Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
26-06-2024 07:45
Behavioral task
behavioral1
Sample
68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe
-
Size
2.3MB
-
MD5
6cc4f8fd14c832efeb7376d01cdb8240
-
SHA1
15e976d55a541fa3c172cc81a20d6319b85b1999
-
SHA256
68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be
-
SHA512
5261247095f009d2d405b692e7b18021255784292ab5c7cc520dc54cbf61c1c7f21e64056f04f6fffa274c193f871ef774d5956492111c790acd8759dd792203
-
SSDEEP
49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+Agr6StVEnmcKrwwyGwSw34:BemTLkNdfE0pZrw8
Malware Config
Signatures
-
KPOT Core Executable 33 IoCs
resource yara_rule behavioral2/files/0x00070000000232b3-5.dat family_kpot behavioral2/files/0x000700000002344d-16.dat family_kpot behavioral2/files/0x000700000002344e-20.dat family_kpot behavioral2/files/0x000700000002344f-26.dat family_kpot behavioral2/files/0x0007000000023450-38.dat family_kpot behavioral2/files/0x0007000000023451-45.dat family_kpot behavioral2/files/0x0007000000023453-50.dat family_kpot behavioral2/files/0x0007000000023454-55.dat family_kpot behavioral2/files/0x0007000000023455-63.dat family_kpot behavioral2/files/0x0007000000023457-73.dat family_kpot behavioral2/files/0x0007000000023459-83.dat family_kpot behavioral2/files/0x000700000002345a-96.dat family_kpot behavioral2/files/0x0007000000023464-138.dat family_kpot behavioral2/files/0x0007000000023466-156.dat family_kpot behavioral2/files/0x000700000002346b-173.dat family_kpot behavioral2/files/0x0007000000023469-171.dat family_kpot behavioral2/files/0x000700000002346a-168.dat family_kpot behavioral2/files/0x0007000000023468-166.dat family_kpot behavioral2/files/0x0007000000023467-161.dat family_kpot behavioral2/files/0x0007000000023465-151.dat family_kpot behavioral2/files/0x0007000000023463-141.dat family_kpot behavioral2/files/0x0007000000023462-136.dat family_kpot behavioral2/files/0x0007000000023461-131.dat family_kpot behavioral2/files/0x0007000000023460-126.dat family_kpot behavioral2/files/0x000700000002345f-121.dat family_kpot behavioral2/files/0x000700000002345e-116.dat family_kpot behavioral2/files/0x000700000002345d-111.dat family_kpot behavioral2/files/0x000700000002345c-106.dat family_kpot behavioral2/files/0x000700000002345b-101.dat family_kpot behavioral2/files/0x0007000000023458-86.dat family_kpot behavioral2/files/0x0007000000023456-76.dat family_kpot behavioral2/files/0x0007000000023452-61.dat family_kpot behavioral2/files/0x000700000002344c-13.dat family_kpot -
XMRig Miner payload 64 IoCs
resource yara_rule behavioral2/memory/4796-0-0x00007FF7D34B0000-0x00007FF7D3804000-memory.dmp xmrig behavioral2/files/0x00070000000232b3-5.dat xmrig behavioral2/files/0x000700000002344d-16.dat xmrig behavioral2/files/0x000700000002344e-20.dat xmrig behavioral2/files/0x000700000002344f-26.dat xmrig behavioral2/memory/3388-35-0x00007FF6A2ED0000-0x00007FF6A3224000-memory.dmp xmrig behavioral2/files/0x0007000000023450-38.dat xmrig behavioral2/files/0x0007000000023451-45.dat xmrig behavioral2/files/0x0007000000023453-50.dat xmrig behavioral2/files/0x0007000000023454-55.dat xmrig behavioral2/files/0x0007000000023455-63.dat xmrig behavioral2/files/0x0007000000023457-73.dat xmrig behavioral2/files/0x0007000000023459-83.dat xmrig behavioral2/files/0x000700000002345a-96.dat xmrig behavioral2/files/0x0007000000023464-138.dat xmrig behavioral2/files/0x0007000000023466-156.dat xmrig behavioral2/memory/4508-730-0x00007FF775B30000-0x00007FF775E84000-memory.dmp xmrig behavioral2/memory/1044-731-0x00007FF6EC810000-0x00007FF6ECB64000-memory.dmp xmrig behavioral2/memory/4584-732-0x00007FF751C80000-0x00007FF751FD4000-memory.dmp xmrig behavioral2/memory/1200-741-0x00007FF672330000-0x00007FF672684000-memory.dmp xmrig behavioral2/files/0x000700000002346b-173.dat xmrig behavioral2/files/0x0007000000023469-171.dat xmrig behavioral2/files/0x000700000002346a-168.dat xmrig behavioral2/files/0x0007000000023468-166.dat xmrig behavioral2/files/0x0007000000023467-161.dat xmrig behavioral2/files/0x0007000000023465-151.dat xmrig behavioral2/files/0x0007000000023463-141.dat xmrig behavioral2/memory/2776-758-0x00007FF7B4200000-0x00007FF7B4554000-memory.dmp xmrig behavioral2/memory/2576-761-0x00007FF682DB0000-0x00007FF683104000-memory.dmp xmrig behavioral2/memory/1760-765-0x00007FF6C8AF0000-0x00007FF6C8E44000-memory.dmp xmrig behavioral2/memory/4548-772-0x00007FF619180000-0x00007FF6194D4000-memory.dmp xmrig behavioral2/memory/1332-775-0x00007FF68EA60000-0x00007FF68EDB4000-memory.dmp xmrig behavioral2/memory/4764-781-0x00007FF63A990000-0x00007FF63ACE4000-memory.dmp xmrig behavioral2/memory/4800-787-0x00007FF6E0020000-0x00007FF6E0374000-memory.dmp xmrig behavioral2/memory/3496-791-0x00007FF681660000-0x00007FF6819B4000-memory.dmp xmrig behavioral2/memory/4632-795-0x00007FF777A40000-0x00007FF777D94000-memory.dmp xmrig behavioral2/memory/5088-801-0x00007FF7705B0000-0x00007FF770904000-memory.dmp xmrig behavioral2/memory/4612-802-0x00007FF67C3E0000-0x00007FF67C734000-memory.dmp xmrig behavioral2/memory/2164-804-0x00007FF6234E0000-0x00007FF623834000-memory.dmp xmrig behavioral2/memory/2676-788-0x00007FF730520000-0x00007FF730874000-memory.dmp xmrig behavioral2/memory/3428-766-0x00007FF7FB420000-0x00007FF7FB774000-memory.dmp xmrig behavioral2/memory/3736-747-0x00007FF7E2630000-0x00007FF7E2984000-memory.dmp xmrig behavioral2/files/0x0007000000023462-136.dat xmrig behavioral2/files/0x0007000000023461-131.dat xmrig behavioral2/files/0x0007000000023460-126.dat xmrig behavioral2/files/0x000700000002345f-121.dat xmrig behavioral2/files/0x000700000002345e-116.dat xmrig behavioral2/files/0x000700000002345d-111.dat xmrig behavioral2/files/0x000700000002345c-106.dat xmrig behavioral2/files/0x000700000002345b-101.dat xmrig behavioral2/files/0x0007000000023458-86.dat xmrig behavioral2/files/0x0007000000023456-76.dat xmrig behavioral2/files/0x0007000000023452-61.dat xmrig behavioral2/memory/3880-56-0x00007FF78C090000-0x00007FF78C3E4000-memory.dmp xmrig behavioral2/memory/4652-54-0x00007FF7728C0000-0x00007FF772C14000-memory.dmp xmrig behavioral2/memory/3440-53-0x00007FF69ACC0000-0x00007FF69B014000-memory.dmp xmrig behavioral2/memory/2020-49-0x00007FF782CD0000-0x00007FF783024000-memory.dmp xmrig behavioral2/memory/2012-43-0x00007FF702CE0000-0x00007FF703034000-memory.dmp xmrig behavioral2/memory/1464-42-0x00007FF79FC40000-0x00007FF79FF94000-memory.dmp xmrig behavioral2/memory/5020-36-0x00007FF609DE0000-0x00007FF60A134000-memory.dmp xmrig behavioral2/memory/5072-17-0x00007FF6F20F0000-0x00007FF6F2444000-memory.dmp xmrig behavioral2/memory/1956-15-0x00007FF6B53E0000-0x00007FF6B5734000-memory.dmp xmrig behavioral2/files/0x000700000002344c-13.dat xmrig behavioral2/memory/4796-1070-0x00007FF7D34B0000-0x00007FF7D3804000-memory.dmp xmrig -
Executes dropped EXE 64 IoCs
