kpot | 394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
02-07-2024 20:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
Size

2.1MB
MD5

d5bf9af4126b01ea503427954f779b0e
SHA1

0704420be55a04a14a84eaa1ba0c0ea616293623
SHA256

394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37
SHA512

66c9297a62799e59ed014cef57c28a0f42f7087116c405acbfec90c2839292ae24750ce1ddf05a8269ab1dea4ff3a19d258a62252d03d1e37bbbf9fa5bddf41c
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9oztFwIi5aIwC+Agr6S/FYqOc2odW:GemTLkNdfE0pZaQX

Score

10^/10

kpot xmrig miner stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 32 IoCs

resource	yara_rule
behavioral2/files/0x000a00000002341d-4.dat	family_kpot
behavioral2/files/0x0007000000023426-8.dat	family_kpot
behavioral2/files/0x0007000000023427-9.dat	family_kpot
behavioral2/files/0x0007000000023428-18.dat	family_kpot
behavioral2/files/0x0007000000023429-23.dat	family_kpot
behavioral2/files/0x000700000002342a-30.dat	family_kpot
behavioral2/files/0x000700000002342b-34.dat	family_kpot
behavioral2/files/0x000700000002342c-39.dat	family_kpot
behavioral2/files/0x000200000002293d-45.dat	family_kpot
behavioral2/files/0x0006000000022937-50.dat	family_kpot
behavioral2/files/0x000700000002342d-58.dat	family_kpot
behavioral2/files/0x0008000000023423-57.dat	family_kpot
behavioral2/files/0x000700000002342e-65.dat	family_kpot
behavioral2/files/0x000900000001e6f2-70.dat	family_kpot
behavioral2/files/0x000600000001e830-75.dat	family_kpot
behavioral2/files/0x000800000001e6e8-78.dat	family_kpot
behavioral2/files/0x0015000000016298-84.dat	family_kpot
behavioral2/files/0x000700000002342f-88.dat	family_kpot
behavioral2/files/0x0007000000023430-94.dat	family_kpot
behavioral2/files/0x0007000000023432-104.dat	family_kpot
behavioral2/files/0x0007000000023433-108.dat	family_kpot
behavioral2/files/0x0007000000023431-100.dat	family_kpot
behavioral2/files/0x0007000000023434-113.dat	family_kpot
behavioral2/files/0x0007000000023435-120.dat	family_kpot
behavioral2/files/0x0007000000023436-125.dat	family_kpot
behavioral2/files/0x0007000000023437-128.dat	family_kpot
behavioral2/files/0x0007000000023438-135.dat	family_kpot
behavioral2/files/0x0007000000023439-139.dat	family_kpot
behavioral2/files/0x000700000002343a-144.dat	family_kpot
behavioral2/files/0x000700000002343b-148.dat	family_kpot
behavioral2/files/0x000700000002343c-154.dat	family_kpot
behavioral2/files/0x000700000002343d-160.dat	family_kpot

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a00000002341d-4.dat	xmrig
behavioral2/files/0x0007000000023426-8.dat	xmrig
behavioral2/files/0x0007000000023427-9.dat	xmrig
behavioral2/files/0x0007000000023428-18.dat	xmrig
behavioral2/files/0x0007000000023429-23.dat	xmrig
behavioral2/files/0x000700000002342a-30.dat	xmrig
behavioral2/files/0x000700000002342b-34.dat	xmrig
behavioral2/files/0x000700000002342c-39.dat	xmrig
behavioral2/files/0x000200000002293d-45.dat	xmrig
behavioral2/files/0x0006000000022937-50.dat	xmrig
behavioral2/files/0x000700000002342d-58.dat	xmrig
behavioral2/files/0x0008000000023423-57.dat	xmrig
behavioral2/files/0x000700000002342e-65.dat	xmrig
behavioral2/files/0x000900000001e6f2-70.dat	xmrig
behavioral2/files/0x000600000001e830-75.dat	xmrig
behavioral2/files/0x000800000001e6e8-78.dat	xmrig
behavioral2/files/0x0015000000016298-84.dat	xmrig
behavioral2/files/0x000700000002342f-88.dat	xmrig
behavioral2/files/0x0007000000023430-94.dat	xmrig
behavioral2/files/0x0007000000023432-104.dat	xmrig
behavioral2/files/0x0007000000023433-108.dat	xmrig
behavioral2/files/0x0007000000023431-100.dat	xmrig
behavioral2/files/0x0007000000023434-113.dat	xmrig
behavioral2/files/0x0007000000023435-120.dat	xmrig
behavioral2/files/0x0007000000023436-125.dat	xmrig
behavioral2/files/0x0007000000023437-128.dat	xmrig
behavioral2/files/0x0007000000023438-135.dat	xmrig
behavioral2/files/0x0007000000023439-139.dat	xmrig
behavioral2/files/0x000700000002343a-144.dat	xmrig
behavioral2/files/0x000700000002343b-148.dat	xmrig
behavioral2/files/0x000700000002343c-154.dat	xmrig
behavioral2/files/0x000700000002343d-160.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1900	ewANIVR.exe
388	tcqikwd.exe
1836	tvwlQhr.exe
2252	XRLSiad.exe
2308	XSSJDnL.exe
2168	ejYRune.exe
792	RarkfUM.exe
2916	HFsuehG.exe
4012	yOqPeik.exe
3824	rDTBQgq.exe
5108	bMaWwsE.exe
5016	plosfjc.exe
1920	gDARTsl.exe
1888	NvbrIVL.exe
1912	rcUhJsQ.exe
3520	MMEzLvi.exe
652	qLFNFLw.exe
2468	VQQWxCp.exe
4692	JoouULY.exe
4716	OSQgxWU.exe
1716	ClnIcdw.exe
4948	dLXAQQe.exe
1648	ZArRFYM.exe
4556	AuFfLGU.exe
4160	EAxKAyi.exe
3372	vRYYOdE.exe
3348	qfhntMw.exe
3784	jLQcsdy.exe
4116	rMATlPu.exe
2836	rHjncoZ.exe
2840	iUpNYGC.exe
1980	VZYohWY.exe
1540	hfiylmz.exe
4432	TOTBylI.exe
1464	SWYROuz.exe
4676	roragCD.exe
4912	kpvmeAP.exe
4464	ZQdGTKt.exe
4620	vJqCPIW.exe
3896	FtRTZxn.exe
4072	HliyHby.exe
3980	thftmCG.exe
3736	NcQDDUD.exe
4420	ZeLhphh.exe
4680	EYWMZky.exe
4496	mWkUdNt.exe
2196	mGCfcrM.exe
1904	psgyjDo.exe
4584	quEPOvv.exe
760	zNSZrMO.exe
3164	rXmnHQj.exe
4884	xTMaTKt.exe
2016	jiJDvKq.exe
4768	RlgddSn.exe
4708	cfnOVTU.exe
5004	HmbsWMI.exe
1548	BRnJPrY.exe
436	rUoshhw.exe
4608	iYfVdig.exe
4040	nammlHa.exe
4416	fFHevhq.exe
3412	BWNuRfa.exe
3724	ljjSaET.exe
1652	xRhwgdz.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NSptvnP.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\ojErRfE.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\GIoQUSt.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\PqVUIgC.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\WgFzGyh.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\tlKZjTI.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\aSFhEbt.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\TIFbYBQ.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\bzrBufX.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\DVYkJFM.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\rCxTtqO.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\IbtHIxa.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\NfXSzUi.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\XOZrAdF.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\mpuAfwN.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\HMbUpWm.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\OQlbqjA.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\ggkIYBO.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\ToVxqGU.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\ozbYPXo.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\CzaqRKI.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\psWlHtq.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\dLXAQQe.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\clVHdwe.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\LyViFkr.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\LGrCSRB.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\xWQypFt.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\SAUkGea.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\UNfsYVC.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\VQQWxCp.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\TMHWTmN.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\xSjujXM.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\EHEnDNE.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\ClnIcdw.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\EqlKsDi.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\oFePTaU.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\dZfuJxu.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\FoOVfjP.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\KKSjFWC.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\HFsuehG.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\FtRTZxn.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\EPUiRfB.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\kBHFeXf.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\TYHaUjO.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\suDiTak.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\tvYfuhz.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\nXHUmLF.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\jiJDvKq.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\glbGNpp.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\MOTxEUx.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\tIDuikf.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\SKRXDsA.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\fJPvvgl.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\WWIroco.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\UTLOAwM.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\roragCD.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\HliyHby.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\SnwBAqu.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\Mugzeyx.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\zVbUbet.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\zItXBiF.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\SfYWkCY.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\LqliGGr.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
File created	C:\Windows\System\AbHfHdM.exe	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
Token: SeLockMemoryPrivilege	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 1900	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	84
PID 2664 wrote to memory of 1900	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	84
PID 2664 wrote to memory of 388	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	85
PID 2664 wrote to memory of 388	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	85
PID 2664 wrote to memory of 1836	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	86
PID 2664 wrote to memory of 1836	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	86
PID 2664 wrote to memory of 2252	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	87
PID 2664 wrote to memory of 2252	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	87
PID 2664 wrote to memory of 2308	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	90
PID 2664 wrote to memory of 2308	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	90
PID 2664 wrote to memory of 2168	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	92
PID 2664 wrote to memory of 2168	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	92
PID 2664 wrote to memory of 792	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	93
PID 2664 wrote to memory of 792	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	93
PID 2664 wrote to memory of 2916	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	94
PID 2664 wrote to memory of 2916	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	94
PID 2664 wrote to memory of 4012	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	95
PID 2664 wrote to memory of 4012	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	95
PID 2664 wrote to memory of 3824	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	96
PID 2664 wrote to memory of 3824	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	96
PID 2664 wrote to memory of 5108	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	97
PID 2664 wrote to memory of 5108	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	97
PID 2664 wrote to memory of 5016	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	98
PID 2664 wrote to memory of 5016	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	98
PID 2664 wrote to memory of 1920	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	99
PID 2664 wrote to memory of 1920	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	99
PID 2664 wrote to memory of 1888	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	100
PID 2664 wrote to memory of 1888	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	100
PID 2664 wrote to memory of 1912	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	101
PID 2664 wrote to memory of 1912	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	101
PID 2664 wrote to memory of 3520	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	102
PID 2664 wrote to memory of 3520	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	102
PID 2664 wrote to memory of 652	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	103
PID 2664 wrote to memory of 652	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	103
PID 2664 wrote to memory of 2468	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	104
PID 2664 wrote to memory of 2468	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	104
PID 2664 wrote to memory of 4692	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	105
PID 2664 wrote to memory of 4692	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	105
PID 2664 wrote to memory of 4716	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	106
PID 2664 wrote to memory of 4716	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	106
PID 2664 wrote to memory of 1716	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	107
PID 2664 wrote to memory of 1716	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	107
PID 2664 wrote to memory of 4948	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	108
PID 2664 wrote to memory of 4948	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	108
PID 2664 wrote to memory of 1648	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	109
PID 2664 wrote to memory of 1648	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	109
PID 2664 wrote to memory of 4556	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	110
PID 2664 wrote to memory of 4556	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	110
PID 2664 wrote to memory of 4160	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	111
PID 2664 wrote to memory of 4160	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	111
PID 2664 wrote to memory of 3372	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	112
PID 2664 wrote to memory of 3372	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	112
PID 2664 wrote to memory of 3348	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	113
PID 2664 wrote to memory of 3348	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	113
PID 2664 wrote to memory of 3784	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	114
PID 2664 wrote to memory of 3784	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	114
PID 2664 wrote to memory of 4116	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	115
PID 2664 wrote to memory of 4116	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	115
PID 2664 wrote to memory of 2836	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	116
PID 2664 wrote to memory of 2836	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	116
PID 2664 wrote to memory of 2840	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	117
PID 2664 wrote to memory of 2840	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	117
PID 2664 wrote to memory of 1980	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	118
PID 2664 wrote to memory of 1980	2664	394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe	118

