xmrig | b8e1d4a59ad92197bc7808077f3b138cbdb6e504e04315ab98c81fef30379bdc

Analysis

max time kernel
135s
max time network
144s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 15:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
Size

1.0MB
MD5

58651e42851cb2cd68d4f955bb252cd0
SHA1

90af4bc5e27bce25f121bb27dec773f0267e4eec
SHA256

b8e1d4a59ad92197bc7808077f3b138cbdb6e504e04315ab98c81fef30379bdc
SHA512

b5df35ada2a0836793e821ad3c385dbf225ec2d1cde34c7c19cd0779282414abd9eaa3b387dc13e4f8cb96cb7f2ee12b5ec8a9603f8bc90a7124c696d3685162
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKensPLI6eg:GezaTF8FcNkNdfE0pZ9oztFwIhLI6eg

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000d000000015d59-2.dat	xmrig
behavioral1/files/0x0025000000016013-6.dat	xmrig
behavioral1/files/0x0007000000016575-11.dat	xmrig
behavioral1/files/0x00070000000167bf-19.dat	xmrig
behavioral1/files/0x0007000000016a28-23.dat	xmrig
behavioral1/files/0x0007000000016c1f-26.dat	xmrig
behavioral1/files/0x0009000000016c30-31.dat	xmrig
behavioral1/files/0x0008000000016d81-34.dat	xmrig
behavioral1/files/0x0006000000016d85-38.dat	xmrig
behavioral1/files/0x0006000000016da9-42.dat	xmrig
behavioral1/files/0x0006000000016f7e-50.dat	xmrig
behavioral1/files/0x000600000001738c-62.dat	xmrig
behavioral1/files/0x00060000000173df-74.dat	xmrig
behavioral1/files/0x000600000001748d-90.dat	xmrig
behavioral1/files/0x0006000000017510-94.dat	xmrig
behavioral1/files/0x000d00000001865b-102.dat	xmrig
behavioral1/files/0x00050000000191fd-130.dat	xmrig
behavioral1/files/0x00050000000191dc-126.dat	xmrig
behavioral1/files/0x00050000000191d7-122.dat	xmrig
behavioral1/files/0x00060000000190bc-118.dat	xmrig
behavioral1/files/0x00060000000190b3-114.dat	xmrig
behavioral1/files/0x000500000001877f-110.dat	xmrig
behavioral1/files/0x0005000000018674-107.dat	xmrig
behavioral1/files/0x000600000001864a-98.dat	xmrig
behavioral1/files/0x0006000000017472-86.dat	xmrig
behavioral1/files/0x000600000001745d-82.dat	xmrig
behavioral1/files/0x00060000000173e7-78.dat	xmrig
behavioral1/files/0x00060000000173dc-71.dat	xmrig
behavioral1/files/0x00060000000173c5-66.dat	xmrig
behavioral1/files/0x000600000001737e-58.dat	xmrig
behavioral1/files/0x000600000001737b-54.dat	xmrig
behavioral1/files/0x0006000000016e56-46.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1824	eNjOSUL.exe
2172	rJeRHdi.exe
1324	vgukuZy.exe
2960	PmmMmdJ.exe
3024	khGdqRF.exe
2536	xRDomro.exe
2680	InABrcO.exe
2664	gQjlUKR.exe
2656	TePuaWE.exe
2392	OuMRbwS.exe
2592	jzENBvm.exe
2640	YtlhKbC.exe
2568	njXwnud.exe
2212	cPnTaCR.exe
2448	urFIxlZ.exe
2500	ZqoLQxc.exe
2936	HcukLdg.exe
2600	zrNRqwJ.exe
820	ZeLNaKn.exe
2496	CJnpXMH.exe
2736	DoBCFyT.exe
1964	XuuMouI.exe
1704	NmdCqOO.exe
1828	eSerBMd.exe
880	wDxkBHK.exe
1804	UUgtyFq.exe
596	PFlINNJ.exe
928	XcqyOGw.exe
2236	kjPfYtT.exe
1548	wLqCESz.exe
1328	eoIPqjA.exe
2856	isynJwI.exe
2020	mMrztoX.exe
2908	lkEWZgX.exe
2284	ehdZFUa.exe
588	joSqMVS.exe
2280	XifhZai.exe
1120	uzPpKip.exe
2412	okadYCh.exe
2632	MUyGfmr.exe
1412	LdgDUgA.exe
2084	TzMWafv.exe
1104	FjBWaHM.exe
2816	gafPEij.exe
1376	hFzWHql.exe
1872	OMJTjvB.exe
1300	CdyrQgX.exe
452	SRbpVus.exe
1148	OBJEBGl.exe
2980	tUozyKo.exe
1712	vxJFVWS.exe
1840	axdZRSN.exe
1560	TuhqzwA.exe
2008	VZgbGfn.exe
2348	xSpsQFb.exe
1444	pTbxIzM.exe
1860	mcrqEbh.exe
2792	CQTvWov.exe
1792	tPsGMze.exe
2092	LJbvKWL.exe
1636	rSdEraf.exe
608	eCahkYm.exe
1320	mdtpeXn.exe
1532	mCudAkO.exe

