bd8adaea0a8dd2bd7
MD5 bbf9e8846826f31fc4ed6181151cf100
SHA1 31cd392260a8af29d9c751fdcd015eac5283ccb3
SHA512 3e841794998714c31bf22d5bb81050d1aa698caccc469a2c26d0fe9e287c8ed76f139e6f84bad88f6bbcfd5993de5e454a4f544f9d51545da9a31c6a5c886f1a
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zyf3tTGn:knw9oUUEEDl37jcq4c3Un
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/4676-70-0x00007FF66E960000-0x00007FF66ED51000-memory.dmp	xmrig
behavioral2/memory/4452-350-0x00007FF7A3DE0000-0x00007FF7A41D1000-memory.dmp	xmrig
behavioral2/memory/3116-369-0x00007FF6E6E80000-0x00007FF6E7271000-memory.dmp	xmrig
behavioral2/memory/5072-398-0x00007FF66A150000-0x00007FF66A541000-memory.dmp	xmrig
behavioral2/memory/852-405-0x00007FF7D1BA0000-0x00007FF7D1F91000-memory.dmp	xmrig
behavioral2/memory/1484-415-0x00007FF6182B0000-0x00007FF6186A1000-memory.dmp	xmrig
behavioral2/memory/3488-428-0x00007FF6F0220000-0x00007FF6F0611000-memory.dmp	xmrig
behavioral2/memory/2812-412-0x00007FF640750000-0x00007FF640B41000-memory.dmp	xmrig
behavioral2/memory/5060-410-0x00007FF669A00000-0x00007FF669DF1000-memory.dmp	xmrig
behavioral2/memory/4616-402-0x00007FF7F8850000-0x00007FF7F8C41000-memory.dmp	xmrig
behavioral2/memory/4184-401-0x00007FF7F9740000-0x00007FF7F9B31000-memory.dmp	xmrig
behavioral2/memory/112-393-0x00007FF7BC040000-0x00007FF7BC431000-memory.dmp	xmrig
behavioral2/memory/2332-379-0x00007FF78C9C0000-0x00007FF78CDB1000-memory.dmp	xmrig
behavioral2/memory/3912-355-0x00007FF760D80000-0x00007FF761171000-memory.dmp	xmrig
behavioral2/memory/4000-71-0x00007FF765460000-0x00007FF765851000-memory.dmp	xmrig
behavioral2/memory/3864-68-0x00007FF7E4B30000-0x00007FF7E4F21000-memory.dmp	xmrig
behavioral2/memory/3288-65-0x00007FF698070000-0x00007FF698461000-memory.dmp	xmrig
behavioral2/memory/3460-49-0x00007FF7AC7B0000-0x00007FF7ACBA1000-memory.dmp	xmrig
behavioral2/memory/2524-42-0x00007FF607E20000-0x00007FF608211000-memory.dmp	xmrig
behavioral2/memory/4812-1946-0x00007FF6B22C0000-0x00007FF6B26B1000-memory.dmp	xmrig
behavioral2/memory/4376-1947-0x00007FF73C7B0000-0x00007FF73CBA1000-memory.dmp	xmrig
behavioral2/memory/556-1948-0x00007FF7DAD30000-0x00007FF7DB121000-memory.dmp	xmrig
behavioral2/memory/2600-1949-0x00007FF655AD0000-0x00007FF655EC1000-memory.dmp	xmrig
behavioral2/memory/2912-1950-0x00007FF68C1E0000-0x00007FF68C5D1000-memory.dmp	xmrig
behavioral2/memory/4812-1988-0x00007FF6B22C0000-0x00007FF6B26B1000-memory.dmp	xmrig
behavioral2/memory/4376-1990-0x00007FF73C7B0000-0x00007FF73CBA1000-memory.dmp	xmrig
behavioral2/memory/2524-1992-0x00007FF607E20000-0x00007FF608211000-memory.dmp	xmrig
behavioral2/memory/3460-1998-0x00007FF7AC7B0000-0x00007FF7ACBA1000-memory.dmp	xmrig
behavioral2/memory/3864-1996-0x00007FF7E4B30000-0x00007FF7E4F21000-memory.dmp	xmrig
behavioral2/memory/556-1995-0x00007FF7DAD30000-0x00007FF7DB121000-memory.dmp	xmrig
behavioral2/memory/3288-2010-0x00007FF698070000-0x00007FF698461000-memory.dmp	xmrig
behavioral2/memory/4676-2012-0x00007FF66E960000-0x00007FF66ED51000-memory.dmp	xmrig
behavioral2/memory/3116-2016-0x00007FF6E6E80000-0x00007FF6E7271000-memory.dmp	xmrig
behavioral2/memory/112-2020-0x00007FF7BC040000-0x00007FF7BC431000-memory.dmp	xmrig
behavioral2/memory/5072-2022-0x00007FF66A150000-0x00007FF66A541000-memory.dmp	xmrig
behavioral2/memory/4184-2024-0x00007FF7F9740000-0x00007FF7F9B31000-memory.dmp	xmrig
behavioral2/memory/5060-2043-0x00007FF669A00000-0x00007FF669DF1000-memory.dmp	xmrig
behavioral2/memory/852-2066-0x00007FF7D1BA0000-0x00007FF7D1F91000-memory.dmp	xmrig
behavioral2/memory/1484-2065-0x00007FF6182B0000-0x00007FF6186A1000-memory.dmp	xmrig
behavioral2/memory/2812-2062-0x00007FF640750000-0x00007FF640B41000-memory.dmp	xmrig
behavioral2/memory/4616-2061-0x00007FF7F8850000-0x00007FF7F8C41000-memory.dmp	xmrig
behavioral2/memory/2332-2018-0x00007FF78C9C0000-0x00007FF78CDB1000-memory.dmp	xmrig
behavioral2/memory/3912-2014-0x00007FF760D80000-0x00007FF761171000-memory.dmp	xmrig
behavioral2/memory/4000-2008-0x00007FF765460000-0x00007FF765851000-memory.dmp	xmrig
behavioral2/memory/3488-2005-0x00007FF6F0220000-0x00007FF6F0611000-memory.dmp	xmrig
behavioral2/memory/2912-2006-0x00007FF68C1E0000-0x00007FF68C5D1000-memory.dmp	xmrig
behavioral2/memory/4452-2002-0x00007FF7A3DE0000-0x00007FF7A41D1000-memory.dmp	xmrig
behavioral2/memory/2600-2001-0x00007FF655AD0000-0x00007FF655EC1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4812	sTUwAsh.exe
4376	wNtVUoK.exe
2524	HnnDLCh.exe
556	wQRqOud.exe
3864	fFxkptd.exe
4676	vqNBlgZ.exe
3460	IKgWSfh.exe
4000	Gpilpsn.exe
2600	DiZhgRe.exe
3288	uGkasaG.exe
4452	rxJwnaU.exe
2912	itcUabO.exe
3912	pZytmUY.exe
3488	nUDkasH.exe
3116	swMcSam.exe
2332	VmbPJQy.exe
112	JPBErFw.exe
5072	RpaxweW.exe
4184	NpeVtjn.exe
4616	OyDXyrV.exe
852	MlSdJct.exe
5060	MriDcdL.exe
2812	zYZgdFF.exe
1484	KeiPOAZ.exe
3388	MyINUnC.exe
2076	sbCtzLt.exe
1400	RvQJNQL.exe
968	JAfnewz.exe
4320	JIqUFEI.exe
1952	aIKiNXO.exe
4912	rDppyqg.exe
4964	VrjUbXu.exe
3396	crZMIJw.exe
2468	rwYQHtv.exe
3960	AKsTCpZ.exe
4324	xMgznSh.exe
4364	zMLblav.exe
216	hvhxMQJ.exe
3908	SaCwpqS.exe
4976	roSMruU.exe
5004	fiZGmgx.exe
4420	UymxigT.exe
412	uyjODgd.exe
3312	CBJEROf.exe
516	nElsYSE.exe
3712	bWAluoo.exe
3648	EaQNGAc.exe
4860	VsxVmUu.exe
2428	SHAQcRg.exe
2708	CjyhoFP.exe
4800	BMFvGTb.exe
1932	ZneEuYg.exe
2856	bqiDYsT.exe
3976	vSwnBog.exe
2416	ltUvVkx.exe
1940	RRzHOoe.exe
2988	axLQQge.exe
712	EhVLDuC.exe
2272	SGXGryM.exe
4888	SnTJjJG.exe
1612	kGmHNpv.exe
4740	OTxzMra.exe
4620	wpoNQwH.exe
3628	JQDKfpW.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4584-0-0x00007FF7C7570000-0x00007FF7C7961000-memory.dmp	upx
behavioral2/files/0x000900000002368b-7.dat	upx
behavioral2/files/0x0007000000023692-6.dat	upx
behavioral2/memory/4376-23-0x00007FF73C7B0000-0x00007FF73CBA1000-memory.dmp	upx
behavioral2/files/0x0007000000023693-29.dat	upx
behavioral2/files/0x0007000000023695-31.dat	upx
behavioral2/files/0x0007000000023698-47.dat	upx
behavioral2/files/0x0007000000023694-52.dat	upx
behavioral2/files/0x0007000000023699-58.dat	upx
behavioral2/memory/2912-67-0x00007FF68C1E0000-0x00007FF68C5D1000-memory.dmp	upx
behavioral2/memory/4676-70-0x00007FF66E960000-0x00007FF66ED51000-memory.dmp	upx
behavioral2/files/0x000700000002369b-74.dat	upx
behavioral2/files/0x00070000000236a0-97.dat	upx
behavioral2/files/0x00070000000236a5-122.dat	upx
behavioral2/files/0x00070000000236a7-135.dat	upx
behavioral2/files/0x00070000000236aa-150.dat	upx
behavioral2/files/0x00070000000236ad-165.dat	upx
behavioral2/memory/4452-350-0x00007FF7A3DE0000-0x00007FF7A41D1000-memory.dmp	upx
behavioral2/memory/3116-369-0x00007FF6E6E80000-0x00007FF6E7271000-memory.dmp	upx
behavioral2/memory/5072-398-0x00007FF66A150000-0x00007FF66A541000-memory.dmp	upx
behavioral2/memory/852-405-0x00007FF7D1BA0000-0x00007FF7D1F91000-memory.dmp	upx
behavioral2/memory/1484-415-0x00007FF6182B0000-0x00007FF6186A1000-memory.dmp	upx
behavioral2/memory/3488-428-0x00007FF6F0220000-0x00007FF6F0611000-memory.dmp	upx
behavioral2/memory/2812-412-0x00007FF640750000-0x00007FF640B41000-memory.dmp	upx
behavioral2/memory/5060-410-0x00007FF669A00000-0x00007FF669DF1000-memory.dmp	upx
behavioral2/memory/4616-402-0x00007FF7F8850000-0x00007FF7F8C41000-memory.dmp	upx
behavioral2/memory/4184-401-0x00007FF7F9740000-0x00007FF7F9B31000-memory.dmp	upx
behavioral2/memory/112-393-0x00007FF7BC040000-0x00007FF7BC431000-memory.dmp	upx
behavioral2/memory/2332-379-0x00007FF78C9C0000-0x00007FF78CDB1000-memory.dmp	upx
behavioral2/memory/3912-355-0x00007FF760D80000-0x00007FF761171000-memory.dmp	upx
behavioral2/files/0x00070000000236b0-173.dat	upx
behavioral2/files/0x00070000000236ae-170.dat	upx
behavioral2/files/0x00070000000236af-168.dat	upx
behavioral2/files/0x00070000000236ac-157.dat	upx
behavioral2/files/0x00070000000236ab-152.dat	upx
behavioral2/files/0x00070000000236a9-142.dat	upx
behavioral2/files/0x00070000000236a8-140.dat	upx
behavioral2/files/0x00070000000236a6-130.dat	upx
behavioral2/files/0x00070000000236a4-120.dat	upx
behavioral2/files/0x00070000000236a3-113.dat	upx
behavioral2/files/0x00070000000236a2-107.dat	upx
behavioral2/files/0x00070000000236a1-105.dat	upx
behavioral2/files/0x000700000002369f-95.dat	upx
behavioral2/files/0x000700000002369e-90.dat	upx
behavioral2/files/0x000700000002369d-85.dat	upx
behavioral2/files/0x000700000002369c-80.dat	upx
behavioral2/files/0x000700000002369a-72.dat	upx
behavioral2/memory/4000-71-0x00007FF765460000-0x00007FF765851000-memory.dmp	upx
behavioral2/memory/3864-68-0x00007FF7E4B30000-0x00007FF7E4F21000-memory.dmp	upx
behavioral2/memory/3288-65-0x00007FF698070000-0x00007FF698461000-memory.dmp	upx
behavioral2/memory/2600-61-0x00007FF655AD0000-0x00007FF655EC1000-memory.dmp	upx
behavioral2/files/0x0007000000023697-60.dat	upx
behavioral2/memory/3460-49-0x00007FF7AC7B0000-0x00007FF7ACBA1000-memory.dmp	upx
behavioral2/memory/2524-42-0x00007FF607E20000-0x00007FF608211000-memory.dmp	upx
behavioral2/files/0x0007000000023696-39.dat	upx
behavioral2/memory/556-26-0x00007FF7DAD30000-0x00007FF7DB121000-memory.dmp	upx
behavioral2/memory/4812-12-0x00007FF6B22C0000-0x00007FF6B26B1000-memory.dmp	upx
behavioral2/files/0x0008000000023691-15.dat	upx
behavioral2/memory/4812-1946-0x00007FF6B22C0000-0x00007FF6B26B1000-memory.dmp	upx
behavioral2/memory/4376-1947-0x00007FF73C7B0000-0x00007FF73CBA1000-memory.dmp	upx
behavioral2/memory/556-1948-0x00007FF7DAD30000-0x00007FF7DB121000-memory.dmp	upx
behavioral2/memory/2600-1949-0x00007FF655AD0000-0x00007FF655EC1000-memory.dmp	upx
behavioral2/memory/2912-1950-0x00007FF68C1E0000-0x00007FF68C5D1000-memory.dmp	upx
behavioral2/memory/4812-1988-0x00007FF6B22C0000-0x00007FF6B26B1000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\NdbbDjF.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\MjdXmUw.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\rNiNfvl.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\SlsxPcT.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\IlZxyie.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\VvAAUuF.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\onJfXDg.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\slqTcAn.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\MdBOEYc.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\TuVLaBa.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\AVnPQJN.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\bEYZXMt.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\NouRYUr.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\FvbJvBo.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\PeZqOfU.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\VeBnSGg.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\RrxinKv.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\KiHXqlS.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\mFUkdUu.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\DNZGSWH.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\GsMbXVD.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\jKDPgPN.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\nCMyXvJ.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\Xdvgwpi.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\IQwIciF.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\otOvCoU.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\tDpyyLB.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\pWBfTqC.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\EXHLYDh.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\dlXdYhz.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\LfwPaPX.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\aIKiNXO.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\PUdkYLC.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\BNADKLl.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\BmDxXtC.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\AqdPmGG.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\wgEfVNb.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\YKqPDAM.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\JAfnewz.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\nynRoOZ.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\mgVxRWo.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\AnTyPdm.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\DjJsxOX.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\oSLfvsj.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\mkxIugu.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\nCkCvZD.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\qYRXZAC.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\SUZSFSN.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\nTtIBnW.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\DkNjbtl.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\MbPuBRA.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\XtDhMUS.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\VCaDSXG.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\ZskjhfP.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\UywpOrm.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\KFwmJop.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\GuNyZOJ.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\vnEaesT.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\kSrbyxr.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\VaRpEOy.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\nOhzPTn.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\xkFWInw.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\zamCuqO.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
File created	C:\Windows\System32\TcHzkDv.exe	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 4812	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	90
PID 4584 wrote to memory of 4812	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	90
PID 4584 wrote to memory of 4376	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	91
PID 4584 wrote to memory of 4376	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	91
PID 4584 wrote to memory of 2524	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	92
PID 4584 wrote to memory of 2524	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	92
PID 4584 wrote to memory of 556	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	93
PID 4584 wrote to memory of 556	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	93
PID 4584 wrote to memory of 4676	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	94
PID 4584 wrote to memory of 4676	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	94
PID 4584 wrote to memory of 3864	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	95
PID 4584 wrote to memory of 3864	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	95
PID 4584 wrote to memory of 3460	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	96
PID 4584 wrote to memory of 3460	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	96
PID 4584 wrote to memory of 4000	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	97
PID 4584 wrote to memory of 4000	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	97
PID 4584 wrote to memory of 2600	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	98
PID 4584 wrote to memory of 2600	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	98
PID 4584 wrote to memory of 3288	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	99
PID 4584 wrote to memory of 3288	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	99
PID 4584 wrote to memory of 4452	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	100
PID 4584 wrote to memory of 4452	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	100
PID 4584 wrote to memory of 2912	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	101
PID 4584 wrote to memory of 2912	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	101
PID 4584 wrote to memory of 3912	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	102
PID 4584 wrote to memory of 3912	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	102
PID 4584 wrote to memory of 3488	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	103
PID 4584 wrote to memory of 3488	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	103
PID 4584 wrote to memory of 3116	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	104
PID 4584 wrote to memory of 3116	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	104
PID 4584 wrote to memory of 2332	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	105
PID 4584 wrote to memory of 2332	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	105
PID 4584 wrote to memory of 112	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	106
PID 4584 wrote to memory of 112	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	106
PID 4584 wrote to memory of 5072	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	107
PID 4584 wrote to memory of 5072	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	107
PID 4584 wrote to memory of 4184	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	108
PID 4584 wrote to memory of 4184	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	108
PID 4584 wrote to memory of 4616	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	109
PID 4584 wrote to memory of 4616	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	109
PID 4584 wrote to memory of 852	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	110
PID 4584 wrote to memory of 852	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	110
PID 4584 wrote to memory of 5060	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	111
PID 4584 wrote to memory of 5060	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	111
PID 4584 wrote to memory of 2812	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	112
PID 4584 wrote to memory of 2812	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	112
PID 4584 wrote to memory of 1484	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	113
PID 4584 wrote to memory of 1484	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	113
PID 4584 wrote to memory of 3388	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	114
PID 4584 wrote to memory of 3388	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	114
PID 4584 wrote to memory of 2076	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	115
PID 4584 wrote to memory of 2076	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	115
PID 4584 wrote to memory of 1400	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	116
PID 4584 wrote to memory of 1400	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	116
PID 4584 wrote to memory of 968	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	117
PID 4584 wrote to memory of 968	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	117
PID 4584 wrote to memory of 4320	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	118
PID 4584 wrote to memory of 4320	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	118
PID 4584 wrote to memory of 1952	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	119
PID 4584 wrote to memory of 1952	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	119
PID 4584 wrote to memory of 4912	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	120
PID 4584 wrote to memory of 4912	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	120
PID 4584 wrote to memory of 4964	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	121
PID 4584 wrote to memory of 4964	4584	bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe	121

