kpot | a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300

Analysis

max time kernel
137s
max time network
147s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13-08-2024 23:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
Size

2.1MB
MD5

ba3bf4cf20e73c5a302d508d122d9286
SHA1

74541042aa914eace1943240aa4446e6949d4abf
SHA256

a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300
SHA512

be59d056d2ecfac0fdc52be7354e22a963f68380ce09495db88c6a3fb909e5caf6687b67ee66788c502c9eeba43074c29005ed8ad6c76853a42498e065981f73
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9oztFwIi5aIwC+Agr6S/FYqOc2iVR:GemTLkNdfE0pZaQE

Score

10^/10

kpot xmrig miner stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 32 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001225f-2.dat	family_kpot
behavioral1/files/0x0007000000018741-9.dat	family_kpot
behavioral1/files/0x000700000001907c-8.dat	family_kpot
behavioral1/files/0x0007000000019080-17.dat	family_kpot
behavioral1/files/0x000600000001919c-21.dat	family_kpot
behavioral1/files/0x000700000001938e-28.dat	family_kpot
behavioral1/files/0x0005000000019d5c-40.dat	family_kpot
behavioral1/files/0x0005000000019f57-48.dat	family_kpot
behavioral1/files/0x000500000001a3e6-80.dat	family_kpot
behavioral1/files/0x000500000001a423-96.dat	family_kpot
behavioral1/files/0x000500000001a454-112.dat	family_kpot
behavioral1/files/0x000500000001a472-128.dat	family_kpot
behavioral1/files/0x000500000001a470-125.dat	family_kpot
behavioral1/files/0x000500000001a46d-120.dat	family_kpot
behavioral1/files/0x000500000001a463-116.dat	family_kpot
behavioral1/files/0x000500000001a452-108.dat	family_kpot
behavioral1/files/0x000500000001a447-104.dat	family_kpot
behavioral1/files/0x000500000001a445-101.dat	family_kpot
behavioral1/files/0x000500000001a3ed-92.dat	family_kpot
behavioral1/files/0x000500000001a3ea-88.dat	family_kpot
behavioral1/files/0x000500000001a3e8-85.dat	family_kpot
behavioral1/files/0x000500000001a3e4-77.dat	family_kpot
behavioral1/files/0x000500000001a2fc-72.dat	family_kpot
behavioral1/files/0x000500000001a2b9-68.dat	family_kpot
behavioral1/files/0x000500000001a05a-64.dat	family_kpot
behavioral1/files/0x000500000001a033-60.dat	family_kpot
behavioral1/files/0x000500000001a020-56.dat	family_kpot
behavioral1/files/0x0005000000019f71-52.dat	family_kpot
behavioral1/files/0x0005000000019d69-44.dat	family_kpot
behavioral1/files/0x0005000000019cfc-36.dat	family_kpot
behavioral1/files/0x0005000000019cd5-32.dat	family_kpot
behavioral1/files/0x00060000000191ad-24.dat	family_kpot

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000b00000001225f-2.dat	xmrig
behavioral1/files/0x0007000000018741-9.dat	xmrig
behavioral1/files/0x000700000001907c-8.dat	xmrig
behavioral1/files/0x0007000000019080-17.dat	xmrig
behavioral1/files/0x000600000001919c-21.dat	xmrig
behavioral1/files/0x000700000001938e-28.dat	xmrig
behavioral1/files/0x0005000000019d5c-40.dat	xmrig
behavioral1/files/0x0005000000019f57-48.dat	xmrig
behavioral1/files/0x000500000001a3e6-80.dat	xmrig
behavioral1/files/0x000500000001a423-96.dat	xmrig
behavioral1/files/0x000500000001a454-112.dat	xmrig
behavioral1/files/0x000500000001a472-128.dat	xmrig
behavioral1/files/0x000500000001a470-125.dat	xmrig
behavioral1/files/0x000500000001a46d-120.dat	xmrig
behavioral1/files/0x000500000001a463-116.dat	xmrig
behavioral1/files/0x000500000001a452-108.dat	xmrig
behavioral1/files/0x000500000001a447-104.dat	xmrig
behavioral1/files/0x000500000001a445-101.dat	xmrig
behavioral1/files/0x000500000001a3ed-92.dat	xmrig
behavioral1/files/0x000500000001a3ea-88.dat	xmrig
behavioral1/files/0x000500000001a3e8-85.dat	xmrig
behavioral1/files/0x000500000001a3e4-77.dat	xmrig
behavioral1/files/0x000500000001a2fc-72.dat	xmrig
behavioral1/files/0x000500000001a2b9-68.dat	xmrig
behavioral1/files/0x000500000001a05a-64.dat	xmrig
behavioral1/files/0x000500000001a033-60.dat	xmrig
behavioral1/files/0x000500000001a020-56.dat	xmrig
behavioral1/files/0x0005000000019f71-52.dat	xmrig
behavioral1/files/0x0005000000019d69-44.dat	xmrig
behavioral1/files/0x0005000000019cfc-36.dat	xmrig
behavioral1/files/0x0005000000019cd5-32.dat	xmrig
behavioral1/files/0x00060000000191ad-24.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2352	VgEwDsu.exe
2440	MWUnbTM.exe
2900	hYKjgDZ.exe
2252	WioSclA.exe
2636	SJmcEEd.exe
2652	UPJLdtt.exe
2692	TofiRZI.exe
2800	npHDQyT.exe
2696	DrARiSI.exe
2748	bzpwMiP.exe
2272	rCJGMMm.exe
2844	JtjyejB.exe
2936	zjGqwJF.exe
2680	mrliZjF.exe
2656	gaHSOFN.exe
2540	nevGXHZ.exe
2616	wpvFnzB.exe
3056	YRTKnMh.exe
3064	Ghfrsek.exe
1096	sSIkmVy.exe
1972	jyzZCUo.exe
2860	gWDMZtj.exe
2728	ZWLXYHg.exe
2056	StnWZMq.exe
2840	nwifMZP.exe
1624	FnYjsYF.exe
1460	OIWBHEt.exe
2140	mhFJCJv.exe
2928	cwzhAnf.exe
2084	DYVMWls.exe
2400	yXniuWh.exe
2512	AjYYeWU.exe
2088	FmDrGEm.exe
1728	LixNxuw.exe
2384	aqafVqc.exe
1088	wuvjiTR.exe
1112	jNPRwWZ.exe
2152	GIhVaFC.exe
328	USPakQS.exe
1536	myXSpgt.exe
1628	jVFgcHf.exe
2180	oUluMQQ.exe
1740	hcLUXur.exe
1752	KhSMtud.exe
1748	RccCgVA.exe
928	sZYVJdA.exe
688	iKYAdyz.exe
944	kBoEaNp.exe
1560	JpsGlRO.exe
1864	avKgNJe.exe
1544	YOJsfhh.exe
1860	NxCEcrx.exe
2120	QqsYipj.exe
2432	VtFodHd.exe
1784	sAqcOOI.exe
2948	oARdadY.exe
2112	fdcEURt.exe
2240	cWYmAVk.exe
624	XZILNFw.exe
1284	YsuFafH.exe
1800	EzfodeD.exe
2448	EDCTaAQ.exe
1876	aSmtkxZ.exe
1512	JNRkVPQ.exe