C:\Users\Admin\AppData\Local\Temp\394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe
"C:\Users\Admin\AppData\Local\Temp\394eb55a9ea2f568a9e992ec2465e6bb5bc6fcc5c8500a2cb335462da750fa37.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\System\ewANIVR.exe
  C:\Windows\System\ewANIVR.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\tcqikwd.exe
  C:\Windows\System\tcqikwd.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\tvwlQhr.exe
  C:\Windows\System\tvwlQhr.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\XRLSiad.exe
  C:\Windows\System\XRLSiad.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\XSSJDnL.exe
  C:\Windows\System\XSSJDnL.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\ejYRune.exe
  C:\Windows\System\ejYRune.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\RarkfUM.exe
  C:\Windows\System\RarkfUM.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\HFsuehG.exe
  C:\Windows\System\HFsuehG.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\yOqPeik.exe
  C:\Windows\System\yOqPeik.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\rDTBQgq.exe
  C:\Windows\System\rDTBQgq.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\bMaWwsE.exe
  C:\Windows\System\bMaWwsE.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\plosfjc.exe
  C:\Windows\System\plosfjc.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\gDARTsl.exe
  C:\Windows\System\gDARTsl.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\NvbrIVL.exe
  C:\Windows\System\NvbrIVL.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\rcUhJsQ.exe
  C:\Windows\System\rcUhJsQ.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\MMEzLvi.exe
  C:\Windows\System\MMEzLvi.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\qLFNFLw.exe
  C:\Windows\System\qLFNFLw.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\VQQWxCp.exe
  C:\Windows\System\VQQWxCp.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\JoouULY.exe
  C:\Windows\System\JoouULY.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\OSQgxWU.exe
  C:\Windows\System\OSQgxWU.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\ClnIcdw.exe
  C:\Windows\System\ClnIcdw.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\dLXAQQe.exe
  C:\Windows\System\dLXAQQe.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\ZArRFYM.exe
  C:\Windows\System\ZArRFYM.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\AuFfLGU.exe
  C:\Windows\System\AuFfLGU.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\EAxKAyi.exe
  C:\Windows\System\EAxKAyi.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\vRYYOdE.exe
  C:\Windows\System\vRYYOdE.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\qfhntMw.exe
  C:\Windows\System\qfhntMw.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\jLQcsdy.exe
  C:\Windows\System\jLQcsdy.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\rMATlPu.exe
  C:\Windows\System\rMATlPu.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\rHjncoZ.exe
  C:\Windows\System\rHjncoZ.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\iUpNYGC.exe
  C:\Windows\System\iUpNYGC.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\VZYohWY.exe
  C:\Windows\System\VZYohWY.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\hfiylmz.exe
  C:\Windows\System\hfiylmz.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\TOTBylI.exe
  C:\Windows\System\TOTBylI.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\SWYROuz.exe
  C:\Windows\System\SWYROuz.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\roragCD.exe
  C:\Windows\System\roragCD.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\kpvmeAP.exe
  C:\Windows\System\kpvmeAP.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\ZQdGTKt.exe
  C:\Windows\System\ZQdGTKt.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\vJqCPIW.exe
  C:\Windows\System\vJqCPIW.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\FtRTZxn.exe
  C:\Windows\System\FtRTZxn.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\HliyHby.exe
  C:\Windows\System\HliyHby.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\thftmCG.exe
  C:\Windows\System\thftmCG.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\NcQDDUD.exe
  C:\Windows\System\NcQDDUD.exe
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Windows\System\ZeLhphh.exe
  C:\Windows\System\ZeLhphh.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\EYWMZky.exe
  C:\Windows\System\EYWMZky.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\mWkUdNt.exe
  C:\Windows\System\mWkUdNt.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\mGCfcrM.exe
  C:\Windows\System\mGCfcrM.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\psgyjDo.exe
  C:\Windows\System\psgyjDo.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\quEPOvv.exe
  C:\Windows\System\quEPOvv.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\zNSZrMO.exe
  C:\Windows\System\zNSZrMO.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\rXmnHQj.exe
  C:\Windows\System\rXmnHQj.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\xTMaTKt.exe
  C:\Windows\System\xTMaTKt.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\jiJDvKq.exe
  C:\Windows\System\jiJDvKq.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\RlgddSn.exe
  C:\Windows\System\RlgddSn.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\cfnOVTU.exe
  C:\Windows\System\cfnOVTU.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\HmbsWMI.exe