C:\Users\Admin\AppData\Local\Temp\bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\bbf9e8846826f31fc4ed6181151cf100_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\System32\sTUwAsh.exe
  C:\Windows\System32\sTUwAsh.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System32\wNtVUoK.exe
  C:\Windows\System32\wNtVUoK.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System32\HnnDLCh.exe
  C:\Windows\System32\HnnDLCh.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System32\wQRqOud.exe
  C:\Windows\System32\wQRqOud.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System32\vqNBlgZ.exe
  C:\Windows\System32\vqNBlgZ.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System32\fFxkptd.exe
  C:\Windows\System32\fFxkptd.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System32\IKgWSfh.exe
  C:\Windows\System32\IKgWSfh.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System32\Gpilpsn.exe
  C:\Windows\System32\Gpilpsn.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System32\DiZhgRe.exe
  C:\Windows\System32\DiZhgRe.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System32\uGkasaG.exe
  C:\Windows\System32\uGkasaG.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System32\rxJwnaU.exe
  C:\Windows\System32\rxJwnaU.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System32\itcUabO.exe
  C:\Windows\System32\itcUabO.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System32\pZytmUY.exe
  C:\Windows\System32\pZytmUY.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System32\nUDkasH.exe
  C:\Windows\System32\nUDkasH.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System32\swMcSam.exe
  C:\Windows\System32\swMcSam.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System32\VmbPJQy.exe
  C:\Windows\System32\VmbPJQy.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System32\JPBErFw.exe
  C:\Windows\System32\JPBErFw.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System32\RpaxweW.exe
  C:\Windows\System32\RpaxweW.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System32\NpeVtjn.exe
  C:\Windows\System32\NpeVtjn.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System32\OyDXyrV.exe
  C:\Windows\System32\OyDXyrV.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System32\MlSdJct.exe
  C:\Windows\System32\MlSdJct.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System32\MriDcdL.exe
  C:\Windows\System32\MriDcdL.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System32\zYZgdFF.exe
  C:\Windows\System32\zYZgdFF.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System32\KeiPOAZ.exe
  C:\Windows\System32\KeiPOAZ.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System32\MyINUnC.exe
  C:\Windows\System32\MyINUnC.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System32\sbCtzLt.exe
  C:\Windows\System32\sbCtzLt.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System32\RvQJNQL.exe
  C:\Windows\System32\RvQJNQL.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System32\JAfnewz.exe
  C:\Windows\System32\JAfnewz.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System32\JIqUFEI.exe
  C:\Windows\System32\JIqUFEI.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System32\aIKiNXO.exe
  C:\Windows\System32\aIKiNXO.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System32\rDppyqg.exe
  C:\Windows\System32\rDppyqg.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System32\VrjUbXu.exe
  C:\Windows\System32\VrjUbXu.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System32\crZMIJw.exe
  C:\Windows\System32\crZMIJw.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System32\rwYQHtv.exe
  C:\Windows\System32\rwYQHtv.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System32\AKsTCpZ.exe
  C:\Windows\System32\AKsTCpZ.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System32\xMgznSh.exe
  C:\Windows\System32\xMgznSh.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System32\zMLblav.exe
  C:\Windows\System32\zMLblav.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System32\hvhxMQJ.exe
  C:\Windows\System32\hvhxMQJ.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System32\SaCwpqS.exe
  C:\Windows\System32\SaCwpqS.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System32\roSMruU.exe
  C:\Windows\System32\roSMruU.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System32\fiZGmgx.exe
  C:\Windows\System32\fiZGmgx.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System32\UymxigT.exe
  C:\Windows\System32\UymxigT.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System32\uyjODgd.exe
  C:\Windows\System32\uyjODgd.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System32\CBJEROf.exe
  C:\Windows\System32\CBJEROf.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System32\nElsYSE.exe
  C:\Windows\System32\nElsYSE.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System32\bWAluoo.exe
  C:\Windows\System32\bWAluoo.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System32\EaQNGAc.exe
  C:\Windows\System32\EaQNGAc.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System32\VsxVmUu.exe
  C:\Windows\System32\VsxVmUu.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System32\SHAQcRg.exe
  C:\Windows\System32\SHAQcRg.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System32\CjyhoFP.exe
  C:\Windows\System32\CjyhoFP.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System32\BMFvGTb.exe
  C:\Windows\System32\BMFvGTb.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System32\ZneEuYg.exe
  C:\Windows\System32\ZneEuYg.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System32\bqiDYsT.exe
  C:\Windows\System32\bqiDYsT.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System32\vSwnBog.exe
  C:\Windows\System32\vSwnBog.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System32\ltUvVkx.exe
  C:\Windows\System32\ltUvVkx.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System32\RRzHOoe.exe
  C:\Windows\System32\RRzHOoe.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System32\axLQQge.exe
  C:\Windows\System32\axLQQge.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System32\EhVLDuC.exe
  C:\Windows\System32\EhVLDuC.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System32\SGXGryM.exe
  C:\Windows\System32\SGXGryM.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System32\SnTJjJG.exe
  C:\Windows\System32\SnTJjJG.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System32\kGmHNpv.exe
  C:\Windows\System32\kGmHNpv.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System32\OTxzMra.exe
  C:\Windows\System32\OTxzMra.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System32\wpoNQwH.exe
  C:\Windows\System32\wpoNQwH.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System32\JQDKfpW.exe
  C:\Windows\System32\JQDKfpW.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System32\TAoZraD.exe
  C:\Windows\System32\TAoZraD.exe
  2⤵
  PID:1480
- C:\Windows\System32\vjWynos.exe
  C:\Windows\System32\vjWynos.exe
  2⤵
  PID:5136
- C:\Windows\System32\xkFWInw.exe
  C:\Windows\System32\xkFWInw.exe
  2⤵
  PID:5164
- C:\Windows\System32\MZmfsTN.exe
  C:\Windows\System32\MZmfsTN.exe
  2⤵
  PID:5196
- C:\Windows\System32\BhiXMJr.exe
  C:\Windows\System32\BhiXMJr.exe
  2⤵
  PID:5220
- C:\Windows\System32\bEYZXMt.exe
  C:\Windows\System32\bEYZXMt.exe
  2⤵
  PID:5256
- C:\Windows\System32\SryeQst.exe
  C:\Windows\System32\SryeQst.exe
  2⤵
  PID:5276
- C:\Windows\System32\fqnLLcz.exe
  C:\Windows\System32\fqnLLcz.exe
  2⤵
  PID:5308
- C:\Windows\System32\AQtYRkr.exe
  C:\Windows\System32\AQtYRkr.exe
  2⤵
  PID:5332
- C:\Windows\System32\LkgjlSF.exe
  C:\Windows\System32\LkgjlSF.exe
  2⤵
  PID:5372
- C:\Windows\System32\sCPOjrB.exe
  C:\Windows\System32\sCPOjrB.exe
  2⤵
  PID:5388
- C:\Windows\System32\oSLfvsj.exe
  C:\Windows\System32\oSLfvsj.exe
  2⤵
  PID:5416
- C:\Windows\System32\NjCobDI.exe
  C:\Windows\System32\NjCobDI.exe
  2⤵
  PID:5444
- C:\Windows\System32\wHZWJip.exe
  C:\Windows\System32\wHZWJip.exe
  2⤵
  PID:5476
- C:\Windows\System32\SXAcYhz.exe
  C:\Windows\System32\SXAcYhz.exe
  2⤵
  PID:5500
- C:\Windows\System32\LESyJUu.exe
  C:\Windows\System32\LESyJUu.exe
  2⤵
  PID:5528
- C:\Windows\System32\BvwzbZu.exe
  C:\Windows\System32\BvwzbZu.exe
  2⤵
  PID:5556
- C:\Windows\System32\JvrNwNh.exe
  C:\Windows\System32\JvrNwNh.exe
  2⤵
  PID:5584
- C:\Windows\System32\PeZqOfU.exe
  C:\Windows\System32\PeZqOfU.exe
  2⤵
  PID:5612
- C:\Windows\System32\BbFjrrj.exe
  C:\Windows\System32\BbFjrrj.exe
  2⤵
  PID:5640
- C:\Windows\System32\OYnNYAy.exe
  C:\Windows\System32\OYnNYAy.exe
  2⤵
  PID:5664
- C:\Windows\System32\gkAdsKX.exe
  C:\Windows\System32\gkAdsKX.exe
  2⤵
  PID:5708
- C:\Windows\System32\LtDuOIS.exe
  C:\Windows\System32\LtDuOIS.exe
  2⤵
  PID:5736
- C:\Windows\System32\UEqJKnm.exe
  C:\Windows\System32\UEqJKnm.exe
  2⤵
  PID:5756
- C:\Windows\System32\GQtzDpI.exe
  C:\Windows\System32\GQtzDpI.exe
  2⤵
  PID:5780
- C:\Windows\System32\HLSeWPS.exe
  C:\Windows\System32\HLSeWPS.exe
  2⤵
  PID:5808
- C:\Windows\System32\UifzHZm.exe
  C:\Windows\System32\UifzHZm.exe
  2⤵
  PID:5840
- C:\Windows\System32\MhvcVuk.exe
  C:\Windows\System32\MhvcVuk.exe
  2⤵
  PID:5864
- C:\Windows\System32\WDvDLTY.exe
  C:\Windows\System32\WDvDLTY.exe
  2⤵
  PID:5900
- C:\Windows\System32\oGVmmPZ.exe
  C:\Windows\System32\oGVmmPZ.exe
  2⤵
  PID:5916
- C:\Windows\System32\httOhyh.exe
  C:\Windows\System32\httOhyh.exe
  2⤵
  PID:5960
- C:\Windows\System32\fhtCzSC.exe
  C:\Windows\System32\fhtCzSC.exe
  2⤵
  PID:5976
- C:\Windows\System32\OHeSHYF.exe
  C:\Windows\System32\OHeSHYF.exe
  2⤵
  PID:5992
- C:\Windows\System32\yefLWGR.exe
  C:\Windows\System32\yefLWGR.exe
  2⤵
  PID:6008
- C:\Windows\System32\eoAnoom.exe
  C:\Windows\System32\eoAnoom.exe
  2⤵
  PID:6024
- C:\Windows\System32\vjyUxDY.exe
  C:\Windows\System32\vjyUxDY.exe
  2⤵
  PID:6052
- C:\Windows\System32\KtwMCze.exe
  C:\Windows\System32\KtwMCze.exe
  2⤵
  PID:6068
- C:\Windows\System32\YFViDMn.exe
  C:\Windows\System32\YFViDMn.exe
  2⤵
  PID:6084
- C:\Windows\System32\NgDSaNz.exe
  C:\Windows\System32\NgDSaNz.exe
  2⤵
  PID:6100