Loads dropped DLL 64 IoCs

pid	Process
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\kBoEaNp.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\rbaWEBz.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\pfMhctB.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\rCJGMMm.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\jVFgcHf.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\SQoZZTN.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\VLOUnSS.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\vxpSKMI.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\lOZqZEp.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\uRDLNWi.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\FIEHAMS.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\cWYmAVk.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\sNIrbIB.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\UGTYCyo.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\BPxOYil.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\dqlwKRu.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\bSRnDYB.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\myXSpgt.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\YOJsfhh.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\fTVeztW.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\dLLvGjh.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\USPakQS.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\gzMxJbY.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\HjENfeZ.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\cwtDTFb.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\yDVHXJo.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\StnWZMq.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\mhFJCJv.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\lkjzRGC.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\TmFkSRj.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\SrCNVPg.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\lyeTFOJ.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\FnYjsYF.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\FQaYZXH.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\hFsxFBi.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\yjnixTl.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\cLLMdWo.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\lDNtRDk.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\SDmHySH.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\NDZyahC.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\KIqHamM.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\oJWkSmg.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\AXzoWjG.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\GSXPrkS.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\HOOEsGq.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\aiIDrok.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\nPHfTqm.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\ZxVgtGY.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\LAdKoKT.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\NQWHcMV.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\LyvJSdu.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\eWTgmcz.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\fZhccBk.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\RynQRUf.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\ODCJkPb.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\dwwpPGJ.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\gENkiOr.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\fyKFCdW.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\DuMkNoT.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\nesTAtB.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\VgEwDsu.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\JNRkVPQ.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\sCGthVD.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
File created	C:\Windows\System\iQpXiKB.exe	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
Token: SeLockMemoryPrivilege	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 2352	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	32
PID 784 wrote to memory of 2352	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	32
PID 784 wrote to memory of 2352	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	32
PID 784 wrote to memory of 2440	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	33
PID 784 wrote to memory of 2440	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	33
PID 784 wrote to memory of 2440	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	33
PID 784 wrote to memory of 2900	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	34
PID 784 wrote to memory of 2900	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	34
PID 784 wrote to memory of 2900	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	34
PID 784 wrote to memory of 2252	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	35
PID 784 wrote to memory of 2252	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	35
PID 784 wrote to memory of 2252	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	35
PID 784 wrote to memory of 2636	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	36
PID 784 wrote to memory of 2636	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	36
PID 784 wrote to memory of 2636	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	36
PID 784 wrote to memory of 2652	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	37
PID 784 wrote to memory of 2652	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	37
PID 784 wrote to memory of 2652	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	37
PID 784 wrote to memory of 2692	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	38
PID 784 wrote to memory of 2692	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	38
PID 784 wrote to memory of 2692	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	38
PID 784 wrote to memory of 2800	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	39
PID 784 wrote to memory of 2800	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	39
PID 784 wrote to memory of 2800	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	39
PID 784 wrote to memory of 2696	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	40
PID 784 wrote to memory of 2696	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	40
PID 784 wrote to memory of 2696	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	40
PID 784 wrote to memory of 2748	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	41
PID 784 wrote to memory of 2748	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	41
PID 784 wrote to memory of 2748	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	41
PID 784 wrote to memory of 2272	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	42
PID 784 wrote to memory of 2272	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	42
PID 784 wrote to memory of 2272	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	42
PID 784 wrote to memory of 2844	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	43
PID 784 wrote to memory of 2844	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	43
PID 784 wrote to memory of 2844	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	43
PID 784 wrote to memory of 2936	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	44
PID 784 wrote to memory of 2936	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	44
PID 784 wrote to memory of 2936	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	44
PID 784 wrote to memory of 2680	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	45
PID 784 wrote to memory of 2680	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	45
PID 784 wrote to memory of 2680	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	45
PID 784 wrote to memory of 2656	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	46
PID 784 wrote to memory of 2656	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	46
PID 784 wrote to memory of 2656	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	46
PID 784 wrote to memory of 2540	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	47
PID 784 wrote to memory of 2540	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	47
PID 784 wrote to memory of 2540	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	47
PID 784 wrote to memory of 2616	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	48
PID 784 wrote to memory of 2616	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	48
PID 784 wrote to memory of 2616	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	48
PID 784 wrote to memory of 3056	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	49
PID 784 wrote to memory of 3056	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	49
PID 784 wrote to memory of 3056	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	49
PID 784 wrote to memory of 3064	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	50
PID 784 wrote to memory of 3064	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	50
PID 784 wrote to memory of 3064	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	50
PID 784 wrote to memory of 1096	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	51
PID 784 wrote to memory of 1096	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	51
PID 784 wrote to memory of 1096	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	51
PID 784 wrote to memory of 1972	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	52
PID 784 wrote to memory of 1972	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	52
PID 784 wrote to memory of 1972	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	52
PID 784 wrote to memory of 2860	784	a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe	53

