kpot | c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf

Analysis

max time kernel
138s
max time network
148s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 01:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
Size

1.9MB
MD5

f3a9eb685eb045965b777edd351fda2d
SHA1

19e330f71076fbfbf78a2fe09a9ed33865f9fde6
SHA256

c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf
SHA512

1d92038cd74b390db943a88e2e99532451b16f31fe5221d68b2a12664bb95aac00029820c19ff13f3cf822806f81bb9c199ccdc537577222e6a0aadbfcddffb4
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9oztFwIi5aIwC+Agr6S/FYxWr:GemTLkNdfE0pZaQU

Score

10^/10

kpot xmrig miner stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 32 IoCs

resource	yara_rule
behavioral1/files/0x000a00000001227b-2.dat	family_kpot
behavioral1/files/0x0008000000016d6d-9.dat	family_kpot
behavioral1/files/0x0008000000016d89-14.dat	family_kpot
behavioral1/files/0x0007000000016de1-15.dat	family_kpot
behavioral1/files/0x0007000000016de9-22.dat	family_kpot
behavioral1/files/0x0007000000016ec4-23.dat	family_kpot
behavioral1/files/0x000700000001879f-33.dat	family_kpot
behavioral1/files/0x0006000000018bfc-37.dat	family_kpot
behavioral1/files/0x000500000001923b-41.dat	family_kpot
behavioral1/files/0x000500000001923d-45.dat	family_kpot
behavioral1/files/0x0005000000019279-57.dat	family_kpot
behavioral1/files/0x0005000000019398-73.dat	family_kpot
behavioral1/files/0x000500000001948a-97.dat	family_kpot
behavioral1/files/0x00050000000194f0-117.dat	family_kpot
behavioral1/files/0x0005000000019506-129.dat	family_kpot
behavioral1/files/0x0005000000019504-126.dat	family_kpot
behavioral1/files/0x00050000000194fa-121.dat	family_kpot
behavioral1/files/0x00050000000194e5-113.dat	family_kpot
behavioral1/files/0x00050000000194c1-109.dat	family_kpot
behavioral1/files/0x00050000000194b1-106.dat	family_kpot
behavioral1/files/0x00050000000194a1-101.dat	family_kpot
behavioral1/files/0x0005000000019449-93.dat	family_kpot
behavioral1/files/0x000500000001943b-89.dat	family_kpot
behavioral1/files/0x00050000000193bc-85.dat	family_kpot
behavioral1/files/0x00050000000193ae-81.dat	family_kpot
behavioral1/files/0x00050000000193aa-77.dat	family_kpot
behavioral1/files/0x000500000001934a-69.dat	family_kpot
behavioral1/files/0x0005000000019330-65.dat	family_kpot
behavioral1/files/0x000500000001927c-61.dat	family_kpot
behavioral1/files/0x0005000000019260-53.dat	family_kpot
behavioral1/files/0x000500000001925c-49.dat	family_kpot
behavioral1/files/0x000a000000017041-30.dat	family_kpot

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000a00000001227b-2.dat	xmrig
behavioral1/files/0x0008000000016d6d-9.dat	xmrig
behavioral1/files/0x0008000000016d89-14.dat	xmrig
behavioral1/files/0x0007000000016de1-15.dat	xmrig
behavioral1/files/0x0007000000016de9-22.dat	xmrig
behavioral1/files/0x0007000000016ec4-23.dat	xmrig
behavioral1/files/0x000700000001879f-33.dat	xmrig
behavioral1/files/0x0006000000018bfc-37.dat	xmrig
behavioral1/files/0x000500000001923b-41.dat	xmrig
behavioral1/files/0x000500000001923d-45.dat	xmrig
behavioral1/files/0x0005000000019279-57.dat	xmrig
behavioral1/files/0x0005000000019398-73.dat	xmrig
behavioral1/files/0x000500000001948a-97.dat	xmrig
behavioral1/files/0x00050000000194f0-117.dat	xmrig
behavioral1/files/0x0005000000019506-129.dat	xmrig
behavioral1/files/0x0005000000019504-126.dat	xmrig
behavioral1/files/0x00050000000194fa-121.dat	xmrig
behavioral1/files/0x00050000000194e5-113.dat	xmrig
behavioral1/files/0x00050000000194c1-109.dat	xmrig
behavioral1/files/0x00050000000194b1-106.dat	xmrig
behavioral1/files/0x00050000000194a1-101.dat	xmrig
behavioral1/files/0x0005000000019449-93.dat	xmrig
behavioral1/files/0x000500000001943b-89.dat	xmrig
behavioral1/files/0x00050000000193bc-85.dat	xmrig
behavioral1/files/0x00050000000193ae-81.dat	xmrig
behavioral1/files/0x00050000000193aa-77.dat	xmrig
behavioral1/files/0x000500000001934a-69.dat	xmrig
behavioral1/files/0x0005000000019330-65.dat	xmrig
behavioral1/files/0x000500000001927c-61.dat	xmrig
behavioral1/files/0x0005000000019260-53.dat	xmrig
behavioral1/files/0x000500000001925c-49.dat	xmrig
behavioral1/files/0x000a000000017041-30.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2808	wNRuMLI.exe
2832	TkZabqc.exe
2636	KqRDjQp.exe
2664	HLunkCl.exe
2764	cfPbqVN.exe
2224	bUPBlbZ.exe
2632	oeLADAH.exe
2700	ERQmvBd.exe
2584	GADSYWN.exe
2540	xRGkcGL.exe
2592	jccQdhI.exe
2984	aRZxkFG.exe
2416	mPnpQbT.exe
1288	IDtFykS.exe
1532	MopyPnu.exe
2784	zeILbrp.exe
2724	qJWSxKY.exe
2716	NqavoBO.exe
2888	gvwnMYn.exe
2188	XGWjDhb.exe
796	bkxWPZU.exe
2036	IVvNoiu.exe
1608	uWsRmaq.exe
276	xCiNDFx.exe
1732	htNlQZa.exe
1880	VmVBXBK.exe
2936	qzBheFO.exe
2924	bhxOQmR.exe
2364	lbUxgkk.exe
2268	fTDnFoJ.exe
2092	qgSAENE.exe
2312	RyHuTrd.exe
872	CNwEjmK.exe
2108	IAvzXDm.exe
1864	qLhBfRD.exe
2404	LRGVZnf.exe
2260	bTLWPwm.exe
1120	NTMRrpm.exe
828	ZZYdEkY.exe
1592	RlWZihr.exe
1928	hxbzpQc.exe
2468	PfVXSuj.exe
896	QEjUPhZ.exe
1756	uEpVDSe.exe
944	jdRIYAI.exe
2196	XjyYiQR.exe
2320	qFaAEnS.exe
1708	GTBHgSn.exe
1840	WXrVtmG.exe
844	ezxyZHD.exe
2184	dpmweHp.exe
2172	xDRPWRK.exe
2168	xJanHQW.exe
2900	iivyeiA.exe
1620	zLSfGcy.exe
1920	OIRaHpm.exe
2128	YyIeTrR.exe
2192	tsxEngG.exe
1664	JipQGAn.exe
1040	ElnhcGa.exe
1888	TWHKdZk.exe
3032	VNBPhaT.exe
1748	FsVnirY.exe
1876	jTvAbOr.exe