Loads dropped DLL 64 IoCs

pid	Process
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\RLoafQV.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\GYmwTIk.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\wLqCESz.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\tjkTkKf.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\KBDJXJW.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\wDxkBHK.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\BjPqztw.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\NZwGYCa.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\lkEWZgX.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\MNVyFWx.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\cTtRhyD.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\CbKozLr.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\WbhLzpD.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\CJnpXMH.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\WzusOKU.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\jzENBvm.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\cPnTaCR.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\ZeLNaKn.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\gRoxiJP.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\lbcDhOy.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\ubvwXwd.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\LuNqHXs.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\rJeRHdi.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\DWGglYk.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\OWGbjwF.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\AktbBHj.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\fhtjhCb.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\rfkKtph.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\OORNkCJ.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\RuQbOid.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\iwoGoFB.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\eoIPqjA.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\OJBvFjr.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\fdoIbhQ.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\iZabmeZ.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\KsVaMsB.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\ikruVgh.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\lkQyYRR.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\vgukuZy.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\vZlJiKa.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\PTxAaHY.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\wNYqtbH.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\kJRmVLs.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\rSdEraf.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\fLZeqhf.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\WaIYuGI.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\PmmMmdJ.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\XoaVkcx.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\yVazXhX.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\kjkRluD.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\XtCeQfQ.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\mJBxJxy.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\vwOhIHm.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\BubPWkv.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\tUozyKo.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\jxcAnvL.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\InABrcO.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\xOvYNqg.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\eCahkYm.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\VZgbGfn.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\mcrqEbh.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\XcqyOGw.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\CdyrQgX.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
File created	C:\Windows\System\LJbvKWL.exe	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
Token: SeLockMemoryPrivilege	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 1824	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	29
PID 2064 wrote to memory of 1824	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	29
PID 2064 wrote to memory of 1824	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	29
PID 2064 wrote to memory of 2172	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	30
PID 2064 wrote to memory of 2172	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	30
PID 2064 wrote to memory of 2172	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	30
PID 2064 wrote to memory of 1324	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	31
PID 2064 wrote to memory of 1324	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	31
PID 2064 wrote to memory of 1324	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	31
PID 2064 wrote to memory of 2960	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	32
PID 2064 wrote to memory of 2960	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	32
PID 2064 wrote to memory of 2960	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	32
PID 2064 wrote to memory of 3024	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	33
PID 2064 wrote to memory of 3024	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	33
PID 2064 wrote to memory of 3024	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	33
PID 2064 wrote to memory of 2536	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	34
PID 2064 wrote to memory of 2536	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	34
PID 2064 wrote to memory of 2536	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	34
PID 2064 wrote to memory of 2680	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	35
PID 2064 wrote to memory of 2680	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	35
PID 2064 wrote to memory of 2680	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	35
PID 2064 wrote to memory of 2664	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	36
PID 2064 wrote to memory of 2664	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	36
PID 2064 wrote to memory of 2664	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	36
PID 2064 wrote to memory of 2656	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	37
PID 2064 wrote to memory of 2656	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	37
PID 2064 wrote to memory of 2656	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	37
PID 2064 wrote to memory of 2392	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	38
PID 2064 wrote to memory of 2392	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	38
PID 2064 wrote to memory of 2392	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	38
PID 2064 wrote to memory of 2592	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	39
PID 2064 wrote to memory of 2592	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	39
PID 2064 wrote to memory of 2592	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	39
PID 2064 wrote to memory of 2640	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	40
PID 2064 wrote to memory of 2640	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	40
PID 2064 wrote to memory of 2640	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	40
PID 2064 wrote to memory of 2568	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	41
PID 2064 wrote to memory of 2568	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	41
PID 2064 wrote to memory of 2568	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	41
PID 2064 wrote to memory of 2212	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	42
PID 2064 wrote to memory of 2212	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	42
PID 2064 wrote to memory of 2212	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	42
PID 2064 wrote to memory of 2448	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	43
PID 2064 wrote to memory of 2448	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	43
PID 2064 wrote to memory of 2448	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	43
PID 2064 wrote to memory of 2500	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	44
PID 2064 wrote to memory of 2500	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	44
PID 2064 wrote to memory of 2500	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	44
PID 2064 wrote to memory of 2936	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	45
PID 2064 wrote to memory of 2936	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	45
PID 2064 wrote to memory of 2936	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	45
PID 2064 wrote to memory of 2600	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	46
PID 2064 wrote to memory of 2600	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	46
PID 2064 wrote to memory of 2600	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	46
PID 2064 wrote to memory of 820	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	47
PID 2064 wrote to memory of 820	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	47
PID 2064 wrote to memory of 820	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	47
PID 2064 wrote to memory of 2496	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	48
PID 2064 wrote to memory of 2496	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	48
PID 2064 wrote to memory of 2496	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	48
PID 2064 wrote to memory of 2736	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	49
PID 2064 wrote to memory of 2736	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	49
PID 2064 wrote to memory of 2736	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	49
PID 2064 wrote to memory of 1964	2064	virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe	50