- C:\Windows\System32\wBVLqiX.exe
  C:\Windows\System32\wBVLqiX.exe
  2⤵
  PID:6116
- C:\Windows\System32\ZRxsYaa.exe
  C:\Windows\System32\ZRxsYaa.exe
  2⤵
  PID:6140
- C:\Windows\System32\OPWtZPc.exe
  C:\Windows\System32\OPWtZPc.exe
  2⤵
  PID:4880
- C:\Windows\System32\NaNDiUA.exe
  C:\Windows\System32\NaNDiUA.exe
  2⤵
  PID:4572
- C:\Windows\System32\FvbJvBo.exe
  C:\Windows\System32\FvbJvBo.exe
  2⤵
  PID:4264
- C:\Windows\System32\XunYxjv.exe
  C:\Windows\System32\XunYxjv.exe
  2⤵
  PID:4280
- C:\Windows\System32\QPNJKNG.exe
  C:\Windows\System32\QPNJKNG.exe
  2⤵
  PID:1680
- C:\Windows\System32\xFRhHcE.exe
  C:\Windows\System32\xFRhHcE.exe
  2⤵
  PID:5228
- C:\Windows\System32\ppIPRAo.exe
  C:\Windows\System32\ppIPRAo.exe
  2⤵
  PID:5408
- C:\Windows\System32\tSNTQuh.exe
  C:\Windows\System32\tSNTQuh.exe
  2⤵
  PID:5540
- C:\Windows\System32\GuNyZOJ.exe
  C:\Windows\System32\GuNyZOJ.exe
  2⤵
  PID:5564
- C:\Windows\System32\aeHlkDn.exe
  C:\Windows\System32\aeHlkDn.exe
  2⤵
  PID:5604
- C:\Windows\System32\ykmwnMg.exe
  C:\Windows\System32\ykmwnMg.exe
  2⤵
  PID:5624
- C:\Windows\System32\WUPmCoS.exe
  C:\Windows\System32\WUPmCoS.exe
  2⤵
  PID:5768
- C:\Windows\System32\DGzVMOn.exe
  C:\Windows\System32\DGzVMOn.exe
  2⤵
  PID:4744
- C:\Windows\System32\FfFbgtr.exe
  C:\Windows\System32\FfFbgtr.exe
  2⤵
  PID:4848
- C:\Windows\System32\HDFCHkO.exe
  C:\Windows\System32\HDFCHkO.exe
  2⤵
  PID:5932
- C:\Windows\System32\RkYMIcp.exe
  C:\Windows\System32\RkYMIcp.exe
  2⤵
  PID:6040
- C:\Windows\System32\gsiTQSF.exe
  C:\Windows\System32\gsiTQSF.exe
  2⤵
  PID:2340
- C:\Windows\System32\DcngoXU.exe
  C:\Windows\System32\DcngoXU.exe
  2⤵
  PID:6112
- C:\Windows\System32\zdOrkuf.exe
  C:\Windows\System32\zdOrkuf.exe
  2⤵
  PID:5984
- C:\Windows\System32\pWBfTqC.exe
  C:\Windows\System32\pWBfTqC.exe
  2⤵
  PID:1728
- C:\Windows\System32\tzTtPLV.exe
  C:\Windows\System32\tzTtPLV.exe
  2⤵
  PID:4068
- C:\Windows\System32\xvBnaZe.exe
  C:\Windows\System32\xvBnaZe.exe
  2⤵
  PID:4832
- C:\Windows\System32\wxNXaoE.exe
  C:\Windows\System32\wxNXaoE.exe
  2⤵
  PID:5212
- C:\Windows\System32\lkHWuay.exe
  C:\Windows\System32\lkHWuay.exe
  2⤵
  PID:2292
- C:\Windows\System32\CxTBLHB.exe
  C:\Windows\System32\CxTBLHB.exe
  2⤵
  PID:1372
- C:\Windows\System32\PbbbLcg.exe
  C:\Windows\System32\PbbbLcg.exe
  2⤵
  PID:5648
- C:\Windows\System32\mkxIugu.exe
  C:\Windows\System32\mkxIugu.exe
  2⤵
  PID:5632
- C:\Windows\System32\GRMuUeI.exe
  C:\Windows\System32\GRMuUeI.exe
  2⤵
  PID:4524
- C:\Windows\System32\BdQiyAB.exe
  C:\Windows\System32\BdQiyAB.exe
  2⤵
  PID:2924
- C:\Windows\System32\zamCuqO.exe
  C:\Windows\System32\zamCuqO.exe
  2⤵
  PID:5764
- C:\Windows\System32\AzADgiF.exe
  C:\Windows\System32\AzADgiF.exe
  2⤵
  PID:3952
- C:\Windows\System32\qVoEZsh.exe
  C:\Windows\System32\qVoEZsh.exe
  2⤵
  PID:6132
- C:\Windows\System32\vnEaesT.exe
  C:\Windows\System32\vnEaesT.exe
  2⤵
  PID:6076
- C:\Windows\System32\BNCWoSR.exe
  C:\Windows\System32\BNCWoSR.exe
  2⤵
  PID:6044
- C:\Windows\System32\wWNaHdk.exe
  C:\Windows\System32\wWNaHdk.exe
  2⤵
  PID:4872
- C:\Windows\System32\gmnCZiK.exe
  C:\Windows\System32\gmnCZiK.exe
  2⤵
  PID:432
- C:\Windows\System32\pFFdoiP.exe
  C:\Windows\System32\pFFdoiP.exe
  2⤵
  PID:1384
- C:\Windows\System32\pezQRdF.exe
  C:\Windows\System32\pezQRdF.exe
  2⤵
  PID:3684
- C:\Windows\System32\YPCoSAB.exe
  C:\Windows\System32\YPCoSAB.exe
  2⤵
  PID:4684
- C:\Windows\System32\rGilfuG.exe
  C:\Windows\System32\rGilfuG.exe
  2⤵
  PID:4836
- C:\Windows\System32\Zncgtkr.exe
  C:\Windows\System32\Zncgtkr.exe
  2⤵
  PID:3100
- C:\Windows\System32\vIKBsJI.exe
  C:\Windows\System32\vIKBsJI.exe
  2⤵
  PID:5592
- C:\Windows\System32\wonHAcO.exe
  C:\Windows\System32\wonHAcO.exe
  2⤵
  PID:6156
- C:\Windows\System32\rMfvIUL.exe
  C:\Windows\System32\rMfvIUL.exe
  2⤵
  PID:6200
- C:\Windows\System32\PgwvDjD.exe
  C:\Windows\System32\PgwvDjD.exe
  2⤵
  PID:6216
- C:\Windows\System32\NIzAywE.exe
  C:\Windows\System32\NIzAywE.exe
  2⤵
  PID:6240
- C:\Windows\System32\ijUtQRl.exe
  C:\Windows\System32\ijUtQRl.exe
  2⤵
  PID:6268
- C:\Windows\System32\elMUxXf.exe
  C:\Windows\System32\elMUxXf.exe
  2⤵
  PID:6288
- C:\Windows\System32\FkotGOa.exe
  C:\Windows\System32\FkotGOa.exe
  2⤵
  PID:6304
- C:\Windows\System32\jHjADhL.exe
  C:\Windows\System32\jHjADhL.exe
  2⤵
  PID:6352
- C:\Windows\System32\OlhwjeX.exe
  C:\Windows\System32\OlhwjeX.exe
  2⤵
  PID:6368
- C:\Windows\System32\qAIsyij.exe
  C:\Windows\System32\qAIsyij.exe
  2⤵
  PID:6388
- C:\Windows\System32\bAeDWhQ.exe
  C:\Windows\System32\bAeDWhQ.exe
  2⤵
  PID:6412
- C:\Windows\System32\gHLXnYz.exe
  C:\Windows\System32\gHLXnYz.exe
  2⤵
  PID:6440
- C:\Windows\System32\AVoWhos.exe
  C:\Windows\System32\AVoWhos.exe
  2⤵
  PID:6476
- C:\Windows\System32\LXCTiFv.exe
  C:\Windows\System32\LXCTiFv.exe
  2⤵
  PID:6532
- C:\Windows\System32\NdbbDjF.exe
  C:\Windows\System32\NdbbDjF.exe
  2⤵
  PID:6548
- C:\Windows\System32\YTtGrmG.exe
  C:\Windows\System32\YTtGrmG.exe
  2⤵
  PID:6576
- C:\Windows\System32\neTFvGj.exe
  C:\Windows\System32\neTFvGj.exe
  2⤵
  PID:6620
- C:\Windows\System32\hYCWdDc.exe
  C:\Windows\System32\hYCWdDc.exe
  2⤵
  PID:6644
- C:\Windows\System32\lbjLBNu.exe
  C:\Windows\System32\lbjLBNu.exe
  2⤵
  PID:6664
- C:\Windows\System32\LBmIiqU.exe
  C:\Windows\System32\LBmIiqU.exe
  2⤵
  PID:6696
- C:\Windows\System32\VvAAUuF.exe
  C:\Windows\System32\VvAAUuF.exe
  2⤵
  PID:6728
- C:\Windows\System32\AUTRSoR.exe
  C:\Windows\System32\AUTRSoR.exe
  2⤵
  PID:6744
- C:\Windows\System32\QknCVNr.exe
  C:\Windows\System32\QknCVNr.exe
  2⤵
  PID:6764
- C:\Windows\System32\fTkGyTk.exe
  C:\Windows\System32\fTkGyTk.exe
  2⤵
  PID:6800
- C:\Windows\System32\JhYKyBy.exe
  C:\Windows\System32\JhYKyBy.exe
  2⤵
  PID:6828
- C:\Windows\System32\ZKTfkgp.exe
  C:\Windows\System32\ZKTfkgp.exe
  2⤵
  PID:6848
- C:\Windows\System32\LyNxnoQ.exe
  C:\Windows\System32\LyNxnoQ.exe
  2⤵
  PID:6872
- C:\Windows\System32\HnNiJVv.exe
  C:\Windows\System32\HnNiJVv.exe
  2⤵
  PID:6892
- C:\Windows\System32\YXEQBPk.exe
  C:\Windows\System32\YXEQBPk.exe
  2⤵
  PID:6912
- C:\Windows\System32\ClYpwMn.exe
  C:\Windows\System32\ClYpwMn.exe
  2⤵
  PID:6932
- C:\Windows\System32\OLVCgDu.exe
  C:\Windows\System32\OLVCgDu.exe
  2⤵
  PID:6952
- C:\Windows\System32\XUWJavG.exe
  C:\Windows\System32\XUWJavG.exe
  2⤵
  PID:6968
- C:\Windows\System32\gDMgUeh.exe
  C:\Windows\System32\gDMgUeh.exe
  2⤵
  PID:6988
- C:\Windows\System32\hngHhbg.exe
  C:\Windows\System32\hngHhbg.exe
  2⤵
  PID:7004
- C:\Windows\System32\gGNrvoB.exe
  C:\Windows\System32\gGNrvoB.exe
  2⤵
  PID:7028
- C:\Windows\System32\cIRTJsJ.exe
  C:\Windows\System32\cIRTJsJ.exe
  2⤵
  PID:7052
- C:\Windows\System32\MjdXmUw.exe
  C:\Windows\System32\MjdXmUw.exe
  2⤵
  PID:7068
- C:\Windows\System32\GDjPwFs.exe
  C:\Windows\System32\GDjPwFs.exe
  2⤵
  PID:7084
- C:\Windows\System32\MwYFXpi.exe
  C:\Windows\System32\MwYFXpi.exe
  2⤵
  PID:7112
- C:\Windows\System32\fMnYjnf.exe
  C:\Windows\System32\fMnYjnf.exe
  2⤵
  PID:7132
- C:\Windows\System32\trkbosC.exe
  C:\Windows\System32\trkbosC.exe
  2⤵
  PID:7156
- C:\Windows\System32\kbENXmQ.exe
  C:\Windows\System32\kbENXmQ.exe
  2⤵
  PID:6436
- C:\Windows\System32\NqnnVXh.exe
  C:\Windows\System32\NqnnVXh.exe
  2⤵
  PID:6508
- C:\Windows\System32\PUdkYLC.exe
  C:\Windows\System32\PUdkYLC.exe
  2⤵
  PID:6544
- C:\Windows\System32\Pfsmvew.exe
  C:\Windows\System32\Pfsmvew.exe
  2⤵
  PID:6600
- C:\Windows\System32\MHUMxDm.exe
  C:\Windows\System32\MHUMxDm.exe
  2⤵
  PID:6652
- C:\Windows\System32\shVrBVt.exe
  C:\Windows\System32\shVrBVt.exe
  2⤵
  PID:6708
- C:\Windows\System32\xHCnnDQ.exe
  C:\Windows\System32\xHCnnDQ.exe
  2⤵
  PID:6840
- C:\Windows\System32\BGrGgbX.exe
  C:\Windows\System32\BGrGgbX.exe
  2⤵
  PID:6836
- C:\Windows\System32\HLGQxCz.exe
  C:\Windows\System32\HLGQxCz.exe
  2⤵
  PID:6928
- C:\Windows\System32\QiMHIqS.exe
  C:\Windows\System32\QiMHIqS.exe
  2⤵
  PID:6976
- C:\Windows\System32\tpQqEtc.exe
  C:\Windows\System32\tpQqEtc.exe
  2⤵
  PID:6960
- C:\Windows\System32\IKmGiLu.exe
  C:\Windows\System32\IKmGiLu.exe
  2⤵
  PID:7024
- C:\Windows\System32\SmuvJiA.exe
  C:\Windows\System32\SmuvJiA.exe
  2⤵
  PID:7128
- C:\Windows\System32\TPRmBKc.exe
  C:\Windows\System32\TPRmBKc.exe
  2⤵
  PID:1684
- C:\Windows\System32\pVhoghj.exe
  C:\Windows\System32\pVhoghj.exe
  2⤵
  PID:6408
- C:\Windows\System32\JlNxoMh.exe
  C:\Windows\System32\JlNxoMh.exe
  2⤵
  PID:6236
- C:\Windows\System32\belKQwX.exe
  C:\Windows\System32\belKQwX.exe
  2⤵
  PID:6724
- C:\Windows\System32\RScjevC.exe
  C:\Windows\System32\RScjevC.exe
  2⤵
  PID:6964
- C:\Windows\System32\ekcpWbr.exe
  C:\Windows\System32\ekcpWbr.exe
  2⤵
  PID:7080
- C:\Windows\System32\VQOPhiv.exe
  C:\Windows\System32\VQOPhiv.exe
  2⤵
  PID:7040
- C:\Windows\System32\HzzTTAW.exe
  C:\Windows\System32\HzzTTAW.exe
  2⤵
  PID:7000
- C:\Windows\System32\ggfVVSL.exe
  C:\Windows\System32\ggfVVSL.exe
  2⤵
  PID:6948
- C:\Windows\System32\sPfKPGW.exe
  C:\Windows\System32\sPfKPGW.exe
  2⤵
  PID:7016
- C:\Windows\System32\CjGkhau.exe
  C:\Windows\System32\CjGkhau.exe
  2⤵
  PID:7104
- C:\Windows\System32\QaljeOl.exe
  C:\Windows\System32\QaljeOl.exe
  2⤵
  PID:7192
- C:\Windows\System32\rUjSOah.exe
  C:\Windows\System32\rUjSOah.exe
  2⤵
  PID:7208
- C:\Windows\System32\kSrbyxr.exe
  C:\Windows\System32\kSrbyxr.exe
  2⤵
  PID:7228
- C:\Windows\System32\nfNPESL.exe
  C:\Windows\System32\nfNPESL.exe
  2⤵
  PID:7272
- C:\Windows\System32\QxnOKHb.exe
  C:\Windows\System32\QxnOKHb.exe
  2⤵
  PID:7300
- C:\Windows\System32\OziKfNI.exe
  C:\Windows\System32\OziKfNI.exe
  2⤵
  PID:7320
- C:\Windows\System32\NtvDNFf.exe
  C:\Windows\System32\NtvDNFf.exe
  2⤵
  PID:7340
- C:\Windows\System32\ZHiSabp.exe
  C:\Windows\System32\ZHiSabp.exe
  2⤵
  PID:7372
- C:\Windows\System32\RxiTngY.exe
  C:\Windows\System32\RxiTngY.exe
  2⤵
  PID:7408
- C:\Windows\System32\sYSXjVA.exe
  C:\Windows\System32\sYSXjVA.exe
  2⤵
  PID:7448
- C:\Windows\System32\iLMJRmZ.exe
  C:\Windows\System32\iLMJRmZ.exe
  2⤵
  PID:7472
- C:\Windows\System32\dWHAMRa.exe