pid Process 1956 MdYZClF.exe 5072 jvZQFcS.exe 3388 RnzoUDS.exe 2020 ZSBpwpS.exe 5020 bomyfFG.exe 1464 xZFOEMl.exe 2012 arWWBFl.exe 3440 epmsADt.exe 4652 BaXOmey.exe 3880 HkIrAhK.exe 4508 oTCSbLh.exe 1044 mqleUjM.exe 4584 hTDbXTK.exe 1200 BHjtrHu.exe 3736 xevpsqc.exe 2776 zqtrVOh.exe 2576 Kjsaeul.exe 1760 sdxfrDd.exe 3428 TXroIPT.exe 4548 tIgIYrj.exe 1332 deodrxj.exe 4764 OefAbku.exe 4800 koYVHud.exe 2676 YMpOXju.exe 3496 nflidMV.exe 4632 IwAAuMU.exe 5088 hlCOkPG.exe 4612 kbQQXUF.exe 2164 qbRAFmB.exe 1828 dqjydqU.exe 2792 KeXtXok.exe 4424 QnwaRJn.exe 3696 RbFODqr.exe 4216 iRkwIya.exe 3744 VmLoqTV.exe 2544 tQyYfRB.exe 2404 ShojqeD.exe 1120 mhMTLwJ.exe 1244 QnrbDTv.exe 1040 NbYiqjf.exe 3704 rTunPiR.exe 724 HxKUdcK.exe 4372 TJqyZcM.exe 2300 uTNLyqF.exe 2320 ZszXkGP.exe 3060 vkoUaPv.exe 4276 DqEEkgy.exe 1456 GUXSwAh.exe 2780 oFyKVOH.exe 1580 eLComIi.exe 2716 fHpzDQa.exe 1824 IvXHXFv.exe 3944 WEGlaXd.exe 5028 dPgNBvP.exe 4728 ZqPfIWU.exe 1184 GWsmVvJ.exe 3400 qpQWvIQ.exe 1304 VOpTJke.exe 2752 qMdbJoo.exe 1980 QModKXe.exe 1648 dDmimsy.exe 4324 SOjTPIf.exe 2536 KSevynP.exe 5016 WaDboVv.exe -
resource yara_rule behavioral2/memory/4796-0-0x00007FF7D34B0000-0x00007FF7D3804000-memory.dmp upx behavioral2/files/0x00070000000232b3-5.dat upx behavioral2/files/0x000700000002344d-16.dat upx behavioral2/files/0x000700000002344e-20.dat upx behavioral2/files/0x000700000002344f-26.dat upx behavioral2/memory/3388-35-0x00007FF6A2ED0000-0x00007FF6A3224000-memory.dmp upx behavioral2/files/0x0007000000023450-38.dat upx behavioral2/files/0x0007000000023451-45.dat upx behavioral2/files/0x0007000000023453-50.dat upx behavioral2/files/0x0007000000023454-55.dat upx behavioral2/files/0x0007000000023455-63.dat upx behavioral2/files/0x0007000000023457-73.dat upx behavioral2/files/0x0007000000023459-83.dat upx behavioral2/files/0x000700000002345a-96.dat upx behavioral2/files/0x0007000000023464-138.dat upx behavioral2/files/0x0007000000023466-156.dat upx behavioral2/memory/4508-730-0x00007FF775B30000-0x00007FF775E84000-memory.dmp upx behavioral2/memory/1044-731-0x00007FF6EC810000-0x00007FF6ECB64000-memory.dmp upx behavioral2/memory/4584-732-0x00007FF751C80000-0x00007FF751FD4000-memory.dmp upx behavioral2/memory/1200-741-0x00007FF672330000-0x00007FF672684000-memory.dmp upx behavioral2/files/0x000700000002346b-173.dat upx behavioral2/files/0x0007000000023469-171.dat upx behavioral2/files/0x000700000002346a-168.dat upx behavioral2/files/0x0007000000023468-166.dat upx behavioral2/files/0x0007000000023467-161.dat upx behavioral2/files/0x0007000000023465-151.dat upx behavioral2/files/0x0007000000023463-141.dat upx behavioral2/memory/2776-758-0x00007FF7B4200000-0x00007FF7B4554000-memory.dmp upx behavioral2/memory/2576-761-0x00007FF682DB0000-0x00007FF683104000-memory.dmp upx behavioral2/memory/1760-765-0x00007FF6C8AF0000-0x00007FF6C8E44000-memory.dmp upx behavioral2/memory/4548-772-0x00007FF619180000-0x00007FF6194D4000-memory.dmp upx behavioral2/memory/1332-775-0x00007FF68EA60000-0x00007FF68EDB4000-memory.dmp upx behavioral2/memory/4764-781-0x00007FF63A990000-0x00007FF63ACE4000-memory.dmp upx behavioral2/memory/4800-787-0x00007FF6E0020000-0x00007FF6E0374000-memory.dmp upx behavioral2/memory/3496-791-0x00007FF681660000-0x00007FF6819B4000-memory.dmp upx behavioral2/memory/4632-795-0x00007FF777A40000-0x00007FF777D94000-memory.dmp upx behavioral2/memory/5088-801-0x00007FF7705B0000-0x00007FF770904000-memory.dmp upx behavioral2/memory/4612-802-0x00007FF67C3E0000-0x00007FF67C734000-memory.dmp upx behavioral2/memory/2164-804-0x00007FF6234E0000-0x00007FF623834000-memory.dmp upx behavioral2/memory/2676-788-0x00007FF730520000-0x00007FF730874000-memory.dmp upx behavioral2/memory/3428-766-0x00007FF7FB420000-0x00007FF7FB774000-memory.dmp upx behavioral2/memory/3736-747-0x00007FF7E2630000-0x00007FF7E2984000-memory.dmp upx behavioral2/files/0x0007000000023462-136.dat upx behavioral2/files/0x0007000000023461-131.dat upx behavioral2/files/0x0007000000023460-126.dat upx behavioral2/files/0x000700000002345f-121.dat upx behavioral2/files/0x000700000002345e-116.dat upx behavioral2/files/0x000700000002345d-111.dat upx behavioral2/files/0x000700000002345c-106.dat upx behavioral2/files/0x000700000002345b-101.dat upx behavioral2/files/0x0007000000023458-86.dat upx behavioral2/files/0x0007000000023456-76.dat upx behavioral2/files/0x0007000000023452-61.dat upx behavioral2/memory/3880-56-0x00007FF78C090000-0x00007FF78C3E4000-memory.dmp upx behavioral2/memory/4652-54-0x00007FF7728C0000-0x00007FF772C14000-memory.dmp upx behavioral2/memory/3440-53-0x00007FF69ACC0000-0x00007FF69B014000-memory.dmp upx behavioral2/memory/2020-49-0x00007FF782CD0000-0x00007FF783024000-memory.dmp upx behavioral2/memory/2012-43-0x00007FF702CE0000-0x00007FF703034000-memory.dmp upx behavioral2/memory/1464-42-0x00007FF79FC40000-0x00007FF79FF94000-memory.dmp upx behavioral2/memory/5020-36-0x00007FF609DE0000-0x00007FF60A134000-memory.dmp upx behavioral2/memory/5072-17-0x00007FF6F20F0000-0x00007FF6F2444000-memory.dmp upx behavioral2/memory/1956-15-0x00007FF6B53E0000-0x00007FF6B5734000-memory.dmp upx behavioral2/files/0x000700000002344c-13.dat upx behavioral2/memory/4796-1070-0x00007FF7D34B0000-0x00007FF7D3804000-memory.dmp upx -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\System\HkIrAhK.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\xevpsqc.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\RyebxKu.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\yhuTxRx.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\IcgannN.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\OimatwP.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\gDnDNZA.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\hBeEELe.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\tOgbgTt.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\jZgEwQA.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\DCadssg.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\KSevynP.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\WaDboVv.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\jmZpzCP.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\mNOPlAW.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\ljPvBmR.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\mOEwYpU.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\dSHajNz.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\WgxNJWq.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\cujqzOL.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\vVLeYPu.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\tThPtCL.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\AWegsUU.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\BaXOmey.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\JjGLRfb.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\EWKWowj.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\TKvIHSz.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\sfJdzPB.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\tJNkoJW.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\qkfnjIh.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\AIMFJhw.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\RXuEMvn.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\JbfeGJj.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\mhMTLwJ.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\eZnbLwV.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\ZdIyQee.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\KDgQSGs.