C:\Users\Admin\AppData\Local\Temp\virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe
"C:\Users\Admin\AppData\Local\Temp\virussign.com_58651e42851cb2cd68d4f955bb252cd0.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\System\eNjOSUL.exe
  C:\Windows\System\eNjOSUL.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\rJeRHdi.exe
  C:\Windows\System\rJeRHdi.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\vgukuZy.exe
  C:\Windows\System\vgukuZy.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\PmmMmdJ.exe
  C:\Windows\System\PmmMmdJ.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\khGdqRF.exe
  C:\Windows\System\khGdqRF.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\xRDomro.exe
  C:\Windows\System\xRDomro.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\InABrcO.exe
  C:\Windows\System\InABrcO.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\gQjlUKR.exe
  C:\Windows\System\gQjlUKR.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\TePuaWE.exe
  C:\Windows\System\TePuaWE.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\OuMRbwS.exe
  C:\Windows\System\OuMRbwS.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\jzENBvm.exe
  C:\Windows\System\jzENBvm.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\YtlhKbC.exe
  C:\Windows\System\YtlhKbC.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\njXwnud.exe
  C:\Windows\System\njXwnud.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\cPnTaCR.exe
  C:\Windows\System\cPnTaCR.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\urFIxlZ.exe
  C:\Windows\System\urFIxlZ.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\ZqoLQxc.exe
  C:\Windows\System\ZqoLQxc.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\HcukLdg.exe
  C:\Windows\System\HcukLdg.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\zrNRqwJ.exe
  C:\Windows\System\zrNRqwJ.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\ZeLNaKn.exe
  C:\Windows\System\ZeLNaKn.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\CJnpXMH.exe
  C:\Windows\System\CJnpXMH.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\DoBCFyT.exe
  C:\Windows\System\DoBCFyT.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\XuuMouI.exe
  C:\Windows\System\XuuMouI.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\NmdCqOO.exe
  C:\Windows\System\NmdCqOO.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\eSerBMd.exe
  C:\Windows\System\eSerBMd.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\wDxkBHK.exe
  C:\Windows\System\wDxkBHK.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\UUgtyFq.exe
  C:\Windows\System\UUgtyFq.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\PFlINNJ.exe
  C:\Windows\System\PFlINNJ.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\XcqyOGw.exe
  C:\Windows\System\XcqyOGw.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\kjPfYtT.exe
  C:\Windows\System\kjPfYtT.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\wLqCESz.exe
  C:\Windows\System\wLqCESz.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\eoIPqjA.exe
  C:\Windows\System\eoIPqjA.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\isynJwI.exe
  C:\Windows\System\isynJwI.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\mMrztoX.exe
  C:\Windows\System\mMrztoX.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\lkEWZgX.exe
  C:\Windows\System\lkEWZgX.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\ehdZFUa.exe
  C:\Windows\System\ehdZFUa.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\joSqMVS.exe
  C:\Windows\System\joSqMVS.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\XifhZai.exe
  C:\Windows\System\XifhZai.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\uzPpKip.exe
  C:\Windows\System\uzPpKip.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\okadYCh.exe
  C:\Windows\System\okadYCh.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\MUyGfmr.exe
  C:\Windows\System\MUyGfmr.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\LdgDUgA.exe
  C:\Windows\System\LdgDUgA.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\TzMWafv.exe
  C:\Windows\System\TzMWafv.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\FjBWaHM.exe
  C:\Windows\System\FjBWaHM.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\gafPEij.exe
  C:\Windows\System\gafPEij.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\hFzWHql.exe
  C:\Windows\System\hFzWHql.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\OMJTjvB.exe
  C:\Windows\System\OMJTjvB.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\CdyrQgX.exe
  C:\Windows\System\CdyrQgX.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\SRbpVus.exe
  C:\Windows\System\SRbpVus.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\OBJEBGl.exe
  C:\Windows\System\OBJEBGl.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\tPsGMze.exe
  C:\Windows\System\tPsGMze.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\tUozyKo.exe
  C:\Windows\System\tUozyKo.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\LJbvKWL.exe
  C:\Windows\System\LJbvKWL.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\vxJFVWS.exe
  C:\Windows\System\vxJFVWS.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\rSdEraf.exe
  C:\Windows\System\rSdEraf.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\axdZRSN.exe
  C:\Windows\System\axdZRSN.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\eCahkYm.exe
  C:\Windows\System\eCahkYm.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\TuhqzwA.exe
  C:\Windows\System\TuhqzwA.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\mdtpeXn.exe
  C:\Windows\System\mdtpeXn.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\VZgbGfn.exe