C:\Users\Admin\AppData\Local\Temp\a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe
"C:\Users\Admin\AppData\Local\Temp\a37674e50c4984283f400511678319681f2b9ecf13e3bb8c6fdbcc4541061300.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:784
- C:\Windows\System\VgEwDsu.exe
  C:\Windows\System\VgEwDsu.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\MWUnbTM.exe
  C:\Windows\System\MWUnbTM.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\hYKjgDZ.exe
  C:\Windows\System\hYKjgDZ.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\WioSclA.exe
  C:\Windows\System\WioSclA.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\SJmcEEd.exe
  C:\Windows\System\SJmcEEd.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\UPJLdtt.exe
  C:\Windows\System\UPJLdtt.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\TofiRZI.exe
  C:\Windows\System\TofiRZI.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\npHDQyT.exe
  C:\Windows\System\npHDQyT.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\DrARiSI.exe
  C:\Windows\System\DrARiSI.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\bzpwMiP.exe
  C:\Windows\System\bzpwMiP.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\rCJGMMm.exe
  C:\Windows\System\rCJGMMm.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\JtjyejB.exe
  C:\Windows\System\JtjyejB.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\zjGqwJF.exe
  C:\Windows\System\zjGqwJF.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\mrliZjF.exe
  C:\Windows\System\mrliZjF.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\gaHSOFN.exe
  C:\Windows\System\gaHSOFN.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\nevGXHZ.exe
  C:\Windows\System\nevGXHZ.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\wpvFnzB.exe
  C:\Windows\System\wpvFnzB.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\YRTKnMh.exe
  C:\Windows\System\YRTKnMh.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\Ghfrsek.exe
  C:\Windows\System\Ghfrsek.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\sSIkmVy.exe
  C:\Windows\System\sSIkmVy.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\jyzZCUo.exe
  C:\Windows\System\jyzZCUo.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\gWDMZtj.exe
  C:\Windows\System\gWDMZtj.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\ZWLXYHg.exe
  C:\Windows\System\ZWLXYHg.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\StnWZMq.exe
  C:\Windows\System\StnWZMq.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\nwifMZP.exe
  C:\Windows\System\nwifMZP.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\FnYjsYF.exe
  C:\Windows\System\FnYjsYF.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\OIWBHEt.exe
  C:\Windows\System\OIWBHEt.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\mhFJCJv.exe
  C:\Windows\System\mhFJCJv.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\cwzhAnf.exe
  C:\Windows\System\cwzhAnf.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\DYVMWls.exe
  C:\Windows\System\DYVMWls.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\yXniuWh.exe
  C:\Windows\System\yXniuWh.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\AjYYeWU.exe
  C:\Windows\System\AjYYeWU.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\FmDrGEm.exe
  C:\Windows\System\FmDrGEm.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\LixNxuw.exe
  C:\Windows\System\LixNxuw.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\aqafVqc.exe
  C:\Windows\System\aqafVqc.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\wuvjiTR.exe
  C:\Windows\System\wuvjiTR.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\jNPRwWZ.exe
  C:\Windows\System\jNPRwWZ.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\GIhVaFC.exe
  C:\Windows\System\GIhVaFC.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\USPakQS.exe
  C:\Windows\System\USPakQS.exe
  2⤵
  - Executes dropped EXE
  PID:328
- C:\Windows\System\myXSpgt.exe
  C:\Windows\System\myXSpgt.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\jVFgcHf.exe
  C:\Windows\System\jVFgcHf.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\oUluMQQ.exe
  C:\Windows\System\oUluMQQ.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\hcLUXur.exe
  C:\Windows\System\hcLUXur.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\KhSMtud.exe
  C:\Windows\System\KhSMtud.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\RccCgVA.exe
  C:\Windows\System\RccCgVA.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\sZYVJdA.exe
  C:\Windows\System\sZYVJdA.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\iKYAdyz.exe
  C:\Windows\System\iKYAdyz.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\kBoEaNp.exe
  C:\Windows\System\kBoEaNp.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\JpsGlRO.exe
  C:\Windows\System\JpsGlRO.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\avKgNJe.exe
  C:\Windows\System\avKgNJe.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\YOJsfhh.exe
  C:\Windows\System\YOJsfhh.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\NxCEcrx.exe
  C:\Windows\System\NxCEcrx.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\QqsYipj.exe
  C:\Windows\System\QqsYipj.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\VtFodHd.exe
  C:\Windows\System\VtFodHd.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\sAqcOOI.exe
  C:\Windows\System\sAqcOOI.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\oARdadY.exe
  C:\Windows\System\oARdadY.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\fdcEURt.exe
  C:\Windows\System\fdcEURt.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\cWYmAVk.exe
  C:\Windows\System\cWYmAVk.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\XZILNFw.exe
  C:\Windows\System\XZILNFw.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\YsuFafH.exe
  C:\Windows\System\YsuFafH.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\EzfodeD.exe
  C:\Windows\System\EzfodeD.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\EDCTaAQ.exe
  C:\Windows\System\EDCTaAQ.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\aSmtkxZ.exe
  C:\Windows\System\aSmtkxZ.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\JNRkVPQ.exe
  C:\Windows\System\JNRkVPQ.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\uRDLNWi.exe
  C:\Windows\System\uRDLNWi.exe
  2⤵
  PID:896
- C:\Windows\System\FQaYZXH.exe
  C:\Windows\System\FQaYZXH.exe
  2⤵
  PID:1288
- C:\Windows\System\rGArhMC.exe
  C:\Windows\System\rGArhMC.exe
  2⤵
  PID:316
- C:\Windows\System\XXQhHPC.exe
  C:\Windows\System\XXQhHPC.exe
  2⤵
  PID:2772
- C:\Windows\System\ktSdBcK.exe
  C:\Windows\System\ktSdBcK.exe
  2⤵
  PID:1620
- C:\Windows\System\mpbETrX.exe
  C:\Windows\System\mpbETrX.exe
  2⤵
  PID:1724
- C:\Windows\System\kooGpQv.exe
  C:\Windows\System\kooGpQv.exe