  C:\Windows\System32\dWHAMRa.exe
  2⤵
  PID:7500
- C:\Windows\System32\VigMMmt.exe
  C:\Windows\System32\VigMMmt.exe
  2⤵
  PID:7516
- C:\Windows\System32\kJnFquQ.exe
  C:\Windows\System32\kJnFquQ.exe
  2⤵
  PID:7532
- C:\Windows\System32\RbfGIjp.exe
  C:\Windows\System32\RbfGIjp.exe
  2⤵
  PID:7560
- C:\Windows\System32\NkuCwJP.exe
  C:\Windows\System32\NkuCwJP.exe
  2⤵
  PID:7580
- C:\Windows\System32\YwwDtiY.exe
  C:\Windows\System32\YwwDtiY.exe
  2⤵
  PID:7608
- C:\Windows\System32\bHosHPN.exe
  C:\Windows\System32\bHosHPN.exe
  2⤵
  PID:7680
- C:\Windows\System32\BNADKLl.exe
  C:\Windows\System32\BNADKLl.exe
  2⤵
  PID:7704
- C:\Windows\System32\pqQIGdt.exe
  C:\Windows\System32\pqQIGdt.exe
  2⤵
  PID:7728
- C:\Windows\System32\hOoHkwY.exe
  C:\Windows\System32\hOoHkwY.exe
  2⤵
  PID:7748
- C:\Windows\System32\WLcSvKd.exe
  C:\Windows\System32\WLcSvKd.exe
  2⤵
  PID:7764
- C:\Windows\System32\xFgEAlc.exe
  C:\Windows\System32\xFgEAlc.exe
  2⤵
  PID:7784
- C:\Windows\System32\IiMnUes.exe
  C:\Windows\System32\IiMnUes.exe
  2⤵
  PID:7812
- C:\Windows\System32\EXHLYDh.exe
  C:\Windows\System32\EXHLYDh.exe
  2⤵
  PID:7832
- C:\Windows\System32\PcrKDPs.exe
  C:\Windows\System32\PcrKDPs.exe
  2⤵
  PID:7848
- C:\Windows\System32\HEwOizM.exe
  C:\Windows\System32\HEwOizM.exe
  2⤵
  PID:7880
- C:\Windows\System32\nCkCvZD.exe
  C:\Windows\System32\nCkCvZD.exe
  2⤵
  PID:7924
- C:\Windows\System32\VOCHnSx.exe
  C:\Windows\System32\VOCHnSx.exe
  2⤵
  PID:7948
- C:\Windows\System32\JsRMIOO.exe
  C:\Windows\System32\JsRMIOO.exe
  2⤵
  PID:7996
- C:\Windows\System32\zoevbyw.exe
  C:\Windows\System32\zoevbyw.exe
  2⤵
  PID:8024
- C:\Windows\System32\JqJxckb.exe
  C:\Windows\System32\JqJxckb.exe
  2⤵
  PID:8044
- C:\Windows\System32\obaWBFA.exe
  C:\Windows\System32\obaWBFA.exe
  2⤵
  PID:8088
- C:\Windows\System32\XReaWnl.exe
  C:\Windows\System32\XReaWnl.exe
  2⤵
  PID:8108
- C:\Windows\System32\wssbLMA.exe
  C:\Windows\System32\wssbLMA.exe
  2⤵
  PID:8124
- C:\Windows\System32\tXFamXF.exe
  C:\Windows\System32\tXFamXF.exe
  2⤵
  PID:8148
- C:\Windows\System32\swYbXXU.exe
  C:\Windows\System32\swYbXXU.exe
  2⤵
  PID:8184
- C:\Windows\System32\rNiNfvl.exe
  C:\Windows\System32\rNiNfvl.exe
  2⤵
  PID:7176
- C:\Windows\System32\PwwWUqo.exe
  C:\Windows\System32\PwwWUqo.exe
  2⤵
  PID:7204
- C:\Windows\System32\BHoOkMN.exe
  C:\Windows\System32\BHoOkMN.exe
  2⤵
  PID:7268
- C:\Windows\System32\QxsRhGR.exe
  C:\Windows\System32\QxsRhGR.exe
  2⤵
  PID:7308
- C:\Windows\System32\TkyaHVt.exe
  C:\Windows\System32\TkyaHVt.exe
  2⤵
  PID:7348
- C:\Windows\System32\gkLuSmf.exe
  C:\Windows\System32\gkLuSmf.exe
  2⤵
  PID:7396
- C:\Windows\System32\WLwTdTq.exe
  C:\Windows\System32\WLwTdTq.exe
  2⤵
  PID:7440
- C:\Windows\System32\BmDxXtC.exe
  C:\Windows\System32\BmDxXtC.exe
  2⤵
  PID:7484
- C:\Windows\System32\TaoiYGL.exe
  C:\Windows\System32\TaoiYGL.exe
  2⤵
  PID:7656
- C:\Windows\System32\CMyMxKa.exe
  C:\Windows\System32\CMyMxKa.exe
  2⤵
  PID:7760
- C:\Windows\System32\FYALxLF.exe
  C:\Windows\System32\FYALxLF.exe
  2⤵
  PID:7772
- C:\Windows\System32\gxJoQts.exe
  C:\Windows\System32\gxJoQts.exe
  2⤵
  PID:7828
- C:\Windows\System32\Syypldo.exe
  C:\Windows\System32\Syypldo.exe
  2⤵
  PID:7900
- C:\Windows\System32\QauOCBy.exe
  C:\Windows\System32\QauOCBy.exe
  2⤵
  PID:7976
- C:\Windows\System32\YuMiCca.exe
  C:\Windows\System32\YuMiCca.exe
  2⤵
  PID:8104
- C:\Windows\System32\slqTcAn.exe
  C:\Windows\System32\slqTcAn.exe
  2⤵
  PID:7288
- C:\Windows\System32\eRPZqSf.exe
  C:\Windows\System32\eRPZqSf.exe
  2⤵
  PID:7492
- C:\Windows\System32\tJhRZPw.exe
  C:\Windows\System32\tJhRZPw.exe
  2⤵
  PID:7420
- C:\Windows\System32\ZLowzfo.exe
  C:\Windows\System32\ZLowzfo.exe
  2⤵
  PID:7892
- C:\Windows\System32\VUTPRFm.exe
  C:\Windows\System32\VUTPRFm.exe
  2⤵
  PID:7860
- C:\Windows\System32\WeKqoRx.exe
  C:\Windows\System32\WeKqoRx.exe
  2⤵
  PID:7888
- C:\Windows\System32\NgQBvtm.exe
  C:\Windows\System32\NgQBvtm.exe
  2⤵
  PID:6920
- C:\Windows\System32\epGpGcf.exe
  C:\Windows\System32\epGpGcf.exe
  2⤵
  PID:7932
- C:\Windows\System32\IcKGOry.exe
  C:\Windows\System32\IcKGOry.exe
  2⤵
  PID:8208
- C:\Windows\System32\nTtIBnW.exe
  C:\Windows\System32\nTtIBnW.exe
  2⤵
  PID:8228
- C:\Windows\System32\sTlxFLf.exe
  C:\Windows\System32\sTlxFLf.exe
  2⤵
  PID:8244
- C:\Windows\System32\lNdMFFK.exe
  C:\Windows\System32\lNdMFFK.exe
  2⤵
  PID:8308
- C:\Windows\System32\xZrRyED.exe
  C:\Windows\System32\xZrRyED.exe
  2⤵
  PID:8348
- C:\Windows\System32\YStEsGe.exe
  C:\Windows\System32\YStEsGe.exe
  2⤵
  PID:8380
- C:\Windows\System32\JEJBxMm.exe
  C:\Windows\System32\JEJBxMm.exe
  2⤵
  PID:8396
- C:\Windows\System32\McojVKb.exe
  C:\Windows\System32\McojVKb.exe
  2⤵
  PID:8420
- C:\Windows\System32\TcHzkDv.exe
  C:\Windows\System32\TcHzkDv.exe
  2⤵
  PID:8436
- C:\Windows\System32\AqhyTOR.exe
  C:\Windows\System32\AqhyTOR.exe
  2⤵
  PID:8460
- C:\Windows\System32\jgtssUx.exe
  C:\Windows\System32\jgtssUx.exe
  2⤵
  PID:8500
- C:\Windows\System32\tVRbHZd.exe
  C:\Windows\System32\tVRbHZd.exe
  2⤵
  PID:8516
- C:\Windows\System32\QAsoRUM.exe
  C:\Windows\System32\QAsoRUM.exe
  2⤵
  PID:8544
- C:\Windows\System32\XcMsmpJ.exe
  C:\Windows\System32\XcMsmpJ.exe
  2⤵
  PID:8560
- C:\Windows\System32\FzEHvKE.exe
  C:\Windows\System32\FzEHvKE.exe
  2⤵
  PID:8592
- C:\Windows\System32\GLbEVWK.exe
  C:\Windows\System32\GLbEVWK.exe
  2⤵
  PID:8612
- C:\Windows\System32\Yvpiipz.exe
  C:\Windows\System32\Yvpiipz.exe
  2⤵
  PID:8636
- C:\Windows\System32\CHMNaBl.exe
  C:\Windows\System32\CHMNaBl.exe
  2⤵
  PID:8652
- C:\Windows\System32\SlsxPcT.exe
  C:\Windows\System32\SlsxPcT.exe
  2⤵
  PID:8684
- C:\Windows\System32\pxwgFVn.exe
  C:\Windows\System32\pxwgFVn.exe
  2⤵
  PID:8788
- C:\Windows\System32\XFgCrZz.exe
  C:\Windows\System32\XFgCrZz.exe
  2⤵
  PID:8804
- C:\Windows\System32\nynRoOZ.exe
  C:\Windows\System32\nynRoOZ.exe
  2⤵
  PID:8820
- C:\Windows\System32\mgVxRWo.exe
  C:\Windows\System32\mgVxRWo.exe
  2⤵
  PID:8844
- C:\Windows\System32\xfJWzfc.exe
  C:\Windows\System32\xfJWzfc.exe
  2⤵
  PID:8864
- C:\Windows\System32\LvfQhNz.exe
  C:\Windows\System32\LvfQhNz.exe
  2⤵
  PID:8912
- C:\Windows\System32\rLiMvOu.exe
  C:\Windows\System32\rLiMvOu.exe
  2⤵
  PID:8956
- C:\Windows\System32\bxIAkzm.exe
  C:\Windows\System32\bxIAkzm.exe
  2⤵
  PID:8972
- C:\Windows\System32\UFKtOke.exe
  C:\Windows\System32\UFKtOke.exe
  2⤵
  PID:8992
- C:\Windows\System32\OBvqyKf.exe
  C:\Windows\System32\OBvqyKf.exe
  2⤵
  PID:9016
- C:\Windows\System32\RCoeCsP.exe
  C:\Windows\System32\RCoeCsP.exe
  2⤵
  PID:9032
- C:\Windows\System32\UAVfWqx.exe
  C:\Windows\System32\UAVfWqx.exe
  2⤵
  PID:9048
- C:\Windows\System32\VeBnSGg.exe
  C:\Windows\System32\VeBnSGg.exe
  2⤵
  PID:9096
- C:\Windows\System32\AnzeeGk.exe
  C:\Windows\System32\AnzeeGk.exe
  2⤵
  PID:9128
- C:\Windows\System32\YHrMJYY.exe
  C:\Windows\System32\YHrMJYY.exe
  2⤵
  PID:9156
- C:\Windows\System32\LRubdsg.exe
  C:\Windows\System32\LRubdsg.exe
  2⤵
  PID:9184
- C:\Windows\System32\ikVxUIy.exe
  C:\Windows\System32\ikVxUIy.exe
  2⤵
  PID:9212
- C:\Windows\System32\OMIMQWm.exe
  C:\Windows\System32\OMIMQWm.exe
  2⤵
  PID:7404
- C:\Windows\System32\TLdgdAR.exe
  C:\Windows\System32\TLdgdAR.exe
  2⤵
  PID:3788
- C:\Windows\System32\OfhIYNE.exe
  C:\Windows\System32\OfhIYNE.exe
  2⤵
  PID:8332
- C:\Windows\System32\mFuDsld.exe
  C:\Windows\System32\mFuDsld.exe
  2⤵
  PID:8432
- C:\Windows\System32\UdoHHvF.exe
  C:\Windows\System32\UdoHHvF.exe
  2⤵
  PID:8448
- C:\Windows\System32\PfVQecA.exe
  C:\Windows\System32\PfVQecA.exe
  2⤵
  PID:8508
- C:\Windows\System32\TWdeSNr.exe
  C:\Windows\System32\TWdeSNr.exe
  2⤵
  PID:8584
- C:\Windows\System32\KXCFYkN.exe
  C:\Windows\System32\KXCFYkN.exe
  2⤵
  PID:8608
- C:\Windows\System32\DBZMckw.exe
  C:\Windows\System32\DBZMckw.exe
  2⤵
  PID:8648
- C:\Windows\System32\mFUkdUu.exe
  C:\Windows\System32\mFUkdUu.exe
  2⤵
  PID:8748
- C:\Windows\System32\BLoYUec.exe
  C:\Windows\System32\BLoYUec.exe
  2⤵
  PID:8784
- C:\Windows\System32\wXMrVLz.exe
  C:\Windows\System32\wXMrVLz.exe
  2⤵
  PID:8816
- C:\Windows\System32\DzKnhID.exe
  C:\Windows\System32\DzKnhID.exe
  2⤵
  PID:8856
- C:\Windows\System32\MkjbpCE.exe
  C:\Windows\System32\MkjbpCE.exe
  2⤵
  PID:8928
- C:\Windows\System32\jSyItkP.exe
  C:\Windows\System32\jSyItkP.exe
  2⤵
  PID:8988
- C:\Windows\System32\cdnheMQ.exe
  C:\Windows\System32\cdnheMQ.exe
  2⤵
  PID:9024
- C:\Windows\System32\cdRmBPx.exe
  C:\Windows\System32\cdRmBPx.exe
  2⤵
  PID:4108
- C:\Windows\System32\BRDWLgO.exe
  C:\Windows\System32\BRDWLgO.exe
  2⤵
  PID:9180
- C:\Windows\System32\KriDnOw.exe
  C:\Windows\System32\KriDnOw.exe
  2⤵
  PID:7556
- C:\Windows\System32\LunlvAo.exe
  C:\Windows\System32\LunlvAo.exe
  2⤵
  PID:8364
- C:\Windows\System32\nAtPHYj.exe
  C:\Windows\System32\nAtPHYj.exe
  2⤵
  PID:8772
- C:\Windows\System32\hflOpeB.exe
  C:\Windows\System32\hflOpeB.exe
  2⤵
  PID:8796
- C:\Windows\System32\UbGMfgH.exe
  C:\Windows\System32\UbGMfgH.exe
  2⤵
  PID:9004
- C:\Windows\System32\RNJAHgz.exe
  C:\Windows\System32\RNJAHgz.exe
  2⤵
  PID:8196
- C:\Windows\System32\TmOfAhc.exe
  C:\Windows\System32\TmOfAhc.exe
  2⤵
  PID:8240
- C:\Windows\System32\dhKsiYW.exe
  C:\Windows\System32\dhKsiYW.exe
  2⤵
  PID:8604
- C:\Windows\System32\tcjenZG.exe
  C:\Windows\System32\tcjenZG.exe
  2⤵
  PID:8576
- C:\Windows\System32\aEvBgtm.exe
  C:\Windows\System32\aEvBgtm.exe
  2⤵
  PID:8904
- C:\Windows\System32\bVccMMT.exe
  C:\Windows\System32\bVccMMT.exe
  2⤵
  PID:8468
- C:\Windows\System32\iuBlEHb.exe
  C:\Windows\System32\iuBlEHb.exe
  2⤵
  PID:9236
- C:\Windows\System32\owPuQnC.exe
  C:\Windows\System32\owPuQnC.exe
  2⤵
  PID:9284
- C:\Windows\System32\dviZZVT.exe
  C:\Windows\System32\dviZZVT.exe
  2⤵
  PID:9308
- C:\Windows\System32\BtyCDFz.exe
  C:\Windows\System32\BtyCDFz.exe
  2⤵
  PID:9328
- C:\Windows\System32\AEVOfXt.exe
  C:\Windows\System32\AEVOfXt.exe
  2⤵
  PID:9364
- C:\Windows\System32\sMWbEDu.exe
  C:\Windows\System32\sMWbEDu.exe
  2⤵
  PID:9404
- C:\Windows\System32\gWnpbuC.exe
