xmrig | d889d5b7502fe6830a332550e01300a1eb14b561e1c5e290a78a9eaf007ff846

Analysis

max time kernel
144s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 11:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
Size 1.7MB
Sample240608-nqscpacb67
SHA256 d889d5b7502fe6830a332550e01300a1eb14b561e1c5e290a78a9eaf007ff846
MD5 13f7c731f75dfa046319efa0020e7a60
SHA1 5fbae90144e56d04f5ebdeb1d637555c0904700c
SHA512 ef566c95dcb6e412d18e2e69b594ac852e68d5602d6daa90fe23f5edaafa9fea40247148a458704bbb56f6a6471dcc0a6f0fe0fd24ce3073d205374992f2e94e
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlNIZbElhzBXeCnfJCwCc4MAKFpMloooIXrgM:Lz071uv4BPMkFfdgIZohteLMxRgb3D
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 13520 created 1016	13520	WerFaultSecure.exe	88

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/4520-1395-0x00007FF710D00000-0x00007FF7110F2000-memory.dmp	xmrig
behavioral2/memory/1568-1403-0x00007FF6A06B0000-0x00007FF6A0AA2000-memory.dmp	xmrig
behavioral2/memory/4276-1394-0x00007FF720C50000-0x00007FF721042000-memory.dmp	xmrig
behavioral2/memory/4656-2244-0x00007FF758940000-0x00007FF758D32000-memory.dmp	xmrig
behavioral2/memory/1492-154-0x00007FF661800000-0x00007FF661BF2000-memory.dmp	xmrig
behavioral2/memory/1616-125-0x00007FF66A120000-0x00007FF66A512000-memory.dmp	xmrig
behavioral2/memory/1864-77-0x00007FF6A8350000-0x00007FF6A8742000-memory.dmp	xmrig
behavioral2/memory/4636-72-0x00007FF7763A0000-0x00007FF776792000-memory.dmp	xmrig
behavioral2/memory/1920-29-0x00007FF63E250000-0x00007FF63E642000-memory.dmp	xmrig
behavioral2/memory/4772-27-0x00007FF7A0220000-0x00007FF7A0612000-memory.dmp	xmrig
behavioral2/memory/4056-2277-0x00007FF6E8CA0000-0x00007FF6E9092000-memory.dmp	xmrig
behavioral2/memory/1216-2287-0x00007FF784200000-0x00007FF7845F2000-memory.dmp	xmrig
behavioral2/memory/2376-2288-0x00007FF738260000-0x00007FF738652000-memory.dmp	xmrig
behavioral2/memory/4636-2289-0x00007FF7763A0000-0x00007FF776792000-memory.dmp	xmrig
behavioral2/memory/3732-2290-0x00007FF733650000-0x00007FF733A42000-memory.dmp	xmrig
behavioral2/memory/4072-2292-0x00007FF76CE10000-0x00007FF76D202000-memory.dmp	xmrig
behavioral2/memory/2708-2291-0x00007FF638CF0000-0x00007FF6390E2000-memory.dmp	xmrig
behavioral2/memory/1460-2293-0x00007FF750BE0000-0x00007FF750FD2000-memory.dmp	xmrig
behavioral2/memory/4772-2327-0x00007FF7A0220000-0x00007FF7A0612000-memory.dmp	xmrig
behavioral2/memory/4520-2329-0x00007FF710D00000-0x00007FF7110F2000-memory.dmp	xmrig
behavioral2/memory/1920-2331-0x00007FF63E250000-0x00007FF63E642000-memory.dmp	xmrig
behavioral2/memory/1568-2334-0x00007FF6A06B0000-0x00007FF6A0AA2000-memory.dmp	xmrig
behavioral2/memory/4056-2337-0x00007FF6E8CA0000-0x00007FF6E9092000-memory.dmp	xmrig
behavioral2/memory/1216-2341-0x00007FF784200000-0x00007FF7845F2000-memory.dmp	xmrig
behavioral2/memory/2376-2345-0x00007FF738260000-0x00007FF738652000-memory.dmp	xmrig
behavioral2/memory/4636-2347-0x00007FF7763A0000-0x00007FF776792000-memory.dmp	xmrig
behavioral2/memory/1864-2343-0x00007FF6A8350000-0x00007FF6A8742000-memory.dmp	xmrig
behavioral2/memory/4656-2340-0x00007FF758940000-0x00007FF758D32000-memory.dmp	xmrig
behavioral2/memory/3896-2336-0x00007FF7E1580000-0x00007FF7E1972000-memory.dmp	xmrig
behavioral2/memory/2708-2378-0x00007FF638CF0000-0x00007FF6390E2000-memory.dmp	xmrig
behavioral2/memory/3892-2376-0x00007FF6B7700000-0x00007FF6B7AF2000-memory.dmp	xmrig
behavioral2/memory/2744-2374-0x00007FF6ACD70000-0x00007FF6AD162000-memory.dmp	xmrig
behavioral2/memory/1492-2368-0x00007FF661800000-0x00007FF661BF2000-memory.dmp	xmrig
behavioral2/memory/3732-2366-0x00007FF733650000-0x00007FF733A42000-memory.dmp	xmrig
behavioral2/memory/4072-2363-0x00007FF76CE10000-0x00007FF76D202000-memory.dmp	xmrig
behavioral2/memory/2228-2362-0x00007FF694000000-0x00007FF6943F2000-memory.dmp	xmrig
behavioral2/memory/3148-2359-0x00007FF69DDD0000-0x00007FF69E1C2000-memory.dmp	xmrig
behavioral2/memory/1460-2356-0x00007FF750BE0000-0x00007FF750FD2000-memory.dmp	xmrig
behavioral2/memory/3920-2354-0x00007FF62F920000-0x00007FF62FD12000-memory.dmp	xmrig
behavioral2/memory/3632-2351-0x00007FF6373C0000-0x00007FF6377B2000-memory.dmp	xmrig
behavioral2/memory/1616-2358-0x00007FF66A120000-0x00007FF66A512000-memory.dmp	xmrig
behavioral2/memory/984-2350-0x00007FF6E2DE0000-0x00007FF6E31D2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
9	4164	powershell.exe
11	4164	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4164	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4520	bJaIvTT.exe
4772	GopqIAi.exe
1568	bZNOYlN.exe
1920	IYiifHs.exe
4656	XRsAVyD.exe
3896	vAziLtg.exe
4056	rkqjLsG.exe
1216	AzouPnt.exe
4636	VVtnKAM.exe
2376	NVJzrVq.exe
1864	HbiGage.exe
3732	KaRvbjI.exe
2708	JkSPord.exe
1492	mAwsdQE.exe
4072	UWODncY.exe
3148	gCieQBn.exe
2228	KDpwtfO.exe
1616	YzKHtdu.exe
3920	pHIFQbb.exe
1460	qczvBcV.exe
3632	RUwspnO.exe
3892	avvBtIJ.exe
984	PvAlArb.exe
2744	ldnwhLY.exe
904	GHdDAdt.exe
3684	jrQvDPe.exe
4852	bKavqQM.exe
1892	aIMBDta.exe
4532	TyHkXZi.exe
3152	uvQiDWF.exe
2340	pmtnVuf.exe
4904	oKGetJe.exe
1804	fIuWMPx.exe
2588	rmQlrFN.exe
1088	bQUjdGG.exe
3056	mKtogcT.exe
4720	WdygYCS.exe
4584	tquHADo.exe
4480	KZjpfrX.exe
5036	yaZVDTj.exe
4196	cafXlbm.exe
5128	optJbND.exe
5032	oMMvTKc.exe
5156	FxnwpYI.exe
5184	EUPSlUT.exe
5204	OZxJEcL.exe
5240	wjfKUlj.exe
5268	gXEtstm.exe
5284	FQhwBgv.exe
5324	gfArQYo.exe
5344	mMDAqvj.exe
5396	zzEEOgm.exe
5436	ZKNcYDY.exe
5460	mLXkaHJ.exe
5484	JwddBDm.exe
5504	LmXplYE.exe
5524	qKeyprw.exe
5560	oDhIOuO.exe
5584	LuXsSeW.exe
5612	SpJFzZk.exe
5636	KTFwpHP.exe
5656	ZAOIaqk.exe
5676	icfgBxZ.exe
5704	zxrYGEH.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4276-0-0x00007FF720C50000-0x00007FF721042000-memory.dmp	upx
behavioral2/files/0x00070000000235e2-11.dat	upx
behavioral2/memory/1568-21-0x00007FF6A06B0000-0x00007FF6A0AA2000-memory.dmp	upx
behavioral2/files/0x00070000000235e6-31.dat	upx
behavioral2/memory/1216-56-0x00007FF784200000-0x00007FF7845F2000-memory.dmp	upx
behavioral2/memory/2376-65-0x00007FF738260000-0x00007FF738652000-memory.dmp	upx
behavioral2/files/0x00070000000235ed-95.dat	upx
behavioral2/files/0x00070000000235fa-152.dat	upx
behavioral2/memory/2228-174-0x00007FF694000000-0x00007FF6943F2000-memory.dmp	upx
behavioral2/files/0x00070000000235fc-183.dat	upx
behavioral2/files/0x0007000000023601-197.dat	upx
behavioral2/memory/4520-1395-0x00007FF710D00000-0x00007FF7110F2000-memory.dmp	upx
behavioral2/memory/1568-1403-0x00007FF6A06B0000-0x00007FF6A0AA2000-memory.dmp	upx
behavioral2/memory/4276-1394-0x00007FF720C50000-0x00007FF721042000-memory.dmp	upx
behavioral2/memory/4656-2244-0x00007FF758940000-0x00007FF758D32000-memory.dmp	upx
behavioral2/memory/2744-196-0x00007FF6ACD70000-0x00007FF6AD162000-memory.dmp	upx
behavioral2/memory/3632-189-0x00007FF6373C0000-0x00007FF6377B2000-memory.dmp	upx
behavioral2/files/0x00070000000235ff-188.dat	upx
behavioral2/memory/3920-180-0x00007FF62F920000-0x00007FF62FD12000-memory.dmp	upx
behavioral2/files/0x00080000000235df-168.dat	upx
behavioral2/memory/1492-154-0x00007FF661800000-0x00007FF661BF2000-memory.dmp	upx
behavioral2/files/0x00080000000235df-151.dat	upx
behavioral2/memory/984-149-0x00007FF6E2DE0000-0x00007FF6E31D2000-memory.dmp	upx
behavioral2/memory/3892-145-0x00007FF6B7700000-0x00007FF6B7AF2000-memory.dmp	upx
behavioral2/memory/1460-133-0x00007FF750BE0000-0x00007FF750FD2000-memory.dmp	upx
behavioral2/files/0x00070000000235f5-136.dat	upx
behavioral2/files/0x00070000000235f3-128.dat	upx
behavioral2/files/0x00070000000235f4-127.dat	upx
behavioral2/memory/1616-125-0x00007FF66A120000-0x00007FF66A512000-memory.dmp	upx
behavioral2/memory/3148-124-0x00007FF69DDD0000-0x00007FF69E1C2000-memory.dmp	upx
behavioral2/files/0x00070000000235f5-123.dat	upx
behavioral2/files/0x00070000000235f6-118.dat	upx
behavioral2/files/0x00070000000235f2-117.dat	upx
behavioral2/memory/4072-116-0x00007FF76CE10000-0x00007FF76D202000-memory.dmp	upx
behavioral2/memory/2708-99-0x00007FF638CF0000-0x00007FF6390E2000-memory.dmp	upx
behavioral2/memory/3732-91-0x00007FF733650000-0x00007FF733A42000-memory.dmp	upx
behavioral2/files/0x00070000000235ef-89.dat	upx
behavioral2/files/0x00070000000235f1-92.dat	upx
behavioral2/files/0x00070000000235ee-81.dat	upx
behavioral2/memory/1864-77-0x00007FF6A8350000-0x00007FF6A8742000-memory.dmp	upx
behavioral2/memory/4636-72-0x00007FF7763A0000-0x00007FF776792000-memory.dmp	upx
behavioral2/files/0x00070000000235ec-71.dat	upx
behavioral2/files/0x00070000000235ea-64.dat	upx
behavioral2/memory/4056-47-0x00007FF6E8CA0000-0x00007FF6E9092000-memory.dmp	upx
behavioral2/memory/3896-40-0x00007FF7E1580000-0x00007FF7E1972000-memory.dmp	upx
behavioral2/memory/4656-35-0x00007FF758940000-0x00007FF758D32000-memory.dmp	upx
behavioral2/files/0x00070000000235e7-39.dat	upx
behavioral2/memory/1920-29-0x00007FF63E250000-0x00007FF63E642000-memory.dmp	upx
behavioral2/memory/4772-27-0x00007FF7A0220000-0x00007FF7A0612000-memory.dmp	upx
behavioral2/files/0x00070000000235e5-25.dat	upx
behavioral2/files/0x00070000000235e4-20.dat	upx
behavioral2/memory/4520-17-0x00007FF710D00000-0x00007FF7110F2000-memory.dmp	upx
behavioral2/memory/4056-2277-0x00007FF6E8CA0000-0x00007FF6E9092000-memory.dmp	upx
behavioral2/memory/1216-2287-0x00007FF784200000-0x00007FF7845F2000-memory.dmp	upx
behavioral2/memory/2376-2288-0x00007FF738260000-0x00007FF738652000-memory.dmp	upx
behavioral2/memory/4636-2289-0x00007FF7763A0000-0x00007FF776792000-memory.dmp	upx
behavioral2/memory/3732-2290-0x00007FF733650000-0x00007FF733A42000-memory.dmp	upx
behavioral2/memory/4072-2292-0x00007FF76CE10000-0x00007FF76D202000-memory.dmp	upx
behavioral2/memory/2708-2291-0x00007FF638CF0000-0x00007FF6390E2000-memory.dmp	upx
behavioral2/memory/1460-2293-0x00007FF750BE0000-0x00007FF750FD2000-memory.dmp	upx
behavioral2/memory/4772-2327-0x00007FF7A0220000-0x00007FF7A0612000-memory.dmp	upx
behavioral2/memory/4520-2329-0x00007FF710D00000-0x00007FF7110F2000-memory.dmp	upx
behavioral2/memory/1920-2331-0x00007FF63E250000-0x00007FF63E642000-memory.dmp	upx
behavioral2/memory/1568-2334-0x00007FF6A06B0000-0x00007FF6A0AA2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\rghHugz.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\JKIbCOJ.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\YhLAXWN.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\VKOxtrW.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\AJrWsnS.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\NFDKate.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\JripSyG.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\qUuJaWl.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\LrEANIm.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\DjNALNU.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\zzfnPZG.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\MEvkIso.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\brgViWP.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\LYxdKFY.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\hfsClfd.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\soertZy.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\kQvikoj.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\jKtfXlL.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\zNKgxSy.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\tDkgtaC.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\OHJkgZe.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\sGhGdNu.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\XdSqfoV.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\fVFWqmf.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\mAwsdQE.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\ktfVzrO.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\aiHsVom.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\IJijWXj.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\YHbVZbU.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\yzxqDqv.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\yqianse.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\dDjKFYs.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\ofMpMgy.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\qKEPWGl.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\JqQCJck.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\AoLtNDO.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\eDeqqvg.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\wpaSBex.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\LyupJPb.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\NVRwAws.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\dgcCRwk.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\bpgTTiD.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\yxNRNkY.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\qczvBcV.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\rgMVRxa.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\VoXTmZG.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\HOyeomx.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\kvSlXuU.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\vVeKZXc.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\JfCetNr.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\bmtjXhq.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\PVbsOKQ.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\jyISrns.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\sQrfFWn.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\zKflNWH.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\VgBfAdP.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\eGWbtcp.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\rbYLbFQ.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\VoHKGTu.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\CrXvrYK.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\BfThPvH.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\wbyCsUx.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\tkSMGyU.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
File created	C:\Windows\System\UFSRCOx.exe	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFaultSecure.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFaultSecure.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFaultSecure.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4164	powershell.exe
4164	powershell.exe
4164	powershell.exe
4164	powershell.exe
14176	WerFaultSecure.exe
14176	WerFaultSecure.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
Token: SeLockMemoryPrivilege	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
Token: SeDebugPrivilege	4164	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 4164	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	92
PID 4276 wrote to memory of 4164	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	92
PID 4276 wrote to memory of 4520	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	93
PID 4276 wrote to memory of 4520	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	93
PID 4276 wrote to memory of 4772	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	94
PID 4276 wrote to memory of 4772	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	94
PID 4276 wrote to memory of 1568	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	95
PID 4276 wrote to memory of 1568	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	95
PID 4276 wrote to memory of 1920	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	96
PID 4276 wrote to memory of 1920	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	96
PID 4276 wrote to memory of 4656	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	97
PID 4276 wrote to memory of 4656	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	97
PID 4276 wrote to memory of 3896	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	98
PID 4276 wrote to memory of 3896	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	98
PID 4276 wrote to memory of 4056	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	99
PID 4276 wrote to memory of 4056	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	99
PID 4276 wrote to memory of 1216	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	100
PID 4276 wrote to memory of 1216	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	100
PID 4276 wrote to memory of 4636	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	101
PID 4276 wrote to memory of 4636	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	101
PID 4276 wrote to memory of 2376	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	102
PID 4276 wrote to memory of 2376	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	102
PID 4276 wrote to memory of 1864	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	103
PID 4276 wrote to memory of 1864	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	103
PID 4276 wrote to memory of 3732	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	104
PID 4276 wrote to memory of 3732	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	104
PID 4276 wrote to memory of 2708	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	105
PID 4276 wrote to memory of 2708	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	105
PID 4276 wrote to memory of 1492	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	106
PID 4276 wrote to memory of 1492	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	106
PID 4276 wrote to memory of 4072	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	107
PID 4276 wrote to memory of 4072	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	107
PID 4276 wrote to memory of 3148	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	108
PID 4276 wrote to memory of 3148	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	108
PID 4276 wrote to memory of 2228	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	109
PID 4276 wrote to memory of 2228	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	109
PID 4276 wrote to memory of 1616	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	110
PID 4276 wrote to memory of 1616	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	110
PID 4276 wrote to memory of 3920	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	111
PID 4276 wrote to memory of 3920	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	111
PID 4276 wrote to memory of 1460	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	112
PID 4276 wrote to memory of 1460	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	112
PID 4276 wrote to memory of 984	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	113
PID 4276 wrote to memory of 984	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	113
PID 4276 wrote to memory of 3632	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	114
PID 4276 wrote to memory of 3632	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	114
PID 4276 wrote to memory of 3892	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	115
PID 4276 wrote to memory of 3892	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	115
PID 4276 wrote to memory of 2744	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	116
PID 4276 wrote to memory of 2744	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	116
PID 4276 wrote to memory of 904	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	117
PID 4276 wrote to memory of 904	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	117
PID 4276 wrote to memory of 3684	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	118
PID 4276 wrote to memory of 3684	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	118
PID 4276 wrote to memory of 4852	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	119
PID 4276 wrote to memory of 4852	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	119
PID 4276 wrote to memory of 1892	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	85
PID 4276 wrote to memory of 1892	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	85
PID 4276 wrote to memory of 4532	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	121
PID 4276 wrote to memory of 4532	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	121
PID 4276 wrote to memory of 3152	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	122
PID 4276 wrote to memory of 3152	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	122
PID 4276 wrote to memory of 2340	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	123
PID 4276 wrote to memory of 2340	4276	virussign.com_13f7c731f75dfa046319efa0020e7a60.exe	123