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\emIlrmR.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\OefAbku.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\eLComIi.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\MXoinDK.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\SJfFRGg.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\BPfEBXr.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\QKVgTQh.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\ShojqeD.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\QnrbDTv.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\QModKXe.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\WbgjPTw.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\dapCNwO.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\OZtyOxO.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\koYVHud.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\vXkCryi.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\gtTXMcM.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\NbYiqjf.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\WotuEnF.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\UtKXMCS.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\fOqvxSy.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\gNUGknF.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\dckuqWu.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\hlCOkPG.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\VmLoqTV.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\YzOGuEl.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\SqmrXvF.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe File created C:\Windows\System\dUNbYgS.exe 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe Token: SeLockMemoryPrivilege 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4796 wrote to memory of 1956 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 86 PID 4796 wrote to memory of 1956 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 86 PID 4796 wrote to memory of 5072 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 87 PID 4796 wrote to memory of 5072 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 87 PID 4796 wrote to memory of 3388 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 88 PID 4796 wrote to memory of 3388 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 88 PID 4796 wrote to memory of 2020 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 89 PID 4796 wrote to memory of 2020 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 89 PID 4796 wrote to memory of 5020 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 90 PID 4796 wrote to memory of 5020 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 90 PID 4796 wrote to memory of 1464 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 91 PID 4796 wrote to memory of 1464 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 91 PID 4796 wrote to memory of 2012 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 92 PID 4796 wrote to memory of 2012 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 92 PID 4796 wrote to memory of 3440 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 93 PID 4796 wrote to memory of 3440 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 93 PID 4796 wrote to memory of 4652 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 94 PID 4796 wrote to memory of 4652 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 94 PID 4796 wrote to memory of 3880 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 95 PID 4796 wrote to memory of 3880 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 95 PID 4796 wrote to memory of 4508 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 96 PID 4796 wrote to memory of 4508 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 96 PID 4796 wrote to memory of 1044 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 97 PID 4796 wrote to memory of 1044 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 97 PID 4796 wrote to memory of 4584 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 98 PID 4796 wrote to memory of 4584 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 98 PID 4796 wrote to memory of 1200 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 99 PID 4796 wrote to memory of 1200 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 99 PID 4796 wrote to memory of 3736 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 100 PID 4796 wrote to memory of 3736 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 100 PID 4796 wrote to memory of 2776 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 101 PID 4796 wrote to memory of 2776 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 101 PID 4796 wrote to memory of 2576 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 102 PID 4796 wrote to memory of 2576 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 102 PID 4796 wrote to memory of 1760 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 103 PID 4796 wrote to memory of 1760 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 103 PID 4796 wrote to memory of 3428 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 104 PID 4796 wrote to memory of 3428 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 104 PID 4796 wrote to memory of 4548 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 105 PID 4796 wrote to memory of 4548 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 105 PID 4796 wrote to memory of 1332 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 106 PID 4796 wrote to memory of 1332 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 106 PID 4796 wrote to memory of 4764 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 107 PID 4796 wrote to memory of 4764 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 107 PID 4796 wrote to memory of 4800 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 108 PID 4796 wrote to memory of 4800 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 108 PID 4796 wrote to memory of 2676 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 109 PID 4796 wrote to memory of 2676 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 109 PID 4796 wrote to memory of 3496 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 110 PID 4796 wrote to memory of 3496 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 110 PID 4796 wrote to memory of 4632 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 111 PID 4796 wrote to memory of 4632 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 111 PID 4796 wrote to memory of 5088 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 112 PID 4796 wrote to memory of 5088 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 112 PID 4796 wrote to memory of 4612 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 113 PID 4796 wrote to memory of 4612 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 113 PID 4796 wrote to memory of 2164 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 114 PID 4796 wrote to memory of 2164 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 114 PID 4796 wrote to memory of 1828 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 115 PID 4796 wrote to memory of 1828 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 115 PID 4796 wrote to memory of 2792 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 116 PID 4796 wrote to memory of 2792 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 116 PID 4796 wrote to memory of 4424 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 117 PID 4796 wrote to memory of 4424 4796 68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\68737a41201c7beac4ea377eebfde3a79db13f1b8254d7931254bb213f5a69be_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\System\MdYZClF.exeC:\Windows\System\MdYZClF.exe2⤵