  2⤵
  PID:2780
- C:\Windows\System\zTmENub.exe
  C:\Windows\System\zTmENub.exe
  2⤵
  PID:2136
- C:\Windows\System\lSBYmSm.exe
  C:\Windows\System\lSBYmSm.exe
  2⤵
  PID:2792
- C:\Windows\System\SXyCUxD.exe
  C:\Windows\System\SXyCUxD.exe
  2⤵
  PID:2764
- C:\Windows\System\frRdXZc.exe
  C:\Windows\System\frRdXZc.exe
  2⤵
  PID:2660
- C:\Windows\System\TZmuuxo.exe
  C:\Windows\System\TZmuuxo.exe
  2⤵
  PID:2568
- C:\Windows\System\iyjiuzC.exe
  C:\Windows\System\iyjiuzC.exe
  2⤵
  PID:1160
- C:\Windows\System\VZVZBiU.exe
  C:\Windows\System\VZVZBiU.exe
  2⤵
  PID:292
- C:\Windows\System\gKUUuvn.exe
  C:\Windows\System\gKUUuvn.exe
  2⤵
  PID:1684
- C:\Windows\System\fZhccBk.exe
  C:\Windows\System\fZhccBk.exe
  2⤵
  PID:1964
- C:\Windows\System\SQoZZTN.exe
  C:\Windows\System\SQoZZTN.exe
  2⤵
  PID:2588
- C:\Windows\System\mNDQrXT.exe
  C:\Windows\System\mNDQrXT.exe
  2⤵
  PID:2368
- C:\Windows\System\wPcbKES.exe
  C:\Windows\System\wPcbKES.exe
  2⤵
  PID:1916
- C:\Windows\System\WHFKvwu.exe
  C:\Windows\System\WHFKvwu.exe
  2⤵
  PID:2932
- C:\Windows\System\lkjzRGC.exe
  C:\Windows\System\lkjzRGC.exe
  2⤵
  PID:2220
- C:\Windows\System\lebFwpq.exe
  C:\Windows\System\lebFwpq.exe
  2⤵
  PID:2336
- C:\Windows\System\BVPZZsI.exe
  C:\Windows\System\BVPZZsI.exe
  2⤵
  PID:3040
- C:\Windows\System\yhrFgbJ.exe
  C:\Windows\System\yhrFgbJ.exe
  2⤵
  PID:1484
- C:\Windows\System\bajoScn.exe
  C:\Windows\System\bajoScn.exe
  2⤵
  PID:2004
- C:\Windows\System\mifIxuZ.exe
  C:\Windows\System\mifIxuZ.exe
  2⤵
  PID:1400
- C:\Windows\System\EZjLuxP.exe
  C:\Windows\System\EZjLuxP.exe
  2⤵
  PID:1720
- C:\Windows\System\TEYXDOL.exe
  C:\Windows\System\TEYXDOL.exe
  2⤵
  PID:2028
- C:\Windows\System\HhhiiZP.exe
  C:\Windows\System\HhhiiZP.exe
  2⤵
  PID:2032
- C:\Windows\System\lCbxMfI.exe
  C:\Windows\System\lCbxMfI.exe
  2⤵
  PID:2976
- C:\Windows\System\EpTYSmw.exe
  C:\Windows\System\EpTYSmw.exe
  2⤵
  PID:1352
- C:\Windows\System\DoOjZRx.exe
  C:\Windows\System\DoOjZRx.exe
  2⤵
  PID:1680
- C:\Windows\System\sNIrbIB.exe
  C:\Windows\System\sNIrbIB.exe
  2⤵
  PID:3024
- C:\Windows\System\PiErOej.exe
  C:\Windows\System\PiErOej.exe
  2⤵
  PID:2996
- C:\Windows\System\AXzoWjG.exe
  C:\Windows\System\AXzoWjG.exe
  2⤵
  PID:3012
- C:\Windows\System\Qojrjoq.exe
  C:\Windows\System\Qojrjoq.exe
  2⤵
  PID:2268
- C:\Windows\System\rqlOLLs.exe
  C:\Windows\System\rqlOLLs.exe
  2⤵
  PID:552
- C:\Windows\System\LAdKoKT.exe
  C:\Windows\System\LAdKoKT.exe
  2⤵
  PID:768
- C:\Windows\System\VSJxFTC.exe
  C:\Windows\System\VSJxFTC.exe
  2⤵
  PID:2200
- C:\Windows\System\ZbiENwZ.exe
  C:\Windows\System\ZbiENwZ.exe
  2⤵
  PID:1580
- C:\Windows\System\QYfeEnn.exe
  C:\Windows\System\QYfeEnn.exe
  2⤵
  PID:2016
- C:\Windows\System\FIEHAMS.exe
  C:\Windows\System\FIEHAMS.exe
  2⤵
  PID:2672
- C:\Windows\System\fjtOslX.exe
  C:\Windows\System\fjtOslX.exe
  2⤵
  PID:2676
- C:\Windows\System\YhueikF.exe
  C:\Windows\System\YhueikF.exe
  2⤵
  PID:2632
- C:\Windows\System\edZeHoJ.exe
  C:\Windows\System\edZeHoJ.exe
  2⤵
  PID:2832
- C:\Windows\System\jEIGxdk.exe
  C:\Windows\System\jEIGxdk.exe
  2⤵
  PID:2024
- C:\Windows\System\kkEaYjN.exe
  C:\Windows\System\kkEaYjN.exe
  2⤵
  PID:1948
- C:\Windows\System\RYQxlki.exe
  C:\Windows\System\RYQxlki.exe
  2⤵
  PID:2424
- C:\Windows\System\GSXPrkS.exe
  C:\Windows\System\GSXPrkS.exe
  2⤵
  PID:968
- C:\Windows\System\vydQKUA.exe
  C:\Windows\System\vydQKUA.exe
  2⤵
  PID:3084
- C:\Windows\System\lDNtRDk.exe
  C:\Windows\System\lDNtRDk.exe
  2⤵
  PID:3100
- C:\Windows\System\NQWHcMV.exe
  C:\Windows\System\NQWHcMV.exe
  2⤵
  PID:3116
- C:\Windows\System\HMCBfNZ.exe
  C:\Windows\System\HMCBfNZ.exe
  2⤵
  PID:3132
- C:\Windows\System\UGAlXSn.exe
  C:\Windows\System\UGAlXSn.exe
  2⤵
  PID:3148
- C:\Windows\System\YryEBgx.exe
  C:\Windows\System\YryEBgx.exe
  2⤵
  PID:3164
- C:\Windows\System\gzMxJbY.exe
  C:\Windows\System\gzMxJbY.exe
  2⤵
  PID:3180
- C:\Windows\System\UexvGIz.exe
  C:\Windows\System\UexvGIz.exe
  2⤵
  PID:3196
- C:\Windows\System\KOcODlr.exe
  C:\Windows\System\KOcODlr.exe
  2⤵
  PID:3212
- C:\Windows\System\mHnMSPd.exe
  C:\Windows\System\mHnMSPd.exe
  2⤵
  PID:3228
- C:\Windows\System\MqVqRkZ.exe
  C:\Windows\System\MqVqRkZ.exe
  2⤵
  PID:3244
- C:\Windows\System\PGhKzsv.exe
  C:\Windows\System\PGhKzsv.exe
  2⤵
  PID:3260
- C:\Windows\System\dQRuMbz.exe
  C:\Windows\System\dQRuMbz.exe
  2⤵
  PID:3276
- C:\Windows\System\GlFAolH.exe
  C:\Windows\System\GlFAolH.exe
  2⤵
  PID:3292
- C:\Windows\System\RXFCWIH.exe
  C:\Windows\System\RXFCWIH.exe
  2⤵
  PID:3308
- C:\Windows\System\qBirhlV.exe
  C:\Windows\System\qBirhlV.exe
  2⤵
  PID:3324
- C:\Windows\System\BTNDyrq.exe
  C:\Windows\System\BTNDyrq.exe
  2⤵
  PID:3340
- C:\Windows\System\UmGSZBs.exe
  C:\Windows\System\UmGSZBs.exe
  2⤵
  PID:3356
- C:\Windows\System\VLOUnSS.exe
  C:\Windows\System\VLOUnSS.exe
  2⤵
  PID:3372
- C:\Windows\System\AjexSEU.exe
  C:\Windows\System\AjexSEU.exe
  2⤵
  PID:3388
- C:\Windows\System\VPRscSc.exe
  C:\Windows\System\VPRscSc.exe
  2⤵
  PID:3404
- C:\Windows\System\pTivfTc.exe
  C:\Windows\System\pTivfTc.exe
  2⤵
  PID:3420
- C:\Windows\System\FaggiuM.exe
  C:\Windows\System\FaggiuM.exe
  2⤵
  PID:3436
- C:\Windows\System\GAfoDvk.exe
  C:\Windows\System\GAfoDvk.exe
  2⤵
  PID:3452
- C:\Windows\System\EwSDuXY.exe
  C:\Windows\System\EwSDuXY.exe
  2⤵
  PID:3468
- C:\Windows\System\lvDTXKT.exe
  C:\Windows\System\lvDTXKT.exe
  2⤵
  PID:3484
- C:\Windows\System\JZbaYce.exe
  C:\Windows\System\JZbaYce.exe
  2⤵
  PID:3500
- C:\Windows\System\nCTrNar.exe
  C:\Windows\System\nCTrNar.exe
  2⤵
  PID:3516
- C:\Windows\System\rgagGeG.exe
  C:\Windows\System\rgagGeG.exe
  2⤵
  PID:3532
- C:\Windows\System\EdLGcvs.exe
  C:\Windows\System\EdLGcvs.exe
  2⤵
  PID:3548
- C:\Windows\System\UGTYCyo.exe
  C:\Windows\System\UGTYCyo.exe
  2⤵
  PID:3564
- C:\Windows\System\dOBbuRt.exe
  C:\Windows\System\dOBbuRt.exe
  2⤵
  PID:3580
- C:\Windows\System\eXSVEyy.exe
  C:\Windows\System\eXSVEyy.exe
  2⤵
  PID:3596
- C:\Windows\System\HjENfeZ.exe
  C:\Windows\System\HjENfeZ.exe
  2⤵
  PID:3612
- C:\Windows\System\HATlWAN.exe
  C:\Windows\System\HATlWAN.exe
  2⤵
  PID:3628
- C:\Windows\System\BfWwsDH.exe
  C:\Windows\System\BfWwsDH.exe
  2⤵
  PID:3644
- C:\Windows\System\NWcQRzX.exe
  C:\Windows\System\NWcQRzX.exe
  2⤵
  PID:3660
- C:\Windows\System\RnscdvD.exe
  C:\Windows\System\RnscdvD.exe
  2⤵
  PID:3676
- C:\Windows\System\BPxOYil.exe
  C:\Windows\System\BPxOYil.exe
  2⤵
  PID:3692
- C:\Windows\System\YLoutVi.exe
  C:\Windows\System\YLoutVi.exe
  2⤵
  PID:3708
- C:\Windows\System\dqlwKRu.exe
  C:\Windows\System\dqlwKRu.exe
  2⤵
  PID:3724
- C:\Windows\System\gvYfRxK.exe
  C:\Windows\System\gvYfRxK.exe
  2⤵
  PID:3740
- C:\Windows\System\grMxHBn.exe
  C:\Windows\System\grMxHBn.exe
