xmrig | bfef9ff65f27369c411bf47e63593faea6805963a48144f7428883b3891a5c6d

Analysis

max time kernel
120s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 12:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
Size

1.9MB
MD5

debd14205773ef124d71a39cb18e9200
SHA1

14a18c6db235cfb509375e18fa29082194c9a113
SHA256

bfef9ff65f27369c411bf47e63593faea6805963a48144f7428883b3891a5c6d
SHA512

a2d42e2d76944957f1c49220f2edf014f7865448935ff4b198e7518b7a8f5c953fa944df429ea83113abfe1e7cc23ecbb1d6989cfd44df79bd8a76b00293aadd
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIQFBIHFxWZ9j:BemTLkNdfE0pZrQH

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1144-0-0x00007FF669530000-0x00007FF669884000-memory.dmp	xmrig
behavioral2/files/0x000700000002328e-4.dat	xmrig
behavioral2/files/0x000700000002341a-10.dat	xmrig
behavioral2/files/0x0008000000023419-9.dat	xmrig
behavioral2/memory/1492-6-0x00007FF616230000-0x00007FF616584000-memory.dmp	xmrig
behavioral2/files/0x000700000002341e-37.dat	xmrig
behavioral2/files/0x0007000000023420-49.dat	xmrig
behavioral2/memory/4460-52-0x00007FF61ADB0000-0x00007FF61B104000-memory.dmp	xmrig
behavioral2/files/0x0007000000023421-54.dat	xmrig
behavioral2/files/0x0007000000023422-58.dat	xmrig
behavioral2/memory/748-69-0x00007FF6C4D80000-0x00007FF6C50D4000-memory.dmp	xmrig
behavioral2/files/0x0008000000023417-76.dat	xmrig
behavioral2/memory/4448-85-0x00007FF6146D0000-0x00007FF614A24000-memory.dmp	xmrig
behavioral2/files/0x0007000000023426-97.dat	xmrig
behavioral2/files/0x000700000002342b-116.dat	xmrig
behavioral2/memory/1664-131-0x00007FF615960000-0x00007FF615CB4000-memory.dmp	xmrig
behavioral2/files/0x000700000002342e-143.dat	xmrig
behavioral2/files/0x0007000000023432-157.dat	xmrig
behavioral2/files/0x0007000000023435-175.dat	xmrig
behavioral2/files/0x0007000000023436-190.dat	xmrig
behavioral2/memory/2312-205-0x00007FF7DC230000-0x00007FF7DC584000-memory.dmp	xmrig
behavioral2/memory/1532-201-0x00007FF73CE40000-0x00007FF73D194000-memory.dmp	xmrig
behavioral2/memory/3868-197-0x00007FF77E7D0000-0x00007FF77EB24000-memory.dmp	xmrig
behavioral2/memory/3132-189-0x00007FF7F9770000-0x00007FF7F9AC4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023437-186.dat	xmrig
behavioral2/memory/1872-183-0x00007FF65D000000-0x00007FF65D354000-memory.dmp	xmrig
behavioral2/files/0x0007000000023434-178.dat	xmrig
behavioral2/files/0x0007000000023433-173.dat	xmrig
behavioral2/memory/1888-172-0x00007FF7D41A0000-0x00007FF7D44F4000-memory.dmp	xmrig
behavioral2/memory/1620-166-0x00007FF716B10000-0x00007FF716E64000-memory.dmp	xmrig
behavioral2/files/0x0007000000023431-161.dat	xmrig
behavioral2/memory/4972-160-0x00007FF6CDEF0000-0x00007FF6CE244000-memory.dmp	xmrig
behavioral2/files/0x0007000000023430-155.dat	xmrig
behavioral2/memory/4928-154-0x00007FF717F40000-0x00007FF718294000-memory.dmp	xmrig
behavioral2/files/0x000700000002342f-149.dat	xmrig
behavioral2/memory/1464-148-0x00007FF6079D0000-0x00007FF607D24000-memory.dmp	xmrig
behavioral2/memory/2396-142-0x00007FF6C5920000-0x00007FF6C5C74000-memory.dmp	xmrig
behavioral2/files/0x000700000002342d-137.dat	xmrig
behavioral2/files/0x000700000002342c-132.dat	xmrig
behavioral2/memory/3180-125-0x00007FF67ABD0000-0x00007FF67AF24000-memory.dmp	xmrig
behavioral2/files/0x000700000002342a-120.dat	xmrig
behavioral2/memory/3572-119-0x00007FF6AC9B0000-0x00007FF6ACD04000-memory.dmp	xmrig
behavioral2/files/0x0007000000023429-114.dat	xmrig
behavioral2/files/0x0007000000023428-109.dat	xmrig
behavioral2/memory/3968-108-0x00007FF7AB8F0000-0x00007FF7ABC44000-memory.dmp	xmrig
behavioral2/files/0x0007000000023427-103.dat	xmrig
behavioral2/memory/3144-102-0x00007FF755DC0000-0x00007FF756114000-memory.dmp	xmrig
behavioral2/memory/3972-96-0x00007FF7F9040000-0x00007FF7F9394000-memory.dmp	xmrig
behavioral2/files/0x0007000000023425-91.dat	xmrig
behavioral2/files/0x0007000000023424-80.dat	xmrig
behavioral2/memory/2980-79-0x00007FF6BCA60000-0x00007FF6BCDB4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023423-74.dat	xmrig
behavioral2/memory/2968-73-0x00007FF627620000-0x00007FF627974000-memory.dmp	xmrig
behavioral2/memory/2648-61-0x00007FF7B5740000-0x00007FF7B5A94000-memory.dmp	xmrig
behavioral2/memory/348-57-0x00007FF6261A0000-0x00007FF6264F4000-memory.dmp	xmrig
behavioral2/memory/4520-53-0x00007FF665FA0000-0x00007FF6662F4000-memory.dmp	xmrig
behavioral2/memory/3708-45-0x00007FF7FBF10000-0x00007FF7FC264000-memory.dmp	xmrig
behavioral2/files/0x000700000002341b-43.dat	xmrig
behavioral2/files/0x000700000002341f-42.dat	xmrig
behavioral2/files/0x000700000002341c-39.dat	xmrig
behavioral2/memory/4140-33-0x00007FF68CDB0000-0x00007FF68D104000-memory.dmp	xmrig
behavioral2/files/0x000700000002341d-31.dat	xmrig
behavioral2/memory/1128-19-0x00007FF7F2DB0000-0x00007FF7F3104000-memory.dmp	xmrig
behavioral2/memory/1144-1774-0x00007FF669530000-0x00007FF669884000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1492	IxxYDtZ.exe
1128	cumoQOw.exe
4140	spBHhtl.exe
348	kCuqUnH.exe
3708	ExQZPuQ.exe
4460	wQaUCfn.exe
4520	bSOiuqG.exe
2648	vWnflBI.exe
748	WasHeUU.exe
2968	CEoPWTT.exe
2980	llPaPRb.exe
4448	kAuLIMC.exe
3972	ajRxkPU.exe
3572	LeKqHdi.exe
3180	xuhZEzW.exe
3144	UvDxvme.exe
1664	aHitVZZ.exe
2396	tWpBbxt.exe
3968	wrvZkKk.exe
1464	nOCzSII.exe
4928	MklKKnY.exe
4972	bXBMPCh.exe
1620	aaSbpZW.exe
1888	WXHFXHa.exe
1872	gHFKtIh.exe
3132	RsLulwv.exe
3868	NSeuClE.exe
1532	UwuYPFT.exe
2312	BwTeozJ.exe
1700	VqgvIFC.exe
4044	AudPAbu.exe
3164	nukESeq.exe
1976	bCVaxeQ.exe
3756	UfejnzD.exe
1624	FlhXfEv.exe
2932	GPIUKGd.exe
3668	bQsRrPN.exe
2196	TjQbqdx.exe
628	VWXLObm.exe
3204	byYCNgO.exe
4964	JkNycMD.exe
4708	WrUrpGy.exe
2460	QVlaIQh.exe
5056	zPhidgI.exe
1272	IjspWJd.exe
1984	GOyendx.exe
4060	mKpdRGt.exe
3304	XvXcPKw.exe
532	cLTZGsE.exe
2940	RREfuKg.exe
4368	NvXhTol.exe
3380	BvjoRzV.exe
712	fULGpYF.exe
4120	KFMMfhG.exe
4516	aISyXIl.exe
2040	OsbEGfV.exe
1072	fuzGDMk.exe
3996	cTjHAiM.exe
2496	wObOYrb.exe
3912	mVJYpwx.exe
2400	eaZFCuw.exe
644	hBAVejO.exe
4924	ovmpNWP.exe
4628	MIUSnSq.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1144-0-0x00007FF669530000-0x00007FF669884000-memory.dmp	upx
behavioral2/files/0x000700000002328e-4.dat	upx
behavioral2/files/0x000700000002341a-10.dat	upx
behavioral2/files/0x0008000000023419-9.dat	upx
behavioral2/memory/1492-6-0x00007FF616230000-0x00007FF616584000-memory.dmp	upx
behavioral2/files/0x000700000002341e-37.dat	upx
behavioral2/files/0x0007000000023420-49.dat	upx
behavioral2/memory/4460-52-0x00007FF61ADB0000-0x00007FF61B104000-memory.dmp	upx
behavioral2/files/0x0007000000023421-54.dat	upx
behavioral2/files/0x0007000000023422-58.dat	upx
behavioral2/memory/748-69-0x00007FF6C4D80000-0x00007FF6C50D4000-memory.dmp	upx
behavioral2/files/0x0008000000023417-76.dat	upx
behavioral2/memory/4448-85-0x00007FF6146D0000-0x00007FF614A24000-memory.dmp	upx
behavioral2/files/0x0007000000023426-97.dat	upx
behavioral2/files/0x000700000002342b-116.dat	upx
behavioral2/memory/1664-131-0x00007FF615960000-0x00007FF615CB4000-memory.dmp	upx
behavioral2/files/0x000700000002342e-143.dat	upx
behavioral2/files/0x0007000000023432-157.dat	upx
behavioral2/files/0x0007000000023435-175.dat	upx
behavioral2/files/0x0007000000023436-190.dat	upx
behavioral2/memory/2312-205-0x00007FF7DC230000-0x00007FF7DC584000-memory.dmp	upx
behavioral2/memory/1532-201-0x00007FF73CE40000-0x00007FF73D194000-memory.dmp	upx
behavioral2/memory/3868-197-0x00007FF77E7D0000-0x00007FF77EB24000-memory.dmp	upx
behavioral2/memory/3132-189-0x00007FF7F9770000-0x00007FF7F9AC4000-memory.dmp	upx
behavioral2/files/0x0007000000023437-186.dat	upx
behavioral2/memory/1872-183-0x00007FF65D000000-0x00007FF65D354000-memory.dmp	upx
behavioral2/files/0x0007000000023434-178.dat	upx
behavioral2/files/0x0007000000023433-173.dat	upx
behavioral2/memory/1888-172-0x00007FF7D41A0000-0x00007FF7D44F4000-memory.dmp	upx
behavioral2/memory/1620-166-0x00007FF716B10000-0x00007FF716E64000-memory.dmp	upx
behavioral2/files/0x0007000000023431-161.dat	upx
behavioral2/memory/4972-160-0x00007FF6CDEF0000-0x00007FF6CE244000-memory.dmp	upx
behavioral2/files/0x0007000000023430-155.dat	upx
behavioral2/memory/4928-154-0x00007FF717F40000-0x00007FF718294000-memory.dmp	upx
behavioral2/files/0x000700000002342f-149.dat	upx
behavioral2/memory/1464-148-0x00007FF6079D0000-0x00007FF607D24000-memory.dmp	upx
behavioral2/memory/2396-142-0x00007FF6C5920000-0x00007FF6C5C74000-memory.dmp	upx
behavioral2/files/0x000700000002342d-137.dat	upx
behavioral2/files/0x000700000002342c-132.dat	upx
behavioral2/memory/3180-125-0x00007FF67ABD0000-0x00007FF67AF24000-memory.dmp	upx
behavioral2/files/0x000700000002342a-120.dat	upx
behavioral2/memory/3572-119-0x00007FF6AC9B0000-0x00007FF6ACD04000-memory.dmp	upx
behavioral2/files/0x0007000000023429-114.dat	upx
behavioral2/files/0x0007000000023428-109.dat	upx
behavioral2/memory/3968-108-0x00007FF7AB8F0000-0x00007FF7ABC44000-memory.dmp	upx
behavioral2/files/0x0007000000023427-103.dat	upx
behavioral2/memory/3144-102-0x00007FF755DC0000-0x00007FF756114000-memory.dmp	upx
behavioral2/memory/3972-96-0x00007FF7F9040000-0x00007FF7F9394000-memory.dmp	upx
behavioral2/files/0x0007000000023425-91.dat	upx
behavioral2/files/0x0007000000023424-80.dat	upx
behavioral2/memory/2980-79-0x00007FF6BCA60000-0x00007FF6BCDB4000-memory.dmp	upx
behavioral2/files/0x0007000000023423-74.dat	upx
behavioral2/memory/2968-73-0x00007FF627620000-0x00007FF627974000-memory.dmp	upx