- Executes dropped EXE
PID:1956
-
-
C:\Windows\System\jvZQFcS.exeC:\Windows\System\jvZQFcS.exe2⤵
- Executes dropped EXE
PID:5072
-
-
C:\Windows\System\RnzoUDS.exeC:\Windows\System\RnzoUDS.exe2⤵
- Executes dropped EXE
PID:3388
-
-
C:\Windows\System\ZSBpwpS.exeC:\Windows\System\ZSBpwpS.exe2⤵
- Executes dropped EXE
PID:2020
-
-
C:\Windows\System\bomyfFG.exeC:\Windows\System\bomyfFG.exe2⤵
- Executes dropped EXE
PID:5020
-
-
C:\Windows\System\xZFOEMl.exeC:\Windows\System\xZFOEMl.exe2⤵
- Executes dropped EXE
PID:1464
-
-
C:\Windows\System\arWWBFl.exeC:\Windows\System\arWWBFl.exe2⤵
- Executes dropped EXE
PID:2012
-
-
C:\Windows\System\epmsADt.exeC:\Windows\System\epmsADt.exe2⤵
- Executes dropped EXE
PID:3440
-
-
C:\Windows\System\BaXOmey.exeC:\Windows\System\BaXOmey.exe2⤵
- Executes dropped EXE
PID:4652
-
-
C:\Windows\System\HkIrAhK.exeC:\Windows\System\HkIrAhK.exe2⤵
- Executes dropped EXE
PID:3880
-
-
C:\Windows\System\oTCSbLh.exeC:\Windows\System\oTCSbLh.exe2⤵
- Executes dropped EXE
PID:4508
-
-
C:\Windows\System\mqleUjM.exeC:\Windows\System\mqleUjM.exe2⤵
- Executes dropped EXE
PID:1044
-
-
C:\Windows\System\hTDbXTK.exeC:\Windows\System\hTDbXTK.exe2⤵
- Executes dropped EXE
PID:4584
-
-
C:\Windows\System\BHjtrHu.exeC:\Windows\System\BHjtrHu.exe2⤵
- Executes dropped EXE
PID:1200
-
-
C:\Windows\System\xevpsqc.exeC:\Windows\System\xevpsqc.exe2⤵
- Executes dropped EXE
PID:3736
-
-
C:\Windows\System\zqtrVOh.exeC:\Windows\System\zqtrVOh.exe2⤵
- Executes dropped EXE
PID:2776
-
-
C:\Windows\System\Kjsaeul.exeC:\Windows\System\Kjsaeul.exe2⤵
- Executes dropped EXE
PID:2576
-
-
C:\Windows\System\sdxfrDd.exeC:\Windows\System\sdxfrDd.exe2⤵
- Executes dropped EXE
PID:1760
-
-
C:\Windows\System\TXroIPT.exeC:\Windows\System\TXroIPT.exe2⤵
- Executes dropped EXE
PID:3428
-
-
C:\Windows\System\tIgIYrj.exeC:\Windows\System\tIgIYrj.exe2⤵
- Executes dropped EXE
PID:4548
-
-
C:\Windows\System\deodrxj.exeC:\Windows\System\deodrxj.exe2⤵
- Executes dropped EXE
PID:1332
-
-
C:\Windows\System\OefAbku.exeC:\Windows\System\OefAbku.exe2⤵
- Executes dropped EXE
PID:4764
-
-
C:\Windows\System\koYVHud.exeC:\Windows\System\koYVHud.exe2⤵
- Executes dropped EXE
PID:4800
-
-
C:\Windows\System\YMpOXju.exeC:\Windows\System\YMpOXju.exe2⤵
- Executes dropped EXE
PID:2676
-
-
C:\Windows\System\nflidMV.exeC:\Windows\System\nflidMV.exe2⤵
- Executes dropped EXE
PID:3496
-
-
C:\Windows\System\IwAAuMU.exeC:\Windows\System\IwAAuMU.exe2⤵
- Executes dropped EXE
PID:4632
-
-
C:\Windows\System\hlCOkPG.exeC:\Windows\System\hlCOkPG.exe2⤵
- Executes dropped EXE
PID:5088
-
-
C:\Windows\System\kbQQXUF.exeC:\Windows\System\kbQQXUF.exe2⤵
- Executes dropped EXE
PID:4612
-
-
C:\Windows\System\qbRAFmB.exeC:\Windows\System\qbRAFmB.exe2⤵
- Executes dropped EXE
PID:2164
-
-
C:\Windows\System\dqjydqU.exeC:\Windows\System\dqjydqU.exe2⤵
- Executes dropped EXE
PID:1828
-
-
C:\Windows\System\KeXtXok.exeC:\Windows\System\KeXtXok.exe2⤵
- Executes dropped EXE
PID:2792
-
-
C:\Windows\System\QnwaRJn.exeC:\Windows\System\QnwaRJn.exe2⤵
- Executes dropped EXE
PID:4424
-
-
C:\Windows\System\RbFODqr.exeC:\Windows\System\RbFODqr.exe2⤵
- Executes dropped EXE
PID:3696
-
-
C:\Windows\System\iRkwIya.exeC:\Windows\System\iRkwIya.exe2⤵
- Executes dropped EXE
PID:4216
-
-
C:\Windows\System\VmLoqTV.exeC:\Windows\System\VmLoqTV.exe2⤵
- Executes dropped EXE
PID:3744
-
-
C:\Windows\System\tQyYfRB.exeC:\Windows\System\tQyYfRB.exe2⤵
- Executes dropped EXE
PID:2544
-
-
C:\Windows\System\ShojqeD.exeC:\Windows\System\ShojqeD.exe2⤵
- Executes dropped EXE
PID:2404
-
-
C:\Windows\System\mhMTLwJ.exeC:\Windows\System\mhMTLwJ.exe2⤵
- Executes dropped EXE
PID:1120
-
-
C:\Windows\System\QnrbDTv.exeC:\Windows\System\QnrbDTv.exe2⤵
- Executes dropped EXE
PID:1244
-
-
C:\Windows\System\NbYiqjf.exeC:\Windows\System\NbYiqjf.exe2⤵
- Executes dropped EXE
PID:1040
-
-
C:\Windows\System\rTunPiR.exeC:\Windows\System\rTunPiR.exe2⤵
- Executes dropped EXE
PID:3704
-
-
C:\Windows\System\HxKUdcK.exeC:\Windows\System\HxKUdcK.exe2⤵
- Executes dropped EXE
PID:724
-
-
C:\Windows\System\TJqyZcM.exeC:\Windows\System\TJqyZcM.exe2⤵
- Executes dropped EXE
PID:4372
-
-
C:\Windows\System\uTNLyqF.exeC:\Windows\System\uTNLyqF.exe2⤵
- Executes dropped EXE
PID:2300
-
-
C:\Windows\System\ZszXkGP.exeC:\Windows\System\ZszXkGP.exe2⤵
- Executes dropped EXE
PID:2320
-
-
C:\Windows\System\vkoUaPv.exeC:\Windows\System\vkoUaPv.exe2⤵
- Executes dropped EXE
PID:3060
-
-
C:\Windows\System\DqEEkgy.exeC:\Windows\System\DqEEkgy.exe2⤵
- Executes dropped EXE
PID:4276
-
-
C:\Windows\System\GUXSwAh.exeC:\Windows\System\GUXSwAh.exe2⤵
- Executes dropped EXE
PID:1456
-
-
C:\Windows\System\oFyKVOH.exeC:\Windows\System\oFyKVOH.exe2⤵
- Executes dropped EXE
PID:2780
-
-
C:\Windows\System\eLComIi.exeC:\Windows\System\eLComIi.exe2⤵
- Executes dropped EXE
PID:1580
-
-
C:\Windows\System\fHpzDQa.exeC:\Windows\System\fHpzDQa.exe2⤵
- Executes dropped EXE
PID:2716
-
-
C:\Windows\System\IvXHXFv.exeC:\Windows\System\IvXHXFv.exe2⤵
- Executes dropped EXE
PID:1824
-
-
C:\Windows\System\WEGlaXd.exeC:\Windows\System\WEGlaXd.exe2⤵
- Executes dropped EXE
PID:3944
-
-
C:\Windows\System\dPgNBvP.exeC:\Windows\System\dPgNBvP.exe2⤵
- Executes dropped EXE
PID:5028
-
-
C:\Windows\System\ZqPfIWU.exeC:\Windows\System\ZqPfIWU.exe2⤵
- Executes dropped EXE
PID:4728
-
-
C:\Windows\System\GWsmVvJ.exeC:\Windows\System\GWsmVvJ.exe2⤵
- Executes dropped EXE
PID:1184
-
-
C:\Windows\System\qpQWvIQ.exeC:\Windows\System\qpQWvIQ.exe2⤵
- Executes dropped EXE
PID:3400
-
-
C:\Windows\System\VOpTJke.exeC:\Windows\System\VOpTJke.exe2⤵
- Executes dropped EXE
PID:1304
-
-
C:\Windows\System\qMdbJoo.exeC:\Windows\System\qMdbJoo.exe2⤵
- Executes dropped EXE
PID:2752
-
-
C:\Windows\System\QModKXe.exeC:\Windows\System\QModKXe.exe2⤵
- Executes dropped EXE
PID:1980
-
-
C:\Windows\System\dDmimsy.exeC:\Windows\System\dDmimsy.exe2⤵
- Executes dropped EXE
PID:1648
-
-
C:\Windows\System\SOjTPIf.exeC:\Windows\System\SOjTPIf.exe2⤵
- Executes dropped EXE
PID:4324
-
-
C:\Windows\System\KSevynP.exeC:\Windows\System\KSevynP.exe2⤵
- Executes dropped EXE
PID:2536
-
-
C:\Windows\System\WaDboVv.exeC:\Windows\System\WaDboVv.exe2⤵
- Executes dropped EXE
PID:5016
-
-
C:\Windows\System\OimatwP.exeC:\Windows\System\OimatwP.exe2⤵PID:4756
-
-
C:\Windows\System\gDnDNZA.exeC:\Windows\System\gDnDNZA.exe2⤵PID:1868
-
-
C:\Windows\System\LCKlyHU.exeC:\Windows\System\LCKlyHU.exe2⤵PID:4724
-
-
C:\Windows\System\RyebxKu.exeC:\Windows\System\RyebxKu.exe2⤵PID:5128
-
-
C:\Windows\System\CVgXBid.exeC:\Windows\System\CVgXBid.exe2⤵PID:5156
-
-
C:\Windows\System\EyEoAXj.exeC:\Windows\System\EyEoAXj.exe2⤵PID:5184