  C:\Windows\System\VZgbGfn.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\mCudAkO.exe
  C:\Windows\System\mCudAkO.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\xSpsQFb.exe
  C:\Windows\System\xSpsQFb.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\fKlBnYL.exe
  C:\Windows\System\fKlBnYL.exe
  2⤵
  PID:3012
- C:\Windows\System\pTbxIzM.exe
  C:\Windows\System\pTbxIzM.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\XgEgHNq.exe
  C:\Windows\System\XgEgHNq.exe
  2⤵
  PID:3040
- C:\Windows\System\mcrqEbh.exe
  C:\Windows\System\mcrqEbh.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\AWSEIRI.exe
  C:\Windows\System\AWSEIRI.exe
  2⤵
  PID:1748
- C:\Windows\System\CQTvWov.exe
  C:\Windows\System\CQTvWov.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\QSNwfXX.exe
  C:\Windows\System\QSNwfXX.exe
  2⤵
  PID:2668
- C:\Windows\System\hArprXf.exe
  C:\Windows\System\hArprXf.exe
  2⤵
  PID:2504
- C:\Windows\System\PeikaMm.exe
  C:\Windows\System\PeikaMm.exe
  2⤵
  PID:2312
- C:\Windows\System\ysHvhmy.exe
  C:\Windows\System\ysHvhmy.exe
  2⤵
  PID:2636
- C:\Windows\System\jcebUle.exe
  C:\Windows\System\jcebUle.exe
  2⤵
  PID:1732
- C:\Windows\System\rYIEHfB.exe
  C:\Windows\System\rYIEHfB.exe
  2⤵
  PID:908
- C:\Windows\System\iwoGoFB.exe
  C:\Windows\System\iwoGoFB.exe
  2⤵
  PID:540
- C:\Windows\System\edxnPGW.exe
  C:\Windows\System\edxnPGW.exe
  2⤵
  PID:800
- C:\Windows\System\aPmCFmK.exe
  C:\Windows\System\aPmCFmK.exe
  2⤵
  PID:2224
- C:\Windows\System\ALzpcPx.exe
  C:\Windows\System\ALzpcPx.exe
  2⤵
  PID:2524
- C:\Windows\System\BheHUES.exe
  C:\Windows\System\BheHUES.exe
  2⤵
  PID:1928
- C:\Windows\System\kFnilLi.exe
  C:\Windows\System\kFnilLi.exe
  2⤵
  PID:2648
- C:\Windows\System\nwaBwqS.exe
  C:\Windows\System\nwaBwqS.exe
  2⤵
  PID:2820
- C:\Windows\System\olusejT.exe
  C:\Windows\System\olusejT.exe
  2⤵
  PID:2748
- C:\Windows\System\mctiVmQ.exe
  C:\Windows\System\mctiVmQ.exe
  2⤵
  PID:2388
- C:\Windows\System\DsSFuSP.exe
  C:\Windows\System\DsSFuSP.exe
  2⤵
  PID:1940
- C:\Windows\System\PcwKcAx.exe
  C:\Windows\System\PcwKcAx.exe
  2⤵
  PID:1672
- C:\Windows\System\QOBKrxS.exe
  C:\Windows\System\QOBKrxS.exe
  2⤵
  PID:1044
- C:\Windows\System\OJBvFjr.exe
  C:\Windows\System\OJBvFjr.exe
  2⤵
  PID:240
- C:\Windows\System\speFeJo.exe
  C:\Windows\System\speFeJo.exe
  2⤵
  PID:2040
- C:\Windows\System\yVazXhX.exe
  C:\Windows\System\yVazXhX.exe
  2⤵
  PID:312
- C:\Windows\System\tcIysox.exe
  C:\Windows\System\tcIysox.exe
  2⤵
  PID:912
- C:\Windows\System\fLZeqhf.exe
  C:\Windows\System\fLZeqhf.exe
  2⤵
  PID:2128
- C:\Windows\System\hAPRJsr.exe
  C:\Windows\System\hAPRJsr.exe
  2⤵
  PID:2476
- C:\Windows\System\CksLjip.exe
  C:\Windows\System\CksLjip.exe
  2⤵
  PID:676
- C:\Windows\System\hWwtzUw.exe
  C:\Windows\System\hWwtzUw.exe
  2⤵
  PID:2916
- C:\Windows\System\KsVaMsB.exe
  C:\Windows\System\KsVaMsB.exe
  2⤵
  PID:1012
- C:\Windows\System\xDSVLle.exe
  C:\Windows\System\xDSVLle.exe
  2⤵
  PID:2576
- C:\Windows\System\wNYqtbH.exe
  C:\Windows\System\wNYqtbH.exe
  2⤵
  PID:628
- C:\Windows\System\GYmwTIk.exe
  C:\Windows\System\GYmwTIk.exe
  2⤵
  PID:1768
- C:\Windows\System\DuQDAHp.exe
  C:\Windows\System\DuQDAHp.exe
  2⤵
  PID:1312
- C:\Windows\System\tjkTkKf.exe
  C:\Windows\System\tjkTkKf.exe
  2⤵
  PID:1708
- C:\Windows\System\ZUnHncA.exe
  C:\Windows\System\ZUnHncA.exe
  2⤵
  PID:2056
- C:\Windows\System\qxZAuYT.exe
  C:\Windows\System\qxZAuYT.exe
  2⤵
  PID:2716
- C:\Windows\System\gRoxiJP.exe
  C:\Windows\System\gRoxiJP.exe
  2⤵
  PID:2360
- C:\Windows\System\zIyrpAe.exe
  C:\Windows\System\zIyrpAe.exe
  2⤵
  PID:1876
- C:\Windows\System\kJRmVLs.exe
  C:\Windows\System\kJRmVLs.exe
  2⤵
  PID:2996
- C:\Windows\System\MVxEgsa.exe
  C:\Windows\System\MVxEgsa.exe
  2⤵
  PID:2756
- C:\Windows\System\fdoIbhQ.exe
  C:\Windows\System\fdoIbhQ.exe
  2⤵
  PID:2424
- C:\Windows\System\jxcAnvL.exe
  C:\Windows\System\jxcAnvL.exe
  2⤵
  PID:2708
- C:\Windows\System\UmojFcz.exe
  C:\Windows\System\UmojFcz.exe
  2⤵
  PID:2608
- C:\Windows\System\eTqYSmd.exe
  C:\Windows\System\eTqYSmd.exe
  2⤵
  PID:2416
- C:\Windows\System\gcMqPAv.exe
  C:\Windows\System\gcMqPAv.exe
  2⤵
  PID:1680
- C:\Windows\System\EHSOoTn.exe
  C:\Windows\System\EHSOoTn.exe
  2⤵
  PID:2864
- C:\Windows\System\eLevowh.exe
  C:\Windows\System\eLevowh.exe
  2⤵
  PID:2804
- C:\Windows\System\kjkRluD.exe
  C:\Windows\System\kjkRluD.exe
  2⤵
  PID:1116
- C:\Windows\System\tdAlNAt.exe
  C:\Windows\System\tdAlNAt.exe
  2⤵
  PID:2152
- C:\Windows\System\XoaVkcx.exe
  C:\Windows\System\XoaVkcx.exe
  2⤵
  PID:1716
- C:\Windows\System\XtCeQfQ.exe
  C:\Windows\System\XtCeQfQ.exe
  2⤵
  PID:1868
- C:\Windows\System\fzKRPWn.exe
  C:\Windows\System\fzKRPWn.exe
  2⤵
  PID:848
- C:\Windows\System\SNikZth.exe
  C:\Windows\System\SNikZth.exe
  2⤵
  PID:1056
- C:\Windows\System\DWGglYk.exe
  C:\Windows\System\DWGglYk.exe
  2⤵
  PID:2196
- C:\Windows\System\PrduoLt.exe
  C:\Windows\System\PrduoLt.exe
  2⤵
  PID:2532
- C:\Windows\System\eVYHBhM.exe
  C:\Windows\System\eVYHBhM.exe
  2⤵
  PID:2304
- C:\Windows\System\onAKiEr.exe
  C:\Windows\System\onAKiEr.exe
  2⤵
  PID:852
- C:\Windows\System\yfAgyDf.exe
  C:\Windows\System\yfAgyDf.exe
  2⤵
  PID:1744
- C:\Windows\System\cgBFgIl.exe
  C:\Windows\System\cgBFgIl.exe
  2⤵
  PID:1624
- C:\Windows\System\czpZZuE.exe
  C:\Windows\System\czpZZuE.exe
  2⤵
  PID:2492
- C:\Windows\System\vZlJiKa.exe
  C:\Windows\System\vZlJiKa.exe
  2⤵
  PID:3008
- C:\Windows\System\RuQbOid.exe
  C:\Windows\System\RuQbOid.exe
  2⤵
  PID:2116
- C:\Windows\System\IEHjcQH.exe
  C:\Windows\System\IEHjcQH.exe
  2⤵