C:\Users\Admin\AppData\Local\Temp\3934565647\zmstage.exe
C:\Users\Admin\AppData\Local\Temp\3934565647\zmstage.exe
1⤵
PID:1892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
1⤵
PID:1016
- C:\Windows\system32\WerFaultSecure.exe
  C:\Windows\system32\WerFaultSecure.exe -u -p 1016 -s 836
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:14176

C:\Users\Admin\AppData\Local\Temp\virussign.com_13f7c731f75dfa046319efa0020e7a60.exe
"C:\Users\Admin\AppData\Local\Temp\virussign.com_13f7c731f75dfa046319efa0020e7a60.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4164
- C:\Windows\System\bJaIvTT.exe
  C:\Windows\System\bJaIvTT.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\GopqIAi.exe
  C:\Windows\System\GopqIAi.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\bZNOYlN.exe
  C:\Windows\System\bZNOYlN.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\IYiifHs.exe
  C:\Windows\System\IYiifHs.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\XRsAVyD.exe
  C:\Windows\System\XRsAVyD.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\vAziLtg.exe
  C:\Windows\System\vAziLtg.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\rkqjLsG.exe
  C:\Windows\System\rkqjLsG.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\AzouPnt.exe
  C:\Windows\System\AzouPnt.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\VVtnKAM.exe
  C:\Windows\System\VVtnKAM.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\NVJzrVq.exe
  C:\Windows\System\NVJzrVq.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\HbiGage.exe
  C:\Windows\System\HbiGage.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\KaRvbjI.exe
  C:\Windows\System\KaRvbjI.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\JkSPord.exe
  C:\Windows\System\JkSPord.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\mAwsdQE.exe
  C:\Windows\System\mAwsdQE.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\UWODncY.exe
  C:\Windows\System\UWODncY.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\gCieQBn.exe
  C:\Windows\System\gCieQBn.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\KDpwtfO.exe
  C:\Windows\System\KDpwtfO.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\YzKHtdu.exe
  C:\Windows\System\YzKHtdu.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\pHIFQbb.exe
  C:\Windows\System\pHIFQbb.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\qczvBcV.exe
  C:\Windows\System\qczvBcV.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\PvAlArb.exe
  C:\Windows\System\PvAlArb.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\RUwspnO.exe
  C:\Windows\System\RUwspnO.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\avvBtIJ.exe
  C:\Windows\System\avvBtIJ.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\ldnwhLY.exe
  C:\Windows\System\ldnwhLY.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\GHdDAdt.exe
  C:\Windows\System\GHdDAdt.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\jrQvDPe.exe
  C:\Windows\System\jrQvDPe.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\bKavqQM.exe
  C:\Windows\System\bKavqQM.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\aIMBDta.exe
  C:\Windows\System\aIMBDta.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\TyHkXZi.exe
  C:\Windows\System\TyHkXZi.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\uvQiDWF.exe
  C:\Windows\System\uvQiDWF.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\pmtnVuf.exe
  C:\Windows\System\pmtnVuf.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\oKGetJe.exe
  C:\Windows\System\oKGetJe.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\fIuWMPx.exe
  C:\Windows\System\fIuWMPx.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\rmQlrFN.exe
  C:\Windows\System\rmQlrFN.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\bQUjdGG.exe
  C:\Windows\System\bQUjdGG.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\mKtogcT.exe
  C:\Windows\System\mKtogcT.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\WdygYCS.exe
  C:\Windows\System\WdygYCS.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\tquHADo.exe
  C:\Windows\System\tquHADo.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\KZjpfrX.exe
  C:\Windows\System\KZjpfrX.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\yaZVDTj.exe
  C:\Windows\System\yaZVDTj.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\cafXlbm.exe
  C:\Windows\System\cafXlbm.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\oMMvTKc.exe
  C:\Windows\System\oMMvTKc.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\optJbND.exe
  C:\Windows\System\optJbND.exe
  2⤵
  - Executes dropped EXE
  PID:5128
- C:\Windows\System\FxnwpYI.exe
  C:\Windows\System\FxnwpYI.exe
  2⤵
  - Executes dropped EXE
  PID:5156
- C:\Windows\System\EUPSlUT.exe
  C:\Windows\System\EUPSlUT.exe
  2⤵
  - Executes dropped EXE
  PID:5184
- C:\Windows\System\OZxJEcL.exe
  C:\Windows\System\OZxJEcL.exe
  2⤵
  - Executes dropped EXE
  PID:5204
- C:\Windows\System\wjfKUlj.exe
  C:\Windows\System\wjfKUlj.exe
  2⤵
  - Executes dropped EXE
  PID:5240
- C:\Windows\System\gXEtstm.exe
  C:\Windows\System\gXEtstm.exe
  2⤵
  - Executes dropped EXE
  PID:5268
- C:\Windows\System\FQhwBgv.exe
  C:\Windows\System\FQhwBgv.exe
  2⤵
  - Executes dropped EXE
  PID:5284
- C:\Windows\System\gfArQYo.exe
  C:\Windows\System\gfArQYo.exe
  2⤵
  - Executes dropped EXE
  PID:5324
- C:\Windows\System\mMDAqvj.exe
  C:\Windows\System\mMDAqvj.exe
  2⤵
  - Executes dropped EXE
  PID:5344
- C:\Windows\System\zzEEOgm.exe
  C:\Windows\System\zzEEOgm.exe
  2⤵
  - Executes dropped EXE
  PID:5396
- C:\Windows\System\ZKNcYDY.exe
  C:\Windows\System\ZKNcYDY.exe
  2⤵
  - Executes dropped EXE
  PID:5436
- C:\Windows\System\mLXkaHJ.exe
  C:\Windows\System\mLXkaHJ.exe
  2⤵
  - Executes dropped EXE
  PID:5460
- C:\Windows\System\JwddBDm.exe
  C:\Windows\System\JwddBDm.exe
  2⤵
  - Executes dropped EXE
  PID:5484
- C:\Windows\System\LmXplYE.exe
  C:\Windows\System\LmXplYE.exe
  2⤵
  - Executes dropped EXE
  PID:5504
- C:\Windows\System\qKeyprw.exe
  C:\Windows\System\qKeyprw.exe
  2⤵
  - Executes dropped EXE
  PID:5524
- C:\Windows\System\oDhIOuO.exe
  C:\Windows\System\oDhIOuO.exe
  2⤵
  - Executes dropped EXE
  PID:5560
- C:\Windows\System\LuXsSeW.exe
  C:\Windows\System\LuXsSeW.exe
  2⤵
  - Executes dropped EXE
  PID:5584
- C:\Windows\System\SpJFzZk.exe
  C:\Windows\System\SpJFzZk.exe
  2⤵
  - Executes dropped EXE
  PID:5612
- C:\Windows\System\KTFwpHP.exe
  C:\Windows\System\KTFwpHP.exe
  2⤵
  - Executes dropped EXE
  PID:5636
- C:\Windows\System\ZAOIaqk.exe
  C:\Windows\System\ZAOIaqk.exe
  2⤵
  - Executes dropped EXE
  PID:5656
- C:\Windows\System\icfgBxZ.exe
  C:\Windows\System\icfgBxZ.exe
  2⤵
  - Executes dropped EXE
  PID:5676
- C:\Windows\System\zxrYGEH.exe
  C:\Windows\System\zxrYGEH.exe
  2⤵
  - Executes dropped EXE
  PID:5704
- C:\Windows\System\GPyyoeH.exe
  C:\Windows\System\GPyyoeH.exe
  2⤵
  PID:5744
- C:\Windows\System\otnHAOr.exe
  C:\Windows\System\otnHAOr.exe
  2⤵
  PID:5764
- C:\Windows\System\nmbHIXd.exe
  C:\Windows\System\nmbHIXd.exe
  2⤵
  PID:5808
- C:\Windows\System\xfjUwqH.exe
  C:\Windows\System\xfjUwqH.exe
  2⤵
  PID:5836
- C:\Windows\System\FDwuhWD.exe
  C:\Windows\System\FDwuhWD.exe
  2⤵
  PID:5856
- C:\Windows\System\JDHHZFv.exe
  C:\Windows\System\JDHHZFv.exe
  2⤵
  PID:5900
- C:\Windows\System\ywkiipL.exe
  C:\Windows\System\ywkiipL.exe
  2⤵
  PID:5944
- C:\Windows\System\WkgerlZ.exe
  C:\Windows\System\WkgerlZ.exe
  2⤵
  PID:5972
- C:\Windows\System\dDjKFYs.exe
  C:\Windows\System\dDjKFYs.exe
  2⤵
  PID:6004
- C:\Windows\System\VDvbSoL.exe
  C:\Windows\System\VDvbSoL.exe
  2⤵
  PID:6032
- C:\Windows\System\ZGMrBpJ.exe
  C:\Windows\System\ZGMrBpJ.exe
  2⤵
  PID:6064
- C:\Windows\System\UXOnKgT.exe
  C:\Windows\System\UXOnKgT.exe
  2⤵
  PID:6092
- C:\Windows\System\fTVURlI.exe
  C:\Windows\System\fTVURlI.exe
  2⤵
  PID:6108
- C:\Windows\System\oTBpwEz.exe
  C:\Windows\System\oTBpwEz.exe
  2⤵
  PID:6132
- C:\Windows\System\jRjhTlM.exe
  C:\Windows\System\jRjhTlM.exe
  2⤵
  PID:1996
- C:\Windows\System\CBkApDg.exe
  C:\Windows\System\CBkApDg.exe
  2⤵
  PID:5148
- C:\Windows\System\zxcOHjP.exe
  C:\Windows\System\zxcOHjP.exe
  2⤵
  PID:5264
- C:\Windows\System\iVMpkJv.exe
  C:\Windows\System\iVMpkJv.exe
  2⤵
  PID:5376
- C:\Windows\System\orxlyQE.exe
  C:\Windows\System\orxlyQE.exe
  2⤵
  PID:5424
- C:\Windows\System\UYpiJuQ.exe
  C:\Windows\System\UYpiJuQ.exe
  2⤵
  PID:5452
- C:\Windows\System\IRwmfEq.exe
  C:\Windows\System\IRwmfEq.exe
  2⤵
  PID:5492
- C:\Windows\System\qQrIQUu.exe
  C:\Windows\System\qQrIQUu.exe
  2⤵
  PID:5536
- C:\Windows\System\VEKoCDh.exe
  C:\Windows\System\VEKoCDh.exe
  2⤵
  PID:5572
- C:\Windows\System\FvIcFVM.exe
  C:\Windows\System\FvIcFVM.exe
  2⤵
  PID:5648
- C:\Windows\System\OfmXZXn.exe
  C:\Windows\System\OfmXZXn.exe
  2⤵
  PID:5776
- C:\Windows\System\ZKMQXkw.exe
  C:\Windows\System\ZKMQXkw.exe
  2⤵
  PID:3472
- C:\Windows\System\TziBRLI.exe
  C:\Windows\System\TziBRLI.exe
  2⤵
  PID:872
- C:\Windows\System\nahGYxc.exe
  C:\Windows\System\nahGYxc.exe
  2⤵
  PID:316
- C:\Windows\System\GCwFMMR.exe
  C:\Windows\System\GCwFMMR.exe
  2⤵
  PID:5924
- C:\Windows\System\kAsTYAG.exe
  C:\Windows\System\kAsTYAG.exe
  2⤵
  PID:6000
- C:\Windows\System\qhOoeMU.exe
  C:\Windows\System\qhOoeMU.exe
  2⤵
  PID:6100
- C:\Windows\System\aMjbpTe.exe
  C:\Windows\System\aMjbpTe.exe
  2⤵
  PID:5124
- C:\Windows\System\BRlxdNm.exe
  C:\Windows\System\BRlxdNm.exe
  2⤵
  PID:5196
- C:\Windows\System\BvaAcvE.exe
  C:\Windows\System\BvaAcvE.exe
  2⤵
  PID:5308
- C:\Windows\System\sJaXOAX.exe
  C:\Windows\System\sJaXOAX.exe
  2⤵
  PID:5480
- C:\Windows\System\afGQhDr.exe