  C:\Windows\System\HmbsWMI.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\BRnJPrY.exe
  C:\Windows\System\BRnJPrY.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\rUoshhw.exe
  C:\Windows\System\rUoshhw.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\iYfVdig.exe
  C:\Windows\System\iYfVdig.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\nammlHa.exe
  C:\Windows\System\nammlHa.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\fFHevhq.exe
  C:\Windows\System\fFHevhq.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\BWNuRfa.exe
  C:\Windows\System\BWNuRfa.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\ljjSaET.exe
  C:\Windows\System\ljjSaET.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\xRhwgdz.exe
  C:\Windows\System\xRhwgdz.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\mpuAfwN.exe
  C:\Windows\System\mpuAfwN.exe
  2⤵
  PID:1800
- C:\Windows\System\pwLFsVt.exe
  C:\Windows\System\pwLFsVt.exe
  2⤵
  PID:1428
- C:\Windows\System\glbGNpp.exe
  C:\Windows\System\glbGNpp.exe
  2⤵
  PID:4964
- C:\Windows\System\zVbUbet.exe
  C:\Windows\System\zVbUbet.exe
  2⤵
  PID:1144
- C:\Windows\System\ajnoAwk.exe
  C:\Windows\System\ajnoAwk.exe
  2⤵
  PID:4488
- C:\Windows\System\rgrBahk.exe
  C:\Windows\System\rgrBahk.exe
  2⤵
  PID:4540
- C:\Windows\System\PqVUIgC.exe
  C:\Windows\System\PqVUIgC.exe
  2⤵
  PID:1276
- C:\Windows\System\MDzeWcB.exe
  C:\Windows\System\MDzeWcB.exe
  2⤵
  PID:2464
- C:\Windows\System\oyfaSuc.exe
  C:\Windows\System\oyfaSuc.exe
  2⤵
  PID:4424
- C:\Windows\System\AFwEsNA.exe
  C:\Windows\System\AFwEsNA.exe
  2⤵
  PID:2444
- C:\Windows\System\CUxxcof.exe
  C:\Windows\System\CUxxcof.exe
  2⤵
  PID:2784
- C:\Windows\System\DpuDwuv.exe
  C:\Windows\System\DpuDwuv.exe
  2⤵
  PID:692
- C:\Windows\System\ayDFftO.exe
  C:\Windows\System\ayDFftO.exe
  2⤵
  PID:900
- C:\Windows\System\rGQSgzw.exe
  C:\Windows\System\rGQSgzw.exe
  2⤵
  PID:3628
- C:\Windows\System\hqHXZwJ.exe
  C:\Windows\System\hqHXZwJ.exe
  2⤵
  PID:4276
- C:\Windows\System\TIFbYBQ.exe
  C:\Windows\System\TIFbYBQ.exe
  2⤵
  PID:4180
- C:\Windows\System\WgFzGyh.exe
  C:\Windows\System\WgFzGyh.exe
  2⤵
  PID:3384
- C:\Windows\System\kemPKgQ.exe
  C:\Windows\System\kemPKgQ.exe
  2⤵
  PID:4364
- C:\Windows\System\dxOjQHD.exe
  C:\Windows\System\dxOjQHD.exe
  2⤵
  PID:4108
- C:\Windows\System\dZfuJxu.exe
  C:\Windows\System\dZfuJxu.exe
  2⤵
  PID:2340
- C:\Windows\System\bzrBufX.exe
  C:\Windows\System\bzrBufX.exe
  2⤵
  PID:4292
- C:\Windows\System\uNFtaft.exe
  C:\Windows\System\uNFtaft.exe
  2⤵
  PID:916
- C:\Windows\System\HrNoovg.exe
  C:\Windows\System\HrNoovg.exe
  2⤵
  PID:1700
- C:\Windows\System\EqlKsDi.exe
  C:\Windows\System\EqlKsDi.exe
  2⤵
  PID:1528
- C:\Windows\System\LJGkfYA.exe
  C:\Windows\System\LJGkfYA.exe
  2⤵
  PID:2764
- C:\Windows\System\MOTxEUx.exe
  C:\Windows\System\MOTxEUx.exe
  2⤵
  PID:1992
- C:\Windows\System\NSptvnP.exe
  C:\Windows\System\NSptvnP.exe
  2⤵
  PID:944
- C:\Windows\System\etxmAKf.exe
  C:\Windows\System\etxmAKf.exe
  2⤵
  PID:5144
- C:\Windows\System\jsUBTiJ.exe
  C:\Windows\System\jsUBTiJ.exe
  2⤵
  PID:5172
- C:\Windows\System\hYXpXBQ.exe
  C:\Windows\System\hYXpXBQ.exe
  2⤵
  PID:5200
- C:\Windows\System\zGywGnf.exe
  C:\Windows\System\zGywGnf.exe
  2⤵
  PID:5228
- C:\Windows\System\FcZpFwD.exe
  C:\Windows\System\FcZpFwD.exe
  2⤵
  PID:5256
- C:\Windows\System\rrHHaxz.exe
  C:\Windows\System\rrHHaxz.exe
  2⤵
  PID:5284
- C:\Windows\System\WPvCyvk.exe
  C:\Windows\System\WPvCyvk.exe
  2⤵
  PID:5312
- C:\Windows\System\kYeFnLR.exe
  C:\Windows\System\kYeFnLR.exe
  2⤵
  PID:5340
- C:\Windows\System\ivJrrLq.exe
  C:\Windows\System\ivJrrLq.exe
  2⤵
  PID:5372
- C:\Windows\System\clVHdwe.exe
  C:\Windows\System\clVHdwe.exe
  2⤵
  PID:5396
- C:\Windows\System\EszgVIL.exe
  C:\Windows\System\EszgVIL.exe
  2⤵
  PID:5424
- C:\Windows\System\EPUiRfB.exe
  C:\Windows\System\EPUiRfB.exe
  2⤵
  PID:5452
- C:\Windows\System\xortoFe.exe
  C:\Windows\System\xortoFe.exe
  2⤵
  PID:5488
- C:\Windows\System\lKTIDlT.exe
  C:\Windows\System\lKTIDlT.exe
  2⤵
  PID:5508
- C:\Windows\System\amRkwyF.exe
  C:\Windows\System\amRkwyF.exe
  2⤵
  PID:5536
- C:\Windows\System\ErUnJIX.exe
  C:\Windows\System\ErUnJIX.exe
  2⤵
  PID:5564
- C:\Windows\System\OfhpaKd.exe
  C:\Windows\System\OfhpaKd.exe
  2⤵
  PID:5592
- C:\Windows\System\RIQvhDH.exe
  C:\Windows\System\RIQvhDH.exe
  2⤵
  PID:5620
- C:\Windows\System\nXGqNVo.exe
  C:\Windows\System\nXGqNVo.exe
  2⤵
  PID:5648
- C:\Windows\System\tIDuikf.exe
  C:\Windows\System\tIDuikf.exe
  2⤵
  PID:5676
- C:\Windows\System\kJiCCAn.exe
  C:\Windows\System\kJiCCAn.exe
  2⤵
  PID:5704
- C:\Windows\System\AHGiOYQ.exe
  C:\Windows\System\AHGiOYQ.exe
  2⤵
  PID:5732
- C:\Windows\System\YQfQPQq.exe
  C:\Windows\System\YQfQPQq.exe
  2⤵
  PID:5760
- C:\Windows\System\JgvrywK.exe
  C:\Windows\System\JgvrywK.exe
  2⤵
  PID:5788
- C:\Windows\System\ZxuGbGu.exe
  C:\Windows\System\ZxuGbGu.exe
  2⤵
  PID:5816
- C:\Windows\System\kBHFeXf.exe
  C:\Windows\System\kBHFeXf.exe
  2⤵
  PID:5844
- C:\Windows\System\TjMJKZU.exe
  C:\Windows\System\TjMJKZU.exe
  2⤵
  PID:5872
- C:\Windows\System\ubIwuMV.exe
  C:\Windows\System\ubIwuMV.exe
  2⤵
  PID:5900
- C:\Windows\System\ZymBuuK.exe
  C:\Windows\System\ZymBuuK.exe
  2⤵
  PID:5928
- C:\Windows\System\rAwTrYP.exe
  C:\Windows\System\rAwTrYP.exe
  2⤵
  PID:5956
- C:\Windows\System\ojErRfE.exe
  C:\Windows\System\ojErRfE.exe