behavioral2/memory/2648-61-0x00007FF7B5740000-0x00007FF7B5A94000-memory.dmp	upx
behavioral2/memory/348-57-0x00007FF6261A0000-0x00007FF6264F4000-memory.dmp	upx
behavioral2/memory/4520-53-0x00007FF665FA0000-0x00007FF6662F4000-memory.dmp	upx
behavioral2/memory/3708-45-0x00007FF7FBF10000-0x00007FF7FC264000-memory.dmp	upx
behavioral2/files/0x000700000002341b-43.dat	upx
behavioral2/files/0x000700000002341f-42.dat	upx
behavioral2/files/0x000700000002341c-39.dat	upx
behavioral2/memory/4140-33-0x00007FF68CDB0000-0x00007FF68D104000-memory.dmp	upx
behavioral2/files/0x000700000002341d-31.dat	upx
behavioral2/memory/1128-19-0x00007FF7F2DB0000-0x00007FF7F3104000-memory.dmp	upx
behavioral2/memory/1144-1774-0x00007FF669530000-0x00007FF669884000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\FMxAXin.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\dCSjIzk.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\bwQbRJP.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\WbuKIzI.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\ReRxjnQ.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\SNWNbLI.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\YmLuRlR.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\wcKYsUk.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\ZGxYGtg.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\uIwWleQ.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\wwYTCmE.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\WPVrqtA.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\tosonDN.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\CLzWvfF.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\MISXmsi.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\sysACcn.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\hVglqzV.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\MLzNath.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\nQCxzXF.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\noygiOa.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\sHIAsOw.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\kwhuIAN.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\RqWPnBG.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\egFAecb.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\tSSjqtO.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\RuSnGSG.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\VqgvIFC.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\SCUHtJF.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\PesqXVt.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\QNeaJdT.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\YVbrptP.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\ylDyvVt.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\DwjmVhL.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\haGvsnP.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\hfbzBiK.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\kKzZisH.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\tWpBbxt.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\UwuYPFT.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\IjspWJd.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\VEiPndl.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\YRjRhyZ.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\KyAFBWM.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\GRDPrBV.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\UzThUeI.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\FdpixhS.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\rxXrgdF.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\LCFdsiP.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\nyNAHLW.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\YbzNEXn.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\yNDYcIL.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\rjZBzsJ.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\TIFvYRQ.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\UFsEpJx.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\uVkLwwg.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\GNzOGhN.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\GeVutdO.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\WgSZbJP.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\ZHLbWAk.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\MVLhsrQ.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\MCRLyoe.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\NBOPqEY.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\VvYQcRf.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\JFjaZCa.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
File created	C:\Windows\System\YNcwrJq.exe	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 1492	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	83
PID 1144 wrote to memory of 1492	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	83
PID 1144 wrote to memory of 1128	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	84
PID 1144 wrote to memory of 1128	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	84
PID 1144 wrote to memory of 4140	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	85
PID 1144 wrote to memory of 4140	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	85
PID 1144 wrote to memory of 3708	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	86
PID 1144 wrote to memory of 3708	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	86
PID 1144 wrote to memory of 348	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	87
PID 1144 wrote to memory of 348	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	87
PID 1144 wrote to memory of 4460	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	88
PID 1144 wrote to memory of 4460	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	88
PID 1144 wrote to memory of 4520	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	89
PID 1144 wrote to memory of 4520	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	89
PID 1144 wrote to memory of 2648	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	90
PID 1144 wrote to memory of 2648	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	90
PID 1144 wrote to memory of 748	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	91
PID 1144 wrote to memory of 748	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	91
PID 1144 wrote to memory of 2968	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	92
PID 1144 wrote to memory of 2968	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	92
PID 1144 wrote to memory of 2980	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	93
PID 1144 wrote to memory of 2980	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	93
PID 1144 wrote to memory of 4448	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	94
PID 1144 wrote to memory of 4448	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	94
PID 1144 wrote to memory of 3972	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	95
PID 1144 wrote to memory of 3972	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	95
PID 1144 wrote to memory of 3572	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	96
PID 1144 wrote to memory of 3572	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	96
PID 1144 wrote to memory of 3180	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	97
PID 1144 wrote to memory of 3180	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	97
PID 1144 wrote to memory of 3144	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	98
PID 1144 wrote to memory of 3144	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	98
PID 1144 wrote to memory of 1664	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	99
PID 1144 wrote to memory of 1664	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	99
PID 1144 wrote to memory of 2396	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	100
PID 1144 wrote to memory of 2396	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	100
PID 1144 wrote to memory of 3968	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	101
PID 1144 wrote to memory of 3968	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	101
PID 1144 wrote to memory of 1464	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	102
PID 1144 wrote to memory of 1464	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	102
PID 1144 wrote to memory of 4928	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	103
PID 1144 wrote to memory of 4928	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	103
PID 1144 wrote to memory of 4972	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	104
PID 1144 wrote to memory of 4972	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	104
PID 1144 wrote to memory of 1620	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	105
PID 1144 wrote to memory of 1620	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	105
PID 1144 wrote to memory of 1888	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	106
PID 1144 wrote to memory of 1888	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	106
PID 1144 wrote to memory of 1872	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	107
PID 1144 wrote to memory of 1872	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	107