  C:\Windows\System\afGQhDr.exe
  2⤵
  PID:5500
- C:\Windows\System\yUpGjRK.exe
  C:\Windows\System\yUpGjRK.exe
  2⤵
  PID:4880
- C:\Windows\System\aoixmvj.exe
  C:\Windows\System\aoixmvj.exe
  2⤵
  PID:2168
- C:\Windows\System\XdbAImS.exe
  C:\Windows\System\XdbAImS.exe
  2⤵
  PID:4988
- C:\Windows\System\xsxcgJd.exe
  C:\Windows\System\xsxcgJd.exe
  2⤵
  PID:5964
- C:\Windows\System\dtRtGFs.exe
  C:\Windows\System\dtRtGFs.exe
  2⤵
  PID:4296
- C:\Windows\System\iXwMJQh.exe
  C:\Windows\System\iXwMJQh.exe
  2⤵
  PID:5216
- C:\Windows\System\xTxLVcB.exe
  C:\Windows\System\xTxLVcB.exe
  2⤵
  PID:4432
- C:\Windows\System\sXqXdXq.exe
  C:\Windows\System\sXqXdXq.exe
  2⤵
  PID:5000
- C:\Windows\System\urnBUnw.exe
  C:\Windows\System\urnBUnw.exe
  2⤵
  PID:5316
- C:\Windows\System\NKrolys.exe
  C:\Windows\System\NKrolys.exe
  2⤵
  PID:5700
- C:\Windows\System\FkUtTeL.exe
  C:\Windows\System\FkUtTeL.exe
  2⤵
  PID:6148
- C:\Windows\System\tDkgtaC.exe
  C:\Windows\System\tDkgtaC.exe
  2⤵
  PID:6168
- C:\Windows\System\tEvArAZ.exe
  C:\Windows\System\tEvArAZ.exe
  2⤵
  PID:6188
- C:\Windows\System\XxzrEEn.exe
  C:\Windows\System\XxzrEEn.exe
  2⤵
  PID:6204
- C:\Windows\System\RcteNoy.exe
  C:\Windows\System\RcteNoy.exe
  2⤵
  PID:6232
- C:\Windows\System\YjRheqN.exe
  C:\Windows\System\YjRheqN.exe
  2⤵
  PID:6268
- C:\Windows\System\VxlFtyr.exe
  C:\Windows\System\VxlFtyr.exe
  2⤵
  PID:6288
- C:\Windows\System\VKOxtrW.exe
  C:\Windows\System\VKOxtrW.exe
  2⤵
  PID:6316
- C:\Windows\System\NVRwAws.exe
  C:\Windows\System\NVRwAws.exe
  2⤵
  PID:6336
- C:\Windows\System\vcQXCHy.exe
  C:\Windows\System\vcQXCHy.exe
  2⤵
  PID:6360
- C:\Windows\System\OncdFzN.exe
  C:\Windows\System\OncdFzN.exe
  2⤵
  PID:6384
- C:\Windows\System\otbKVOg.exe
  C:\Windows\System\otbKVOg.exe
  2⤵
  PID:6440
- C:\Windows\System\FpqPVEx.exe
  C:\Windows\System\FpqPVEx.exe
  2⤵
  PID:6512
- C:\Windows\System\IvIuSOF.exe
  C:\Windows\System\IvIuSOF.exe
  2⤵
  PID:6532
- C:\Windows\System\xiKcfnb.exe
  C:\Windows\System\xiKcfnb.exe
  2⤵
  PID:6568
- C:\Windows\System\XOQIyCb.exe
  C:\Windows\System\XOQIyCb.exe
  2⤵
  PID:6584
- C:\Windows\System\vFHjCmS.exe
  C:\Windows\System\vFHjCmS.exe
  2⤵
  PID:6608
- C:\Windows\System\wJfZxSX.exe
  C:\Windows\System\wJfZxSX.exe
  2⤵
  PID:6624
- C:\Windows\System\fCqHeNw.exe
  C:\Windows\System\fCqHeNw.exe
  2⤵
  PID:6656
- C:\Windows\System\dVRtOBw.exe
  C:\Windows\System\dVRtOBw.exe
  2⤵
  PID:6684
- C:\Windows\System\kvSlXuU.exe
  C:\Windows\System\kvSlXuU.exe
  2⤵
  PID:6728
- C:\Windows\System\FqrNhMA.exe
  C:\Windows\System\FqrNhMA.exe
  2⤵
  PID:6748
- C:\Windows\System\TotYbbv.exe
  C:\Windows\System\TotYbbv.exe
  2⤵
  PID:6772
- C:\Windows\System\ldmKXVL.exe
  C:\Windows\System\ldmKXVL.exe
  2⤵
  PID:6792
- C:\Windows\System\ooCgxCB.exe
  C:\Windows\System\ooCgxCB.exe
  2⤵
  PID:6816
- C:\Windows\System\JVISRXZ.exe
  C:\Windows\System\JVISRXZ.exe
  2⤵
  PID:6836
- C:\Windows\System\jbXIFvO.exe
  C:\Windows\System\jbXIFvO.exe
  2⤵
  PID:6876
- C:\Windows\System\dZGwMNH.exe
  C:\Windows\System\dZGwMNH.exe
  2⤵
  PID:6900
- C:\Windows\System\vmumzzz.exe
  C:\Windows\System\vmumzzz.exe
  2⤵
  PID:6920
- C:\Windows\System\cxTSEVQ.exe
  C:\Windows\System\cxTSEVQ.exe
  2⤵
  PID:6944
- C:\Windows\System\miWBRVq.exe
  C:\Windows\System\miWBRVq.exe
  2⤵
  PID:6964
- C:\Windows\System\EpEXTce.exe
  C:\Windows\System\EpEXTce.exe
  2⤵
  PID:6980
- C:\Windows\System\XtAmaBE.exe
  C:\Windows\System\XtAmaBE.exe
  2⤵
  PID:7008
- C:\Windows\System\xmOLYWt.exe
  C:\Windows\System\xmOLYWt.exe
  2⤵
  PID:7048
- C:\Windows\System\vBSWtet.exe
  C:\Windows\System\vBSWtet.exe
  2⤵
  PID:7080
- C:\Windows\System\BGgrVik.exe
  C:\Windows\System\BGgrVik.exe
  2⤵
  PID:7096
- C:\Windows\System\YHbVZbU.exe
  C:\Windows\System\YHbVZbU.exe
  2⤵
  PID:7140
- C:\Windows\System\QHiJFfk.exe
  C:\Windows\System\QHiJFfk.exe
  2⤵
  PID:7156
- C:\Windows\System\qKegDad.exe
  C:\Windows\System\qKegDad.exe
  2⤵
  PID:6160
- C:\Windows\System\gyFHPxL.exe
  C:\Windows\System\gyFHPxL.exe
  2⤵
  PID:696
- C:\Windows\System\veXjTyZ.exe
  C:\Windows\System\veXjTyZ.exe
  2⤵
  PID:6212
- C:\Windows\System\RFttmhP.exe
  C:\Windows\System\RFttmhP.exe
  2⤵
  PID:6252
- C:\Windows\System\gBOlzND.exe
  C:\Windows\System\gBOlzND.exe
  2⤵
  PID:6324
- C:\Windows\System\nytaxEF.exe
  C:\Windows\System\nytaxEF.exe
  2⤵
  PID:6436
- C:\Windows\System\ktfVzrO.exe
  C:\Windows\System\ktfVzrO.exe
  2⤵
  PID:6580
- C:\Windows\System\fBGplIq.exe
  C:\Windows\System\fBGplIq.exe
  2⤵
  PID:6620
- C:\Windows\System\upqbvNv.exe
  C:\Windows\System\upqbvNv.exe
  2⤵
  PID:6744
- C:\Windows\System\XuULKeY.exe
  C:\Windows\System\XuULKeY.exe
  2⤵
  PID:6868
- C:\Windows\System\lpJkeZN.exe
  C:\Windows\System\lpJkeZN.exe
  2⤵
  PID:6892
- C:\Windows\System\VeadbHd.exe
  C:\Windows\System\VeadbHd.exe
  2⤵
  PID:6956
- C:\Windows\System\OPcICoT.exe
  C:\Windows\System\OPcICoT.exe
  2⤵
  PID:7040
- C:\Windows\System\CPZUPMf.exe
  C:\Windows\System\CPZUPMf.exe
  2⤵
  PID:7136
- C:\Windows\System\NFpvywr.exe
  C:\Windows\System\NFpvywr.exe
  2⤵
  PID:6960
- C:\Windows\System\NJSmuJU.exe
  C:\Windows\System\NJSmuJU.exe
  2⤵
  PID:6200
- C:\Windows\System\OHJkgZe.exe
  C:\Windows\System\OHJkgZe.exe
  2⤵
  PID:876
- C:\Windows\System\hlJZMzE.exe
  C:\Windows\System\hlJZMzE.exe
  2⤵
  PID:6712
- C:\Windows\System\yTGttVv.exe
  C:\Windows\System\yTGttVv.exe
  2⤵
  PID:6596
- C:\Windows\System\nYyezcl.exe
  C:\Windows\System\nYyezcl.exe
  2⤵
  PID:6760
- C:\Windows\System\ceTmQjE.exe
  C:\Windows\System\ceTmQjE.exe
  2⤵
  PID:6976
- C:\Windows\System\UzOFSsB.exe
  C:\Windows\System\UzOFSsB.exe
  2⤵
  PID:6928
- C:\Windows\System\JIbSSya.exe
  C:\Windows\System\JIbSSya.exe
  2⤵
  PID:6648
- C:\Windows\System\IeVaqqJ.exe
  C:\Windows\System\IeVaqqJ.exe
  2⤵
  PID:6940
- C:\Windows\System\htctVrr.exe
  C:\Windows\System\htctVrr.exe
  2⤵
  PID:6700
- C:\Windows\System\aIwKHMq.exe
  C:\Windows\System\aIwKHMq.exe
  2⤵
  PID:7088
- C:\Windows\System\ZDEnPxQ.exe
  C:\Windows\System\ZDEnPxQ.exe
  2⤵
  PID:7192
- C:\Windows\System\uXxzPkW.exe
  C:\Windows\System\uXxzPkW.exe
  2⤵
  PID:7228
- C:\Windows\System\wrsiKfL.exe
  C:\Windows\System\wrsiKfL.exe
  2⤵
  PID:7252
- C:\Windows\System\OGbXPil.exe
  C:\Windows\System\OGbXPil.exe
  2⤵
  PID:7280
- C:\Windows\System\VjQFuMg.exe
  C:\Windows\System\VjQFuMg.exe
  2⤵
  PID:7308
- C:\Windows\System\bQexCDV.exe
  C:\Windows\System\bQexCDV.exe
  2⤵
  PID:7328
- C:\Windows\System\poNnkjK.exe
  C:\Windows\System\poNnkjK.exe
  2⤵
  PID:7352
- C:\Windows\System\vnMCUkI.exe
  C:\Windows\System\vnMCUkI.exe
  2⤵
  PID:7400
- C:\Windows\System\PwUePZj.exe
  C:\Windows\System\PwUePZj.exe
  2⤵
  PID:7416
- C:\Windows\System\PmjuZcO.exe
  C:\Windows\System\PmjuZcO.exe
  2⤵
  PID:7456
- C:\Windows\System\pFqzUab.exe
  C:\Windows\System\pFqzUab.exe
  2⤵
  PID:7472
- C:\Windows\System\gKDwSJU.exe
  C:\Windows\System\gKDwSJU.exe
  2⤵
  PID:7488
- C:\Windows\System\rghHugz.exe
  C:\Windows\System\rghHugz.exe
  2⤵
  PID:7508
- C:\Windows\System\AoLtNDO.exe
  C:\Windows\System\AoLtNDO.exe
  2⤵
  PID:7556
- C:\Windows\System\xCEYshn.exe
  C:\Windows\System\xCEYshn.exe
  2⤵
  PID:7576
- C:\Windows\System\ABVHVhs.exe
  C:\Windows\System\ABVHVhs.exe
  2⤵
  PID:7604
- C:\Windows\System\hVKgKTM.exe
  C:\Windows\System\hVKgKTM.exe
  2⤵
  PID:7644
- C:\Windows\System\tNwPqZV.exe
  C:\Windows\System\tNwPqZV.exe
  2⤵
  PID:7660
- C:\Windows\System\qjwPHHa.exe
  C:\Windows\System\qjwPHHa.exe
  2⤵
  PID:7688
- C:\Windows\System\HRhfmLY.exe
  C:\Windows\System\HRhfmLY.exe
  2⤵
  PID:7708
- C:\Windows\System\pTOoXXh.exe
  C:\Windows\System\pTOoXXh.exe
  2⤵
  PID:7744
- C:\Windows\System\qUuJaWl.exe
  C:\Windows\System\qUuJaWl.exe
  2⤵
  PID:7768
- C:\Windows\System\cpkvafi.exe
  C:\Windows\System\cpkvafi.exe
  2⤵
  PID:7792
- C:\Windows\System\nwNEVsV.exe
  C:\Windows\System\nwNEVsV.exe
  2⤵
  PID:7848
- C:\Windows\System\ELzUMic.exe
  C:\Windows\System\ELzUMic.exe
  2⤵
  PID:7864
- C:\Windows\System\MqmXWsj.exe
  C:\Windows\System\MqmXWsj.exe
  2⤵
  PID:7896
- C:\Windows\System\zBKssjk.exe
  C:\Windows\System\zBKssjk.exe
  2⤵
  PID:7912
- C:\Windows\System\dWSpXUX.exe
  C:\Windows\System\dWSpXUX.exe
  2⤵
  PID:7928
- C:\Windows\System\alOxaTI.exe
  C:\Windows\System\alOxaTI.exe
  2⤵
  PID:7960
- C:\Windows\System\KlbTLKZ.exe
  C:\Windows\System\KlbTLKZ.exe
  2⤵
  PID:7984
- C:\Windows\System\skrcrGT.exe
  C:\Windows\System\skrcrGT.exe
  2⤵
  PID:8028
- C:\Windows\System\DkvtvcL.exe
  C:\Windows\System\DkvtvcL.exe
  2⤵
  PID:8048
- C:\Windows\System\qKUYuMV.exe
  C:\Windows\System\qKUYuMV.exe
  2⤵
  PID:8068
- C:\Windows\System\gopTBUQ.exe
  C:\Windows\System\gopTBUQ.exe
  2⤵
  PID:8096
- C:\Windows\System\BSDWUxU.exe
  C:\Windows\System\BSDWUxU.exe
  2⤵
  PID:8124
- C:\Windows\System\IDRtpAg.exe
  C:\Windows\System\IDRtpAg.exe
  2⤵
  PID:8152
- C:\Windows\System\saqecHY.exe
  C:\Windows\System\saqecHY.exe
  2⤵
  PID:8180
- C:\Windows\System\qGuuWQt.exe
  C:\Windows\System\qGuuWQt.exe
  2⤵
  PID:7208
- C:\Windows\System\sGhGdNu.exe
  C:\Windows\System\sGhGdNu.exe
  2⤵
  PID:7268
- C:\Windows\System\VhuliJO.exe
  C:\Windows\System\VhuliJO.exe
  2⤵
  PID:7324
- C:\Windows\System\aiHsVom.exe
  C:\Windows\System\aiHsVom.exe
  2⤵
  PID:7396
- C:\Windows\System\xjoOyrl.exe
  C:\Windows\System\xjoOyrl.exe
  2⤵
  PID:7436
- C:\Windows\System\rYaCRij.exe
  C:\Windows\System\rYaCRij.exe
  2⤵
  PID:7504
- C:\Windows\System\hRYEVRl.exe
  C:\Windows\System\hRYEVRl.exe
  2⤵
  PID:7532
- C:\Windows\System\stRtnuU.exe
  C:\Windows\System\stRtnuU.exe
  2⤵
  PID:7584
- C:\Windows\System\YHuLGCm.exe
  C:\Windows\System\YHuLGCm.exe
  2⤵
  PID:7624
- C:\Windows\System\KogVIzr.exe