  C:\Windows\System32\gWnpbuC.exe
  2⤵
  PID:9432
- C:\Windows\System32\wzrBsRc.exe
  C:\Windows\System32\wzrBsRc.exe
  2⤵
  PID:9452
- C:\Windows\System32\YrorgLd.exe
  C:\Windows\System32\YrorgLd.exe
  2⤵
  PID:9476
- C:\Windows\System32\cdesplK.exe
  C:\Windows\System32\cdesplK.exe
  2⤵
  PID:9492
- C:\Windows\System32\nXHAZUV.exe
  C:\Windows\System32\nXHAZUV.exe
  2⤵
  PID:9520
- C:\Windows\System32\TYvEmEv.exe
  C:\Windows\System32\TYvEmEv.exe
  2⤵
  PID:9552
- C:\Windows\System32\DztQyam.exe
  C:\Windows\System32\DztQyam.exe
  2⤵
  PID:9588
- C:\Windows\System32\ttiwADA.exe
  C:\Windows\System32\ttiwADA.exe
  2⤵
  PID:9608
- C:\Windows\System32\SqXHUqA.exe
  C:\Windows\System32\SqXHUqA.exe
  2⤵
  PID:9636
- C:\Windows\System32\NcpDLQH.exe
  C:\Windows\System32\NcpDLQH.exe
  2⤵
  PID:9652
- C:\Windows\System32\zBiYgbG.exe
  C:\Windows\System32\zBiYgbG.exe
  2⤵
  PID:9732
- C:\Windows\System32\DDjBbDH.exe
  C:\Windows\System32\DDjBbDH.exe
  2⤵
  PID:9776
- C:\Windows\System32\WGZVabs.exe
  C:\Windows\System32\WGZVabs.exe
  2⤵
  PID:9812
- C:\Windows\System32\hnEHHqd.exe
  C:\Windows\System32\hnEHHqd.exe
  2⤵
  PID:9856
- C:\Windows\System32\FFZzhDq.exe
  C:\Windows\System32\FFZzhDq.exe
  2⤵
  PID:9896
- C:\Windows\System32\QXsPsqj.exe
  C:\Windows\System32\QXsPsqj.exe
  2⤵
  PID:9916
- C:\Windows\System32\IYStJBm.exe
  C:\Windows\System32\IYStJBm.exe
  2⤵
  PID:9932
- C:\Windows\System32\APaGWnf.exe
  C:\Windows\System32\APaGWnf.exe
  2⤵
  PID:9948
- C:\Windows\System32\IQwIciF.exe
  C:\Windows\System32\IQwIciF.exe
  2⤵
  PID:9964
- C:\Windows\System32\khpNdDj.exe
  C:\Windows\System32\khpNdDj.exe
  2⤵
  PID:9980
- C:\Windows\System32\RAuyPEZ.exe
  C:\Windows\System32\RAuyPEZ.exe
  2⤵
  PID:9996
- C:\Windows\System32\IMwTuwE.exe
  C:\Windows\System32\IMwTuwE.exe
  2⤵
  PID:10012
- C:\Windows\System32\heovGSs.exe
  C:\Windows\System32\heovGSs.exe
  2⤵
  PID:10028
- C:\Windows\System32\vwVcaKv.exe
  C:\Windows\System32\vwVcaKv.exe
  2⤵
  PID:10044
- C:\Windows\System32\EQGuDrV.exe
  C:\Windows\System32\EQGuDrV.exe
  2⤵
  PID:10060
- C:\Windows\System32\uKWpVTo.exe
  C:\Windows\System32\uKWpVTo.exe
  2⤵
  PID:10080
- C:\Windows\System32\SnYCFOt.exe
  C:\Windows\System32\SnYCFOt.exe
  2⤵
  PID:10096
- C:\Windows\System32\OnaFNeT.exe
  C:\Windows\System32\OnaFNeT.exe
  2⤵
  PID:10116
- C:\Windows\System32\mZfifJd.exe
  C:\Windows\System32\mZfifJd.exe
  2⤵
  PID:10132
- C:\Windows\System32\kbLbcTQ.exe
  C:\Windows\System32\kbLbcTQ.exe
  2⤵
  PID:10148
- C:\Windows\System32\FVCfTVa.exe
  C:\Windows\System32\FVCfTVa.exe
  2⤵
  PID:10164
- C:\Windows\System32\KJZEJPg.exe
  C:\Windows\System32\KJZEJPg.exe
  2⤵
  PID:10180
- C:\Windows\System32\iXzOzqX.exe
  C:\Windows\System32\iXzOzqX.exe
  2⤵
  PID:10196
- C:\Windows\System32\qdzbVXa.exe
  C:\Windows\System32\qdzbVXa.exe
  2⤵
  PID:10212
- C:\Windows\System32\ByVAtIJ.exe
  C:\Windows\System32\ByVAtIJ.exe
  2⤵
  PID:10228
- C:\Windows\System32\idrQGme.exe
  C:\Windows\System32\idrQGme.exe
  2⤵
  PID:9196
- C:\Windows\System32\BBQoPWp.exe
  C:\Windows\System32\BBQoPWp.exe
  2⤵
  PID:8964
- C:\Windows\System32\udaAhJi.exe
  C:\Windows\System32\udaAhJi.exe
  2⤵
  PID:9228
- C:\Windows\System32\PZkzmYU.exe
  C:\Windows\System32\PZkzmYU.exe
  2⤵
  PID:9248
- C:\Windows\System32\lZPxFQy.exe
  C:\Windows\System32\lZPxFQy.exe
  2⤵
  PID:9292
- C:\Windows\System32\KFhMqyf.exe
  C:\Windows\System32\KFhMqyf.exe
  2⤵
  PID:9336
- C:\Windows\System32\LzLsmBF.exe
  C:\Windows\System32\LzLsmBF.exe
  2⤵
  PID:9380
- C:\Windows\System32\SLLLkKH.exe
  C:\Windows\System32\SLLLkKH.exe
  2⤵
  PID:9448
- C:\Windows\System32\LFvWStD.exe
  C:\Windows\System32\LFvWStD.exe
  2⤵
  PID:9468
- C:\Windows\System32\DNZGSWH.exe
  C:\Windows\System32\DNZGSWH.exe
  2⤵
  PID:9444
- C:\Windows\System32\MdBOEYc.exe
  C:\Windows\System32\MdBOEYc.exe
  2⤵
  PID:9540
- C:\Windows\System32\pfikzlp.exe
  C:\Windows\System32\pfikzlp.exe
  2⤵
  PID:9628
- C:\Windows\System32\IjgHvVw.exe
  C:\Windows\System32\IjgHvVw.exe
  2⤵
  PID:9680
- C:\Windows\System32\vUCyuLZ.exe
  C:\Windows\System32\vUCyuLZ.exe
  2⤵
  PID:9928
- C:\Windows\System32\otOvCoU.exe
  C:\Windows\System32\otOvCoU.exe
  2⤵
  PID:9960
- C:\Windows\System32\MvcxFpq.exe
  C:\Windows\System32\MvcxFpq.exe
  2⤵
  PID:10156
- C:\Windows\System32\vmXMHIt.exe
  C:\Windows\System32\vmXMHIt.exe
  2⤵
  PID:10108
- C:\Windows\System32\YphzmCy.exe
  C:\Windows\System32\YphzmCy.exe
  2⤵
  PID:9972
- C:\Windows\System32\xKaBMxJ.exe
  C:\Windows\System32\xKaBMxJ.exe
  2⤵
  PID:9304
- C:\Windows\System32\hzhnTQe.exe
  C:\Windows\System32\hzhnTQe.exe
  2⤵
  PID:10128
- C:\Windows\System32\iLozryK.exe
  C:\Windows\System32\iLozryK.exe
  2⤵
  PID:9316
- C:\Windows\System32\isZnshs.exe
  C:\Windows\System32\isZnshs.exe
  2⤵
  PID:9580
- C:\Windows\System32\DkNjbtl.exe
  C:\Windows\System32\DkNjbtl.exe
  2⤵
  PID:9740
- C:\Windows\System32\QqZMYiI.exe
  C:\Windows\System32\QqZMYiI.exe
  2⤵
  PID:9956
- C:\Windows\System32\ffblMNs.exe
  C:\Windows\System32\ffblMNs.exe
  2⤵
  PID:9460
- C:\Windows\System32\ofptwys.exe
  C:\Windows\System32\ofptwys.exe
  2⤵
  PID:10204
- C:\Windows\System32\tuJwmtx.exe
  C:\Windows\System32\tuJwmtx.exe
  2⤵
  PID:10024
- C:\Windows\System32\tVgpclg.exe
  C:\Windows\System32\tVgpclg.exe
  2⤵
  PID:10472
- C:\Windows\System32\IwdWDwO.exe
  C:\Windows\System32\IwdWDwO.exe
  2⤵
  PID:10572
- C:\Windows\System32\MpHeAhc.exe
  C:\Windows\System32\MpHeAhc.exe
  2⤵
  PID:10596
- C:\Windows\System32\qYRXZAC.exe
  C:\Windows\System32\qYRXZAC.exe
  2⤵
  PID:10636
- C:\Windows\System32\ldkbavL.exe
  C:\Windows\System32\ldkbavL.exe
  2⤵
  PID:10656
- C:\Windows\System32\VaRpEOy.exe
  C:\Windows\System32\VaRpEOy.exe
  2⤵
  PID:10672
- C:\Windows\System32\vbcqeBm.exe
  C:\Windows\System32\vbcqeBm.exe
  2⤵
  PID:10716
- C:\Windows\System32\exLdfbI.exe
  C:\Windows\System32\exLdfbI.exe
  2⤵
  PID:10736
- C:\Windows\System32\FdYdBVs.exe
  C:\Windows\System32\FdYdBVs.exe
  2⤵
  PID:10804
- C:\Windows\System32\MbPuBRA.exe
  C:\Windows\System32\MbPuBRA.exe
  2⤵
  PID:10824
- C:\Windows\System32\efUHsUp.exe
  C:\Windows\System32\efUHsUp.exe
  2⤵
  PID:10864
- C:\Windows\System32\AAHBhdT.exe
  C:\Windows\System32\AAHBhdT.exe
  2⤵
  PID:10888
- C:\Windows\System32\IRgRUDM.exe
  C:\Windows\System32\IRgRUDM.exe
  2⤵
  PID:10912
- C:\Windows\System32\XHuQdGq.exe
  C:\Windows\System32\XHuQdGq.exe
  2⤵
  PID:10932
- C:\Windows\System32\wpsbyth.exe
  C:\Windows\System32\wpsbyth.exe
  2⤵
  PID:10948
- C:\Windows\System32\enUqobd.exe
  C:\Windows\System32\enUqobd.exe
  2⤵
  PID:11008
- C:\Windows\System32\MOuJyIb.exe
  C:\Windows\System32\MOuJyIb.exe
  2⤵
  PID:11048
- C:\Windows\System32\XoOqSLu.exe
  C:\Windows\System32\XoOqSLu.exe
  2⤵
  PID:11084
- C:\Windows\System32\TPQztdy.exe
  C:\Windows\System32\TPQztdy.exe
  2⤵
  PID:11104
- C:\Windows\System32\dmrIqXQ.exe
  C:\Windows\System32\dmrIqXQ.exe
  2⤵
  PID:11120
- C:\Windows\System32\gqDKfkD.exe
  C:\Windows\System32\gqDKfkD.exe
  2⤵
  PID:11160
- C:\Windows\System32\dDTtUHm.exe
  C:\Windows\System32\dDTtUHm.exe
  2⤵
  PID:11176
- C:\Windows\System32\ASqnAkR.exe
  C:\Windows\System32\ASqnAkR.exe
  2⤵
  PID:11204
- C:\Windows\System32\dAymDgA.exe
  C:\Windows\System32\dAymDgA.exe
  2⤵
  PID:11224
- C:\Windows\System32\GaWgAsN.exe
  C:\Windows\System32\GaWgAsN.exe
  2⤵
  PID:11240
- C:\Windows\System32\sjcxuYt.exe
  C:\Windows\System32\sjcxuYt.exe
  2⤵
  PID:9584
- C:\Windows\System32\duRTKOv.exe
  C:\Windows\System32\duRTKOv.exe
  2⤵
  PID:10248
- C:\Windows\System32\lBsnnZc.exe
  C:\Windows\System32\lBsnnZc.exe
  2⤵
  PID:9824
- C:\Windows\System32\IEvOqrY.exe
  C:\Windows\System32\IEvOqrY.exe
  2⤵
  PID:9876
- C:\Windows\System32\OewKOSI.exe
  C:\Windows\System32\OewKOSI.exe
  2⤵
  PID:10004
- C:\Windows\System32\vhMPHjE.exe
  C:\Windows\System32\vhMPHjE.exe
  2⤵
  PID:10488
- C:\Windows\System32\WWbhuak.exe
  C:\Windows\System32\WWbhuak.exe
  2⤵
  PID:10160
- C:\Windows\System32\ZNbdwkv.exe
  C:\Windows\System32\ZNbdwkv.exe
  2⤵
  PID:10436
- C:\Windows\System32\rGwVhKM.exe
  C:\Windows\System32\rGwVhKM.exe
  2⤵
  PID:10468
- C:\Windows\System32\qnZcoOQ.exe
  C:\Windows\System32\qnZcoOQ.exe
  2⤵
  PID:10564
- C:\Windows\System32\NsxnYMo.exe
  C:\Windows\System32\NsxnYMo.exe
  2⤵
  PID:10668
- C:\Windows\System32\onJfXDg.exe
  C:\Windows\System32\onJfXDg.exe
  2⤵
  PID:10768
- C:\Windows\System32\VtuxrKv.exe
  C:\Windows\System32\VtuxrKv.exe
  2⤵
  PID:10776
- C:\Windows\System32\ZTAQOxq.exe
  C:\Windows\System32\ZTAQOxq.exe
  2⤵
  PID:10904
- C:\Windows\System32\AnQPQmH.exe
  C:\Windows\System32\AnQPQmH.exe
  2⤵
  PID:10964
- C:\Windows\System32\yNrufdi.exe
  C:\Windows\System32\yNrufdi.exe
  2⤵
  PID:11020
- C:\Windows\System32\qLeHtvd.exe
  C:\Windows\System32\qLeHtvd.exe
  2⤵
  PID:11028
- C:\Windows\System32\YkaoZMi.exe
  C:\Windows\System32\YkaoZMi.exe
  2⤵
  PID:11092
- C:\Windows\System32\Fzeyviv.exe
  C:\Windows\System32\Fzeyviv.exe
  2⤵
  PID:11200
- C:\Windows\System32\fjgxMEp.exe
  C:\Windows\System32\fjgxMEp.exe
  2⤵
  PID:11232
- C:\Windows\System32\fiRpBVl.exe
  C:\Windows\System32\fiRpBVl.exe
  2⤵
  PID:9344
- C:\Windows\System32\loWcmJz.exe
  C:\Windows\System32\loWcmJz.exe
  2⤵
  PID:9940
- C:\Windows\System32\IrNcoAd.exe
  C:\Windows\System32\IrNcoAd.exe
  2⤵
  PID:10368
- C:\Windows\System32\XwAtYrs.exe
  C:\Windows\System32\XwAtYrs.exe
  2⤵
  PID:10432
- C:\Windows\System32\xyeEMQz.exe
  C:\Windows\System32\xyeEMQz.exe
  2⤵
  PID:9892
- C:\Windows\System32\dvHxuNN.exe
  C:\Windows\System32\dvHxuNN.exe
  2⤵
  PID:10836
- C:\Windows\System32\XaGvcCF.exe
  C:\Windows\System32\XaGvcCF.exe
  2⤵
  PID:10900
- C:\Windows\System32\OnLbPjp.exe
  C:\Windows\System32\OnLbPjp.exe
  2⤵
  PID:10940
- C:\Windows\System32\GbdHRsK.exe
  C:\Windows\System32\GbdHRsK.exe
  2⤵
  PID:11056
- C:\Windows\System32\YlQrJpu.exe
  C:\Windows\System32\YlQrJpu.exe
  2⤵
  PID:10072
- C:\Windows\System32\yjKiOzQ.exe
  C:\Windows\System32\yjKiOzQ.exe
  2⤵
  PID:10684
- C:\Windows\System32\kwjifKs.exe
  C:\Windows\System32\kwjifKs.exe
  2⤵
  PID:10832
- C:\Windows\System32\eWkAHYy.exe
  C:\Windows\System32\eWkAHYy.exe