-
-
C:\Windows\System\qJimvAW.exeC:\Windows\System\qJimvAW.exe2⤵PID:5208
-
-
C:\Windows\System\hreerDZ.exeC:\Windows\System\hreerDZ.exe2⤵PID:5244
-
-
C:\Windows\System\nSjoOAR.exeC:\Windows\System\nSjoOAR.exe2⤵PID:5268
-
-
C:\Windows\System\rovivBB.exeC:\Windows\System\rovivBB.exe2⤵PID:5292
-
-
C:\Windows\System\wPjQPlr.exeC:\Windows\System\wPjQPlr.exe2⤵PID:5320
-
-
C:\Windows\System\SbESeRJ.exeC:\Windows\System\SbESeRJ.exe2⤵PID:5348
-
-
C:\Windows\System\wwJkWdh.exeC:\Windows\System\wwJkWdh.exe2⤵PID:5380
-
-
C:\Windows\System\rvujYct.exeC:\Windows\System\rvujYct.exe2⤵PID:5404
-
-
C:\Windows\System\rRzoJek.exeC:\Windows\System\rRzoJek.exe2⤵PID:5436
-
-
C:\Windows\System\RTJldRz.exeC:\Windows\System\RTJldRz.exe2⤵PID:5464
-
-
C:\Windows\System\htXrAVG.exeC:\Windows\System\htXrAVG.exe2⤵PID:5492
-
-
C:\Windows\System\hDrnFpV.exeC:\Windows\System\hDrnFpV.exe2⤵PID:5516
-
-
C:\Windows\System\LSATBAp.exeC:\Windows\System\LSATBAp.exe2⤵PID:5548
-
-
C:\Windows\System\cIYwSsU.exeC:\Windows\System\cIYwSsU.exe2⤵PID:5576
-
-
C:\Windows\System\GzpRCbM.exeC:\Windows\System\GzpRCbM.exe2⤵PID:5604
-
-
C:\Windows\System\qNXKvdc.exeC:\Windows\System\qNXKvdc.exe2⤵PID:5632
-
-
C:\Windows\System\iMKOhLK.exeC:\Windows\System\iMKOhLK.exe2⤵PID:5660
-
-
C:\Windows\System\yQxyYVB.exeC:\Windows\System\yQxyYVB.exe2⤵PID:5684
-
-
C:\Windows\System\jNDJiQZ.exeC:\Windows\System\jNDJiQZ.exe2⤵PID:5712
-
-
C:\Windows\System\kPYFsTB.exeC:\Windows\System\kPYFsTB.exe2⤵PID:5740
-
-
C:\Windows\System\RAvRAMA.exeC:\Windows\System\RAvRAMA.exe2⤵PID:5768
-
-
C:\Windows\System\amZlyoG.exeC:\Windows\System\amZlyoG.exe2⤵PID:5800
-
-
C:\Windows\System\hxLRmNf.exeC:\Windows\System\hxLRmNf.exe2⤵PID:5824
-
-
C:\Windows\System\ZApdvqQ.exeC:\Windows\System\ZApdvqQ.exe2⤵PID:5856
-
-
C:\Windows\System\ZeRTkFE.exeC:\Windows\System\ZeRTkFE.exe2⤵PID:5884
-
-
C:\Windows\System\oxPzSRj.exeC:\Windows\System\oxPzSRj.exe2⤵PID:5912
-
-
C:\Windows\System\PsfFuqG.exeC:\Windows\System\PsfFuqG.exe2⤵PID:5936
-
-
C:\Windows\System\JioLnou.exeC:\Windows\System\JioLnou.exe2⤵PID:5968
-
-
C:\Windows\System\FmQdGNx.exeC:\Windows\System\FmQdGNx.exe2⤵PID:5992
-
-
C:\Windows\System\RFTlOwK.exeC:\Windows\System\RFTlOwK.exe2⤵PID:6020
-
-
C:\Windows\System\YUalwPg.exeC:\Windows\System\YUalwPg.exe2⤵PID:6052
-
-
C:\Windows\System\djLYZPN.exeC:\Windows\System\djLYZPN.exe2⤵PID:6076
-
-
C:\Windows\System\DmZLgsr.exeC:\Windows\System\DmZLgsr.exe2⤵PID:6104
-
-
C:\Windows\System\ZOqwUBe.exeC:\Windows\System\ZOqwUBe.exe2⤵PID:6132
-
-
C:\Windows\System\vNRJyHM.exeC:\Windows\System\vNRJyHM.exe2⤵PID:4360
-
-
C:\Windows\System\mQxdocx.exeC:\Windows\System\mQxdocx.exe2⤵PID:1140
-
-
C:\Windows\System\qwaVhmy.exeC:\Windows\System\qwaVhmy.exe2⤵PID:1976
-
-
C:\Windows\System\wyOYcDG.exeC:\Windows\System\wyOYcDG.exe2⤵PID:8
-
-
C:\Windows\System\yhuTxRx.exeC:\Windows\System\yhuTxRx.exe2⤵PID:3688
-
-
C:\Windows\System\XauuWne.exeC:\Windows\System\XauuWne.exe2⤵PID:5144
-
-
C:\Windows\System\StEFCZU.exeC:\Windows\System\StEFCZU.exe2⤵PID:5204
-
-
C:\Windows\System\jUGsYbM.exeC:\Windows\System\jUGsYbM.exe2⤵PID:5280
-
-
C:\Windows\System\neyxYra.exeC:\Windows\System\neyxYra.exe2⤵PID:5340
-
-
C:\Windows\System\IiFwfVw.exeC:\Windows\System\IiFwfVw.exe2⤵PID:5400
-
-
C:\Windows\System\cujqzOL.exeC:\Windows\System\cujqzOL.exe2⤵PID:5476
-
-
C:\Windows\System\vXkCryi.exeC:\Windows\System\vXkCryi.exe2⤵PID:5536
-
-
C:\Windows\System\bcHrJtK.exeC:\Windows\System\bcHrJtK.exe2⤵PID:5596
-
-
C:\Windows\System\FBktyQj.exeC:\Windows\System\FBktyQj.exe2⤵PID:5672
-
-
C:\Windows\System\NTjZRit.exeC:\Windows\System\NTjZRit.exe2⤵PID:5728
-
-
C:\Windows\System\VaqtgLS.exeC:\Windows\System\VaqtgLS.exe2⤵PID:5792
-
-
C:\Windows\System\wtVlPfj.exeC:\Windows\System\wtVlPfj.exe2⤵PID:5848
-
-
C:\Windows\System\sfJdzPB.exeC:\Windows\System\sfJdzPB.exe2⤵PID:5928
-
-
C:\Windows\System\tJNkoJW.exeC:\Windows\System\tJNkoJW.exe2⤵PID:5984
-
-
C:\Windows\System\kxgaYjH.exeC:\Windows\System\kxgaYjH.exe2⤵PID:6044
-
-
C:\Windows\System\ledWZdK.exeC:\Windows\System\ledWZdK.exe2⤵PID:6124
-
-
C:\Windows\System\vVLeYPu.exeC:\Windows\System\vVLeYPu.exe2⤵PID:1336
-
-
C:\Windows\System\VpYUwVQ.exeC:\Windows\System\VpYUwVQ.exe2⤵PID:4524
-
-
C:\Windows\System\NjNxYRj.exeC:\Windows\System\NjNxYRj.exe2⤵PID:2668
-
-
C:\Windows\System\kWRPWQD.exeC:\Windows\System\kWRPWQD.exe2⤵PID:5308
-
-
C:\Windows\System\ARIitlW.exeC:\Windows\System\ARIitlW.exe2⤵PID:5452
-
-
C:\Windows\System\UvlAAAH.exeC:\Windows\System\UvlAAAH.exe2⤵PID:5624
-
-
C:\Windows\System\trdFhdZ.exeC:\Windows\System\trdFhdZ.exe2⤵PID:5760
-
-
C:\Windows\System\MPNCbPm.exeC:\Windows\System\MPNCbPm.exe2⤵PID:5900
-
-
C:\Windows\System\qkfnjIh.exeC:\Windows\System\qkfnjIh.exe2⤵PID:6040
-
-
C:\Windows\System\XCDSWYa.exeC:\Windows\System\XCDSWYa.exe2⤵PID:6180
-
-
C:\Windows\System\FTjYLiS.exeC:\Windows\System\FTjYLiS.exe2⤵PID:6204
-
-
C:\Windows\System\xiVelTn.exeC:\Windows\System\xiVelTn.exe2⤵PID:6232
-
-
C:\Windows\System\YWCcyVw.exeC:\Windows\System\YWCcyVw.exe2⤵PID:6256
-
-
C:\Windows\System\hBeEELe.exeC:\Windows\System\hBeEELe.exe2⤵PID:6284
-
-
C:\Windows\System\uEMjzpV.exeC:\Windows\System\uEMjzpV.exe2⤵PID:6312
-
-
C:\Windows\System\BnebdaW.exeC:\Windows\System\BnebdaW.exe2⤵PID:6344
-
-
C:\Windows\System\dCjeszz.exeC:\Windows\System\dCjeszz.exe2⤵PID:6372
-
-
C:\Windows\System\WbgjPTw.exeC:\Windows\System\WbgjPTw.exe2⤵PID:6396
-
-
C:\Windows\System\cmcVhTL.exeC:\Windows\System\cmcVhTL.exe2⤵PID:6424
-
-
C:\Windows\System\sWTFlDK.exeC:\Windows\System\sWTFlDK.exe2⤵PID:6452
-
-
C:\Windows\System\MXoinDK.exeC:\Windows\System\MXoinDK.exe2⤵PID:6484
-
-
C:\Windows\System\ZKMSbwQ.exeC:\Windows\System\ZKMSbwQ.exe2⤵PID:6508
-
-
C:\Windows\System\UHeRgaN.exeC:\Windows\System\UHeRgaN.exe2⤵PID:6536
-
-
C:\Windows\System\qWUgVJD.exeC:\Windows\System\qWUgVJD.exe2⤵PID:6564
-
-
C:\Windows\System\pLUhybK.exeC:\Windows\System\pLUhybK.exe2⤵PID:6592
-
-
C:\Windows\System\tThPtCL.exeC:\Windows\System\tThPtCL.exe2⤵PID:6620
-
-
C:\Windows\System\WtNAZOE.exeC:\Windows\System\WtNAZOE.exe2⤵PID:6648
-
-
C:\Windows\System\HbHkpGU.exeC:\Windows\System\HbHkpGU.exe2⤵PID:6676
-
-
C:\Windows\System\KDgQSGs.exeC:\Windows\System\KDgQSGs.exe2⤵PID:6704
-
-
C:\Windows\System\wgnjzIG.exeC:\Windows\System\wgnjzIG.exe2⤵PID:6732
-
-
C:\Windows\System\kJDIvLT.exeC:\Windows\System\kJDIvLT.exe2⤵PID:6764
-
-
C:\Windows\System\OhMhPQN.exeC:\Windows\System\OhMhPQN.exe2⤵PID:6792
-
-
C:\Windows\System\pGFpnXf.exeC:\Windows\System\pGFpnXf.exe2⤵PID:6816
-
-
C:\Windows\System\JtLnqBX.exeC:\Windows\System\JtLnqBX.exe2⤵PID:6848
-
-
C:\Windows\System\SUhSfJk.exeC:\Windows\System\SUhSfJk.exe2⤵PID:6876
-
-
C:\Windows\System\xoHkcyc.exeC:\Windows\System\xoHkcyc.exe2⤵PID:6904
-
-
C:\Windows\System\qVWsxyv.exeC:\Windows\System\qVWsxyv.exe2⤵PID:6932
-
-
C:\Windows\System\yoUTmsu.exeC:\Windows\System\yoUTmsu.exe2⤵PID:6960
-
-
C:\Windows\System\mhSOOfz.exeC:\Windows\System\mhSOOfz.exe2⤵PID:6988
-
-
C:\Windows\System\lOamisF.exeC:\Windows\System\lOamisF.exe2⤵PID:7012
-
-
C:\Windows\System\AIMFJhw.exeC:\Windows\System\AIMFJhw.exe2⤵PID:7044
-
-
C:\Windows\System\VdkcaHO.exeC:\Windows\System\VdkcaHO.exe2⤵PID:7072
-
-
C:\Windows\System\ynMlNWS.exeC:\Windows\System\ynMlNWS.exe2⤵PID:7096