  C:\Windows\System\KogVIzr.exe
  2⤵
  PID:7676
- C:\Windows\System\NLOhXAf.exe
  C:\Windows\System\NLOhXAf.exe
  2⤵
  PID:7780
- C:\Windows\System\rbYLbFQ.exe
  C:\Windows\System\rbYLbFQ.exe
  2⤵
  PID:7856
- C:\Windows\System\QvSQjVX.exe
  C:\Windows\System\QvSQjVX.exe
  2⤵
  PID:7944
- C:\Windows\System\cqaBICG.exe
  C:\Windows\System\cqaBICG.exe
  2⤵
  PID:8036
- C:\Windows\System\IXNxYSI.exe
  C:\Windows\System\IXNxYSI.exe
  2⤵
  PID:8060
- C:\Windows\System\lFGcvOm.exe
  C:\Windows\System\lFGcvOm.exe
  2⤵
  PID:8044
- C:\Windows\System\VBhWfTj.exe
  C:\Windows\System\VBhWfTj.exe
  2⤵
  PID:7184
- C:\Windows\System\WZusDro.exe
  C:\Windows\System\WZusDro.exe
  2⤵
  PID:7260
- C:\Windows\System\CyzJOaG.exe
  C:\Windows\System\CyzJOaG.exe
  2⤵
  PID:7376
- C:\Windows\System\bKEheLs.exe
  C:\Windows\System\bKEheLs.exe
  2⤵
  PID:7652
- C:\Windows\System\XdMKJep.exe
  C:\Windows\System\XdMKJep.exe
  2⤵
  PID:7764
- C:\Windows\System\lQIuSkd.exe
  C:\Windows\System\lQIuSkd.exe
  2⤵
  PID:7860
- C:\Windows\System\yywmcSY.exe
  C:\Windows\System\yywmcSY.exe
  2⤵
  PID:8076
- C:\Windows\System\motRkoX.exe
  C:\Windows\System\motRkoX.exe
  2⤵
  PID:8148
- C:\Windows\System\vzeXvdt.exe
  C:\Windows\System\vzeXvdt.exe
  2⤵
  PID:7372
- C:\Windows\System\QbiKPxm.exe
  C:\Windows\System\QbiKPxm.exe
  2⤵
  PID:520
- C:\Windows\System\tsRrAFJ.exe
  C:\Windows\System\tsRrAFJ.exe
  2⤵
  PID:7656
- C:\Windows\System\zzfnPZG.exe
  C:\Windows\System\zzfnPZG.exe
  2⤵
  PID:7300
- C:\Windows\System\mKbCrkF.exe
  C:\Windows\System\mKbCrkF.exe
  2⤵
  PID:8220
- C:\Windows\System\tHdiAab.exe
  C:\Windows\System\tHdiAab.exe
  2⤵
  PID:8244
- C:\Windows\System\ouNQUlL.exe
  C:\Windows\System\ouNQUlL.exe
  2⤵
  PID:8264
- C:\Windows\System\tGnYRZR.exe
  C:\Windows\System\tGnYRZR.exe
  2⤵
  PID:8292
- C:\Windows\System\oKKkHXD.exe
  C:\Windows\System\oKKkHXD.exe
  2⤵
  PID:8312
- C:\Windows\System\lSmtxJL.exe
  C:\Windows\System\lSmtxJL.exe
  2⤵
  PID:8336
- C:\Windows\System\KdBgvgj.exe
  C:\Windows\System\KdBgvgj.exe
  2⤵
  PID:8356
- C:\Windows\System\IdSufNP.exe
  C:\Windows\System\IdSufNP.exe
  2⤵
  PID:8376
- C:\Windows\System\fPOZqry.exe
  C:\Windows\System\fPOZqry.exe
  2⤵
  PID:8440
- C:\Windows\System\KxOTMxv.exe
  C:\Windows\System\KxOTMxv.exe
  2⤵
  PID:8472
- C:\Windows\System\FjkDRpQ.exe
  C:\Windows\System\FjkDRpQ.exe
  2⤵
  PID:8496
- C:\Windows\System\eraXtBE.exe
  C:\Windows\System\eraXtBE.exe
  2⤵
  PID:8520
- C:\Windows\System\jisKkDk.exe
  C:\Windows\System\jisKkDk.exe
  2⤵
  PID:8548
- C:\Windows\System\ltrIOQJ.exe
  C:\Windows\System\ltrIOQJ.exe
  2⤵
  PID:8564
- C:\Windows\System\bTNowtt.exe
  C:\Windows\System\bTNowtt.exe
  2⤵
  PID:8588
- C:\Windows\System\SJIEvjc.exe
  C:\Windows\System\SJIEvjc.exe
  2⤵
  PID:8616
- C:\Windows\System\uECOptj.exe
  C:\Windows\System\uECOptj.exe
  2⤵
  PID:8644
- C:\Windows\System\vRdRNhF.exe
  C:\Windows\System\vRdRNhF.exe
  2⤵
  PID:8684
- C:\Windows\System\FgqWwRL.exe
  C:\Windows\System\FgqWwRL.exe
  2⤵
  PID:8724
- C:\Windows\System\WfXvSKS.exe
  C:\Windows\System\WfXvSKS.exe
  2⤵
  PID:8744
- C:\Windows\System\ifJXMYw.exe
  C:\Windows\System\ifJXMYw.exe
  2⤵
  PID:8768
- C:\Windows\System\PRQGMLs.exe
  C:\Windows\System\PRQGMLs.exe
  2⤵
  PID:8788
- C:\Windows\System\voHEvzD.exe
  C:\Windows\System\voHEvzD.exe
  2⤵
  PID:8824
- C:\Windows\System\qjqvcqM.exe
  C:\Windows\System\qjqvcqM.exe
  2⤵
  PID:8844
- C:\Windows\System\fSkRsag.exe
  C:\Windows\System\fSkRsag.exe
  2⤵
  PID:8876
- C:\Windows\System\CQFzYWo.exe
  C:\Windows\System\CQFzYWo.exe
  2⤵
  PID:8912
- C:\Windows\System\dfrXpIp.exe
  C:\Windows\System\dfrXpIp.exe
  2⤵
  PID:8936
- C:\Windows\System\hfTQolw.exe
  C:\Windows\System\hfTQolw.exe
  2⤵
  PID:8996
- C:\Windows\System\iqaLaaY.exe
  C:\Windows\System\iqaLaaY.exe
  2⤵
  PID:9016
- C:\Windows\System\jKtfXlL.exe
  C:\Windows\System\jKtfXlL.exe
  2⤵
  PID:9048
- C:\Windows\System\zUVpCvh.exe
  C:\Windows\System\zUVpCvh.exe
  2⤵
  PID:9064
- C:\Windows\System\sBHqmIU.exe
  C:\Windows\System\sBHqmIU.exe
  2⤵
  PID:9084
- C:\Windows\System\mxWHlnv.exe
  C:\Windows\System\mxWHlnv.exe
  2⤵
  PID:9108
- C:\Windows\System\JlrMKsV.exe
  C:\Windows\System\JlrMKsV.exe
  2⤵
  PID:9128
- C:\Windows\System\bgPNvJK.exe
  C:\Windows\System\bgPNvJK.exe
  2⤵
  PID:9152
- C:\Windows\System\EsHHAxq.exe
  C:\Windows\System\EsHHAxq.exe
  2⤵
  PID:9172
- C:\Windows\System\CIxuKBT.exe
  C:\Windows\System\CIxuKBT.exe
  2⤵
  PID:9200
- C:\Windows\System\WKlMpbf.exe
  C:\Windows\System\WKlMpbf.exe
  2⤵
  PID:8200
- C:\Windows\System\IqPdtlu.exe
  C:\Windows\System\IqPdtlu.exe
  2⤵
  PID:8196
- C:\Windows\System\YUbwSqB.exe
  C:\Windows\System\YUbwSqB.exe
  2⤵
  PID:8216
- C:\Windows\System\JYscgaK.exe
  C:\Windows\System\JYscgaK.exe
  2⤵
  PID:8260
- C:\Windows\System\dNAdenN.exe
  C:\Windows\System\dNAdenN.exe
  2⤵
  PID:8348
- C:\Windows\System\DsfTnoN.exe
  C:\Windows\System\DsfTnoN.exe
  2⤵
  PID:8364
- C:\Windows\System\taUOOxh.exe
  C:\Windows\System\taUOOxh.exe
  2⤵
  PID:8464
- C:\Windows\System\IuRsnUz.exe
  C:\Windows\System\IuRsnUz.exe
  2⤵
  PID:8612
- C:\Windows\System\ejAwkTH.exe
  C:\Windows\System\ejAwkTH.exe
  2⤵
  PID:8720
- C:\Windows\System\dtEVIxP.exe
  C:\Windows\System\dtEVIxP.exe
  2⤵
  PID:8780
- C:\Windows\System\OTuEwxE.exe
  C:\Windows\System\OTuEwxE.exe
  2⤵
  PID:8808
- C:\Windows\System\aUKLZcd.exe
  C:\Windows\System\aUKLZcd.exe
  2⤵
  PID:8884
- C:\Windows\System\snfsyLd.exe
  C:\Windows\System\snfsyLd.exe
  2⤵
  PID:8932
- C:\Windows\System\SqeevRF.exe
  C:\Windows\System\SqeevRF.exe
  2⤵
  PID:8980
- C:\Windows\System\exUpntl.exe
  C:\Windows\System\exUpntl.exe
  2⤵
  PID:9012
- C:\Windows\System\UHbWogG.exe
  C:\Windows\System\UHbWogG.exe
  2⤵
  PID:9076
- C:\Windows\System\qvIbQPC.exe
  C:\Windows\System\qvIbQPC.exe
  2⤵
  PID:9116
- C:\Windows\System\CGomQlV.exe
  C:\Windows\System\CGomQlV.exe
  2⤵
  PID:9140
- C:\Windows\System\azlXAlD.exe
  C:\Windows\System\azlXAlD.exe
  2⤵
  PID:9192
- C:\Windows\System\idTacgQ.exe
  C:\Windows\System\idTacgQ.exe
  2⤵
  PID:8236
- C:\Windows\System\dxUAkNj.exe
  C:\Windows\System\dxUAkNj.exe
  2⤵
  PID:4948
- C:\Windows\System\lgklhVG.exe
  C:\Windows\System\lgklhVG.exe
  2⤵
  PID:8580
- C:\Windows\System\zhtFtUi.exe
  C:\Windows\System\zhtFtUi.exe
  2⤵
  PID:8632
- C:\Windows\System\AJrWsnS.exe
  C:\Windows\System\AJrWsnS.exe
  2⤵
  PID:8804
- C:\Windows\System\nFlDwBI.exe
  C:\Windows\System\nFlDwBI.exe
  2⤵
  PID:8840
- C:\Windows\System\ndMGVaG.exe
  C:\Windows\System\ndMGVaG.exe
  2⤵
  PID:8968
- C:\Windows\System\LxaGSEh.exe
  C:\Windows\System\LxaGSEh.exe
  2⤵
  PID:9056
- C:\Windows\System\TdKrmiM.exe
  C:\Windows\System\TdKrmiM.exe
  2⤵
  PID:9168
- C:\Windows\System\goxmPAE.exe
  C:\Windows\System\goxmPAE.exe
  2⤵
  PID:8344
- C:\Windows\System\IfAWveH.exe
  C:\Windows\System\IfAWveH.exe
  2⤵
  PID:8432
- C:\Windows\System\VlggrAJ.exe
  C:\Windows\System\VlggrAJ.exe
  2⤵
  PID:4688
- C:\Windows\System\nvdtzwJ.exe
  C:\Windows\System\nvdtzwJ.exe
  2⤵
  PID:9004
- C:\Windows\System\tIVERFT.exe
  C:\Windows\System\tIVERFT.exe
  2⤵
  PID:8304
- C:\Windows\System\IlZuaEr.exe
  C:\Windows\System\IlZuaEr.exe
  2⤵
  PID:1120
- C:\Windows\System\rMfhaxU.exe
  C:\Windows\System\rMfhaxU.exe
  2⤵
  PID:4872
- C:\Windows\System\TEGmRfh.exe
  C:\Windows\System\TEGmRfh.exe
  2⤵
  PID:9232
- C:\Windows\System\ljWSMov.exe
  C:\Windows\System\ljWSMov.exe
  2⤵
  PID:9256
- C:\Windows\System\xLuybmH.exe
  C:\Windows\System\xLuybmH.exe
  2⤵
  PID:9276
- C:\Windows\System\RNgkKjt.exe
  C:\Windows\System\RNgkKjt.exe
  2⤵
  PID:9304
- C:\Windows\System\jyISrns.exe
  C:\Windows\System\jyISrns.exe
  2⤵
  PID:9320
- C:\Windows\System\hIfSipG.exe
  C:\Windows\System\hIfSipG.exe
  2⤵
  PID:9344
- C:\Windows\System\TlUcAQg.exe
  C:\Windows\System\TlUcAQg.exe
  2⤵
  PID:9364
- C:\Windows\System\sMlzozE.exe
  C:\Windows\System\sMlzozE.exe
  2⤵
  PID:9400
- C:\Windows\System\eDeqqvg.exe
  C:\Windows\System\eDeqqvg.exe
  2⤵
  PID:9476
- C:\Windows\System\nlSyeqa.exe
  C:\Windows\System\nlSyeqa.exe
  2⤵
  PID:9496
- C:\Windows\System\TEjGdKh.exe
  C:\Windows\System\TEjGdKh.exe
  2⤵
  PID:9524
- C:\Windows\System\HOtPKSm.exe
  C:\Windows\System\HOtPKSm.exe
  2⤵
  PID:9540
- C:\Windows\System\TnqfVxw.exe
  C:\Windows\System\TnqfVxw.exe
  2⤵
  PID:9572
- C:\Windows\System\VpcnkiV.exe
  C:\Windows\System\VpcnkiV.exe
  2⤵
  PID:9592
- C:\Windows\System\uPXzBeH.exe
  C:\Windows\System\uPXzBeH.exe
  2⤵
  PID:9640
- C:\Windows\System\vRRdDOl.exe
  C:\Windows\System\vRRdDOl.exe
  2⤵
  PID:9688
- C:\Windows\System\yiwrptB.exe
  C:\Windows\System\yiwrptB.exe
  2⤵
  PID:9712
- C:\Windows\System\eVHtYMM.exe
  C:\Windows\System\eVHtYMM.exe
  2⤵
  PID:9756
- C:\Windows\System\BPKSRqr.exe
  C:\Windows\System\BPKSRqr.exe
  2⤵
  PID:9776
- C:\Windows\System\rpdVksD.exe
  C:\Windows\System\rpdVksD.exe
  2⤵
  PID:9796
- C:\Windows\System\ImxCaGn.exe
  C:\Windows\System\ImxCaGn.exe
  2⤵
  PID:9828
- C:\Windows\System\SMJOpBD.exe
  C:\Windows\System\SMJOpBD.exe
  2⤵
  PID:9844
- C:\Windows\System\BKGveKo.exe
  C:\Windows\System\BKGveKo.exe
  2⤵
  PID:9864
- C:\Windows\System\TKBWZKY.exe
  C:\Windows\System\TKBWZKY.exe
  2⤵
  PID:9908
- C:\Windows\System\ZdLHvbI.exe
  C:\Windows\System\ZdLHvbI.exe
  2⤵
  PID:9948
- C:\Windows\System\zNKgxSy.exe
  C:\Windows\System\zNKgxSy.exe
  2⤵
  PID:9964
- C:\Windows\System\SUWxzqo.exe
  C:\Windows\System\SUWxzqo.exe
  2⤵
  PID:9992
- C:\Windows\System\wTQlOpw.exe
  C:\Windows\System\wTQlOpw.exe
  2⤵
  PID:10012
- C:\Windows\System\ofIEuFK.exe
  C:\Windows\System\ofIEuFK.exe
  2⤵
  PID:10032
- C:\Windows\System\sGSUgBj.exe
  C:\Windows\System\sGSUgBj.exe
  2⤵
  PID:10080
- C:\Windows\System\pxKfhAj.exe