  2⤵
  PID:10944
- C:\Windows\System32\ZFEHVwQ.exe
  C:\Windows\System32\ZFEHVwQ.exe
  2⤵
  PID:10384
- C:\Windows\System32\JOYyxIU.exe
  C:\Windows\System32\JOYyxIU.exe
  2⤵
  PID:11268
- C:\Windows\System32\SsCZaYm.exe
  C:\Windows\System32\SsCZaYm.exe
  2⤵
  PID:11308
- C:\Windows\System32\KDSrirx.exe
  C:\Windows\System32\KDSrirx.exe
  2⤵
  PID:11368
- C:\Windows\System32\AnTyPdm.exe
  C:\Windows\System32\AnTyPdm.exe
  2⤵
  PID:11392
- C:\Windows\System32\MMNtzMT.exe
  C:\Windows\System32\MMNtzMT.exe
  2⤵
  PID:11428
- C:\Windows\System32\rpWcaho.exe
  C:\Windows\System32\rpWcaho.exe
  2⤵
  PID:11452
- C:\Windows\System32\OzjZdKr.exe
  C:\Windows\System32\OzjZdKr.exe
  2⤵
  PID:11472
- C:\Windows\System32\UNTYGGI.exe
  C:\Windows\System32\UNTYGGI.exe
  2⤵
  PID:11496
- C:\Windows\System32\OZaVxAE.exe
  C:\Windows\System32\OZaVxAE.exe
  2⤵
  PID:11524
- C:\Windows\System32\hUsZGqs.exe
  C:\Windows\System32\hUsZGqs.exe
  2⤵
  PID:11564
- C:\Windows\System32\edsoQuA.exe
  C:\Windows\System32\edsoQuA.exe
  2⤵
  PID:11584
- C:\Windows\System32\EyfPfyj.exe
  C:\Windows\System32\EyfPfyj.exe
  2⤵
  PID:11608
- C:\Windows\System32\QPLpnqk.exe
  C:\Windows\System32\QPLpnqk.exe
  2⤵
  PID:11636
- C:\Windows\System32\JiLyDxW.exe
  C:\Windows\System32\JiLyDxW.exe
  2⤵
  PID:11652
- C:\Windows\System32\TIPkBIJ.exe
  C:\Windows\System32\TIPkBIJ.exe
  2⤵
  PID:11668
- C:\Windows\System32\dUaOqaF.exe
  C:\Windows\System32\dUaOqaF.exe
  2⤵
  PID:11700
- C:\Windows\System32\ZskjhfP.exe
  C:\Windows\System32\ZskjhfP.exe
  2⤵
  PID:11716
- C:\Windows\System32\xuLLNne.exe
  C:\Windows\System32\xuLLNne.exe
  2⤵
  PID:11744
- C:\Windows\System32\nUmBNEr.exe
  C:\Windows\System32\nUmBNEr.exe
  2⤵
  PID:11792
- C:\Windows\System32\BYaFKRj.exe
  C:\Windows\System32\BYaFKRj.exe
  2⤵
  PID:11836
- C:\Windows\System32\ALBjbnE.exe
  C:\Windows\System32\ALBjbnE.exe
  2⤵
  PID:11860
- C:\Windows\System32\tDpyyLB.exe
  C:\Windows\System32\tDpyyLB.exe
  2⤵
  PID:11888
- C:\Windows\System32\dlXdYhz.exe
  C:\Windows\System32\dlXdYhz.exe
  2⤵
  PID:11924
- C:\Windows\System32\aiCjupR.exe
  C:\Windows\System32\aiCjupR.exe
  2⤵
  PID:11940
- C:\Windows\System32\plyjiPl.exe
  C:\Windows\System32\plyjiPl.exe
  2⤵
  PID:11960
- C:\Windows\System32\UGfuECn.exe
  C:\Windows\System32\UGfuECn.exe
  2⤵
  PID:12020
- C:\Windows\System32\SeljVus.exe
  C:\Windows\System32\SeljVus.exe
  2⤵
  PID:12048
- C:\Windows\System32\xAMdRqa.exe
  C:\Windows\System32\xAMdRqa.exe
  2⤵
  PID:12068
- C:\Windows\System32\aZJDGEr.exe
  C:\Windows\System32\aZJDGEr.exe
  2⤵
  PID:12088
- C:\Windows\System32\pdHdroL.exe
  C:\Windows\System32\pdHdroL.exe
  2⤵
  PID:12132
- C:\Windows\System32\SUZSFSN.exe
  C:\Windows\System32\SUZSFSN.exe
  2⤵
  PID:12156
- C:\Windows\System32\PyfSahN.exe
  C:\Windows\System32\PyfSahN.exe
  2⤵
  PID:12172
- C:\Windows\System32\erRWcJV.exe
  C:\Windows\System32\erRWcJV.exe
  2⤵
  PID:12212
- C:\Windows\System32\GeWckqS.exe
  C:\Windows\System32\GeWckqS.exe
  2⤵
  PID:12236
- C:\Windows\System32\cWygxxA.exe
  C:\Windows\System32\cWygxxA.exe
  2⤵
  PID:12256
- C:\Windows\System32\ehwkNmR.exe
  C:\Windows\System32\ehwkNmR.exe
  2⤵
  PID:12272
- C:\Windows\System32\PffNRdO.exe
  C:\Windows\System32\PffNRdO.exe
  2⤵
  PID:10884
- C:\Windows\System32\uBSUdkl.exe
  C:\Windows\System32\uBSUdkl.exe
  2⤵
  PID:9560
- C:\Windows\System32\BWdepHS.exe
  C:\Windows\System32\BWdepHS.exe
  2⤵
  PID:10268
- C:\Windows\System32\GsMbXVD.exe
  C:\Windows\System32\GsMbXVD.exe
  2⤵
  PID:11388
- C:\Windows\System32\uuhvazb.exe
  C:\Windows\System32\uuhvazb.exe
  2⤵
  PID:11508
- C:\Windows\System32\isGQaqe.exe
  C:\Windows\System32\isGQaqe.exe
  2⤵
  PID:11572
- C:\Windows\System32\AqdPmGG.exe
  C:\Windows\System32\AqdPmGG.exe
  2⤵
  PID:11660
- C:\Windows\System32\kwKAMpU.exe
  C:\Windows\System32\kwKAMpU.exe
  2⤵
  PID:11808
- C:\Windows\System32\ypDQEui.exe
  C:\Windows\System32\ypDQEui.exe
  2⤵
  PID:11848
- C:\Windows\System32\qgQRvTN.exe
  C:\Windows\System32\qgQRvTN.exe
  2⤵
  PID:11884
- C:\Windows\System32\QkiRpqM.exe
  C:\Windows\System32\QkiRpqM.exe
  2⤵
  PID:11948
- C:\Windows\System32\ljQFmmT.exe
  C:\Windows\System32\ljQFmmT.exe
  2⤵
  PID:12012
- C:\Windows\System32\QmkAkBm.exe
  C:\Windows\System32\QmkAkBm.exe
  2⤵
  PID:12040
- C:\Windows\System32\IlZxyie.exe
  C:\Windows\System32\IlZxyie.exe
  2⤵
  PID:12084
- C:\Windows\System32\DjvItNJ.exe
  C:\Windows\System32\DjvItNJ.exe
  2⤵
  PID:12164
- C:\Windows\System32\IqNaKKT.exe
  C:\Windows\System32\IqNaKKT.exe
  2⤵
  PID:11324
- C:\Windows\System32\TOHQBwy.exe
  C:\Windows\System32\TOHQBwy.exe
  2⤵
  PID:11280
- C:\Windows\System32\XwcbceV.exe
  C:\Windows\System32\XwcbceV.exe
  2⤵
  PID:11448
- C:\Windows\System32\vFShMNI.exe
  C:\Windows\System32\vFShMNI.exe
  2⤵
  PID:11676
- C:\Windows\System32\QQbaQGf.exe
  C:\Windows\System32\QQbaQGf.exe
  2⤵
  PID:11780
- C:\Windows\System32\TuVLaBa.exe
  C:\Windows\System32\TuVLaBa.exe
  2⤵
  PID:11852
- C:\Windows\System32\QVLuSpr.exe
  C:\Windows\System32\QVLuSpr.exe
  2⤵
  PID:4688
- C:\Windows\System32\UoDQkGJ.exe
  C:\Windows\System32\UoDQkGJ.exe
  2⤵
  PID:11908
- C:\Windows\System32\RrxinKv.exe
  C:\Windows\System32\RrxinKv.exe
  2⤵
  PID:12180
- C:\Windows\System32\fNSMqtm.exe
  C:\Windows\System32\fNSMqtm.exe
  2⤵
  PID:11304
- C:\Windows\System32\XtDhMUS.exe
  C:\Windows\System32\XtDhMUS.exe
  2⤵
  PID:11768
- C:\Windows\System32\bbPpCLk.exe
  C:\Windows\System32\bbPpCLk.exe
  2⤵
  PID:11956
- C:\Windows\System32\FLHxoWf.exe
  C:\Windows\System32\FLHxoWf.exe
  2⤵
  PID:12104
- C:\Windows\System32\ZYCxKgL.exe
  C:\Windows\System32\ZYCxKgL.exe
  2⤵
  PID:11544
- C:\Windows\System32\YbrcFao.exe
  C:\Windows\System32\YbrcFao.exe
  2⤵
  PID:4700
- C:\Windows\System32\VrrSmgV.exe
  C:\Windows\System32\VrrSmgV.exe
  2⤵
  PID:12292
- C:\Windows\System32\BeMvaFF.exe
  C:\Windows\System32\BeMvaFF.exe
  2⤵
  PID:12308
- C:\Windows\System32\DjJsxOX.exe
  C:\Windows\System32\DjJsxOX.exe
  2⤵
  PID:12352
- C:\Windows\System32\LsiyvRQ.exe
  C:\Windows\System32\LsiyvRQ.exe
  2⤵
  PID:12372
- C:\Windows\System32\BNnAHxF.exe
  C:\Windows\System32\BNnAHxF.exe
  2⤵
  PID:12420
- C:\Windows\System32\PLQNBPn.exe
  C:\Windows\System32\PLQNBPn.exe
  2⤵
  PID:12456
- C:\Windows\System32\gYpshFD.exe
  C:\Windows\System32\gYpshFD.exe
  2⤵
  PID:12472
- C:\Windows\System32\NouRYUr.exe
  C:\Windows\System32\NouRYUr.exe
  2⤵
  PID:12496
- C:\Windows\System32\GsLCJyp.exe
  C:\Windows\System32\GsLCJyp.exe
  2⤵
  PID:12572
- C:\Windows\System32\HNVZjsB.exe
  C:\Windows\System32\HNVZjsB.exe
  2⤵
  PID:12588
- C:\Windows\System32\OOMnYfG.exe
  C:\Windows\System32\OOMnYfG.exe
  2⤵
  PID:12604
- C:\Windows\System32\KiHXqlS.exe
  C:\Windows\System32\KiHXqlS.exe
  2⤵
  PID:12624
- C:\Windows\System32\pAhGVJz.exe
  C:\Windows\System32\pAhGVJz.exe
  2⤵
  PID:12640
- C:\Windows\System32\UGsKNDz.exe
  C:\Windows\System32\UGsKNDz.exe
  2⤵
  PID:12676
- C:\Windows\System32\janduKg.exe
  C:\Windows\System32\janduKg.exe
  2⤵
  PID:12720
- C:\Windows\System32\igKAQTW.exe
  C:\Windows\System32\igKAQTW.exe
  2⤵
  PID:12752
- C:\Windows\System32\zWDsycv.exe
  C:\Windows\System32\zWDsycv.exe
  2⤵
  PID:12776
- C:\Windows\System32\vNbTyyq.exe
  C:\Windows\System32\vNbTyyq.exe
  2⤵
  PID:12792
- C:\Windows\System32\JtrCHmW.exe
  C:\Windows\System32\JtrCHmW.exe
  2⤵
  PID:12820
- C:\Windows\System32\EPTcuiH.exe
  C:\Windows\System32\EPTcuiH.exe
  2⤵
  PID:12840
- C:\Windows\System32\IpGIykc.exe
  C:\Windows\System32\IpGIykc.exe
  2⤵
  PID:12876
- C:\Windows\System32\EPhOlPO.exe
  C:\Windows\System32\EPhOlPO.exe
  2⤵
  PID:12920
- C:\Windows\System32\CuExasQ.exe
  C:\Windows\System32\CuExasQ.exe
  2⤵
  PID:12948
- C:\Windows\System32\UywpOrm.exe
  C:\Windows\System32\UywpOrm.exe
  2⤵
  PID:12964
- C:\Windows\System32\iyAfLUF.exe
  C:\Windows\System32\iyAfLUF.exe
  2⤵
  PID:12988
- C:\Windows\System32\wgEfVNb.exe
  C:\Windows\System32\wgEfVNb.exe
  2⤵
  PID:13036
- C:\Windows\System32\HYonykw.exe
  C:\Windows\System32\HYonykw.exe
  2⤵
  PID:13056
- C:\Windows\System32\GPSiBxB.exe
  C:\Windows\System32\GPSiBxB.exe
  2⤵
  PID:13072
- C:\Windows\System32\qlVbsGY.exe
  C:\Windows\System32\qlVbsGY.exe
  2⤵
  PID:13092
- C:\Windows\System32\jKDPgPN.exe
  C:\Windows\System32\jKDPgPN.exe
  2⤵
  PID:13116
- C:\Windows\System32\psUxqZS.exe
  C:\Windows\System32\psUxqZS.exe
  2⤵
  PID:13140
- C:\Windows\System32\MFKVMtL.exe
  C:\Windows\System32\MFKVMtL.exe
  2⤵
  PID:13172
- C:\Windows\System32\LHgdiUn.exe
  C:\Windows\System32\LHgdiUn.exe
  2⤵
  PID:13220
- C:\Windows\System32\KvuZsGG.exe
  C:\Windows\System32\KvuZsGG.exe
  2⤵
  PID:13244
- C:\Windows\System32\opESSzk.exe
  C:\Windows\System32\opESSzk.exe
  2⤵
  PID:13260
- C:\Windows\System32\drrPKdQ.exe
  C:\Windows\System32\drrPKdQ.exe
  2⤵
  PID:13300
- C:\Windows\System32\yGhXxAw.exe
  C:\Windows\System32\yGhXxAw.exe
  2⤵
  PID:8732
- C:\Windows\System32\ZqvpjYC.exe
  C:\Windows\System32\ZqvpjYC.exe
  2⤵
  PID:12364
- C:\Windows\System32\gPAnXTa.exe
  C:\Windows\System32\gPAnXTa.exe
  2⤵
  PID:12396
- C:\Windows\System32\LfwPaPX.exe
  C:\Windows\System32\LfwPaPX.exe
  2⤵
  PID:12464
- C:\Windows\System32\KcVQyht.exe
  C:\Windows\System32\KcVQyht.exe
  2⤵
  PID:12568
- C:\Windows\System32\LcojDaK.exe
  C:\Windows\System32\LcojDaK.exe
  2⤵
  PID:12656
- C:\Windows\System32\otWSyhY.exe
  C:\Windows\System32\otWSyhY.exe
  2⤵
  PID:12636
- C:\Windows\System32\YdgEXvQ.exe
  C:\Windows\System32\YdgEXvQ.exe
  2⤵
  PID:12684
- C:\Windows\System32\pbmMFrk.exe
  C:\Windows\System32\pbmMFrk.exe
  2⤵
  PID:12816
- C:\Windows\System32\GQSVAmT.exe
  C:\Windows\System32\GQSVAmT.exe
  2⤵
  PID:12856
- C:\Windows\System32\VIhaYsy.exe
  C:\Windows\System32\VIhaYsy.exe
  2⤵
  PID:12928
- C:\Windows\System32\gzfuaul.exe
  C:\Windows\System32\gzfuaul.exe
  2⤵
  PID:12980
- C:\Windows\System32\KiusLrV.exe
  C:\Windows\System32\KiusLrV.exe
  2⤵
  PID:13052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3956,i,8998666007764333392,14724298544432336038,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
1⤵
PID:4292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