  PID:1720
- C:\Windows\System\KBDJXJW.exe
  C:\Windows\System\KBDJXJW.exe
  2⤵
  PID:1536
- C:\Windows\System\ellrZKW.exe
  C:\Windows\System\ellrZKW.exe
  2⤵
  PID:2860
- C:\Windows\System\KMGHmhQ.exe
  C:\Windows\System\KMGHmhQ.exe
  2⤵
  PID:2200
- C:\Windows\System\RLoafQV.exe
  C:\Windows\System\RLoafQV.exe
  2⤵
  PID:2068
- C:\Windows\System\vnSQcNu.exe
  C:\Windows\System\vnSQcNu.exe
  2⤵
  PID:2956
- C:\Windows\System\tYphXxr.exe
  C:\Windows\System\tYphXxr.exe
  2⤵
  PID:3044
- C:\Windows\System\abjcFvJ.exe
  C:\Windows\System\abjcFvJ.exe
  2⤵
  PID:2484
- C:\Windows\System\PaAlYMx.exe
  C:\Windows\System\PaAlYMx.exe
  2⤵
  PID:2788
- C:\Windows\System\WzusOKU.exe
  C:\Windows\System\WzusOKU.exe
  2⤵
  PID:2480
- C:\Windows\System\BlSgwjp.exe
  C:\Windows\System\BlSgwjp.exe
  2⤵
  PID:3052
- C:\Windows\System\bKJZAfG.exe
  C:\Windows\System\bKJZAfG.exe
  2⤵
  PID:2548
- C:\Windows\System\oRUddJD.exe
  C:\Windows\System\oRUddJD.exe
  2⤵
  PID:2096
- C:\Windows\System\mJBxJxy.exe
  C:\Windows\System\mJBxJxy.exe
  2⤵
  PID:1584
- C:\Windows\System\ltBtAhd.exe
  C:\Windows\System\ltBtAhd.exe
  2⤵
  PID:1508
- C:\Windows\System\KLyjOAO.exe
  C:\Windows\System\KLyjOAO.exe
  2⤵
  PID:564
- C:\Windows\System\OWGbjwF.exe
  C:\Windows\System\OWGbjwF.exe
  2⤵
  PID:1392
- C:\Windows\System\BjPqztw.exe
  C:\Windows\System\BjPqztw.exe
  2⤵
  PID:1360
- C:\Windows\System\WbhLzpD.exe
  C:\Windows\System\WbhLzpD.exe
  2⤵
  PID:1524
- C:\Windows\System\WaIYuGI.exe
  C:\Windows\System\WaIYuGI.exe
  2⤵
  PID:1208
- C:\Windows\System\iUdePTZ.exe
  C:\Windows\System\iUdePTZ.exe
  2⤵
  PID:1356
- C:\Windows\System\rfkKtph.exe
  C:\Windows\System\rfkKtph.exe
  2⤵
  PID:1592
- C:\Windows\System\MwFIcnI.exe
  C:\Windows\System\MwFIcnI.exe
  2⤵
  PID:2440
- C:\Windows\System\DhLSpnE.exe
  C:\Windows\System\DhLSpnE.exe
  2⤵
  PID:2972
- C:\Windows\System\AktbBHj.exe
  C:\Windows\System\AktbBHj.exe
  2⤵
  PID:2432
- C:\Windows\System\mRSOuEG.exe
  C:\Windows\System\mRSOuEG.exe
  2⤵
  PID:864
- C:\Windows\System\MNVyFWx.exe
  C:\Windows\System\MNVyFWx.exe
  2⤵
  PID:1364
- C:\Windows\System\pKFpNwN.exe
  C:\Windows\System\pKFpNwN.exe
  2⤵
  PID:2204
- C:\Windows\System\iZabmeZ.exe
  C:\Windows\System\iZabmeZ.exe
  2⤵
  PID:2604
- C:\Windows\System\lwzAekC.exe
  C:\Windows\System\lwzAekC.exe
  2⤵
  PID:2892
- C:\Windows\System\AeahCmu.exe
  C:\Windows\System\AeahCmu.exe
  2⤵
  PID:2176
- C:\Windows\System\cTtRhyD.exe
  C:\Windows\System\cTtRhyD.exe
  2⤵
  PID:2692
- C:\Windows\System\gSgVpyK.exe
  C:\Windows\System\gSgVpyK.exe
  2⤵
  PID:336
- C:\Windows\System\qhhsIkU.exe
  C:\Windows\System\qhhsIkU.exe
  2⤵
  PID:1396
- C:\Windows\System\CbKozLr.exe
  C:\Windows\System\CbKozLr.exe
  2⤵
  PID:1516
- C:\Windows\System\fsnIBxJ.exe
  C:\Windows\System\fsnIBxJ.exe
  2⤵
  PID:1028
- C:\Windows\System\lZkqffF.exe
  C:\Windows\System\lZkqffF.exe
  2⤵
  PID:2872
- C:\Windows\System\PTxAaHY.exe
  C:\Windows\System\PTxAaHY.exe
  2⤵
  PID:2628
- C:\Windows\System\NrFoUTL.exe
  C:\Windows\System\NrFoUTL.exe
  2⤵
  PID:1544
- C:\Windows\System\hpunoRK.exe
  C:\Windows\System\hpunoRK.exe
  2⤵
  PID:324
- C:\Windows\System\lZamqBz.exe
  C:\Windows\System\lZamqBz.exe
  2⤵
  PID:2728
- C:\Windows\System\BubPWkv.exe
  C:\Windows\System\BubPWkv.exe
  2⤵
  PID:1996
- C:\Windows\System\wSMevny.exe
  C:\Windows\System\wSMevny.exe
  2⤵
  PID:3076
- C:\Windows\System\DlRGUAZ.exe
  C:\Windows\System\DlRGUAZ.exe
  2⤵
  PID:3092
- C:\Windows\System\vwOhIHm.exe
  C:\Windows\System\vwOhIHm.exe
  2⤵
  PID:3108
- C:\Windows\System\lbcDhOy.exe
  C:\Windows\System\lbcDhOy.exe
  2⤵
  PID:3124
- C:\Windows\System\yCPbGlv.exe
  C:\Windows\System\yCPbGlv.exe
  2⤵
  PID:3140
- C:\Windows\System\aWPIqZa.exe
  C:\Windows\System\aWPIqZa.exe
  2⤵
  PID:3156
- C:\Windows\System\gxLmHXe.exe
  C:\Windows\System\gxLmHXe.exe
  2⤵
  PID:3176
- C:\Windows\System\IJTzLlr.exe
  C:\Windows\System\IJTzLlr.exe
  2⤵
  PID:3192
- C:\Windows\System\xOvYNqg.exe
  C:\Windows\System\xOvYNqg.exe
  2⤵
  PID:3208
- C:\Windows\System\osHuKkK.exe
  C:\Windows\System\osHuKkK.exe
  2⤵
  PID:3224
- C:\Windows\System\XeqrAEH.exe
  C:\Windows\System\XeqrAEH.exe
  2⤵
  PID:3244
- C:\Windows\System\coaqEKg.exe
  C:\Windows\System\coaqEKg.exe
  2⤵
  PID:3260
- C:\Windows\System\NZwGYCa.exe
  C:\Windows\System\NZwGYCa.exe
  2⤵
  PID:3276
- C:\Windows\System\Iunsiex.exe
  C:\Windows\System\Iunsiex.exe
  2⤵
  PID:3292
- C:\Windows\System\ubvwXwd.exe
  C:\Windows\System\ubvwXwd.exe
  2⤵
  PID:3308
- C:\Windows\System\ZYDjCRf.exe
  C:\Windows\System\ZYDjCRf.exe
  2⤵
  PID:3324
- C:\Windows\System\fhtjhCb.exe
  C:\Windows\System\fhtjhCb.exe
  2⤵
  PID:3340
- C:\Windows\System\YoyFuXo.exe
  C:\Windows\System\YoyFuXo.exe
  2⤵
  PID:3356
- C:\Windows\System\BAsEBnC.exe
  C:\Windows\System\BAsEBnC.exe
  2⤵
  PID:3372
- C:\Windows\System\knkmuVT.exe
  C:\Windows\System\knkmuVT.exe
  2⤵
  PID:3388
- C:\Windows\System\LuNqHXs.exe
  C:\Windows\System\LuNqHXs.exe
  2⤵
  PID:3404
- C:\Windows\System\rPZZJQg.exe
  C:\Windows\System\rPZZJQg.exe
  2⤵
  PID:3424
- C:\Windows\System\vsEbLUI.exe
  C:\Windows\System\vsEbLUI.exe
  2⤵
  PID:3448
- C:\Windows\System\OORNkCJ.exe
  C:\Windows\System\OORNkCJ.exe
  2⤵
  PID:3468
- C:\Windows\System\ikruVgh.exe
  C:\Windows\System\ikruVgh.exe
  2⤵
  PID:3492
- C:\Windows\System\wnjjyuD.exe
  C:\Windows\System\wnjjyuD.exe
  2⤵
  PID:3520
- C:\Windows\System\lkQyYRR.exe
  C:\Windows\System\lkQyYRR.exe
  2⤵
  PID:3544
- C:\Windows\System\KMHPAJi.exe
  C:\Windows\System\KMHPAJi.exe
  2⤵
  PID:3560
- C:\Windows\System\GzdlJgO.exe
  C:\Windows\System\GzdlJgO.exe
  2⤵
  PID:3576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CJnpXMH.exe