  C:\Windows\System\pxKfhAj.exe
  2⤵
  PID:10100
- C:\Windows\System\wbyCsUx.exe
  C:\Windows\System\wbyCsUx.exe
  2⤵
  PID:10124
- C:\Windows\System\VphqoUa.exe
  C:\Windows\System\VphqoUa.exe
  2⤵
  PID:10144
- C:\Windows\System\BbVEoIk.exe
  C:\Windows\System\BbVEoIk.exe
  2⤵
  PID:10196
- C:\Windows\System\GOIjEkL.exe
  C:\Windows\System\GOIjEkL.exe
  2⤵
  PID:10216
- C:\Windows\System\CidXGPl.exe
  C:\Windows\System\CidXGPl.exe
  2⤵
  PID:9036
- C:\Windows\System\hWjAgap.exe
  C:\Windows\System\hWjAgap.exe
  2⤵
  PID:9272
- C:\Windows\System\GqhoRZO.exe
  C:\Windows\System\GqhoRZO.exe
  2⤵
  PID:4964
- C:\Windows\System\LYxdKFY.exe
  C:\Windows\System\LYxdKFY.exe
  2⤵
  PID:9388
- C:\Windows\System\gIvsYRl.exe
  C:\Windows\System\gIvsYRl.exe
  2⤵
  PID:9352
- C:\Windows\System\tQsHdNh.exe
  C:\Windows\System\tQsHdNh.exe
  2⤵
  PID:9512
- C:\Windows\System\zijXnQi.exe
  C:\Windows\System\zijXnQi.exe
  2⤵
  PID:9532
- C:\Windows\System\oZFoRTc.exe
  C:\Windows\System\oZFoRTc.exe
  2⤵
  PID:9588
- C:\Windows\System\nYSAlyy.exe
  C:\Windows\System\nYSAlyy.exe
  2⤵
  PID:9632
- C:\Windows\System\IDMISBu.exe
  C:\Windows\System\IDMISBu.exe
  2⤵
  PID:9752
- C:\Windows\System\adIATUb.exe
  C:\Windows\System\adIATUb.exe
  2⤵
  PID:9764
- C:\Windows\System\zTAnvLJ.exe
  C:\Windows\System\zTAnvLJ.exe
  2⤵
  PID:9860
- C:\Windows\System\feGUuWT.exe
  C:\Windows\System\feGUuWT.exe
  2⤵
  PID:9880
- C:\Windows\System\NFDKate.exe
  C:\Windows\System\NFDKate.exe
  2⤵
  PID:9972
- C:\Windows\System\yeMdGNP.exe
  C:\Windows\System\yeMdGNP.exe
  2⤵
  PID:10060
- C:\Windows\System\TbtTglM.exe
  C:\Windows\System\TbtTglM.exe
  2⤵
  PID:10092
- C:\Windows\System\DJNWAqV.exe
  C:\Windows\System\DJNWAqV.exe
  2⤵
  PID:10160
- C:\Windows\System\IVngKBw.exe
  C:\Windows\System\IVngKBw.exe
  2⤵
  PID:10228
- C:\Windows\System\qSldzWU.exe
  C:\Windows\System\qSldzWU.exe
  2⤵
  PID:9224
- C:\Windows\System\mQDQrvf.exe
  C:\Windows\System\mQDQrvf.exe
  2⤵
  PID:1548
- C:\Windows\System\eBozWDZ.exe
  C:\Windows\System\eBozWDZ.exe
  2⤵
  PID:9316
- C:\Windows\System\sDSATmB.exe
  C:\Windows\System\sDSATmB.exe
  2⤵
  PID:9440
- C:\Windows\System\ZPgLqSq.exe
  C:\Windows\System\ZPgLqSq.exe
  2⤵
  PID:9580
- C:\Windows\System\TzHELZq.exe
  C:\Windows\System\TzHELZq.exe
  2⤵
  PID:9684
- C:\Windows\System\dnKIKAY.exe
  C:\Windows\System\dnKIKAY.exe
  2⤵
  PID:9856
- C:\Windows\System\wQmwEgZ.exe
  C:\Windows\System\wQmwEgZ.exe
  2⤵
  PID:9960
- C:\Windows\System\tqUcjLv.exe
  C:\Windows\System\tqUcjLv.exe
  2⤵
  PID:10108
- C:\Windows\System\cewuhbd.exe
  C:\Windows\System\cewuhbd.exe
  2⤵
  PID:4068
- C:\Windows\System\LsjeiYG.exe
  C:\Windows\System\LsjeiYG.exe
  2⤵
  PID:1644
- C:\Windows\System\jlkWSpL.exe
  C:\Windows\System\jlkWSpL.exe
  2⤵
  PID:9772
- C:\Windows\System\CeVzYOE.exe
  C:\Windows\System\CeVzYOE.exe
  2⤵
  PID:3948
- C:\Windows\System\ePRmCxJ.exe
  C:\Windows\System\ePRmCxJ.exe
  2⤵
  PID:4540
- C:\Windows\System\cTXytQg.exe
  C:\Windows\System\cTXytQg.exe
  2⤵
  PID:10248
- C:\Windows\System\CvMNKrA.exe
  C:\Windows\System\CvMNKrA.exe
  2⤵
  PID:10276
- C:\Windows\System\pSREhcj.exe
  C:\Windows\System\pSREhcj.exe
  2⤵
  PID:10340
- C:\Windows\System\nuGjPWU.exe
  C:\Windows\System\nuGjPWU.exe
  2⤵
  PID:10380
- C:\Windows\System\FYuQpHC.exe
  C:\Windows\System\FYuQpHC.exe
  2⤵
  PID:10404
- C:\Windows\System\vVeKZXc.exe
  C:\Windows\System\vVeKZXc.exe
  2⤵
  PID:10420
- C:\Windows\System\RDJmgPH.exe
  C:\Windows\System\RDJmgPH.exe
  2⤵
  PID:10440
- C:\Windows\System\aCbODAG.exe
  C:\Windows\System\aCbODAG.exe
  2⤵
  PID:10472
- C:\Windows\System\oVgLNcd.exe
  C:\Windows\System\oVgLNcd.exe
  2⤵
  PID:10492
- C:\Windows\System\jiHDHml.exe
  C:\Windows\System\jiHDHml.exe
  2⤵
  PID:10512
- C:\Windows\System\TsCnSWm.exe
  C:\Windows\System\TsCnSWm.exe
  2⤵
  PID:10584
- C:\Windows\System\CuXpEkk.exe
  C:\Windows\System\CuXpEkk.exe
  2⤵
  PID:10608
- C:\Windows\System\lpfxHJw.exe
  C:\Windows\System\lpfxHJw.exe
  2⤵
  PID:10664
- C:\Windows\System\ChRCjLp.exe
  C:\Windows\System\ChRCjLp.exe
  2⤵
  PID:10700
- C:\Windows\System\JkzxIfe.exe
  C:\Windows\System\JkzxIfe.exe
  2⤵
  PID:10724
- C:\Windows\System\mDVhHKc.exe
  C:\Windows\System\mDVhHKc.exe
  2⤵
  PID:10744
- C:\Windows\System\OjhJKUl.exe
  C:\Windows\System\OjhJKUl.exe
  2⤵
  PID:10760
- C:\Windows\System\cOOQhKg.exe
  C:\Windows\System\cOOQhKg.exe
  2⤵
  PID:10788
- C:\Windows\System\VVqKhTh.exe
  C:\Windows\System\VVqKhTh.exe
  2⤵
  PID:10808
- C:\Windows\System\eOuJhEA.exe
  C:\Windows\System\eOuJhEA.exe
  2⤵
  PID:10864
- C:\Windows\System\oVyNttF.exe
  C:\Windows\System\oVyNttF.exe
  2⤵
  PID:10908
- C:\Windows\System\UeCsiRl.exe
  C:\Windows\System\UeCsiRl.exe
  2⤵
  PID:10944
- C:\Windows\System\rLBLcoZ.exe
  C:\Windows\System\rLBLcoZ.exe
  2⤵
  PID:10972
- C:\Windows\System\ZfXNtmZ.exe
  C:\Windows\System\ZfXNtmZ.exe
  2⤵
  PID:11000
- C:\Windows\System\INXMSOF.exe
  C:\Windows\System\INXMSOF.exe
  2⤵
  PID:11020
- C:\Windows\System\svZZXRC.exe
  C:\Windows\System\svZZXRC.exe
  2⤵
  PID:11048
- C:\Windows\System\HeAQdmu.exe
  C:\Windows\System\HeAQdmu.exe
  2⤵
  PID:11072
- C:\Windows\System\EJBVQUN.exe
  C:\Windows\System\EJBVQUN.exe
  2⤵
  PID:11088
- C:\Windows\System\msAreFl.exe
  C:\Windows\System\msAreFl.exe
  2⤵
  PID:11108
- C:\Windows\System\lxPpzeC.exe
  C:\Windows\System\lxPpzeC.exe
  2⤵
  PID:11160
- C:\Windows\System\bTugbcQ.exe
  C:\Windows\System\bTugbcQ.exe
  2⤵
  PID:11192
- C:\Windows\System\AQSPeGl.exe
  C:\Windows\System\AQSPeGl.exe
  2⤵
  PID:10120
- C:\Windows\System\HRixsiU.exe
  C:\Windows\System\HRixsiU.exe
  2⤵
  PID:9932
- C:\Windows\System\dgcCRwk.exe
  C:\Windows\System\dgcCRwk.exe
  2⤵
  PID:9852
- C:\Windows\System\CYrUhlp.exe
  C:\Windows\System\CYrUhlp.exe
  2⤵
  PID:10304
- C:\Windows\System\HaAHMCj.exe
  C:\Windows\System\HaAHMCj.exe
  2⤵
  PID:10356
- C:\Windows\System\ofvqhFT.exe
  C:\Windows\System\ofvqhFT.exe
  2⤵
  PID:10392
- C:\Windows\System\pYzHbUV.exe
  C:\Windows\System\pYzHbUV.exe
  2⤵
  PID:10412
- C:\Windows\System\gPGTJNA.exe
  C:\Windows\System\gPGTJNA.exe
  2⤵
  PID:10488
- C:\Windows\System\TYgHISf.exe
  C:\Windows\System\TYgHISf.exe
  2⤵
  PID:10484
- C:\Windows\System\JfCetNr.exe
  C:\Windows\System\JfCetNr.exe
  2⤵
  PID:10532
- C:\Windows\System\jAAcISA.exe
  C:\Windows\System\jAAcISA.exe
  2⤵
  PID:10568
- C:\Windows\System\nqMlkbG.exe
  C:\Windows\System\nqMlkbG.exe
  2⤵
  PID:10616
- C:\Windows\System\PyAKFNi.exe
  C:\Windows\System\PyAKFNi.exe
  2⤵
  PID:10680
- C:\Windows\System\zeiPbPo.exe
  C:\Windows\System\zeiPbPo.exe
  2⤵
  PID:10736
- C:\Windows\System\wkZvOPA.exe
  C:\Windows\System\wkZvOPA.exe
  2⤵
  PID:10756
- C:\Windows\System\ymSAgtv.exe
  C:\Windows\System\ymSAgtv.exe
  2⤵
  PID:10772
- C:\Windows\System\usHjxgk.exe
  C:\Windows\System\usHjxgk.exe
  2⤵
  PID:10832
- C:\Windows\System\sQrfFWn.exe
  C:\Windows\System\sQrfFWn.exe
  2⤵
  PID:10888
- C:\Windows\System\ZOyhfKE.exe
  C:\Windows\System\ZOyhfKE.exe
  2⤵
  PID:11056
- C:\Windows\System\BcHjldc.exe
  C:\Windows\System\BcHjldc.exe
  2⤵
  PID:9568
- C:\Windows\System\cNEFNvO.exe
  C:\Windows\System\cNEFNvO.exe
  2⤵
  PID:9928
- C:\Windows\System\eacoOln.exe
  C:\Windows\System\eacoOln.exe
  2⤵
  PID:11232
- C:\Windows\System\ZdPRabZ.exe
  C:\Windows\System\ZdPRabZ.exe
  2⤵
  PID:10960
- C:\Windows\System\MwKgUwy.exe
  C:\Windows\System\MwKgUwy.exe
  2⤵
  PID:10376
- C:\Windows\System\SuIPbdh.exe
  C:\Windows\System\SuIPbdh.exe
  2⤵
  PID:10436
- C:\Windows\System\hxCBPiD.exe
  C:\Windows\System\hxCBPiD.exe
  2⤵
  PID:10596
- C:\Windows\System\MwAronS.exe
  C:\Windows\System\MwAronS.exe
  2⤵
  PID:11084
- C:\Windows\System\GTRoaux.exe
  C:\Windows\System\GTRoaux.exe
  2⤵
  PID:11200
- C:\Windows\System\bNyoROf.exe
  C:\Windows\System\bNyoROf.exe
  2⤵
  PID:10936
- C:\Windows\System\ytfLObi.exe
  C:\Windows\System\ytfLObi.exe
  2⤵
  PID:11288
- C:\Windows\System\YpjkKwk.exe
  C:\Windows\System\YpjkKwk.exe
  2⤵
  PID:11336
- C:\Windows\System\prjTMAz.exe
  C:\Windows\System\prjTMAz.exe
  2⤵
  PID:11372
- C:\Windows\System\ijpXcuO.exe
  C:\Windows\System\ijpXcuO.exe
  2⤵
  PID:11396
- C:\Windows\System\zdjULqD.exe
  C:\Windows\System\zdjULqD.exe
  2⤵
  PID:11416
- C:\Windows\System\PqzGyya.exe
  C:\Windows\System\PqzGyya.exe
  2⤵
  PID:11440
- C:\Windows\System\VEAGiAb.exe
  C:\Windows\System\VEAGiAb.exe
  2⤵
  PID:11456
- C:\Windows\System\gQMgDkp.exe
  C:\Windows\System\gQMgDkp.exe
  2⤵
  PID:11488
- C:\Windows\System\kJxASyB.exe
  C:\Windows\System\kJxASyB.exe
  2⤵
  PID:11508
- C:\Windows\System\pXEGPpk.exe
  C:\Windows\System\pXEGPpk.exe
  2⤵
  PID:11524
- C:\Windows\System\AicEugy.exe
  C:\Windows\System\AicEugy.exe
  2⤵
  PID:11580
- C:\Windows\System\YZnLoMn.exe
  C:\Windows\System\YZnLoMn.exe
  2⤵
  PID:11612
- C:\Windows\System\hEhBuzI.exe
  C:\Windows\System\hEhBuzI.exe
  2⤵
  PID:11632
- C:\Windows\System\tZHhkKX.exe
  C:\Windows\System\tZHhkKX.exe
  2⤵
  PID:11668
- C:\Windows\System\mjZdDUN.exe
  C:\Windows\System\mjZdDUN.exe
  2⤵
  PID:11696
- C:\Windows\System\BYyFuGW.exe
  C:\Windows\System\BYyFuGW.exe
  2⤵
  PID:11720
- C:\Windows\System\FCZQDkc.exe
  C:\Windows\System\FCZQDkc.exe
  2⤵
  PID:11744
- C:\Windows\System\Rtnmslg.exe
  C:\Windows\System\Rtnmslg.exe
  2⤵
  PID:11764
- C:\Windows\System\GobAEgV.exe
  C:\Windows\System\GobAEgV.exe
  2⤵
  PID:11816
- C:\Windows\System\KDmZDDo.exe
  C:\Windows\System\KDmZDDo.exe
  2⤵
  PID:11856
- C:\Windows\System\dstnynH.exe
  C:\Windows\System\dstnynH.exe
  2⤵
  PID:11884
- C:\Windows\System\ulGEodO.exe
  C:\Windows\System\ulGEodO.exe
  2⤵
  PID:11900
- C:\Windows\System\UGgLzzj.exe
  C:\Windows\System\UGgLzzj.exe
  2⤵
  PID:11920