  2⤵
  PID:5984
- C:\Windows\System\ZxIgpZw.exe
  C:\Windows\System\ZxIgpZw.exe
  2⤵
  PID:6012
- C:\Windows\System\JlbUGTU.exe
  C:\Windows\System\JlbUGTU.exe
  2⤵
  PID:6044
- C:\Windows\System\PFrPgdx.exe
  C:\Windows\System\PFrPgdx.exe
  2⤵
  PID:6068
- C:\Windows\System\zItXBiF.exe
  C:\Windows\System\zItXBiF.exe
  2⤵
  PID:6096
- C:\Windows\System\AhyvuWP.exe
  C:\Windows\System\AhyvuWP.exe
  2⤵
  PID:6124
- C:\Windows\System\qDLamPJ.exe
  C:\Windows\System\qDLamPJ.exe
  2⤵
  PID:5136
- C:\Windows\System\OQlbqjA.exe
  C:\Windows\System\OQlbqjA.exe
  2⤵
  PID:5220
- C:\Windows\System\LKmFvZe.exe
  C:\Windows\System\LKmFvZe.exe
  2⤵
  PID:5268
- C:\Windows\System\gvAZdfD.exe
  C:\Windows\System\gvAZdfD.exe
  2⤵
  PID:5336
- C:\Windows\System\TYHaUjO.exe
  C:\Windows\System\TYHaUjO.exe
  2⤵
  PID:5392
- C:\Windows\System\KliNZYJ.exe
  C:\Windows\System\KliNZYJ.exe
  2⤵
  PID:5464
- C:\Windows\System\jgvsXTk.exe
  C:\Windows\System\jgvsXTk.exe
  2⤵
  PID:5528
- C:\Windows\System\gGjsCOf.exe
  C:\Windows\System\gGjsCOf.exe
  2⤵
  PID:5588
- C:\Windows\System\SPYkRpc.exe
  C:\Windows\System\SPYkRpc.exe
  2⤵
  PID:5660
- C:\Windows\System\eoBdOKv.exe
  C:\Windows\System\eoBdOKv.exe
  2⤵
  PID:5724
- C:\Windows\System\rELwsQq.exe
  C:\Windows\System\rELwsQq.exe
  2⤵
  PID:5800
- C:\Windows\System\DCxRkUh.exe
  C:\Windows\System\DCxRkUh.exe
  2⤵
  PID:5856
- C:\Windows\System\owguiNB.exe
  C:\Windows\System\owguiNB.exe
  2⤵
  PID:5920
- C:\Windows\System\uGZPKpm.exe
  C:\Windows\System\uGZPKpm.exe
  2⤵
  PID:5980
- C:\Windows\System\UBFMxVI.exe
  C:\Windows\System\UBFMxVI.exe
  2⤵
  PID:6052
- C:\Windows\System\qPiAmZX.exe
  C:\Windows\System\qPiAmZX.exe
  2⤵
  PID:6116
- C:\Windows\System\ggkIYBO.exe
  C:\Windows\System\ggkIYBO.exe
  2⤵
  PID:5192
- C:\Windows\System\WUKrgnE.exe
  C:\Windows\System\WUKrgnE.exe
  2⤵
  PID:5360
- C:\Windows\System\ToVxqGU.exe
  C:\Windows\System\ToVxqGU.exe
  2⤵
  PID:5496
- C:\Windows\System\xqRPbwe.exe
  C:\Windows\System\xqRPbwe.exe
  2⤵
  PID:5688
- C:\Windows\System\yejgLQH.exe
  C:\Windows\System\yejgLQH.exe
  2⤵
  PID:5812
- C:\Windows\System\ApuQaMC.exe
  C:\Windows\System\ApuQaMC.exe
  2⤵
  PID:5968
- C:\Windows\System\KKSjFWC.exe
  C:\Windows\System\KKSjFWC.exe
  2⤵
  PID:6108
- C:\Windows\System\JoafJnS.exe
  C:\Windows\System\JoafJnS.exe
  2⤵
  PID:5388
- C:\Windows\System\suDiTak.exe
  C:\Windows\System\suDiTak.exe
  2⤵
  PID:5776
- C:\Windows\System\tlKZjTI.exe
  C:\Windows\System\tlKZjTI.exe
  2⤵
  PID:6092
- C:\Windows\System\RzodpqL.exe
  C:\Windows\System\RzodpqL.exe
  2⤵
  PID:5912
- C:\Windows\System\EevRdtt.exe
  C:\Windows\System\EevRdtt.exe
  2⤵
  PID:6148
- C:\Windows\System\DOiASEe.exe
  C:\Windows\System\DOiASEe.exe
  2⤵
  PID:6172
- C:\Windows\System\pxaBHzd.exe
  C:\Windows\System\pxaBHzd.exe
  2⤵
  PID:6200
- C:\Windows\System\TMHWTmN.exe
  C:\Windows\System\TMHWTmN.exe
  2⤵
  PID:6228
- C:\Windows\System\TMvnBVq.exe
  C:\Windows\System\TMvnBVq.exe
  2⤵
  PID:6256
- C:\Windows\System\HBjzuOr.exe
  C:\Windows\System\HBjzuOr.exe
  2⤵
  PID:6288
- C:\Windows\System\gVzEwhk.exe
  C:\Windows\System\gVzEwhk.exe
  2⤵
  PID:6312
- C:\Windows\System\ZlBBNMF.exe
  C:\Windows\System\ZlBBNMF.exe
  2⤵
  PID:6340
- C:\Windows\System\uXiynzf.exe
  C:\Windows\System\uXiynzf.exe
  2⤵
  PID:6360
- C:\Windows\System\nZaazUP.exe
  C:\Windows\System\nZaazUP.exe
  2⤵
  PID:6404
- C:\Windows\System\hVFNwfR.exe
  C:\Windows\System\hVFNwfR.exe
  2⤵
  PID:6424
- C:\Windows\System\WkUxRry.exe
  C:\Windows\System\WkUxRry.exe
  2⤵
  PID:6448
- C:\Windows\System\FoOVfjP.exe
  C:\Windows\System\FoOVfjP.exe
  2⤵
  PID:6472
- C:\Windows\System\agzirEd.exe
  C:\Windows\System\agzirEd.exe
  2⤵
  PID:6516
- C:\Windows\System\meQLAMv.exe
  C:\Windows\System\meQLAMv.exe
  2⤵
  PID:6536
- C:\Windows\System\xjmVdcV.exe
  C:\Windows\System\xjmVdcV.exe
  2⤵
  PID:6572
- C:\Windows\System\tnFgSXo.exe
  C:\Windows\System\tnFgSXo.exe
  2⤵
  PID:6600
- C:\Windows\System\LEgQdoH.exe
  C:\Windows\System\LEgQdoH.exe
  2⤵
  PID:6632
- C:\Windows\System\EIZAgIE.exe
  C:\Windows\System\EIZAgIE.exe
  2⤵
  PID:6656
- C:\Windows\System\ozbYPXo.exe
  C:\Windows\System\ozbYPXo.exe
  2⤵
  PID:6684
- C:\Windows\System\zfQNlpl.exe
  C:\Windows\System\zfQNlpl.exe
  2⤵
  PID:6712
- C:\Windows\System\ZkiIkMr.exe
  C:\Windows\System\ZkiIkMr.exe
  2⤵
  PID:6740
- C:\Windows\System\JqFsmYy.exe
  C:\Windows\System\JqFsmYy.exe
  2⤵
  PID:6768
- C:\Windows\System\CPOybat.exe
  C:\Windows\System\CPOybat.exe
  2⤵
  PID:6796
- C:\Windows\System\MGCFtLN.exe
  C:\Windows\System\MGCFtLN.exe
  2⤵
  PID:6828
- C:\Windows\System\UtgeLqp.exe
  C:\Windows\System\UtgeLqp.exe
  2⤵
  PID:6852
- C:\Windows\System\OFWRwbM.exe
  C:\Windows\System\OFWRwbM.exe
  2⤵
  PID:6884
- C:\Windows\System\VzLAwxg.exe
  C:\Windows\System\VzLAwxg.exe
  2⤵
  PID:6908
- C:\Windows\System\oFePTaU.exe
  C:\Windows\System\oFePTaU.exe
  2⤵
  PID:6936
- C:\Windows\System\EHXMEOw.exe
  C:\Windows\System\EHXMEOw.exe
  2⤵
  PID:6964
- C:\Windows\System\FBgcnNI.exe
  C:\Windows\System\FBgcnNI.exe
  2⤵
  PID:6992
- C:\Windows\System\KWWnAxw.exe
  C:\Windows\System\KWWnAxw.exe
  2⤵
  PID:7020
- C:\Windows\System\errUkWp.exe
  C:\Windows\System\errUkWp.exe
  2⤵
  PID:7048
- C:\Windows\System\SfYWkCY.exe
  C:\Windows\System\SfYWkCY.exe
  2⤵
  PID:7076
- C:\Windows\System\fDgqMEV.exe
  C:\Windows\System\fDgqMEV.exe
  2⤵
  PID:7104
- C:\Windows\System\FSpEGNz.exe
  C:\Windows\System\FSpEGNz.exe