Filesize
1.0MB

MD5
2310c1bbd18c182d3abc81ff1a6abba6

SHA1
e46312112fe5b09a54ee619f0be56e89a284a472

SHA256
59080f6189bdcd78d6cabdf6e11b72e99b16e35b9374e31a827914da5c72f5f7

SHA512
4721528f7c11dd44e3d4b3a80e67570ccbd6de41385cbd87f45d0cf736b305586694ee2b67faa9ceb420661965a21e6165e23cc7f47a65933b61c658ef74fea8

Download Submit
C:\Windows\system\DoBCFyT.exe

Filesize
1.0MB

MD5
d3b4f12dd981e72694caa9d45f0ed7ed

SHA1
0bb238d8e209614a3615fbf33a5b9a2e0464460b

SHA256
c3fb86deac14b01781217440afa7dd8d3be471a96d0539599c474e6c84faca0b

SHA512
24c75be354b9be719a33db7c4bce4c6242304efce55d3bcf92d6aacdaf2ef94c2605591735609c37a27b6526e4e180eb2fc5e18805c333a55d72d1e565b546a9

Download Submit
C:\Windows\system\HcukLdg.exe

Filesize
1.0MB

MD5
be44a4b64e7518815a83b14258529b64

SHA1
6cf85d7b7a5071a90667ffb1984770543d463202

SHA256
00bfc42fa91a1fc669ed186ad0535f80702d67045e61c75f69026b26f5955b82

SHA512
1e46765c3d6d65552a47957324ea927ff6de7f4326f5e049fce7d0f9f8cb0be04f6fe6b38ce39151055a95850aa6a92b26638ab840657b7abc8fc393b12cf2e0

Download Submit
C:\Windows\system\InABrcO.exe

Filesize
1.0MB

MD5
ae73b790461819778c3f779a7eb846f8

SHA1
f2deae5ffb628e940e8f26d80ca54d521470a209

SHA256
1580229682e2f11fb39fccbcebdc68b7ac8a79488ebab9a87ad59e68984156f9

SHA512
09847a540fb8fa4ca987c1c9badec683e9ca43c5a695f56fb6912ea8f6f887b6f53d05c779c9ad7a0dd9f60fd139550ebefe061477d5f7746ae5671aeb653efa

Download Submit
C:\Windows\system\NmdCqOO.exe

Filesize
1.0MB

MD5
86b1e53330b2131f876e4236f925c2b5

SHA1
5c290b32d0fadb6cb17b8e72b8fcb0084d91f146

SHA256
9e469e9a1f2124fc14c567456130e07f6b6717e4a3a834b626dd233d1e1bee96

SHA512
a18acb28836091137f6cbb6be046fc2273d3341d96f06fda5b012a587ba3f2a39594fafb4c3d460daae89af9dbb7d22d3677281fab8ec1a6f914a7cbdfd2b893

Download Submit
C:\Windows\system\OuMRbwS.exe

Filesize
1.0MB

MD5
49e75a627cf2aa604bdab33036640a6e

SHA1
7d2726a369fd1c940b289202a5b8e5b2217b88a0

SHA256
9924eb5df11566244727914955c5b7fe9913afdbdf7efe7777001142a6047440

SHA512
b0ccf32ede7d1d4428179fed81e9eb768487ba44643fabfb822e57427d439f5e9d729e740c944d43d5821ab867c72071418301b670dd783fd32d8c3ced570e55

Download Submit
C:\Windows\system\PFlINNJ.exe

Filesize
1.0MB

MD5
01ac3d18545c556ceb95e301065ba8b9

SHA1
35406cce302778648681ed4bf26647c2c9ca93d0

SHA256
7e0c5ba583a9b1432c2bce91f220643ee05f55bf1f51a72dd051be127dc62ac1

SHA512
ba7a642f7f5b9154f03d1bd33175e0428e8af6f280273699a9555fe488c9f088a9aa65d6e8851647799afcecd2ad170f2a1ee92b843ee0dbdd4e631bdbd9d37f

Download Submit
C:\Windows\system\PmmMmdJ.exe

Filesize
1.0MB

MD5
0506bf29bcbc471ad586d0751635362f

SHA1
dce6a277ea7423b6bfa84e0a6dc6630d36cd8817

SHA256
55473020a16eb7dfe42a0ca395932974323fe780a27d65acc671d633a8d939d6

SHA512
21f6f6146ad003d5982aaf20b247bb0c723d7b94abf0bba02c7a8ea366c38782e3d0de5fb7c2357cbb84d93b591afd06fe0cea9e26e887f66ca16b7f2fbfcdae

Download Submit
C:\Windows\system\TePuaWE.exe

Filesize
1.0MB

MD5
ce6b48f1671c10b784cb7705af7ee041

SHA1
5c73701c1af3bf0fd94082dedd36e6f34324df43

SHA256
08f97fce3c1aaaace1f14b4a7f1ea36061e54b7df5273e9309563c58f377bfc5

SHA512
89d404180cf6d4fc3abe0d8d076a4cdd02fde1f30a83348256653978d694237dd564db1db9af658d6687e2679d7259f8931dfd6c180fb596d57a3b3f824fe23b

Download Submit
C:\Windows\system\UUgtyFq.exe

Filesize
1.0MB

MD5
4c6c49e8be3fa063d576ba313ca7b70e

SHA1
467831e6092463d0d04bae7c95906e40ce34c320

SHA256
61a2bb495c21ca68601c7ea269685fe5c0f99a8eedd2a0caa201cb2b70173884

SHA512
15784fba9472d019d4de880d914fd471f197f2246abacd5f0d71336f4582bba2a0a176f28ab8de31b217fa096386995a9127d20157a31e0c7023cc8f97b1823d