- C:\Windows\System\FQthpyJ.exe
  C:\Windows\System\FQthpyJ.exe
  2⤵
  PID:11940
- C:\Windows\System\IJijWXj.exe
  C:\Windows\System\IJijWXj.exe
  2⤵
  PID:12004
- C:\Windows\System\QtiqMpF.exe
  C:\Windows\System\QtiqMpF.exe
  2⤵
  PID:12032
- C:\Windows\System\JjqdPql.exe
  C:\Windows\System\JjqdPql.exe
  2⤵
  PID:12060
- C:\Windows\System\hfsClfd.exe
  C:\Windows\System\hfsClfd.exe
  2⤵
  PID:12088
- C:\Windows\System\YCrXNxl.exe
  C:\Windows\System\YCrXNxl.exe
  2⤵
  PID:12116
- C:\Windows\System\nOyxsAP.exe
  C:\Windows\System\nOyxsAP.exe
  2⤵
  PID:12136
- C:\Windows\System\NtvQPYo.exe
  C:\Windows\System\NtvQPYo.exe
  2⤵
  PID:12160
- C:\Windows\System\tbfVcOA.exe
  C:\Windows\System\tbfVcOA.exe
  2⤵
  PID:12180
- C:\Windows\System\yzxqDqv.exe
  C:\Windows\System\yzxqDqv.exe
  2⤵
  PID:12200
- C:\Windows\System\KRmVPmV.exe
  C:\Windows\System\KRmVPmV.exe
  2⤵
  PID:12220
- C:\Windows\System\IdmwRAd.exe
  C:\Windows\System\IdmwRAd.exe
  2⤵
  PID:12240
- C:\Windows\System\vVoUXZu.exe
  C:\Windows\System\vVoUXZu.exe
  2⤵
  PID:12284
- C:\Windows\System\EZdItzy.exe
  C:\Windows\System\EZdItzy.exe
  2⤵
  PID:10336
- C:\Windows\System\nMASfVZ.exe
  C:\Windows\System\nMASfVZ.exe
  2⤵
  PID:11308
- C:\Windows\System\WmiNjuy.exe
  C:\Windows\System\WmiNjuy.exe
  2⤵
  PID:11368
- C:\Windows\System\FcTbCGu.exe
  C:\Windows\System\FcTbCGu.exe
  2⤵
  PID:11388
- C:\Windows\System\eDWUXoz.exe
  C:\Windows\System\eDWUXoz.exe
  2⤵
  PID:11548
- C:\Windows\System\MEvkIso.exe
  C:\Windows\System\MEvkIso.exe
  2⤵
  PID:11564
- C:\Windows\System\bpgTTiD.exe
  C:\Windows\System\bpgTTiD.exe
  2⤵
  PID:11572
- C:\Windows\System\tiNyKGB.exe
  C:\Windows\System\tiNyKGB.exe
  2⤵
  PID:11660
- C:\Windows\System\SlbOLhP.exe
  C:\Windows\System\SlbOLhP.exe
  2⤵
  PID:11728
- C:\Windows\System\EOYUhWe.exe
  C:\Windows\System\EOYUhWe.exe
  2⤵
  PID:11864
- C:\Windows\System\HnOrHAl.exe
  C:\Windows\System\HnOrHAl.exe
  2⤵
  PID:11876
- C:\Windows\System\pirfcXl.exe
  C:\Windows\System\pirfcXl.exe
  2⤵
  PID:11932
- C:\Windows\System\wsAGhkK.exe
  C:\Windows\System\wsAGhkK.exe
  2⤵
  PID:12024
- C:\Windows\System\EnzNEbk.exe
  C:\Windows\System\EnzNEbk.exe
  2⤵
  PID:12076
- C:\Windows\System\YfXmOhg.exe
  C:\Windows\System\YfXmOhg.exe
  2⤵
  PID:12128
- C:\Windows\System\wCOrkQA.exe
  C:\Windows\System\wCOrkQA.exe
  2⤵
  PID:12172
- C:\Windows\System\VLONEDk.exe
  C:\Windows\System\VLONEDk.exe
  2⤵
  PID:12256
- C:\Windows\System\chgUJjg.exe
  C:\Windows\System\chgUJjg.exe
  2⤵
  PID:12268
- C:\Windows\System\oAZGoVn.exe
  C:\Windows\System\oAZGoVn.exe
  2⤵
  PID:9412
- C:\Windows\System\sDRkfjC.exe
  C:\Windows\System\sDRkfjC.exe
  2⤵
  PID:11280
- C:\Windows\System\dBoOnbR.exe
  C:\Windows\System\dBoOnbR.exe
  2⤵
  PID:11476
- C:\Windows\System\LLOXbNV.exe
  C:\Windows\System\LLOXbNV.exe
  2⤵
  PID:11692
- C:\Windows\System\tHPDUuW.exe
  C:\Windows\System\tHPDUuW.exe
  2⤵
  PID:11964
- C:\Windows\System\SxSuwvr.exe
  C:\Windows\System\SxSuwvr.exe
  2⤵
  PID:12236
- C:\Windows\System\OWijXeI.exe
  C:\Windows\System\OWijXeI.exe
  2⤵
  PID:12196
- C:\Windows\System\FFEnlWY.exe
  C:\Windows\System\FFEnlWY.exe
  2⤵
  PID:11284
- C:\Windows\System\KMvlMjf.exe
  C:\Windows\System\KMvlMjf.exe
  2⤵
  PID:11412
- C:\Windows\System\vqcSphb.exe
  C:\Windows\System\vqcSphb.exe
  2⤵
  PID:11972
- C:\Windows\System\nFhWWum.exe
  C:\Windows\System\nFhWWum.exe
  2⤵
  PID:12208
- C:\Windows\System\wViWzds.exe
  C:\Windows\System\wViWzds.exe
  2⤵
  PID:12300
- C:\Windows\System\jZNCZmr.exe
  C:\Windows\System\jZNCZmr.exe
  2⤵
  PID:12328
- C:\Windows\System\DTfYvQT.exe
  C:\Windows\System\DTfYvQT.exe
  2⤵
  PID:12352
- C:\Windows\System\CGkfHlx.exe
  C:\Windows\System\CGkfHlx.exe
  2⤵
  PID:12380
- C:\Windows\System\WKJaJRR.exe
  C:\Windows\System\WKJaJRR.exe
  2⤵
  PID:12404
- C:\Windows\System\VWvBtOm.exe
  C:\Windows\System\VWvBtOm.exe
  2⤵
  PID:12452
- C:\Windows\System\THQgneD.exe
  C:\Windows\System\THQgneD.exe
  2⤵
  PID:12480
- C:\Windows\System\RtkmLJp.exe
  C:\Windows\System\RtkmLJp.exe
  2⤵
  PID:12500
- C:\Windows\System\SRGAqcK.exe
  C:\Windows\System\SRGAqcK.exe
  2⤵
  PID:12520
- C:\Windows\System\ibuRUQF.exe
  C:\Windows\System\ibuRUQF.exe
  2⤵
  PID:12540
- C:\Windows\System\OPMVfNi.exe
  C:\Windows\System\OPMVfNi.exe
  2⤵
  PID:12564
- C:\Windows\System\TWeaGkB.exe
  C:\Windows\System\TWeaGkB.exe
  2⤵
  PID:12584
- C:\Windows\System\JripSyG.exe
  C:\Windows\System\JripSyG.exe
  2⤵
  PID:12636
- C:\Windows\System\guJfpjU.exe
  C:\Windows\System\guJfpjU.exe
  2⤵
  PID:12656
- C:\Windows\System\qzBoVYJ.exe
  C:\Windows\System\qzBoVYJ.exe
  2⤵
  PID:12680
- C:\Windows\System\MEpFnrU.exe
  C:\Windows\System\MEpFnrU.exe
  2⤵
  PID:12712
- C:\Windows\System\NzyuHOG.exe
  C:\Windows\System\NzyuHOG.exe
  2⤵
  PID:12756
- C:\Windows\System\pyONVGt.exe
  C:\Windows\System\pyONVGt.exe
  2⤵
  PID:12788
- C:\Windows\System\zKflNWH.exe
  C:\Windows\System\zKflNWH.exe
  2⤵
  PID:12808
- C:\Windows\System\ZtipkbL.exe
  C:\Windows\System\ZtipkbL.exe
  2⤵
  PID:12844
- C:\Windows\System\LZaOEAh.exe
  C:\Windows\System\LZaOEAh.exe
  2⤵
  PID:12888
- C:\Windows\System\kCjcfYn.exe
  C:\Windows\System\kCjcfYn.exe
  2⤵
  PID:12916
- C:\Windows\System\dPbDpEQ.exe
  C:\Windows\System\dPbDpEQ.exe
  2⤵
  PID:12936
- C:\Windows\System\ZeqPWFm.exe
  C:\Windows\System\ZeqPWFm.exe
  2⤵
  PID:12960
- C:\Windows\System\ftvNcXY.exe
  C:\Windows\System\ftvNcXY.exe
  2⤵
  PID:12980
- C:\Windows\System\VoHKGTu.exe
  C:\Windows\System\VoHKGTu.exe
  2⤵
  PID:13024
- C:\Windows\System\wWPIzeh.exe
  C:\Windows\System\wWPIzeh.exe
  2⤵
  PID:13044
- C:\Windows\System\VkPbexk.exe
  C:\Windows\System\VkPbexk.exe
  2⤵
  PID:13068
- C:\Windows\System\XuevsTS.exe
  C:\Windows\System\XuevsTS.exe
  2⤵
  PID:13104
- C:\Windows\System\ofMpMgy.exe
  C:\Windows\System\ofMpMgy.exe
  2⤵
  PID:13124
- C:\Windows\System\sqUrHtQ.exe
  C:\Windows\System\sqUrHtQ.exe
  2⤵
  PID:13152
- C:\Windows\System\MbVYpra.exe
  C:\Windows\System\MbVYpra.exe
  2⤵
  PID:13196
- C:\Windows\System\eJrxqgq.exe
  C:\Windows\System\eJrxqgq.exe
  2⤵
  PID:13216
- C:\Windows\System\CopajPo.exe
  C:\Windows\System\CopajPo.exe
  2⤵
  PID:13256
- C:\Windows\System\qjgiiLm.exe
  C:\Windows\System\qjgiiLm.exe
  2⤵
  PID:13276
- C:\Windows\System\VgBfAdP.exe
  C:\Windows\System\VgBfAdP.exe
  2⤵
  PID:13296
- C:\Windows\System\jBkiIea.exe
  C:\Windows\System\jBkiIea.exe
  2⤵
  PID:10480
- C:\Windows\System\CrXvrYK.exe
  C:\Windows\System\CrXvrYK.exe
  2⤵
  PID:12048
- C:\Windows\System\phyiwVP.exe
  C:\Windows\System\phyiwVP.exe
  2⤵
  PID:12440
- C:\Windows\System\mpYjkKX.exe
  C:\Windows\System\mpYjkKX.exe
  2⤵
  PID:12472
- C:\Windows\System\XkJiWyy.exe
  C:\Windows\System\XkJiWyy.exe
  2⤵
  PID:12512
- C:\Windows\System\DcmFpSH.exe
  C:\Windows\System\DcmFpSH.exe
  2⤵
  PID:12600
- C:\Windows\System\swfuaAq.exe
  C:\Windows\System\swfuaAq.exe
  2⤵
  PID:12672
- C:\Windows\System\HPlSfTW.exe
  C:\Windows\System\HPlSfTW.exe
  2⤵
  PID:12744
- C:\Windows\System\zXiKbqa.exe
  C:\Windows\System\zXiKbqa.exe
  2⤵
  PID:12824
- C:\Windows\System\oEIlVyw.exe
  C:\Windows\System\oEIlVyw.exe
  2⤵
  PID:12836
- C:\Windows\System\RkkAeUY.exe
  C:\Windows\System\RkkAeUY.exe
  2⤵
  PID:12924
- C:\Windows\System\kTaTHVm.exe
  C:\Windows\System\kTaTHVm.exe
  2⤵
  PID:12948
- C:\Windows\System\vGXokoY.exe
  C:\Windows\System\vGXokoY.exe
  2⤵
  PID:13084
- C:\Windows\System\INwrYYz.exe
  C:\Windows\System\INwrYYz.exe
  2⤵
  PID:13120
- C:\Windows\System\DjuYFFS.exe
  C:\Windows\System\DjuYFFS.exe
  2⤵
  PID:13212
- C:\Windows\System\jqyrBao.exe
  C:\Windows\System\jqyrBao.exe
  2⤵
  PID:4952
- C:\Windows\System\qeBmeEm.exe
  C:\Windows\System\qeBmeEm.exe
  2⤵
  PID:13264
- C:\Windows\System\foFqFPG.exe
  C:\Windows\System\foFqFPG.exe
  2⤵
  PID:12420
- C:\Windows\System\WnlyhiP.exe
  C:\Windows\System\WnlyhiP.exe
  2⤵
  PID:12424
- C:\Windows\System\RlLYLJV.exe
  C:\Windows\System\RlLYLJV.exe
  2⤵
  PID:12800
- C:\Windows\System\QoVCuSo.exe
  C:\Windows\System\QoVCuSo.exe
  2⤵
  PID:12996
- C:\Windows\System\BfThPvH.exe
  C:\Windows\System\BfThPvH.exe
  2⤵
  PID:13036
- C:\Windows\System\lkxmDTj.exe
  C:\Windows\System\lkxmDTj.exe
  2⤵
  PID:13092
- C:\Windows\System\SXLdVnV.exe
  C:\Windows\System\SXLdVnV.exe
  2⤵
  PID:13168
- C:\Windows\System\RMvHGhD.exe
  C:\Windows\System\RMvHGhD.exe
  2⤵
  PID:11792
- C:\Windows\System\vMuKMes.exe
  C:\Windows\System\vMuKMes.exe
  2⤵
  PID:11588
- C:\Windows\System\hIIegnI.exe
  C:\Windows\System\hIIegnI.exe
  2⤵
  PID:12768
- C:\Windows\System\jqXDeYg.exe
  C:\Windows\System\jqXDeYg.exe
  2⤵
  PID:13188
- C:\Windows\System\ldvYfkj.exe
  C:\Windows\System\ldvYfkj.exe
  2⤵
  PID:12572
- C:\Windows\System\HQOnufv.exe
  C:\Windows\System\HQOnufv.exe
  2⤵
  PID:13388
- C:\Windows\System\eZJOJYg.exe
  C:\Windows\System\eZJOJYg.exe
  2⤵
  PID:13404
- C:\Windows\System\txsqKnT.exe
  C:\Windows\System\txsqKnT.exe
  2⤵
  PID:13428
- C:\Windows\System\NyxhQNT.exe
  C:\Windows\System\NyxhQNT.exe
  2⤵
  PID:13476
- C:\Windows\System\WJArOkd.exe
  C:\Windows\System\WJArOkd.exe
  2⤵
  PID:13508
- C:\Windows\System\ztPfFSI.exe
  C:\Windows\System\ztPfFSI.exe
  2⤵
  PID:13540
- C:\Windows\System\GYuRsCH.exe
  C:\Windows\System\GYuRsCH.exe
  2⤵
  PID:13576
- C:\Windows\System\bHrFQbB.exe
  C:\Windows\System\bHrFQbB.exe
  2⤵
  PID:13580
- C:\Windows\System\wVnPeaj.exe
  C:\Windows\System\wVnPeaj.exe
  2⤵
  PID:13636
- C:\Windows\System\JKIbCOJ.exe
  C:\Windows\System\JKIbCOJ.exe
  2⤵
  PID:13656
- C:\Windows\System\zEqDmzr.exe
  C:\Windows\System\zEqDmzr.exe
  2⤵
  PID:13732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4040,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:8
1⤵
PID:7032