PID 1144 wrote to memory of 3132	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	108
PID 1144 wrote to memory of 3132	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	108
PID 1144 wrote to memory of 3868	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	109
PID 1144 wrote to memory of 3868	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	109
PID 1144 wrote to memory of 1532	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	110
PID 1144 wrote to memory of 1532	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	110
PID 1144 wrote to memory of 2312	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	111
PID 1144 wrote to memory of 2312	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	111
PID 1144 wrote to memory of 1700	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	112
PID 1144 wrote to memory of 1700	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	112
PID 1144 wrote to memory of 4044	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	113
PID 1144 wrote to memory of 4044	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	113
PID 1144 wrote to memory of 3164	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	114
PID 1144 wrote to memory of 3164	1144	debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\debd14205773ef124d71a39cb18e9200_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\System\IxxYDtZ.exe
  C:\Windows\System\IxxYDtZ.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\cumoQOw.exe
  C:\Windows\System\cumoQOw.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\spBHhtl.exe
  C:\Windows\System\spBHhtl.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\ExQZPuQ.exe
  C:\Windows\System\ExQZPuQ.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\kCuqUnH.exe
  C:\Windows\System\kCuqUnH.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\wQaUCfn.exe
  C:\Windows\System\wQaUCfn.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\bSOiuqG.exe
  C:\Windows\System\bSOiuqG.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\vWnflBI.exe
  C:\Windows\System\vWnflBI.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\WasHeUU.exe
  C:\Windows\System\WasHeUU.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\CEoPWTT.exe
  C:\Windows\System\CEoPWTT.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\llPaPRb.exe
  C:\Windows\System\llPaPRb.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\kAuLIMC.exe
  C:\Windows\System\kAuLIMC.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\ajRxkPU.exe
  C:\Windows\System\ajRxkPU.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\LeKqHdi.exe
  C:\Windows\System\LeKqHdi.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\xuhZEzW.exe
  C:\Windows\System\xuhZEzW.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\UvDxvme.exe
  C:\Windows\System\UvDxvme.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\aHitVZZ.exe
  C:\Windows\System\aHitVZZ.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\tWpBbxt.exe
  C:\Windows\System\tWpBbxt.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\wrvZkKk.exe
  C:\Windows\System\wrvZkKk.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\nOCzSII.exe
  C:\Windows\System\nOCzSII.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\MklKKnY.exe
  C:\Windows\System\MklKKnY.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\bXBMPCh.exe
  C:\Windows\System\bXBMPCh.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\aaSbpZW.exe
  C:\Windows\System\aaSbpZW.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\WXHFXHa.exe
  C:\Windows\System\WXHFXHa.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\gHFKtIh.exe
  C:\Windows\System\gHFKtIh.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\RsLulwv.exe
  C:\Windows\System\RsLulwv.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\NSeuClE.exe
  C:\Windows\System\NSeuClE.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\UwuYPFT.exe
  C:\Windows\System\UwuYPFT.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\BwTeozJ.exe
  C:\Windows\System\BwTeozJ.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\VqgvIFC.exe
  C:\Windows\System\VqgvIFC.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\AudPAbu.exe
  C:\Windows\System\AudPAbu.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\nukESeq.exe
  C:\Windows\System\nukESeq.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\bCVaxeQ.exe
  C:\Windows\System\bCVaxeQ.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\UfejnzD.exe
  C:\Windows\System\UfejnzD.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\FlhXfEv.exe
  C:\Windows\System\FlhXfEv.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\GPIUKGd.exe
  C:\Windows\System\GPIUKGd.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\bQsRrPN.exe
  C:\Windows\System\bQsRrPN.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\TjQbqdx.exe
  C:\Windows\System\TjQbqdx.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\VWXLObm.exe
  C:\Windows\System\VWXLObm.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\byYCNgO.exe
  C:\Windows\System\byYCNgO.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\JkNycMD.exe
  C:\Windows\System\JkNycMD.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\WrUrpGy.exe
  C:\Windows\System\WrUrpGy.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\QVlaIQh.exe
  C:\Windows\System\QVlaIQh.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\zPhidgI.exe
  C:\Windows\System\zPhidgI.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\IjspWJd.exe
  C:\Windows\System\IjspWJd.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\GOyendx.exe
  C:\Windows\System\GOyendx.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\mKpdRGt.exe
  C:\Windows\System\mKpdRGt.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\XvXcPKw.exe
  C:\Windows\System\XvXcPKw.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\cLTZGsE.exe
  C:\Windows\System\cLTZGsE.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\RREfuKg.exe
  C:\Windows\System\RREfuKg.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\NvXhTol.exe
  C:\Windows\System\NvXhTol.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\BvjoRzV.exe
  C:\Windows\System\BvjoRzV.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\fULGpYF.exe
  C:\Windows\System\fULGpYF.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System\KFMMfhG.exe
  C:\Windows\System\KFMMfhG.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\aISyXIl.exe
  C:\Windows\System\aISyXIl.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\OsbEGfV.exe
  C:\Windows\System\OsbEGfV.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\fuzGDMk.exe
  C:\Windows\System\fuzGDMk.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\cTjHAiM.exe
  C:\Windows\System\cTjHAiM.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\wObOYrb.exe
  C:\Windows\System\wObOYrb.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\mVJYpwx.exe
  C:\Windows\System\mVJYpwx.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\eaZFCuw.exe
  C:\Windows\System\eaZFCuw.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\hBAVejO.exe
  C:\Windows\System\hBAVejO.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\ovmpNWP.exe
  C:\Windows\System\ovmpNWP.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\MIUSnSq.exe
  C:\Windows\System\MIUSnSq.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\QhHBvnH.exe
  C:\Windows\System\QhHBvnH.exe
  2⤵
  PID:2624
- C:\Windows\System\JgOdXdk.exe
  C:\Windows\System\JgOdXdk.exe
  2⤵
  PID:4152
- C:\Windows\System\SuoeRDl.exe
  C:\Windows\System\SuoeRDl.exe
  2⤵
  PID:1696
- C:\Windows\System\kvWmMWd.exe
  C:\Windows\System\kvWmMWd.exe
  2⤵
  PID:4896
- C:\Windows\System\gNfERpu.exe
  C:\Windows\System\gNfERpu.exe
  2⤵
  PID:1920
- C:\Windows\System\WYUSuPN.exe
  C:\Windows\System\WYUSuPN.exe
  2⤵
  PID:2716
- C:\Windows\System\GnezpYZ.exe
  C:\Windows\System\GnezpYZ.exe
  2⤵
  PID:3768
- C:\Windows\System\VEiPndl.exe
  C:\Windows\System\VEiPndl.exe
  2⤵
  PID:516
- C:\Windows\System\NFNTqtz.exe
  C:\Windows\System\NFNTqtz.exe
  2⤵
  PID:4212
- C:\Windows\System\mAkCFYG.exe
  C:\Windows\System\mAkCFYG.exe
  2⤵
  PID:1928
- C:\Windows\System\TIFvYRQ.exe
  C:\Windows\System\TIFvYRQ.exe
  2⤵
  PID:4344
- C:\Windows\System\gIQMiiV.exe
  C:\Windows\System\gIQMiiV.exe
  2⤵
  PID:2864
- C:\Windows\System\xvfTBKO.exe
  C:\Windows\System\xvfTBKO.exe
  2⤵
  PID:4836
- C:\Windows\System\cQGbJuB.exe
  C:\Windows\System\cQGbJuB.exe
  2⤵
  PID:5048
- C:\Windows\System\pgVQEWl.exe
  C:\Windows\System\pgVQEWl.exe
  2⤵
  PID:1284
- C:\Windows\System\cNKXRRm.exe
  C:\Windows\System\cNKXRRm.exe
  2⤵
  PID:5152
- C:\Windows\System\POEqmZw.exe
  C:\Windows\System\POEqmZw.exe
  2⤵
  PID:5180
- C:\Windows\System\yZVWggJ.exe
  C:\Windows\System\yZVWggJ.exe
  2⤵
  PID:5208
- C:\Windows\System\cwoFUOb.exe
  C:\Windows\System\cwoFUOb.exe
  2⤵
  PID:5236
- C:\Windows\System\MISXmsi.exe
  C:\Windows\System\MISXmsi.exe
  2⤵
  PID:5264
- C:\Windows\System\bENqvJf.exe
  C:\Windows\System\bENqvJf.exe
  2⤵
  PID:5292
- C:\Windows\System\mKDnwjM.exe
  C:\Windows\System\mKDnwjM.exe
  2⤵
  PID:5320
- C:\Windows\System\Cqeiulv.exe
  C:\Windows\System\Cqeiulv.exe
  2⤵
  PID:5348
- C:\Windows\System\ReRxjnQ.exe
  C:\Windows\System\ReRxjnQ.exe
  2⤵
  PID:5376
- C:\Windows\System\pCzZHsq.exe
  C:\Windows\System\pCzZHsq.exe
  2⤵
  PID:5404