Loads dropped DLL 64 IoCs

pid	Process
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\APHiOHi.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\xCiNDFx.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\tsxEngG.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\sNwXVwD.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\bBpaLVg.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\BDtDTxB.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\NSotloe.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\PZyRKaP.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\zTMZaHC.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\oeLADAH.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\mPnpQbT.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\rOJHxRZ.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\iWmsmwk.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\tYRwLAH.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\bTLWPwm.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\youGWMV.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\hFxmOtO.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\absKfDI.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\mGKxbFK.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\qirijgA.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\GliNXaI.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\dGqIstn.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\iMeljyh.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\UWHELWv.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\plUxtKQ.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\WTDuwoH.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\NzdkfoD.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\ZZYdEkY.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\iNJAGBe.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\gxWTluX.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\UZYzpYK.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\LXvCkwo.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\juetcDr.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\VpIPUaR.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\EQDCdtF.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\RlWZihr.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\jvtnuUV.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\keATdNV.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\OlaWTXj.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\hxbzpQc.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\knzikAU.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\nwZwVnF.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\tKuFmET.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\GNRKdkt.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\KKsLSCX.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\UaFCJeg.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\qJWSxKY.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\zLSfGcy.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\YECZvqz.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\AUnoawS.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\DBrYFXj.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\diAeBLS.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\FYGFSea.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\HBgMyDe.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\hIKOXgb.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\szntqVm.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\FTeFnSH.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\BhKAvGS.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\rcwtwGE.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\DdToJqa.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\ElnhcGa.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\FsVnirY.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\rpElZUQ.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
File created	C:\Windows\System\PzUALGr.exe	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
Token: SeLockMemoryPrivilege	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2808	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	32
PID 2176 wrote to memory of 2808	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	32
PID 2176 wrote to memory of 2808	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	32
PID 2176 wrote to memory of 2832	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	33
PID 2176 wrote to memory of 2832	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	33
PID 2176 wrote to memory of 2832	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	33
PID 2176 wrote to memory of 2636	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	34
PID 2176 wrote to memory of 2636	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	34
PID 2176 wrote to memory of 2636	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	34
PID 2176 wrote to memory of 2664	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	35
PID 2176 wrote to memory of 2664	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	35
PID 2176 wrote to memory of 2664	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	35
PID 2176 wrote to memory of 2764	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	36
PID 2176 wrote to memory of 2764	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	36
PID 2176 wrote to memory of 2764	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	36
PID 2176 wrote to memory of 2224	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	37
PID 2176 wrote to memory of 2224	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	37
PID 2176 wrote to memory of 2224	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	37
PID 2176 wrote to memory of 2632	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	38
PID 2176 wrote to memory of 2632	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	38
PID 2176 wrote to memory of 2632	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	38
PID 2176 wrote to memory of 2700	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	39
PID 2176 wrote to memory of 2700	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	39
PID 2176 wrote to memory of 2700	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	39
PID 2176 wrote to memory of 2584	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	40
PID 2176 wrote to memory of 2584	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	40
PID 2176 wrote to memory of 2584	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	40
PID 2176 wrote to memory of 2540	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	41
PID 2176 wrote to memory of 2540	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	41
PID 2176 wrote to memory of 2540	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	41
PID 2176 wrote to memory of 2592	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	42
PID 2176 wrote to memory of 2592	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	42
PID 2176 wrote to memory of 2592	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	42
PID 2176 wrote to memory of 2984	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	43
PID 2176 wrote to memory of 2984	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	43
PID 2176 wrote to memory of 2984	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	43
PID 2176 wrote to memory of 2416	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	44
PID 2176 wrote to memory of 2416	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	44
PID 2176 wrote to memory of 2416	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	44
PID 2176 wrote to memory of 1288	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	45
PID 2176 wrote to memory of 1288	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	45
PID 2176 wrote to memory of 1288	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	45
PID 2176 wrote to memory of 1532	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	46
PID 2176 wrote to memory of 1532	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	46
PID 2176 wrote to memory of 1532	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	46
PID 2176 wrote to memory of 2784	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	47
PID 2176 wrote to memory of 2784	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	47
PID 2176 wrote to memory of 2784	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	47
PID 2176 wrote to memory of 2724	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	48
PID 2176 wrote to memory of 2724	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	48
PID 2176 wrote to memory of 2724	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	48
PID 2176 wrote to memory of 2716	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	49
PID 2176 wrote to memory of 2716	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	49
PID 2176 wrote to memory of 2716	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	49
PID 2176 wrote to memory of 2888	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	50
PID 2176 wrote to memory of 2888	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	50
PID 2176 wrote to memory of 2888	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	50
PID 2176 wrote to memory of 2188	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	51
PID 2176 wrote to memory of 2188	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	51
PID 2176 wrote to memory of 2188	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	51
PID 2176 wrote to memory of 796	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	52
PID 2176 wrote to memory of 796	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	52
PID 2176 wrote to memory of 796	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	52
PID 2176 wrote to memory of 2036	2176	c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe	53

C:\Users\Admin\AppData\Local\Temp\c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe
"C:\Users\Admin\AppData\Local\Temp\c1d4832754376405711286976e80369207d775af104e2e1a4c201a841d0db1bf.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\System\wNRuMLI.exe
  C:\Windows\System\wNRuMLI.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\TkZabqc.exe
  C:\Windows\System\TkZabqc.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\KqRDjQp.exe
  C:\Windows\System\KqRDjQp.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\HLunkCl.exe
  C:\Windows\System\HLunkCl.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\cfPbqVN.exe
  C:\Windows\System\cfPbqVN.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\bUPBlbZ.exe
  C:\Windows\System\bUPBlbZ.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\oeLADAH.exe
  C:\Windows\System\oeLADAH.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\ERQmvBd.exe
  C:\Windows\System\ERQmvBd.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\GADSYWN.exe
  C:\Windows\System\GADSYWN.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\xRGkcGL.exe
  C:\Windows\System\xRGkcGL.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\jccQdhI.exe
  C:\Windows\System\jccQdhI.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\aRZxkFG.exe
  C:\Windows\System\aRZxkFG.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\mPnpQbT.exe
  C:\Windows\System\mPnpQbT.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\IDtFykS.exe
  C:\Windows\System\IDtFykS.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\MopyPnu.exe
  C:\Windows\System\MopyPnu.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\zeILbrp.exe
  C:\Windows\System\zeILbrp.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\qJWSxKY.exe
  C:\Windows\System\qJWSxKY.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\NqavoBO.exe
  C:\Windows\System\NqavoBO.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\gvwnMYn.exe
  C:\Windows\System\gvwnMYn.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\XGWjDhb.exe
  C:\Windows\System\XGWjDhb.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\bkxWPZU.exe
  C:\Windows\System\bkxWPZU.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\IVvNoiu.exe
  C:\Windows\System\IVvNoiu.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\uWsRmaq.exe
  C:\Windows\System\uWsRmaq.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\xCiNDFx.exe
  C:\Windows\System\xCiNDFx.exe
  2⤵
  - Executes dropped EXE
  PID:276
- C:\Windows\System\htNlQZa.exe
  C:\Windows\System\htNlQZa.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\VmVBXBK.exe
  C:\Windows\System\VmVBXBK.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\qzBheFO.exe
  C:\Windows\System\qzBheFO.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\bhxOQmR.exe
  C:\Windows\System\bhxOQmR.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\lbUxgkk.exe
  C:\Windows\System\lbUxgkk.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\fTDnFoJ.exe
  C:\Windows\System\fTDnFoJ.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\qgSAENE.exe
  C:\Windows\System\qgSAENE.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\RyHuTrd.exe
  C:\Windows\System\RyHuTrd.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\CNwEjmK.exe
  C:\Windows\System\CNwEjmK.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\IAvzXDm.exe
  C:\Windows\System\IAvzXDm.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\qLhBfRD.exe
  C:\Windows\System\qLhBfRD.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\LRGVZnf.exe
  C:\Windows\System\LRGVZnf.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\bTLWPwm.exe
  C:\Windows\System\bTLWPwm.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\NTMRrpm.exe
  C:\Windows\System\NTMRrpm.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\ZZYdEkY.exe
  C:\Windows\System\ZZYdEkY.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\RlWZihr.exe
  C:\Windows\System\RlWZihr.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\hxbzpQc.exe
  C:\Windows\System\hxbzpQc.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\PfVXSuj.exe
  C:\Windows\System\PfVXSuj.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\QEjUPhZ.exe
  C:\Windows\System\QEjUPhZ.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\uEpVDSe.exe
  C:\Windows\System\uEpVDSe.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\jdRIYAI.exe
  C:\Windows\System\jdRIYAI.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\XjyYiQR.exe
  C:\Windows\System\XjyYiQR.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\qFaAEnS.exe
  C:\Windows\System\qFaAEnS.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\GTBHgSn.exe
  C:\Windows\System\GTBHgSn.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\WXrVtmG.exe
  C:\Windows\System\WXrVtmG.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\ezxyZHD.exe
  C:\Windows\System\ezxyZHD.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\dpmweHp.exe
  C:\Windows\System\dpmweHp.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\xDRPWRK.exe
  C:\Windows\System\xDRPWRK.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\xJanHQW.exe
  C:\Windows\System\xJanHQW.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\iivyeiA.exe
  C:\Windows\System\iivyeiA.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\zLSfGcy.exe
  C:\Windows\System\zLSfGcy.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\OIRaHpm.exe
  C:\Windows\System\OIRaHpm.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\YyIeTrR.exe
  C:\Windows\System\YyIeTrR.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\tsxEngG.exe
  C:\Windows\System\tsxEngG.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\JipQGAn.exe
  C:\Windows\System\JipQGAn.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\ElnhcGa.exe
  C:\Windows\System\ElnhcGa.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\TWHKdZk.exe
  C:\Windows\System\TWHKdZk.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\VNBPhaT.exe
  C:\Windows\System\VNBPhaT.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\FsVnirY.exe
  C:\Windows\System\FsVnirY.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\jTvAbOr.exe
  C:\Windows\System\jTvAbOr.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\vOZlNAG.exe
  C:\Windows\System\vOZlNAG.exe
  2⤵
  PID:1916
- C:\Windows\System\PzUALGr.exe
  C:\Windows\System\PzUALGr.exe
  2⤵
  PID:1744
- C:\Windows\System\sWIdDwr.exe
  C:\Windows\System\sWIdDwr.exe
  2⤵
  PID:2256
- C:\Windows\System\TDgepUC.exe
  C:\Windows\System\TDgepUC.exe
  2⤵
  PID:1420
- C:\Windows\System\gFjvkga.exe
  C:\Windows\System\gFjvkga.exe
  2⤵
  PID:2660
- C:\Windows\System\JbfULKt.exe
  C:\Windows\System\JbfULKt.exe
  2⤵
  PID:1576
- C:\Windows\System\IwqErLL.exe
  C:\Windows\System\IwqErLL.exe
  2⤵
  PID:2692
- C:\Windows\System\jvtnuUV.exe
  C:\Windows\System\jvtnuUV.exe
  2⤵
  PID:2908
- C:\Windows\System\mkqJCOB.exe
  C:\Windows\System\mkqJCOB.exe
  2⤵
  PID:2028
- C:\Windows\System\OKHrUoG.exe
  C:\Windows\System\OKHrUoG.exe
  2⤵
  PID:2864
- C:\Windows\System\LNHjYCA.exe
  C:\Windows\System\LNHjYCA.exe
  2⤵
  PID:2528
- C:\Windows\System\MjILfIv.exe
  C:\Windows\System\MjILfIv.exe
  2⤵
  PID:2652
- C:\Windows\System\GliNXaI.exe
  C:\Windows\System\GliNXaI.exe
  2⤵
  PID:2140
- C:\Windows\System\GkpSbYY.exe
  C:\Windows\System\GkpSbYY.exe
  2⤵
  PID:264
- C:\Windows\System\uyGztVm.exe
  C:\Windows\System\uyGztVm.exe
  2⤵
  PID:2756
- C:\Windows\System\youGWMV.exe
  C:\Windows\System\youGWMV.exe
  2⤵
  PID:840
- C:\Windows\System\OMMxeYQ.exe
  C:\Windows\System\OMMxeYQ.exe
  2⤵
  PID:1980
- C:\Windows\System\RVhksFt.exe
  C:\Windows\System\RVhksFt.exe
  2⤵
  PID:2156
- C:\Windows\System\vVYumpL.exe
  C:\Windows\System\vVYumpL.exe
  2⤵
  PID:1684
- C:\Windows\System\AyUMFBR.exe
  C:\Windows\System\AyUMFBR.exe
  2⤵
  PID:1476
- C:\Windows\System\eWHfsuX.exe
  C:\Windows\System\eWHfsuX.exe
  2⤵
  PID:2508
- C:\Windows\System\qquDFiB.exe
  C:\Windows\System\qquDFiB.exe
  2⤵
  PID:2244
- C:\Windows\System\vJvhCel.exe
  C:\Windows\System\vJvhCel.exe
  2⤵
  PID:2352
- C:\Windows\System\LtOxHbR.exe
  C:\Windows\System\LtOxHbR.exe
  2⤵
  PID:2208
- C:\Windows\System\RvrhvKW.exe
  C:\Windows\System\RvrhvKW.exe
  2⤵
  PID:2372
- C:\Windows\System\DBrYFXj.exe
  C:\Windows\System\DBrYFXj.exe
  2⤵
  PID:1904
- C:\Windows\System\PJQXieP.exe
  C:\Windows\System\PJQXieP.exe
  2⤵
  PID:1356
- C:\Windows\System\tmbJAXL.exe
  C:\Windows\System\tmbJAXL.exe
  2⤵
  PID:2488
- C:\Windows\System\mWSHPKV.exe
  C:\Windows\System\mWSHPKV.exe
  2⤵
  PID:780
- C:\Windows\System\FTeFnSH.exe
  C:\Windows\System\FTeFnSH.exe
  2⤵
  PID:1784
- C:\Windows\System\XgKqKAz.exe
  C:\Windows\System\XgKqKAz.exe
  2⤵
  PID:3040
- C:\Windows\System\fHUDRGI.exe
  C:\Windows\System\fHUDRGI.exe
  2⤵
  PID:1012
- C:\Windows\System\rsbRGOc.exe
  C:\Windows\System\rsbRGOc.exe
  2⤵
  PID:1704
- C:\Windows\System\SuvQism.exe
  C:\Windows\System\SuvQism.exe
  2⤵
  PID:1564
- C:\Windows\System\hFxmOtO.exe
  C:\Windows\System\hFxmOtO.exe
  2⤵
  PID:1820
- C:\Windows\System\knzikAU.exe
  C:\Windows\System\knzikAU.exe
  2⤵
  PID:1764
- C:\Windows\System\iNJAGBe.exe
  C:\Windows\System\iNJAGBe.exe
  2⤵
  PID:2052
- C:\Windows\System\onsKmry.exe
  C:\Windows\System\onsKmry.exe
  2⤵
  PID:2216
- C:\Windows\System\washvHq.exe
  C:\Windows\System\washvHq.exe
  2⤵
  PID:1896
- C:\Windows\System\ifUxEkN.exe
  C:\Windows\System\ifUxEkN.exe
  2⤵
  PID:1256
- C:\Windows\System\EpPSjYq.exe
  C:\Windows\System\EpPSjYq.exe
  2⤵
  PID:1984
- C:\Windows\System\YRRHPhZ.exe
  C:\Windows\System\YRRHPhZ.exe
  2⤵
  PID:1688
- C:\Windows\System\zdBnSjM.exe
  C:\Windows\System\zdBnSjM.exe
  2⤵
  PID:2440
- C:\Windows\System\rOJHxRZ.exe
  C:\Windows\System\rOJHxRZ.exe
  2⤵
  PID:2568
- C:\Windows\System\RWwXaSP.exe
  C:\Windows\System\RWwXaSP.exe
  2⤵
  PID:2580
- C:\Windows\System\wDulHFN.exe
  C:\Windows\System\wDulHFN.exe
  2⤵
  PID:2044
- C:\Windows\System\ZtegcQy.exe
  C:\Windows\System\ZtegcQy.exe
  2⤵
  PID:2884
- C:\Windows\System\dGqIstn.exe
  C:\Windows\System\dGqIstn.exe
  2⤵
  PID:1728
- C:\Windows\System\WDQWQPD.exe
  C:\Windows\System\WDQWQPD.exe
  2⤵
  PID:532
- C:\Windows\System\wZoNYmX.exe
  C:\Windows\System\wZoNYmX.exe
  2⤵
  PID:2220
- C:\Windows\System\aCzejDl.exe
  C:\Windows\System\aCzejDl.exe
  2⤵
  PID:2332
- C:\Windows\System\UULWaHg.exe
  C:\Windows\System\UULWaHg.exe
  2⤵
  PID:2400
- C:\Windows\System\vzDGpbQ.exe
  C:\Windows\System\vzDGpbQ.exe
  2⤵
  PID:2456
- C:\Windows\System\lRlOdoL.exe
  C:\Windows\System\lRlOdoL.exe
  2⤵
  PID:1860
- C:\Windows\System\iWmsmwk.exe
  C:\Windows\System\iWmsmwk.exe
  2⤵
  PID:1868
- C:\Windows\System\TqRRlPr.exe
  C:\Windows\System\TqRRlPr.exe
  2⤵
  PID:2912
- C:\Windows\System\YkQeNAg.exe
  C:\Windows\System\YkQeNAg.exe
  2⤵
  PID:1812
- C:\Windows\System\nwZwVnF.exe
  C:\Windows\System\nwZwVnF.exe
  2⤵
  PID:3076
- C:\Windows\System\BhKAvGS.exe
  C:\Windows\System\BhKAvGS.exe
  2⤵
  PID:3092
- C:\Windows\System\mBzdYTS.exe
  C:\Windows\System\mBzdYTS.exe
  2⤵
  PID:3108
- C:\Windows\System\pLxEjiP.exe
  C:\Windows\System\pLxEjiP.exe
  2⤵
  PID:3124
- C:\Windows\System\DcFpfIT.exe
  C:\Windows\System\DcFpfIT.exe
  2⤵
  PID:3140
- C:\Windows\System\sNwXVwD.exe
  C:\Windows\System\sNwXVwD.exe
  2⤵
  PID:3156
- C:\Windows\System\cKueKfm.exe
  C:\Windows\System\cKueKfm.exe
  2⤵
  PID:3172
- C:\Windows\System\lGqcSXw.exe
  C:\Windows\System\lGqcSXw.exe
  2⤵
  PID:3188
- C:\Windows\System\rcwtwGE.exe
  C:\Windows\System\rcwtwGE.exe
  2⤵
  PID:3204
- C:\Windows\System\pjkZorr.exe
  C:\Windows\System\pjkZorr.exe
  2⤵
  PID:3220
- C:\Windows\System\MqExJmw.exe
  C:\Windows\System\MqExJmw.exe
  2⤵
  PID:3236
- C:\Windows\System\PEkJjvd.exe
  C:\Windows\System\PEkJjvd.exe
  2⤵
  PID:3252
- C:\Windows\System\iBKTwzK.exe
  C:\Windows\System\iBKTwzK.exe
  2⤵
  PID:3268
- C:\Windows\System\VAfceKT.exe
  C:\Windows\System\VAfceKT.exe
  2⤵
  PID:3284
- C:\Windows\System\aLaqPLZ.exe
  C:\Windows\System\aLaqPLZ.exe
  2⤵
  PID:3300
- C:\Windows\System\QXskLOm.exe
  C:\Windows\System\QXskLOm.exe
  2⤵
  PID:3316
- C:\Windows\System\uJukClA.exe
  C:\Windows\System\uJukClA.exe
  2⤵
  PID:3332
- C:\Windows\System\KELMcem.exe
  C:\Windows\System\KELMcem.exe
  2⤵
  PID:3348
- C:\Windows\System\TIexZkB.exe
  C:\Windows\System\TIexZkB.exe
  2⤵
  PID:3364
- C:\Windows\System\XldfQUJ.exe
  C:\Windows\System\XldfQUJ.exe
  2⤵
  PID:3380
- C:\Windows\System\msXEwVK.exe
  C:\Windows\System\msXEwVK.exe
  2⤵
  PID:3396
- C:\Windows\System\mGKxbFK.exe
  C:\Windows\System\mGKxbFK.exe
  2⤵
  PID:3412
- C:\Windows\System\gIuEDFw.exe
  C:\Windows\System\gIuEDFw.exe
  2⤵
  PID:3428
- C:\Windows\System\uWYsbXm.exe
  C:\Windows\System\uWYsbXm.exe
  2⤵
  PID:3444
- C:\Windows\System\wKUSdUC.exe
  C:\Windows\System\wKUSdUC.exe
  2⤵
  PID:3460
- C:\Windows\System\SAiGWxN.exe
  C:\Windows\System\SAiGWxN.exe
  2⤵
  PID:3476
- C:\Windows\System\PNNZEmY.exe
  C:\Windows\System\PNNZEmY.exe
  2⤵
  PID:3492
- C:\Windows\System\MwOHjvB.exe
  C:\Windows\System\MwOHjvB.exe
  2⤵
  PID:3508
- C:\Windows\System\mCQGmex.exe
  C:\Windows\System\mCQGmex.exe
  2⤵
  PID:3524
- C:\Windows\System\AtsmSnm.exe
  C:\Windows\System\AtsmSnm.exe
  2⤵
  PID:3540
- C:\Windows\System\qirijgA.exe
  C:\Windows\System\qirijgA.exe
  2⤵
  PID:3556
- C:\Windows\System\oJtJdkS.exe
  C:\Windows\System\oJtJdkS.exe
  2⤵
  PID:3572
- C:\Windows\System\MpRZIch.exe
  C:\Windows\System\MpRZIch.exe
  2⤵
  PID:3588
- C:\Windows\System\rxIbAWG.exe
  C:\Windows\System\rxIbAWG.exe
  2⤵
  PID:3604
- C:\Windows\System\hOloMQw.exe
  C:\Windows\System\hOloMQw.exe
  2⤵
  PID:3620
- C:\Windows\System\yStUxDV.exe
  C:\Windows\System\yStUxDV.exe
  2⤵
  PID:3636
- C:\Windows\System\idIUlsd.exe
  C:\Windows\System\idIUlsd.exe
  2⤵
  PID:3652
- C:\Windows\System\TzUPMTO.exe
  C:\Windows\System\TzUPMTO.exe
  2⤵
  PID:3668
- C:\Windows\System\gKJqWJK.exe
  C:\Windows\System\gKJqWJK.exe
  2⤵
  PID:3684
- C:\Windows\System\diAeBLS.exe
  C:\Windows\System\diAeBLS.exe
  2⤵
  PID:3700
- C:\Windows\System\fZHnebN.exe
  C:\Windows\System\fZHnebN.exe
  2⤵
  PID:3716
- C:\Windows\System\YAFSysL.exe
  C:\Windows\System\YAFSysL.exe
  2⤵
  PID:3732
- C:\Windows\System\GTvniFq.exe
  C:\Windows\System\GTvniFq.exe
  2⤵
  PID:3748
- C:\Windows\System\xxgbapp.exe
  C:\Windows\System\xxgbapp.exe
  2⤵
  PID:3764
- C:\Windows\System\KLWDBWz.exe
  C:\Windows\System\KLWDBWz.exe
  2⤵
  PID:3780
- C:\Windows\System\YmntubI.exe
  C:\Windows\System\YmntubI.exe
  2⤵
  PID:3796
- C:\Windows\System\yBlLrZt.exe
  C:\Windows\System\yBlLrZt.exe
  2⤵
  PID:3812
- C:\Windows\System\IjGiEpR.exe
  C:\Windows\System\IjGiEpR.exe
  2⤵
  PID:3828
- C:\Windows\System\EgZBGwT.exe
  C:\Windows\System\EgZBGwT.exe
  2⤵
  PID:3844
- C:\Windows\System\HwHBHNG.exe
  C:\Windows\System\HwHBHNG.exe
  2⤵
  PID:3860
- C:\Windows\System\ZGEVQSt.exe
  C:\Windows\System\ZGEVQSt.exe
  2⤵
  PID:3876
- C:\Windows\System\joEIWUt.exe
  C:\Windows\System\joEIWUt.exe
  2⤵
  PID:3892
- C:\Windows\System\LvmvIiR.exe
  C:\Windows\System\LvmvIiR.exe
  2⤵
  PID:3908
- C:\Windows\System\CXNzjSL.exe
  C:\Windows\System\CXNzjSL.exe
  2⤵
  PID:3924
- C:\Windows\System\gSgGSry.exe
  C:\Windows\System\gSgGSry.exe
  2⤵
  PID:3940
- C:\Windows\System\bTcvSsR.exe
  C:\Windows\System\bTcvSsR.exe
  2⤵
  PID:3956
- C:\Windows\System\BcjHgJt.exe
  C:\Windows\System\BcjHgJt.exe
  2⤵
  PID:3972
- C:\Windows\System\rvJCiTx.exe
  C:\Windows\System\rvJCiTx.exe
  2⤵
  PID:3988
- C:\Windows\System\XJPNOKz.exe
  C:\Windows\System\XJPNOKz.exe
  2⤵
  PID:4004
- C:\Windows\System\keATdNV.exe
  C:\Windows\System\keATdNV.exe
  2⤵
  PID:4020
- C:\Windows\System\CmevkLo.exe
  C:\Windows\System\CmevkLo.exe
  2⤵
  PID:4036
- C:\Windows\System\KZNVqNG.exe
  C:\Windows\System\KZNVqNG.exe
  2⤵
  PID:4052
- C:\Windows\System\jdWRdzL.exe
  C:\Windows\System\jdWRdzL.exe
  2⤵
  PID:4068
- C:\Windows\System\xSjqXOL.exe
  C:\Windows\System\xSjqXOL.exe
  2⤵
  PID:4084
- C:\Windows\System\csiyeVH.exe
  C:\Windows\System\csiyeVH.exe
  2⤵
  PID:2940
- C:\Windows\System\JdZxJIh.exe
  C:\Windows\System\JdZxJIh.exe
  2⤵
  PID:2064
- C:\Windows\System\AdtsHJa.exe
  C:\Windows\System\AdtsHJa.exe
  2⤵
  PID:1824
- C:\Windows\System\nuILPDE.exe
  C:\Windows\System\nuILPDE.exe
  2⤵
  PID:2804
- C:\Windows\System\qGgQVLE.exe
  C:\Windows\System\qGgQVLE.exe
  2⤵
  PID:2880
- C:\Windows\System\gxWTluX.exe
  C:\Windows\System\gxWTluX.exe
  2⤵
  PID:1100
- C:\Windows\System\OlaWTXj.exe
  C:\Windows\System\OlaWTXj.exe
  2⤵
  PID:492
- C:\Windows\System\YubkSvj.exe
  C:\Windows\System\YubkSvj.exe
  2⤵
  PID:2296
- C:\Windows\System\eRYnLuF.exe
  C:\Windows\System\eRYnLuF.exe
  2⤵
  PID:2408
- C:\Windows\System\mtFnwOm.exe
  C:\Windows\System\mtFnwOm.exe
  2⤵
  PID:1680
- C:\Windows\System\DdToJqa.exe
  C:\Windows\System\DdToJqa.exe
  2⤵
  PID:1212
- C:\Windows\System\SNhOQML.exe
  C:\Windows\System\SNhOQML.exe
  2⤵
  PID:2144
- C:\Windows\System\kCgWtwj.exe
  C:\Windows\System\kCgWtwj.exe
  2⤵
  PID:3104
- C:\Windows\System\gfYsQrj.exe
  C:\Windows\System\gfYsQrj.exe
  2⤵
  PID:3136
- C:\Windows\System\UZYzpYK.exe
  C:\Windows\System\UZYzpYK.exe
  2⤵
  PID:3168
- C:\Windows\System\YVUDgIb.exe
  C:\Windows\System\YVUDgIb.exe
  2⤵
  PID:3200
- C:\Windows\System\mIkQGxB.exe
  C:\Windows\System\mIkQGxB.exe
  2⤵
  PID:3232
- C:\Windows\System\hXwLiJv.exe
  C:\Windows\System\hXwLiJv.exe
  2⤵
  PID:3264
- C:\Windows\System\AxSoQFj.exe
  C:\Windows\System\AxSoQFj.exe
  2⤵
  PID:3280
- C:\Windows\System\zudjHuw.exe
  C:\Windows\System\zudjHuw.exe
  2⤵
  PID:3312
- C:\Windows\System\LXvCkwo.exe
  C:\Windows\System\LXvCkwo.exe
  2⤵
  PID:3344
- C:\Windows\System\jTozshD.exe
  C:\Windows\System\jTozshD.exe
  2⤵
  PID:3392
- C:\Windows\System\HICvZVu.exe
  C:\Windows\System\HICvZVu.exe
  2⤵
  PID:3424
- C:\Windows\System\hbzgjTQ.exe
  C:\Windows\System\hbzgjTQ.exe
  2⤵
  PID:3440
- C:\Windows\System\fcfToSm.exe
  C:\Windows\System\fcfToSm.exe
  2⤵
  PID:3516
- C:\Windows\System\hwIpYId.exe
  C:\Windows\System\hwIpYId.exe
  2⤵
  PID:3504
- C:\Windows\System\wjArFUb.exe
  C:\Windows\System\wjArFUb.exe
  2⤵
  PID:3536
- C:\Windows\System\tkZNnKO.exe
  C:\Windows\System\tkZNnKO.exe
  2⤵
  PID:3584
- C:\Windows\System\PRgtXsa.exe
  C:\Windows\System\PRgtXsa.exe
  2⤵
  PID:3616
- C:\Windows\System\sDgjeZa.exe
  C:\Windows\System\sDgjeZa.exe
  2⤵
  PID:3644
- C:\Windows\System\QXQCWoJ.exe
  C:\Windows\System\QXQCWoJ.exe
  2⤵
  PID:3676
- C:\Windows\System\YiFBvvU.exe
  C:\Windows\System\YiFBvvU.exe
  2⤵
  PID:3696
- C:\Windows\System\VOErBIH.exe
  C:\Windows\System\VOErBIH.exe
  2⤵
  PID:3724
- C:\Windows\System\bBpaLVg.exe
  C:\Windows\System\bBpaLVg.exe
  2⤵
  PID:3760
- C:\Windows\System\zhhYTiy.exe
  C:\Windows\System\zhhYTiy.exe
  2⤵
  PID:3804
- C:\Windows\System\absKfDI.exe
  C:\Windows\System\absKfDI.exe
  2⤵
  PID:3836
- C:\Windows\System\cfEiOgY.exe
  C:\Windows\System\cfEiOgY.exe
  2⤵
  PID:3868
- C:\Windows\System\TBJZNke.exe
  C:\Windows\System\TBJZNke.exe
  2⤵
  PID:3900
- C:\Windows\System\puHnXyu.exe
  C:\Windows\System\puHnXyu.exe
  2⤵
  PID:3932
- C:\Windows\System\hLXYrqm.exe
  C:\Windows\System\hLXYrqm.exe
  2⤵
  PID:3964
- C:\Windows\System\kxzgfuH.exe
  C:\Windows\System\kxzgfuH.exe
  2⤵
  PID:2648
- C:\Windows\System\fRGvICg.exe
  C:\Windows\System\fRGvICg.exe
  2⤵
  PID:4012
- C:\Windows\System\aDBwIDA.exe
  C:\Windows\System\aDBwIDA.exe
  2⤵
  PID:4044
- C:\Windows\System\UegZkYq.exe
  C:\Windows\System\UegZkYq.exe
  2⤵
  PID:4076
- C:\Windows\System\IOHYjiN.exe
  C:\Windows\System\IOHYjiN.exe
  2⤵
  PID:2944
- C:\Windows\System\axFdFYD.exe
  C:\Windows\System\axFdFYD.exe
  2⤵
  PID:1584
- C:\Windows\System\CJEzcao.exe
  C:\Windows\System\CJEzcao.exe
  2⤵
  PID:2000
- C:\Windows\System\rpElZUQ.exe
  C:\Windows\System\rpElZUQ.exe
  2⤵
  PID:2272
- C:\Windows\System\YECZvqz.exe
  C:\Windows\System\YECZvqz.exe
  2⤵
  PID:1892
- C:\Windows\System\FYGFSea.exe
  C:\Windows\System\FYGFSea.exe
  2⤵
  PID:1648
- C:\Windows\System\JSOwmzK.exe
  C:\Windows\System\JSOwmzK.exe
  2⤵
  PID:3088
- C:\Windows\System\BDtDTxB.exe
  C:\Windows\System\BDtDTxB.exe
  2⤵
  PID:3152
- C:\Windows\System\LVwZshG.exe
  C:\Windows\System\LVwZshG.exe
  2⤵
  PID:3196
- C:\Windows\System\QJXTWdM.exe
  C:\Windows\System\QJXTWdM.exe
  2⤵
  PID:3292
- C:\Windows\System\qriLhxf.exe
  C:\Windows\System\qriLhxf.exe
  2⤵
  PID:3324
- C:\Windows\System\juetcDr.exe
  C:\Windows\System\juetcDr.exe