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 1016 -i 1016 -h 432 -j 440 -s 448 -d 13416
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:13520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_qdnovys1.ar5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qdnovys1.ar5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

GopqIAi.exe

Path C:\Windows\System\GopqIAi.exe
Size 1.7MB
SHA256 ef70e040a363a919b3f519d21a0e13d2473897027170961942e12bd4a1e1107e
MD5 cdcfb788baa7f0230fd96a556d455c71
SHA1 f651556668ab4e518ccd30c750321d9b93bed281
SHA512 c363614e7a16eab7d815a2749a8faa0e1437641d128e8567e27ae5e62971c3d83c89bd0b394ef6c31109bcb09fad921f2a767493217debb2f0add4f753778982
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlNIZbElhzBXeCnfJCwCc4MAKFpMloooIXrgq:Lz071uv4BPMkFfdgIZohteLMxRgb3D
MD5 SHA1 SHA512 SSDEEP

Submit Download

IYiifHs.exe

Path C:\Windows\System\IYiifHs.exe
Size 1.7MB
SHA256 5b3027e155a643e606171914b930011d7a3791c353b4ef3feb325e4a95e44fd7
MD5 a6a3718f8c054ddf268232e822018fcf
SHA1 f65539cfdec15b2b6d2af5a2f08f32487845c39c
SHA512 b43e74b7908dd0878c7e48b766f4b9a8403b2e39bedda42a59096bb86f2f66db881fd03f22cfbdff520c5065e11f58eaa4b53575989055d1cbcb8134c20c281b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlNIZbElhzBXeCnfJCwCc4MAKFpMloooIXrg1:Lz071uv4BPMkFfdgIZohteLMxRgb3g
MD5 SHA1 SHA512 SSDEEP

Submit Download

JkSPord.exe

Path C:\Windows\System\JkSPord.exe
Size 448KB
SHA256 aab1acd918f567ff34b418fd2971ffb7ad7f9284ea4d62c517c015f2e4f1d70f
MD5 2264ad6cf2c3feda241e32c18cc63613
SHA1 6cf1d5079287ae747430510102276a5d8553f195
SHA512 51d3f07b3e2d80ac627998a5fc071e41f8cd34e52e9d27ee547393019213fb2b53ce77d281d07d4df20e449416034194d3a784391c6fc788a552c1cba010098f
SSDEEP 12288:UuqZ0GO3/fTn5rPtFDO5BTVo2hZiavoQFNc6EH:zv3/fTLF671TilQFGH
MD5 SHA1 SHA512 SSDEEP

Submit Download

KDpwtfO.exe

Path C:\Windows\System\KDpwtfO.exe
Size 1.7MB
SHA256 6a6f37045a77da544c3ba64ec4beb2ec06bb5cde62a681edbd071e894cc0341e
MD5 34264e53afff905e25932577ba014154
SHA1 333855c5f9674705f150397ca1b52ccef07c0834
SHA512 ed3bcfecdddaaf5582406f5674576c49191fbb24209ddf5b9ddebf251ab296b5c3da4fb55e597d66296602174c5fa3224012885a15c68a73e3b2efa336334398
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlNIZbElhzBXeCnfJCwCc4MAKFpMloooIXrgb:Lz071uv4BPMkFfdgIZohteLMxRgb3o
MD5 SHA1 SHA512 SSDEEP

Submit Download

KaRvbjI.exe

Path C:\Windows\System\KaRvbjI.exe
Size 192KB
SHA256 60d46b68e2dec4dd54b3b98e2936c740b0a81687ef7e61fcba1931ad2151177b
MD5 3c72dbc23a6622fc0ba13a655fe73cb7
SHA1 6400c6610e252688e509f655c0c1742cd3e76fe5
SHA512 3a7f13d7a9e5345a11dd9caea7215ff9ce8b932aed2a7f40bd5687fae6e2d3d8e292fd0a0419fc98b97394994c5924266d8190f3af6015bdcdaf26d71a97a6cc
SSDEEP 3072:UTxVR3ACkCD1PStCsP2liIETW0GmUz1N1MM/yf6dquYHUYV2aJtW0V8cTKXO15HA:UTxVCvCx+PCqW0GJ3MM/yO5YVlw0BTHA
MD5 SHA1 SHA512 SSDEEP

Submit Download

NVJzrVq.exe

Path C:\Windows\System\NVJzrVq.exe
Size 1.7MB
SHA256 a995b5f52cf3562448593bb07b0eb2ae045ecf9ea5559d25d9a2b32ffd1e728c
MD5 33487591ebf26f36e427717f9600f35f
SHA1 f4003fda1342987849ba85fa85d70f53c378e052
SHA512 38ef17838ba57058b37e16448ebeabad4fb2941e624a204113b820902ff50e2e604aec2db21fa90f8dcf508c0eba01335416cc265b5865306b448c482f070813
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlNIZbElhzBXeCnfJCwCc4MAKFpMloooIXrg/:Lz071uv4BPMkFfdgIZohteLMxRgb32
MD5 SHA1 SHA512 SSDEEP

Submit Download

NarGGgj.exe

Path C:\Windows\System\NarGGgj.exe
Size 8B
SHA256 efa8a7a6952ccabd712273da0ab5538682fcdaff585ff7604e7a4346286e9320
MD5 b51f4f6ea566c7181d4d1f715615a414
SHA1 5f5d2057c3e793a449fbedd304d5084c92db621c
SHA512 cf70e5addae3f1995c350d8ead332088224d80c10cffe6e3f241ed79cc752dc79ee18c102b4cce11ffe47af43c22c4887cb7ff11f4d8c7bdc4456269c5638b1a
MD5 SHA1 SHA512

Submit Download

PvAlArb.exe

Path C:\Windows\System\PvAlArb.exe
Size 576KB
SHA256 87f048a961f73c31785d7e94921a9a359d719bf76105c9601eca055227d1c1db
MD5 c3d03a9d37f5edf2280ce6b2b3c5fbef
SHA1 f13d7156c1061252682d37ff0da0cac93c34953e
SHA512 07bab652c526204ee9528b6d8bd65b22dc499a44c1267b60f71a7439366582f72e58adec4d23b764a0ff0478fd6ffd60597a561b86fe20b6db5ee2bd531950b5
SSDEEP 12288:UuqZ0GO3/fTn5rPtFDO5BTVo2hZiavoQFNc6E4PUwgsF+F6:zv3/fTLF671TilQFG4P5PM6
MD5 SHA1 SHA512 SSDEEP

Submit Download

PvAlArb.exe

Path C:\Windows\System\PvAlArb.exe
Size 704KB
SHA256 e674e63bccf4364ed173be1d3c026a371b07ad40138569b115682078b8310b92
MD5 4f4e501e3cd5c43a20156b512619afe0
SHA1 7e652aa23c5570958e9034cd6c8abe7da4e15b09
SHA512 11e09b2c29e9982892dccca946e73e2407def16d665708eeeafdfe9d95605a82436a249bc9f3cf44b17e57b8aaa216e202ca24f6c7b3e5fdbb63e555c3705c43
SSDEEP 12288:UuqZ0GO3/fTn5rPtFDO5BTVo2hZiavoQFNc6E4PUwgsF+FkL3xv0Cw:zv3/fTLF671TilQFG4P5PMkE
MD5 SHA1 SHA512 SSDEEP

Submit Download

RUwspnO.exe

Path C:\Windows\System\RUwspnO.exe
Size 128KB
SHA256 023ac7fc351f6d2e4691b22c68fbc17c1895254a67982bf0958242ced6e67f29
MD5 4faadaeab68805f04a3264b24b4484e7
SHA1 1506c8fa28d842c0dbf87aa4fae07f0c1d21c224
SHA512 933034705851d18a168ec6a4a2f7a5330c92a605b28011dc44e331b0baa53be92639772e268a3dcd0b9551cd627b9185e234399894d0a898c1ae6ffdbb38edec
SSDEEP 3072:UTxVR3ACkCD1PStCsP2liIETW0GmUz1N1MM/yf6dquYHUm:UTxVCvCx+PCqW0GJ3MM/yO5m
MD5 SHA1 SHA512 SSDEEP

Submit Download

TyHkXZi.exe

Path C:\Windows\System\TyHkXZi.exe
Size 1.7MB
SHA256 8c1fd2c73fbbba7ebf9291374137983b66a91cfd7b6c74f98089ab68c7584b4e
MD5 970032a05a1a55f08ea33b53b492ea25
SHA1 6c94970c0af329654875bf2cbbdb6a4e874fb787
SHA512 0718645a30631ba62a873ffc24ad1403fe8d1864be7e51966ecc6e0a727f6ad081cfe552afcbf0249027a68221c58c39c4c2f14ce6ded4967fa614ee25849a1f
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlNIZbElhzBXeCnfJCwCc4MAKFpMloooIXrgo:Lz071uv4BPMkFfdgIZohteLMxRgb3z
MD5 SHA1 SHA512 SSDEEP

Submit Download

UWODncY.exe

Path C:\Windows\System\UWODncY.exe
Size 1.7MB
SHA256 ef2f31927191f0b50104411b09ec3b93def4168b5e7e39c3ff601c7bf5bb47ae
MD5 c1bd4a3266ac6dd981c81e06efb4ea8f
SHA1 ccd0c55353b0108fb8880330c248c96eb48b60d3
SHA512 5e34188619d27102e3b7539e0e56cab59e1cc55ae20c49cbcc3afcb30122534c0bfc272a46fa64d6ecb0f02281375641d8596d7ebed3b20c3367bea7b9cf5087
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlNIZbElhzBXeCnfJCwCc4MAKFpMloooIXrgI:Lz071uv4BPMkFfdgIZohteLMxRgb37
MD5 SHA1 SHA512 SSDEEP

Submit Download

XRsAVyD.exe

Path C:\Windows\System\XRsAVyD.exe
Size 1.7MB
SHA256 4107a53a7786fef6754d131e485ccd8439671145594d1afcea4ac951bc2035ae
MD5 ad20413cd4131e7ddfb7a1dbef2c1b4d
SHA1 051f51d9a59820277124a54f4ea0174e1fab78de
SHA512 faee3a724d8d09ca5525d5172b71e262903e67259ae397923162b66238bdab39b3339bb786a33f51915acf13321733d7e055a8075e1eff1bb9dbaf6b069ed5b3
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlNIZbElhzBXeCnfJCwCc4MAKFpMloooIXrgV:Lz071uv4BPMkFfdgIZohteLMxRgb3W
MD5 SHA1 SHA512 SSDEEP