DiZhgRe.exe

Path C:\Windows\System32\DiZhgRe.exe
Size 1.1MB
SHA256 5caab5e89dd0aa692bd7a8a071ba94479010c30f046dd9d49e5e09d668f07a0b
MD5 55cf22d99d6eec9a139ec227fcd45b70
SHA1 696437a3ae4b400c350100dd21ffc96c6219cf62
SHA512 bff5066e3e223bf2af6caff20113240fa7a5993343b25973bcb23ccb0ff712d6d9ae3cf9b57b5a43a424645a0eabf1980e1a3229a688813b79bcf52de943605a
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zyf3tTGS:knw9oUUEEDl37jcq4c3US
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gpilpsn.exe

Path C:\Windows\System32\Gpilpsn.exe
Size 1.1MB
SHA256 9e271facb3a30d892d1bf4768c6aa699de67feb4a43b2591beeb7ae29c5c4118
MD5 b4db137203458e443a00a49b97189436
SHA1 f79ffbf5bd11fa6ab02fd9f7ad3619d861e51475
SHA512 8cb5f60b3c63ca0d1196f82034ce8663aeffdb685329c5ace08bb8843d04d1e5d9fc25d50ceae4cc9dbc3d50c8dbeab2c8f9fd58aa67cab8b68e2e15799ade3a
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zyf3tTGj:knw9oUUEEDl37jcq4c3Uj
MD5 SHA1 SHA512 SSDEEP

Submit Download

HnnDLCh.exe

Path C:\Windows\System32\HnnDLCh.exe
Size 1.1MB
SHA256 199939e6b0279fa92e646db361693ab557c21d0cab95f9f019b28cbb67cfdafa
MD5 b69e4c2ff22f1e5910793c88335317aa
SHA1 64d174d38e7d3f09ab0cffcfb65c66681074ad5c
SHA512 e3efad655f61d95edceecf6d2b81f3e9dd10fe2c00e9eafeedce60ffb66ac58ded7eabb5bcb42cbee54400f8ed657960e550796fa1cb3e043afa0cc2b8c25f24
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zyf3tTGp:knw9oUUEEDl37jcq4c3Up
MD5 SHA1 SHA512 SSDEEP

Submit Download

IKgWSfh.exe

Path C:\Windows\System32\IKgWSfh.exe
Size 1.1MB
SHA256 409ee46ad75e89d891ff4f7133097ae25c964a2de8b98f6e1f6f23f41a036fd6
MD5 099b3249a42215c86dcbce4d63fdc417
SHA1 e44f9ae95915a807c80c4ce2a39ef5411bf87a2c
SHA512 2ee4253d77b98494932639ecf41397a1b05a52eb2fe995b9ee6e5aeec9745da9aae7651ab7adf845cf7ce882a14fb313e2e136e96fbcf83c03ece641e16f0517
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zyf3tTGh:knw9oUUEEDl37jcq4c3Uh
MD5 SHA1 SHA512 SSDEEP

Submit Download

JAfnewz.exe

Path C:\Windows\System32\JAfnewz.exe
Size 1.1MB
SHA256 4c72cdae08c000bd4084b6b76770d65fefe82593851c4cb6c3bbd2dbd7ff9dd8
MD5 87d2ee7a1e015f49b7685a3e0532508c
SHA1 efcac2be4acb6df03bbd2591a0a2eb812793d9d2
SHA512 92183333387364b231bcfc629a79b6c4f32a154347baf3d96e7b5a55bc8d81c21b1babe9fead1e53ae8e7e003a7b6f8cb6a20c203c7456b2b4c90b76455b0e71
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zyf3tTGu:knw9oUUEEDl37jcq4c3Uu
MD5 SHA1 SHA512 SSDEEP

Submit Download

JIqUFEI.exe

Path C:\Windows\System32\JIqUFEI.exe
Size 1.1MB
SHA256 7721f3861c62cc28303d94055f9f2318216e64a8bdca8b6c8dd8274b8b8b1d0b
MD5 980cfa31d06ab30b3e72990a7f7fa579
SHA1 d29d7aaae7f88fa8ebe4d965d99c20588721baf7
SHA512 2dd8187535e43a6377a3106207773685831f3bb147f2d8381da3d1b1190d45523c14fa7eee35ec7cc734849e7f72e709edfa690ed9657bc34ee17dde4f583a15
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zyf3tTGX:knw9oUUEEDl37jcq4c3UX
MD5 SHA1 SHA512 SSDEEP

Submit Download

JPBErFw.exe

Path C:\Windows\System32\JPBErFw.exe
Size 1.1MB
SHA256 1603db9cbcd16994aa1c43aa4824026f24375c8a569be10cc19313d5710eda92
MD5 8b3f7994a04e49fba3b8be4bb5693c90
SHA1 956c53983e84a7ff6be788289c89d0e475969a24
SHA512 b229ffb24cbef2a6a8bf260cf442c46573d71d81fbe0b3a89ec8a4f9ce091c714133e61d63d71dd2f05da5e769a830f2470a7b5ed14b4d3cddc3d8f4448fff83
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zyf3tTGb:knw9oUUEEDl37jcq4c3Ub
MD5 SHA1 SHA512 SSDEEP

Submit Download

KeiPOAZ.exe

Path C:\Windows\System32\KeiPOAZ.exe
Size 1.1MB
SHA256 ec0dbfbc88f8b53762013a9d8edb02c8c0ff24c33b3a57dfd4a27955e53f98c6
MD5 106c287334b7aba44fbe9bf9e47700b8
SHA1 74ed1dc58b2528110763d8a8e356bf5a3d603579
SHA512 15a97546696fa91aafc837cb53b329a36e6b85d553a4eb3caef7a56d6f19fe16ad965451e326cf982ec6e37c9506856f2ff538ae023e0d9d2a04f81918a8381f
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zyf3tTGN+:knw9oUUEEDl37jcq4c3Us
MD5 SHA1 SHA512 SSDEEP

Submit Download

MlSdJct.exe

Path C:\Windows\System32\MlSdJct.exe
Size 1.1MB
SHA256 e888ecbbe06de2dd9be0027555d3efb54970b919eaf8590ffb2a43a5886d13c9
MD5 aefa841c9dcd96de028e335abbda9853
SHA1 9c2e8dd6267fa58c6770e76bd4d6068c2cb9d458
SHA512 13caf50e5a160ba720eba0eb5249c963c686465cdb431883d4d55d3fb38e12d30748b9cd79a1dfd9a3f7d75fb5298eb0bfc43ffec85922e7cbabddade996440f
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zyf3tTGg:knw9oUUEEDl37jcq4c3Ug
MD5 SHA1 SHA512 SSDEEP

Submit Download

MriDcdL.exe

Path C:\Windows\System32\MriDcdL.exe
Size 1.1MB
SHA256 6f1793f0fa73f097c9db2c6b197b38fb5eb96c4625d30629770f8bb908a057db
MD5 c2dc9622a0e2cdb99a515ae0d9661970
SHA1 23b7dc2a4cbe6bf7e81a2d6bb2149bf30c66c4cf
SHA512 13f8b621353770f6b3ddf8424737f7c52ff3e8b90b8c245488e8995e2fd527dc7be22e3623ddbbb05d86bee104072ffc8dfe26d4947ebdd232bce93dfbba0eba
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zyf3tTGi:knw9oUUEEDl37jcq4c3Ui
MD5 SHA1 SHA512 SSDEEP

Submit Download

MyINUnC.exe

Path C:\Windows\System32\MyINUnC.exe
Size 1.1MB
SHA256 200cf53a897585131785a7447535c0a8fb3b1baaa32c8747f3d5b9966ea46808
MD5 288959cd48f96d6a02b9f8e0aaeb82ce
SHA1 11a3d12740de4ebccefcf2ac1c42e82e424051c3
SHA512 ccb89989d1f7e15b21fd44ae0214d0a4f3eff9006d03bf5d133a680c232ffd6a9aaa83571ade0c844998ba7ca9342e3ef9ab2c27f94273123867c8c448f86114
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zyf3tTGd:knw9oUUEEDl37jcq4c3Ud
MD5 SHA1 SHA512 SSDEEP

Submit Download

NpeVtjn.exe

Path C:\Windows\System32\NpeVtjn.exe
Size 1.1MB
SHA256 97bdde5a6f2d4e5203f39a5ed5db5a7319d254d49b4a892f129ad7882126cb23
MD5 52bae48b4e3fe7591b2459a3a8f90574
SHA1 e84f5e0f87aa816cccc277b63f75ae9c5cb74335
SHA512 e3d53cda631412ac0334917e3dba615b2c7453e804a989b3404673e0998a2eb365c6437bbfcfef2357d8c5c26d6c4a0e0603401e4920bd94de9c6baf961e4e02
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zyf3tTGa:knw9oUUEEDl37jcq4c3Ua
MD5 SHA1 SHA512 SSDEEP

Submit Download

OyDXyrV.exe

Path C:\Windows\System32\OyDXyrV.exe
Size 1.1MB
SHA256 7d26df6b0f5058276c0d714f1e180d34335ef10b7ea06a1597ccb42a1a6c2f25
MD5 03e840adac4241729610b8265402b8ff
SHA1 03747976e55f1b1b2272ec763a06395d69c38828
SHA512 591b3850797f5bbaf4c523475ef30a708fa622ff8cc571af4f73f2ea66c1c2edcbdaf46559738ca716b9076db1c6840d68df2bb5f3190a00c5648b0723dddcfc
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zyf3tTGi:knw9oUUEEDl37jcq4c3Ui
MD5 SHA1 SHA512 SSDEEP

Submit Download

RpaxweW.exe

Path C:\Windows\System32\RpaxweW.exe
Size 1.1MB
SHA256 932589cdbe0827ba3c274beafbc83ac7346b7e84228e001dff9f82a0840eda72
MD5 542bd0172685778a1b943518175531be
SHA1 ab301774473d93a583a4e58a8b27247fd544c153
SHA512 1d43384b46a4b2d90864635465f9d910daae8a03dfae12f2811ff08910e1abfbd324af1ec1fc3cf3aa85e18afc9f862215710738ddd6147d2464ffc157e2f0fe
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zyf3tTGU:knw9oUUEEDl37jcq4c3UU
MD5 SHA1 SHA512 SSDEEP

Submit Download

RvQJNQL.exe

Path C:\Windows\System32\RvQJNQL.exe
Size 1.1MB
SHA256 c2efd19174ac06a0016cf3b8c65df180c48c36b3ce3aa2b181978f3b69125e13
MD5 c63c1ce12576b18308f3cb90e72c730c
SHA1 57a33b6efc3487a76a76dec58d74a739f643bff0
SHA512 980419c2a2b9f8fe86d0f81bb364e5cfe9ce1edc9379ee9a46eafa21e7e13bae2f06c5a7c6a6e89fe756c204949f92f2db211bed005fdd95757509fc68739313
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zyf3tTG3:knw9oUUEEDl37jcq4c3U3
MD5 SHA1 SHA512 SSDEEP

Submit Download

VmbPJQy.exe

Path C:\Windows\System32\VmbPJQy.exe
Size 1.1MB
SHA256 b42fa79b50a64705445133a33c3a2d222553cbe37c4deb63c21e75c0e4bfab68
MD5 f007085108fbeaa54e5b63e223f42901
SHA1 c378b3460c14f5d2e9dff5126859178afc8cd209
SHA512 e3dbe5860b3876e8a2eeaf5e5508ab30dacec2d2719c81847e1f81ae14e60059099fee2d8d7e4f94fe29ec0da017b0ad06f188c9013052d1542acb3dc1997099
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zyf3tTGo:knw9oUUEEDl37jcq4c3Uo
MD5 SHA1 SHA512 SSDEEP

Submit Download

VrjUbXu.exe

Path C:\Windows\System32\VrjUbXu.exe
Size 1.1MB
SHA256 9fda36d5012200bf656ec1de7c530caacb2068fe91c15a841a0dd6132d0437d4
MD5 8a51a712df62db7b1e5800801dfd126a
SHA1 2c29b4729244c90d98d538f751e8be222bd58298
SHA512 56c24121de9f49af94c8c41481a74f3623531b740d1461ac3209f1e684918a23ca1c2aaf8784e1f90deeca4aafc37c1fb94d86c4d2458d2d1e54440d54ade799
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zyf3tTGH:knw9oUUEEDl37jcq4c3UH
MD5 SHA1 SHA512 SSDEEP

Submit Download

aIKiNXO.exe

Path C:\Windows\System32\aIKiNXO.exe
Size 1.1MB
SHA256 95b27860ab50dc30327d94c511ae6339a925f9a5e7ac10f11c2ca29f4579c1e9
MD5 7cb997f7a2a64a952fea40733f3aaf12
SHA1 d2707ccda476577d11307afd51b505b0ec21785c
SHA512 8fbe1532d0d2888dfd606fbd50ee91490be5221a047ffb609c17d6b9edfefa3082e3890b5d63f490135cdde85b6ce9a850d7ec336e4e5edce839959cc619ecdb
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zyf3tTGBf:knw9oUUEEDl37jcq4c3Ud
MD5 SHA1 SHA512 SSDEEP

Submit Download

crZMIJw.exe

Path C:\Windows\System32\crZMIJw.exe
Size 1.1MB
SHA256 cc8ec0af5a2c32941e9b5a92ef5378397a82079dea4f3a2a9ce7e61d39066823
MD5 02d372372efcba570dcee10b60435879
SHA1 63b23f4f39683963490d48d2b19e8457af0c5e9c
SHA512 53e9e39b537f1d84cf93facaffacefeecc6c5242ecc1ef6f69069c3c603859d16e348eccb3d3cee01ba850e707e51405da5ec00d06003fe4d2a80e916b5bf020
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zyf3tTG1:knw9oUUEEDl37jcq4c3U1
MD5 SHA1 SHA512 SSDEEP