Download Submit
C:\Windows\system\XcqyOGw.exe

Filesize
1.0MB

MD5
7098d26a498eed9e34488c4d3bdbd03c

SHA1
721edeb0009c6da80fc16ab062e4ed0b7faa335b

SHA256
6c001f68c00ada4d809283e0560bf0e18a521976433f9103a4f433d9629cc452

SHA512
652531dcac22148109913c833d7a09424120f3060c2ce40db300725e310684db9832fb4c06363de029936d2b39c882c10eac490431bb87acb1192d60ff51f6c7

Download Submit
C:\Windows\system\XuuMouI.exe

Filesize
1.0MB

MD5
055f97fff1fc49f7daf219707346fc3b

SHA1
66811ecc6e939de023660da4b76b12b3c3f9d8f9

SHA256
18b0c37eda308c88879c1122127aabd3a9c29ed63888bb2c7b0c36ec82f98cf9

SHA512
0e59b47d213843aff16ec175966f5f4529b4559439b32d7909db935b235e180ec7eb6423575f42b8d3181e7102511ffc4e467d439f987f7051c4bdad8bd65b25

Download Submit
C:\Windows\system\YtlhKbC.exe

Filesize
1.0MB

MD5
5b89e44b634b61ee45098172a6f8b4bf

SHA1
6c125bdffd80d49c083b7630b3fd7200e10bfb3e

SHA256
93e683dbbbe4bbe664fccadfc474bc08cba8b7fb2834cbcff1180077dd1ed3d9

SHA512
0436ddfe63ccf93a9f53b47663ba058460d1ef9ba4a231bbab35dc1f7e14af50329e3c48c0df00efa662611bd22753bc805d694e8bfe2bc7daee34a56cffe3b4

Download Submit
C:\Windows\system\ZeLNaKn.exe

Filesize
1.0MB

MD5
4d4b0d2ee701c10cf003aee74b6aa94a

SHA1
35cc9567f4d6d5312c36304020f9d5d9cc4d0522

SHA256
399e1c52dcb6adf581d55f906619e23f2ba76e163033973e02f9aa9c1ee99468

SHA512
1032fa147211af681c8ccf1c44365448174e67c20a83512d7c3f19abee10503627a250d94687454e0b9d1512a6018d62d6a852217197520cf3d17b3799da4dd8

Download Submit
C:\Windows\system\ZqoLQxc.exe

Filesize
1.0MB

MD5
21c094e15c5bbf30ca527c1ff740d550

SHA1
b6b8c1085b32f47ab34516f9621fc6f46f516f4e

SHA256
6f167a503437d0dde2b0ad710138ff04a5704ff7b6150ead9f5f76c35768ed29

SHA512
7dfc00a9cfb46ab411079c4eefe2deec3892c4f9439e4e67bf993d6fdbfcf1ea5ee5ee5b4a9071210c3945d94546e2a2c0954bf0fd88692b35a0e31513cc1fe4

Download Submit
C:\Windows\system\cPnTaCR.exe

Filesize
1.0MB

MD5
e915fab164ffa5cfc517beb5808d07cf

SHA1
a5d687a41b78b3e8e880c3cf40b038016df1f35c

SHA256
14815a55768f4047b446d2ba2ba8c926b6dd880f56218d30573fb241ced088e0

SHA512
c74f0044a7649505e174e20c0ad3475e8e855dd5005e7f818edf006580d7bf887e174004652e9c90d52ce984312c3907170f7428c70cfa3c66d74c62487a583e

Download Submit
C:\Windows\system\eSerBMd.exe

Filesize
1.0MB

MD5
a5c26993715504c2baa6fae1d7124047

SHA1
662b4842e9064b4970cecd961df1e5240814bf82

SHA256
8f2db1569bdcdea138e0df775940fcb0c24505bf52034cf9a0404e3d01c83b4a

SHA512
2bd5776697c9cc5f24d0b66bc39b28e6508cb9b1ecc473734ed8782a7f86b4f2f955e268269a079f8e07afd6ba6bae5ade2f64cf84c09b2033e59b00fd735a24

Download Submit
C:\Windows\system\eoIPqjA.exe

Filesize
1.0MB

MD5
62cc31691cc10d2ae7b98399cbe0f09e

SHA1
0123b87bcd1ef37802bee6777db35c104ab25120

SHA256
50bee90ad7c38fe36db529fd8a5a132137c8bc2eb4640d0948a90cafd78fb485

SHA512
4c498d5f6720aab24b57dad83f60eee67b500e6e499a7cb103bb694c8c3680b7f33873d2d9d007ee9540c4e9e45e97d93ba520296847f79991f35b3414449446

Download Submit
C:\Windows\system\gQjlUKR.exe

Filesize
1.0MB

MD5
2a02d2ca7cfbc543ff193c47e9cb3f5d

SHA1
59bdfd0702a61e30e29649b769e1cd1f7941d0b2

SHA256
8c408fd9e96084cf1bf6a6cdd6227168151cb92f1acc56c31bba7cd7b5be990a

SHA512
8e8b930aa22f55e0eb04cd41a347bc32248db6921e6c790ad698740eeda7c0e8b285feb4a6e4e27fe6968a25aa9827fba886bc610f5c46347c008e8c3e49d293

Download Submit
C:\Windows\system\isynJwI.exe

Filesize
1.0MB

MD5
c3b5a39f24df671b9cf97f682ee97bc4

SHA1
2733e759716c863b3e5304b791724bbb47f4ce35

SHA256
5fbb0b56cc62d87d09de3e89f8a014548161d71a5fdc2aef918056354d9e3a51

SHA512
558613743848fa9bd9ce876825654871d63975434fbf416cf3203a42873c2c34e7b0047eee016a5f0163ad86f9a5daad318a139b384d8a86ce28316a930f3d7e

Download Submit
C:\Windows\system\jzENBvm.exe

Filesize
1.0MB

MD5
d32650e3280a9b1edf3a0ac29cb2213a

SHA1
f255242dc8d7bc9dceaacd72fc1646b07e1eb5cc

SHA256
867d3d3d0584cf01fcf910fe4c444117f63bbc84baa8ec4092ffce3aee58d0a3

SHA512
5557657902c6c952f524a30660f949536c8c472b2a682d07b88e87e16260d78b170f9d354d5e1cee65f92044748bdc2a89d62c4fff1663bcf76779c73cb67ab3