- C:\Windows\System\OWZRSBE.exe
  C:\Windows\System\OWZRSBE.exe
  2⤵
  PID:5432
- C:\Windows\System\NQAqrBv.exe
  C:\Windows\System\NQAqrBv.exe
  2⤵
  PID:5456
- C:\Windows\System\JUQsThT.exe
  C:\Windows\System\JUQsThT.exe
  2⤵
  PID:5484
- C:\Windows\System\ZGxYGtg.exe
  C:\Windows\System\ZGxYGtg.exe
  2⤵
  PID:5516
- C:\Windows\System\bwByktR.exe
  C:\Windows\System\bwByktR.exe
  2⤵
  PID:5540
- C:\Windows\System\YzFTyfE.exe
  C:\Windows\System\YzFTyfE.exe
  2⤵
  PID:5568
- C:\Windows\System\XQatYMh.exe
  C:\Windows\System\XQatYMh.exe
  2⤵
  PID:5600
- C:\Windows\System\SCUHtJF.exe
  C:\Windows\System\SCUHtJF.exe
  2⤵
  PID:5628
- C:\Windows\System\BVIxffO.exe
  C:\Windows\System\BVIxffO.exe
  2⤵
  PID:5656
- C:\Windows\System\KPLDoAv.exe
  C:\Windows\System\KPLDoAv.exe
  2⤵
  PID:5684
- C:\Windows\System\ZUvdTXj.exe
  C:\Windows\System\ZUvdTXj.exe
  2⤵
  PID:5712
- C:\Windows\System\nupazht.exe
  C:\Windows\System\nupazht.exe
  2⤵
  PID:5740
- C:\Windows\System\lGftyVp.exe
  C:\Windows\System\lGftyVp.exe
  2⤵
  PID:5768
- C:\Windows\System\lQquTMu.exe
  C:\Windows\System\lQquTMu.exe
  2⤵
  PID:5796
- C:\Windows\System\xxJDMqC.exe
  C:\Windows\System\xxJDMqC.exe
  2⤵
  PID:5820
- C:\Windows\System\tNiJpgj.exe
  C:\Windows\System\tNiJpgj.exe
  2⤵
  PID:5852
- C:\Windows\System\HSEAeyv.exe
  C:\Windows\System\HSEAeyv.exe
  2⤵
  PID:5876
- C:\Windows\System\YbzNEXn.exe
  C:\Windows\System\YbzNEXn.exe
  2⤵
  PID:5904
- C:\Windows\System\rdSVJAD.exe
  C:\Windows\System\rdSVJAD.exe
  2⤵
  PID:5932
- C:\Windows\System\aIpczqX.exe
  C:\Windows\System\aIpczqX.exe
  2⤵
  PID:5960
- C:\Windows\System\TVBhzho.exe
  C:\Windows\System\TVBhzho.exe
  2⤵
  PID:5992
- C:\Windows\System\RvettFZ.exe
  C:\Windows\System\RvettFZ.exe
  2⤵
  PID:6016
- C:\Windows\System\SMSiAEM.exe
  C:\Windows\System\SMSiAEM.exe
  2⤵
  PID:6044
- C:\Windows\System\HlWisgx.exe
  C:\Windows\System\HlWisgx.exe
  2⤵
  PID:6076
- C:\Windows\System\SNWNbLI.exe
  C:\Windows\System\SNWNbLI.exe
  2⤵
  PID:6104
- C:\Windows\System\FfevYpv.exe
  C:\Windows\System\FfevYpv.exe
  2⤵
  PID:6128
- C:\Windows\System\ppQENTV.exe
  C:\Windows\System\ppQENTV.exe
  2⤵
  PID:4684
- C:\Windows\System\YmLuRlR.exe
  C:\Windows\System\YmLuRlR.exe
  2⤵
  PID:2892
- C:\Windows\System\MXefXvj.exe
  C:\Windows\System\MXefXvj.exe
  2⤵
  PID:2084
- C:\Windows\System\qTaXuju.exe
  C:\Windows\System\qTaXuju.exe
  2⤵
  PID:5060
- C:\Windows\System\YNcwrJq.exe
  C:\Windows\System\YNcwrJq.exe
  2⤵
  PID:2700
- C:\Windows\System\hWwrCKh.exe
  C:\Windows\System\hWwrCKh.exe
  2⤵
  PID:4360
- C:\Windows\System\jVxZPrW.exe
  C:\Windows\System\jVxZPrW.exe
  2⤵
  PID:2948
- C:\Windows\System\WCCmbqD.exe
  C:\Windows\System\WCCmbqD.exe
  2⤵
  PID:832
- C:\Windows\System\MGDFOvR.exe
  C:\Windows\System\MGDFOvR.exe
  2⤵
  PID:5192
- C:\Windows\System\mEqbhqe.exe
  C:\Windows\System\mEqbhqe.exe
  2⤵
  PID:5248
- C:\Windows\System\oUryAtq.exe
  C:\Windows\System\oUryAtq.exe
  2⤵
  PID:5308
- C:\Windows\System\bYMWKvY.exe
  C:\Windows\System\bYMWKvY.exe
  2⤵
  PID:5368
- C:\Windows\System\KBOeAUj.exe
  C:\Windows\System\KBOeAUj.exe
  2⤵
  PID:5444
- C:\Windows\System\essZPXC.exe
  C:\Windows\System\essZPXC.exe
  2⤵
  PID:5500
- C:\Windows\System\VfOsnQX.exe
  C:\Windows\System\VfOsnQX.exe
  2⤵
  PID:5560
- C:\Windows\System\OkITsAF.exe
  C:\Windows\System\OkITsAF.exe
  2⤵
  PID:5616
- C:\Windows\System\FjrEVAp.exe
  C:\Windows\System\FjrEVAp.exe
  2⤵
  PID:5676
- C:\Windows\System\WCRwDzP.exe
  C:\Windows\System\WCRwDzP.exe
  2⤵
  PID:5752
- C:\Windows\System\rvNoWXt.exe
  C:\Windows\System\rvNoWXt.exe
  2⤵
  PID:5816
- C:\Windows\System\uzwAMcl.exe
  C:\Windows\System\uzwAMcl.exe
  2⤵
  PID:5892
- C:\Windows\System\KIpcjId.exe
  C:\Windows\System\KIpcjId.exe
  2⤵
  PID:5948
- C:\Windows\System\uPRcxfv.exe
  C:\Windows\System\uPRcxfv.exe
  2⤵
  PID:6008
- C:\Windows\System\BaluAko.exe
  C:\Windows\System\BaluAko.exe
  2⤵
  PID:6088
- C:\Windows\System\MVLhsrQ.exe
  C:\Windows\System\MVLhsrQ.exe
  2⤵
  PID:4980
- C:\Windows\System\FvhePWI.exe
  C:\Windows\System\FvhePWI.exe
  2⤵
  PID:2580
- C:\Windows\System\bVGDbkj.exe
  C:\Windows\System\bVGDbkj.exe
  2⤵
  PID:1648
- C:\Windows\System\SRUkHhU.exe
  C:\Windows\System\SRUkHhU.exe
  2⤵
  PID:2124
- C:\Windows\System\yysbYKQ.exe
  C:\Windows\System\yysbYKQ.exe
  2⤵
  PID:5228
- C:\Windows\System\wcKYsUk.exe
  C:\Windows\System\wcKYsUk.exe
  2⤵
  PID:6156
- C:\Windows\System\FMxAXin.exe
  C:\Windows\System\FMxAXin.exe
  2⤵
  PID:6180
- C:\Windows\System\PuRoxut.exe
  C:\Windows\System\PuRoxut.exe
  2⤵
  PID:6208
- C:\Windows\System\YBSAyZt.exe
  C:\Windows\System\YBSAyZt.exe
  2⤵
  PID:6240
- C:\Windows\System\UFsEpJx.exe
  C:\Windows\System\UFsEpJx.exe
  2⤵
  PID:6268
- C:\Windows\System\OZahNBI.exe
  C:\Windows\System\OZahNBI.exe
  2⤵
  PID:6296
- C:\Windows\System\DwjmVhL.exe
  C:\Windows\System\DwjmVhL.exe
  2⤵
  PID:6324
- C:\Windows\System\nytpnvk.exe
  C:\Windows\System\nytpnvk.exe
  2⤵
  PID:6348
- C:\Windows\System\rbNmMKs.exe
  C:\Windows\System\rbNmMKs.exe
  2⤵
  PID:6380
- C:\Windows\System\LAzQoMH.exe
  C:\Windows\System\LAzQoMH.exe
  2⤵
  PID:6408
- C:\Windows\System\AGfOEij.exe
  C:\Windows\System\AGfOEij.exe
  2⤵
  PID:6436
- C:\Windows\System\AmrBJgE.exe
  C:\Windows\System\AmrBJgE.exe
  2⤵
  PID:6464
- C:\Windows\System\sGmXSvD.exe
  C:\Windows\System\sGmXSvD.exe
  2⤵
  PID:6492
- C:\Windows\System\cMMveTy.exe
  C:\Windows\System\cMMveTy.exe
  2⤵
  PID:6520
- C:\Windows\System\HVHVDxd.exe
  C:\Windows\System\HVHVDxd.exe
  2⤵
  PID:6544
- C:\Windows\System\xKYMLIn.exe
  C:\Windows\System\xKYMLIn.exe
  2⤵
  PID:6576
- C:\Windows\System\zYQxnpf.exe
  C:\Windows\System\zYQxnpf.exe
  2⤵
  PID:6604
- C:\Windows\System\uhLIlBO.exe
  C:\Windows\System\uhLIlBO.exe
  2⤵
  PID:6628
- C:\Windows\System\hhDdMno.exe
  C:\Windows\System\hhDdMno.exe
  2⤵
  PID:6660
- C:\Windows\System\PudCgDa.exe
  C:\Windows\System\PudCgDa.exe
  2⤵
  PID:6688
- C:\Windows\System\MAlXjZj.exe
  C:\Windows\System\MAlXjZj.exe
  2⤵
  PID:6716
- C:\Windows\System\MRzJMXQ.exe
  C:\Windows\System\MRzJMXQ.exe
  2⤵
  PID:6744
- C:\Windows\System\cpJPBGX.exe
  C:\Windows\System\cpJPBGX.exe
  2⤵
  PID:6772
- C:\Windows\System\qykpIeu.exe
  C:\Windows\System\qykpIeu.exe
  2⤵
  PID:6800
- C:\Windows\System\yZmKlXJ.exe
  C:\Windows\System\yZmKlXJ.exe
  2⤵
  PID:6824
- C:\Windows\System\XMdRqgT.exe
  C:\Windows\System\XMdRqgT.exe
  2⤵
  PID:6852
- C:\Windows\System\syKwIyi.exe
  C:\Windows\System\syKwIyi.exe
  2⤵
  PID:6884
- C:\Windows\System\LelrnZg.exe
  C:\Windows\System\LelrnZg.exe
  2⤵
  PID:6908
- C:\Windows\System\GdyNgiT.exe
  C:\Windows\System\GdyNgiT.exe
  2⤵
  PID:6936
- C:\Windows\System\IyqFSJX.exe
  C:\Windows\System\IyqFSJX.exe
  2⤵
  PID:6964
- C:\Windows\System\aoeYXyj.exe
  C:\Windows\System\aoeYXyj.exe
  2⤵
  PID:6996
- C:\Windows\System\BIDEFdL.exe
  C:\Windows\System\BIDEFdL.exe
  2⤵
  PID:7024
- C:\Windows\System\LqyqhCk.exe
  C:\Windows\System\LqyqhCk.exe
  2⤵
  PID:7052
- C:\Windows\System\QrNcxSa.exe
  C:\Windows\System\QrNcxSa.exe
  2⤵
  PID:7080
- C:\Windows\System\XBtYOjD.exe
  C:\Windows\System\XBtYOjD.exe
  2⤵
  PID:7108
- C:\Windows\System\kKWrzlI.exe
  C:\Windows\System\kKWrzlI.exe
  2⤵
  PID:7136
- C:\Windows\System\siglwNX.exe
  C:\Windows\System\siglwNX.exe
  2⤵
  PID:7164
- C:\Windows\System\hFAvndz.exe
  C:\Windows\System\hFAvndz.exe
  2⤵
  PID:5472
- C:\Windows\System\fQAyYKE.exe
  C:\Windows\System\fQAyYKE.exe
  2⤵
  PID:2228
- C:\Windows\System\tIgpZof.exe
  C:\Windows\System\tIgpZof.exe
  2⤵
  PID:5672
- C:\Windows\System\GeVutdO.exe
  C:\Windows\System\GeVutdO.exe
  2⤵
  PID:5844
- C:\Windows\System\QicUOhS.exe
  C:\Windows\System\QicUOhS.exe
  2⤵
  PID:5984
- C:\Windows\System\GLnJEbP.exe
  C:\Windows\System\GLnJEbP.exe
  2⤵
  PID:6124
- C:\Windows\System\jnhEwJq.exe
  C:\Windows\System\jnhEwJq.exe
  2⤵
  PID:1896
- C:\Windows\System\gSwaHEx.exe
  C:\Windows\System\gSwaHEx.exe
  2⤵
  PID:5336
- C:\Windows\System\JrbARFP.exe
  C:\Windows\System\JrbARFP.exe
  2⤵
  PID:6204
- C:\Windows\System\MCRLyoe.exe
  C:\Windows\System\MCRLyoe.exe
  2⤵
  PID:4432
- C:\Windows\System\brTWrZq.exe
  C:\Windows\System\brTWrZq.exe
  2⤵
  PID:6336
- C:\Windows\System\QXJFqla.exe
  C:\Windows\System\QXJFqla.exe
  2⤵
  PID:6396
- C:\Windows\System\GzMCXYK.exe
  C:\Windows\System\GzMCXYK.exe
  2⤵
  PID:6456
- C:\Windows\System\UDLdVRE.exe
  C:\Windows\System\UDLdVRE.exe
  2⤵
  PID:6504
- C:\Windows\System\zQcvwQf.exe
  C:\Windows\System\zQcvwQf.exe
  2⤵
  PID:6540
- C:\Windows\System\PuWyxnH.exe
  C:\Windows\System\PuWyxnH.exe
  2⤵
  PID:6616
- C:\Windows\System\FfvLLYv.exe
  C:\Windows\System\FfvLLYv.exe
  2⤵
  PID:6676
- C:\Windows\System\kJgCRhk.exe
  C:\Windows\System\kJgCRhk.exe
  2⤵
  PID:6756
- C:\Windows\System\Iqtproi.exe
  C:\Windows\System\Iqtproi.exe
  2⤵
  PID:1852
- C:\Windows\System\HcNwJnD.exe
  C:\Windows\System\HcNwJnD.exe
  2⤵
  PID:6848
- C:\Windows\System\EssGUjX.exe
  C:\Windows\System\EssGUjX.exe
  2⤵
  PID:2556
- C:\Windows\System\EUrZyjM.exe
  C:\Windows\System\EUrZyjM.exe
  2⤵
  PID:6960
- C:\Windows\System\JeNeZcf.exe
  C:\Windows\System\JeNeZcf.exe
  2⤵
  PID:7016
- C:\Windows\System\wdsnkuA.exe
  C:\Windows\System\wdsnkuA.exe
  2⤵
  PID:7072
- C:\Windows\System\VzZSPBH.exe
  C:\Windows\System\VzZSPBH.exe
  2⤵
  PID:7148
- C:\Windows\System\GSAdIAH.exe
  C:\Windows\System\GSAdIAH.exe
  2⤵
  PID:5588
- C:\Windows\System\haGvsnP.exe
  C:\Windows\System\haGvsnP.exe
  2⤵
  PID:5788
- C:\Windows\System\oxmzMJp.exe
  C:\Windows\System\oxmzMJp.exe
  2⤵
  PID:3992
- C:\Windows\System\lJZiMkX.exe
  C:\Windows\System\lJZiMkX.exe
  2⤵
  PID:6176
- C:\Windows\System\AvyJFMX.exe
  C:\Windows\System\AvyJFMX.exe
  2⤵
  PID:6312
- C:\Windows\System\DMYpKzK.exe
  C:\Windows\System\DMYpKzK.exe
  2⤵
  PID:6448
- C:\Windows\System\dWpZprp.exe
  C:\Windows\System\dWpZprp.exe
  2⤵
  PID:6588
- C:\Windows\System\kyDtWdz.exe
  C:\Windows\System\kyDtWdz.exe
  2⤵
  PID:6708
- C:\Windows\System\FRGRhAj.exe
  C:\Windows\System\FRGRhAj.exe
  2⤵
  PID:2316
- C:\Windows\System\XZvlkaa.exe
  C:\Windows\System\XZvlkaa.exe
  2⤵
  PID:6932
- C:\Windows\System\ZVFpLAn.exe
  C:\Windows\System\ZVFpLAn.exe
  2⤵
  PID:7064
- C:\Windows\System\LpSrVeU.exe
  C:\Windows\System\LpSrVeU.exe
  2⤵
  PID:5416
- C:\Windows\System\YHWBkCR.exe
  C:\Windows\System\YHWBkCR.exe
  2⤵
  PID:7176
- C:\Windows\System\jSricOM.exe
  C:\Windows\System\jSricOM.exe
  2⤵
  PID:7204
- C:\Windows\System\sUuXdOA.exe
  C:\Windows\System\sUuXdOA.exe
  2⤵
  PID:7232
- C:\Windows\System\LUIBnYu.exe
  C:\Windows\System\LUIBnYu.exe
  2⤵
  PID:7260
- C:\Windows\System\IBhsHfi.exe
  C:\Windows\System\IBhsHfi.exe
  2⤵
  PID:7288
- C:\Windows\System\YStEgSn.exe
  C:\Windows\System\YStEgSn.exe
  2⤵
  PID:7316
- C:\Windows\System\ntUGsOA.exe
  C:\Windows\System\ntUGsOA.exe
  2⤵
  PID:7344
- C:\Windows\System\BqoRpTY.exe
  C:\Windows\System\BqoRpTY.exe
  2⤵
  PID:7372
- C:\Windows\System\IeGMTqE.exe
  C:\Windows\System\IeGMTqE.exe
  2⤵
  PID:7396
- C:\Windows\System\PKvaNMb.exe
  C:\Windows\System\PKvaNMb.exe
  2⤵
  PID:7424
- C:\Windows\System\GDuFTUD.exe
  C:\Windows\System\GDuFTUD.exe
  2⤵
  PID:7452
- C:\Windows\System\ohBCSLF.exe
  C:\Windows\System\ohBCSLF.exe
  2⤵
  PID:7480
- C:\Windows\System\UWlFsxV.exe
  C:\Windows\System\UWlFsxV.exe
  2⤵
  PID:7512
- C:\Windows\System\sHIAsOw.exe
  C:\Windows\System\sHIAsOw.exe
  2⤵
  PID:7540
- C:\Windows\System\XKhvffT.exe
  C:\Windows\System\XKhvffT.exe
  2⤵
  PID:7568
- C:\Windows\System\OzmorOs.exe
  C:\Windows\System\OzmorOs.exe
  2⤵
  PID:7592
- C:\Windows\System\pcYOpQY.exe
  C:\Windows\System\pcYOpQY.exe
  2⤵
  PID:7624
- C:\Windows\System\OlgOCdI.exe
  C:\Windows\System\OlgOCdI.exe
  2⤵
  PID:7648
- C:\Windows\System\mxpcjuH.exe
  C:\Windows\System\mxpcjuH.exe
  2⤵
  PID:7676
- C:\Windows\System\GJMVXsC.exe
  C:\Windows\System\GJMVXsC.exe
  2⤵
  PID:7708
- C:\Windows\System\yaSrKIj.exe
  C:\Windows\System\yaSrKIj.exe
  2⤵
  PID:7732
- C:\Windows\System\WEagRHJ.exe
  C:\Windows\System\WEagRHJ.exe
  2⤵
  PID:7760
- C:\Windows\System\tVmAhUq.exe
  C:\Windows\System\tVmAhUq.exe
  2⤵
  PID:7792
- C:\Windows\System\DvFadtU.exe
  C:\Windows\System\DvFadtU.exe
  2⤵
  PID:7820
- C:\Windows\System\DYwKuNE.exe
  C:\Windows\System\DYwKuNE.exe
  2⤵
  PID:7844
- C:\Windows\System\nRjlvpA.exe
  C:\Windows\System\nRjlvpA.exe
  2⤵
  PID:7876
- C:\Windows\System\UluOLPV.exe
  C:\Windows\System\UluOLPV.exe
  2⤵
  PID:7904
- C:\Windows\System\NBOPqEY.exe
  C:\Windows\System\NBOPqEY.exe
  2⤵
  PID:7928
- C:\Windows\System\sZIFkNP.exe
  C:\Windows\System\sZIFkNP.exe
  2⤵
  PID:7960
- C:\Windows\System\NFFWfFt.exe
  C:\Windows\System\NFFWfFt.exe
  2⤵
  PID:7988
- C:\Windows\System\YkEjpNQ.exe
  C:\Windows\System\YkEjpNQ.exe
  2⤵
  PID:8012
- C:\Windows\System\sQKhQdc.exe
  C:\Windows\System\sQKhQdc.exe
  2⤵
  PID:8040
- C:\Windows\System\tCuDrfW.exe
  C:\Windows\System\tCuDrfW.exe
  2⤵
  PID:8072
- C:\Windows\System\cptoWPD.exe
  C:\Windows\System\cptoWPD.exe
  2⤵
  PID:8100
- C:\Windows\System\xBTUwln.exe
  C:\Windows\System\xBTUwln.exe
  2⤵
  PID:8128
- C:\Windows\System\XDxLHbT.exe
  C:\Windows\System\XDxLHbT.exe
  2⤵
  PID:8152
- C:\Windows\System\WgSZbJP.exe
  C:\Windows\System\WgSZbJP.exe
  2⤵
  PID:8184
- C:\Windows\System\dCSjIzk.exe
  C:\Windows\System\dCSjIzk.exe
  2⤵
  PID:6172
- C:\Windows\System\ZWZlqMI.exe
  C:\Windows\System\ZWZlqMI.exe
  2⤵
  PID:6428
- C:\Windows\System\XMHvXum.exe
  C:\Windows\System\XMHvXum.exe
  2⤵
  PID:1472
- C:\Windows\System\cZokRuU.exe
  C:\Windows\System\cZokRuU.exe
  2⤵
  PID:6876
- C:\Windows\System\rkJgibH.exe
  C:\Windows\System\rkJgibH.exe
  2⤵
  PID:7196
- C:\Windows\System\kdwwJGN.exe
  C:\Windows\System\kdwwJGN.exe
  2⤵
  PID:7224
- C:\Windows\System\rGtPtQp.exe
  C:\Windows\System\rGtPtQp.exe
  2⤵
  PID:7272
- C:\Windows\System\sOyMAUd.exe
  C:\Windows\System\sOyMAUd.exe
  2⤵
  PID:7308
- C:\Windows\System\vYBHlOT.exe
  C:\Windows\System\vYBHlOT.exe
  2⤵
  PID:2448
- C:\Windows\System\EWtiUAk.exe
  C:\Windows\System\EWtiUAk.exe
  2⤵
  PID:7416
- C:\Windows\System\UplrbHc.exe
  C:\Windows\System\UplrbHc.exe
  2⤵
  PID:7472
- C:\Windows\System\rcdmBhv.exe
  C:\Windows\System\rcdmBhv.exe
  2⤵
  PID:1244
- C:\Windows\System\ykBkwlw.exe
  C:\Windows\System\ykBkwlw.exe
  2⤵
  PID:7580
- C:\Windows\System\xCeVJQE.exe
  C:\Windows\System\xCeVJQE.exe
  2⤵
  PID:7616
- C:\Windows\System\DOdKgZJ.exe
  C:\Windows\System\DOdKgZJ.exe
  2⤵
  PID:3212
- C:\Windows\System\fpUvFAf.exe
  C:\Windows\System\fpUvFAf.exe
  2⤵
  PID:7696
- C:\Windows\System\BZqzclL.exe
  C:\Windows\System\BZqzclL.exe
  2⤵
  PID:5016
- C:\Windows\System\DKTQTew.exe
  C:\Windows\System\DKTQTew.exe
  2⤵
  PID:7808
- C:\Windows\System\yNDYcIL.exe
  C:\Windows\System\yNDYcIL.exe
  2⤵
  PID:3088
- C:\Windows\System\sysACcn.exe
  C:\Windows\System\sysACcn.exe
  2⤵
  PID:1396
- C:\Windows\System\CczwfcN.exe
  C:\Windows\System\CczwfcN.exe
  2⤵
  PID:7944
- C:\Windows\System\MNsdnaF.exe
  C:\Windows\System\MNsdnaF.exe
  2⤵
  PID:7972
- C:\Windows\System\udNgsMS.exe
  C:\Windows\System\udNgsMS.exe
  2⤵
  PID:2328
- C:\Windows\System\hVTUUBf.exe
  C:\Windows\System\hVTUUBf.exe
  2⤵
  PID:740
- C:\Windows\System\rDnMAux.exe
  C:\Windows\System\rDnMAux.exe
  2⤵
  PID:8092
- C:\Windows\System\igSPkpp.exe
  C:\Windows\System\igSPkpp.exe
  2⤵
  PID:8148
- C:\Windows\System\ghgeigK.exe
  C:\Windows\System\ghgeigK.exe
  2⤵
  PID:6308
- C:\Windows\System\FdpixhS.exe
  C:\Windows\System\FdpixhS.exe
  2⤵
  PID:6792
- C:\Windows\System\CKgmRrT.exe
  C:\Windows\System\CKgmRrT.exe
  2⤵
  PID:1452
- C:\Windows\System\DxkWbyq.exe
  C:\Windows\System\DxkWbyq.exe
  2⤵
  PID:7304
- C:\Windows\System\aVslmMZ.exe
  C:\Windows\System\aVslmMZ.exe
  2⤵
  PID:7412
- C:\Windows\System\zklIKOn.exe
  C:\Windows\System\zklIKOn.exe
  2⤵
  PID:7552
- C:\Windows\System\VoxlARP.exe
  C:\Windows\System\VoxlARP.exe
  2⤵
  PID:1304
- C:\Windows\System\mXUOzVT.exe
  C:\Windows\System\mXUOzVT.exe
  2⤵
  PID:7952
- C:\Windows\System\EDgCgGz.exe
  C:\Windows\System\EDgCgGz.exe
  2⤵
  PID:8032
- C:\Windows\System\HQhgXkM.exe
  C:\Windows\System\HQhgXkM.exe
  2⤵
  PID:8088
- C:\Windows\System\fzrxXFb.exe
  C:\Windows\System\fzrxXFb.exe
  2⤵
  PID:2404
- C:\Windows\System\lpBDDRT.exe
  C:\Windows\System\lpBDDRT.exe
  2⤵
  PID:7188
- C:\Windows\System\sWUhfPl.exe
  C:\Windows\System\sWUhfPl.exe
  2⤵
  PID:7252
- C:\Windows\System\PPIjbAs.exe
  C:\Windows\System\PPIjbAs.exe
  2⤵
  PID:5044
- C:\Windows\System\RKvckeR.exe
  C:\Windows\System\RKvckeR.exe
  2⤵
  PID:804
- C:\Windows\System\jIjKIuH.exe
  C:\Windows\System\jIjKIuH.exe
  2⤵
  PID:2412
- C:\Windows\System\rxXrgdF.exe
  C:\Windows\System\rxXrgdF.exe
  2⤵
  PID:4968
- C:\Windows\System\OGSuPKU.exe
  C:\Windows\System\OGSuPKU.exe
  2⤵
  PID:4848
- C:\Windows\System\ZSEsQeG.exe
  C:\Windows\System\ZSEsQeG.exe
  2⤵
  PID:5728
- C:\Windows\System\XQWQJGY.exe
  C:\Windows\System\XQWQJGY.exe
  2⤵
  PID:1408
- C:\Windows\System\QNeaJdT.exe
  C:\Windows\System\QNeaJdT.exe
  2⤵
  PID:7356
- C:\Windows\System\NnFLJXU.exe
  C:\Windows\System\NnFLJXU.exe
  2⤵
  PID:4040
- C:\Windows\System\ZrzoIef.exe
  C:\Windows\System\ZrzoIef.exe
  2⤵
  PID:7916
- C:\Windows\System\uFbkaIb.exe
  C:\Windows\System\uFbkaIb.exe
  2⤵
  PID:8140
- C:\Windows\System\LvZsNdH.exe
  C:\Windows\System\LvZsNdH.exe
  2⤵
  PID:7836
- C:\Windows\System\njAyEDk.exe
  C:\Windows\System\njAyEDk.exe
  2⤵
  PID:8208
- C:\Windows\System\mZJhhoP.exe
  C:\Windows\System\mZJhhoP.exe
  2⤵
  PID:8236
- C:\Windows\System\VEDXyLb.exe
  C:\Windows\System\VEDXyLb.exe
  2⤵
  PID:8252
- C:\Windows\System\wjoVPzA.exe
  C:\Windows\System\wjoVPzA.exe
  2⤵
  PID:8276
- C:\Windows\System\jIbZvqh.exe
  C:\Windows\System\jIbZvqh.exe
  2⤵
  PID:8300
- C:\Windows\System\mIFnRIw.exe
  C:\Windows\System\mIFnRIw.exe
  2⤵
  PID:8332
- C:\Windows\System\REjaTst.exe
  C:\Windows\System\REjaTst.exe
  2⤵
  PID:8412
- C:\Windows\System\eCnCLPL.exe
  C:\Windows\System\eCnCLPL.exe
  2⤵
  PID:8440
- C:\Windows\System\DTyHTxQ.exe
  C:\Windows\System\DTyHTxQ.exe
  2⤵
  PID:8468
- C:\Windows\System\QwWiunr.exe
  C:\Windows\System\QwWiunr.exe
  2⤵
  PID:8496
- C:\Windows\System\kwhuIAN.exe
  C:\Windows\System\kwhuIAN.exe
  2⤵
  PID:8524
- C:\Windows\System\uRMYvJh.exe
  C:\Windows\System\uRMYvJh.exe
  2⤵
  PID:8540
- C:\Windows\System\OJpWfON.exe
  C:\Windows\System\OJpWfON.exe
  2⤵
  PID:8564
- C:\Windows\System\FMDTsTe.exe
  C:\Windows\System\FMDTsTe.exe
  2⤵
  PID:8608
- C:\Windows\System\SKFAjfA.exe
  C:\Windows\System\SKFAjfA.exe
  2⤵
  PID:8624
- C:\Windows\System\Zcooexn.exe
  C:\Windows\System\Zcooexn.exe
  2⤵
  PID:8652
- C:\Windows\System\bzWOaVz.exe
  C:\Windows\System\bzWOaVz.exe
  2⤵
  PID:8680
- C:\Windows\System\imHIRuC.exe