  2⤵
  PID:7132
- C:\Windows\System\qSZkUQh.exe
  C:\Windows\System\qSZkUQh.exe
  2⤵
  PID:5324
- C:\Windows\System\ASuhcIu.exe
  C:\Windows\System\ASuhcIu.exe
  2⤵
  PID:6196
- C:\Windows\System\xSjujXM.exe
  C:\Windows\System\xSjujXM.exe
  2⤵
  PID:6252
- C:\Windows\System\FEgGGfO.exe
  C:\Windows\System\FEgGGfO.exe
  2⤵
  PID:6324
- C:\Windows\System\aWcFIAd.exe
  C:\Windows\System\aWcFIAd.exe
  2⤵
  PID:6388
- C:\Windows\System\iBXUHwW.exe
  C:\Windows\System\iBXUHwW.exe
  2⤵
  PID:6468
- C:\Windows\System\HMbUpWm.exe
  C:\Windows\System\HMbUpWm.exe
  2⤵
  PID:6532
- C:\Windows\System\nziLNaX.exe
  C:\Windows\System\nziLNaX.exe
  2⤵
  PID:6592
- C:\Windows\System\UAqLEIK.exe
  C:\Windows\System\UAqLEIK.exe
  2⤵
  PID:6652
- C:\Windows\System\tvYfuhz.exe
  C:\Windows\System\tvYfuhz.exe
  2⤵
  PID:6724
- C:\Windows\System\WdaLgww.exe
  C:\Windows\System\WdaLgww.exe
  2⤵
  PID:6792
- C:\Windows\System\eXdtSGY.exe
  C:\Windows\System\eXdtSGY.exe
  2⤵
  PID:6848
- C:\Windows\System\EHEnDNE.exe
  C:\Windows\System\EHEnDNE.exe
  2⤵
  PID:6920
- C:\Windows\System\cqPVFNA.exe
  C:\Windows\System\cqPVFNA.exe
  2⤵
  PID:6976
- C:\Windows\System\LyViFkr.exe
  C:\Windows\System\LyViFkr.exe
  2⤵
  PID:7044
- C:\Windows\System\cdeSTth.exe
  C:\Windows\System\cdeSTth.exe
  2⤵
  PID:7116
- C:\Windows\System\xyBtPiw.exe
  C:\Windows\System\xyBtPiw.exe
  2⤵
  PID:6168
- C:\Windows\System\hNRKQYD.exe
  C:\Windows\System\hNRKQYD.exe
  2⤵
  PID:6304
- C:\Windows\System\VbHkjAh.exe
  C:\Windows\System\VbHkjAh.exe
  2⤵
  PID:6500
- C:\Windows\System\APDlWGf.exe
  C:\Windows\System\APDlWGf.exe
  2⤵
  PID:6640
- C:\Windows\System\msbDdhl.exe
  C:\Windows\System\msbDdhl.exe
  2⤵
  PID:6780
- C:\Windows\System\LGrCSRB.exe
  C:\Windows\System\LGrCSRB.exe
  2⤵
  PID:6988
- C:\Windows\System\nXHUmLF.exe
  C:\Windows\System\nXHUmLF.exe
  2⤵
  PID:7100
- C:\Windows\System\BZDUOqZ.exe
  C:\Windows\System\BZDUOqZ.exe
  2⤵
  PID:6308
- C:\Windows\System\ibvdcfm.exe
  C:\Windows\System\ibvdcfm.exe
  2⤵
  PID:6752
- C:\Windows\System\BbPLaQa.exe
  C:\Windows\System\BbPLaQa.exe
  2⤵
  PID:7072
- C:\Windows\System\asCacSn.exe
  C:\Windows\System\asCacSn.exe
  2⤵
  PID:7012
- C:\Windows\System\UcWaRfl.exe
  C:\Windows\System\UcWaRfl.exe
  2⤵
  PID:6240
- C:\Windows\System\BugCZhI.exe
  C:\Windows\System\BugCZhI.exe
  2⤵
  PID:7200
- C:\Windows\System\INQmkuz.exe
  C:\Windows\System\INQmkuz.exe
  2⤵
  PID:7224
- C:\Windows\System\oSjHaId.exe
  C:\Windows\System\oSjHaId.exe
  2⤵
  PID:7252
- C:\Windows\System\AGgGpHM.exe
  C:\Windows\System\AGgGpHM.exe
  2⤵
  PID:7280
- C:\Windows\System\DfFmtbz.exe
  C:\Windows\System\DfFmtbz.exe
  2⤵
  PID:7308
- C:\Windows\System\OirrpKr.exe
  C:\Windows\System\OirrpKr.exe
  2⤵
  PID:7336
- C:\Windows\System\cGoJrBU.exe
  C:\Windows\System\cGoJrBU.exe
  2⤵
  PID:7364
- C:\Windows\System\mHNhXEu.exe
  C:\Windows\System\mHNhXEu.exe
  2⤵
  PID:7392
- C:\Windows\System\KqtqlBh.exe
  C:\Windows\System\KqtqlBh.exe
  2⤵
  PID:7420
- C:\Windows\System\jNsWwRZ.exe
  C:\Windows\System\jNsWwRZ.exe
  2⤵
  PID:7448
- C:\Windows\System\DVYkJFM.exe
  C:\Windows\System\DVYkJFM.exe
  2⤵
  PID:7476
- C:\Windows\System\LqliGGr.exe
  C:\Windows\System\LqliGGr.exe
  2⤵
  PID:7492
- C:\Windows\System\ZnRMizH.exe
  C:\Windows\System\ZnRMizH.exe
  2⤵
  PID:7520
- C:\Windows\System\jwKIUdI.exe
  C:\Windows\System\jwKIUdI.exe
  2⤵
  PID:7544
- C:\Windows\System\eAKxHMt.exe
  C:\Windows\System\eAKxHMt.exe
  2⤵
  PID:7588
- C:\Windows\System\BckoZpp.exe
  C:\Windows\System\BckoZpp.exe
  2⤵
  PID:7616
- C:\Windows\System\TvxfLsJ.exe
  C:\Windows\System\TvxfLsJ.exe
  2⤵
  PID:7644
- C:\Windows\System\CzaqRKI.exe
  C:\Windows\System\CzaqRKI.exe
  2⤵
  PID:7672
- C:\Windows\System\PEAiicY.exe
  C:\Windows\System\PEAiicY.exe
  2⤵
  PID:7700
- C:\Windows\System\ENAixwX.exe
  C:\Windows\System\ENAixwX.exe
  2⤵
  PID:7728
- C:\Windows\System\geBMNiI.exe
  C:\Windows\System\geBMNiI.exe
  2⤵
  PID:7756
- C:\Windows\System\Ifwvljn.exe
  C:\Windows\System\Ifwvljn.exe
  2⤵
  PID:7784
- C:\Windows\System\tIMKwuC.exe
  C:\Windows\System\tIMKwuC.exe
  2⤵
  PID:7812
- C:\Windows\System\tCiFaMJ.exe
  C:\Windows\System\tCiFaMJ.exe
  2⤵
  PID:7840
- C:\Windows\System\sVbRuNo.exe
  C:\Windows\System\sVbRuNo.exe
  2⤵
  PID:7868
- C:\Windows\System\OQatpaD.exe
  C:\Windows\System\OQatpaD.exe
  2⤵
  PID:7896
- C:\Windows\System\xWQypFt.exe
  C:\Windows\System\xWQypFt.exe
  2⤵
  PID:7924
- C:\Windows\System\atTLDaS.exe
  C:\Windows\System\atTLDaS.exe
  2⤵
  PID:7952
- C:\Windows\System\omHtCVp.exe
  C:\Windows\System\omHtCVp.exe
  2⤵
  PID:7980
- C:\Windows\System\sQCMLKS.exe
  C:\Windows\System\sQCMLKS.exe
  2⤵
  PID:8008
- C:\Windows\System\OxFlBzH.exe
  C:\Windows\System\OxFlBzH.exe
  2⤵
  PID:8036
- C:\Windows\System\OqyJhcI.exe
  C:\Windows\System\OqyJhcI.exe
  2⤵
  PID:8064
- C:\Windows\System\XpBGfei.exe
  C:\Windows\System\XpBGfei.exe
  2⤵
  PID:8092
- C:\Windows\System\OsZELzO.exe
  C:\Windows\System\OsZELzO.exe
  2⤵
  PID:8120
- C:\Windows\System\BgvnrqN.exe
  C:\Windows\System\BgvnrqN.exe
  2⤵
  PID:8148
- C:\Windows\System\SdmRIpj.exe
  C:\Windows\System\SdmRIpj.exe
  2⤵
  PID:8176
- C:\Windows\System\nJhlyfN.exe
  C:\Windows\System\nJhlyfN.exe
  2⤵
  PID:7188
- C:\Windows\System\IVnmVvQ.exe
  C:\Windows\System\IVnmVvQ.exe
  2⤵
  PID:7248
- C:\Windows\System\TnqElYn.exe
  C:\Windows\System\TnqElYn.exe
  2⤵
  PID:7304
- C:\Windows\System\NjTWDMf.exe
  C:\Windows\System\NjTWDMf.exe