-
-
C:\Windows\System\szJLTde.exeC:\Windows\System\szJLTde.exe2⤵PID:7124
-
-
C:\Windows\System\eZnbLwV.exeC:\Windows\System\eZnbLwV.exe2⤵PID:7156
-
-
C:\Windows\System\nRBiCQG.exeC:\Windows\System\nRBiCQG.exe2⤵PID:2628
-
-
C:\Windows\System\WlZtbKp.exeC:\Windows\System\WlZtbKp.exe2⤵PID:5252
-
-
C:\Windows\System\QRpOigM.exeC:\Windows\System\QRpOigM.exe2⤵PID:5512
-
-
C:\Windows\System\fkGFJpc.exeC:\Windows\System\fkGFJpc.exe2⤵PID:5840
-
-
C:\Windows\System\YzOGuEl.exeC:\Windows\System\YzOGuEl.exe2⤵PID:6164
-
-
C:\Windows\System\FpNhXps.exeC:\Windows\System\FpNhXps.exe2⤵PID:6224
-
-
C:\Windows\System\bIfRRZo.exeC:\Windows\System\bIfRRZo.exe2⤵PID:6300
-
-
C:\Windows\System\dSHajNz.exeC:\Windows\System\dSHajNz.exe2⤵PID:6360
-
-
C:\Windows\System\vXdHrlw.exeC:\Windows\System\vXdHrlw.exe2⤵PID:6412
-
-
C:\Windows\System\fqaVVZB.exeC:\Windows\System\fqaVVZB.exe2⤵PID:6444
-
-
C:\Windows\System\SqmrXvF.exeC:\Windows\System\SqmrXvF.exe2⤵PID:6504
-
-
C:\Windows\System\snpvKHS.exeC:\Windows\System\snpvKHS.exe2⤵PID:6580
-
-
C:\Windows\System\WotuEnF.exeC:\Windows\System\WotuEnF.exe2⤵PID:6640
-
-
C:\Windows\System\eErGPKM.exeC:\Windows\System\eErGPKM.exe2⤵PID:6720
-
-
C:\Windows\System\ewkBxoO.exeC:\Windows\System\ewkBxoO.exe2⤵PID:6776
-
-
C:\Windows\System\pqYhpJw.exeC:\Windows\System\pqYhpJw.exe2⤵PID:6832
-
-
C:\Windows\System\WchHMet.exeC:\Windows\System\WchHMet.exe2⤵PID:6896
-
-
C:\Windows\System\hSxZhsf.exeC:\Windows\System\hSxZhsf.exe2⤵PID:6948
-
-
C:\Windows\System\bmrlICc.exeC:\Windows\System\bmrlICc.exe2⤵PID:7004
-
-
C:\Windows\System\uBBWLvN.exeC:\Windows\System\uBBWLvN.exe2⤵PID:7084
-
-
C:\Windows\System\pdPRDZR.exeC:\Windows\System\pdPRDZR.exe2⤵PID:7116
-
-
C:\Windows\System\ixHeloh.exeC:\Windows\System\ixHeloh.exe2⤵PID:5084
-
-
C:\Windows\System\CKdpZdH.exeC:\Windows\System\CKdpZdH.exe2⤵PID:1360
-
-
C:\Windows\System\GpQDetW.exeC:\Windows\System\GpQDetW.exe2⤵PID:6196
-
-
C:\Windows\System\PBuSGor.exeC:\Windows\System\PBuSGor.exe2⤵PID:6332
-
-
C:\Windows\System\iXQVyKH.exeC:\Windows\System\iXQVyKH.exe2⤵PID:1864
-
-
C:\Windows\System\zHdMdwJ.exeC:\Windows\System\zHdMdwJ.exe2⤵PID:6556
-
-
C:\Windows\System\ZdIyQee.exeC:\Windows\System\ZdIyQee.exe2⤵PID:6748
-
-
C:\Windows\System\jjJvsiF.exeC:\Windows\System\jjJvsiF.exe2⤵PID:6868
-
-
C:\Windows\System\QRqYyxF.exeC:\Windows\System\QRqYyxF.exe2⤵PID:1732
-
-
C:\Windows\System\rBnwtxk.exeC:\Windows\System\rBnwtxk.exe2⤵PID:7112
-
-
C:\Windows\System\nJMoWJt.exeC:\Windows\System\nJMoWJt.exe2⤵PID:3044
-
-
C:\Windows\System\dUNbYgS.exeC:\Windows\System\dUNbYgS.exe2⤵PID:7184
-
-
C:\Windows\System\GJpZWqg.exeC:\Windows\System\GJpZWqg.exe2⤵PID:7212
-
-
C:\Windows\System\RXuEMvn.exeC:\Windows\System\RXuEMvn.exe2⤵PID:7240
-
-
C:\Windows\System\bqZtVYF.exeC:\Windows\System\bqZtVYF.exe2⤵PID:7272
-
-
C:\Windows\System\VVCLtzO.exeC:\Windows\System\VVCLtzO.exe2⤵PID:7300
-
-
C:\Windows\System\mmibsdw.exeC:\Windows\System\mmibsdw.exe2⤵PID:7328
-
-
C:\Windows\System\rrNjnea.exeC:\Windows\System\rrNjnea.exe2⤵PID:7352
-
-
C:\Windows\System\iAcMaxU.exeC:\Windows\System\iAcMaxU.exe2⤵PID:7380
-
-
C:\Windows\System\tjHaGgM.exeC:\Windows\System\tjHaGgM.exe2⤵PID:7412
-
-
C:\Windows\System\nekCHmt.exeC:\Windows\System\nekCHmt.exe2⤵PID:7436
-
-
C:\Windows\System\grDSYvW.exeC:\Windows\System\grDSYvW.exe2⤵PID:7464
-
-
C:\Windows\System\JJWZLmP.exeC:\Windows\System\JJWZLmP.exe2⤵PID:7492
-
-
C:\Windows\System\jmZpzCP.exeC:\Windows\System\jmZpzCP.exe2⤵PID:7520
-
-
C:\Windows\System\NgQcbXl.exeC:\Windows\System\NgQcbXl.exe2⤵PID:7552
-
-
C:\Windows\System\sMwoaFy.exeC:\Windows\System\sMwoaFy.exe2⤵PID:7580
-
-
C:\Windows\System\SQfhYVU.exeC:\Windows\System\SQfhYVU.exe2⤵PID:7604
-
-
C:\Windows\System\IyfTSlG.exeC:\Windows\System\IyfTSlG.exe2⤵PID:7632
-
-
C:\Windows\System\KojiiDD.exeC:\Windows\System\KojiiDD.exe2⤵PID:7720
-
-
C:\Windows\System\tOgbgTt.exeC:\Windows\System\tOgbgTt.exe2⤵PID:7752
-
-
C:\Windows\System\ZTJhhfZ.exeC:\Windows\System\ZTJhhfZ.exe2⤵PID:7780
-
-
C:\Windows\System\VkDTXhW.exeC:\Windows\System\VkDTXhW.exe2⤵PID:7804
-
-
C:\Windows\System\rhuQLES.exeC:\Windows\System\rhuQLES.exe2⤵PID:7832
-
-
C:\Windows\System\jkAZIFt.exeC:\Windows\System\jkAZIFt.exe2⤵PID:7856
-
-
C:\Windows\System\lusFQQi.exeC:\Windows\System\lusFQQi.exe2⤵PID:7872
-
-
C:\Windows\System\qvTBqul.exeC:\Windows\System\qvTBqul.exe2⤵PID:7896
-
-
C:\Windows\System\mNOPlAW.exeC:\Windows\System\mNOPlAW.exe2⤵PID:7920
-
-
C:\Windows\System\rxWBMwU.exeC:\Windows\System\rxWBMwU.exe2⤵PID:7988
-
-
C:\Windows\System\XVBfDYO.exeC:\Windows\System\XVBfDYO.exe2⤵PID:8016
-
-
C:\Windows\System\EkUlLEV.exeC:\Windows\System\EkUlLEV.exe2⤵PID:8036
-
-
C:\Windows\System\OhAgOXf.exeC:\Windows\System\OhAgOXf.exe2⤵PID:8084
-
-
C:\Windows\System\EkaiTpa.exeC:\Windows\System\EkaiTpa.exe2⤵PID:8104
-
-
C:\Windows\System\IPZBWXK.exeC:\Windows\System\IPZBWXK.exe2⤵PID:8124
-
-
C:\Windows\System\JbfeGJj.exeC:\Windows\System\JbfeGJj.exe2⤵PID:8140
-
-
C:\Windows\System\VQdfNus.exeC:\Windows\System\VQdfNus.exe2⤵PID:6036
-
-
C:\Windows\System\cdXjvrE.exeC:\Windows\System\cdXjvrE.exe2⤵PID:6636
-
-
C:\Windows\System\TwGhxUx.exeC:\Windows\System\TwGhxUx.exe2⤵PID:3360
-
-
C:\Windows\System\ntRMkEd.exeC:\Windows\System\ntRMkEd.exe2⤵PID:6092
-
-
C:\Windows\System\igDJvTu.exeC:\Windows\System\igDJvTu.exe2⤵PID:7292
-
-
C:\Windows\System\Ckhthdd.exeC:\Windows\System\Ckhthdd.exe2⤵PID:7372
-
-
C:\Windows\System\nIxTEwU.exeC:\Windows\System\nIxTEwU.exe2⤵PID:4700
-
-
C:\Windows\System\ESuvfnf.exeC:\Windows\System\ESuvfnf.exe2⤵PID:1460
-
-
C:\Windows\System\WgxNJWq.exeC:\Windows\System\WgxNJWq.exe2⤵PID:7452
-
-
C:\Windows\System\LVgiqxB.exeC:\Windows\System\LVgiqxB.exe2⤵PID:1972
-
-
C:\Windows\System\shwBYQQ.exeC:\Windows\System\shwBYQQ.exe2⤵PID:7516
-
-
C:\Windows\System\SJfFRGg.exeC:\Windows\System\SJfFRGg.exe2⤵PID:7600
-
-
C:\Windows\System\FMkWXdH.exeC:\Windows\System\FMkWXdH.exe2⤵PID:7572
-
-
C:\Windows\System\VrDFVWv.exeC:\Windows\System\VrDFVWv.exe2⤵PID:7620
-
-
C:\Windows\System\AWegsUU.exeC:\Windows\System\AWegsUU.exe2⤵PID:2532
-
-
C:\Windows\System\ZRIMjqN.exeC:\Windows\System\ZRIMjqN.exe2⤵PID:7652
-
-
C:\Windows\System\VbHwrXD.exeC:\Windows\System\VbHwrXD.exe2⤵PID:3560
-
-
C:\Windows\System\LZVDfXS.exeC:\Windows\System\LZVDfXS.exe2⤵PID:7764
-
-
C:\Windows\System\gwETldn.exeC:\Windows\System\gwETldn.exe2⤵PID:7852
-
-
C:\Windows\System\ljPvBmR.exeC:\Windows\System\ljPvBmR.exe2⤵PID:7868
-
-
C:\Windows\System\FArieTo.exeC:\Windows\System\FArieTo.exe2⤵PID:7916
-
-
C:\Windows\System\IGujmJC.exeC:\Windows\System\IGujmJC.exe2⤵PID:8000
-
-
C:\Windows\System\WfLqOsz.exeC:\Windows\System\WfLqOsz.exe2⤵PID:8072
-
-
C:\Windows\System\gtTXMcM.exeC:\Windows\System\gtTXMcM.exe2⤵PID:8132
-
-
C:\Windows\System\znxtecM.exeC:\Windows\System\znxtecM.exe2⤵PID:6692
-
-
C:\Windows\System\xxtJPhQ.exeC:\Windows\System\xxtJPhQ.exe2⤵PID:1288
-
-
C:\Windows\System\UtKXMCS.exeC:\Windows\System\UtKXMCS.exe2⤵PID:7204
-
-
C:\Windows\System\wgANndj.exeC:\Windows\System\wgANndj.exe2⤵PID:7368
-
-
C:\Windows\System\lYoOSoo.exeC:\Windows\System\lYoOSoo.exe2⤵PID:4864
-
-
C:\Windows\System\eQDswXR.exeC:\Windows\System\eQDswXR.exe2⤵PID:4812
-
-
C:\Windows\System\dapCNwO.exeC:\Windows\System\dapCNwO.exe2⤵PID:7564
-
-