  C:\Windows\System\imHIRuC.exe
  2⤵
  PID:8708
- C:\Windows\System\mbIyJzc.exe
  C:\Windows\System\mbIyJzc.exe
  2⤵
  PID:8732
- C:\Windows\System\QhBBMTz.exe
  C:\Windows\System\QhBBMTz.exe
  2⤵
  PID:8764
- C:\Windows\System\tSSjqtO.exe
  C:\Windows\System\tSSjqtO.exe
  2⤵
  PID:8796
- C:\Windows\System\oSfkDVF.exe
  C:\Windows\System\oSfkDVF.exe
  2⤵
  PID:8820
- C:\Windows\System\YVbrptP.exe
  C:\Windows\System\YVbrptP.exe
  2⤵
  PID:8848
- C:\Windows\System\ScQcJxW.exe
  C:\Windows\System\ScQcJxW.exe
  2⤵
  PID:8876
- C:\Windows\System\hVglqzV.exe
  C:\Windows\System\hVglqzV.exe
  2⤵
  PID:8904
- C:\Windows\System\GsxZYow.exe
  C:\Windows\System\GsxZYow.exe
  2⤵
  PID:8920
- C:\Windows\System\EafDNDC.exe
  C:\Windows\System\EafDNDC.exe
  2⤵
  PID:8948
- C:\Windows\System\MzugbIO.exe
  C:\Windows\System\MzugbIO.exe
  2⤵
  PID:9000
- C:\Windows\System\GYSUGGI.exe
  C:\Windows\System\GYSUGGI.exe
  2⤵
  PID:9016
- C:\Windows\System\rYZGrYs.exe
  C:\Windows\System\rYZGrYs.exe
  2⤵
  PID:9056
- C:\Windows\System\aRcXnuC.exe
  C:\Windows\System\aRcXnuC.exe
  2⤵
  PID:9084
- C:\Windows\System\GgUmkkQ.exe
  C:\Windows\System\GgUmkkQ.exe
  2⤵
  PID:9108
- C:\Windows\System\cyihtDK.exe
  C:\Windows\System\cyihtDK.exe
  2⤵
  PID:9140
- C:\Windows\System\QZXihwi.exe
  C:\Windows\System\QZXihwi.exe
  2⤵
  PID:9168
- C:\Windows\System\UfDKemO.exe
  C:\Windows\System\UfDKemO.exe
  2⤵
  PID:9184
- C:\Windows\System\stDxfGq.exe
  C:\Windows\System\stDxfGq.exe
  2⤵
  PID:9212
- C:\Windows\System\OQbrYSN.exe
  C:\Windows\System\OQbrYSN.exe
  2⤵
  PID:6116
- C:\Windows\System\msaYkfM.exe
  C:\Windows\System\msaYkfM.exe
  2⤵
  PID:8224
- C:\Windows\System\cAzjCGZ.exe
  C:\Windows\System\cAzjCGZ.exe
  2⤵
  PID:8292
- C:\Windows\System\TsgOuYF.exe
  C:\Windows\System\TsgOuYF.exe
  2⤵
  PID:8388
- C:\Windows\System\dUFeAPZ.exe
  C:\Windows\System\dUFeAPZ.exe
  2⤵
  PID:8456
- C:\Windows\System\EwZzsTg.exe
  C:\Windows\System\EwZzsTg.exe
  2⤵
  PID:8536
- C:\Windows\System\CllOSLo.exe
  C:\Windows\System\CllOSLo.exe
  2⤵
  PID:8620
- C:\Windows\System\kDRDmTu.exe
  C:\Windows\System\kDRDmTu.exe
  2⤵
  PID:8640
- C:\Windows\System\TSjkoph.exe
  C:\Windows\System\TSjkoph.exe
  2⤵
  PID:8728
- C:\Windows\System\QtoGMuE.exe
  C:\Windows\System\QtoGMuE.exe
  2⤵
  PID:8816
- C:\Windows\System\peIgbww.exe
  C:\Windows\System\peIgbww.exe
  2⤵
  PID:8864
- C:\Windows\System\eLuXPRC.exe
  C:\Windows\System\eLuXPRC.exe
  2⤵
  PID:8932
- C:\Windows\System\mfaCdVV.exe
  C:\Windows\System\mfaCdVV.exe
  2⤵
  PID:3624
- C:\Windows\System\ylDyvVt.exe
  C:\Windows\System\ylDyvVt.exe
  2⤵
  PID:8992
- C:\Windows\System\qOLNmOg.exe
  C:\Windows\System\qOLNmOg.exe
  2⤵
  PID:9072
- C:\Windows\System\bwQbRJP.exe
  C:\Windows\System\bwQbRJP.exe
  2⤵
  PID:9156
- C:\Windows\System\WfSyVRH.exe
  C:\Windows\System\WfSyVRH.exe
  2⤵
  PID:9196
- C:\Windows\System\KBBMoPz.exe
  C:\Windows\System\KBBMoPz.exe
  2⤵
  PID:8288
- C:\Windows\System\HrXLtUi.exe
  C:\Windows\System\HrXLtUi.exe
  2⤵
  PID:8360
- C:\Windows\System\FOCLISf.exe
  C:\Windows\System\FOCLISf.exe
  2⤵
  PID:8516
- C:\Windows\System\iJhMWPD.exe
  C:\Windows\System\iJhMWPD.exe
  2⤵
  PID:8668
- C:\Windows\System\vVoUXlz.exe
  C:\Windows\System\vVoUXlz.exe
  2⤵
  PID:8860
- C:\Windows\System\ypqIbLR.exe
  C:\Windows\System\ypqIbLR.exe
  2⤵
  PID:8936
- C:\Windows\System\hqFSNCT.exe
  C:\Windows\System\hqFSNCT.exe
  2⤵
  PID:8964
- C:\Windows\System\wfuHPDZ.exe
  C:\Windows\System\wfuHPDZ.exe
  2⤵
  PID:8356
- C:\Windows\System\KBkrnVi.exe
  C:\Windows\System\KBkrnVi.exe
  2⤵
  PID:8636
- C:\Windows\System\rStmVDO.exe
  C:\Windows\System\rStmVDO.exe
  2⤵
  PID:4664
- C:\Windows\System\tufTxGy.exe
  C:\Windows\System\tufTxGy.exe
  2⤵
  PID:1004
- C:\Windows\System\TLhoYci.exe
  C:\Windows\System\TLhoYci.exe
  2⤵
  PID:8836
- C:\Windows\System\drHzsFE.exe
  C:\Windows\System\drHzsFE.exe
  2⤵
  PID:9104
- C:\Windows\System\oiLcgLb.exe
  C:\Windows\System\oiLcgLb.exe
  2⤵
  PID:9236
- C:\Windows\System\QVztxcm.exe
  C:\Windows\System\QVztxcm.exe
  2⤵
  PID:9264
- C:\Windows\System\XngEukZ.exe
  C:\Windows\System\XngEukZ.exe
  2⤵
  PID:9296
- C:\Windows\System\qjjtnrQ.exe
  C:\Windows\System\qjjtnrQ.exe
  2⤵
  PID:9324
- C:\Windows\System\uUuGuad.exe
  C:\Windows\System\uUuGuad.exe
  2⤵
  PID:9344
- C:\Windows\System\SnLIZJy.exe
  C:\Windows\System\SnLIZJy.exe
  2⤵
  PID:9372
- C:\Windows\System\NteCJTV.exe
  C:\Windows\System\NteCJTV.exe
  2⤵
  PID:9392
- C:\Windows\System\EZcPvXW.exe
  C:\Windows\System\EZcPvXW.exe
  2⤵
  PID:9452
- C:\Windows\System\dyewQLH.exe
  C:\Windows\System\dyewQLH.exe
  2⤵
  PID:9472
- C:\Windows\System\MXnPUhK.exe
  C:\Windows\System\MXnPUhK.exe
  2⤵
  PID:9504
- C:\Windows\System\jNLIAYr.exe
  C:\Windows\System\jNLIAYr.exe
  2⤵
  PID:9532
- C:\Windows\System\WYDggMl.exe
  C:\Windows\System\WYDggMl.exe
  2⤵
  PID:9572
- C:\Windows\System\XYuJimj.exe
  C:\Windows\System\XYuJimj.exe
  2⤵
  PID:9588
- C:\Windows\System\uIwWleQ.exe
  C:\Windows\System\uIwWleQ.exe
  2⤵
  PID:9608
- C:\Windows\System\VrlVdgA.exe
  C:\Windows\System\VrlVdgA.exe
  2⤵
  PID:9636
- C:\Windows\System\mRhOazw.exe
  C:\Windows\System\mRhOazw.exe
  2⤵
  PID:9672
- C:\Windows\System\VvYQcRf.exe
  C:\Windows\System\VvYQcRf.exe
  2⤵
  PID:9708
- C:\Windows\System\lChqJdO.exe
  C:\Windows\System\lChqJdO.exe
  2⤵
  PID:9728
- C:\Windows\System\LCFdsiP.exe
  C:\Windows\System\LCFdsiP.exe
  2⤵
  PID:9756
- C:\Windows\System\PWoCAJg.exe
  C:\Windows\System\PWoCAJg.exe
  2⤵
  PID:9784
- C:\Windows\System\wREhIlF.exe
  C:\Windows\System\wREhIlF.exe
  2⤵
  PID:9816
- C:\Windows\System\VHTKbsg.exe
  C:\Windows\System\VHTKbsg.exe
  2⤵
  PID:9840
- C:\Windows\System\fPbyUzp.exe
  C:\Windows\System\fPbyUzp.exe
  2⤵
  PID:9880
- C:\Windows\System\GgRAqPC.exe
  C:\Windows\System\GgRAqPC.exe
  2⤵
  PID:9908
- C:\Windows\System\EVGAJvX.exe
  C:\Windows\System\EVGAJvX.exe
  2⤵
  PID:9924
- C:\Windows\System\JNDRwTN.exe
  C:\Windows\System\JNDRwTN.exe
  2⤵
  PID:9964
- C:\Windows\System\HFyumhq.exe
  C:\Windows\System\HFyumhq.exe
  2⤵
  PID:9992
- C:\Windows\System\XxfyuFm.exe
  C:\Windows\System\XxfyuFm.exe
  2⤵
  PID:10016
- C:\Windows\System\thWdsQz.exe
  C:\Windows\System\thWdsQz.exe
  2⤵
  PID:10048
- C:\Windows\System\uPfREme.exe
  C:\Windows\System\uPfREme.exe
  2⤵
  PID:10076
- C:\Windows\System\kDhMdqY.exe
  C:\Windows\System\kDhMdqY.exe
  2⤵
  PID:10104
- C:\Windows\System\njLpurn.exe
  C:\Windows\System\njLpurn.exe
  2⤵
  PID:10136
- C:\Windows\System\WRrQwnI.exe
  C:\Windows\System\WRrQwnI.exe
  2⤵
  PID:10160
- C:\Windows\System\VmGgEDe.exe
  C:\Windows\System\VmGgEDe.exe
  2⤵
  PID:10176
- C:\Windows\System\RqWPnBG.exe
  C:\Windows\System\RqWPnBG.exe
  2⤵
  PID:10196
- C:\Windows\System\WYwPvhc.exe
  C:\Windows\System\WYwPvhc.exe
  2⤵
  PID:10232
- C:\Windows\System\UZVpOxw.exe
  C:\Windows\System\UZVpOxw.exe
  2⤵
  PID:9244
- C:\Windows\System\MLzNath.exe
  C:\Windows\System\MLzNath.exe
  2⤵
  PID:9272
- C:\Windows\System\xQmYxMn.exe
  C:\Windows\System\xQmYxMn.exe
  2⤵
  PID:9340
- C:\Windows\System\WbuKIzI.exe
  C:\Windows\System\WbuKIzI.exe
  2⤵
  PID:9408
- C:\Windows\System\gZpWHxz.exe
  C:\Windows\System\gZpWHxz.exe
  2⤵
  PID:9488
- C:\Windows\System\eCajphO.exe
  C:\Windows\System\eCajphO.exe
  2⤵
  PID:9556
- C:\Windows\System\FsYTuOQ.exe
  C:\Windows\System\FsYTuOQ.exe
  2⤵
  PID:9660
- C:\Windows\System\UipzsLu.exe
  C:\Windows\System\UipzsLu.exe
  2⤵
  PID:9696
- C:\Windows\System\keRrRNB.exe
  C:\Windows\System\keRrRNB.exe
  2⤵
  PID:9824
- C:\Windows\System\pOYEGGm.exe
  C:\Windows\System\pOYEGGm.exe
  2⤵
  PID:9872
- C:\Windows\System\hfbzBiK.exe
  C:\Windows\System\hfbzBiK.exe
  2⤵
  PID:9920
- C:\Windows\System\xxjoNQy.exe
  C:\Windows\System\xxjoNQy.exe
  2⤵
  PID:9988
- C:\Windows\System\wOHDpNO.exe
  C:\Windows\System\wOHDpNO.exe
  2⤵
  PID:2904
- C:\Windows\System\mokLkLw.exe
  C:\Windows\System\mokLkLw.exe
  2⤵
  PID:10096
- C:\Windows\System\UKnEfzz.exe
  C:\Windows\System\UKnEfzz.exe
  2⤵
  PID:10120
- C:\Windows\System\SoBHPSq.exe
  C:\Windows\System\SoBHPSq.exe
  2⤵
  PID:10188
- C:\Windows\System\vYLHpyL.exe
  C:\Windows\System\vYLHpyL.exe
  2⤵
  PID:9284
- C:\Windows\System\RrrusXG.exe
  C:\Windows\System\RrrusXG.exe
  2⤵
  PID:9368
- C:\Windows\System\hWhMvjc.exe
  C:\Windows\System\hWhMvjc.exe
  2⤵
  PID:9524
- C:\Windows\System\cAptIXT.exe
  C:\Windows\System\cAptIXT.exe
  2⤵
  PID:9744
- C:\Windows\System\reYMRSX.exe
  C:\Windows\System\reYMRSX.exe
  2⤵
  PID:9900
- C:\Windows\System\SAFjTmy.exe
  C:\Windows\System\SAFjTmy.exe
  2⤵
  PID:10060
- C:\Windows\System\COKrJIe.exe
  C:\Windows\System\COKrJIe.exe
  2⤵
  PID:10168
- C:\Windows\System\RuSnGSG.exe
  C:\Windows\System\RuSnGSG.exe
  2⤵
  PID:9468
- C:\Windows\System\DELrZuo.exe
  C:\Windows\System\DELrZuo.exe
  2⤵
  PID:9852
- C:\Windows\System\JwcJpgu.exe
  C:\Windows\System\JwcJpgu.exe
  2⤵
  PID:9492
- C:\Windows\System\GBCgFcH.exe
  C:\Windows\System\GBCgFcH.exe
  2⤵
  PID:9544
- C:\Windows\System\qJVXSKE.exe
  C:\Windows\System\qJVXSKE.exe
  2⤵
  PID:10204
- C:\Windows\System\VLBpiBK.exe
  C:\Windows\System\VLBpiBK.exe
  2⤵
  PID:10252
- C:\Windows\System\DNmnpRb.exe
  C:\Windows\System\DNmnpRb.exe
  2⤵
  PID:10280
- C:\Windows\System\lNokNDJ.exe
  C:\Windows\System\lNokNDJ.exe
  2⤵
  PID:10308
- C:\Windows\System\uVkLwwg.exe
  C:\Windows\System\uVkLwwg.exe
  2⤵