  2⤵
  PID:3756
- C:\Windows\System\cnqOMOM.exe
  C:\Windows\System\cnqOMOM.exe
  2⤵
  PID:3772
- C:\Windows\System\uHrCPXw.exe
  C:\Windows\System\uHrCPXw.exe
  2⤵
  PID:3788
- C:\Windows\System\qqcAZEG.exe
  C:\Windows\System\qqcAZEG.exe
  2⤵
  PID:3804
- C:\Windows\System\RynQRUf.exe
  C:\Windows\System\RynQRUf.exe
  2⤵
  PID:3820
- C:\Windows\System\KbSsmCQ.exe
  C:\Windows\System\KbSsmCQ.exe
  2⤵
  PID:3836
- C:\Windows\System\OIpsIar.exe
  C:\Windows\System\OIpsIar.exe
  2⤵
  PID:3852
- C:\Windows\System\EOYwTgw.exe
  C:\Windows\System\EOYwTgw.exe
  2⤵
  PID:3868
- C:\Windows\System\nPHfTqm.exe
  C:\Windows\System\nPHfTqm.exe
  2⤵
  PID:3884
- C:\Windows\System\oIalapg.exe
  C:\Windows\System\oIalapg.exe
  2⤵
  PID:3900
- C:\Windows\System\wvnLMAk.exe
  C:\Windows\System\wvnLMAk.exe
  2⤵
  PID:3916
- C:\Windows\System\uljMcUZ.exe
  C:\Windows\System\uljMcUZ.exe
  2⤵
  PID:3932
- C:\Windows\System\alLVqTv.exe
  C:\Windows\System\alLVqTv.exe
  2⤵
  PID:3948
- C:\Windows\System\yauYzph.exe
  C:\Windows\System\yauYzph.exe
  2⤵
  PID:3964
- C:\Windows\System\bSRnDYB.exe
  C:\Windows\System\bSRnDYB.exe
  2⤵
  PID:3980
- C:\Windows\System\KTxPqXs.exe
  C:\Windows\System\KTxPqXs.exe
  2⤵
  PID:3996
- C:\Windows\System\ShbdJcN.exe
  C:\Windows\System\ShbdJcN.exe
  2⤵
  PID:4012
- C:\Windows\System\OIJlGiI.exe
  C:\Windows\System\OIJlGiI.exe
  2⤵
  PID:4028
- C:\Windows\System\JWlkQCg.exe
  C:\Windows\System\JWlkQCg.exe
  2⤵
  PID:4044
- C:\Windows\System\KhBIdeC.exe
  C:\Windows\System\KhBIdeC.exe
  2⤵
  PID:4060
- C:\Windows\System\IKnpdbd.exe
  C:\Windows\System\IKnpdbd.exe
  2⤵
  PID:4076
- C:\Windows\System\LyvJSdu.exe
  C:\Windows\System\LyvJSdu.exe
  2⤵
  PID:4092
- C:\Windows\System\eTkCrLf.exe
  C:\Windows\System\eTkCrLf.exe
  2⤵
  PID:408
- C:\Windows\System\TmFkSRj.exe
  C:\Windows\System\TmFkSRj.exe
  2⤵
  PID:1872
- C:\Windows\System\RmPyKfD.exe
  C:\Windows\System\RmPyKfD.exe
  2⤵
  PID:1756
- C:\Windows\System\oADdcEM.exe
  C:\Windows\System\oADdcEM.exe
  2⤵
  PID:652
- C:\Windows\System\uMEMITZ.exe
  C:\Windows\System\uMEMITZ.exe
  2⤵
  PID:3000
- C:\Windows\System\ElwxKAC.exe
  C:\Windows\System\ElwxKAC.exe
  2⤵
  PID:1060
- C:\Windows\System\ekKcNmF.exe
  C:\Windows\System\ekKcNmF.exe
  2⤵
  PID:900
- C:\Windows\System\UHoTGaX.exe
  C:\Windows\System\UHoTGaX.exe
  2⤵
  PID:2472
- C:\Windows\System\STUFDZS.exe
  C:\Windows\System\STUFDZS.exe
  2⤵
  PID:1612
- C:\Windows\System\HOOEsGq.exe
  C:\Windows\System\HOOEsGq.exe
  2⤵
  PID:2788
- C:\Windows\System\pVpeWce.exe
  C:\Windows\System\pVpeWce.exe
  2⤵
  PID:1248
- C:\Windows\System\DwFbhRl.exe
  C:\Windows\System\DwFbhRl.exe
  2⤵
  PID:2360
- C:\Windows\System\LZSWoUo.exe
  C:\Windows\System\LZSWoUo.exe
  2⤵
  PID:1252
- C:\Windows\System\iQpXiKB.exe
  C:\Windows\System\iQpXiKB.exe
  2⤵
  PID:3080
- C:\Windows\System\XJAqYFs.exe
  C:\Windows\System\XJAqYFs.exe
  2⤵
  PID:3128
- C:\Windows\System\TpHIzab.exe
  C:\Windows\System\TpHIzab.exe
  2⤵
  PID:3144
- C:\Windows\System\ODCJkPb.exe
  C:\Windows\System\ODCJkPb.exe
  2⤵
  PID:3176
- C:\Windows\System\vPazuVT.exe
  C:\Windows\System\vPazuVT.exe
  2⤵
  PID:3208
- C:\Windows\System\vnFxisx.exe
  C:\Windows\System\vnFxisx.exe
  2⤵
  PID:3240
- C:\Windows\System\CmtsHjP.exe
  C:\Windows\System\CmtsHjP.exe
  2⤵
  PID:3288
- C:\Windows\System\UMJuTYY.exe
  C:\Windows\System\UMJuTYY.exe
  2⤵
  PID:3320
- C:\Windows\System\ajxYfBI.exe
  C:\Windows\System\ajxYfBI.exe
  2⤵
  PID:3336
- C:\Windows\System\NDZyahC.exe
  C:\Windows\System\NDZyahC.exe
  2⤵
  PID:3384
- C:\Windows\System\YNvYLuk.exe
  C:\Windows\System\YNvYLuk.exe
  2⤵
  PID:3416
- C:\Windows\System\fTVeztW.exe
  C:\Windows\System\fTVeztW.exe
  2⤵
  PID:3448
- C:\Windows\System\SDmHySH.exe
  C:\Windows\System\SDmHySH.exe
  2⤵
  PID:3480
- C:\Windows\System\joMXUVz.exe
  C:\Windows\System\joMXUVz.exe
  2⤵
  PID:3512
- C:\Windows\System\lveMAku.exe
  C:\Windows\System\lveMAku.exe
  2⤵
  PID:3544
- C:\Windows\System\eWTgmcz.exe
  C:\Windows\System\eWTgmcz.exe
  2⤵
  PID:3576
- C:\Windows\System\PobxUUt.exe
  C:\Windows\System\PobxUUt.exe
  2⤵
  PID:3608
- C:\Windows\System\gUQEHHN.exe
  C:\Windows\System\gUQEHHN.exe
  2⤵
  PID:3640
- C:\Windows\System\cckNEUQ.exe
  C:\Windows\System\cckNEUQ.exe
  2⤵
  PID:3672
- C:\Windows\System\oiMxBUd.exe
  C:\Windows\System\oiMxBUd.exe
  2⤵
  PID:3704
- C:\Windows\System\NBTClTW.exe
  C:\Windows\System\NBTClTW.exe
  2⤵
  PID:3736
- C:\Windows\System\FsSBreT.exe
  C:\Windows\System\FsSBreT.exe
  2⤵
  PID:3752
- C:\Windows\System\bAZzjUU.exe
  C:\Windows\System\bAZzjUU.exe
  2⤵
  PID:3800
- C:\Windows\System\mZemMfE.exe
  C:\Windows\System\mZemMfE.exe
  2⤵
  PID:3816
- C:\Windows\System\VBqcTUt.exe
  C:\Windows\System\VBqcTUt.exe
  2⤵
  PID:3864
- C:\Windows\System\SOrmccL.exe
  C:\Windows\System\SOrmccL.exe
  2⤵
  PID:3880
- C:\Windows\System\ZbLoqTA.exe
  C:\Windows\System\ZbLoqTA.exe
  2⤵
  PID:3912
- C:\Windows\System\eQymUWw.exe
  C:\Windows\System\eQymUWw.exe
  2⤵
  PID:3956
- C:\Windows\System\GEoOtlS.exe
  C:\Windows\System\GEoOtlS.exe
  2⤵
  PID:3976
- C:\Windows\System\hFsxFBi.exe
  C:\Windows\System\hFsxFBi.exe
  2⤵
  PID:4020
- C:\Windows\System\kXeMqru.exe
  C:\Windows\System\kXeMqru.exe
  2⤵
  PID:4040
- C:\Windows\System\onpAshX.exe
  C:\Windows\System\onpAshX.exe
  2⤵
  PID:4088
- C:\Windows\System\QPGfyEL.exe
  C:\Windows\System\QPGfyEL.exe
  2⤵
  PID:1360
- C:\Windows\System\MpgMsvm.exe
  C:\Windows\System\MpgMsvm.exe
  2⤵
  PID:2216
- C:\Windows\System\hVtxLKC.exe
  C:\Windows\System\hVtxLKC.exe
  2⤵
  PID:1804
- C:\Windows\System\KIqHamM.exe
  C:\Windows\System\KIqHamM.exe
  2⤵
  PID:1828
- C:\Windows\System\aiIDrok.exe
  C:\Windows\System\aiIDrok.exe
  2⤵
  PID:760
- C:\Windows\System\LNpPxPJ.exe
  C:\Windows\System\LNpPxPJ.exe
  2⤵
  PID:2564
- C:\Windows\System\PAqihSW.exe
  C:\Windows\System\PAqihSW.exe
  2⤵
  PID:2372
- C:\Windows\System\ZqJZWQL.exe
  C:\Windows\System\ZqJZWQL.exe
  2⤵
  PID:3124
- C:\Windows\System\vIDghSL.exe
  C:\Windows\System\vIDghSL.exe
  2⤵
  PID:3188
- C:\Windows\System\dwwpPGJ.exe
  C:\Windows\System\dwwpPGJ.exe
  2⤵
  PID:3252
- C:\Windows\System\rbaWEBz.exe
  C:\Windows\System\rbaWEBz.exe
  2⤵
  PID:3316
- C:\Windows\System\UuWuCwG.exe
  C:\Windows\System\UuWuCwG.exe
  2⤵
  PID:3380
- C:\Windows\System\cwtDTFb.exe
  C:\Windows\System\cwtDTFb.exe
  2⤵
  PID:3444
- C:\Windows\System\gENkiOr.exe
  C:\Windows\System\gENkiOr.exe
  2⤵
  PID:3508
- C:\Windows\System\EkPDMbb.exe
  C:\Windows\System\EkPDMbb.exe
  2⤵
  PID:3572
- C:\Windows\System\oboeppm.exe
  C:\Windows\System\oboeppm.exe
  2⤵
  PID:1976
- C:\Windows\System\cBcXtCe.exe
  C:\Windows\System\cBcXtCe.exe
  2⤵
  PID:3668
- C:\Windows\System\ZxVgtGY.exe
  C:\Windows\System\ZxVgtGY.exe
  2⤵
  PID:3700
- C:\Windows\System\ENlbsbE.exe
  C:\Windows\System\ENlbsbE.exe
  2⤵
  PID:3796
- C:\Windows\System\vNxbwdY.exe
  C:\Windows\System\vNxbwdY.exe
  2⤵
  PID:3860
- C:\Windows\System\YDUGEis.exe
  C:\Windows\System\YDUGEis.exe
  2⤵
  PID:3876
- C:\Windows\System\BEdauUR.exe
  C:\Windows\System\BEdauUR.exe
  2⤵
  PID:3988
- C:\Windows\System\PdLPpjv.exe
  C:\Windows\System\PdLPpjv.exe
  2⤵
  PID:4008
- C:\Windows\System\tdwXmVx.exe
  C:\Windows\System\tdwXmVx.exe
  2⤵
  PID:4084
- C:\Windows\System\cHjHxuG.exe
  C:\Windows\System\cHjHxuG.exe
  2⤵
  PID:1932
- C:\Windows\System\WaEldcT.exe
  C:\Windows\System\WaEldcT.exe
  2⤵
  PID:560
- C:\Windows\System\NrXkthX.exe
  C:\Windows\System\NrXkthX.exe
  2⤵
  PID:2184
- C:\Windows\System\NGLympX.exe
  C:\Windows\System\NGLympX.exe
  2⤵
  PID:3096
- C:\Windows\System\yjnixTl.exe
  C:\Windows\System\yjnixTl.exe
  2⤵
  PID:3224
- C:\Windows\System\jTOwEZX.exe
  C:\Windows\System\jTOwEZX.exe
  2⤵
  PID:4104
- C:\Windows\System\yDVHXJo.exe
  C:\Windows\System\yDVHXJo.exe
  2⤵
  PID:4120
- C:\Windows\System\tKouaSA.exe
  C:\Windows\System\tKouaSA.exe
  2⤵
  PID:4136
- C:\Windows\System\KfpYSoS.exe
  C:\Windows\System\KfpYSoS.exe
  2⤵
  PID:4152
- C:\Windows\System\HCyWiii.exe
  C:\Windows\System\HCyWiii.exe
  2⤵
  PID:4168
- C:\Windows\System\opEOfMc.exe
  C:\Windows\System\opEOfMc.exe
  2⤵
  PID:4184
- C:\Windows\System\qyemiaQ.exe
  C:\Windows\System\qyemiaQ.exe
  2⤵
  PID:4200
- C:\Windows\System\ZuGbbtD.exe
  C:\Windows\System\ZuGbbtD.exe
  2⤵
  PID:4216
- C:\Windows\System\tjemfjA.exe
  C:\Windows\System\tjemfjA.exe
  2⤵
  PID:4232
- C:\Windows\System\XvmpEqT.exe
  C:\Windows\System\XvmpEqT.exe
  2⤵
  PID:4248
- C:\Windows\System\rNSswij.exe
  C:\Windows\System\rNSswij.exe
  2⤵
  PID:4264
- C:\Windows\System\vxpSKMI.exe
  C:\Windows\System\vxpSKMI.exe
  2⤵
  PID:4280
- C:\Windows\System\XRVLHzx.exe
  C:\Windows\System\XRVLHzx.exe
  2⤵
  PID:4296
- C:\Windows\System\JrDhJGP.exe
  C:\Windows\System\JrDhJGP.exe
  2⤵
  PID:4312
- C:\Windows\System\pjsoIad.exe
  C:\Windows\System\pjsoIad.exe
  2⤵
  PID:4328
- C:\Windows\System\hGPKyJo.exe
  C:\Windows\System\hGPKyJo.exe
  2⤵
  PID:4344
- C:\Windows\System\trzJbrD.exe
  C:\Windows\System\trzJbrD.exe
  2⤵
  PID:4360
- C:\Windows\System\SLZLrJS.exe
  C:\Windows\System\SLZLrJS.exe
  2⤵
  PID:4376
- C:\Windows\System\sbCFYIz.exe
  C:\Windows\System\sbCFYIz.exe
  2⤵
  PID:4392
- C:\Windows\System\PGUsPzx.exe
  C:\Windows\System\PGUsPzx.exe
  2⤵
  PID:4408
- C:\Windows\System\WUguVPX.exe
  C:\Windows\System\WUguVPX.exe
  2⤵
  PID:4424
- C:\Windows\System\LKUHRtC.exe
  C:\Windows\System\LKUHRtC.exe
  2⤵
  PID:4440
- C:\Windows\System\AfprqXu.exe
  C:\Windows\System\AfprqXu.exe
  2⤵
  PID:4456
- C:\Windows\System\sYqWXsH.exe
  C:\Windows\System\sYqWXsH.exe
  2⤵
  PID:4472
- C:\Windows\System\PrjBDRF.exe
  C:\Windows\System\PrjBDRF.exe
  2⤵
  PID:4488
- C:\Windows\System\fyKFCdW.exe
  C:\Windows\System\fyKFCdW.exe
  2⤵
  PID:4504
- C:\Windows\System\bjWONAQ.exe
  C:\Windows\System\bjWONAQ.exe
  2⤵
  PID:4520
- C:\Windows\System\FDeMPmD.exe
  C:\Windows\System\FDeMPmD.exe
  2⤵
  PID:4536
- C:\Windows\System\pfMhctB.exe
  C:\Windows\System\pfMhctB.exe
  2⤵
  PID:4552
- C:\Windows\System\dLLvGjh.exe
  C:\Windows\System\dLLvGjh.exe
  2⤵
  PID:4568
- C:\Windows\System\VQKiNAP.exe
  C:\Windows\System\VQKiNAP.exe
  2⤵
  PID:4584
- C:\Windows\System\HZfIsZn.exe
  C:\Windows\System\HZfIsZn.exe
  2⤵
  PID:4600
- C:\Windows\System\SrCNVPg.exe
  C:\Windows\System\SrCNVPg.exe
  2⤵
  PID:4616
- C:\Windows\System\thxBEHp.exe
  C:\Windows\System\thxBEHp.exe
  2⤵
  PID:4632
- C:\Windows\System\lYPLvEJ.exe
  C:\Windows\System\lYPLvEJ.exe
  2⤵
  PID:4648
- C:\Windows\System\WzqgJRI.exe
  C:\Windows\System\WzqgJRI.exe
  2⤵
  PID:4664
- C:\Windows\System\lPzLQaK.exe
  C:\Windows\System\lPzLQaK.exe
  2⤵
  PID:4680
- C:\Windows\System\sqRjKXT.exe
  C:\Windows\System\sqRjKXT.exe
  2⤵
  PID:4696
- C:\Windows\System\BlyFkVW.exe
  C:\Windows\System\BlyFkVW.exe
  2⤵
  PID:4712
- C:\Windows\System\iwzcoMt.exe
  C:\Windows\System\iwzcoMt.exe
  2⤵
  PID:4728
- C:\Windows\System\DuMkNoT.exe
  C:\Windows\System\DuMkNoT.exe
  2⤵
  PID:4744
- C:\Windows\System\lyeTFOJ.exe
  C:\Windows\System\lyeTFOJ.exe
  2⤵
  PID:4760
- C:\Windows\System\SBBEWKa.exe
  C:\Windows\System\SBBEWKa.exe
  2⤵
  PID:4776
- C:\Windows\System\cLLMdWo.exe
  C:\Windows\System\cLLMdWo.exe
  2⤵
  PID:4792
- C:\Windows\System\nesTAtB.exe
  C:\Windows\System\nesTAtB.exe
  2⤵
  PID:4808
- C:\Windows\System\xULxres.exe
  C:\Windows\System\xULxres.exe
  2⤵
  PID:4824
- C:\Windows\System\ffqIVXv.exe
  C:\Windows\System\ffqIVXv.exe
  2⤵
  PID:4840
- C:\Windows\System\QgLlZzL.exe
  C:\Windows\System\QgLlZzL.exe
  2⤵
  PID:4856
- C:\Windows\System\aPUIuZp.exe
  C:\Windows\System\aPUIuZp.exe
  2⤵
  PID:4872
- C:\Windows\System\MvZgcJQ.exe
  C:\Windows\System\MvZgcJQ.exe
  2⤵
  PID:4888
- C:\Windows\System\LxTVYew.exe
  C:\Windows\System\LxTVYew.exe
  2⤵
  PID:4904
- C:\Windows\System\CCInCfV.exe
  C:\Windows\System\CCInCfV.exe
  2⤵
  PID:4920
- C:\Windows\System\fWPxoIB.exe
  C:\Windows\System\fWPxoIB.exe
  2⤵
  PID:4936
- C:\Windows\System\xFHOvKa.exe
  C:\Windows\System\xFHOvKa.exe
  2⤵
  PID:4952
- C:\Windows\System\ecGGtXl.exe
  C:\Windows\System\ecGGtXl.exe
  2⤵
  PID:4968
- C:\Windows\System\vlafqny.exe
  C:\Windows\System\vlafqny.exe
  2⤵
  PID:4984
- C:\Windows\System\ZWYGpWq.exe
  C:\Windows\System\ZWYGpWq.exe
  2⤵
  PID:5000
- C:\Windows\System\oJWkSmg.exe
  C:\Windows\System\oJWkSmg.exe
  2⤵
  PID:5016
- C:\Windows\System\oJifaGI.exe
  C:\Windows\System\oJifaGI.exe
  2⤵
  PID:5032
- C:\Windows\System\xkbOGBg.exe
  C:\Windows\System\xkbOGBg.exe
  2⤵
  PID:5048
- C:\Windows\System\DFwVRZi.exe
  C:\Windows\System\DFwVRZi.exe
  2⤵
  PID:5064
- C:\Windows\System\CbzFmti.exe
  C:\Windows\System\CbzFmti.exe
  2⤵
  PID:5080
- C:\Windows\System\lOZqZEp.exe
  C:\Windows\System\lOZqZEp.exe
  2⤵
  PID:5096
- C:\Windows\System\zKUfbtF.exe
  C:\Windows\System\zKUfbtF.exe
  2⤵
  PID:5112
- C:\Windows\System\oRhCVHe.exe
  C:\Windows\System\oRhCVHe.exe
  2⤵
  PID:1820
- C:\Windows\System\KLAFxdz.exe
  C:\Windows\System\KLAFxdz.exe
  2⤵
  PID:3528
- C:\Windows\System\eCmzbqI.exe
  C:\Windows\System\eCmzbqI.exe
  2⤵
  PID:3604
- C:\Windows\System\ShzcYsG.exe
  C:\Windows\System\ShzcYsG.exe
  2⤵
  PID:3764
- C:\Windows\System\KArIzSR.exe
  C:\Windows\System\KArIzSR.exe
  2⤵
  PID:3908
- C:\Windows\System\RAfAxId.exe
  C:\Windows\System\RAfAxId.exe
  2⤵
  PID:4052
- C:\Windows\System\sCGthVD.exe
  C:\Windows\System\sCGthVD.exe
  2⤵
  PID:2516
- C:\Windows\System\QLMlUFI.exe
  C:\Windows\System\QLMlUFI.exe
  2⤵
  PID:1324
- C:\Windows\System\XyrjijK.exe
  C:\Windows\System\XyrjijK.exe
  2⤵
  PID:3160
- C:\Windows\System\aybBqEY.exe
  C:\Windows\System\aybBqEY.exe
  2⤵
  PID:3400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AjYYeWU.exe

Filesize
2.1MB

MD5
84380eab47d0511eb06905fc34b16760

SHA1
6175ba9bae11cb6f66b66d13aaa8a3f19f97ec5d

SHA256
d229189d1fd3ea9643d9cebf5669ee107f690074ad1198b68f775f814e608fe1

SHA512
8cfa00a17a3cdcebc5ae9dbf085d265c3ae0d3430cee27aa785007e01bcfd889380967649c744a85d220fa752578fd206bfbcc49191f7532f65cb692dd5a3ed7

Download Submit
C:\Windows\system\DYVMWls.exe

Filesize
2.1MB

MD5
7d5101c305ac90b211cc94cf370a7119

SHA1
81927d97df5d24f618a9bf6b13b2742b60fad849

SHA256
fa40cbdf6a854ca200f313beeb3de1c4f96e45f5e888b02b712388af649a9973

SHA512
53bf53fc2e8a5e0b7d16654b658b531bdb1c480459923986a38289d3a12043d9850567291c8f231c5e8f7826d39f092ce3aec2bffd5cd1085eae0a0b5e7ddbaa

Download Submit
C:\Windows\system\DrARiSI.exe

Filesize
2.1MB

MD5
e6ab3cc1008bcbb7b2cc1060e3fcabb4

SHA1
bfcbed0d36bff07c4260aa0d9f7ff6b5979389e8

SHA256
da00cbbe31159b60bb7cb112ac9e3f95e698a820dea9ed50cc43859f70c28527

SHA512
3fbf04f995ee9992fff653db6c223132890a604a268d919fb7d0b19b9ac9025c8a69a6a351a89b975e9d96d32187dd16fe55df1bf342d0a67b46d25779ed5d7a

Download Submit
C:\Windows\system\FnYjsYF.exe

Filesize
2.1MB

MD5
e0d5f6c00060f9e9a1389b3c8f4662f8

SHA1
7c39a63092d9a691a9a5fe8139280101cff7b37f

SHA256
acf93127e9b3c78b01af43d0f38481d3aaefd7dace4e46e9f78638ad1098e817

SHA512
74869ddcf97923656e0089f4f46d61fcc0fba4e63eb57eea1320d3f2ccbc2d94821a93f312d434f632327373c1a023f568cf3614b5b9ee65fb9386aa3d0b4be8

Download Submit
C:\Windows\system\Ghfrsek.exe

Filesize
2.1MB

MD5
92f64666219909a0699d53318a073c1a

SHA1
497a66bacfdb3dd0241082216a9898ecce51a80f

SHA256
137c37bf970958851efe6cc3db1bc4d62b1ee0d5058b57ecd9c42e49f3ec98e0

SHA512
9f527a5ca0ce93c35e1a8502d5ef3de149c9705d3ba9a09c0f8f7c6f23a13fc74f36c1f639dabe0abac958999dba65d6816b075ac4b5c1f97bab084fb28c306a

Download Submit
C:\Windows\system\JtjyejB.exe

Filesize
2.1MB

MD5
b6254a424827958ea497a29c12f49491

SHA1
625c0818488aab384c90851d88576183436da14a

SHA256
17b9cc989d941894a511377f2a63930ca499f79381489b966036b54214755a8e

SHA512
8268c4150a522b7d017d16b14963f66367330f588e50ce76b2e3a263940ef099c7d7c44475a9048832ad4260be1b27d223a3781e39ff49a108c9fca4d3043c37

Download Submit
C:\Windows\system\MWUnbTM.exe

Filesize
2.1MB

MD5
498c93ecef45cfa009bb7568e3efded2

SHA1
5e644c0f6ed58d3e7356b83148600fc418371ad1

SHA256
b9ca53cd741973290afecba27f491d2232ca034fe8f03c63e810da11817bbaa0

SHA512
3f92ace3e253f7897d39720eb468a8a60bcd5d62bc658a8ae677a9f9d7cde724b887807245e4317c9d7ddd5fc8a6966cceade237cfe1c3c3bf3c1c538d9d4127

Download Submit
C:\Windows\system\OIWBHEt.exe

Filesize
2.1MB

MD5
aafe77784f05947b8d27273b7daac02d

SHA1
aa5c87c2399f16f859b48503976a12adccc9218f

SHA256
d98c87235ab4542ebe1ebc00681a967f61af25073fa9cd4b1fd298f45d4408dc

SHA512
76c2522c18a0273921b6a9f858a7a786b8bb37452ec4b587e2bb8eddb018e968eff7c3dfa96e1338d6234b4bd10a4143534eda2f82a85ea6e41fb756ad33a8ad

Download Submit
C:\Windows\system\SJmcEEd.exe

Filesize
2.1MB

MD5
9d2c543dd77ec5931a2a8015fb60f5e3

SHA1
e616ca3b33eae120e1a9822d7305cf0982bbd7e3

SHA256
14392e48c3b56a8a5edc112ead3b1cf6eb722e35d6b0f1e1a40c0f582a49c371

SHA512
ac1aeac786ca91c2e22d87902327cac794b3c94402f8863f834e1489cffe9053ae8b40c3d42eec7d0090214bdddee78e59442d22c83a31b26eccecca3c9f42c9

Download Submit
C:\Windows\system\StnWZMq.exe

Filesize
2.1MB

MD5
05ac5559c19855afd7eefee7bbb4505b

SHA1
62a2561138781c22ec86d8bdd3f946f6baa49ba3

SHA256
28e87706d2a5219048c67584c482f3c99029d5ecad2551148785e308be7146fe

SHA512
695f601671dc7c2ffa84182d21d16d4cddc5a0ff7991d7f89414b1baaf161218c561fc2b73c3d1b4912539c2af93cc2ba2191436b915a4ebb08cca0a79fd832c

Download Submit
C:\Windows\system\TofiRZI.exe

Filesize
2.1MB

MD5
75f7e266a23f85a21f91d3bbcb127cfa

SHA1
ffc6943b675cda4608e6933ac03830409bbd1284

SHA256
83195861ae3061ada2979f3fd1d9f2cc8b8f8073d95fb469240a0577172fa6cb

SHA512
ed9d2e7068451088d98fc1cf6e10f1b1f008946b16c821b4388a56241ed3c2a8a4fd265cacf65c62bcf0872ef54ac85d80ec1347c6bad38257a138f8cd006751

Download Submit
C:\Windows\system\UPJLdtt.exe

Filesize
2.1MB

MD5
37e03b1c00fa9f979667a05b3a9403a0

SHA1
7a6838525fc03b40a734b5b09f7ce413207cd1bd

SHA256
2f7eb47ce2f690964ffaaf66810b4a29310abf8e00c7447f93b6f225c905594e

SHA512
3cb6fbc9e5f1cd238cdab208230a07780f69eada0dc07bd6809ce739a4a8bc99bd55c4a9c0660b1217c29fae060fc73c49f76caaca503b08c376a4b9439b7b06

Download Submit
C:\Windows\system\WioSclA.exe

Filesize
2.1MB

MD5
c11453ead6683bab045b75555d455b5d

SHA1
6d7aea9a842296b0478420a8c2a9e0c71decf53c

SHA256
06e92e25a0daf7626c981cecbdb95f0e8c2eefbf9e6e298e0bfcc3b45c7de2fc

SHA512
b1cd34fcecf612e67d6d5259488f693d1c45955053e680fcc1a29fc3a92c054c1aeaa834fe1b53b8fb08dd473787b42230efaac29f6081494f7fb85ccd1ffa9b

Download Submit
C:\Windows\system\YRTKnMh.exe

Filesize
2.1MB

MD5
7fc194e6a131c980ff256b717e8072fe

SHA1
ba0046eb3ca2e71e75a2a285294daed575dc1761

SHA256
4869ef1c4dd8b57c0a82e76244c78253de8c0e5a88f45ea1f78f0b52912e1ca5

SHA512
3d42f5753c202edf26bf5be4b17b467c7ff550fee425b024dfa37d125379c3850cb43c226efb671d6162b2350d423c041d8a52e75fca923a443153f7549bca6d

Download Submit
C:\Windows\system\ZWLXYHg.exe

Filesize
2.1MB

MD5
de4d802390703d457282dc13acefdf4c

SHA1
033582ef0838fb4a1767387db1e46f3cadd53843

SHA256
6e9ef3dc5ff3a7cd62542a975825d350d213732b35390e6bc89e0f830aaece7d

SHA512
4fcc26114f16eb434e23280689e1fcfe7f4056344f550a0c9e286b7c3b3ee18cdbd3dcef825b89676f3207e0f6bb36e3736d15e8f5d568c9abe3895e42a73e33

Download Submit
C:\Windows\system\bzpwMiP.exe

Filesize
2.1MB

MD5
4e10b151fd26fe1597e55dce5a9941b5

SHA1
3b1e81125cda0b4aa13622e67f41025b021d8c08

SHA256
79354ec0828c7f1673f3db53dbe997ccef19fd8d9458481612af1d9697222935

SHA512
3f6d0cbd9e81f68a1a7aa1c1506472b1feae7d02889f507185e9a888064f2979e2d54eeef3ac65b8267593480e59133fffe4cf83c597abc37e0bef9bc2c4ab70

Download Submit
C:\Windows\system\cwzhAnf.exe

Filesize
2.1MB

MD5
f906a867fe367757587bdd8b02a8f003

SHA1
52517f37059d1b0816743cbaa2eedcc09832fffe

SHA256
605f88225bcd331f3a2523abc576c821966c679a8ab94fde0e1e7e803edf4b85

SHA512
ee0dc3bd8233e5f73e719e40b5fb1ef68b8094a676a06fb0fd8219f0fdd7e4ae0cccd36a0c528182c38be82b58bf9d628fe435dc5fefdbdc620da54212202ce8