  2⤵
  PID:7384
- C:\Windows\System\EmFLSDD.exe
  C:\Windows\System\EmFLSDD.exe
  2⤵
  PID:7444
- C:\Windows\System\XpDhXOQ.exe
  C:\Windows\System\XpDhXOQ.exe
  2⤵
  PID:7512
- C:\Windows\System\mDjxIIX.exe
  C:\Windows\System\mDjxIIX.exe
  2⤵
  PID:7568
- C:\Windows\System\GIqigKI.exe
  C:\Windows\System\GIqigKI.exe
  2⤵
  PID:7664
- C:\Windows\System\PBIagSC.exe
  C:\Windows\System\PBIagSC.exe
  2⤵
  PID:7712
- C:\Windows\System\xrNsDca.exe
  C:\Windows\System\xrNsDca.exe
  2⤵
  PID:7776
- C:\Windows\System\uZftHVT.exe
  C:\Windows\System\uZftHVT.exe
  2⤵
  PID:7832
- C:\Windows\System\SnwBAqu.exe
  C:\Windows\System\SnwBAqu.exe
  2⤵
  PID:7920
- C:\Windows\System\nyBHdCL.exe
  C:\Windows\System\nyBHdCL.exe
  2⤵
  PID:7976
- C:\Windows\System\rCxTtqO.exe
  C:\Windows\System\rCxTtqO.exe
  2⤵
  PID:8032
- C:\Windows\System\AbHfHdM.exe
  C:\Windows\System\AbHfHdM.exe
  2⤵
  PID:8112
- C:\Windows\System\UJcvedd.exe
  C:\Windows\System\UJcvedd.exe
  2⤵
  PID:8188
- C:\Windows\System\ALMeWsf.exe
  C:\Windows\System\ALMeWsf.exe
  2⤵
  PID:7244
- C:\Windows\System\Mugzeyx.exe
  C:\Windows\System\Mugzeyx.exe
  2⤵
  PID:7432
- C:\Windows\System\GIoQUSt.exe
  C:\Windows\System\GIoQUSt.exe
  2⤵
  PID:7584
- C:\Windows\System\ibzHkwv.exe
  C:\Windows\System\ibzHkwv.exe
  2⤵
  PID:7740
- C:\Windows\System\lvbiCUY.exe
  C:\Windows\System\lvbiCUY.exe
  2⤵
  PID:7940
- C:\Windows\System\GYznvim.exe
  C:\Windows\System\GYznvim.exe
  2⤵
  PID:8028
- C:\Windows\System\mjCqNFM.exe
  C:\Windows\System\mjCqNFM.exe
  2⤵
  PID:7180
- C:\Windows\System\sjpsnvS.exe
  C:\Windows\System\sjpsnvS.exe
  2⤵
  PID:7412
- C:\Windows\System\SKRXDsA.exe
  C:\Windows\System\SKRXDsA.exe
  2⤵
  PID:7804
- C:\Windows\System\MZdfHAo.exe
  C:\Windows\System\MZdfHAo.exe
  2⤵
  PID:8140
- C:\Windows\System\LNXnmmX.exe
  C:\Windows\System\LNXnmmX.exe
  2⤵
  PID:7864
- C:\Windows\System\MunRJSH.exe
  C:\Windows\System\MunRJSH.exe
  2⤵
  PID:8204
- C:\Windows\System\PWilhJD.exe
  C:\Windows\System\PWilhJD.exe
  2⤵
  PID:8232
- C:\Windows\System\IbtHIxa.exe
  C:\Windows\System\IbtHIxa.exe
  2⤵
  PID:8260
- C:\Windows\System\YYBCZDw.exe
  C:\Windows\System\YYBCZDw.exe
  2⤵
  PID:8288
- C:\Windows\System\QHwbPNF.exe
  C:\Windows\System\QHwbPNF.exe
  2⤵
  PID:8316
- C:\Windows\System\SOiByyT.exe
  C:\Windows\System\SOiByyT.exe
  2⤵
  PID:8344
- C:\Windows\System\urKlXsn.exe
  C:\Windows\System\urKlXsn.exe
  2⤵
  PID:8372
- C:\Windows\System\YCFBgKK.exe
  C:\Windows\System\YCFBgKK.exe
  2⤵
  PID:8400
- C:\Windows\System\tiQjsqK.exe
  C:\Windows\System\tiQjsqK.exe
  2⤵
  PID:8428
- C:\Windows\System\DSRSzan.exe
  C:\Windows\System\DSRSzan.exe
  2⤵
  PID:8456
- C:\Windows\System\HArNLjj.exe
  C:\Windows\System\HArNLjj.exe
  2⤵
  PID:8484
- C:\Windows\System\avglOOX.exe
  C:\Windows\System\avglOOX.exe
  2⤵
  PID:8512
- C:\Windows\System\nmPzomX.exe
  C:\Windows\System\nmPzomX.exe
  2⤵
  PID:8528
- C:\Windows\System\fJPvvgl.exe
  C:\Windows\System\fJPvvgl.exe
  2⤵
  PID:8548
- C:\Windows\System\KZKIAFT.exe
  C:\Windows\System\KZKIAFT.exe
  2⤵
  PID:8580
- C:\Windows\System\hxvDGsh.exe
  C:\Windows\System\hxvDGsh.exe
  2⤵
  PID:8608
- C:\Windows\System\aHwIgJF.exe
  C:\Windows\System\aHwIgJF.exe
  2⤵
  PID:8628
- C:\Windows\System\bwjneky.exe
  C:\Windows\System\bwjneky.exe
  2⤵
  PID:8656
- C:\Windows\System\VpEpKZO.exe
  C:\Windows\System\VpEpKZO.exe
  2⤵
  PID:8692
- C:\Windows\System\XRFhLzt.exe
  C:\Windows\System\XRFhLzt.exe
  2⤵
  PID:8728
- C:\Windows\System\TJJrtmj.exe
  C:\Windows\System\TJJrtmj.exe
  2⤵
  PID:8768
- C:\Windows\System\NfXSzUi.exe
  C:\Windows\System\NfXSzUi.exe
  2⤵
  PID:8784
- C:\Windows\System\LTEopMj.exe
  C:\Windows\System\LTEopMj.exe
  2⤵
  PID:8800
- C:\Windows\System\oViUnQx.exe
  C:\Windows\System\oViUnQx.exe
  2⤵
  PID:8816
- C:\Windows\System\aSFhEbt.exe
  C:\Windows\System\aSFhEbt.exe
  2⤵
  PID:8840
- C:\Windows\System\NIaqbqr.exe
  C:\Windows\System\NIaqbqr.exe
  2⤵
  PID:8900
- C:\Windows\System\vyoMMgC.exe
  C:\Windows\System\vyoMMgC.exe
  2⤵
  PID:8924
- C:\Windows\System\SAUkGea.exe
  C:\Windows\System\SAUkGea.exe
  2⤵
  PID:8940
- C:\Windows\System\uLiZLPm.exe
  C:\Windows\System\uLiZLPm.exe
  2⤵
  PID:8972
- C:\Windows\System\QWViqww.exe
  C:\Windows\System\QWViqww.exe
  2⤵
  PID:9008
- C:\Windows\System\piPqgfI.exe
  C:\Windows\System\piPqgfI.exe
  2⤵
  PID:9036
- C:\Windows\System\OoRtclV.exe
  C:\Windows\System\OoRtclV.exe
  2⤵
  PID:9052
- C:\Windows\System\CaYVSDE.exe
  C:\Windows\System\CaYVSDE.exe
  2⤵
  PID:9092
- C:\Windows\System\JwsyQBX.exe
  C:\Windows\System\JwsyQBX.exe
  2⤵
  PID:9128
- C:\Windows\System\FXXpjUy.exe
  C:\Windows\System\FXXpjUy.exe
  2⤵
  PID:9160
- C:\Windows\System\PfpNVOc.exe
  C:\Windows\System\PfpNVOc.exe
  2⤵
  PID:9180
- C:\Windows\System\psWlHtq.exe
  C:\Windows\System\psWlHtq.exe
  2⤵
  PID:8196
- C:\Windows\System\LeIpGSw.exe
  C:\Windows\System\LeIpGSw.exe
  2⤵
  PID:8244
- C:\Windows\System\UNfsYVC.exe
  C:\Windows\System\UNfsYVC.exe
  2⤵
  PID:8336
- C:\Windows\System\QyliYxw.exe
  C:\Windows\System\QyliYxw.exe
  2⤵
  PID:8392
- C:\Windows\System\WWIroco.exe
  C:\Windows\System\WWIroco.exe
  2⤵
  PID:8472
- C:\Windows\System\XOZrAdF.exe
  C:\Windows\System\XOZrAdF.exe
  2⤵
  PID:8524
- C:\Windows\System\UTLOAwM.exe
  C:\Windows\System\UTLOAwM.exe
  2⤵
  PID:8572
- C:\Windows\System\GOMHfPw.exe
  C:\Windows\System\GOMHfPw.exe
  2⤵
  PID:8640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AuFfLGU.exe