Submit Download

YzKHtdu.exe

Path C:\Windows\System\YzKHtdu.exe
Size 1.7MB
SHA256 66166eee6c1540364cc937f03d5b4c4a70671bf0ad09ef541612bd7102c8f675
MD5 57febd70a6a08b389666994ceb8a5e00
SHA1 02039be34b1b80139b8bb6aff05257875305bf3d
SHA512 9d7d91bebee43530073e14aa01aafde2393815c61b26a78ac53b830d1f116302415ee6b1cd4316b70df895cdbe44aed8cd920fab32a131b2bd33749d7e00ef18
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlNIZbElhzBXeCnfJCwCc4MAKFpMloooIXrgM:Lz071uv4BPMkFfdgIZohteLMxRgb3x
MD5 SHA1 SHA512 SSDEEP

Submit Download

bKavqQM.exe

Path C:\Windows\System\bKavqQM.exe
Size 1.7MB
SHA256 dc35701ad8762550e5d34f4edf09c1071da9119058294c055fa7a279a9ce2cfa
MD5 d7053092ac85ae99ff263eb67099e65b
SHA1 129b8f606db669125d2494a5835ed0c175001794
SHA512 950fa4540d974fd99358c1bd7a0bc8c6ddb1b73ba1554a5373722e85a0e8af8a52270e0c5bbb9ecd8f0213b96e327ceb11235e79c74bdfe9dec2052bbf1e699e
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlNIZbElhzBXeCnfJCwCc4MAKFpMloooIXrgX:Lz071uv4BPMkFfdgIZohteLMxRgb3M
MD5 SHA1 SHA512 SSDEEP

Submit Download

jrQvDPe.exe

Path C:\Windows\System\jrQvDPe.exe
Size 1.2MB
SHA256 6bc480da51381bb270c1a137c2ff50392fce9090cb796f6961c5e25c3c5d39b8
MD5 5a3630f010b497245fe830a93e1d4b03
SHA1 bff45cd93738d07191ee7803253f69ac6160f5bb
SHA512 b7b28e9b7360013ccd4c32cc4a0341314ebad59d1dd8863d3d011b89d0853fc8b97f79961e08e4d4662033ade71e28edc4adffe0abd92831c0f358c98f69bd48
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlNIZbElhzBXB:Lz071uv4BPMkFfdgIZohtB
MD5 SHA1 SHA512 SSDEEP

Submit Download

jrQvDPe.exe

Path C:\Windows\System\jrQvDPe.exe
Size 1.7MB
SHA256 845f986622b4fb5a925a50e3b24433db477d2746cc6d8ce0c468a7dc73a7512b
MD5 2472e67320c309aca2ecc25837d4f9ae
SHA1 43726e9957ef3db0fa21ae000c37f5a71bcaf5d1
SHA512 c3760fed33e813835b048631a8583864667bf73634a3e6f28cb02fa1bde14115b273ab65d4ec3d9d7af227c2923aa9b2454c310da7699796f0707c4ddf5f9657
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlNIZbElhzBXeCnfJCwCc4MAKFpMloooIXrg4:Lz071uv4BPMkFfdgIZohteLMxRgb3x
MD5 SHA1 SHA512 SSDEEP

Submit Download

mAwsdQE.exe

Path C:\Windows\System\mAwsdQE.exe
Size 1.1MB
SHA256 325137560226aff303e315172256b89e592ed8ef4776f6f029acd828a3e7349c
MD5 1db6d50a1f2be393ac021e0a5310ce23
SHA1 63a024b47a2671906b71a4b6e445b3bfae250cd8
SHA512 80b3817497d7291b65ed309bd266d1762d189e7b6976010107bcd545439261c213673c8756696a822a307e904913e16c5c5ea7f235fad27dddebbc2a840b95b1
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlNIZbElB:Lz071uv4BPMkFfdgIZoB
MD5 SHA1 SHA512 SSDEEP

Submit Download

pHIFQbb.exe

Path C:\Windows\System\pHIFQbb.exe
Size 1.1MB
SHA256 a1d19378446df56a23d14a22cee4cc7cdd0e6ba68f7119868c9b4d6283a8a701
MD5 a51d273d0e294a4b67414aa5d7dcbe7d
SHA1 395968e87d1364c71d391aa82978bca2361863a3
SHA512 d2f9f159fa22129bd60e606f88537e33c1fa64ef6809b721d695747320ebebf84895dd76695490522a661cdec9212146e6835168615b75eb00c6793835bdda98
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlNIZbElhP:Lz071uv4BPMkFfdgIZohP
MD5 SHA1 SHA512 SSDEEP

Submit Download

qczvBcV.exe

Path C:\Windows\System\qczvBcV.exe
Size 1.7MB
SHA256 b4d8585c678381f54ce266f4ce2c11c3d48a1bce9382677ac539698113f4a8d8
MD5 d0a97421decdcc9b7078669917fa0d85
SHA1 e406a35ac7c99a0a63f8ee0a50eb5241fe53e61e
SHA512 91ed331a15c6d4e383d74e632bc06a10cc0a5421d6199c3357d3d2622418da9285de90b0a8d708e0b9c3652ffe243aea98477fb34c2bec0f759ccf74af862e88
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlNIZbElhzBXeCnfJCwCc4MAKFpMloooIXrgh:Lz071uv4BPMkFfdgIZohteLMxRgb3I
MD5 SHA1 SHA512 SSDEEP

Submit Download

rkqjLsG.exe

Path C:\Windows\System\rkqjLsG.exe
Size 384KB
SHA256 d62e1e277bdf6084324e05cb4c9746086a08cb3dbc51ceac0b8767e74090d4b4
MD5 e15f822347e059eba3a1f4755756c857
SHA1 39e4b640fb7e21c4dccd8fc344d3d068a98981d0
SHA512 4b82c41cbb869668f84b8505efe9f98e2782a5084ddcb8b35870676588da1cd73f7f219d598b21fed90a0389b60382bf0436e2e90ee0c9e5d156dc9790e3e0b3
SSDEEP 6144:UTxVCvCx+PCqW0GJ3MM/yO5YVlw0BTH155r72Mdc8uCNxDFDO579uvz2GUKFH6XD:UuqZ0GO3/fTn5rPtFDO5BTVo2hZiavou
MD5 SHA1 SHA512 SSDEEP

Submit Download

rmQlrFN.exe

Path C:\Windows\System\rmQlrFN.exe
Size 1.7MB
SHA256 52a2e60ddc033864ea888cbb3feaaab57f0d6466420a01157aed526c87a2efa2
MD5 caae26e9a47cbf83d6a3155573956a8f
SHA1 924658704b58986f28d9ca37f7c1f94edc6b0cf9
SHA512 cd92a8e5b6f19aaa3325d8ec5941d937adc7ec8153304e8a49c5eff1f04ec44643ab6a89b577e32d801b6f4668229b8015709fd578cecc75f5757ee6adf5ecb9
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlNIZbElhzBXeCnfJCwCc4MAKFpMloooIXrgn:Lz071uv4BPMkFfdgIZohteLMxRgb36
MD5 SHA1 SHA512 SSDEEP

Submit Download

uvQiDWF.exe

Path C:\Windows\System\uvQiDWF.exe
Size 1.7MB
SHA256 e37eabf497dd7d6618ba29db95d6b93ac350d3ef59267854035fdf62b3b5220d
MD5 227751a276cdc65d2f8a9651bdebfe14
SHA1 8c5010cf6935a766fef2ebe6e732f3d3afa4e550
SHA512 19ad8da289b1741e14a19a943f68417710f01f11909aaf0fbf45b286c7ecfa22782228a7a5f1dd4f0eec489baafc8dbd5e97070e22df3d284ab00f264df91a74
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlNIZbElhzBXeCnfJCwCc4MAKFpMloooIXrgf:Lz071uv4BPMkFfdgIZohteLMxRgb3+
MD5 SHA1 SHA512 SSDEEP

Submit Download

vAziLtg.exe

Path C:\Windows\System\vAziLtg.exe
Size 1.7MB
SHA256 0fe113589d10d23ddb16b8c9fe0633b394373cea0f58a30ca2d3b4ca64ac2145
MD5 74e46089beca4a0096278d1860934fc7
SHA1 8a9996a11c6998069a6ad987b65aab9b876d3aee
SHA512 a7be97dcd7aab2f018969700a8c0955d14569ebfa84e498d6007ddb7040052921e9bfd6d19d9c274b12018063160204123d67bee718178571c79d5827130891b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlNIZbElhzBXeCnfJCwCc4MAKFpMloooIXrgB:Lz071uv4BPMkFfdgIZohteLMxRgb3U
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/984-149-0x00007FF6E2DE0000-0x00007FF6E31D2000-memory.dmp

Download

memory/984-2350-0x00007FF6E2DE0000-0x00007FF6E31D2000-memory.dmp

Download

memory/1216-2341-0x00007FF784200000-0x00007FF7845F2000-memory.dmp

Download

memory/1216-56-0x00007FF784200000-0x00007FF7845F2000-memory.dmp

Download

memory/1216-2287-0x00007FF784200000-0x00007FF7845F2000-memory.dmp

Download

memory/1460-133-0x00007FF750BE0000-0x00007FF750FD2000-memory.dmp

Download

memory/1460-2293-0x00007FF750BE0000-0x00007FF750FD2000-memory.dmp

Download

memory/1460-2356-0x00007FF750BE0000-0x00007FF750FD2000-memory.dmp

Download

memory/1492-2368-0x00007FF661800000-0x00007FF661BF2000-memory.dmp

Download

memory/1492-154-0x00007FF661800000-0x00007FF661BF2000-memory.dmp

Download

memory/1568-1403-0x00007FF6A06B0000-0x00007FF6A0AA2000-memory.dmp

Download

memory/1568-2334-0x00007FF6A06B0000-0x00007FF6A0AA2000-memory.dmp

Download

memory/1568-21-0x00007FF6A06B0000-0x00007FF6A0AA2000-memory.dmp

Download

memory/1616-2358-0x00007FF66A120000-0x00007FF66A512000-memory.dmp

Download

memory/1616-125-0x00007FF66A120000-0x00007FF66A512000-memory.dmp

Download

memory/1864-77-0x00007FF6A8350000-0x00007FF6A8742000-memory.dmp

Download

memory/1864-2343-0x00007FF6A8350000-0x00007FF6A8742000-memory.dmp

Download

memory/1920-2331-0x00007FF63E250000-0x00007FF63E642000-memory.dmp

Download

memory/1920-29-0x00007FF63E250000-0x00007FF63E642000-memory.dmp

Download

memory/2228-174-0x00007FF694000000-0x00007FF6943F2000-memory.dmp

Download

memory/2228-2362-0x00007FF694000000-0x00007FF6943F2000-memory.dmp

Download

memory/2376-65-0x00007FF738260000-0x00007FF738652000-memory.dmp

Download

memory/2376-2345-0x00007FF738260000-0x00007FF738652000-memory.dmp

Download

memory/2376-2288-0x00007FF738260000-0x00007FF738652000-memory.dmp

Download

memory/2708-99-0x00007FF638CF0000-0x00007FF6390E2000-memory.dmp

Download

memory/2708-2378-0x00007FF638CF0000-0x00007FF6390E2000-memory.dmp

Download

memory/2708-2291-0x00007FF638CF0000-0x00007FF6390E2000-memory.dmp

Download

memory/2744-196-0x00007FF6ACD70000-0x00007FF6AD162000-memory.dmp

Download

memory/2744-2374-0x00007FF6ACD70000-0x00007FF6AD162000-memory.dmp

Download

memory/3148-2359-0x00007FF69DDD0000-0x00007FF69E1C2000-memory.dmp

Download

memory/3148-124-0x00007FF69DDD0000-0x00007FF69E1C2000-memory.dmp

Download

memory/3632-189-0x00007FF6373C0000-0x00007FF6377B2000-memory.dmp

Download

memory/3632-2351-0x00007FF6373C0000-0x00007FF6377B2000-memory.dmp

Download

memory/3732-2366-0x00007FF733650000-0x00007FF733A42000-memory.dmp

Download

memory/3732-2290-0x00007FF733650000-0x00007FF733A42000-memory.dmp

Download

memory/3732-91-0x00007FF733650000-0x00007FF733A42000-memory.dmp

Download

memory/3892-145-0x00007FF6B7700000-0x00007FF6B7AF2000-memory.dmp

Download

memory/3892-2376-0x00007FF6B7700000-0x00007FF6B7AF2000-memory.dmp

Download

memory/3896-2336-0x00007FF7E1580000-0x00007FF7E1972000-memory.dmp

Download

memory/3896-40-0x00007FF7E1580000-0x00007FF7E1972000-memory.dmp

Download

memory/3920-2354-0x00007FF62F920000-0x00007FF62FD12000-memory.dmp

Download

memory/3920-180-0x00007FF62F920000-0x00007FF62FD12000-memory.dmp

Download

memory/4056-2277-0x00007FF6E8CA0000-0x00007FF6E9092000-memory.dmp

Download

memory/4056-2337-0x00007FF6E8CA0000-0x00007FF6E9092000-memory.dmp

Download

memory/4056-47-0x00007FF6E8CA0000-0x00007FF6E9092000-memory.dmp

Download

memory/4072-2292-0x00007FF76CE10000-0x00007FF76D202000-memory.dmp

Download

memory/4072-116-0x00007FF76CE10000-0x00007FF76D202000-memory.dmp

Download

memory/4072-2363-0x00007FF76CE10000-0x00007FF76D202000-memory.dmp

Download

memory/4164-171-0x000001BE82A00000-0x000001BE82A22000-memory.dmp

Download

memory/4164-354-0x000001BE9DE10000-0x000001BE9E5B6000-memory.dmp

Download

memory/4276-1394-0x00007FF720C50000-0x00007FF721042000-memory.dmp

Download

memory/4276-0-0x00007FF720C50000-0x00007FF721042000-memory.dmp

Download

memory/4276-1-0x000001D10D100000-0x000001D10D110000-memory.dmp

Download

memory/4520-17-0x00007FF710D00000-0x00007FF7110F2000-memory.dmp

Download

memory/4520-2329-0x00007FF710D00000-0x00007FF7110F2000-memory.dmp

Download

memory/4520-1395-0x00007FF710D00000-0x00007FF7110F2000-memory.dmp

Download

memory/4636-2289-0x00007FF7763A0000-0x00007FF776792000-memory.dmp

Download

memory/4636-72-0x00007FF7763A0000-0x00007FF776792000-memory.dmp

Download

memory/4636-2347-0x00007FF7763A0000-0x00007FF776792000-memory.dmp

Download

memory/4656-2244-0x00007FF758940000-0x00007FF758D32000-memory.dmp

Download

memory/4656-2340-0x00007FF758940000-0x00007FF758D32000-memory.dmp

Download

memory/4656-35-0x00007FF758940000-0x00007FF758D32000-memory.dmp

Download

memory/4772-2327-0x00007FF7A0220000-0x00007FF7A0612000-memory.dmp

Download

memory/4772-27-0x00007FF7A0220000-0x00007FF7A0612000-memory.dmp

Download