  2⤵
  PID:3388
- C:\Windows\System\mRTTKGm.exe
  C:\Windows\System\mRTTKGm.exe
  2⤵
  PID:3452
- C:\Windows\System\UWHELWv.exe
  C:\Windows\System\UWHELWv.exe
  2⤵
  PID:3472
- C:\Windows\System\ZYppazL.exe
  C:\Windows\System\ZYppazL.exe
  2⤵
  PID:3552
- C:\Windows\System\mKGuuCd.exe
  C:\Windows\System\mKGuuCd.exe
  2⤵
  PID:3600
- C:\Windows\System\EDVwuLc.exe
  C:\Windows\System\EDVwuLc.exe
  2⤵
  PID:3664
- C:\Windows\System\NjKuBcl.exe
  C:\Windows\System\NjKuBcl.exe
  2⤵
  PID:3708
- C:\Windows\System\HBgMyDe.exe
  C:\Windows\System\HBgMyDe.exe
  2⤵
  PID:3772
- C:\Windows\System\wWQKtaW.exe
  C:\Windows\System\wWQKtaW.exe
  2⤵
  PID:3904
- C:\Windows\System\ENbKwLc.exe
  C:\Windows\System\ENbKwLc.exe
  2⤵
  PID:2844
- C:\Windows\System\NSotloe.exe
  C:\Windows\System\NSotloe.exe
  2⤵
  PID:3936
- C:\Windows\System\AUnoawS.exe
  C:\Windows\System\AUnoawS.exe
  2⤵
  PID:4016
- C:\Windows\System\plUxtKQ.exe
  C:\Windows\System\plUxtKQ.exe
  2⤵
  PID:556
- C:\Windows\System\PwFnOLF.exe
  C:\Windows\System\PwFnOLF.exe
  2⤵
  PID:2656
- C:\Windows\System\CJWPYKn.exe
  C:\Windows\System\CJWPYKn.exe
  2⤵
  PID:2776
- C:\Windows\System\PZyRKaP.exe
  C:\Windows\System\PZyRKaP.exe
  2⤵
  PID:2560
- C:\Windows\System\wsmvywu.exe
  C:\Windows\System\wsmvywu.exe
  2⤵
  PID:2920
- C:\Windows\System\dIFfjsX.exe
  C:\Windows\System\dIFfjsX.exe
  2⤵
  PID:3212
- C:\Windows\System\WQqoJkI.exe
  C:\Windows\System\WQqoJkI.exe
  2⤵
  PID:3356
- C:\Windows\System\cusfBnN.exe
  C:\Windows\System\cusfBnN.exe
  2⤵
  PID:4108
- C:\Windows\System\ASLgXxv.exe
  C:\Windows\System\ASLgXxv.exe
  2⤵
  PID:4124
- C:\Windows\System\fDgVhGZ.exe
  C:\Windows\System\fDgVhGZ.exe
  2⤵
  PID:4140
- C:\Windows\System\VyyIDoA.exe
  C:\Windows\System\VyyIDoA.exe
  2⤵
  PID:4156
- C:\Windows\System\WTDuwoH.exe
  C:\Windows\System\WTDuwoH.exe
  2⤵
  PID:4172
- C:\Windows\System\tezrdvt.exe
  C:\Windows\System\tezrdvt.exe
  2⤵
  PID:4188
- C:\Windows\System\yRspzBU.exe
  C:\Windows\System\yRspzBU.exe
  2⤵
  PID:4204
- C:\Windows\System\sTVoFzf.exe
  C:\Windows\System\sTVoFzf.exe
  2⤵
  PID:4220
- C:\Windows\System\LUVuBEO.exe
  C:\Windows\System\LUVuBEO.exe
  2⤵
  PID:4236
- C:\Windows\System\iMeljyh.exe
  C:\Windows\System\iMeljyh.exe
  2⤵
  PID:4252
- C:\Windows\System\LtukUPU.exe
  C:\Windows\System\LtukUPU.exe
  2⤵
  PID:4268
- C:\Windows\System\SSNpRDl.exe
  C:\Windows\System\SSNpRDl.exe
  2⤵
  PID:4284
- C:\Windows\System\tKuFmET.exe
  C:\Windows\System\tKuFmET.exe
  2⤵
  PID:4300
- C:\Windows\System\xrlzaBG.exe
  C:\Windows\System\xrlzaBG.exe
  2⤵
  PID:4316
- C:\Windows\System\qvryFzc.exe
  C:\Windows\System\qvryFzc.exe
  2⤵
  PID:4336
- C:\Windows\System\MFqyvLl.exe
  C:\Windows\System\MFqyvLl.exe
  2⤵
  PID:4352
- C:\Windows\System\CMeUPXX.exe
  C:\Windows\System\CMeUPXX.exe
  2⤵
  PID:4368
- C:\Windows\System\GNRKdkt.exe
  C:\Windows\System\GNRKdkt.exe
  2⤵
  PID:4384
- C:\Windows\System\KELArfr.exe
  C:\Windows\System\KELArfr.exe
  2⤵
  PID:4400
- C:\Windows\System\tMSgFQk.exe
  C:\Windows\System\tMSgFQk.exe
  2⤵
  PID:4416
- C:\Windows\System\NNmAKnZ.exe
  C:\Windows\System\NNmAKnZ.exe
  2⤵
  PID:4432
- C:\Windows\System\ZuoikvK.exe
  C:\Windows\System\ZuoikvK.exe
  2⤵
  PID:4448
- C:\Windows\System\ivbgAjX.exe
  C:\Windows\System\ivbgAjX.exe
  2⤵
  PID:4464
- C:\Windows\System\TDGOUbY.exe
  C:\Windows\System\TDGOUbY.exe
  2⤵
  PID:4480
- C:\Windows\System\eEvrlGx.exe
  C:\Windows\System\eEvrlGx.exe
  2⤵
  PID:4496
- C:\Windows\System\VpIPUaR.exe
  C:\Windows\System\VpIPUaR.exe
  2⤵
  PID:4512
- C:\Windows\System\LUXdvkf.exe
  C:\Windows\System\LUXdvkf.exe
  2⤵
  PID:4528
- C:\Windows\System\KKsLSCX.exe
  C:\Windows\System\KKsLSCX.exe
  2⤵
  PID:4544
- C:\Windows\System\GbyanLN.exe
  C:\Windows\System\GbyanLN.exe
  2⤵
  PID:4560
- C:\Windows\System\yvmBItZ.exe
  C:\Windows\System\yvmBItZ.exe
  2⤵
  PID:4576
- C:\Windows\System\NzdkfoD.exe
  C:\Windows\System\NzdkfoD.exe
  2⤵
  PID:4592
- C:\Windows\System\xqYzEnr.exe
  C:\Windows\System\xqYzEnr.exe
  2⤵
  PID:4608
- C:\Windows\System\UaFCJeg.exe
  C:\Windows\System\UaFCJeg.exe
  2⤵
  PID:4624
- C:\Windows\System\OMogHuq.exe
  C:\Windows\System\OMogHuq.exe
  2⤵
  PID:4640
- C:\Windows\System\xIClBvX.exe
  C:\Windows\System\xIClBvX.exe
  2⤵
  PID:4656
- C:\Windows\System\pTtVfTr.exe
  C:\Windows\System\pTtVfTr.exe
  2⤵
  PID:4672
- C:\Windows\System\amfNOqO.exe
  C:\Windows\System\amfNOqO.exe
  2⤵
  PID:4688
- C:\Windows\System\HVJQVzQ.exe
  C:\Windows\System\HVJQVzQ.exe
  2⤵
  PID:4704
- C:\Windows\System\PeYohzl.exe
  C:\Windows\System\PeYohzl.exe
  2⤵
  PID:4720
- C:\Windows\System\wBJnSuh.exe
  C:\Windows\System\wBJnSuh.exe
  2⤵
  PID:4736
- C:\Windows\System\GhqXvWT.exe
  C:\Windows\System\GhqXvWT.exe
  2⤵
  PID:4752
- C:\Windows\System\WUuYqpY.exe
  C:\Windows\System\WUuYqpY.exe
  2⤵
  PID:4768
- C:\Windows\System\dzsesFc.exe
  C:\Windows\System\dzsesFc.exe
  2⤵
  PID:4784
- C:\Windows\System\AirDFmq.exe
  C:\Windows\System\AirDFmq.exe
  2⤵
  PID:4800
- C:\Windows\System\XVdeeZf.exe
  C:\Windows\System\XVdeeZf.exe
  2⤵
  PID:4816
- C:\Windows\System\APHiOHi.exe
  C:\Windows\System\APHiOHi.exe
  2⤵
  PID:4832
- C:\Windows\System\zTMZaHC.exe
  C:\Windows\System\zTMZaHC.exe
  2⤵
  PID:4848
- C:\Windows\System\MGVgpUT.exe
  C:\Windows\System\MGVgpUT.exe
  2⤵
  PID:4864
- C:\Windows\System\HDvgthU.exe
  C:\Windows\System\HDvgthU.exe
  2⤵
  PID:4880
- C:\Windows\System\vbknNCA.exe
  C:\Windows\System\vbknNCA.exe
  2⤵
  PID:4896
- C:\Windows\System\QDDhgMW.exe
  C:\Windows\System\QDDhgMW.exe
  2⤵
  PID:4912
- C:\Windows\System\FvxfcLN.exe
  C:\Windows\System\FvxfcLN.exe
  2⤵
  PID:4928
- C:\Windows\System\PmWdReX.exe
  C:\Windows\System\PmWdReX.exe
  2⤵
  PID:4944
- C:\Windows\System\EZgnibC.exe
  C:\Windows\System\EZgnibC.exe
  2⤵
  PID:4960
- C:\Windows\System\tYRwLAH.exe
  C:\Windows\System\tYRwLAH.exe
  2⤵
  PID:4984
- C:\Windows\System\RkDuTge.exe
  C:\Windows\System\RkDuTge.exe
  2⤵
  PID:5088
- C:\Windows\System\KlLHkQw.exe
  C:\Windows\System\KlLHkQw.exe
  2⤵
  PID:2100
- C:\Windows\System\yOYAkVf.exe
  C:\Windows\System\yOYAkVf.exe
  2⤵
  PID:4064
- C:\Windows\System\hIKOXgb.exe
  C:\Windows\System\hIKOXgb.exe
  2⤵
  PID:3100
- C:\Windows\System\BnlSuuM.exe
  C:\Windows\System\BnlSuuM.exe
  2⤵
  PID:3276
- C:\Windows\System\szntqVm.exe
  C:\Windows\System\szntqVm.exe
  2⤵
  PID:4604
- C:\Windows\System\naLnxCW.exe
  C:\Windows\System\naLnxCW.exe
  2⤵
  PID:4700
- C:\Windows\System\EQDCdtF.exe
  C:\Windows\System\EQDCdtF.exe
  2⤵
  PID:4744
- C:\Windows\System\XwcTXoc.exe
  C:\Windows\System\XwcTXoc.exe
  2⤵
  PID:4748
- C:\Windows\System\CfcfQFp.exe
  C:\Windows\System\CfcfQFp.exe
  2⤵
  PID:1508
- C:\Windows\System\ixaBTdL.exe
  C:\Windows\System\ixaBTdL.exe
  2⤵
  PID:1836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ERQmvBd.exe

Filesize
1.9MB

MD5
85a75bae483ec7ee7f31a90ffca38106

SHA1
ca3fe3f1cdaab81fd5c95e8d54e731edfca12b34

SHA256
97a10312bb6201bbe893875a0b47f8f3e5a0d59d0c3f38d077687508f6e47242

SHA512
5ad8bbe45d439880f15ab2d5522064e304405cac6a8debde67ee9e1e10ff12f8dc90b407feb78301fd30d95730691b87537cf3a2a1bad012f7f6a86d5db093c4

Download Submit
C:\Windows\system\GADSYWN.exe

Filesize
1.9MB

MD5
5ff50b518b8659048eb489fba0146f6d

SHA1
7208c88217c715b83e11224f148cea828a57dc14

SHA256
1ad4ddadae5df8ef3b2beda30b54f82f33889721fd1d51f30bfa0d0f206a5e4a

SHA512
c6e70a40450866215614c9c6cb46a64f4c765038e14c9016190a43d345283deeda78baacfa7ea4ca0a6c6f42658fdbc4636aa0ca54429d9499c227f08f2eb768

Download Submit
C:\Windows\system\IDtFykS.exe

Filesize
1.9MB

MD5
8cd07872774214cbd20653d5d6f58233

SHA1
3e8b034e2a2c61556518c7b9e013d75dba462f93

SHA256
35398483592c731b27e52ebce881d96a2c877396e9b137dbff826c4ab9378763

SHA512
c1741ecab5a5dd2542e2fc0b25a345c29170d28490d2465b9fbc54ea694add8d9f9b177d4745d9c19d883ec1288ec64ff42a0ce29a2a30be45dee112bf8d9eee

Download Submit
C:\Windows\system\IVvNoiu.exe

Filesize
1.9MB

MD5
92e408d7b7f9ae7c3f6ef3db4e271d8a

SHA1
b5034a2a3eb120e923db54188a3dac42e49e25cf

SHA256
0cabf5c5caa81520e15a752baf2ea01e612a772f695bc1dc8df06340e5766a10

SHA512
0671769ebf56aa4596b0a6bd41a06f1f15d9f4848e8ce83835457eaaa8c7cd808f38d91215a0784cf6a6cad6f555157637216b923a04baa93aea8265bdc00919

Download Submit
C:\Windows\system\KqRDjQp.exe

Filesize
1.9MB

MD5
e1cc843c71ce4235394dd45ec1e88c6c

SHA1
58cdb2e96041cba8ce7bf96d65e5b489f0c0015c

SHA256
5c7a0ad33cdc021ea7ea458939f7c76f976bf2a61b603fd873a7680069acd0bb

SHA512
6b830c5d1f8b7192808ee32218d9ddf43d4f2177b2037d7d293eb4477c5b47c26a474347c0cba6e0fc70b1116e9004db255bb414d113f15fcd21d51dc37574b5

Download Submit
C:\Windows\system\MopyPnu.exe

Filesize
1.9MB

MD5
655cfb5d9eb13da5e4c8f62285431f5b

SHA1
d0419c10168a6d6de5d8ff477a469e644a3c51cf

SHA256
d56d39e51f1aaa5d807273c903ec0757619ec4de488772f29b3c6c48e2a826c8

SHA512
0b9333aea74ba12b4ed0c150ecfeabd444ba80258a77c0161e77dd5d883f31819e3713285af9809fca22e56323641f7457f1f41944f500ae065e9daa63b9d48f

Download Submit
C:\Windows\system\NqavoBO.exe

Filesize
1.9MB

MD5
58b769f6e2d459dc0aa193454a5f7763

SHA1
d7863c9a3236908453553c9da0c390f7114d353d

SHA256
89ca3076ab3c2380df0e0224066e9abe19a4c91c49c02d06770d4bc330dcdcc4

SHA512
217864db5109ffff9917aec9ec616c9fe72fe443cfd6d350ebb2145c02328ff1efc706f16191b4ae41a5959f5781a52985d7a269a7a7b52f996bcdd7bb835be8

Download Submit
C:\Windows\system\RyHuTrd.exe

Filesize
1.9MB

MD5
5619f5e7faa8747588b315bffd9e1f96

SHA1
2a4d9aa0733a0ecdd09b8d118d1d4c58134ff481

SHA256
bdbbfa90d18bd0f0f490a4150aea3a7fbab196dad7706b7e8ab2f628c76d2d04

SHA512
58848764d64a38d10f50ecdfbc06cdec8c8c735c4803c7e8276ecba30d639fb1dff5bbe1e4697ea27342ed11508e6ff2ff4f7b7d9ba7e25d3c52240b95e876c4

Download Submit
C:\Windows\system\TkZabqc.exe

Filesize
1.9MB

MD5
0c197bcdfd9f3517fe1ac5b482e3c5aa

SHA1
d926af6f1830892ce2dc9b9c6cf8c60c3b95a199

SHA256
f98ad87df5fa648da0f0d316cfddc66b1a57eb2c90c7b567bed3a5a6773fafa9

SHA512
52b60c1c288a136df462e8c9925da9a9c5cfcea29e924c0c4362474a937ea567df732f29b8e87331715d15eb58cbd871174f96a0f94336746a6ffcf4f3be9b14

Download Submit
C:\Windows\system\VmVBXBK.exe

Filesize
1.9MB

MD5
ff28003df921ceeab66a236297c88015

SHA1
07b886bc1ff21f95fde875a6fb5402f30ec208a2

SHA256
223c9da487d3e79ea61cd1d447fdf7439097786fda18192baeea3062f1af70b3

SHA512
e3055500484d10bfcf9518325d6a59494ee5e359dae8a1c9ed7b0d278dd925bb74eb4645808da9f8c9b665a866ab6cb1ded0e084be799352e59d51a7c1e7de67

Download Submit
C:\Windows\system\XGWjDhb.exe

Filesize
1.9MB

MD5
7ec6dbceaf148a91b4b8f7f3bcadba64

SHA1
571da91dc4bbbb0453d7022cfb2a9f47c811b300

SHA256
e317f70940a48d11c93244c01824f258893ebc42f54437a4067e41156a33530c

SHA512
8bb50f956562f792014cdbcc1dad464a697553088853ecadefffb31508fcf3dcb75672d8eedd342683e0ec03a9b2e2055c495686149d6635712895730c2f515a

Download Submit
C:\Windows\system\aRZxkFG.exe

Filesize
1.9MB

MD5
e0f896761bd4b2eb3b4fc9587bf42088

SHA1
0c47edcababcf59a6ded316b9bbbb3eef79a3efd

SHA256
5597e33bdc73c62688c8cdb1c124d798ec0df8aedb89e3ec8073124ea08e14de

SHA512
8321eed5a84373b09606db3555e71f89db9279cf3152339fe1433a1b4e22ad3d8eacb1070c65d9a1c700bdb42ac70c22bd3f46e8d54ea60419e6f506eb7146b4

Download Submit
C:\Windows\system\bhxOQmR.exe

Filesize
1.9MB

MD5
b6098a8b2aa1ab8f0f226d0269a60b29

SHA1
e4dccc8b624a3b5e168e7a7f03893673af1009fe

SHA256
d06f7e5ab43d318d16571c227ab2671ed1bdf88db2648c3bbd364a4322857d16

SHA512
6dbddd9059fb0fce73487035aeb752a554d3b3a98e0ab2618af9763a24e19b737c47fe0f21e0fe5d259a08ad1ce8ce6235b4b13b9686ded6b7be4fb3359e9092

Download Submit
C:\Windows\system\bkxWPZU.exe

Filesize
1.9MB

MD5
1668f211c65bef6cd3bbaed456ae6fba

SHA1
a81c234e271cd2d3e86fe9a6317e45e18fdd88bb

SHA256
c21ba9b5582ef1536fe800e782d7b7e9dce9c613c42f84ac129fa5e56c0dff81

SHA512
ad1d420408ee8bc939e3d86c4d8007656ddd3d691e7eb3d87735a8730238298b8587c9c989b536035e82891087e742c92dbe0beb077a991e4c541396811c2569

Download Submit
C:\Windows\system\cfPbqVN.exe

Filesize
1.9MB

MD5
d6f3775b107a6cce97c86ca5e485fcbc

SHA1
87f013305dd4633a112758036444c1daa4ed4fa5

SHA256
3fbad27c8b0451c83b73f0f0dd123a8a5f7b741c2c9d130b7f7e1b9d15e6d412

SHA512
036b6f18b9de0026b7cc6ecf89809a4dff297dd163bac08f4d922ba3b7822d8ce229f0a180a7e9908163bc98e82689cce94e330a7279a1ab50e698ab8f0b1764

Download Submit
C:\Windows\system\fTDnFoJ.exe

Filesize
1.9MB

MD5
de407bfbc88231b9ad2d1983a15ec6af

SHA1
cf914a776cc296bfe7e69aae6235a99c6095d64a

SHA256
aa04d01fdd75e4f636797e1698de5a0dbd3b6d2ed3de10232ebfc38bf3c48905

SHA512
fcc46d99a41d0386a9fe73740243135980c19e4188c2e24b6d74af42b8c47af9074d5a6087cd5ddec3bbb93bb8557b1894e7dd16dd36a80e2e84bb54d2bfc9e0

Download Submit
C:\Windows\system\gvwnMYn.exe

Filesize
1.9MB

MD5
a7366e382072821b84858641a78f11d7

SHA1
a1cd936d40e99b5b56c59a0fbb168b94282a8927

SHA256
6ccf0df0335b74a4fba7b10a129a5429e42dfd6a9d8b54bfacbd409a7d0f9b3b

SHA512
139de3336fe2c55080a179fe66846d9359aa0784c00aeab1ae68671804fa7e301a416063635dc522583572edc82186953bc9ee2aafcd2d9559c00c231b0fa218

Download Submit
C:\Windows\system\htNlQZa.exe

Filesize
1.9MB

MD5
f835f3fda37c6bdbc0a14b7045cd7031

SHA1
0afff02d764f9188769e0ea5081e5ae2ab640234

SHA256
54a639ed64cf6f839ef8cb7568519e59cf7de3ad0bdda2f3b04ae51e7d6e9204

SHA512
49e1fab546d4cfbe66c388a707a9a0c27e5ac74ed9635436d1b7066a3bfc296fc1a65426e185f00d148c1f8b7985b1c8c01d4c22f5cd7aa3b231a0736661f6ed

Download Submit
C:\Windows\system\jccQdhI.exe

Filesize
1.9MB

MD5
106b7a850f0bb0488f863aaf1cc344f5

SHA1
622c21e65f05089d897a17be322d67bd587c5351

SHA256
18177913a457a01df5f0c49a4112a0ebfbe000bb7b168615abb5dbd1d6c3fabb

SHA512
bda69de92ed6e99d4986e275a8b759eecc4e9cfdf720a59fb1bb82a1598b6794cb947960f2f011d65eec0be39486add1274d12dc4a40969d24273d53df96a834

Download Submit
C:\Windows\system\lbUxgkk.exe

Filesize
1.9MB

MD5
0f46d4d9c773262fc162276287fab626

SHA1
9327eccfa750e8853f40df10e770e6a70dc7da41

SHA256
505c784dde38baf8239c5aea559f3db7b256d0deb32999d0f2be26265841bc89

SHA512
b24e89aac8d85391820a99fef9bcb4a62d46da19b44f23ae5b7a1cc56a9d42477f77675db0868597e7f7240158d6a688a133c83f0e1f045ed17f0fb81743e7ba

Download Submit
C:\Windows\system\mPnpQbT.exe

Filesize
1.9MB

MD5
a9856f2fad87ac835bdb19bb55d798d1

SHA1
fbcc50d45da172db55ff70de4cbbabba2d23e122

SHA256
7f9aa2b4ae7d64b5c351fed6280a60bee6266a1f62cc082557def0b2036e83e6

SHA512
810608813b3fab85fc4691ee7e14030819be9f562b89e1d34f73369e1422d7a0af872e1538828dc6927410c91b51bb0e0b6d5a4cda643b8126b9deb15483e76e

Download Submit
C:\Windows\system\oeLADAH.exe

Filesize
1.9MB

MD5
b86d10dc78592d371c1df909e462b56e

SHA1
8a128eeace0f9d27bb791ebe17bb446aff5da2e2

SHA256
52c77a60d986a48f82dc550d07c3197d1227b8b3d9510ed7c4bc1c230729f3cf

SHA512
01c6edb29f1396f5ca877ea73bb9f1a63cde8ab9998d90085b8461ef7aecd1986be81544381a41734537f70ef515f840aae4d61ed454c45f5892a5982f10c8a8

Download Submit
C:\Windows\system\qJWSxKY.exe

Filesize
1.9MB

MD5
68b23f39d4e55356e83fc95b30d3e054

SHA1
7f1d0eb64282432c135ea22d21058b7728b26ef8

SHA256
03a8ea07e9e5d7e7913d299a4e9667f5dc7e1a3cbcb919786dcc66d6960e66ad

SHA512
1581c6d618be589e3f0adad019de9b17d3090fcb793f82f5a9d80c9164907a403658ba3b62c19f0659bfdebfc51c780c4b880fd87ebb5de57253ed79efaaf118

Download Submit
C:\Windows\system\qgSAENE.exe

Filesize
1.9MB

MD5
92d6e625d9a66182b999d3ca0e0bd5c9

SHA1
60a5b8e70da68c50f4e64dc1257db8f57350a122

SHA256
5af32ac70fafa2f4200680e47e465f606fdf093d1b729b742325eefd3e5ae43d

SHA512
a5bfec98f7202ce55757114354b4b5afefdb3111c34e215b68d12fd540e1b0761decdedffe46ace13a532bb4bfe802d75d92b868d9e062ff7c44082bcf19098f

Download Submit
C:\Windows\system\qzBheFO.exe

Filesize
1.9MB

MD5
f6cdb7bfa816557e0ba67b7d33e6c85b

SHA1
55368e16ed8d15a04e8df594c04c649b56e53b06

SHA256
5f3a374bea36cdbd13e758d7be9f60a33941684bc7206d92ab10fc5a348c9063

SHA512
5ab6c556d85bcded7e5e321bc2b1617cb68b2b852aab77a2aca14f9449f33a73468400020a0a353bc13c3d01756ce4f73b12801a86c5104d51a1b949abcc641e

Download Submit
C:\Windows\system\uWsRmaq.exe

Filesize
1.9MB

MD5
e9fec35f5e750115bcd40c0f311f5c27

SHA1
06fe5c4fc164d55b6e24257ce427083d4f9be209

SHA256
0e4104edfec8919e0e8451ddbc48525e8ec44019234b5cba9eb5f244baef353d

SHA512
d9c4b54f06a40e9252454dac12f3fbf1b3dfb18ad2fdbc59f8ae8635e81d6f941101cfa1ea249068f4f2409696291ce29ac0e3b0be0201f05acb1871ba764d2e

Download Submit
C:\Windows\system\xCiNDFx.exe

Filesize
1.9MB

MD5
a1dc33925df5de60243336faf726c676

SHA1
e8f9269aaff4168b0113334f52bb47db95b26e55

SHA256
83aef77e4ef597520941e9a3e62aa6fd191ecfc573c5c637841adc000d605b69

SHA512
564b1b78a5e6a228c62335bffaa9c67dc2d88f5a911da5bc9a859f16b5f6eca8908d7438883bfbb3f6fda8503dfc18f1dae11cbdbc669bf97a1c56ba73309fe1

Download Submit
C:\Windows\system\xRGkcGL.exe

Filesize
1.9MB

MD5
81dca17a56dd882c37a95886c9f03eca

SHA1
c9ae2fab207e18b56383218dd15fc3a07f5aadda

SHA256
02b004dacf59eb8b273bfe8760f7841bbfb2f5ff8b37bd9fbe5270431aca40a8

SHA512
d68ec11fa37547e365ae4e31d6fc983792d1c5d122e095e2f16198c5d129d43fff921a9617a094d03f0a0c4117d5e6d29f8bbe60361da175be7d72a113944061

Download Submit
C:\Windows\system\zeILbrp.exe

Filesize
1.9MB

MD5
2e5192c0b46b08a43a648eaa025ed260

SHA1
d1bb9dea471051da1a02ef5b00d40ac21d51440a

SHA256
732de418f7749c8cbd07ee48f059afdc721f4056b9d117c8bdc0717521bf0186

SHA512
c760cf80c8ee11ef90a1a53830c9bfe4ccfccd7b538b00aa08246179e202e19823c4f5937c194aa1e6553d55154e892ab9f1bcc2ddb00e5bc7eb9e6b217fbca4

Download Submit
\Windows\system\HLunkCl.exe

Filesize
1.9MB

MD5
72239ee2a23cd3f2427db820250b2c9d

SHA1
dea964073523b6d3e894cadb3bcff30bcc7ed022

SHA256
63f78326183e5fa081045daf42f138318a84bade0436dc63a48a765a24690d3f

SHA512
7ef43eb4edd8135b87a2ad0de7348d1216622dcb747a63605b891726930e67f359827d8c25921ccb17793a456a315029f51a05fd62613bdd56b70e735eadd091

Download Submit
\Windows\system\bUPBlbZ.exe

Filesize
1.9MB

MD5
c212bb9beaf0d709436ee6113ff64c00

SHA1
98d303465c1801a5b7ede4fe912516d420091f4d

SHA256
497660226f2c9fb4a0f4d513d5c50013e2ef128ef0ea5029bc332fbebc8cbad0

SHA512
cd63acd10047d6b9110af1070eac177d0b95d115896b8a4231a91c7106bae5c19a3925353b509f09072b7c8391d2254abde93853754b1a3054720dfa41eedaab

Download Submit
\Windows\system\wNRuMLI.exe

Filesize
1.9MB

MD5
51fd4e47fd4b4d315a4274dba90ccf23

SHA1
b26370f63caa6d589b2b3af94292fbda786a5a7c

SHA256
d35765775d363aa3e6a2a5eb5a1c9451a36edfe0b7931d5ef4ff938c535aaa37

SHA512
d517215376a76ddf39cd27e15d70f9e78f6b266a40ceea5d307a64492074cb90f647bd822713917ada03c8dc8dac1f3b439ce823f35257f3240399130463ae37

Download Submit
memory/2176-0-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download