Filesize
2.1MB

MD5
3dfe873e0e0c731206d99fe57cb8ab40

SHA1
03cfff22a5bfd2ab3d0a7783c0f4a17f3b212957

SHA256
c2c463066818ad55ccde54772a48b83fb714c74b158887fe8c0e5b06bc8af35d

SHA512
e334e1321bcedb66cec9432ffa534e1d6d49a9e689e36092448b8b215b3aef7d886f84613513d33a1207866ecdcee7aaeead46dc08ee1341106805a8703d41df

Download Submit
C:\Windows\System\ClnIcdw.exe

Filesize
2.1MB

MD5
55bcfe4b96e9ba5fbb058d0b06aede29

SHA1
58e42c5e46e80ce411401e0c5a39eb68ad81f3db

SHA256
3dee49b9a7684e7baba08b7d23359f7316ac639ce708731168964c1afd3421b9

SHA512
2bac156ef0296a0a8a7cef5c0e5c3580c38f0686226e0fc5ca934223d4a440f1d7f865d9edfdf6950ed753614a2f23073476845d3d3b5982549b596ed453f187

Download Submit
C:\Windows\System\EAxKAyi.exe

Filesize
2.1MB

MD5
383f55dcf860f8acdbb817882ecc3de0

SHA1
b93c3263d5a5702fb0ea3c9de41364e400b8dda5

SHA256
4f87a29a74427e17689f19cd62f903370408917dbc88b1ee7f1a166f81218c4f

SHA512
6090e5b8f778a1d8f3faeca0282d633e1529bdc34d62f4570b3b762a88c266cacf7bdd7b023c53bd5b7af3df663cb33c227547b84468d0f7135f41125231bf31

Download Submit
C:\Windows\System\HFsuehG.exe

Filesize
2.1MB

MD5
c670f02f09d285b03f4b1685d8f73943

SHA1
c074e828e22b6920e8ee82a97c26e3e7e30a54e7

SHA256
fdc2c553d3f9ba812871edab300cdc88100f3ad2119eb5b0a99b037507e4d59e

SHA512
ce4edf0e3c87d62984ad0ad98676bceddcd77fa31a509557615548fc92467e0d04a1349e6ca916530b4f19da83fb0a93a11de2497ba12b132cde3914fb3aa7ba

Download Submit
C:\Windows\System\JoouULY.exe

Filesize
2.1MB

MD5
e7099bb3266f44d2ccdcf5afbfb7910b

SHA1
bd975b388702ca4f353b78aeae631892b1a86dcc

SHA256
49f94ed0a4d0e8e7ecb4cc005bee5dea35be6d11f98829e76ed955e7abaf23a3

SHA512
d4ae3bcf42628512e89b811f95270939d14997116eca663dfc8c5faf38498808a91a74f5535a5ac8a0ac7409d8b2d841f612a9d2acad52b084af4731110926ee

Download Submit
C:\Windows\System\MMEzLvi.exe

Filesize
2.1MB

MD5
311957ff880353912e1269ebc8dc65ae

SHA1
190510328e9405d4f16ba0b434ffc7394a00b01d

SHA256
5bc74a6176eed84a8ecf194a572a8620962ca26c1906bf67e2aa6c9928cb0428

SHA512
082115e172203977959a36f5198bc01296ac2ce2cfc1d8b26e5cbd526d92df8a734c58235184894daa2383c867f76d9c2180206056b98cd9f0118349b2ffbe4e

Download Submit
C:\Windows\System\NvbrIVL.exe

Filesize
2.1MB

MD5
eadd8dc13587c525e0387e0100412980

SHA1
21dd655013109b2573c0e70113e2eb5fdc9961b4

SHA256
4f4ceeda3e9edebce330f7f4b399c84b98a5c12c9d08d62da0aeec5d1ccb797d

SHA512
a71a48003b8f33de411a9e8029cc7f94f17552be45ca191a3563aa7a1a35d3946ac44da046fb029cf5decd9a9139e8010c9ed2b417b5a3a8dc9c3da6f1f43696

Download Submit
C:\Windows\System\OSQgxWU.exe

Filesize
2.1MB

MD5
369f2e8ab9879de8dd91937ec9e587a2

SHA1
7df96d0b88c66a318701da9c8ab39caa562b27c3

SHA256
d830d46dbc2e2aed0efa71ffbf838e37e1465ebf8aecff94ec4b175464f2d3e5

SHA512
bdc3cdda112ef5d8bf3226e09f72cfc38511981f692637f7f5c5b0e83afb6737f71ac5282e3f3e6979246dda1e5e3693579c440d62e5fbabe6a60371e5353ac3

Download Submit
C:\Windows\System\RarkfUM.exe

Filesize
2.1MB

MD5
f38957348d99193742ef8ad6bef82785

SHA1
8f53adae2c49f63a2dde1ce686196c0fd28ae2b0

SHA256
6556775f5dc45fc4c0e43c64a293242cdaadc0ff8e92f931f0b53d66b223e25b

SHA512
7cdb65ef887a11fa1e77d5ca8881abfaeac3dd131898fd5b71bc8ba87671d826c04af4a5f2c7906733230021bc8addabfb794750468d650ee7168ca76e5e8599

Download Submit
C:\Windows\System\VQQWxCp.exe

Filesize
2.1MB

MD5
18622756750dcd6f6b033bab62ccdb4b

SHA1
9882ea332e3c0ff5b139dad0d0e4898ba7f6799a

SHA256
d2306f3b26fe18e744383b5bbc4091f79fa3cd30f1ce8de839624dadb054f582

SHA512
2b4e8eeb53b02573eda65a0314a75a4a226d16d90bed776635f51b352e9b537b7a8172d46226eec7d4de4af57d8432ee7b214cce34e902fae95d95844cd165ff

Download Submit
C:\Windows\System\VZYohWY.exe

Filesize
2.1MB

MD5
28f1c6ddf4e05e2c77fc18fa0a2e713a

SHA1
40723a25851174a2751b0198c33b4a07b9965543

SHA256
98b205a120852befc6b07d747b0594e65083161a0739b2e35fd290ef02178c6d

SHA512
bc4af2946cd10d6a175225eedf44ad6719c99531ccd48d5eb94b30c26714a4f3dec45985cec3aff12599518da881b29b46fb9245a0f7b357681bb18165383e5a

Download Submit
C:\Windows\System\XRLSiad.exe

Filesize
2.1MB

MD5
aa213474b602c919c7c25686061d6e1f

SHA1
6fa52e7b468397b2e9c4fbfe13c2969daa085bd6

SHA256
ffa16f7cd5d299b917f3497811a8a1eee01c96511c479cdcff406582ecbbf02a

SHA512
970bce772c2fb195ecefc24fb0052c45d57c82f7fc95f8f60f06a48ad788bf08214ee66ca318f4e011023133f61a04eb38a4d437302c3c4efe1b9cadd0f2c3d0

Download Submit
C:\Windows\System\XSSJDnL.exe

Filesize
2.1MB

MD5
8ef60faf9c971685b07c27081f89397f

SHA1
41f67f8fecd803ae626106cbfbc3ef00ed950230

SHA256
9cb9f0f7446daead1ae33dd91b08490c0ab0b1d3eaa3f089ac24e5c18d08df5d

SHA512
43bb02bffdd8b94612e5faeaf2a317c6c8328991dc884f04c0e771065125c0e91de82be5ad098747d68f3baf26f5f21be9b06a57f8e81216972716e28af44374

Download Submit
C:\Windows\System\ZArRFYM.exe

Filesize
2.1MB

MD5
d51b15e73e53ce5a4e6f205c5e1e4473

SHA1
9dcd6296ace7572c3188edfb6e9f3732a149c023

SHA256
34a380efca80a75ccf5c689b8847acb416e6dc5b12e3464455c1a3e9064226bf

SHA512
a54e70068c04e1b8a33cf4d87bbed14c2c6488cb0b38f7fdd807986ce51b718063b1e961986055a1d5c68c080957dceff5293262afd54e2ff815e5e8ef7d75b0

Download Submit
C:\Windows\System\bMaWwsE.exe

Filesize
2.1MB

MD5
560f39cad6259c7616fa95a5443408dd

SHA1
ba80a44e9acdbf403d575bf282114e277cc6d2e1

SHA256
559f1c615ce36dcb9df44c6707d3b7286fd10848db3a4009508418f1bdc3a518

SHA512
7d71d74948f5c5a41d82cd107ab1d70e665e7f6e809bff36103c231989b7b29fed8b808aa0d52c46d065c596dc940b2d95205fd076657b1334529fb988950cde

Download Submit
C:\Windows\System\dLXAQQe.exe

Filesize
2.1MB

MD5
46e8315ca7f5ab8be6a490ae0a099e16

SHA1
37539b6b80f34f66f3a762a0fc3e663fd326f0be

SHA256
3386838d5304c20bff5fee11f48ddaf9a4878aaea3cfbf6df5b1282d7c65467f

SHA512
bc0f285cb18e2e9a105aaf215bbcab6d28262f2e723cb4dec998d63ac125fc6e6f7a788dd9bc598066418b65aac4ad4c6ebcd8a78669b15e2d12fa02e158df05