C:\Windows\System\DtrYoFA.exeC:\Windows\System\DtrYoFA.exe2⤵PID:2484
-
-
C:\Windows\System\XJwrSVi.exeC:\Windows\System\XJwrSVi.exe2⤵PID:7768
-
-
C:\Windows\System\nwKVrYG.exeC:\Windows\System\nwKVrYG.exe2⤵PID:8024
-
-
C:\Windows\System\FEVFRyB.exeC:\Windows\System\FEVFRyB.exe2⤵PID:3784
-
-
C:\Windows\System\cjOPUAE.exeC:\Windows\System\cjOPUAE.exe2⤵PID:7460
-
-
C:\Windows\System\GIssQzy.exeC:\Windows\System\GIssQzy.exe2⤵PID:7928
-
-
C:\Windows\System\CwsdAyA.exeC:\Windows\System\CwsdAyA.exe2⤵PID:8184
-
-
C:\Windows\System\BPfEBXr.exeC:\Windows\System\BPfEBXr.exe2⤵PID:2896
-
-
C:\Windows\System\EfteAIG.exeC:\Windows\System\EfteAIG.exe2⤵PID:7952
-
-
C:\Windows\System\jZgEwQA.exeC:\Windows\System\jZgEwQA.exe2⤵PID:8212
-
-
C:\Windows\System\AtBzPsW.exeC:\Windows\System\AtBzPsW.exe2⤵PID:8244
-
-
C:\Windows\System\tOlpVnC.exeC:\Windows\System\tOlpVnC.exe2⤵PID:8276
-
-
C:\Windows\System\CUvQrQN.exeC:\Windows\System\CUvQrQN.exe2⤵PID:8292
-
-
C:\Windows\System\pkqscgX.exeC:\Windows\System\pkqscgX.exe2⤵PID:8324
-
-
C:\Windows\System\ohuMxTv.exeC:\Windows\System\ohuMxTv.exe2⤵PID:8364
-
-
C:\Windows\System\IcgannN.exeC:\Windows\System\IcgannN.exe2⤵PID:8392
-
-
C:\Windows\System\OZtyOxO.exeC:\Windows\System\OZtyOxO.exe2⤵PID:8432
-
-
C:\Windows\System\lGQSbcO.exeC:\Windows\System\lGQSbcO.exe2⤵PID:8456
-
-
C:\Windows\System\WlLIueC.exeC:\Windows\System\WlLIueC.exe2⤵PID:8476
-
-
C:\Windows\System\JjGLRfb.exeC:\Windows\System\JjGLRfb.exe2⤵PID:8500
-
-
C:\Windows\System\JjLDmcD.exeC:\Windows\System\JjLDmcD.exe2⤵PID:8532
-
-
C:\Windows\System\prmJUDx.exeC:\Windows\System\prmJUDx.exe2⤵PID:8572
-
-
C:\Windows\System\xERhyxd.exeC:\Windows\System\xERhyxd.exe2⤵PID:8588
-
-
C:\Windows\System\GgtEyyB.exeC:\Windows\System\GgtEyyB.exe2⤵PID:8604
-
-
C:\Windows\System\AABpDfo.exeC:\Windows\System\AABpDfo.exe2⤵PID:8660
-
-
C:\Windows\System\PgLNurB.exeC:\Windows\System\PgLNurB.exe2⤵PID:8676
-
-
C:\Windows\System\YlpAuRM.exeC:\Windows\System\YlpAuRM.exe2⤵PID:8708
-
-
C:\Windows\System\KlbRXZU.exeC:\Windows\System\KlbRXZU.exe2⤵PID:8732
-
-
C:\Windows\System\fOqvxSy.exeC:\Windows\System\fOqvxSy.exe2⤵PID:8760
-
-
C:\Windows\System\gNUGknF.exeC:\Windows\System\gNUGknF.exe2⤵PID:8784
-
-
C:\Windows\System\JFNWIDK.exeC:\Windows\System\JFNWIDK.exe2⤵PID:8812
-
-
C:\Windows\System\ViZZeeZ.exeC:\Windows\System\ViZZeeZ.exe2⤵PID:8828
-
-
C:\Windows\System\emIlrmR.exeC:\Windows\System\emIlrmR.exe2⤵PID:8848
-
-
C:\Windows\System\DiWhhgq.exeC:\Windows\System\DiWhhgq.exe2⤵PID:8888
-
-
C:\Windows\System\jUcbUiJ.exeC:\Windows\System\jUcbUiJ.exe2⤵PID:8904
-
-
C:\Windows\System\Ilwhcdp.exeC:\Windows\System\Ilwhcdp.exe2⤵PID:8920
-
-
C:\Windows\System\mfFncKA.exeC:\Windows\System\mfFncKA.exe2⤵PID:8960
-
-
C:\Windows\System\VhcgzVQ.exeC:\Windows\System\VhcgzVQ.exe2⤵PID:8988
-
-
C:\Windows\System\llkCvuR.exeC:\Windows\System\llkCvuR.exe2⤵PID:9020
-
-
C:\Windows\System\UciDsMe.exeC:\Windows\System\UciDsMe.exe2⤵PID:9080
-
-
C:\Windows\System\EWKWowj.exeC:\Windows\System\EWKWowj.exe2⤵PID:9108
-
-
C:\Windows\System\KrJdsEf.exeC:\Windows\System\KrJdsEf.exe2⤵PID:9124
-
-
C:\Windows\System\yCWANKS.exeC:\Windows\System\yCWANKS.exe2⤵PID:9164
-
-
C:\Windows\System\YasrcGB.exeC:\Windows\System\YasrcGB.exe2⤵PID:9180
-
-
C:\Windows\System\blfwcrD.exeC:\Windows\System\blfwcrD.exe2⤵PID:9208
-
-
C:\Windows\System\zJjhDDA.exeC:\Windows\System\zJjhDDA.exe2⤵PID:8236
-
-
C:\Windows\System\TSgCfuQ.exeC:\Windows\System\TSgCfuQ.exe2⤵PID:8304
-
-
C:\Windows\System\dckuqWu.exeC:\Windows\System\dckuqWu.exe2⤵PID:8336
-
-
C:\Windows\System\TPKNfau.exeC:\Windows\System\TPKNfau.exe2⤵PID:8404
-
-
C:\Windows\System\GfOAbHd.exeC:\Windows\System\GfOAbHd.exe2⤵PID:8512
-
-
C:\Windows\System\VBeDrUR.exeC:\Windows\System\VBeDrUR.exe2⤵PID:8580
-
-
C:\Windows\System\mOEwYpU.exeC:\Windows\System\mOEwYpU.exe2⤵PID:8652
-
-
C:\Windows\System\JqsiRhQ.exeC:\Windows\System\JqsiRhQ.exe2⤵PID:8696
-
-
C:\Windows\System\TKvIHSz.exeC:\Windows\System\TKvIHSz.exe2⤵PID:8780
-
-
C:\Windows\System\qNJbpVX.exeC:\Windows\System\qNJbpVX.exe2⤵PID:8776
-
-
C:\Windows\System\QKVgTQh.exeC:\Windows\System\QKVgTQh.exe2⤵PID:8916
-
-
C:\Windows\System\fjWqmIq.exeC:\Windows\System\fjWqmIq.exe2⤵PID:8972
-
-
C:\Windows\System\DCadssg.exeC:\Windows\System\DCadssg.exe2⤵PID:9040
-
-
C:\Windows\System\dJnxtxM.exeC:\Windows\System\dJnxtxM.exe2⤵PID:9116
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD5f24e5d12d2188a62a9219d27b05260d8
SHA16a7c4b7cf40b63bc7d254e7860000b61ea8080c5
SHA256cc945f39ba13182e4fdb927132edd311d6a3959fc936141384f9e41af47d7213
SHA512952983713afec3af275495913bd0a67a3ec9b73e7c55d9c3c61bb45681e1bfee0bd0717fcc0e770c56b087ee53ebc4df5f9ab8c0179720aea7c61d978b05d40c
-
Filesize
2.3MB
MD5ec50841239e12ec930375cd5913dc7f6
SHA190a80935f949a45b20b9b4e327fcf00663f840d0
SHA256d338e89b79a8aef1705944ed2bb30c0fd7e99c56bbb68d77e9e34824ccd7e2a0
SHA512dcc2ab6cabc78fa6f9789d2795fd19efbb8b195727d6c1d87b2e61c45b922464aeaf7151bcd45d44bc06a59d47e6d28920e708d78cff338731fea1eb74076140
-
Filesize
2.3MB
MD5f528e38ed561ff83e7485cd9b8fec48e
SHA15a1d1e932a73b198544cc83f20e5df94f82c4339
SHA2568e1a966ec44cd52babb8209b9f639f2acc028afdf20517be2851850be5246144
SHA51248a894209c32270a8aea18c09416078d7aadff8a996d05508a1a62d800509ad061dff0c1cdd797a93f2c043c903e1b447d08e590c3846c4a777ba62f362ff48b
-
Filesize
2.3MB
MD5ef896c8d7612279658b0fc12250ee687
SHA105fa51b56a2b36c149db30b5189b6c2e58dd5f1f
SHA25619c425abcd82efbaa531827fcf22e875d1a5e05b69b29d1146eb2b7627625b60
SHA512b78c3961105a5d6f6a048d3a5c0f8cf5b48a10ecd2bf96fbb0aac660b0f253e7cf2827e3fbc87106bc58bbf2db209332e11cb9feb0981a9f1746a0c0f9e37042
-
Filesize
2.3MB
MD5e2f216921d9eabe1a2dd8e35e9ac7c0a
SHA110b9d07ad1d9a1966dbd847a29fd86ee86d72944
SHA2567e8478f81f9ec7b46d13325f1a7fb05f54c183e954a11e64f768c46f534d8721
SHA512bbe11c2da4ed3221f3ca706dcfe93f40db196426b36382ade98960018c8845f05df023273c593fcb7c9382e069e3aeecb222d102c1781cd5162d591ee32cfe7a
-
Filesize
2.3MB
MD53673ef2a75703061877a65c23d25ab23
SHA18549a01bf7ffd93707c7172dea1257e940bcdac5
SHA2561872dfbdaa7df9cb2c870fbec0a251becbb78a8d2691ad0be6208fdd858ac30e
SHA512d8d4a279126557c8f638bfe2c63e02b9e9d95a16e5c027ba81d4c6b7b24bda6065d65a5c03d1b4efd48bdebf9904eb93624e278a2bfc4a6385252825690c7660
-
Filesize
2.3MB
MD5ea956a56d5cdcabbe988bd815ebf70a1
SHA12823fb268202056e62e88df3a96bd45d360c6bdb
SHA256c5098880533cb221d8122991084e52fb9e9b1b91368192a45c81487bc6696854
SHA512fa8464ac041c470f584bab8b4c11190b2e956ef64a4ad50a611a32a65c846040375ae70782c5d5ba498ef3ff524eca600768956d9c564205c6864407a2655044
-
Filesize
2.3MB
MD58ff142de11d1c8d68cbff4db55002353
SHA19f4865fa0c8a1f112eb5cdf721516f9bf86b5e74
SHA2569b8756837440f1d681bff59a8152c1e619fee9e3a0bd52fbe170c5fb8d12f718
SHA512fe82028da7bfb993ab938340fd5caec7f9bd63ad51223a625e15b789d1b957fa2e6e08a1783d6c4ff0de1d69734272740045d1c6a4c996bd72355c64aac63c69
-
Filesize
2.3MB
MD550b1a38de4f75f5811969f059a34f398
SHA198c75a4c8ed3a832c94bd9d9acfbb3984e127a45
SHA256adb85a0d7442adc3d33f6a65f9204d344197c309c1d12d30a6df300e7c474354
SHA512a8120e7750243f114af30ab5c030ea5ab1b2d6715913a54fabf6bba9a4d7d03f2cdfa5832efeee2ba783acc4d77dbf7ed242a684d779f820dae12bd32c474fbf
-
Filesize
2.3MB
MD503524b27f95bf3e58b7b379cbae98149
SHA1cd2feca2b43fba74ffdb385adf6b895ccbd158f8