Download Submit
C:\Windows\system\khGdqRF.exe

Filesize
1.0MB

MD5
cde7d2f78db65f63167a2b294afc5f9b

SHA1
157edeb08144291f9c2db3a29d4c78ace59337f7

SHA256
e18d79ee221f9b16ad1eaed476b5f851e4ee3716ac8c1c9e4e0864f9b7091c5d

SHA512
782fe2a58c505da4046e7cfc09e0545743827c8c385cf1116f3643e7f2f975defdab3785060aa409e185c1b53fd5dbe9540fce5bd4537e32157f9c242ddca575

Download Submit
C:\Windows\system\kjPfYtT.exe

Filesize
1.0MB

MD5
8b5f5171286791ea3afd2e7ed53ecb93

SHA1
0459584bcf2cf87ab347d7c53d01d2b6aa00ba20

SHA256
83e000d241104815034939e1d339ca0299e0684ba9169d82ca25f3fb6bd8e4ab

SHA512
22c7eff959bde8f0830124fa1a7c17776a6ab10a670283519c88e244dbecadb621cf6045be0106a953027a1e50a4d9921e07aacc048cbb284187bc37a95ccaed

Download Submit
C:\Windows\system\njXwnud.exe

Filesize
1.0MB

MD5
9545134ac6ba93e76b8a7bb80314bf5d

SHA1
b8be219b0e57534eb6c8ca9a42ac2aa83d5aeafb

SHA256
17ee59e316572f6a04feb2a60815b14a48714f05ed35cc421df03ec7c105327b

SHA512
43840adfefb6837c897a1d24016d685439bade4096f70baadba66069494a99d3caeabeba6139dbf5ff7bc697a017cbf5032129dd55867c3ccee3fbb93608a0cf

Download Submit
C:\Windows\system\urFIxlZ.exe

Filesize
1.0MB

MD5
ce52e3a89f53680d2437b6ec8f5daa1f

SHA1
ead851fd8782606fb84ea378846987e4ff87d93c

SHA256
759c7c77b56d409d67c7327810ba5dad85a8e8b66c4d55c4dc8da4b337406c1a

SHA512
aca0b78f83804755c58c639a2d820c28408e818af12726522406045ff35dbc687876ce04988c4fab2673f722c2fd54a7938482d8e6319378f304a327a53d283d

Download Submit
C:\Windows\system\wDxkBHK.exe

Filesize
1.0MB

MD5
39d9af4f754e9068edcb0dbdae088434

SHA1
455074fbb2f19adc6ab2ff226d0409db945dd5f2

SHA256
86931a889a16c68e5aa471513a6a822203b78488947a69ded92ab40417dfe1b8

SHA512
2221926bf80f028b030f707364e9b6ae38a69b299c189716bcebdd659c2bebfc3e18d77e59e0bffc8b790694eb0b4649b7df0d69d0ab81e689657a122eff9e0a

Download Submit
C:\Windows\system\wLqCESz.exe

Filesize
1.0MB

MD5
c00a19ccf53b97a2421393b585a722df

SHA1
d556af7fdd841f9b0903beea86a30dc5eb9f5331

SHA256
705b23bb3670eee638b7811f39a41a74902354e790c6d6caeaebb12e1637250f

SHA512
a5e2147895c858d2516399f277ce13e0e3ed760950bfedf69a4df7b71ea694c8ea77c8b7d6aea1e2111cf647561dfa3e39735b0f256c31a0b816571013aa87e0

Download Submit
C:\Windows\system\xRDomro.exe

Filesize
1.0MB

MD5
e3d4a2ee7def6fd63890debec54f56cf

SHA1
1d861fbd94e0247f2af9a0782113485bb022e35a

SHA256
114dddb7f7cf621971fe45c517d1d818661a4c429dbed66214862a42bd2d1508

SHA512
aa979e1ad9f845b3170126f9f4ea4303930e28865458a064f4195ab5202949b76f55b5516b8493d931f157287c4ab154944237968d84d46f7df603f16bd79ecc

Download Submit
C:\Windows\system\zrNRqwJ.exe

Filesize
1.0MB

MD5
662da8622e9621ea5663be4c2e9f1e59

SHA1
5178410857362e2c73cef7a13148d67029414eac

SHA256
3aabb8d93f8dc56a1dc5e3bff4e8254b0c50aeec39807e20ef072c9e5b5261ab

SHA512
3fb751be3d21ff3e38d33ce4cc3c813730e90c0d7112fe17f2e09a2700fe654f522ad854d6ffa58905ef8d6108a8aa29a544a9138cf49f786d7e79b5f7c97b8c

Download Submit
\Windows\system\eNjOSUL.exe

Filesize
1.0MB

MD5
eb2944e8c83833be5629798eb948f76d

SHA1
a42b7d09e2276a28d6f5aaee91fa868f24e38816

SHA256
2909da7114d9457d1e2c95b1c4c64b3b8342137c483c783dab93c271231f6249

SHA512
8f600b6fde628bafe67541bf1d66413ab7cfc458b958bc477001295f22203465a7758792333e16c04877d3be1b62df561fb2fe6578cf8c29a572742a26870898

Download Submit
\Windows\system\rJeRHdi.exe

Filesize
1.0MB

MD5
9de966c2f273cec4601ed1bba4178e63

SHA1
aa279ac26f00e6395c1522d6b045b243dfac5b5c

SHA256
f186285240e5fc6af3c729dfc3cc61ea89b3e49edf80ed687607ac66b6e47d67

SHA512
bb0b6fd57f171c3e36a20df0ff053d42bd2a266824ec3a04b89c15c67f20d6e40e3c6321df0dce230d1d14ac38de3b337a4c7af6600b1bba10095240fc5b5d44

Download Submit
\Windows\system\vgukuZy.exe

Filesize
1.0MB

MD5
452bcdb14c6abb37ded501b283294372

SHA1
1b7be2892efe09619e549c5e18cc9516b573466a

SHA256
8c76f8d30936316c057e05bd64e5bb4832ce27b009946689ba9e6f5da3d73f4a

SHA512
02f903293a22fa653542d1387e77a8391ccb1400e5be614d7c3a8015352bda372800062dd9dc55a02afb782b22101ceb3a2926b81f40ac090bf0130a4477f705

Download Submit
memory/2064-0-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download