Download Submit
C:\Windows\System\ejYRune.exe

Filesize
2.1MB

MD5
ba67a32627876dd38ee262d53879088e

SHA1
f37061297002886f79ba30c325613d0a9023db57

SHA256
3de57b1acf373a3beea2ea90693caf00257d7190a0d237869c62121a671c7652

SHA512
c36f8899a27a13fe2d71282334ed721583e32f6e0b728aa5e5186f357a002cac63c4e7536c5caadf1569d8ac8b8224343cb83bbe216104e53c22a579b40e9244

Download Submit
C:\Windows\System\ewANIVR.exe

Filesize
2.1MB

MD5
56969b6644f6058279236dea2822114c

SHA1
b04cf435afb0864199870e9748ba2529a096bfaa

SHA256
074ccb383481a2cf8726fd2a09a3cdf3656fc4d09dab6dd4be9c3227f891076b

SHA512
daef0313d4fd9fa70e1ca4ba202d6db74212b6b96cac1f891a9bf45a129a16064e08651be01b6388d0fb790db103c1b3017430cf6333a2f8bd494e243f5b0774

Download Submit
C:\Windows\System\gDARTsl.exe

Filesize
2.1MB

MD5
12ec6d25b2cb803205dfc4742e1a7aab

SHA1
1f2c6090b54845bd4951b24c2568825dec79e94d

SHA256
fe4298f637dd49a94da699416d540544ed8a9895ae9b8dee7161811a82431507

SHA512
1acf9c6197410ebad403d8a219a08b81503c37ba07b24968701403121d8b3581d4eea24325c848259fdeeefec10433e9cd1daec81133e3833cbb9ba7d5115467

Download Submit
C:\Windows\System\iUpNYGC.exe

Filesize
2.1MB

MD5
05aa0a2774f3db3109e84f019dce82b6

SHA1
3b7da987dd707c108a9a51750bd77ff38842b0c0

SHA256
d675805c96ffaeef77ab646962bd47cef49fb733272d265c9192a3dd817ba792

SHA512
be84aab330b7543d72bf00e00cea158cb0e0c9f4b3ca3704cc52c6c39098ab3fb757008df3a05320d8b5ad319b8869a218ec4c7d2faeff2923cef0b8bab85420

Download Submit
C:\Windows\System\jLQcsdy.exe

Filesize
2.1MB

MD5
548108fec57ae315a632ca6adeb191d0

SHA1
2420e71a047f31faa8981ad9a757a49df2cc728c

SHA256
4009b379e902aeac967ce18d89f5d5d73be8d7545ab999a55bd97f339259c33f

SHA512
e53a5e8a22257d4bd75ee973ede95d4259096a2080ed03d9ab25614050e3e868189a21ce89d809365ade6973902f2ac7e3eae803f04fc5b6078c12449986e091

Download Submit
C:\Windows\System\plosfjc.exe

Filesize
2.1MB

MD5
f99cdba6bafc53498ccb708719d3632b

SHA1
5111b753f849f5a300027ec751e8e470dbcdcaf3

SHA256
18a16138cc4f45aca33971270900f009e9a2dd27e64f6c238ecb37961bdab456

SHA512
b6cd00f4e074f60a91c6aca1f266980ad136873ba3833e3a1053884240f77b38d34b1de627852b120f5ebb38e0f137a1671f17d9805c0d8ad4993ca2d3b46179

Download Submit
C:\Windows\System\qLFNFLw.exe

Filesize
2.1MB

MD5
4b4b46fe562f68b032772848852b8f1e

SHA1
bdd2c64770e7ba2769abbef46d11c2d84c68214b

SHA256
a7a1ea2b84c64dba649ee26f6bdf83e67cb887bdab08a3188d89976e01092d73

SHA512
d900b09d412781a18631b1bcb240afec0801f2989b03edec94021d30112265e55f228c71b109e863f32723fe71331943e52db3a6b8cc79bdc693115bbd8df3a2

Download Submit
C:\Windows\System\qfhntMw.exe

Filesize
2.1MB

MD5
7e702b6463ed23dbd1b8684dc417bed7

SHA1
dc6617bb8acc6d299f7d97748dbcf14fdba3f0d3

SHA256
fb05af18073f47821c1b7f85797a18e0a6b355b4e4f152cd73815eff82665df3

SHA512
0ed23c82efc7a9618a420379ec0bfbbc2960504a518e9ff77f936d7b49f9792c4b56b7777d03652909b8686d8f14e4d91020609db4dc31602d61edc89b9592c1

Download Submit
C:\Windows\System\rDTBQgq.exe

Filesize
2.1MB

MD5
556e449776cbba69cc8249e9bf5d3aa9

SHA1
0decfb4e0cdd11dd6caa707fa5af984dd95b862f

SHA256
480c6bc8fb4988c4f5ad4058307f7d1d3c8ac96babb690490752005942a49afb

SHA512
9614b942f94642908b55c6dd447533324a8f63802d5013426a4ab607522a2db5287e5115f7e4b4a8d67653c55813a294a305570f719e832ad3e2786d791ef49e

Download Submit
C:\Windows\System\rHjncoZ.exe

Filesize
2.1MB

MD5
d273738e3ec7587dbc08fe2a166a46cd

SHA1
ab733c6f3e3a236effd625328b81fa145592ba14

SHA256
facab32752ad15bed1ff799413c70a1bc5a5527b95a11acc1221f3f5d3014cf8

SHA512
7e9f4f1eed044037e4e7ec4dea96849362c4456942db6c297d9fdf588684a89dd215e45412816afc0cde9b6261a5fd7a9a565a9b336bfb6a20816e98a9b3923a

Download Submit
C:\Windows\System\rMATlPu.exe

Filesize
2.1MB

MD5
9c55c23d1dd67ad5322f101261501839

SHA1
f896d889563c784388b79c434e6085698d620e75

SHA256
f292249c0235e0b37192b5cdd9d1a40051276bf24abe47156a60360f45201779

SHA512
cd8d5913415a299d26b0b61d081ccc05374af57518dc1e55f12deb5c06961efda5d01b320c72ecd777b22e1b9af1aabd9d07c4488d706d010ed7df45788121be

Download Submit
C:\Windows\System\rcUhJsQ.exe

Filesize
2.1MB

MD5
9c1d0bc54dedf2ee54b29f83629e95de

SHA1
eb149d1229d15b5e375c28080f032843466ab26e

SHA256
2c3ffa1ab0acd034340d814abf9f0f7e1dc0e14103184140dd62b777adc85b1b

SHA512
93e3b9c0ab0876a054957dfd4f6d3bf3b7068216b6db9068f01e49743602ebe02c42d77c8423c531f6aafec248ac9d6f9439df92e1753045c70f76b05248aba8

Download Submit
C:\Windows\System\tcqikwd.exe

Filesize
2.1MB

MD5
d91de2c27b226128cf3a2ce8a5e8227e

SHA1
8d0646d8ea807f6191bc27aefb241a3241690553

SHA256
9db0e7a5fdfde0a176c8458843c9d9ebfd413bb63881bca5a217fbe82c6a6695

SHA512
a51592fd265f83a2c815127c6eec694be490bf95c59cc568a7cd24b05252e5a1e9bad7f2c9ee862cb7fd5caee65c22deef24a2627ca5c643fedb37d491509dd6

Download Submit
C:\Windows\System\tvwlQhr.exe

Filesize
2.1MB

MD5
93827b2e3fd439d3463a9e6d3b6b78f9

SHA1
5391bc1bc46f8f6564c42ac4f4abf5e902cc9cb7

SHA256
f6a73aa4b515d1936a0a4dd381c2d90a97beeacc97b7bae63c4f65b0b95b3fd6

SHA512
e7a94aa53a736e5a9369d7073f1578fbb5b67784465a8a46f28a50718c14738d9ab8872d8c6bc06bf4fdf1cd458edbd825f73d5e2362f6362d417247afbcc5ef

Download Submit
C:\Windows\System\vRYYOdE.exe

Filesize
2.1MB

MD5
e21423c45a8f3f00830a54f9a64006f3

SHA1
a39de621587ca61483d43438f994c7005c990022

SHA256
0cc6c3f597d1c855af770a315abdff080129e4a3fe5f30d882fdfcb068c0c914

SHA512
13b724b536d9683b2d9ea65ece699411a9c021e81e0988288daca7e5548d5ec48308582531868c7aca157ebca91cc14f97d6d891a20524c227b8fada0bae66d3

Download Submit
C:\Windows\System\yOqPeik.exe

Filesize
2.1MB

MD5
f568da7d332b20dcbcf38b3d9a394ffc

SHA1
08d6e1daff17febe71145f507629519e5e34f32d

SHA256
9093030672e4de4d53f26f7bb9a2aabbe98400212137c4b806d8c524f807be01

SHA512
4a79416cefb291274a671c07f2e10f6fbd15296333ddf27bd836679141a48fa9fba14c5e8fa245b85532a3dd4ddb3dd8c45bc4010595d3e0be1be956e48580cf

Download Submit
memory/2664-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download