Download Submit
C:\Windows\system\gWDMZtj.exe

Filesize
2.1MB

MD5
7f0f8ceff1ff9f40ca3282f7513a10d9

SHA1
ad834128ec0fa65c0cfdd3be25c723a5e393cef2

SHA256
e46d1a7a66f1b739843bdf502426f5b96996afd093cb3e0fe9a52a7b633ec500

SHA512
84eb49d6e85cff77905603f6ab386bbccb94870cf43062f0c189c1d62caa5d835c359bfaacf3892636561864ff64d0021cfd0c22c5547abc7cbb428463caa8e1

Download Submit
C:\Windows\system\gaHSOFN.exe

Filesize
2.1MB

MD5
c5c4c7b3ec05bebc987232104652894e

SHA1
d4e2a6c2a32d523105b4d0bbbde93187b971fc4b

SHA256
4a7853f99f74a23d1489edd99f1bc6acafb128f46b5f22eda6ac1db8e8a08808

SHA512
c8688e41caef3e3cbf9008a2cc360e4e86ea88a0a50c30fb75802ba95fcbde8e94d1b70d19be128e64d133e6a22be86ae2cc5c546836c45068b2e3b314bc0495

Download Submit
C:\Windows\system\hYKjgDZ.exe

Filesize
2.1MB

MD5
cebb191dcd17f1187759cec82d02cf94

SHA1
28fb550c2462af15f02bf1ac05b2cec406a591aa

SHA256
6f025c0ed3b271cfc559341cfc04adfd28af8cd6b43d0cfe9f4529eefb1fe508

SHA512
4d562f6f40399dfa09e19118672f59486f2d1445b1d0d300ef5389db8c0d4cc3a40b1bfe4fa5e2f1a3429a9194f274abd8a42c96e83b1826d2ae91651dcac00b

Download Submit
C:\Windows\system\jyzZCUo.exe

Filesize
2.1MB

MD5
09c3693c9034c1ce26dba962e86e44b5

SHA1
edabf523401d2b1d944a4b801635de54aafb680f

SHA256
a7058462ab9dc6f639230037789fcfd84bc0f1eafac815598e78cacda118faa4

SHA512
75e490020ef5f3f8dc0eac736e454b786be3ea5298a67e8731f03c026b788d0311adf5b15ce7b763569f42c66029e6efa2bac99f5f818c6b4225b25eba5c6db6

Download Submit
C:\Windows\system\mhFJCJv.exe

Filesize
2.1MB

MD5
ff8cae1703c30728d20d7dce82025300

SHA1
cd89b9f9740de3e5c9159e5fb2b9aa8ed726e7ea

SHA256
702969346933896cf78462519c4358385cbc6fff7497b1dda86480d671360822

SHA512
3b0a3e3bc1088f6bc55c0720395096f39abeb7aa914524d02e0ad271cc00654b659294cbecc9e58219745112c1c23222544d5d06cbbdfedbf42e6e1fe63b75d5

Download Submit
C:\Windows\system\mrliZjF.exe

Filesize
2.1MB

MD5
7fa613cdecbf351c62e295c3949e79a3

SHA1
9be9e4ef15f2bc0c2e340b71c41c3820600c5a0a

SHA256
88c85155e3ec2a1042b78c813972b10d8332f9f4a73debdcd1d8f36bb14a337a

SHA512
3d7e5bc5e789f4c5745b357f31e58ef8d135a66d1f1928ac6e0f1e3835e3af2a32d8c942b6097ccc7422a8dc1056dddc0d8e87fd6d55ccc250cc944d40ee8b79

Download Submit
C:\Windows\system\nevGXHZ.exe

Filesize
2.1MB

MD5
d51c862f14fb4c9dd2c77677164458cf

SHA1
a3ab64d7847519369651fb715d43bb256ee560d6

SHA256
774941847404ffdab63aec393a0f585b087398a0595e69824329ae77590d7215

SHA512
d7ae8995639441a46d975dfc27c125438ecc15c3b81304554649ecd461dad3ca60ac5758584c5378a7b929b90fb3830ffffcb969bed8af35960bf89a09910377

Download Submit
C:\Windows\system\npHDQyT.exe

Filesize
2.1MB

MD5
018fd2698d2df800cb55e0c40046a2cb

SHA1
dc844c951553fe6759a49ce059acdd0dea7a546a

SHA256
3f763602976daf80d7285063219f40b2be1d23e0228eb745255f5e07d261e1d5

SHA512
1e578043f58e92445062635e17e97b8d2459d6fdae57fa12a39a9cb034b559d6d1f8e88bf8c0b3dbd2ddcf4b2e60542dc9e8de7924f2944f8f5634ff3aeddc1b

Download Submit
C:\Windows\system\nwifMZP.exe

Filesize
2.1MB

MD5
0dfe3a1d1c000ad44a254a4f7404280c

SHA1
cabaa5ff1a03adee6b1027d66ecdf27916aab442

SHA256
e8e2609ec64ec07db6716e00b4aa0b38261e9e5e966a6f6192a39adebac5b5e5

SHA512
cc971730bcc4b2e154259e28eec1fd5902cd7a49a613e8952fe302776d60e995c3bfbc4074efc27b5ba17e2a344357da12ebf151656916d7caba155e71db4f3c

Download Submit
C:\Windows\system\rCJGMMm.exe

Filesize
2.1MB

MD5
58c54eead267339baa1337a88f37ca13

SHA1
668caa0947dcc6f6f2797f4157c05b8518f5d81f

SHA256
875174d474cba79b3a1d9825bdd91670b8006606bcd682c838990ffed9ba69bd

SHA512
46ab00a8582bbe251f6df6b4453dd73fda521651af94727e0b9aab5471df47bdec51fa7bcee0110e56569ae2122dbf20b8cc3f73160d196bd1609c7023a2608b

Download Submit
C:\Windows\system\sSIkmVy.exe

Filesize
2.1MB

MD5
123118cc7f080c8c9874029e9f268215

SHA1
ea8e09fc526ffbe8d2505d6492605ca2432d7692

SHA256
76adbc058438484d7e861f3be70ef9f02603054eeb840d392df7a0b32a137050

SHA512
c93bbb02e19799e89fb992b96885c38c5a41a380abaedd2b8c2f5a0a3b3f5f3e1997699d7382adb49362aa0fec56ea48af5638cd5a4f3afe91c618ef7b21a70a

Download Submit
C:\Windows\system\wpvFnzB.exe

Filesize
2.1MB

MD5
5cabbdde06b003e9c2fc435a49208c02

SHA1
f27e9b35ef68f9feffe8b760566d0abb4eeb82ac

SHA256
e2f03bc0d6a0481ecc52cb1906739177c079402f99744f06996a9e3fb9e6d54e

SHA512
71b86e56ac116ccb2b4e12416900ad8f7637a9f56cc086cc7656dae62ecd56b6abe5e50f1799adc922fdf51e38fa18a852603505fec4d0939f6b09a5e6700307

Download Submit
C:\Windows\system\yXniuWh.exe

Filesize
2.1MB

MD5
839f0b2f09c2b14d1bdf5e178fe11db2

SHA1
8ea32b87f5c5b535838ceb46cac8c1d320c5d05a

SHA256
e03e98cfc3d5f53e4c5dd868770d0e08f4873078d88a1c4b33aff195cd58dba7

SHA512
2762083bb9ff7460d88260e6944ffcc47245372f8abcfbd54580564b5ac50cfb8a5067bbcc943964cf232c44b7906781959e0f4ad9a510853640677a989b274a

Download Submit
C:\Windows\system\zjGqwJF.exe

Filesize
2.1MB

MD5
4d6ae959335cf981ed81236a10da4f24

SHA1
5c48e8449109658c62f1847e76989ae2fd9615d3

SHA256
3d9381f3eabdfc4ef8eda0d557e6ccd1e6a8898bb93cdb28a45bb978c8725e35

SHA512
bc50de132d47bdb7118da354e99cbd2603acda55b3d71218d7ccc1c0017f4c13c3e70c42aafbe7b124f18c56199b047ed2f7466defcc97e6409b492cdfff7344

Download Submit
\Windows\system\VgEwDsu.exe

Filesize
2.1MB

MD5
5a445f04cf34f7ab7ee963007f66d69d

SHA1
19e196a346c723a8d73bae0cda40f423e0370aae

SHA256
f5a5a41f6475189f1ac13f3140ca59d5774598e4490c809fd045c2ece4efe796

SHA512
80474bcdd97be4cedc583f0be8d647cabd30631c34306c0092a97b1fa7ac0f9654f8c009364bc5796991c9189814b9c1d051392969b649b6f83ff1d0c8e53a52

Download Submit
memory/784-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download