Submit Download

fFxkptd.exe

Path C:\Windows\System32\fFxkptd.exe
Size 1.1MB
SHA256 e2a12a072be3379b6b9b2418600d82f94aba7987daaf0e055a6a6a2af1f88981
MD5 e3b76f3a16ec07253ac069fbcc13a261
SHA1 14ad97aeab93816767715848e8b697db5bcab6ce
SHA512 f2330c6a9322042a7ccec4447aa2852f9b149eec33fcc71b18e6c6d1f0ea37eb7032be7d739a46af7d486d7e9389382a5c375b69394558b8da062025ac4cf9f2
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zyf3tTGK:knw9oUUEEDl37jcq4c3UK
MD5 SHA1 SHA512 SSDEEP

Submit Download

itcUabO.exe

Path C:\Windows\System32\itcUabO.exe
Size 1.1MB
SHA256 35dddfc0549333d716c4e6dd249b53cd62be1eaa70ba035e2961a76e0ea54007
MD5 2cac87ad3157cd3096e1c4ac5a1aa0e1
SHA1 f2c93187ad80b9e9aba30e900889a8f3414eae04
SHA512 969d7f493316a95c2ec1a50dee8088f859e393c16d7fa7494d8af768afdedb54efb62a0274161b287535f9ce8f0cf201f7c4c9038d80f4bb065860320a96d51c
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zyf3tTG9:knw9oUUEEDl37jcq4c3U9
MD5 SHA1 SHA512 SSDEEP

Submit Download

nUDkasH.exe

Path C:\Windows\System32\nUDkasH.exe
Size 1.1MB
SHA256 06ff7362365712142354c6450866320e0a75fcaa90a5ba6a6447fbb3b7eeca1e
MD5 61cb718c91d7e0eceee2b518d602bd98
SHA1 31fcbf4971ea6b7e7b5d322053fae8b05ef62184
SHA512 a6e2448e063779231ca8e9432c7fc1b17bf9514cb001518fd790f4e78313319207a9c23345d9bb13eee474888d77f9cdb6603b43547a4f018f1ae298b51ff4a0
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zyf3tTGZ:knw9oUUEEDl37jcq4c3UZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

pZytmUY.exe

Path C:\Windows\System32\pZytmUY.exe
Size 1.1MB
SHA256 e932ff4b311328b388979f0f1a27a531b9751d0d70911104262c3446a58e75a6
MD5 c8512cc4c80584f5a818e71fa16370d4
SHA1 ff6f063cc04eae7d4dfa48a059e6c8f84102c29f
SHA512 3983fd269e0f50f894cdc0b14baa312cdceeb912c28af32dfe1e98b9eb60ab584d5f68f02abd896d55f589990878fd01ef16fd6c4d08f9cbdb07117deb806833
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zyf3tTGhZ:knw9oUUEEDl37jcq4c3Uv
MD5 SHA1 SHA512 SSDEEP

Submit Download

rDppyqg.exe

Path C:\Windows\System32\rDppyqg.exe
Size 1.1MB
SHA256 a09493b09b95269645e1eaa1c57f44ad3305531f34c9e9b44aa59148a54f02ec
MD5 1a2dfd117770e90fac3f6351959e2148
SHA1 0fc2349962030cf52e0c79ed94d5d714ecc74dce
SHA512 ff3db7fdbca1ffbe33e0df9bfc5a24f1a245c4ad2d8a98488ee8b16249fbe1e66369e967e6033ff808da3bbcf49ea6372545bd25c6446a47799f52002a5c0cc0
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zyf3tTGm:knw9oUUEEDl37jcq4c3Um
MD5 SHA1 SHA512 SSDEEP

Submit Download

rxJwnaU.exe

Path C:\Windows\System32\rxJwnaU.exe
Size 1.1MB
SHA256 45ef297ed799f2ab400ab76a863c3017d3b40e1ff2b0f4cb220f3ddbc22f7448
MD5 6428714ffcabb87275055c441a9359bb
SHA1 cd95c416287ea200e4dea8b9b199e7531b9d2aa5
SHA512 33ff54dae6658fa7236462063baedf8eadda3ad2b6e15efebf8f14fdd5bcb12d56ef250e53bea6e95800845f6878d47c2b9535ac0c7e9c4ed1f8f19ef19d936e
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zyf3tTG4:knw9oUUEEDl37jcq4c3U4
MD5 SHA1 SHA512 SSDEEP

Submit Download

sTUwAsh.exe

Path C:\Windows\System32\sTUwAsh.exe
Size 1.1MB
SHA256 e7674e2bcddcd73c8b972e96e3a079042406daa886dd4e6d9989d6a067141a38
MD5 3faaf186948d23221ec16ba9f1ea894c
SHA1 2b4606441f5ac645dd0ca6c0f6802f4d58a673ea
SHA512 1cde18bba60b7b3badef027f48bb45ad9918824662f294471cf982c3a97d6f431d59c440c6396881cf097b40fac853416445a97267868f2ecf062f00e4a97d41
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zyf3tTGt:knw9oUUEEDl37jcq4c3Ut
MD5 SHA1 SHA512 SSDEEP

Submit Download

sbCtzLt.exe

Path C:\Windows\System32\sbCtzLt.exe
Size 1.1MB
SHA256 ccd0de5668fce2bf6a936212b4eda1a837c8ade931d061902add20436fbf495f
MD5 7a0aa272f0dfe8a40d4238ea156440cd
SHA1 a0ae407e9bad7c3dc6f459b1929211890d4b3815
SHA512 2155187407fc4491160e914945085f52e47840a4aa039047d8d05e2e8e28e2cf5c0db5978873167fe3b96371eb8ccc698d6c3eb30fac1f37370c6c252ea95ee3
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zyf3tTG7:knw9oUUEEDl37jcq4c3U7
MD5 SHA1 SHA512 SSDEEP

Submit Download

swMcSam.exe

Path C:\Windows\System32\swMcSam.exe
Size 1.1MB
SHA256 6b66287230010fc588672dd480276d460dbec6d422bb56db31dffe98edb3d0e2
MD5 26eeabbaca9366c20fce7ca1c1965fb6
SHA1 323d78f2d6dab230f81fed04f4219bfed10db927
SHA512 8fbaaabee2de36f8bf8cb22d81cfa54f738cf345dd52200eb64529a93b1aaae51a21d619ccc2e64e59fd49d0f8148a59a6e782307e5608e34e2cad16f1b8f031
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zyf3tTGU:knw9oUUEEDl37jcq4c3UU
MD5 SHA1 SHA512 SSDEEP

Submit Download

uGkasaG.exe

Path C:\Windows\System32\uGkasaG.exe
Size 1.1MB
SHA256 269a9ef0091fe8766cc6f3e95cb7d76d8c44e37828dc70dcc2c14c5270eada17
MD5 45451176f27c172b86e2f184676e3074
SHA1 4a588be1412df71378ccd62c4cfff56c18fd1c9b
SHA512 85255420fea32db772f9b2dae884417a31fedfa768358f7a41732a3655850bfb1bbcf7e948e5bdf865238c6fa90efea9caf1b4ad0a9a21f585c1c7e7d7a5773d
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zyf3tTG7:knw9oUUEEDl37jcq4c3U7
MD5 SHA1 SHA512 SSDEEP

Submit Download

vqNBlgZ.exe

Path C:\Windows\System32\vqNBlgZ.exe
Size 1.1MB
SHA256 6cce9d3b0c6399f0ffee173c706b33d4effb1d514515dd6f3b0ea9d944b32576
MD5 2b74d950294a1466ffd9440f4dd625ed
SHA1 a6beb4553169456f0787965c6315812030659b1a
SHA512 42dfa9d67099e049c569efa0d60f001925cbf78f7e3c5cec1f187840c158549c80ddb37c1e1828a370e2aa7f2435e3db4dcf531eb836da099e0a2172933d8b15
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zyf3tTG6:knw9oUUEEDl37jcq4c3U6
MD5 SHA1 SHA512 SSDEEP

Submit Download

wNtVUoK.exe

Path C:\Windows\System32\wNtVUoK.exe
Size 1.1MB
SHA256 e21b85910fa626ddd2800bcdf8a410cdc14f4933b854d518468ff505b19e2cfe
MD5 731bd129747c21b9d26060acf4412233
SHA1 c8ab841eef849a95afedd46db7966c05804764fe
SHA512 d4accfa4d7e4078506a67878a0a5f527e2679f9ad0934baf24eb948030cb3593cdea51693aa270f68ca89f3ee7c3e4830a898763a1eedd6228b8f4b7149a0aef
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zyf3tTG3:knw9oUUEEDl37jcq4c3U3
MD5 SHA1 SHA512 SSDEEP

Submit Download

wQRqOud.exe

Path C:\Windows\System32\wQRqOud.exe
Size 1.1MB
SHA256 5813ac5d87d191c791c260775dc565f0bfacf175ab6509f2fca908b17b4c314b
MD5 c801fa86b3012e41574318a7af993244
SHA1 84a692e02b339953ef487abbb9219ed5ab6c907e
SHA512 d28e7191fae16440595112e183b01d2d3a7da7d2efb270be678443288066e38dbac592e997d4e2f1c665c40aac1b7afc9ba154914e1c4affc86000c57945be6a
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zyf3tTGYj:knw9oUUEEDl37jcq4c3Ua
MD5 SHA1 SHA512 SSDEEP

Submit Download

zYZgdFF.exe

Path C:\Windows\System32\zYZgdFF.exe
Size 1.1MB
SHA256 c57cb74921e5be9edb0f82eb1e64673f21cb036ef5541693a444fa3517bf58a6
MD5 621da048bf2b75ec8a37c291e1b787f7
SHA1 3a5c64ea42cd916df213bfcadcab2d0a0293b5fb
SHA512 36b97d71c1010dbdc64dad9914f66a3fc8105fc32dcb40373bc4122b04aa4ed776f9169cb07aff942a13697fc30ab258ba37fcd325c5c43338b1870679e52520
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5Pbcq92zyf3tTG1:knw9oUUEEDl37jcq4c3U1
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/112-393-0x00007FF7BC040000-0x00007FF7BC431000-memory.dmp

Download

memory/112-2020-0x00007FF7BC040000-0x00007FF7BC431000-memory.dmp

Download

memory/556-26-0x00007FF7DAD30000-0x00007FF7DB121000-memory.dmp

Download

memory/556-1995-0x00007FF7DAD30000-0x00007FF7DB121000-memory.dmp

Download

memory/556-1948-0x00007FF7DAD30000-0x00007FF7DB121000-memory.dmp

Download

memory/852-405-0x00007FF7D1BA0000-0x00007FF7D1F91000-memory.dmp

Download

memory/852-2066-0x00007FF7D1BA0000-0x00007FF7D1F91000-memory.dmp

Download

memory/1484-415-0x00007FF6182B0000-0x00007FF6186A1000-memory.dmp

Download

memory/1484-2065-0x00007FF6182B0000-0x00007FF6186A1000-memory.dmp

Download

memory/2332-379-0x00007FF78C9C0000-0x00007FF78CDB1000-memory.dmp

Download

memory/2332-2018-0x00007FF78C9C0000-0x00007FF78CDB1000-memory.dmp

Download

memory/2524-1992-0x00007FF607E20000-0x00007FF608211000-memory.dmp

Download

memory/2524-42-0x00007FF607E20000-0x00007FF608211000-memory.dmp

Download

memory/2600-61-0x00007FF655AD0000-0x00007FF655EC1000-memory.dmp

Download

memory/2600-2001-0x00007FF655AD0000-0x00007FF655EC1000-memory.dmp

Download

memory/2600-1949-0x00007FF655AD0000-0x00007FF655EC1000-memory.dmp

Download

memory/2812-412-0x00007FF640750000-0x00007FF640B41000-memory.dmp

Download

memory/2812-2062-0x00007FF640750000-0x00007FF640B41000-memory.dmp

Download

memory/2912-67-0x00007FF68C1E0000-0x00007FF68C5D1000-memory.dmp

Download

memory/2912-2006-0x00007FF68C1E0000-0x00007FF68C5D1000-memory.dmp

Download

memory/2912-1950-0x00007FF68C1E0000-0x00007FF68C5D1000-memory.dmp

Download

memory/3116-369-0x00007FF6E6E80000-0x00007FF6E7271000-memory.dmp

Download

memory/3116-2016-0x00007FF6E6E80000-0x00007FF6E7271000-memory.dmp

Download

memory/3288-65-0x00007FF698070000-0x00007FF698461000-memory.dmp

Download

memory/3288-2010-0x00007FF698070000-0x00007FF698461000-memory.dmp

Download

memory/3460-49-0x00007FF7AC7B0000-0x00007FF7ACBA1000-memory.dmp

Download

memory/3460-1998-0x00007FF7AC7B0000-0x00007FF7ACBA1000-memory.dmp

Download

memory/3488-2005-0x00007FF6F0220000-0x00007FF6F0611000-memory.dmp

Download

memory/3488-428-0x00007FF6F0220000-0x00007FF6F0611000-memory.dmp

Download

memory/3864-68-0x00007FF7E4B30000-0x00007FF7E4F21000-memory.dmp

Download

memory/3864-1996-0x00007FF7E4B30000-0x00007FF7E4F21000-memory.dmp

Download

memory/3912-2014-0x00007FF760D80000-0x00007FF761171000-memory.dmp

Download

memory/3912-355-0x00007FF760D80000-0x00007FF761171000-memory.dmp

Download

memory/4000-2008-0x00007FF765460000-0x00007FF765851000-memory.dmp

Download

memory/4000-71-0x00007FF765460000-0x00007FF765851000-memory.dmp

Download

memory/4184-2024-0x00007FF7F9740000-0x00007FF7F9B31000-memory.dmp

Download

memory/4184-401-0x00007FF7F9740000-0x00007FF7F9B31000-memory.dmp

Download

memory/4376-1947-0x00007FF73C7B0000-0x00007FF73CBA1000-memory.dmp

Download

memory/4376-1990-0x00007FF73C7B0000-0x00007FF73CBA1000-memory.dmp

Download

memory/4376-23-0x00007FF73C7B0000-0x00007FF73CBA1000-memory.dmp

Download

memory/4452-350-0x00007FF7A3DE0000-0x00007FF7A41D1000-memory.dmp

Download

memory/4452-2002-0x00007FF7A3DE0000-0x00007FF7A41D1000-memory.dmp

Download

memory/4584-0-0x00007FF7C7570000-0x00007FF7C7961000-memory.dmp

Download

memory/4584-1-0x0000019A46060000-0x0000019A46070000-memory.dmp

Download

memory/4616-2061-0x00007FF7F8850000-0x00007FF7F8C41000-memory.dmp

Download

memory/4616-402-0x00007FF7F8850000-0x00007FF7F8C41000-memory.dmp

Download

memory/4676-2012-0x00007FF66E960000-0x00007FF66ED51000-memory.dmp

Download

memory/4676-70-0x00007FF66E960000-0x00007FF66ED51000-memory.dmp

Download

memory/4812-1988-0x00007FF6B22C0000-0x00007FF6B26B1000-memory.dmp

Download

memory/4812-1946-0x00007FF6B22C0000-0x00007FF6B26B1000-memory.dmp

Download

memory/4812-12-0x00007FF6B22C0000-0x00007FF6B26B1000-memory.dmp

Download

memory/5060-2043-0x00007FF669A00000-0x00007FF669DF1000-memory.dmp

Download

memory/5060-410-0x00007FF669A00000-0x00007FF669DF1000-memory.dmp

Download

memory/5072-2022-0x00007FF66A150000-0x00007FF66A541000-memory.dmp

Download

memory/5072-398-0x00007FF66A150000-0x00007FF66A541000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads