Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1522740
MD5: 4178bac91df58826af26760d0519dc75
SHA1: 19d7c2b17f2b7e58cfc2de9da425a106bd556bcd
SHA256: a7847a3df956c6ef6f88ba1386af47d9e974cd08285cb9fbd93c95dd5166c251
Tags: exex64user-jstrosch
Infos:

Detection

Xmrig
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Xmrig cryptocurrency miner
AI detected suspicious sample
Contains functionality to registers a callback to get notified when the system is suspended or resumed (often done by Miners)
Drops executables to the windows directory (C:\Windows) and starts them
Found strings related to Crypto-Mining
Machine Learning detection for dropped file
Machine Learning detection for sample
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
May sleep (evasive loops) to hinder dynamic analysis
Sample execution stops while process was sleeping (likely an evasion)
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
xmrig According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: file.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Windows\System32\ENNjqpn.exe Avira: detection malicious, Label: PUA/CoinMiner.Gen
Source: C:\Windows\System32\BZXlXZF.exe Avira: detection malicious, Label: PUA/CoinMiner.Gen
Source: C:\Windows\System32\AAFWtMo.exe Avira: detection malicious, Label: PUA/CoinMiner.Gen
Source: C:\Windows\System32\DYRnoDf.exe Avira: detection malicious, Label: PUA/CoinMiner.Gen
Source: C:\Windows\System32\ENASfEY.exe Avira: detection malicious, Label: PUA/CoinMiner.Gen
Source: C:\Windows\System32\EeTDKLH.exe Avira: detection malicious, Label: PUA/CoinMiner.Gen
Source: C:\Windows\System32\AvKmyWx.exe Avira: detection malicious, Label: PUA/CoinMiner.Gen
Source: C:\Windows\System32\CGHEajN.exe Avira: detection malicious, Label: PUA/CoinMiner.Gen
Source: C:\Windows\System32\AJbunRc.exe Avira: detection malicious, Label: PUA/CoinMiner.Gen
Source: C:\Windows\System32\DecYaAF.exe Avira: detection malicious, Label: PUA/CoinMiner.Gen
Source: C:\Windows\System32\BGEmobC.exe Avira: detection malicious, Label: PUA/CoinMiner.Gen
Source: C:\Windows\System32\CwZoVMx.exe Avira: detection malicious, Label: PUA/CoinMiner.Gen
Source: C:\Windows\System32\BQVZXof.exe Avira: detection malicious, Label: PUA/CoinMiner.Gen
Source: C:\Windows\System32\BlxXZNI.exe Avira: detection malicious, Label: PUA/CoinMiner.Gen
Source: C:\Windows\System32\DNWTLfi.exe Avira: detection malicious, Label: PUA/CoinMiner.Gen
Source: C:\Windows\System32\EYQygjH.exe Avira: detection malicious, Label: PUA/CoinMiner.Gen
Source: C:\Windows\System32\BBTtOmS.exe Avira: detection malicious, Label: PUA/CoinMiner.Gen
Source: C:\Windows\System32\AoDqPum.exe Avira: detection malicious, Label: PUA/CoinMiner.Gen
Source: C:\Windows\System32\AeHKOUk.exe Avira: detection malicious, Label: PUA/CoinMiner.Gen
Source: C:\Windows\System32\CStEhbp.exe Avira: detection malicious, Label: PUA/CoinMiner.Gen
Source: C:\Windows\System32\DjFGkEO.exe Avira: detection malicious, Label: PUA/CoinMiner.Gen
Source: C:\Windows\System32\DoYQIEQ.exe Avira: detection malicious, Label: PUA/CoinMiner.Gen
Source: C:\Windows\System32\BkMxlYA.exe Avira: detection malicious, Label: PUA/CoinMiner.Gen
Source: C:\Windows\System32\AmlHggH.exe Avira: detection malicious, Label: PUA/CoinMiner.Gen
Source: C:\Windows\System32\AINedvE.exe Avira: detection malicious, Label: PUA/CoinMiner.Gen
Source: C:\Windows\System32\AfwGLOC.exe Avira: detection malicious, Label: PUA/CoinMiner.Gen
Source: C:\Windows\System32\ANovuUs.exe Avira: detection malicious, Label: PUA/CoinMiner.Gen
Source: C:\Windows\System32\AOxtNit.exe Avira: detection malicious, Label: PUA/CoinMiner.Gen
Source: C:\Windows\System32\CgshOaM.exe Avira: detection malicious, Label: PUA/CoinMiner.Gen
Source: C:\Windows\System32\BXwYBdZ.exe Avira: detection malicious, Label: PUA/CoinMiner.Gen
Source: C:\Windows\System32\AARFjPz.exe Avira: detection malicious, Label: PUA/CoinMiner.Gen
Multi AV Scanner detection for submitted file
Source: file.exe ReversingLabs: Detection: 84%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.1% probability
Machine Learning detection for dropped file
Source: C:\Windows\System32\ENNjqpn.exe Joe Sandbox ML: detected
Source: C:\Windows\System32\BZXlXZF.exe Joe Sandbox ML: detected
Source: C:\Windows\System32\AAFWtMo.exe Joe Sandbox ML: detected
Source: C:\Windows\System32\DYRnoDf.exe Joe Sandbox ML: detected
Source: C:\Windows\System32\ENASfEY.exe Joe Sandbox ML: detected
Source: C:\Windows\System32\EeTDKLH.exe Joe Sandbox ML: detected
Source: C:\Windows\System32\AvKmyWx.exe Joe Sandbox ML: detected
Source: C:\Windows\System32\CGHEajN.exe Joe Sandbox ML: detected
Source: C:\Windows\System32\AJbunRc.exe Joe Sandbox ML: detected
Source: C:\Windows\System32\DecYaAF.exe Joe Sandbox ML: detected
Source: C:\Windows\System32\BGEmobC.exe Joe Sandbox ML: detected
Source: C:\Windows\System32\CwZoVMx.exe Joe Sandbox ML: detected
Source: C:\Windows\System32\BQVZXof.exe Joe Sandbox ML: detected
Source: C:\Windows\System32\BlxXZNI.exe Joe Sandbox ML: detected
Source: C:\Windows\System32\DNWTLfi.exe Joe Sandbox ML: detected
Source: C:\Windows\System32\EYQygjH.exe Joe Sandbox ML: detected
Source: C:\Windows\System32\BBTtOmS.exe Joe Sandbox ML: detected
Source: C:\Windows\System32\AoDqPum.exe Joe Sandbox ML: detected
Source: C:\Windows\System32\AeHKOUk.exe Joe Sandbox ML: detected
Source: C:\Windows\System32\CStEhbp.exe Joe Sandbox ML: detected
Source: C:\Windows\System32\DjFGkEO.exe Joe Sandbox ML: detected
Source: C:\Windows\System32\DoYQIEQ.exe Joe Sandbox ML: detected
Source: C:\Windows\System32\BkMxlYA.exe Joe Sandbox ML: detected
Source: C:\Windows\System32\AmlHggH.exe Joe Sandbox ML: detected
Source: C:\Windows\System32\AINedvE.exe Joe Sandbox ML: detected
Source: C:\Windows\System32\AfwGLOC.exe Joe Sandbox ML: detected
Source: C:\Windows\System32\ANovuUs.exe Joe Sandbox ML: detected
Source: C:\Windows\System32\AOxtNit.exe Joe Sandbox ML: detected
Source: C:\Windows\System32\CgshOaM.exe Joe Sandbox ML: detected
Source: C:\Windows\System32\BXwYBdZ.exe Joe Sandbox ML: detected
Source: C:\Windows\System32\AARFjPz.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: file.exe Joe Sandbox ML: detected

Bitcoin Miner
barindex
Yara detected Xmrig cryptocurrency miner
Source: Yara match File source: 7.2.OTQisvZ.exe.7ff63cce0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.wkKSPgp.exe.7ff7e2fb0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 31.2.FmDRJeq.exe.7ff6cc6e0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.NbSGhVM.exe.7ff6b47a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.2.Emkynwd.exe.7ff7750c0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.JxXCqVa.exe.7ff601720000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 27.2.WJJOByy.exe.7ff77f320000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.AJbunRc.exe.7ff695c60000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 28.2.DNWTLfi.exe.7ff6f3450000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.XaZvEHG.exe.7ff61d670000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.YuhEzpi.exe.7ff740490000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.FSsBuPy.exe.7ff6ec710000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.PXvfCpI.exe.7ff63fd90000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 38.2.UTMWcnW.exe.7ff74e920000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.DYRnoDf.exe.7ff6e0b30000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.FJbyTtP.exe.7ff72c9d0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.biTFilm.exe.7ff650c60000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.qulWMNK.exe.7ff75ce90000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 30.2.eTlchBa.exe.7ff781b70000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.SUqdJFj.exe.7ff6abe50000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 35.2.zgnppqX.exe.7ff7fb250000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.dhdvyXn.exe.7ff741710000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.2.nUwvlEf.exe.7ff602d90000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.VFmvQYa.exe.7ff7bf040000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.TIHWeXa.exe.7ff78ccd0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.FTsRyWe.exe.7ff69f8a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.AvKmyWx.exe.7ff610230000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.KvrKIPQ.exe.7ff76a090000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.JVLiIAQ.exe.7ff7f0e60000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.ODEkuhr.exe.7ff7fa7c0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.JvuHRXO.exe.7ff6e1ed0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.gaDJFNb.exe.7ff6273a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.oblCraV.exe.7ff6a9e60000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.2.uUnCnJC.exe.7ff6c4430000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.ehLRfQc.exe.7ff647cc0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.QMneGpM.exe.7ff765d80000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 36.2.VeDzKyt.exe.7ff6be0a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.BXwYBdZ.exe.7ff7f5f90000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000028.00000002.1405612196.00007FF6EC711000.00000040.00000001.01000000.00000029.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.1383052956.00007FF7FA7C1000.00000040.00000001.01000000.00000016.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.1375078736.00007FF6E0B31000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.1396382038.00007FF76A091000.00000040.00000001.01000000.00000023.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.1392384745.00007FF6CC6E1000.00000040.00000001.01000000.00000020.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.1363257135.00007FF647CC1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.1398206646.00007FF7FB251000.00000040.00000001.01000000.00000024.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.1375345435.00007FF650C61000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.1366048511.00007FF6A9E61000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.1362497526.00007FF6273A1000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match File source: 00000026.00000002.1403867031.00007FF74E921000.00000040.00000001.01000000.00000027.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.1404780984.00007FF602D91000.00000040.00000001.01000000.00000028.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.1383923541.00007FF7BF041000.00000040.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.1395070392.00007FF75CE91000.00000040.00000001.01000000.00000022.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.1388605319.00007FF77F321000.00000040.00000001.01000000.0000001C.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1361257869.00007FF7E2FB1000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.1367675145.00007FF740491000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.1386427447.00007FF6C4431000.00000040.00000001.01000000.0000001A.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1364920698.00007FF61D671000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.1390364369.00007FF7F0E61000.00000040.00000001.01000000.0000001E.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.1375169466.00007FF7F5F91000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.1393342592.00007FF601721000.00000040.00000001.01000000.00000021.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.1380687334.00007FF63FD91000.00000040.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.1359897501.00007FF6E1ED1000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.1385460441.00007FF69F8A1000.00000040.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.1402533725.00007FF7750C1000.00000040.00000001.01000000.00000026.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.1389033820.00007FF6F3451000.00000040.00000001.01000000.0000001D.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1364414958.00007FF610231000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.1381609239.00007FF741711000.00000040.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.1382041502.00007FF765D81000.00000040.00000001.01000000.00000015.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.1385081519.00007FF72C9D1000.00000040.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.1387497734.00007FF6B47A1000.00000040.00000001.01000000.0000001B.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.1379338394.00007FF78CCD1000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.1376970168.00007FF695C61000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000002.1391714498.00007FF781B71000.00000040.00000001.01000000.0000001F.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.1378219320.00007FF6ABE51000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.1400934255.00007FF6BE0A1000.00000040.00000001.01000000.00000025.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.1363885220.00007FF63CCE1000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Contains functionality to registers a callback to get notified when the system is suspended or resumed (often done by Miners)
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F3EBF0 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError, 3_2_00007FF6E1F3EBF0
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E301EBF0 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError, 4_2_00007FF7E301EBF0
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF62740EBF0 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError, 5_2_00007FF62740EBF0
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647D2EBF0 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError, 6_2_00007FF647D2EBF0
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CD4EBF0 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError, 7_2_00007FF63CD4EBF0
Source: C:\Windows\System32\AvKmyWx.exe Code function: 8_2_00007FF61029EBF0 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError, 8_2_00007FF61029EBF0
Source: C:\Windows\System32\XaZvEHG.exe Code function: 9_2_00007FF61D6DEBF0 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError, 9_2_00007FF61D6DEBF0
Found strings related to Crypto-Mining
Source: JvuHRXO.exe String found in binary or memory: stratum+tcp://
Source: JvuHRXO.exe String found in binary or memory: cryptonight/double
Source: JvuHRXO.exe String found in binary or memory: stratum+tcp://
Source: file.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: file.exe, OTQisvZ.exe.0.dr, KNQeCYU.exe.0.dr, FTsRyWe.exe.0.dr, UYpGIpx.exe.0.dr, YuhEzpi.exe.0.dr, JyTylDG.exe.0.dr, rWLJMFs.exe.0.dr, MVyvCVk.exe.0.dr, UsvbkSz.exe.0.dr, FCGGaTu.exe.0.dr, QeMlQoi.exe.0.dr, ZxDRWfb.exe.0.dr, boujFkb.exe.0.dr, ENNjqpn.exe.0.dr, LKIvikl.exe.0.dr, vINSkcN.exe.0.dr, gIWIAoR.exe.0.dr, vQWABTG.exe.0.dr, BZXlXZF.exe.0.dr, byMqxSp.exe.0.dr String found in binary or memory: https://gettodaveriviedt0.com/secur3-appleld-verlfy1/?16shop)
Source: file.exe, OTQisvZ.exe.0.dr, KNQeCYU.exe.0.dr, FTsRyWe.exe.0.dr, UYpGIpx.exe.0.dr, YuhEzpi.exe.0.dr, JyTylDG.exe.0.dr, rWLJMFs.exe.0.dr, MVyvCVk.exe.0.dr, UsvbkSz.exe.0.dr, FCGGaTu.exe.0.dr, QeMlQoi.exe.0.dr, ZxDRWfb.exe.0.dr, boujFkb.exe.0.dr, ENNjqpn.exe.0.dr, LKIvikl.exe.0.dr, vINSkcN.exe.0.dr, gIWIAoR.exe.0.dr, vQWABTG.exe.0.dr, BZXlXZF.exe.0.dr, byMqxSp.exe.0.dr String found in binary or memory: https://pdfcrowd.com/?ref=pdf)
Source: file.exe, OTQisvZ.exe.0.dr, KNQeCYU.exe.0.dr, FTsRyWe.exe.0.dr, UYpGIpx.exe.0.dr, YuhEzpi.exe.0.dr, JyTylDG.exe.0.dr, rWLJMFs.exe.0.dr, MVyvCVk.exe.0.dr, UsvbkSz.exe.0.dr, FCGGaTu.exe.0.dr, QeMlQoi.exe.0.dr, ZxDRWfb.exe.0.dr, boujFkb.exe.0.dr, ENNjqpn.exe.0.dr, LKIvikl.exe.0.dr, vINSkcN.exe.0.dr, gIWIAoR.exe.0.dr, vQWABTG.exe.0.dr, BZXlXZF.exe.0.dr, byMqxSp.exe.0.dr String found in binary or memory: https://pdfcrowd.com/doc/api/?ref=pdf)

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 7.2.OTQisvZ.exe.7ff63cce0000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 4.2.wkKSPgp.exe.7ff7e2fb0000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 31.2.FmDRJeq.exe.7ff6cc6e0000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 26.2.NbSGhVM.exe.7ff6b47a0000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 37.2.Emkynwd.exe.7ff7750c0000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 32.2.JxXCqVa.exe.7ff601720000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 27.2.WJJOByy.exe.7ff77f320000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 15.2.AJbunRc.exe.7ff695c60000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 28.2.DNWTLfi.exe.7ff6f3450000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 9.2.XaZvEHG.exe.7ff61d670000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 11.2.YuhEzpi.exe.7ff740490000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 40.2.FSsBuPy.exe.7ff6ec710000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 18.2.PXvfCpI.exe.7ff63fd90000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 38.2.UTMWcnW.exe.7ff74e920000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 12.2.DYRnoDf.exe.7ff6e0b30000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 23.2.FJbyTtP.exe.7ff72c9d0000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 13.2.biTFilm.exe.7ff650c60000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 33.2.qulWMNK.exe.7ff75ce90000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 30.2.eTlchBa.exe.7ff781b70000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 16.2.SUqdJFj.exe.7ff6abe50000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 35.2.zgnppqX.exe.7ff7fb250000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 19.2.dhdvyXn.exe.7ff741710000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 39.2.nUwvlEf.exe.7ff602d90000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 22.2.VFmvQYa.exe.7ff7bf040000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 17.2.TIHWeXa.exe.7ff78ccd0000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 24.2.FTsRyWe.exe.7ff69f8a0000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 8.2.AvKmyWx.exe.7ff610230000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 34.2.KvrKIPQ.exe.7ff76a090000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 29.2.JVLiIAQ.exe.7ff7f0e60000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 21.2.ODEkuhr.exe.7ff7fa7c0000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 3.2.JvuHRXO.exe.7ff6e1ed0000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 5.2.gaDJFNb.exe.7ff6273a0000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 10.2.oblCraV.exe.7ff6a9e60000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 25.2.uUnCnJC.exe.7ff6c4430000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 6.2.ehLRfQc.exe.7ff647cc0000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 20.2.QMneGpM.exe.7ff765d80000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 36.2.VeDzKyt.exe.7ff6be0a0000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 14.2.BXwYBdZ.exe.7ff7f5f90000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Creates files inside the system directory
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\JvuHRXO.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\wkKSPgp.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\gaDJFNb.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ehLRfQc.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\OTQisvZ.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\AvKmyWx.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\XaZvEHG.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\oblCraV.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\YuhEzpi.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\DYRnoDf.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\biTFilm.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\BXwYBdZ.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\AJbunRc.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\SUqdJFj.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\TIHWeXa.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\PXvfCpI.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\dhdvyXn.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\QMneGpM.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ODEkuhr.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\VFmvQYa.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FJbyTtP.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FTsRyWe.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\uUnCnJC.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\NbSGhVM.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\WJJOByy.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\DNWTLfi.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\JVLiIAQ.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\eTlchBa.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FmDRJeq.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\JxXCqVa.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\qulWMNK.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\KvrKIPQ.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\zgnppqX.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\VeDzKyt.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\Emkynwd.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\UTMWcnW.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\nUwvlEf.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FSsBuPy.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\XbmxgAo.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\xZCsQFU.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\oLIMGEG.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\LmLfObb.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\xosmhFY.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\YHzfIbf.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\vUMVWef.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\YeogayJ.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\cWFXjGb.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\jlhXoDU.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\QQrJtgR.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\YoWRHKm.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\DecYaAF.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\RkBIliC.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\gIWIAoR.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\HHkrdhY.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\OakHRVh.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\VcsXjEN.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\kiaPNWp.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\koSIwBF.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\rECIoeF.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\niuNHza.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\YDNKKav.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\nEqlptY.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\AINedvE.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\XiEDOUw.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\LIUOcyg.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FCGGaTu.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\AOxtNit.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\uwpSJTY.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\LKIvikl.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\GEjShaj.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\BBTtOmS.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\waRaTny.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\NbwonFl.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\QafCaUC.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\aaQPPko.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\CwZoVMx.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\vsZRZPn.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\asMPLRF.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\uxZFvtG.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\XAMlAeL.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\wncnOga.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\mUtoiRj.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\dbOMNtK.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\jNvuQDu.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\TRDwKtF.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\zAqphYy.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ZjfUfPp.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ZxDRWfb.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\EvKiHlY.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\rzOVEdp.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\tRrgCEd.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\gVxVuPE.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\dznqpDP.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\uJLpuAT.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\JlwJpiQ.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\LlVYLfY.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\HfVKjfu.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\pONZxkY.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\PATRbwz.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\XvmplkI.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\OkcQGeE.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\iNyWjdh.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\edsunAc.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\MqDEnug.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\hHyzwMR.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\aRcunFP.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\hEUdUZb.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FPbzJmC.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\mZbuFep.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\EpJmKCP.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\xsPUYnY.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\hiRRhNA.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\JyTylDG.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FOKqTNk.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\dkvzZbr.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\mNMttQk.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\atCrJKj.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\gZXMDli.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\BkMxlYA.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\pnHAApr.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\bWqzsZL.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\AeHKOUk.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\wMaaxvk.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\NHtBCxU.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\Pyjxeub.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\cMZjysl.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\BlxXZNI.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FddCmld.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\qYfJmBx.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\AAFWtMo.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\SDuWpap.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\LsxWNuU.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\suHCBrv.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\hImJGCQ.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\IGbJixm.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\bZAgvbx.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\OmReOVb.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\spwZxbD.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\rzBuUNn.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\DoYQIEQ.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\xjXpcqI.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\HqzYgND.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\dXYoCLq.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\HuQzjRH.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\nOUmNRd.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\hcWXimc.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ugXtQTT.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\KPSoDjq.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\jOLYVDQ.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\KXPXHqw.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\tYuJBKo.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\pCYFbPY.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\DjFGkEO.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\dcvcJux.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\oheGeDM.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\vtyxvBq.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\vQWABTG.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\wIBrJnT.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\wLBrJuN.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\yQykaWi.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\gsJfIAI.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\TuPZZgO.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\VGaYkjy.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\agvrwBm.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\UsvbkSz.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\nZqSwkk.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\UhaWIvI.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\KEckQhl.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\nVRFUMU.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\UYpGIpx.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\sRxYPzo.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\byMqxSp.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\rWLJMFs.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\hPbLcyI.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\iDjoCba.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\hkdrylp.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\yeQSiTm.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\kwBHINw.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\pmqeloX.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\gFItvpO.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\MVyvCVk.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\pVAAkNS.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\NkJqpeK.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\IfWXppj.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\KNQeCYU.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\gvzqmaV.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\AARFjPz.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\QeMlQoi.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\dxwuaZx.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\qBNFibO.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\boujFkb.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\lvuSoVX.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\OCQPeNZ.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\CStEhbp.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\sHrvKbH.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\YPSGLBU.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\nySppDL.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\oeyXpah.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\PFFZxBK.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\MZzfLEZ.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ZcPsbVC.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\vINSkcN.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\zcRTKcl.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ZZceFPb.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\BGEmobC.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\sOMtwdY.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\NoVBMWR.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\MwQiyKB.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\qPOzufP.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\UcDbkWX.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\uoUnoPV.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\OjDKkKR.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FfHFdUV.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\BQVZXof.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\KsaexJr.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\zoNaMRv.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\PtyEDzX.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\JSWAmsK.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\KdtqCrx.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\qrMFKUE.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ENNjqpn.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\CgshOaM.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\sDUxUOz.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\rfvRxbV.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ezbfIqP.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\IGIRuaN.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ihRMBvK.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\SYhASaz.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\cQSYuAP.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\AoDqPum.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\IbzihzQ.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\XdtKVFg.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\WaSCrgW.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\wHmEWnE.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\RSlZAbq.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\hHHgQhg.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\TrOUMxR.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\aqHHhqZ.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\htpHIjf.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\AmlHggH.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\YNbNjyr.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\KisuSgd.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ANovuUs.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\WaZAbif.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\TKmEpby.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\SUPTwuz.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\OLgSbZB.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\pydLviI.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\CGHEajN.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\VJGuWtg.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\vwIpBIp.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\kcGcYyc.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\NppXEik.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\hdrmJmm.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\hldtrer.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\EeTDKLH.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\SuSRVcd.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\qQrbmYX.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\EYQygjH.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\nUxFpBv.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\MqBemCY.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\UthEkPV.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\HKQIXhJ.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\YoRPgID.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\oTTZHtv.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\JPNUgrl.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\eJQEoBU.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\PVSsNXl.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\oFlkVvC.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\BZXlXZF.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\OaEKhAc.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ZOsbaqw.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\bHOUpYN.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ZksIGgD.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\thYWpNp.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\iVxWAhp.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\OoXXuCQ.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\lYsCKDB.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\qyjihXJ.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\HmNtbmf.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\zxkWcfH.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\IwiJsNl.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\yNciWyL.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\SgRYHnh.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\MfIrnxp.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\JnWFmyo.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\pBUJBbD.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\zafOJaW.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\NUGNSrJ.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\AfwGLOC.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\lkHmjCB.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\iWlgDsI.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\fsYNdIS.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\HhuUNgU.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\cbxEAHb.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ifdEeMJ.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ZYpXsUH.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\rSfKwnk.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\VDAzIym.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\UWoSVBa.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FgkhtMM.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\kDIeJiO.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\sklRMsM.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\WUhIqEX.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\LRwQOeC.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\SJbiQtA.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ecTFjpe.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ENASfEY.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\WvCPwWV.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FwDCyKX.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\LIYZzMn.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\daTQGhs.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\SFUZlia.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\KTKMSLw.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\pQiWMAE.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\oXhzTJB.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\IkKuNGZ.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\cvviXVl.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\gIerfNx.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\JVEeonp.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\zoWFHEB.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\VWmfLAK.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\SxUWiRQ.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\dTlWhsy.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\sGHQnMX.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\kPIwtDx.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\zZluDpQ.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ycvgKWP.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\jNFZeRV.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\dGuPBcu.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\vycObZI.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\inRRvXn.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\CwhXtVv.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\gBfjURW.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\zbghAjn.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\cQjoPzl.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\MtQYYan.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FgEDYIt.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\GeITmSX.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\nipGDpr.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\KxuObHx.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\mdZCEdX.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\whSZjGj.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ubpUeIJ.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\kPIyRaw.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\eWlDXse.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FJaEnfD.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\yyfpoGS.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\KcCxmHR.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\pwERttL.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\LWVlprA.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\OZElmzI.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\cbDTXVG.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\mfhRMhg.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\bPBkhXh.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\AyyQOKl.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\gYSrEOC.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\VAruRnG.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ZtwOljK.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\UBRkEpD.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\BRJWUZY.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\sBLKXCX.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\TUveOGT.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\PjSaBpk.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\qyfmWZU.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\zXnlfSn.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\vyGiaJM.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\zeIWZHV.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\KYyOXBi.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\xzRvPAx.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\nnhkwcP.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\IbtPNdR.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\nhsLjwP.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\sXNrjna.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\VzqgCXA.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\bahuBDs.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\nfHZHOa.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\dacrbjB.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\RoAEEuh.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\otygJwy.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\mfKSgnw.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\QvBxzJt.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\YixMfbM.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\lwoZXhA.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\kcAITno.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\XdkEtpr.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\rGYkBRf.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FcbbbYp.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\bytvdvw.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ePaPAAc.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\Mzjbyhv.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\YwlXteM.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ERwQLOW.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\QFZnnAt.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\XrXGDOi.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\KjKFtzd.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\uEpDLsK.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\bothfGK.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\dCKgClx.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\KuKfsnM.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\NYbMFYE.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\fNkqHSN.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\qzksQwK.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FoXxMJm.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\xmBCROr.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\zNsdkgR.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\OrPfHRc.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\whhxFJt.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\VDmWQeI.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\fJESXJh.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\OFgjJeB.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\HnSeaEn.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\DmYjEUn.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\pDcAvMO.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ZokzIkU.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\nIodAWM.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\QQpMfDH.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\vctZvNQ.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\XKzINOS.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ZghmMLZ.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\cYUvoSX.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\NlVjUSL.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\iiBjZzs.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\NrgFLNf.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\iIDZrtt.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\EwiGDqy.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ldWOsZq.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\DKuuvBy.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\SHkpggW.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\KkwagnX.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\jeofPto.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\WYnuJvZ.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\eBSmkld.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\fWrJahI.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\miWQvCJ.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\YDnDFrB.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\PmrPbEd.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\vLBMXgO.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\MUGlQGy.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\JWypZjb.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\RaMhjBC.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\rQTCpBp.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\MEOwgiH.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\tEswRTe.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\iHiwTyI.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\QVcgtsY.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\MthZsiG.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\QkPKnBV.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\KrbTqff.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\TzqeQtq.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\brrSsjj.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\hrHPxkr.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\UWrzTUG.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\fdFKnNk.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\uaXULVF.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\XYSKwJX.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\MytGnLr.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\JZdUYhq.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\RgdXPiG.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\zGtxQbe.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FjVBhmf.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\CMwKKCe.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\TjxybYr.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\WMxLixE.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\nmQuMCR.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\sxcvDqa.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\wsTfvdH.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\bNOSUVo.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\OALjLLG.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ZqZHfLm.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\tHyISZt.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\hLkOyIS.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\HSZhlFr.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\qvmXfwZ.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\CxafMzo.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\UlXOAcP.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\zDObYyC.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\KQKxHwR.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\LJRpRxc.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\MzXqePW.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\UEJgVFQ.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\DwIGaIq.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\PZwZAjF.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\oJaUxFB.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\DBVTZBq.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\hYJPxIk.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\kIYfQzW.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\UlvXHCl.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\DZDXASu.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\fXpIDNg.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\MXYgmhn.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\AjUVgdX.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\wZeBLtV.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\GsKfcYn.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\gIxCbmU.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\PrRulyG.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\qQYKOZo.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\vEYUCUY.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\QZvVGFk.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\kUvXUxh.exe Jump to behavior
Detected potential crypto function
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FDF340 3_2_00007FF6E1FDF340
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F86B44 3_2_00007FF6E1F86B44
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1ED92E0 3_2_00007FF6E1ED92E0
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F99388 3_2_00007FF6E1F99388
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F173A0 3_2_00007FF6E1F173A0
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FB4BB0 3_2_00007FF6E1FB4BB0
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F02AC0 3_2_00007FF6E1F02AC0
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FC4BD0 3_2_00007FF6E1FC4BD0
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1EF8A70 3_2_00007FF6E1EF8A70
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FC3410 3_2_00007FF6E1FC3410
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FC3C20 3_2_00007FF6E1FC3C20
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F99C20 3_2_00007FF6E1F99C20
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FCA420 3_2_00007FF6E1FCA420
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1EEBA40 3_2_00007FF6E1EEBA40
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F00230 3_2_00007FF6E1F00230
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FBD450 3_2_00007FF6E1FBD450
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FCFC50 3_2_00007FF6E1FCFC50
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FC8C70 3_2_00007FF6E1FC8C70
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F16C70 3_2_00007FF6E1F16C70
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FD54A0 3_2_00007FF6E1FD54A0
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FCE4A0 3_2_00007FF6E1FCE4A0
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FC94D0 3_2_00007FF6E1FC94D0
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FD3CE0 3_2_00007FF6E1FD3CE0
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F334B4 3_2_00007FF6E1F334B4
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1EEC980 3_2_00007FF6E1EEC980
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FABD00 3_2_00007FF6E1FABD00
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FCED00 3_2_00007FF6E1FCED00
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FA9D20 3_2_00007FF6E1FA9D20
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F8AD30 3_2_00007FF6E1F8AD30
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FC6940 3_2_00007FF6E1FC6940
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F00530 3_2_00007FF6E1F00530
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1EECD10 3_2_00007FF6E1EECD10
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1EEDD10 3_2_00007FF6E1EEDD10
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F33165 3_2_00007FF6E1F33165
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FC3970 3_2_00007FF6E1FC3970
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F01500 3_2_00007FF6E1F01500
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1EE8CF0 3_2_00007FF6E1EE8CF0
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FCC180 3_2_00007FF6E1FCC180
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FC5190 3_2_00007FF6E1FC5190
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FDC190 3_2_00007FF6E1FDC190
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FD19B0 3_2_00007FF6E1FD19B0
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F159C0 3_2_00007FF6E1F159C0
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FCA9D0 3_2_00007FF6E1FCA9D0
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FC59F0 3_2_00007FF6E1FC59F0
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1EF2C80 3_2_00007FF6E1EF2C80
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FDC9F0 3_2_00007FF6E1FDC9F0
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FDE1F0 3_2_00007FF6E1FDE1F0
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FD0200 3_2_00007FF6E1FD0200
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F941F8 3_2_00007FF6E1F941F8
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1EF0460 3_2_00007FF6E1EF0460
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FD7210 3_2_00007FF6E1FD7210
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1EF1C50 3_2_00007FF6E1EF1C50
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F18A20 3_2_00007FF6E1F18A20
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F00C40 3_2_00007FF6E1F00C40
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FCB230 3_2_00007FF6E1FCB230
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1EF1420 3_2_00007FF6E1EF1420
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1EF4410 3_2_00007FF6E1EF4410
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FD5A60 3_2_00007FF6E1FD5A60
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FD0A60 3_2_00007FF6E1FD0A60
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1EE9BE0 3_2_00007FF6E1EE9BE0
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FD62C0 3_2_00007FF6E1FD62C0
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1EEFB80 3_2_00007FF6E1EEFB80
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F06B80 3_2_00007FF6E1F06B80
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F08B10 3_2_00007FF6E1F08B10
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F9CB20 3_2_00007FF6E1F9CB20
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1ED7350 3_2_00007FF6E1ED7350
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1EFB730 3_2_00007FF6E1EFB730
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FC7760 3_2_00007FF6E1FC7760
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1EEE700 3_2_00007FF6E1EEE700
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FD1F70 3_2_00007FF6E1FD1F70
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FD8F70 3_2_00007FF6E1FD8F70
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FCCF90 3_2_00007FF6E1FCCF90
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F09F90 3_2_00007FF6E1F09F90
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F1B790 3_2_00007FF6E1F1B790
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FD27B0 3_2_00007FF6E1FD27B0
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F1A7B0 3_2_00007FF6E1F1A7B0
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1EF8EB0 3_2_00007FF6E1EF8EB0
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FD77C0 3_2_00007FF6E1FD77C0
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F1CFF0 3_2_00007FF6E1F1CFF0
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1EF9E70 3_2_00007FF6E1EF9E70
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F17010 3_2_00007FF6E1F17010
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FD8020 3_2_00007FF6E1FD8020
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F18020 3_2_00007FF6E1F18020
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1EEEE40 3_2_00007FF6E1EEEE40
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F0B830 3_2_00007FF6E1F0B830
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F03610 3_2_00007FF6E1F03610
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FBD070 3_2_00007FF6E1FBD070
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F0A870 3_2_00007FF6E1F0A870
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FDF890 3_2_00007FF6E1FDF890
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FB58C0 3_2_00007FF6E1FB58C0
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F01DA0 3_2_00007FF6E1F01DA0
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F06D90 3_2_00007FF6E1F06D90
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1EDED90 3_2_00007FF6E1EDED90
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1EE0D90 3_2_00007FF6E1EE0D90
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1EF9540 3_2_00007FF6E1EF9540
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F07120 3_2_00007FF6E1F07120
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F08120 3_2_00007FF6E1F08120
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FD4550 3_2_00007FF6E1FD4550
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1ED70F0 3_2_00007FF6E1ED70F0
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1EED0A0 3_2_00007FF6E1EED0A0
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F7FDEC 3_2_00007FF6E1F7FDEC
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FA1DF4 3_2_00007FF6E1FA1DF4
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FB2E10 3_2_00007FF6E1FB2E10
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1EFD860 3_2_00007FF6E1EFD860
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F31E20 3_2_00007FF6E1F31E20
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1EDD030 3_2_00007FF6E1EDD030
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1EFA810 3_2_00007FF6E1EFA810
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1EE97E0 3_2_00007FF6E1EE97E0
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FC86B0 3_2_00007FF6E1FC86B0
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F19EB0 3_2_00007FF6E1F19EB0
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FC36C0 3_2_00007FF6E1FC36C0
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FCDEE0 3_2_00007FF6E1FCDEE0
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1ED2F80 3_2_00007FF6E1ED2F80
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FC6F00 3_2_00007FF6E1FC6F00
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1EEC770 3_2_00007FF6E1EEC770
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FD3700 3_2_00007FF6E1FD3700
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F04740 3_2_00007FF6E1F04740
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1FCC730 3_2_00007FF6E1FCC730
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FD1420 4_2_00007FF7E2FD1420
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30A3C20 4_2_00007FF7E30A3C20
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30AA420 4_2_00007FF7E30AA420
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E309D450 4_2_00007FF7E309D450
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30AFC50 4_2_00007FF7E30AFC50
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FE0C40 4_2_00007FF7E2FE0C40
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FD1C50 4_2_00007FF7E2FD1C50
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30A8C70 4_2_00007FF7E30A8C70
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FD0460 4_2_00007FF7E2FD0460
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FF6C70 4_2_00007FF7E2FF6C70
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FD2C80 4_2_00007FF7E2FD2C80
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30B54A0 4_2_00007FF7E30B54A0
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30AE4A0 4_2_00007FF7E30AE4A0
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30A94D0 4_2_00007FF7E30A94D0
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30134B4 4_2_00007FF7E30134B4
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30B3CE0 4_2_00007FF7E30B3CE0
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FC8CF0 4_2_00007FF7E2FC8CF0
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FE1500 4_2_00007FF7E2FE1500
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E308BD00 4_2_00007FF7E308BD00
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30AED00 4_2_00007FF7E30AED00
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FCCD10 4_2_00007FF7E2FCCD10
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FCDD10 4_2_00007FF7E2FCDD10
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30BF340 4_2_00007FF7E30BF340
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FB7350 4_2_00007FF7E2FB7350
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FE6B80 4_2_00007FF7E2FE6B80
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FCFB80 4_2_00007FF7E2FCFB80
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E3094BB0 4_2_00007FF7E3094BB0
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FF73A0 4_2_00007FF7E2FF73A0
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30A4BD0 4_2_00007FF7E30A4BD0
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FC9BE0 4_2_00007FF7E2FC9BE0
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30A3410 4_2_00007FF7E30A3410
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FD4410 4_2_00007FF7E2FD4410
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30AB230 4_2_00007FF7E30AB230
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FF8A20 4_2_00007FF7E2FF8A20
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FE0230 4_2_00007FF7E2FE0230
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FCBA40 4_2_00007FF7E2FCBA40
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30B5A60 4_2_00007FF7E30B5A60
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30B0A60 4_2_00007FF7E30B0A60
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FD8A70 4_2_00007FF7E2FD8A70
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FE2AC0 4_2_00007FF7E2FE2AC0
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30B62C0 4_2_00007FF7E30B62C0
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FB92E0 4_2_00007FF7E2FB92E0
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FE8B10 4_2_00007FF7E2FE8B10
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FE7120 4_2_00007FF7E2FE7120
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FE8120 4_2_00007FF7E2FE8120
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30A6940 4_2_00007FF7E30A6940
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30A3970 4_2_00007FF7E30A3970
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E3013165 4_2_00007FF7E3013165
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30A5190 4_2_00007FF7E30A5190
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30BC190 4_2_00007FF7E30BC190
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FCC980 4_2_00007FF7E2FCC980
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30AC180 4_2_00007FF7E30AC180
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30B19B0 4_2_00007FF7E30B19B0
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30AA9D0 4_2_00007FF7E30AA9D0
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FF59C0 4_2_00007FF7E2FF59C0
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30A59F0 4_2_00007FF7E30A59F0
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30BC9F0 4_2_00007FF7E30BC9F0
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30BE1F0 4_2_00007FF7E30BE1F0
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30B7210 4_2_00007FF7E30B7210
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30B0200 4_2_00007FF7E30B0200
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30741F8 4_2_00007FF7E30741F8
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FF8020 4_2_00007FF7E2FF8020
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FBD030 4_2_00007FF7E2FBD030
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30B8020 4_2_00007FF7E30B8020
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FEB830 4_2_00007FF7E2FEB830
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E309D070 4_2_00007FF7E309D070
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FDD860 4_2_00007FF7E2FDD860
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FEA870 4_2_00007FF7E2FEA870
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30BF890 4_2_00007FF7E30BF890
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FCD0A0 4_2_00007FF7E2FCD0A0
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30958C0 4_2_00007FF7E30958C0
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FB70F0 4_2_00007FF7E2FB70F0
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30AC730 4_2_00007FF7E30AC730
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FDB730 4_2_00007FF7E2FDB730
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FE4740 4_2_00007FF7E2FE4740
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30B8F70 4_2_00007FF7E30B8F70
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30B1F70 4_2_00007FF7E30B1F70
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30A7760 4_2_00007FF7E30A7760
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FCC770 4_2_00007FF7E2FCC770
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FB2F80 4_2_00007FF7E2FB2F80
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30ACF90 4_2_00007FF7E30ACF90
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FFB790 4_2_00007FF7E2FFB790
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FE9F90 4_2_00007FF7E2FE9F90
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30B27B0 4_2_00007FF7E30B27B0
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FFA7B0 4_2_00007FF7E2FFA7B0
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30B77C0 4_2_00007FF7E30B77C0
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FC97E0 4_2_00007FF7E2FC97E0
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FFCFF0 4_2_00007FF7E2FFCFF0
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FDA810 4_2_00007FF7E2FDA810
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FF7010 4_2_00007FF7E2FF7010
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E3011E20 4_2_00007FF7E3011E20
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FCEE40 4_2_00007FF7E2FCEE40
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FD9E70 4_2_00007FF7E2FD9E70
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30A86B0 4_2_00007FF7E30A86B0
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FD8EB0 4_2_00007FF7E2FD8EB0
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FF9EB0 4_2_00007FF7E2FF9EB0
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30A36C0 4_2_00007FF7E30A36C0
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30ADEE0 4_2_00007FF7E30ADEE0
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FCE700 4_2_00007FF7E2FCE700
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30A6F00 4_2_00007FF7E30A6F00
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30B3700 4_2_00007FF7E30B3700
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E3089D20 4_2_00007FF7E3089D20
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FE0530 4_2_00007FF7E2FE0530
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E30B4550 4_2_00007FF7E30B4550
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FD9540 4_2_00007FF7E2FD9540
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FBED90 4_2_00007FF7E2FBED90
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FC0D90 4_2_00007FF7E2FC0D90
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FE6D90 4_2_00007FF7E2FE6D90
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FE1DA0 4_2_00007FF7E2FE1DA0
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E3092E10 4_2_00007FF7E3092E10
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FE3610 4_2_00007FF7E2FE3610
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6274AF890 5_2_00007FF6274AF890
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273BD0A0 5_2_00007FF6273BD0A0
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF62748D070 5_2_00007FF62748D070
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273CD860 5_2_00007FF6273CD860
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273DA870 5_2_00007FF6273DA870
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273D7120 5_2_00007FF6273D7120
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273D8120 5_2_00007FF6273D8120
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6274858C0 5_2_00007FF6274858C0
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273A70F0 5_2_00007FF6273A70F0
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273A2F80 5_2_00007FF6273A2F80
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF62749CF90 5_2_00007FF62749CF90
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273EB790 5_2_00007FF6273EB790
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273D9F90 5_2_00007FF6273D9F90
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6274A27B0 5_2_00007FF6274A27B0
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273EA7B0 5_2_00007FF6273EA7B0
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273D4740 5_2_00007FF6273D4740
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6274A8F70 5_2_00007FF6274A8F70
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6274A1F70 5_2_00007FF6274A1F70
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273BC770 5_2_00007FF6273BC770
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF627497760 5_2_00007FF627497760
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273CA810 5_2_00007FF6273CA810
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273E7010 5_2_00007FF6273E7010
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273E8020 5_2_00007FF6273E8020
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273AD030 5_2_00007FF6273AD030
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6274A8020 5_2_00007FF6274A8020
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273DB830 5_2_00007FF6273DB830
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6274A77C0 5_2_00007FF6274A77C0
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273B97E0 5_2_00007FF6273B97E0
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273ECFF0 5_2_00007FF6273ECFF0
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6274986B0 5_2_00007FF6274986B0
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273E9EB0 5_2_00007FF6273E9EB0
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273C8EB0 5_2_00007FF6273C8EB0
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273BEE40 5_2_00007FF6273BEE40
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273C9E70 5_2_00007FF6273C9E70
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273BE700 5_2_00007FF6273BE700
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF627496F00 5_2_00007FF627496F00
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6274A3700 5_2_00007FF6274A3700
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF62749C730 5_2_00007FF62749C730
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273CB730 5_2_00007FF6273CB730
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6274936C0 5_2_00007FF6274936C0
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF62749DEE0 5_2_00007FF62749DEE0
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273AED90 5_2_00007FF6273AED90
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273B0D90 5_2_00007FF6273B0D90
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273D6D90 5_2_00007FF6273D6D90
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273D1DA0 5_2_00007FF6273D1DA0
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6274A4550 5_2_00007FF6274A4550
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273C9540 5_2_00007FF6273C9540
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF627482E10 5_2_00007FF627482E10
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273D3610 5_2_00007FF6273D3610
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF627401E20 5_2_00007FF627401E20
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273C2C80 5_2_00007FF6273C2C80
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6274A54A0 5_2_00007FF6274A54A0
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF62749E4A0 5_2_00007FF62749E4A0
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF62748D450 5_2_00007FF62748D450
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF62749FC50 5_2_00007FF62749FC50
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273D0C40 5_2_00007FF6273D0C40
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273C1C50 5_2_00007FF6273C1C50
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273C0460 5_2_00007FF6273C0460
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF627498C70 5_2_00007FF627498C70
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273E6C70 5_2_00007FF6273E6C70
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273D1500 5_2_00007FF6273D1500
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273BCD10 5_2_00007FF6273BCD10
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273BDD10 5_2_00007FF6273BDD10
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF62749ED00 5_2_00007FF62749ED00
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF62747BD00 5_2_00007FF62747BD00
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273D0530 5_2_00007FF6273D0530
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF627479D20 5_2_00007FF627479D20
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6274994D0 5_2_00007FF6274994D0
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273B8CF0 5_2_00007FF6273B8CF0
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6274A3CE0 5_2_00007FF6274A3CE0
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6274034B4 5_2_00007FF6274034B4
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273BFB80 5_2_00007FF6273BFB80
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273D6B80 5_2_00007FF6273D6B80
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273E73A0 5_2_00007FF6273E73A0
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF627484BB0 5_2_00007FF627484BB0
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6274AF340 5_2_00007FF6274AF340
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273A7350 5_2_00007FF6273A7350
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF627493410 5_2_00007FF627493410
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273C4410 5_2_00007FF6273C4410
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273C1420 5_2_00007FF6273C1420
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF627493C20 5_2_00007FF627493C20
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF62749A420 5_2_00007FF62749A420
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF627494BD0 5_2_00007FF627494BD0
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273B9BE0 5_2_00007FF6273B9BE0
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273BBA40 5_2_00007FF6273BBA40
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6274A5A60 5_2_00007FF6274A5A60
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6274A0A60 5_2_00007FF6274A0A60
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273C8A70 5_2_00007FF6273C8A70
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273D8B10 5_2_00007FF6273D8B10
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273D2AC0 5_2_00007FF6273D2AC0
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6274A62C0 5_2_00007FF6274A62C0
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273A92E0 5_2_00007FF6273A92E0
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6274AC190 5_2_00007FF6274AC190
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273BC980 5_2_00007FF6273BC980
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF627495190 5_2_00007FF627495190
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF62749C180 5_2_00007FF62749C180
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6274A19B0 5_2_00007FF6274A19B0
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF627496940 5_2_00007FF627496940
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF627403165 5_2_00007FF627403165
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF627493970 5_2_00007FF627493970
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6274A7210 5_2_00007FF6274A7210
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6274A0200 5_2_00007FF6274A0200
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6274641F8 5_2_00007FF6274641F8
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF62749B230 5_2_00007FF62749B230
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273E8A20 5_2_00007FF6273E8A20
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273D0230 5_2_00007FF6273D0230
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF62749A9D0 5_2_00007FF62749A9D0
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273E59C0 5_2_00007FF6273E59C0
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6274AC9F0 5_2_00007FF6274AC9F0
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6274AE1F0 5_2_00007FF6274AE1F0
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6274959F0 5_2_00007FF6274959F0
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CF7120 6_2_00007FF647CF7120
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CF8120 6_2_00007FF647CF8120
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CC70F0 6_2_00007FF647CC70F0
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DA58C0 6_2_00007FF647DA58C0
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DCF890 6_2_00007FF647DCF890
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CDD0A0 6_2_00007FF647CDD0A0
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DAD070 6_2_00007FF647DAD070
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CFA870 6_2_00007FF647CFA870
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CED860 6_2_00007FF647CED860
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DC8020 6_2_00007FF647DC8020
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CEA810 6_2_00007FF647CEA810
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647D07010 6_2_00007FF647D07010
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CFB830 6_2_00007FF647CFB830
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CCD030 6_2_00007FF647CCD030
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647D08020 6_2_00007FF647D08020
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647D0CFF0 6_2_00007FF647D0CFF0
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DC77C0 6_2_00007FF647DC77C0
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CD97E0 6_2_00007FF647CD97E0
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CF9F90 6_2_00007FF647CF9F90
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CC2F80 6_2_00007FF647CC2F80
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DC27B0 6_2_00007FF647DC27B0
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647D0A7B0 6_2_00007FF647D0A7B0
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DBCF90 6_2_00007FF647DBCF90
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647D0B790 6_2_00007FF647D0B790
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DB7760 6_2_00007FF647DB7760
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DC1F70 6_2_00007FF647DC1F70
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CF4740 6_2_00007FF647CF4740
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DC8F70 6_2_00007FF647DC8F70
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CDC770 6_2_00007FF647CDC770
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DBC730 6_2_00007FF647DBC730
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CDE700 6_2_00007FF647CDE700
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DB6F00 6_2_00007FF647DB6F00
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DC3700 6_2_00007FF647DC3700
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CEB730 6_2_00007FF647CEB730
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DBDEE0 6_2_00007FF647DBDEE0
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DB36C0 6_2_00007FF647DB36C0
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DB86B0 6_2_00007FF647DB86B0
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647D09EB0 6_2_00007FF647D09EB0
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CE8EB0 6_2_00007FF647CE8EB0
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CDEE40 6_2_00007FF647CDEE40
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CE9E70 6_2_00007FF647CE9E70
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CF3610 6_2_00007FF647CF3610
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647D21E20 6_2_00007FF647D21E20
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DA2E10 6_2_00007FF647DA2E10
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647D6FDEC 6_2_00007FF647D6FDEC
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647D91DF4 6_2_00007FF647D91DF4
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CF6D90 6_2_00007FF647CF6D90
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CCED90 6_2_00007FF647CCED90
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CD0D90 6_2_00007FF647CD0D90
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CF1DA0 6_2_00007FF647CF1DA0
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CE9540 6_2_00007FF647CE9540
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DC4550 6_2_00007FF647DC4550
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647D99D20 6_2_00007FF647D99D20
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CDCD10 6_2_00007FF647CDCD10
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CDDD10 6_2_00007FF647CDDD10
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CF1500 6_2_00007FF647CF1500
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647D7AD30 6_2_00007FF647D7AD30
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DBED00 6_2_00007FF647DBED00
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647D9BD00 6_2_00007FF647D9BD00
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CF0530 6_2_00007FF647CF0530
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DC3CE0 6_2_00007FF647DC3CE0
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647D234B4 6_2_00007FF647D234B4
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CD8CF0 6_2_00007FF647CD8CF0
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DB94D0 6_2_00007FF647DB94D0
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DC54A0 6_2_00007FF647DC54A0
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DBE4A0 6_2_00007FF647DBE4A0
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CE2C80 6_2_00007FF647CE2C80
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CE1C50 6_2_00007FF647CE1C50
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DB8C70 6_2_00007FF647DB8C70
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CF0C40 6_2_00007FF647CF0C40
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647D06C70 6_2_00007FF647D06C70
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DAD450 6_2_00007FF647DAD450
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DBFC50 6_2_00007FF647DBFC50
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CE0460 6_2_00007FF647CE0460
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DB3C20 6_2_00007FF647DB3C20
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DBA420 6_2_00007FF647DBA420
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647D89C20 6_2_00007FF647D89C20
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CE4410 6_2_00007FF647CE4410
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DB3410 6_2_00007FF647DB3410
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CE1420 6_2_00007FF647CE1420
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DB4BD0 6_2_00007FF647DB4BD0
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CD9BE0 6_2_00007FF647CD9BE0
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DA4BB0 6_2_00007FF647DA4BB0
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CF6B80 6_2_00007FF647CF6B80
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CDFB80 6_2_00007FF647CDFB80
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647D073A0 6_2_00007FF647D073A0
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647D89388 6_2_00007FF647D89388
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CC7350 6_2_00007FF647CC7350
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DCF340 6_2_00007FF647DCF340
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647D76B44 6_2_00007FF647D76B44
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647D8CB20 6_2_00007FF647D8CB20
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CF8B10 6_2_00007FF647CF8B10
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CF2AC0 6_2_00007FF647CF2AC0
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DC62C0 6_2_00007FF647DC62C0
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CC92E0 6_2_00007FF647CC92E0
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DC5A60 6_2_00007FF647DC5A60
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DC0A60 6_2_00007FF647DC0A60
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CDBA40 6_2_00007FF647CDBA40
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CE8A70 6_2_00007FF647CE8A70
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647D08A20 6_2_00007FF647D08A20
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DBB230 6_2_00007FF647DBB230
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DC0200 6_2_00007FF647DC0200
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CF0230 6_2_00007FF647CF0230
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647D841F8 6_2_00007FF647D841F8
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DC7210 6_2_00007FF647DC7210
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DB59F0 6_2_00007FF647DB59F0
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647D059C0 6_2_00007FF647D059C0
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DCC9F0 6_2_00007FF647DCC9F0
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DCE1F0 6_2_00007FF647DCE1F0
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DBA9D0 6_2_00007FF647DBA9D0
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DC19B0 6_2_00007FF647DC19B0
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CDC980 6_2_00007FF647CDC980
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DBC180 6_2_00007FF647DBC180
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DB5190 6_2_00007FF647DB5190
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DCC190 6_2_00007FF647DCC190
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647D23165 6_2_00007FF647D23165
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DB3970 6_2_00007FF647DB3970
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647DB6940 6_2_00007FF647DB6940
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CD41E20 7_2_00007FF63CD41E20
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CDC2E10 7_2_00007FF63CDC2E10
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CD13610 7_2_00007FF63CD13610
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CCEED90 7_2_00007FF63CCEED90
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CCF0D90 7_2_00007FF63CCF0D90
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CD11DA0 7_2_00007FF63CD11DA0
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CD16D90 7_2_00007FF63CD16D90
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CD09540 7_2_00007FF63CD09540
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CDE4550 7_2_00007FF63CDE4550
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CCFE700 7_2_00007FF63CCFE700
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CDDC730 7_2_00007FF63CDDC730
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CD0B730 7_2_00007FF63CD0B730
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CDD6F00 7_2_00007FF63CDD6F00
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CDE3700 7_2_00007FF63CDE3700
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CDDDEE0 7_2_00007FF63CDDDEE0
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CDD36C0 7_2_00007FF63CDD36C0
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CDD86B0 7_2_00007FF63CDD86B0
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CD29EB0 7_2_00007FF63CD29EB0
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CD08EB0 7_2_00007FF63CD08EB0
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CCFEE40 7_2_00007FF63CCFEE40
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CD09E70 7_2_00007FF63CD09E70
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CDE8020 7_2_00007FF63CDE8020
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CD28020 7_2_00007FF63CD28020
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CD1B830 7_2_00007FF63CD1B830
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CCED030 7_2_00007FF63CCED030
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CD0A810 7_2_00007FF63CD0A810
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CD27010 7_2_00007FF63CD27010
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CD2CFF0 7_2_00007FF63CD2CFF0
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CDE77C0 7_2_00007FF63CDE77C0
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CCF97E0 7_2_00007FF63CCF97E0
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CCE2F80 7_2_00007FF63CCE2F80
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CDE27B0 7_2_00007FF63CDE27B0
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CD2A7B0 7_2_00007FF63CD2A7B0
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CDDCF90 7_2_00007FF63CDDCF90
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CD2B790 7_2_00007FF63CD2B790
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CD19F90 7_2_00007FF63CD19F90
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CDD7760 7_2_00007FF63CDD7760
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CDE8F70 7_2_00007FF63CDE8F70
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CDE1F70 7_2_00007FF63CDE1F70
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CCFC770 7_2_00007FF63CCFC770
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CD14740 7_2_00007FF63CD14740
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CD17120 7_2_00007FF63CD17120
Yara signature match
Source: 7.2.OTQisvZ.exe.7ff63cce0000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 4.2.wkKSPgp.exe.7ff7e2fb0000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 31.2.FmDRJeq.exe.7ff6cc6e0000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 26.2.NbSGhVM.exe.7ff6b47a0000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 37.2.Emkynwd.exe.7ff7750c0000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 32.2.JxXCqVa.exe.7ff601720000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 27.2.WJJOByy.exe.7ff77f320000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 15.2.AJbunRc.exe.7ff695c60000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 28.2.DNWTLfi.exe.7ff6f3450000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 9.2.XaZvEHG.exe.7ff61d670000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 11.2.YuhEzpi.exe.7ff740490000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 40.2.FSsBuPy.exe.7ff6ec710000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 18.2.PXvfCpI.exe.7ff63fd90000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 38.2.UTMWcnW.exe.7ff74e920000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 12.2.DYRnoDf.exe.7ff6e0b30000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 23.2.FJbyTtP.exe.7ff72c9d0000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 13.2.biTFilm.exe.7ff650c60000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 33.2.qulWMNK.exe.7ff75ce90000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 30.2.eTlchBa.exe.7ff781b70000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 16.2.SUqdJFj.exe.7ff6abe50000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 35.2.zgnppqX.exe.7ff7fb250000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 19.2.dhdvyXn.exe.7ff741710000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 39.2.nUwvlEf.exe.7ff602d90000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 22.2.VFmvQYa.exe.7ff7bf040000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 17.2.TIHWeXa.exe.7ff78ccd0000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 24.2.FTsRyWe.exe.7ff69f8a0000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 8.2.AvKmyWx.exe.7ff610230000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 34.2.KvrKIPQ.exe.7ff76a090000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 29.2.JVLiIAQ.exe.7ff7f0e60000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 21.2.ODEkuhr.exe.7ff7fa7c0000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 3.2.JvuHRXO.exe.7ff6e1ed0000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 5.2.gaDJFNb.exe.7ff6273a0000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 10.2.oblCraV.exe.7ff6a9e60000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 25.2.uUnCnJC.exe.7ff6c4430000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 6.2.ehLRfQc.exe.7ff647cc0000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 20.2.QMneGpM.exe.7ff765d80000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 36.2.VeDzKyt.exe.7ff6be0a0000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 14.2.BXwYBdZ.exe.7ff7f5f90000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: classification engine Classification label: mal100.evad.mine.winEXE@2488/330@0/0
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7280:120:WilError_03
Source: C:\Users\user\Desktop\file.exe Mutant created: \Sessions\1\BaseNamedObjects\sfdkjjhgkdsfhgjksd
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: file.exe ReversingLabs: Detection: 84%
Source: JvuHRXO.exe String found in binary or memory: --help
Source: JvuHRXO.exe String found in binary or memory: --help
Source: wkKSPgp.exe String found in binary or memory: --help
Source: wkKSPgp.exe String found in binary or memory: --help
Source: gaDJFNb.exe String found in binary or memory: --help
Source: gaDJFNb.exe String found in binary or memory: --help
Source: ehLRfQc.exe String found in binary or memory: --help
Source: ehLRfQc.exe String found in binary or memory: --help
Source: OTQisvZ.exe String found in binary or memory: --help
Source: OTQisvZ.exe String found in binary or memory: --help
Source: AvKmyWx.exe String found in binary or memory: --help
Source: AvKmyWx.exe String found in binary or memory: --help
Source: XaZvEHG.exe String found in binary or memory: --help
Source: XaZvEHG.exe String found in binary or memory: --help
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\user\Desktop\file.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\JvuHRXO.exe C:\Windows\System32\JvuHRXO.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\wkKSPgp.exe C:\Windows\System32\wkKSPgp.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\gaDJFNb.exe C:\Windows\System32\gaDJFNb.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\ehLRfQc.exe C:\Windows\System32\ehLRfQc.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\OTQisvZ.exe C:\Windows\System32\OTQisvZ.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\AvKmyWx.exe C:\Windows\System32\AvKmyWx.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\XaZvEHG.exe C:\Windows\System32\XaZvEHG.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\oblCraV.exe C:\Windows\System32\oblCraV.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\YuhEzpi.exe C:\Windows\System32\YuhEzpi.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\DYRnoDf.exe C:\Windows\System32\DYRnoDf.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\biTFilm.exe C:\Windows\System32\biTFilm.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\BXwYBdZ.exe C:\Windows\System32\BXwYBdZ.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\AJbunRc.exe C:\Windows\System32\AJbunRc.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\SUqdJFj.exe C:\Windows\System32\SUqdJFj.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\TIHWeXa.exe C:\Windows\System32\TIHWeXa.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\PXvfCpI.exe C:\Windows\System32\PXvfCpI.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\dhdvyXn.exe C:\Windows\System32\dhdvyXn.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\QMneGpM.exe C:\Windows\System32\QMneGpM.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\ODEkuhr.exe C:\Windows\System32\ODEkuhr.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\VFmvQYa.exe C:\Windows\System32\VFmvQYa.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\FJbyTtP.exe C:\Windows\System32\FJbyTtP.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\FTsRyWe.exe C:\Windows\System32\FTsRyWe.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\uUnCnJC.exe C:\Windows\System32\uUnCnJC.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\NbSGhVM.exe C:\Windows\System32\NbSGhVM.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\WJJOByy.exe C:\Windows\System32\WJJOByy.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\DNWTLfi.exe C:\Windows\System32\DNWTLfi.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\JVLiIAQ.exe C:\Windows\System32\JVLiIAQ.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\eTlchBa.exe C:\Windows\System32\eTlchBa.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\FmDRJeq.exe C:\Windows\System32\FmDRJeq.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\JxXCqVa.exe C:\Windows\System32\JxXCqVa.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\qulWMNK.exe C:\Windows\System32\qulWMNK.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\KvrKIPQ.exe C:\Windows\System32\KvrKIPQ.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\zgnppqX.exe C:\Windows\System32\zgnppqX.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\VeDzKyt.exe C:\Windows\System32\VeDzKyt.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\Emkynwd.exe C:\Windows\System32\Emkynwd.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\UTMWcnW.exe C:\Windows\System32\UTMWcnW.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\nUwvlEf.exe C:\Windows\System32\nUwvlEf.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\FSsBuPy.exe C:\Windows\System32\FSsBuPy.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\JvuHRXO.exe C:\Windows\System32\JvuHRXO.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\wkKSPgp.exe C:\Windows\System32\wkKSPgp.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\gaDJFNb.exe C:\Windows\System32\gaDJFNb.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\ehLRfQc.exe C:\Windows\System32\ehLRfQc.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\OTQisvZ.exe C:\Windows\System32\OTQisvZ.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\AvKmyWx.exe C:\Windows\System32\AvKmyWx.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\XaZvEHG.exe C:\Windows\System32\XaZvEHG.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\oblCraV.exe C:\Windows\System32\oblCraV.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\YuhEzpi.exe C:\Windows\System32\YuhEzpi.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\DYRnoDf.exe C:\Windows\System32\DYRnoDf.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\biTFilm.exe C:\Windows\System32\biTFilm.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\BXwYBdZ.exe C:\Windows\System32\BXwYBdZ.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\AJbunRc.exe C:\Windows\System32\AJbunRc.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\SUqdJFj.exe C:\Windows\System32\SUqdJFj.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\TIHWeXa.exe C:\Windows\System32\TIHWeXa.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\PXvfCpI.exe C:\Windows\System32\PXvfCpI.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\dhdvyXn.exe C:\Windows\System32\dhdvyXn.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\QMneGpM.exe C:\Windows\System32\QMneGpM.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\ODEkuhr.exe C:\Windows\System32\ODEkuhr.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\VFmvQYa.exe C:\Windows\System32\VFmvQYa.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\FJbyTtP.exe C:\Windows\System32\FJbyTtP.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\FTsRyWe.exe C:\Windows\System32\FTsRyWe.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\uUnCnJC.exe C:\Windows\System32\uUnCnJC.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\NbSGhVM.exe C:\Windows\System32\NbSGhVM.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\WJJOByy.exe C:\Windows\System32\WJJOByy.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\DNWTLfi.exe C:\Windows\System32\DNWTLfi.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\JVLiIAQ.exe C:\Windows\System32\JVLiIAQ.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\eTlchBa.exe C:\Windows\System32\eTlchBa.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\FmDRJeq.exe C:\Windows\System32\FmDRJeq.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\JxXCqVa.exe C:\Windows\System32\JxXCqVa.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\qulWMNK.exe C:\Windows\System32\qulWMNK.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\KvrKIPQ.exe C:\Windows\System32\KvrKIPQ.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\zgnppqX.exe C:\Windows\System32\zgnppqX.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\VeDzKyt.exe C:\Windows\System32\VeDzKyt.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\Emkynwd.exe C:\Windows\System32\Emkynwd.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\UTMWcnW.exe C:\Windows\System32\UTMWcnW.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\nUwvlEf.exe C:\Windows\System32\nUwvlEf.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\FSsBuPy.exe C:\Windows\System32\FSsBuPy.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\JvuHRXO.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\JvuHRXO.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wkKSPgp.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\wkKSPgp.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\gaDJFNb.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\gaDJFNb.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\ehLRfQc.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\ehLRfQc.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\OTQisvZ.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\OTQisvZ.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\AvKmyWx.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\AvKmyWx.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\XaZvEHG.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\XaZvEHG.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\oblCraV.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\oblCraV.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\YuhEzpi.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\YuhEzpi.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\DYRnoDf.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\DYRnoDf.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\biTFilm.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\biTFilm.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\BXwYBdZ.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\BXwYBdZ.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\AJbunRc.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\AJbunRc.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\SUqdJFj.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\SUqdJFj.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\TIHWeXa.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\TIHWeXa.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\PXvfCpI.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\PXvfCpI.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\dhdvyXn.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\dhdvyXn.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\QMneGpM.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\QMneGpM.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\ODEkuhr.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\ODEkuhr.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\VFmvQYa.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\VFmvQYa.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\FJbyTtP.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\FJbyTtP.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\FTsRyWe.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\FTsRyWe.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\uUnCnJC.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\uUnCnJC.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\NbSGhVM.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\NbSGhVM.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WJJOByy.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\WJJOByy.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\DNWTLfi.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\DNWTLfi.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\JVLiIAQ.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\JVLiIAQ.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\eTlchBa.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\eTlchBa.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\FmDRJeq.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\FmDRJeq.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\JxXCqVa.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\JxXCqVa.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\qulWMNK.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\qulWMNK.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\KvrKIPQ.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\KvrKIPQ.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\zgnppqX.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\zgnppqX.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\VeDzKyt.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\VeDzKyt.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\Emkynwd.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\Emkynwd.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\UTMWcnW.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\UTMWcnW.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\nUwvlEf.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\nUwvlEf.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\FSsBuPy.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\FSsBuPy.exe Section loaded: kernel.appcore.dll
Source: file.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: file.exe Static file information: File size 1552132 > 1048576
Source: file.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Contains functionality to dynamically determine API calls
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F3EBF0 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError, 3_2_00007FF6E1F3EBF0
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1EE8072 push qword ptr [00007FF66D36AAF7h]; retf 3_2_00007FF6E1EE8078
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1EE7FA3 push qword ptr [00007FF66D36AA28h]; retf 3_2_00007FF6E1EE7FA9
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FC8072 push qword ptr [00007FF76E44AAF7h]; retf 4_2_00007FF7E2FC8078
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E2FC7FA3 push qword ptr [00007FF76E44AA28h]; retf 4_2_00007FF7E2FC7FA9
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273B8072 push qword ptr [00007FF5B283AAF7h]; retf 5_2_00007FF6273B8078
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF6273B7FA3 push qword ptr [00007FF5B283AA28h]; retf 5_2_00007FF6273B7FA9
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CD8072 push qword ptr [00007FF5D315AAF7h]; retf 6_2_00007FF647CD8078
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647CD7FA3 push qword ptr [00007FF5D315AA28h]; retf 6_2_00007FF647CD7FA9
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CCF7FA3 push qword ptr [00007FF5C817AA28h]; retf 7_2_00007FF63CCF7FA9
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CCF8072 push qword ptr [00007FF5C817AAF7h]; retf 7_2_00007FF63CCF8078
Source: C:\Windows\System32\AvKmyWx.exe Code function: 8_2_00007FF610247FA3 push qword ptr [00007FF59B6CAA28h]; retf 8_2_00007FF610247FA9
Source: C:\Windows\System32\AvKmyWx.exe Code function: 8_2_00007FF610248072 push qword ptr [00007FF59B6CAAF7h]; retf 8_2_00007FF610248078
Source: C:\Windows\System32\XaZvEHG.exe Code function: 9_2_00007FF61D688072 push qword ptr [00007FF5A8B0AAF7h]; retf 9_2_00007FF61D688078
Source: C:\Windows\System32\XaZvEHG.exe Code function: 9_2_00007FF61D687FA3 push qword ptr [00007FF5A8B0AA28h]; retf 9_2_00007FF61D687FA9
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1

Persistence and Installation Behavior
barindex
Drops executables to the windows directory (C:\Windows) and starts them
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\FJbyTtP.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\DNWTLfi.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\BXwYBdZ.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\UTMWcnW.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\AJbunRc.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\QMneGpM.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\dhdvyXn.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\JVLiIAQ.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\eTlchBa.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\NbSGhVM.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\SUqdJFj.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\VFmvQYa.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\AvKmyWx.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\DYRnoDf.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\Emkynwd.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\wkKSPgp.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\FTsRyWe.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\JxXCqVa.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\ODEkuhr.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\gaDJFNb.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\OTQisvZ.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\biTFilm.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\YuhEzpi.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\PXvfCpI.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\FmDRJeq.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\uUnCnJC.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\WJJOByy.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\ehLRfQc.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\oblCraV.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\FSsBuPy.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\nUwvlEf.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\KvrKIPQ.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\qulWMNK.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\VeDzKyt.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\TIHWeXa.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\zgnppqX.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\JvuHRXO.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Executable created and started: C:\Windows\System32\XaZvEHG.exe Jump to behavior
Drops PE files
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\MZzfLEZ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\hHHgQhg.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\lkHmjCB.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\xjXpcqI.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\aqHHhqZ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\uUnCnJC.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\sRxYPzo.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\asMPLRF.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\nySppDL.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\kcGcYyc.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\WJJOByy.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\JyTylDG.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\LsxWNuU.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\OoXXuCQ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\hcWXimc.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\SgRYHnh.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\qrMFKUE.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\AmlHggH.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\REoMUue.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ENASfEY.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\mNMttQk.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\NppXEik.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\YoRPgID.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ENNjqpn.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FJbyTtP.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\gVxVuPE.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\UthEkPV.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\dkvzZbr.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ehLRfQc.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\JlwJpiQ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ifdEeMJ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\qYfJmBx.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\cvviXVl.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\YoWRHKm.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\kwBHINw.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\XiEDOUw.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\yQykaWi.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ZksIGgD.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\pmqeloX.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\uwpSJTY.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\Pyjxeub.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\HmNtbmf.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\TrOUMxR.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\vINSkcN.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\iNyWjdh.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\gFItvpO.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\SUqdJFj.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\atCrJKj.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\XbmxgAo.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FCGGaTu.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\oblCraV.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\vsZRZPn.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\HKQIXhJ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\IfWXppj.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\wHmEWnE.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\cWFXjGb.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\UYpGIpx.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\vUMVWef.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\SUPTwuz.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FOKqTNk.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\YHzfIbf.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\IGbJixm.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\edsunAc.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FSsBuPy.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\OTQisvZ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\nUwvlEf.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\HHkrdhY.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\NoVBMWR.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\nVRFUMU.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\OCQPeNZ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\UhaWIvI.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\oheGeDM.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\cbxEAHb.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\CGHEajN.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\AeHKOUk.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\aaQPPko.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\xZCsQFU.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\jlhXoDU.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\hldtrer.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\RkBIliC.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\VJGuWtg.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\PFFZxBK.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\HhuUNgU.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\oTTZHtv.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\pnHAApr.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\gsJfIAI.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\dTlWhsy.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\oeyXpah.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\pONZxkY.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\IGIRuaN.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\bWqzsZL.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\LRwQOeC.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\DNWTLfi.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\pQiWMAE.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\VFmvQYa.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\nZqSwkk.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\LIUOcyg.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\BXwYBdZ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\DecYaAF.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\hPbLcyI.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\MqDEnug.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\gIerfNx.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\niuNHza.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\UWoSVBa.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\LIYZzMn.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\SuSRVcd.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\biTFilm.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ZOsbaqw.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\oLIMGEG.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\GEjShaj.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\gIWIAoR.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\AARFjPz.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\BQVZXof.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\cMZjysl.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\SJbiQtA.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\iVxWAhp.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\SDuWpap.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\sHrvKbH.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\YuhEzpi.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\rzOVEdp.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\WaSCrgW.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\rECIoeF.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\BlxXZNI.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\zZluDpQ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\KTKMSLw.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ZZceFPb.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\mUtoiRj.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\VDAzIym.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\AvKmyWx.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\pCYFbPY.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FfHFdUV.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\qBNFibO.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\eJQEoBU.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\spwZxbD.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\NUGNSrJ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\rWLJMFs.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\qyjihXJ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\dXYoCLq.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\tYuJBKo.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\sklRMsM.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\JVEeonp.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\DYRnoDf.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\sDUxUOz.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\MwQiyKB.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ezbfIqP.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\dxwuaZx.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\wncnOga.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\TRDwKtF.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\BkMxlYA.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\TKmEpby.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\iDjoCba.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\IwiJsNl.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\OaEKhAc.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\PtyEDzX.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\IbzihzQ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\pVAAkNS.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\fsYNdIS.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\SxUWiRQ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\EeTDKLH.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\yeQSiTm.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\gvzqmaV.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\KPSoDjq.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\UTMWcnW.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\DoYQIEQ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\AINedvE.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\UsvbkSz.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\nOUmNRd.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\Emkynwd.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\vQWABTG.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\qPOzufP.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\bZAgvbx.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ycvgKWP.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\htpHIjf.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\lYsCKDB.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ihRMBvK.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\BZXlXZF.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\HqzYgND.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\XdtKVFg.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\NHtBCxU.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\BBTtOmS.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\kPIwtDx.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\wMaaxvk.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ZjfUfPp.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\zcRTKcl.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\byMqxSp.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\dcvcJux.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\agvrwBm.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\aRcunFP.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\iWlgDsI.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ugXtQTT.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\kiaPNWp.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\KvrKIPQ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\KNQeCYU.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\RSlZAbq.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\zxkWcfH.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\MVyvCVk.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\boujFkb.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\CgshOaM.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\gZXMDli.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\oXhzTJB.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\TuPZZgO.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FwDCyKX.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\OakHRVh.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ZxDRWfb.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\qQrbmYX.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\OkcQGeE.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\wIBrJnT.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ANovuUs.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\OmReOVb.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\KsaexJr.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\bHOUpYN.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\uoUnoPV.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\zAqphYy.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\wkKSPgp.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\koSIwBF.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\rSfKwnk.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\KEckQhl.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\HfVKjfu.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\nUxFpBv.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\DjFGkEO.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\KXPXHqw.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\hiRRhNA.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\SYhASaz.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\qulWMNK.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\PVSsNXl.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\VeDzKyt.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\zoNaMRv.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\BGEmobC.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\KisuSgd.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\wLBrJuN.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\OLgSbZB.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\PATRbwz.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\LmLfObb.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\YPSGLBU.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FTsRyWe.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\hdrmJmm.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\dbOMNtK.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\uJLpuAT.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\XAMlAeL.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\nEqlptY.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\AJbunRc.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\JxXCqVa.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\uxZFvtG.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\LlVYLfY.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ZYpXsUH.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\PXvfCpI.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\VcsXjEN.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\IkKuNGZ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\hEUdUZb.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\TIHWeXa.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\QMneGpM.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\WvCPwWV.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\AfwGLOC.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\dhdvyXn.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\vtyxvBq.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FgkhtMM.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\lvuSoVX.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\LKIvikl.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\AAFWtMo.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\JVLiIAQ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\zoWFHEB.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\OjDKkKR.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\JPNUgrl.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\MqBemCY.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\YDNKKav.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\EvKiHlY.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ODEkuhr.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\XvmplkI.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\jOLYVDQ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\kDIeJiO.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ecTFjpe.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FPbzJmC.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\VGaYkjy.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\MfIrnxp.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\QafCaUC.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\WUhIqEX.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\eTlchBa.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\sGHQnMX.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\xosmhFY.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\WaZAbif.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\QeMlQoi.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\rfvRxbV.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\tRrgCEd.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\mZbuFep.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\SFUZlia.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\CStEhbp.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\xsPUYnY.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\EYQygjH.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\zgnppqX.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\YeogayJ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\daTQGhs.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\hHyzwMR.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FddCmld.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\CwZoVMx.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\UcDbkWX.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\NbwonFl.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\AOxtNit.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\HuQzjRH.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\YNbNjyr.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\waRaTny.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\jNFZeRV.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\AoDqPum.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\cQSYuAP.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\JSWAmsK.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\vwIpBIp.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\VWmfLAK.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\NbSGhVM.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\suHCBrv.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\gaDJFNb.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\hkdrylp.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\EpJmKCP.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\NkJqpeK.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\sOMtwdY.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\jNvuQDu.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\zafOJaW.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\XaZvEHG.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\JvuHRXO.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FmDRJeq.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\pBUJBbD.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\rzBuUNn.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\thYWpNp.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\yNciWyL.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\pydLviI.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\hImJGCQ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\QQrJtgR.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\dznqpDP.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\KdtqCrx.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ZcPsbVC.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\oFlkVvC.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\JnWFmyo.exe Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\MZzfLEZ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\hHHgQhg.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\lkHmjCB.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\xjXpcqI.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\aqHHhqZ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\uUnCnJC.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\sRxYPzo.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\asMPLRF.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\nySppDL.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\kcGcYyc.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\WJJOByy.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\JyTylDG.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\LsxWNuU.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\OoXXuCQ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\hcWXimc.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\SgRYHnh.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\qrMFKUE.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\AmlHggH.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\REoMUue.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ENASfEY.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\mNMttQk.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\NppXEik.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\YoRPgID.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ENNjqpn.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FJbyTtP.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\gVxVuPE.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\UthEkPV.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\dkvzZbr.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ehLRfQc.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\JlwJpiQ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ifdEeMJ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\qYfJmBx.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\cvviXVl.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\YoWRHKm.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\kwBHINw.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\XiEDOUw.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\yQykaWi.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ZksIGgD.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\pmqeloX.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\uwpSJTY.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\Pyjxeub.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\HmNtbmf.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\TrOUMxR.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\vINSkcN.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\iNyWjdh.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\gFItvpO.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\SUqdJFj.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\atCrJKj.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\XbmxgAo.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FCGGaTu.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\oblCraV.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\vsZRZPn.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\HKQIXhJ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\IfWXppj.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\wHmEWnE.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\cWFXjGb.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\UYpGIpx.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\vUMVWef.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\SUPTwuz.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FOKqTNk.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\YHzfIbf.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\IGbJixm.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\edsunAc.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FSsBuPy.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\OTQisvZ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\nUwvlEf.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\HHkrdhY.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\NoVBMWR.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\nVRFUMU.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\OCQPeNZ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\UhaWIvI.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\oheGeDM.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\cbxEAHb.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\CGHEajN.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\AeHKOUk.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\aaQPPko.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\xZCsQFU.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\jlhXoDU.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\hldtrer.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\RkBIliC.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\VJGuWtg.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\PFFZxBK.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\HhuUNgU.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\oTTZHtv.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\pnHAApr.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\gsJfIAI.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\dTlWhsy.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\oeyXpah.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\pONZxkY.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\IGIRuaN.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\bWqzsZL.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\LRwQOeC.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\DNWTLfi.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\pQiWMAE.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\VFmvQYa.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\nZqSwkk.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\LIUOcyg.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\BXwYBdZ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\DecYaAF.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\hPbLcyI.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\MqDEnug.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\gIerfNx.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\niuNHza.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\UWoSVBa.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\LIYZzMn.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\SuSRVcd.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\biTFilm.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ZOsbaqw.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\oLIMGEG.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\GEjShaj.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\gIWIAoR.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\AARFjPz.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\BQVZXof.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\cMZjysl.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\SJbiQtA.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\iVxWAhp.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\SDuWpap.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\sHrvKbH.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\YuhEzpi.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\rzOVEdp.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\WaSCrgW.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\rECIoeF.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\BlxXZNI.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\zZluDpQ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\KTKMSLw.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ZZceFPb.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\mUtoiRj.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\VDAzIym.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\AvKmyWx.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\pCYFbPY.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FfHFdUV.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\qBNFibO.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\eJQEoBU.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\spwZxbD.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\NUGNSrJ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\rWLJMFs.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\qyjihXJ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\dXYoCLq.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\tYuJBKo.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\sklRMsM.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\JVEeonp.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\DYRnoDf.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\sDUxUOz.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\MwQiyKB.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ezbfIqP.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\dxwuaZx.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\wncnOga.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\TRDwKtF.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\BkMxlYA.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\TKmEpby.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\iDjoCba.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\IwiJsNl.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\OaEKhAc.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\PtyEDzX.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\IbzihzQ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\pVAAkNS.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\fsYNdIS.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\SxUWiRQ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\EeTDKLH.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\yeQSiTm.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\gvzqmaV.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\KPSoDjq.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\UTMWcnW.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\DoYQIEQ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\AINedvE.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\UsvbkSz.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\nOUmNRd.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\Emkynwd.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\vQWABTG.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\qPOzufP.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\bZAgvbx.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ycvgKWP.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\htpHIjf.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\lYsCKDB.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ihRMBvK.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\BZXlXZF.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\HqzYgND.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\XdtKVFg.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\NHtBCxU.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\BBTtOmS.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\kPIwtDx.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\wMaaxvk.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ZjfUfPp.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\zcRTKcl.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\byMqxSp.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\dcvcJux.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\agvrwBm.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\aRcunFP.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\iWlgDsI.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ugXtQTT.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\kiaPNWp.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\KvrKIPQ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\KNQeCYU.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\RSlZAbq.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\zxkWcfH.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\MVyvCVk.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\boujFkb.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\CgshOaM.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\gZXMDli.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\oXhzTJB.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\TuPZZgO.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FwDCyKX.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\OakHRVh.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ZxDRWfb.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\qQrbmYX.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\OkcQGeE.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\wIBrJnT.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ANovuUs.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\OmReOVb.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\KsaexJr.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\bHOUpYN.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\uoUnoPV.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\zAqphYy.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\wkKSPgp.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\koSIwBF.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\rSfKwnk.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\KEckQhl.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\HfVKjfu.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\nUxFpBv.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\DjFGkEO.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\KXPXHqw.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\hiRRhNA.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\SYhASaz.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\qulWMNK.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\PVSsNXl.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\VeDzKyt.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\zoNaMRv.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\BGEmobC.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\KisuSgd.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\wLBrJuN.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\OLgSbZB.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\PATRbwz.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\LmLfObb.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\YPSGLBU.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FTsRyWe.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\hdrmJmm.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\dbOMNtK.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\uJLpuAT.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\XAMlAeL.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\nEqlptY.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\AJbunRc.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\JxXCqVa.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\uxZFvtG.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\LlVYLfY.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ZYpXsUH.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\PXvfCpI.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\VcsXjEN.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\IkKuNGZ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\hEUdUZb.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\TIHWeXa.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\QMneGpM.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\WvCPwWV.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\AfwGLOC.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\dhdvyXn.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\vtyxvBq.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FgkhtMM.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\lvuSoVX.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\LKIvikl.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\AAFWtMo.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\JVLiIAQ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\zoWFHEB.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\OjDKkKR.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\JPNUgrl.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\MqBemCY.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\YDNKKav.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\EvKiHlY.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ODEkuhr.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\XvmplkI.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\jOLYVDQ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\kDIeJiO.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ecTFjpe.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FPbzJmC.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\VGaYkjy.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\MfIrnxp.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\QafCaUC.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\WUhIqEX.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\eTlchBa.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\sGHQnMX.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\xosmhFY.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\WaZAbif.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\QeMlQoi.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\rfvRxbV.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\tRrgCEd.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\mZbuFep.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\SFUZlia.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\CStEhbp.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\xsPUYnY.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\EYQygjH.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\zgnppqX.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\YeogayJ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\daTQGhs.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\hHyzwMR.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FddCmld.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\CwZoVMx.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\UcDbkWX.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\NbwonFl.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\AOxtNit.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\HuQzjRH.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\YNbNjyr.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\waRaTny.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\jNFZeRV.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\AoDqPum.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\cQSYuAP.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\JSWAmsK.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\vwIpBIp.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\VWmfLAK.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\NbSGhVM.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\suHCBrv.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\gaDJFNb.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\hkdrylp.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\EpJmKCP.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\NkJqpeK.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\sOMtwdY.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\jNvuQDu.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\zafOJaW.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\XaZvEHG.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\JvuHRXO.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\FmDRJeq.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\pBUJBbD.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\rzBuUNn.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\thYWpNp.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\yNciWyL.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\pydLviI.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\hImJGCQ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\QQrJtgR.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\dznqpDP.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\KdtqCrx.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\ZcPsbVC.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\oFlkVvC.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\System32\JnWFmyo.exe Jump to dropped file
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F3EBF0 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError, 3_2_00007FF6E1F3EBF0
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\MZzfLEZ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\hHHgQhg.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\lkHmjCB.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\xjXpcqI.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\aqHHhqZ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\sRxYPzo.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\asMPLRF.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\nySppDL.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\kcGcYyc.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\JyTylDG.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\LsxWNuU.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\OoXXuCQ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\SgRYHnh.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\hcWXimc.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\qrMFKUE.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\AmlHggH.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\REoMUue.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\ENASfEY.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\mNMttQk.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\YoRPgID.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\NppXEik.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\ENNjqpn.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\gVxVuPE.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\dkvzZbr.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\UthEkPV.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\JlwJpiQ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\ifdEeMJ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\qYfJmBx.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\cvviXVl.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\YoWRHKm.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\kwBHINw.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\XiEDOUw.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\yQykaWi.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\pmqeloX.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\ZksIGgD.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\uwpSJTY.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\Pyjxeub.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\HmNtbmf.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\vINSkcN.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\TrOUMxR.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\iNyWjdh.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\gFItvpO.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\atCrJKj.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\XbmxgAo.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\FCGGaTu.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\vsZRZPn.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\HKQIXhJ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\IfWXppj.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\wHmEWnE.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\cWFXjGb.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\UYpGIpx.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\vUMVWef.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\SUPTwuz.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\YHzfIbf.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\FOKqTNk.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\edsunAc.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\IGbJixm.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\HHkrdhY.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\NoVBMWR.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\nVRFUMU.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\OCQPeNZ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\UhaWIvI.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\oheGeDM.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\cbxEAHb.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\CGHEajN.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\AeHKOUk.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\aaQPPko.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\xZCsQFU.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\jlhXoDU.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\RkBIliC.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\hldtrer.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\VJGuWtg.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\PFFZxBK.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\HhuUNgU.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\oTTZHtv.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\pnHAApr.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\dTlWhsy.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\gsJfIAI.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\oeyXpah.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\pONZxkY.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\IGIRuaN.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\LRwQOeC.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\bWqzsZL.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\pQiWMAE.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\nZqSwkk.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\LIUOcyg.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\DecYaAF.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\hPbLcyI.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\MqDEnug.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\gIerfNx.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\niuNHza.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\UWoSVBa.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\LIYZzMn.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\SuSRVcd.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\ZOsbaqw.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\oLIMGEG.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\GEjShaj.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\gIWIAoR.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\AARFjPz.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\BQVZXof.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\cMZjysl.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\SJbiQtA.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\iVxWAhp.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\SDuWpap.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\sHrvKbH.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\rzOVEdp.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\rECIoeF.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\WaSCrgW.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\BlxXZNI.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\zZluDpQ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\KTKMSLw.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\ZZceFPb.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\mUtoiRj.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\VDAzIym.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\pCYFbPY.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\FfHFdUV.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\qBNFibO.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\eJQEoBU.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\spwZxbD.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\NUGNSrJ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\rWLJMFs.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\qyjihXJ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\tYuJBKo.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\dXYoCLq.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\sklRMsM.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\JVEeonp.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\sDUxUOz.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\MwQiyKB.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\ezbfIqP.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\dxwuaZx.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\wncnOga.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\TRDwKtF.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\BkMxlYA.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\iDjoCba.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\TKmEpby.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\IwiJsNl.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\PtyEDzX.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\OaEKhAc.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\pVAAkNS.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\IbzihzQ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\fsYNdIS.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\SxUWiRQ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\EeTDKLH.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\yeQSiTm.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\gvzqmaV.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\KPSoDjq.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\DoYQIEQ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\AINedvE.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\UsvbkSz.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\nOUmNRd.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\qPOzufP.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\vQWABTG.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\bZAgvbx.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\ycvgKWP.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\htpHIjf.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\lYsCKDB.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\ihRMBvK.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\BZXlXZF.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\HqzYgND.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\NHtBCxU.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\XdtKVFg.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\BBTtOmS.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\kPIwtDx.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\ZjfUfPp.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\zcRTKcl.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\wMaaxvk.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\byMqxSp.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\agvrwBm.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\dcvcJux.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\aRcunFP.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\iWlgDsI.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\ugXtQTT.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\kiaPNWp.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\KNQeCYU.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\RSlZAbq.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\zxkWcfH.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\MVyvCVk.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\CgshOaM.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\boujFkb.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\oXhzTJB.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\gZXMDli.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\TuPZZgO.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\FwDCyKX.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\OakHRVh.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\ZxDRWfb.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\qQrbmYX.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\OkcQGeE.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\wIBrJnT.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\ANovuUs.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\OmReOVb.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\KsaexJr.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\bHOUpYN.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\uoUnoPV.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\zAqphYy.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\koSIwBF.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\rSfKwnk.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\HfVKjfu.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\KEckQhl.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\nUxFpBv.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\DjFGkEO.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\KXPXHqw.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\hiRRhNA.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\SYhASaz.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\PVSsNXl.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\zoNaMRv.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\BGEmobC.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\KisuSgd.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\wLBrJuN.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\PATRbwz.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\OLgSbZB.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\LmLfObb.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\YPSGLBU.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\hdrmJmm.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\dbOMNtK.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\uJLpuAT.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\XAMlAeL.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\nEqlptY.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\uxZFvtG.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\LlVYLfY.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\ZYpXsUH.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\IkKuNGZ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\VcsXjEN.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\hEUdUZb.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\WvCPwWV.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\AfwGLOC.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\vtyxvBq.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\FgkhtMM.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\lvuSoVX.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\LKIvikl.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\AAFWtMo.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\OjDKkKR.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\zoWFHEB.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\JPNUgrl.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\MqBemCY.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\YDNKKav.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\EvKiHlY.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\XvmplkI.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\ecTFjpe.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\jOLYVDQ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\kDIeJiO.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\FPbzJmC.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\MfIrnxp.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\VGaYkjy.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\QafCaUC.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\WUhIqEX.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\sGHQnMX.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\xosmhFY.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\WaZAbif.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\QeMlQoi.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\rfvRxbV.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\tRrgCEd.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\mZbuFep.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\SFUZlia.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\CStEhbp.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\xsPUYnY.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\EYQygjH.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\daTQGhs.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\YeogayJ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\hHyzwMR.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\FddCmld.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\UcDbkWX.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\CwZoVMx.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\NbwonFl.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\AOxtNit.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\HuQzjRH.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\waRaTny.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\YNbNjyr.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\AoDqPum.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\jNFZeRV.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\cQSYuAP.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\JSWAmsK.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\VWmfLAK.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\vwIpBIp.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\suHCBrv.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\hkdrylp.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\EpJmKCP.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\NkJqpeK.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\sOMtwdY.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\jNvuQDu.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\zafOJaW.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\pBUJBbD.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\yNciWyL.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\rzBuUNn.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\thYWpNp.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\hImJGCQ.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\pydLviI.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\QQrJtgR.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\KdtqCrx.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\dznqpDP.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\ZcPsbVC.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\JnWFmyo.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Windows\System32\oFlkVvC.exe Jump to dropped file
Found large amount of non-executed APIs
Source: C:\Windows\System32\JvuHRXO.exe API coverage: 1.3 %
Source: C:\Windows\System32\wkKSPgp.exe API coverage: 1.3 %
Source: C:\Windows\System32\gaDJFNb.exe API coverage: 1.3 %
Source: C:\Windows\System32\ehLRfQc.exe API coverage: 1.6 %
Source: C:\Windows\System32\OTQisvZ.exe API coverage: 1.3 %
Source: C:\Windows\System32\AvKmyWx.exe API coverage: 1.3 %
Source: C:\Windows\System32\XaZvEHG.exe API coverage: 1.6 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\JvuHRXO.exe TID: 7364 Thread sleep time: -41000s >= -30000s Jump to behavior
Source: C:\Windows\System32\wkKSPgp.exe TID: 7380 Thread sleep time: -41000s >= -30000s Jump to behavior
Source: C:\Windows\System32\gaDJFNb.exe TID: 7396 Thread sleep time: -41000s >= -30000s Jump to behavior
Source: C:\Windows\System32\ehLRfQc.exe TID: 7412 Thread sleep time: -41000s >= -30000s Jump to behavior
Source: C:\Windows\System32\OTQisvZ.exe TID: 7432 Thread sleep time: -41000s >= -30000s Jump to behavior
Source: C:\Windows\System32\AvKmyWx.exe TID: 7448 Thread sleep time: -41000s >= -30000s Jump to behavior
Source: C:\Windows\System32\XaZvEHG.exe TID: 7464 Thread sleep time: -41000s >= -30000s
Source: C:\Windows\System32\oblCraV.exe TID: 7480 Thread sleep time: -41000s >= -30000s
Source: C:\Windows\System32\YuhEzpi.exe TID: 7496 Thread sleep time: -41000s >= -30000s
Source: C:\Windows\System32\DYRnoDf.exe TID: 7512 Thread sleep time: -41000s >= -30000s
Source: C:\Windows\System32\biTFilm.exe TID: 7528 Thread sleep time: -41000s >= -30000s
Source: C:\Windows\System32\BXwYBdZ.exe TID: 7544 Thread sleep time: -41000s >= -30000s
Source: C:\Windows\System32\AJbunRc.exe TID: 7560 Thread sleep time: -41000s >= -30000s
Source: C:\Windows\System32\SUqdJFj.exe TID: 7604 Thread sleep time: -41000s >= -30000s
Source: C:\Windows\System32\TIHWeXa.exe TID: 7624 Thread sleep time: -41000s >= -30000s
Source: C:\Windows\System32\PXvfCpI.exe TID: 7640 Thread sleep time: -41000s >= -30000s
Source: C:\Windows\System32\dhdvyXn.exe TID: 7656 Thread sleep time: -41000s >= -30000s
Source: C:\Windows\System32\QMneGpM.exe TID: 7672 Thread sleep time: -41000s >= -30000s
Source: C:\Windows\System32\ODEkuhr.exe TID: 7688 Thread sleep time: -41000s >= -30000s
Source: C:\Windows\System32\VFmvQYa.exe TID: 7704 Thread sleep time: -41000s >= -30000s
Source: C:\Windows\System32\FJbyTtP.exe TID: 7720 Thread sleep time: -41000s >= -30000s
Source: C:\Windows\System32\FTsRyWe.exe TID: 7736 Thread sleep time: -41000s >= -30000s
Source: C:\Windows\System32\uUnCnJC.exe TID: 7752 Thread sleep time: -41000s >= -30000s
Source: C:\Windows\System32\NbSGhVM.exe TID: 7768 Thread sleep time: -41000s >= -30000s
Source: C:\Windows\System32\WJJOByy.exe TID: 7784 Thread sleep time: -41000s >= -30000s
Source: C:\Windows\System32\DNWTLfi.exe TID: 7800 Thread sleep time: -41000s >= -30000s
Source: C:\Windows\System32\JVLiIAQ.exe TID: 7816 Thread sleep time: -41000s >= -30000s
Source: C:\Windows\System32\eTlchBa.exe TID: 7832 Thread sleep time: -41000s >= -30000s
Source: C:\Windows\System32\FmDRJeq.exe TID: 7848 Thread sleep time: -41000s >= -30000s
Source: C:\Windows\System32\JxXCqVa.exe TID: 7864 Thread sleep time: -41000s >= -30000s
Source: C:\Windows\System32\qulWMNK.exe TID: 7880 Thread sleep time: -41000s >= -30000s
Source: C:\Windows\System32\KvrKIPQ.exe TID: 7896 Thread sleep time: -41000s >= -30000s
Source: C:\Windows\System32\zgnppqX.exe TID: 7912 Thread sleep time: -41000s >= -30000s
Source: C:\Windows\System32\VeDzKyt.exe TID: 7928 Thread sleep time: -41000s >= -30000s
Source: C:\Windows\System32\Emkynwd.exe TID: 7944 Thread sleep time: -41000s >= -30000s
Source: C:\Windows\System32\UTMWcnW.exe TID: 7964 Thread sleep time: -41000s >= -30000s
Source: C:\Windows\System32\nUwvlEf.exe TID: 7980 Thread sleep time: -41000s >= -30000s
Source: C:\Windows\System32\FSsBuPy.exe TID: 7996 Thread sleep time: -41000s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F3B760 CreateEventA,SetErrorMode,RtlInitializeCriticalSection,GetSystemInfo,RtlInitializeCriticalSection,RtlInitializeCriticalSection,SetConsoleCtrlHandler,CreateSemaphoreA,GetLastError,CreateFileW,QueueUserWorkItem,RtlInitializeCriticalSection,QueryPerformanceFrequency,SetEvent,CloseHandle,WaitForSingleObject,GetLastError, 3_2_00007FF6E1F3B760
Source: C:\Windows\System32\JvuHRXO.exe Thread delayed: delay time: 41000 Jump to behavior
Source: C:\Windows\System32\wkKSPgp.exe Thread delayed: delay time: 41000 Jump to behavior
Source: C:\Windows\System32\gaDJFNb.exe Thread delayed: delay time: 41000 Jump to behavior
Source: C:\Windows\System32\ehLRfQc.exe Thread delayed: delay time: 41000 Jump to behavior
Source: C:\Windows\System32\OTQisvZ.exe Thread delayed: delay time: 41000 Jump to behavior
Source: C:\Windows\System32\AvKmyWx.exe Thread delayed: delay time: 41000 Jump to behavior
Source: C:\Windows\System32\XaZvEHG.exe Thread delayed: delay time: 41000
Source: C:\Windows\System32\oblCraV.exe Thread delayed: delay time: 41000
Source: C:\Windows\System32\YuhEzpi.exe Thread delayed: delay time: 41000
Source: C:\Windows\System32\DYRnoDf.exe Thread delayed: delay time: 41000
Source: C:\Windows\System32\biTFilm.exe Thread delayed: delay time: 41000
Source: C:\Windows\System32\BXwYBdZ.exe Thread delayed: delay time: 41000
Source: C:\Windows\System32\AJbunRc.exe Thread delayed: delay time: 41000
Source: C:\Windows\System32\SUqdJFj.exe Thread delayed: delay time: 41000
Source: C:\Windows\System32\TIHWeXa.exe Thread delayed: delay time: 41000
Source: C:\Windows\System32\PXvfCpI.exe Thread delayed: delay time: 41000
Source: C:\Windows\System32\dhdvyXn.exe Thread delayed: delay time: 41000
Source: C:\Windows\System32\QMneGpM.exe Thread delayed: delay time: 41000
Source: C:\Windows\System32\ODEkuhr.exe Thread delayed: delay time: 41000
Source: C:\Windows\System32\VFmvQYa.exe Thread delayed: delay time: 41000
Source: C:\Windows\System32\FJbyTtP.exe Thread delayed: delay time: 41000
Source: C:\Windows\System32\FTsRyWe.exe Thread delayed: delay time: 41000
Source: C:\Windows\System32\uUnCnJC.exe Thread delayed: delay time: 41000
Source: C:\Windows\System32\NbSGhVM.exe Thread delayed: delay time: 41000
Source: C:\Windows\System32\WJJOByy.exe Thread delayed: delay time: 41000
Source: C:\Windows\System32\DNWTLfi.exe Thread delayed: delay time: 41000
Source: C:\Windows\System32\JVLiIAQ.exe Thread delayed: delay time: 41000
Source: C:\Windows\System32\eTlchBa.exe Thread delayed: delay time: 41000
Source: C:\Windows\System32\FmDRJeq.exe Thread delayed: delay time: 41000
Source: C:\Windows\System32\JxXCqVa.exe Thread delayed: delay time: 41000
Source: C:\Windows\System32\qulWMNK.exe Thread delayed: delay time: 41000
Source: C:\Windows\System32\KvrKIPQ.exe Thread delayed: delay time: 41000
Source: C:\Windows\System32\zgnppqX.exe Thread delayed: delay time: 41000
Source: C:\Windows\System32\VeDzKyt.exe Thread delayed: delay time: 41000
Source: C:\Windows\System32\Emkynwd.exe Thread delayed: delay time: 41000
Source: C:\Windows\System32\UTMWcnW.exe Thread delayed: delay time: 41000
Source: C:\Windows\System32\nUwvlEf.exe Thread delayed: delay time: 41000
Source: C:\Windows\System32\FSsBuPy.exe Thread delayed: delay time: 41000
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F7D6D4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 3_2_00007FF6E1F7D6D4
Contains functionality to dynamically determine API calls
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F3EBF0 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError, 3_2_00007FF6E1F3EBF0
Source: C:\Windows\System32\JvuHRXO.exe Code function: 3_2_00007FF6E1F7D6D4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 3_2_00007FF6E1F7D6D4
Source: C:\Windows\System32\wkKSPgp.exe Code function: 4_2_00007FF7E305D6D4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 4_2_00007FF7E305D6D4
Source: C:\Windows\System32\gaDJFNb.exe Code function: 5_2_00007FF62744D6D4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 5_2_00007FF62744D6D4
Source: C:\Windows\System32\ehLRfQc.exe Code function: 6_2_00007FF647D6D6D4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 6_2_00007FF647D6D6D4
Source: C:\Windows\System32\OTQisvZ.exe Code function: 7_2_00007FF63CD8D6D4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 7_2_00007FF63CD8D6D4
Source: C:\Windows\System32\AvKmyWx.exe Code function: 8_2_00007FF6102DD6D4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 8_2_00007FF6102DD6D4
Source: C:\Windows\System32\XaZvEHG.exe Code function: 9_2_00007FF61D71D6D4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 9_2_00007FF61D71D6D4
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1522740 Sample: file.exe Startdate: 30/09/2024 Architecture: WINDOWS Score: 100 27 Malicious sample detected (through community Yara rule) 2->27 29 Antivirus detection for dropped file 2->29 31 Antivirus / Scanner detection for submitted sample 2->31 33 6 other signatures 2->33 6 file.exe 1002 2->6         started        process3 file4 19 C:\Windows\System32\zxkWcfH.exe, PE32+ 6->19 dropped 21 C:\Windows\System32\zoWFHEB.exe, PE32+ 6->21 dropped 23 C:\Windows\System32\zoNaMRv.exe, PE32+ 6->23 dropped 25 327 other malicious files 6->25 dropped 35 Drops executables to the windows directory (C:\Windows) and starts them 6->35 10 AvKmyWx.exe 1 6->10         started        13 DYRnoDf.exe 6->13         started        15 BXwYBdZ.exe 6->15         started        17 36 other processes 6->17 signatures5 process6 signatures7 37 Antivirus detection for dropped file 10->37 39 Machine Learning detection for dropped file 10->39 41 Contains functionality to registers a callback to get notified when the system is suspended or resumed (often done by Miners) 10->41
⊘No contacted IP infos