  PID:10336
- C:\Windows\System\niqxnrL.exe
  C:\Windows\System\niqxnrL.exe
  2⤵
  PID:10352
- C:\Windows\System\UfRVmVm.exe
  C:\Windows\System\UfRVmVm.exe
  2⤵
  PID:10380
- C:\Windows\System\nwvbZrk.exe
  C:\Windows\System\nwvbZrk.exe
  2⤵
  PID:10408
- C:\Windows\System\IGepKuj.exe
  C:\Windows\System\IGepKuj.exe
  2⤵
  PID:10448
- C:\Windows\System\fuBqUEe.exe
  C:\Windows\System\fuBqUEe.exe
  2⤵
  PID:10464
- C:\Windows\System\NzXUjBR.exe
  C:\Windows\System\NzXUjBR.exe
  2⤵
  PID:10492
- C:\Windows\System\GcMyYoa.exe
  C:\Windows\System\GcMyYoa.exe
  2⤵
  PID:10520
- C:\Windows\System\BkGVPzN.exe
  C:\Windows\System\BkGVPzN.exe
  2⤵
  PID:10560
- C:\Windows\System\fPjwDfR.exe
  C:\Windows\System\fPjwDfR.exe
  2⤵
  PID:10580
- C:\Windows\System\ArybfTq.exe
  C:\Windows\System\ArybfTq.exe
  2⤵
  PID:10600
- C:\Windows\System\wwYTCmE.exe
  C:\Windows\System\wwYTCmE.exe
  2⤵
  PID:10644
- C:\Windows\System\kpQSlcE.exe
  C:\Windows\System\kpQSlcE.exe
  2⤵
  PID:10672
- C:\Windows\System\XXdyfsv.exe
  C:\Windows\System\XXdyfsv.exe
  2⤵
  PID:10716
- C:\Windows\System\CMFtrPp.exe
  C:\Windows\System\CMFtrPp.exe
  2⤵
  PID:10732
- C:\Windows\System\MUHQCcB.exe
  C:\Windows\System\MUHQCcB.exe
  2⤵
  PID:10760
- C:\Windows\System\nKwgVeP.exe
  C:\Windows\System\nKwgVeP.exe
  2⤵
  PID:10788
- C:\Windows\System\ziDtczu.exe
  C:\Windows\System\ziDtczu.exe
  2⤵
  PID:10812
- C:\Windows\System\mVIXZnz.exe
  C:\Windows\System\mVIXZnz.exe
  2⤵
  PID:10832
- C:\Windows\System\omThwLk.exe
  C:\Windows\System\omThwLk.exe
  2⤵
  PID:10860
- C:\Windows\System\SuaRFpv.exe
  C:\Windows\System\SuaRFpv.exe
  2⤵
  PID:10884
- C:\Windows\System\xgkSwwu.exe
  C:\Windows\System\xgkSwwu.exe
  2⤵
  PID:10912
- C:\Windows\System\egFAecb.exe
  C:\Windows\System\egFAecb.exe
  2⤵
  PID:10956
- C:\Windows\System\hOisqpY.exe
  C:\Windows\System\hOisqpY.exe
  2⤵
  PID:10984
- C:\Windows\System\MebakuI.exe
  C:\Windows\System\MebakuI.exe
  2⤵
  PID:11016
- C:\Windows\System\nyNAHLW.exe
  C:\Windows\System\nyNAHLW.exe
  2⤵
  PID:11040
- C:\Windows\System\ZERTvgI.exe
  C:\Windows\System\ZERTvgI.exe
  2⤵
  PID:11056
- C:\Windows\System\rxAFDQY.exe
  C:\Windows\System\rxAFDQY.exe
  2⤵
  PID:11088
- C:\Windows\System\gWsvYii.exe
  C:\Windows\System\gWsvYii.exe
  2⤵
  PID:11116
- C:\Windows\System\GGzdmGC.exe
  C:\Windows\System\GGzdmGC.exe
  2⤵
  PID:11160
- C:\Windows\System\SZCerzk.exe
  C:\Windows\System\SZCerzk.exe
  2⤵
  PID:11184
- C:\Windows\System\OHjfVgB.exe
  C:\Windows\System\OHjfVgB.exe
  2⤵
  PID:11212
- C:\Windows\System\UsUnaAE.exe
  C:\Windows\System\UsUnaAE.exe
  2⤵
  PID:11244
- C:\Windows\System\toLgksd.exe
  C:\Windows\System\toLgksd.exe
  2⤵
  PID:11260
- C:\Windows\System\mARFqPF.exe
  C:\Windows\System\mARFqPF.exe
  2⤵
  PID:10300
- C:\Windows\System\gqLHYNX.exe
  C:\Windows\System\gqLHYNX.exe
  2⤵
  PID:10396
- C:\Windows\System\nDJwGKr.exe
  C:\Windows\System\nDJwGKr.exe
  2⤵
  PID:10456
- C:\Windows\System\XrwWhEi.exe
  C:\Windows\System\XrwWhEi.exe
  2⤵
  PID:10516
- C:\Windows\System\bisBsud.exe
  C:\Windows\System\bisBsud.exe
  2⤵
  PID:10572
- C:\Windows\System\pQMLMpb.exe
  C:\Windows\System\pQMLMpb.exe
  2⤵
  PID:10656
- C:\Windows\System\JdxoTeM.exe
  C:\Windows\System\JdxoTeM.exe
  2⤵
  PID:10692
- C:\Windows\System\KrLBdyQ.exe
  C:\Windows\System\KrLBdyQ.exe
  2⤵
  PID:10744
- C:\Windows\System\yxTiwEu.exe
  C:\Windows\System\yxTiwEu.exe
  2⤵
  PID:10828
- C:\Windows\System\jcEivJp.exe
  C:\Windows\System\jcEivJp.exe
  2⤵
  PID:10896
- C:\Windows\System\ctYpBjK.exe
  C:\Windows\System\ctYpBjK.exe
  2⤵
  PID:10996
- C:\Windows\System\IeaxsgE.exe
  C:\Windows\System\IeaxsgE.exe
  2⤵
  PID:11036
- C:\Windows\System\RAtgtIU.exe
  C:\Windows\System\RAtgtIU.exe
  2⤵
  PID:11148
- C:\Windows\System\LMlDIef.exe
  C:\Windows\System\LMlDIef.exe
  2⤵
  PID:11144
- C:\Windows\System\ftcPuxy.exe
  C:\Windows\System\ftcPuxy.exe
  2⤵
  PID:11204
- C:\Windows\System\KeYoSiv.exe
  C:\Windows\System\KeYoSiv.exe
  2⤵
  PID:10364
- C:\Windows\System\PesqXVt.exe
  C:\Windows\System\PesqXVt.exe
  2⤵
  PID:10544
- C:\Windows\System\YciyCyI.exe
  C:\Windows\System\YciyCyI.exe
  2⤵
  PID:10752
- C:\Windows\System\KsaiSgd.exe
  C:\Windows\System\KsaiSgd.exe
  2⤵
  PID:10872
- C:\Windows\System\SzNsWJm.exe
  C:\Windows\System\SzNsWJm.exe
  2⤵
  PID:11048
- C:\Windows\System\WPVrqtA.exe
  C:\Windows\System\WPVrqtA.exe
  2⤵
  PID:11140
- C:\Windows\System\lRVuXex.exe
  C:\Windows\System\lRVuXex.exe
  2⤵
  PID:11256
- C:\Windows\System\lisYUMy.exe
  C:\Windows\System\lisYUMy.exe
  2⤵
  PID:10748
- C:\Windows\System\nQCxzXF.exe
  C:\Windows\System\nQCxzXF.exe
  2⤵
  PID:10944
- C:\Windows\System\yZHDQfT.exe
  C:\Windows\System\yZHDQfT.exe
  2⤵
  PID:11136
- C:\Windows\System\tLPyXgX.exe
  C:\Windows\System\tLPyXgX.exe
  2⤵
  PID:10372
- C:\Windows\System\IBxKwGS.exe
  C:\Windows\System\IBxKwGS.exe
  2⤵
  PID:11292
- C:\Windows\System\EUZTfUD.exe
  C:\Windows\System\EUZTfUD.exe
  2⤵
  PID:11320
- C:\Windows\System\lGGkSoG.exe
  C:\Windows\System\lGGkSoG.exe
  2⤵
  PID:11348
- C:\Windows\System\cyvDQku.exe
  C:\Windows\System\cyvDQku.exe
  2⤵
  PID:11380
- C:\Windows\System\ZOoRpGc.exe
  C:\Windows\System\ZOoRpGc.exe
  2⤵
  PID:11404
- C:\Windows\System\zVnWJTn.exe
  C:\Windows\System\zVnWJTn.exe
  2⤵
  PID:11448
- C:\Windows\System\HKuLIJe.exe
  C:\Windows\System\HKuLIJe.exe
  2⤵
  PID:11476
- C:\Windows\System\gAdpWXZ.exe
  C:\Windows\System\gAdpWXZ.exe
  2⤵
  PID:11496
- C:\Windows\System\fZgqvlX.exe
  C:\Windows\System\fZgqvlX.exe
  2⤵
  PID:11516
- C:\Windows\System\PCPIvWS.exe
  C:\Windows\System\PCPIvWS.exe
  2⤵
  PID:11536
- C:\Windows\System\bXHXsQL.exe
  C:\Windows\System\bXHXsQL.exe
  2⤵
  PID:11568
- C:\Windows\System\SSLsfYK.exe
  C:\Windows\System\SSLsfYK.exe
  2⤵
  PID:11600
- C:\Windows\System\tYfPyOO.exe
  C:\Windows\System\tYfPyOO.exe
  2⤵
  PID:11632
- C:\Windows\System\jKNJCzR.exe
  C:\Windows\System\jKNJCzR.exe
  2⤵
  PID:11648
- C:\Windows\System\DQvktOV.exe
  C:\Windows\System\DQvktOV.exe
  2⤵
  PID:11668
- C:\Windows\System\iVMvUbK.exe
  C:\Windows\System\iVMvUbK.exe
  2⤵
  PID:11712
- C:\Windows\System\jqMMJEb.exe
  C:\Windows\System\jqMMJEb.exe
  2⤵
  PID:11744
- C:\Windows\System\NieklVM.exe
  C:\Windows\System\NieklVM.exe
  2⤵
  PID:11772
- C:\Windows\System\bvjObPq.exe
  C:\Windows\System\bvjObPq.exe
  2⤵
  PID:11800
- C:\Windows\System\KiPCngE.exe
  C:\Windows\System\KiPCngE.exe
  2⤵
  PID:11824
- C:\Windows\System\lxumGMP.exe
  C:\Windows\System\lxumGMP.exe
  2⤵
  PID:11856
- C:\Windows\System\noygiOa.exe
  C:\Windows\System\noygiOa.exe
  2⤵
  PID:11892
- C:\Windows\System\kKzZisH.exe
  C:\Windows\System\kKzZisH.exe
  2⤵
  PID:11924
- C:\Windows\System\pikCSBd.exe
  C:\Windows\System\pikCSBd.exe
  2⤵
  PID:11952
- C:\Windows\System\FtgAOmi.exe
  C:\Windows\System\FtgAOmi.exe
  2⤵
  PID:11968
- C:\Windows\System\wORVjml.exe
  C:\Windows\System\wORVjml.exe
  2⤵
  PID:11996
- C:\Windows\System\GEkBKls.exe
  C:\Windows\System\GEkBKls.exe
  2⤵
  PID:12024
- C:\Windows\System\xyPWlxq.exe
  C:\Windows\System\xyPWlxq.exe
  2⤵
  PID:12064
- C:\Windows\System\ziWHWtS.exe
  C:\Windows\System\ziWHWtS.exe
  2⤵
  PID:12092
- C:\Windows\System\dgwqkgI.exe
  C:\Windows\System\dgwqkgI.exe
  2⤵
  PID:12120
- C:\Windows\System\FVaGKIb.exe
  C:\Windows\System\FVaGKIb.exe
  2⤵
  PID:12148
- C:\Windows\System\GUsIugn.exe
  C:\Windows\System\GUsIugn.exe
  2⤵
  PID:12164
- C:\Windows\System\qOeWXrk.exe
  C:\Windows\System\qOeWXrk.exe
  2⤵
  PID:12204
- C:\Windows\System\nhVWPlV.exe
  C:\Windows\System\nhVWPlV.exe
  2⤵
  PID:12220
- C:\Windows\System\WgaVHmN.exe
  C:\Windows\System\WgaVHmN.exe
  2⤵
  PID:12248
- C:\Windows\System\MkzqEpY.exe
  C:\Windows\System\MkzqEpY.exe
  2⤵
  PID:12280
- C:\Windows\System\nCnDRpt.exe
  C:\Windows\System\nCnDRpt.exe
  2⤵
  PID:11228
- C:\Windows\System\JfWvDiV.exe
  C:\Windows\System\JfWvDiV.exe
  2⤵
  PID:11336
- C:\Windows\System\WdldZbi.exe
  C:\Windows\System\WdldZbi.exe
  2⤵
  PID:11424
- C:\Windows\System\TghNIAe.exe
  C:\Windows\System\TghNIAe.exe
  2⤵
  PID:11528
- C:\Windows\System\UQIjirQ.exe
  C:\Windows\System\UQIjirQ.exe
  2⤵
  PID:11584
- C:\Windows\System\oEtWKVi.exe
  C:\Windows\System\oEtWKVi.exe
  2⤵
  PID:11612
- C:\Windows\System\oXDuOOS.exe
  C:\Windows\System\oXDuOOS.exe
  2⤵
  PID:11688
- C:\Windows\System\CwnfCkb.exe
  C:\Windows\System\CwnfCkb.exe
  2⤵
  PID:11792
- C:\Windows\System\ZELFSyf.exe
  C:\Windows\System\ZELFSyf.exe
  2⤵
  PID:11844
- C:\Windows\System\jRaWqKJ.exe
  C:\Windows\System\jRaWqKJ.exe
  2⤵
  PID:11880
- C:\Windows\System\sCOTqjj.exe
  C:\Windows\System\sCOTqjj.exe
  2⤵
  PID:11984
- C:\Windows\System\EbLWuYP.exe
  C:\Windows\System\EbLWuYP.exe
  2⤵
  PID:12052
- C:\Windows\System\OjKJaMg.exe
  C:\Windows\System\OjKJaMg.exe
  2⤵
  PID:12104
- C:\Windows\System\yYgISVH.exe
  C:\Windows\System\yYgISVH.exe
  2⤵
  PID:12156
- C:\Windows\System\zySAgIz.exe
  C:\Windows\System\zySAgIz.exe
  2⤵
  PID:12216
- C:\Windows\System\Yafqmqk.exe
  C:\Windows\System\Yafqmqk.exe
  2⤵
  PID:12272
- C:\Windows\System\qFqrZGu.exe
  C:\Windows\System\qFqrZGu.exe
  2⤵
  PID:11224
- C:\Windows\System\lcFAQKa.exe
  C:\Windows\System\lcFAQKa.exe
  2⤵
  PID:11508
- C:\Windows\System\GNzOGhN.exe
  C:\Windows\System\GNzOGhN.exe
  2⤵
  PID:11736
- C:\Windows\System\riryTkj.exe
  C:\Windows\System\riryTkj.exe
  2⤵
  PID:11884