SHA256f0dd577b5e53e08eab43945b06b8b466ca8b27c3e2851915003270f81ad32e42
SHA512979c6e9487dbf56e5192bf6f19f18021f82f40df7e9a29f49d3b3131166695ab2985e34d349a08dd51fb2d18b16934dc275ba7825ab1ef5cc1955920d2b2d209
-
Filesize
2.3MB
MD5e4ca3651f37fe4d8ee04bdbfc2db480f
SHA156b39f028e5b78f46f8704ae395f916fe80a7703
SHA2562d5f12efd9cc86963f1513ea816b62cd345ebdc287dcb3f967698c037d45261f
SHA512aacdb0b135e9095bce86ffe05a69606fc981e2534ddbec9220e2fad0c87d146f10a6e7bcf4d0222d4cf4abeca3dd9f08cb398193a5ae4e883293162022ed4da2
-
Filesize
2.3MB
MD5c304922a3de919e47e0316dad903f2d7
SHA17674149147ca1387d1adbcdf3c2a8ef8a97214b0
SHA25695a035bb1e57914684e2bb5c756ab6be89b320a1821fe86579e2579d6af9e110
SHA512608e849e1a572b88d466147bc6326a5f28a33f76bc61910bc8f0fae50a61ed08d004b11e65cc0c30013beb434d7f22846d70aabcebd69cfe6f5a897afa62cfe1
-
Filesize
2.3MB
MD58287fb08e4602cac894fed9ac60ce9fe
SHA1619e33a8a04b735b591b4446f8f283574971eca3
SHA25603e895b45ba191149101396fbe3c91146032640883d7551c56b1817114924836
SHA51251dc05171e9043104771496484274ab88da8cf065f93ea1abc1e91b0bed4aa9214be4bf9a1ca9e3b8de472c257f1507df1963dc4f16c20d79a5657ace8f19a3d
-
Filesize
2.3MB
MD586e7455c846ee7cb292bddf1741fa9f3
SHA1b0589645fbc972d7da6b0221819cf1fd56eb9c11
SHA256a78fc485899ee1116d255b3140ca42a9325188a56e907cf91f481165ecc85dbd
SHA512938d08613a115608370fec8cbbcc907cbd2b01703a72b0057087b64f42321bb778492b6620728f96693abff7f791db832b138ba1e225f5d279b7dbd8aaeb0772
-
Filesize
2.3MB
MD5a1599994b86d27351ecf5a6550353cc4
SHA12ab136f309837d09805f872996d2c59f44a95fa9
SHA2563a72f62ed72fda531f8787169eb07a21f1b3de507e6f8f1d7aa0202eb1788e8b
SHA5124bbea1a6921997cff61246f70f16f4e731a01e6ab8612e8b2f6ad6da36e5d60b16b6ce7eefaea21f61661e9c61165b96a4a92700e53db4d2523b08898876e55e
-
Filesize
2.3MB
MD51ac3251c11c81fb57ae024af57fa98a9
SHA1ddcc536a2d12c2f7882bbdc0fc1767de7b8d8cf6
SHA2563460808bf70931bc263af0cfec52469e0e71f9e71ebb38a23ac3dd325bdc93cd
SHA51281daec1d046912b166a46fa320a8a49ec1630c65d404a72bfbd33cd8dbad873c8ca072043b01c1464d9a9cc55153b35d42c270095dbde6eae62f031bdcaf2ee1
-
Filesize
2.3MB
MD58caa0ff5f0bd63e3f6b293fedc10f592
SHA1fccc061572900b946d322c74817824add4a0aa07
SHA256fc7c18b181fccf85514f2ee31c2dc6ebca8844e2b45377bfeb2a0670fbe271a1
SHA512ee8275cc4abf69ad7a33121ca8eff5b28c67070ee3a23e516a5db602cae1a562f3f13e3a0e54d47426ababd130253373523bb8807c5684e5a574f574c96e5e2e
-
Filesize
2.3MB
MD594589396452ae38e5a5b9d51b6425fe6
SHA138577c98e2cefc3940c0c8bab1703c00694d2ec1
SHA256ff8d1d0c5b8e421e84c8aa15d60290feb9aa8f0beeab06d3c28ded0b390d7421
SHA51273d53e58f719ff6bf2f86e94a44562338f0a2fe2fab3687d561fe2dd94b35aa553e27ba8984e801ed62bfa06307c18974ef8693be75885dbd8c8e133d4724e1d
-
Filesize
2.3MB
MD594b87914beed4b014d8a9a38e883d760
SHA1b89ee39223967b8be5aae1916c00110c89a41f13
SHA25635b9fbc3907394094fdf0adfa989dc6370a291d53308666595ef161c0be7fe74
SHA512cae865323ca7aced23ae5147f88dfff1879b3554b48340df392ffc2d6752627f5a1c552f907b06ddb309888f4a79e29cb2f84c57d5f9ccbfc88f83d4984dad9c
-
Filesize
2.3MB
MD544e61218d55adf77208066fb0ec3b31c
SHA19d2bf15a1e3c89e7bd7de0777e93182f220d8fb0
SHA2568a764ad368e4139818adc94a07f230955adf5a8559ce7d36df3f138f665f12c5
SHA512da3f7de99013c9be643d3749ce5e8a4dbc055835b86c9b2b6c7a4032a01345560a45655694a014062b52b8101a2e78b5e9b17cb6e7809522eea32c74111e804e
-
Filesize
2.3MB
MD54b0225219c835b0964bafd4c8d164609
SHA12931420199dcf567cb06c2ae6709febb18641553
SHA2567887ada0b27ec643b11c03f42683671ec683cff80ef4ab645e8e625b68d12161
SHA5126c89d44a7de414b2891aebeee9296872d50a6ae3921d168104b79c030819c4210dcad0c1470389fe48774fa0f97a47ff1f52a0b412410335f311fcad62e103d7
-
Filesize
2.3MB
MD528117e59f744b664e90745b664abef92
SHA14ac50c6a5532c941b5d50eae95290b39a7b809ac
SHA256322a6d2c24a68a71c783f6b25f50655a6ae51d95cf3bf4dae8de448d6e65d37a
SHA5127accb72342d2f8ee3fc9f6d0382de4ea8180363b3d4d65d4e1563a9534f31f57cfe72e22d38ff56cf65bc3f022149b6aad2b5de84798d79f02e99c3192192b19
-
Filesize
2.3MB
MD513590bcbf10f9aa2e299a48ac9d7b79e
SHA170c3e03eceed06b6ba4488b3daff119c50a7ec76
SHA256f0a8f92ffad730878dc1c7ce11dfe2d3e0a6c67faf60041a9c91807a95325378
SHA5122ed1e514dd90224b042e7caf5f1c55fbe56b60f7f0838247b4b8b4f0afd49d8a7193d9e42f04a5641e40a86e355d274cd9c607dbc49bc3ff6f6e486f0f2cf963
-
Filesize
2.3MB
MD5f15b599f83c628121b9749ea3bed556f
SHA16ff861cf2e93a10ceecd5cfdd7be0b4becc0f8ff
SHA2560c8eb1c39b97d971b17747c774af49d901c52d5e719a5abf2254c85531e0ed96
SHA512c6d2aaf04a0fa84cdfcbb2e44ebef645e628a13037221d91b1ecc2501affc1344bb267add1dc19ddda46e1ac2991f3f8805ddc0c23043a8bc722b0581af3171d
-
Filesize
2.3MB
MD52583bfa475ef5bafa760973a6529b424
SHA1eb8b99cfe0e4254e81418094f999c4cd052e547d
SHA2567c0d68e8e7167f3764b7ef42c5ffcfc4cab14d78d6a6772c58bcd5ad0557554a
SHA5121cafe943d60e96be846a6f1337f9094876c9a7c063d4a51352ee9f488c86142474e96bf58d6a6d4042aae957cecc8d7cd5f698972ff5bf7d61fc55f294d5dc4e
-
Filesize
2.3MB
MD523a2dbdd859b918cbdd1a253e69b0efc
SHA1634b7c7d4a58e13dee33735d1aa9cd26735c493d
SHA25661b98404f575899584cf4624c35a2ce26fd322daf6f2ac3f9307e349cab52471
SHA5121418f271fd9e92dadfbdfc541b5ff8415fd053b4df13565b14584420ac1413cc9637b594d6d8359d072691c0b083afddf47b98a86351eca621242d9ae4f213c3
-
Filesize
2.3MB
MD552ab8600cb47527e53e031721b813952
SHA1d78402b5e48113ce299b0ca02760713523145c45
SHA256b5aa77e5cbf083c49b4e6aaf1c85a74d59f74dee269b4986c2a728491a7814a6
SHA5127cd6e5843de4b1e3f2c4ea7c2084a89caba1933d381b07beecd4bdfe00e2fd720cec0fa2ddc0f20b06b06d4f59dfe3ab2784cabe3051fc25471f512759cecf4e
-
Filesize
2.3MB
MD56a2c1e9419bc371202ae97a12263e338
SHA1d2e6f0102765aec95392cf194345d4b615933192
SHA256b5de2febf3637fa9256cff081b2ee5779457e0d3b003e87e7af7a7934f6bd800
SHA512add891338914fe83aba672fbd96bcb198160161b4f0403501c64c2fd67db83b3037354efd49b8dfcd1e611e1010ea31cf8c202fca11d2c173c44e5ba0074aef8
-
Filesize
2.3MB
MD54cf97775fc1bd86adc57e0c2be532c31
SHA14daa1b61dd3ffa7724066e58de80e3a811e0ea78
SHA256cd93c127538f6c2c8d86072fc549223041f9fd377fa466472f24c8023f1f88fc
SHA512cbece3ad2fca0b0bca5941ced35aa89a472f2f5e74f8884bbeb0fc78e393f53d32b52f0c46f99b48088266447658a67509ecfda7618e72282e8c76391b7acf84
-
Filesize
2.3MB
MD5dcfec7d493dd56e4561457de6b3b88de
SHA157e6da6bb1793aa58aabfccc8dad476aa153f602
SHA256d433474a52a7c35a40f169cc4f51b04e075569b31788865ce57d0ec1c7013f24
SHA512f151b1e3ab0e6059edfc7688ad11e91c710999268c220aae3518d1ee5bd2e0cbb81fc2e266be2667f76c3705974574e24e5371286c5de369e27d62a851be7651
-
Filesize
2.3MB
MD58d93117a313ce03f620683cf4269805f
SHA1006899c1e18a23fb9795da9a9709e25c0d890bd5
SHA25633ae50ba03e07939ae1fc031c56054310e86ecd78ca23121470bf33a06140c34
SHA51248ff5e49706fb3b3266c3ee96c387c020b1b8ee432650ba5e1762a2d3ece56449ad312d09fbc06098888d501532650d55997e1babb06d1827b0f6b4fad4eb97e
-
Filesize
2.3MB
MD58677b40102a81f170c2c6dfa05f2e825
SHA102fc7b6c04c429133e6a272bc55d66def860f0d4
SHA256230223442f9c8766b985f7a9923579a4538beb1358fd47a210821c7b1713ee22
SHA512ed4af3da79514f849513a354573470f2d71c468690bef10e952f6211d15a774a9c95a673f504170af7ed89e6f2fcb6ab14f410acf8c7f6c5cfb77305425041e7
-
Filesize
2.3MB
MD5c189112db19506c320e7c6ee7ae5fba1
SHA1324bf87b76144f36f9d908ec1b9ec30aa0633e8c
SHA25643217851ad194d88c50b0abf6bcea131ba790edf737f3f1815e01e9bc2b30c62
SHA5120d0d4b35ef9efb1e327b376cc1f3c6e4e8747533e7eee4e67ab3d23c1e82d84e5aca2e3c32112999bc302cf315bf23eb8939737d6364db332e969252cc885010