- C:\Windows\System\bCkgeZe.exe
  C:\Windows\System\bCkgeZe.exe
  2⤵
  PID:11936
- C:\Windows\System\iiJsbeZ.exe
  C:\Windows\System\iiJsbeZ.exe
  2⤵
  PID:12144
- C:\Windows\System\ucOVLfr.exe
  C:\Windows\System\ucOVLfr.exe
  2⤵
  PID:11344
- C:\Windows\System\NmKvkGs.exe
  C:\Windows\System\NmKvkGs.exe
  2⤵
  PID:11656
- C:\Windows\System\aKowGjj.exe
  C:\Windows\System\aKowGjj.exe
  2⤵
  PID:11916
- C:\Windows\System\LxWijws.exe
  C:\Windows\System\LxWijws.exe
  2⤵
  PID:12132
- C:\Windows\System\RRVeWAA.exe
  C:\Windows\System\RRVeWAA.exe
  2⤵
  PID:12212
- C:\Windows\System\UraLgCd.exe
  C:\Windows\System\UraLgCd.exe
  2⤵
  PID:12304
- C:\Windows\System\lyFbNtz.exe
  C:\Windows\System\lyFbNtz.exe
  2⤵
  PID:12328
- C:\Windows\System\IvpQUss.exe
  C:\Windows\System\IvpQUss.exe
  2⤵
  PID:12348
- C:\Windows\System\HsPOGrI.exe
  C:\Windows\System\HsPOGrI.exe
  2⤵
  PID:12368
- C:\Windows\System\JaQvaZj.exe
  C:\Windows\System\JaQvaZj.exe
  2⤵
  PID:12388
- C:\Windows\System\dyeXqNe.exe
  C:\Windows\System\dyeXqNe.exe
  2⤵
  PID:12420
- C:\Windows\System\bZdhJnr.exe
  C:\Windows\System\bZdhJnr.exe
  2⤵
  PID:12444
- C:\Windows\System\YdGlMLT.exe
  C:\Windows\System\YdGlMLT.exe
  2⤵
  PID:12492
- C:\Windows\System\BFLmVGi.exe
  C:\Windows\System\BFLmVGi.exe
  2⤵
  PID:12544
- C:\Windows\System\GJvEeCO.exe
  C:\Windows\System\GJvEeCO.exe
  2⤵
  PID:12580
- C:\Windows\System\ZtPqiFD.exe
  C:\Windows\System\ZtPqiFD.exe
  2⤵
  PID:12612
- C:\Windows\System\cxktmeo.exe
  C:\Windows\System\cxktmeo.exe
  2⤵
  PID:12640
- C:\Windows\System\APRunKC.exe
  C:\Windows\System\APRunKC.exe
  2⤵
  PID:12660
- C:\Windows\System\HmzAJGf.exe
  C:\Windows\System\HmzAJGf.exe
  2⤵
  PID:12692
- C:\Windows\System\PrMAafg.exe
  C:\Windows\System\PrMAafg.exe
  2⤵
  PID:12736
- C:\Windows\System\cFDSKlU.exe
  C:\Windows\System\cFDSKlU.exe
  2⤵
  PID:12764
- C:\Windows\System\HkctAzb.exe
  C:\Windows\System\HkctAzb.exe
  2⤵
  PID:12828
- C:\Windows\System\tosonDN.exe
  C:\Windows\System\tosonDN.exe
  2⤵
  PID:12844
- C:\Windows\System\SMlLbaF.exe
  C:\Windows\System\SMlLbaF.exe
  2⤵
  PID:12860
- C:\Windows\System\vkQFJrC.exe
  C:\Windows\System\vkQFJrC.exe
  2⤵
  PID:12908
- C:\Windows\System\FraZQlc.exe
  C:\Windows\System\FraZQlc.exe
  2⤵
  PID:12928
- C:\Windows\System\tCXgzLj.exe
  C:\Windows\System\tCXgzLj.exe
  2⤵
  PID:12956
- C:\Windows\System\RHBRRTQ.exe
  C:\Windows\System\RHBRRTQ.exe
  2⤵
  PID:12996
- C:\Windows\System\xaqzfvb.exe
  C:\Windows\System\xaqzfvb.exe
  2⤵
  PID:13028
- C:\Windows\System\uMVqZDt.exe
  C:\Windows\System\uMVqZDt.exe
  2⤵
  PID:13056
- C:\Windows\System\YRjRhyZ.exe
  C:\Windows\System\YRjRhyZ.exe
  2⤵
  PID:13084
- C:\Windows\System\pLYDKNE.exe
  C:\Windows\System\pLYDKNE.exe
  2⤵
  PID:13108
- C:\Windows\System\OtnEQgT.exe
  C:\Windows\System\OtnEQgT.exe
  2⤵
  PID:13128
- C:\Windows\System\mBQYBsq.exe
  C:\Windows\System\mBQYBsq.exe
  2⤵
  PID:13176
- C:\Windows\System\DVbXfpS.exe
  C:\Windows\System\DVbXfpS.exe
  2⤵
  PID:13192
- C:\Windows\System\irgZmUJ.exe
  C:\Windows\System\irgZmUJ.exe
  2⤵
  PID:13232
- C:\Windows\System\iNZshte.exe
  C:\Windows\System\iNZshte.exe
  2⤵
  PID:13256
- C:\Windows\System\wsxacEF.exe
  C:\Windows\System\wsxacEF.exe
  2⤵
  PID:13276
- C:\Windows\System\PYIABUs.exe
  C:\Windows\System\PYIABUs.exe
  2⤵
  PID:11768
- C:\Windows\System\eYxgIqA.exe
  C:\Windows\System\eYxgIqA.exe
  2⤵
  PID:12292
- C:\Windows\System\mYneJwE.exe
  C:\Windows\System\mYneJwE.exe
  2⤵
  PID:11396
- C:\Windows\System\EQpWBvv.exe
  C:\Windows\System\EQpWBvv.exe
  2⤵
  PID:12412
- C:\Windows\System\sodPDfj.exe
  C:\Windows\System\sodPDfj.exe
  2⤵
  PID:12516
- C:\Windows\System\kcmPIHc.exe
  C:\Windows\System\kcmPIHc.exe
  2⤵
  PID:12596
- C:\Windows\System\gJcYDrT.exe
  C:\Windows\System\gJcYDrT.exe
  2⤵
  PID:4032
- C:\Windows\System\mIwllDA.exe
  C:\Windows\System\mIwllDA.exe
  2⤵
  PID:12748
- C:\Windows\System\tGzpncI.exe
  C:\Windows\System\tGzpncI.exe
  2⤵
  PID:12312
- C:\Windows\System\CtViyaH.exe
  C:\Windows\System\CtViyaH.exe
  2⤵
  PID:12892
- C:\Windows\System\RlicNSq.exe
  C:\Windows\System\RlicNSq.exe
  2⤵
  PID:12924
- C:\Windows\System\Jfcgrsv.exe
  C:\Windows\System\Jfcgrsv.exe
  2⤵
  PID:13024
- C:\Windows\System\ZOULsjS.exe
  C:\Windows\System\ZOULsjS.exe
  2⤵
  PID:13104
- C:\Windows\System\tJxwJJq.exe
  C:\Windows\System\tJxwJJq.exe
  2⤵
  PID:13144
- C:\Windows\System\gzqFLkl.exe
  C:\Windows\System\gzqFLkl.exe
  2⤵
  PID:13184
- C:\Windows\System\uixlCCn.exe
  C:\Windows\System\uixlCCn.exe
  2⤵
  PID:13216
- C:\Windows\System\AZYmoRJ.exe
  C:\Windows\System\AZYmoRJ.exe
  2⤵
  PID:13268
- C:\Windows\System\RmEyUrH.exe
  C:\Windows\System\RmEyUrH.exe
  2⤵
  PID:11836
- C:\Windows\System\RdVWtHE.exe
  C:\Windows\System\RdVWtHE.exe
  2⤵
  PID:12484
- C:\Windows\System\mmfhKTm.exe
  C:\Windows\System\mmfhKTm.exe
  2⤵
  PID:12560
- C:\Windows\System\alOjbAH.exe
  C:\Windows\System\alOjbAH.exe
  2⤵
  PID:12732
- C:\Windows\System\goTChAH.exe
  C:\Windows\System\goTChAH.exe
  2⤵
  PID:12900
- C:\Windows\System\DaAmdiN.exe
  C:\Windows\System\DaAmdiN.exe
  2⤵
  PID:13068
- C:\Windows\System\KyAFBWM.exe
  C:\Windows\System\KyAFBWM.exe
  2⤵
  PID:13220
- C:\Windows\System\IknAIhu.exe
  C:\Windows\System\IknAIhu.exe
  2⤵
  PID:11464
- C:\Windows\System\PgsUUEN.exe
  C:\Windows\System\PgsUUEN.exe
  2⤵
  PID:12992
- C:\Windows\System\KCHtRBe.exe
  C:\Windows\System\KCHtRBe.exe
  2⤵
  PID:13168
- C:\Windows\System\MriLFab.exe
  C:\Windows\System\MriLFab.exe
  2⤵
  PID:4240
- C:\Windows\System\uYjUXYF.exe
  C:\Windows\System\uYjUXYF.exe
  2⤵
  PID:12684
- C:\Windows\System\KaWRMAm.exe
  C:\Windows\System\KaWRMAm.exe
  2⤵
  PID:13332
- C:\Windows\System\tEGZhtC.exe
  C:\Windows\System\tEGZhtC.exe
  2⤵
  PID:13364
- C:\Windows\System\SYlNeAi.exe
  C:\Windows\System\SYlNeAi.exe
  2⤵
  PID:13392
- C:\Windows\System\OcxSbYu.exe
  C:\Windows\System\OcxSbYu.exe
  2⤵
  PID:13424
- C:\Windows\System\JFjaZCa.exe
  C:\Windows\System\JFjaZCa.exe
  2⤵
  PID:13448
- C:\Windows\System\FTcrjph.exe
  C:\Windows\System\FTcrjph.exe
  2⤵
  PID:13488
- C:\Windows\System\kxgnrsF.exe
  C:\Windows\System\kxgnrsF.exe
  2⤵
  PID:13516
- C:\Windows\System\PJntehw.exe
  C:\Windows\System\PJntehw.exe
  2⤵
  PID:13544
- C:\Windows\System\SyHvDRV.exe
  C:\Windows\System\SyHvDRV.exe
  2⤵
  PID:13568
- C:\Windows\System\uGsrxex.exe
  C:\Windows\System\uGsrxex.exe
  2⤵
  PID:13588
- C:\Windows\System\dfKJNdB.exe
  C:\Windows\System\dfKJNdB.exe
  2⤵
  PID:13608
- C:\Windows\System\hmLJSOr.exe
  C:\Windows\System\hmLJSOr.exe
  2⤵
  PID:13632
- C:\Windows\System\crGcoZw.exe
  C:\Windows\System\crGcoZw.exe
  2⤵
  PID:13668
- C:\Windows\System\gAmASTv.exe
  C:\Windows\System\gAmASTv.exe
  2⤵
  PID:13696
- C:\Windows\System\EHpkRJj.exe
  C:\Windows\System\EHpkRJj.exe
  2⤵
  PID:13716
- C:\Windows\System\rjZBzsJ.exe
  C:\Windows\System\rjZBzsJ.exe
  2⤵
  PID:13740
- C:\Windows\System\SdshbJa.exe
  C:\Windows\System\SdshbJa.exe
  2⤵
  PID:13760
- C:\Windows\System\PqlYsCM.exe
  C:\Windows\System\PqlYsCM.exe
  2⤵
  PID:13792
- C:\Windows\System\klqxJLK.exe
  C:\Windows\System\klqxJLK.exe
  2⤵
  PID:13824
- C:\Windows\System\DrgWmZV.exe
  C:\Windows\System\DrgWmZV.exe
  2⤵
  PID:13864
- C:\Windows\System\weyNZVL.exe
  C:\Windows\System\weyNZVL.exe
  2⤵
  PID:13888
- C:\Windows\System\vpDWIJs.exe
  C:\Windows\System\vpDWIJs.exe
  2⤵
  PID:13916
- C:\Windows\System\qnHshac.exe
  C:\Windows\System\qnHshac.exe
  2⤵
  PID:13936
- C:\Windows\System\mvOSLoh.exe
  C:\Windows\System\mvOSLoh.exe
  2⤵
  PID:13964
- C:\Windows\System\EjlfCjM.exe
  C:\Windows\System\EjlfCjM.exe
  2⤵
  PID:13992
- C:\Windows\System\mdqFrCU.exe
  C:\Windows\System\mdqFrCU.exe
  2⤵
  PID:14012
- C:\Windows\System\vWXHysE.exe
  C:\Windows\System\vWXHysE.exe
  2⤵
  PID:14036
- C:\Windows\System\WWaQytR.exe
  C:\Windows\System\WWaQytR.exe
  2⤵
  PID:14064
- C:\Windows\System\cOlBFyQ.exe
  C:\Windows\System\cOlBFyQ.exe
  2⤵
  PID:14096
- C:\Windows\System\hrPFDbZ.exe
  C:\Windows\System\hrPFDbZ.exe
  2⤵
  PID:14124
- C:\Windows\System\CLzWvfF.exe
  C:\Windows\System\CLzWvfF.exe
  2⤵
  PID:14152
- C:\Windows\System\NvbfFdS.exe
  C:\Windows\System\NvbfFdS.exe
  2⤵
  PID:14180
- C:\Windows\System\DvlPGXA.exe
  C:\Windows\System\DvlPGXA.exe
  2⤵
  PID:14208
- C:\Windows\System\RjrbPTX.exe
  C:\Windows\System\RjrbPTX.exe
  2⤵
  PID:14232
- C:\Windows\System\OKSZiLd.exe
  C:\Windows\System\OKSZiLd.exe
  2⤵
  PID:14264
- C:\Windows\System\Xyzswsz.exe
  C:\Windows\System\Xyzswsz.exe
  2⤵
  PID:14284
- C:\Windows\System\aqRFcIU.exe
  C:\Windows\System\aqRFcIU.exe
  2⤵
  PID:14312
- C:\Windows\System\GGVWJGC.exe
  C:\Windows\System\GGVWJGC.exe
  2⤵
  PID:12456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AudPAbu.exe

Filesize
1.9MB

MD5
95d63ae9611fb3c1f66e7b7db66a394a

SHA1
49ab9c296b829c0748ab27718f21b2eadf9cb6b0

SHA256
9f151ae1fccb597afd347d07ada0511f85a8bc73cb60372a1e7c79b46ff06717

SHA512
a9642c2bf03428b267fd111e4a5aed84dcca7629901cf1d717c1793f2e5eac6b639b9e4ba5b47e1ccff9df4483c0deef66532c1e0453bd19ef77954d4b33e0da

Download Submit
C:\Windows\System\BwTeozJ.exe

Filesize
1.9MB

MD5
bf6b97fa3248e6515b2af4e3ff7b7908

SHA1
f9689e6249df9c75653dae4158a4660e6cf9d2f2

SHA256
d170d1a6f4b22a84382fa84f77e606d778c8dadea387cd7af9c2ac4f00a04396

SHA512
0d846d0b68d2133bb2f17c27107daf881533360ea1defb9e576872868d80eb54a8ec587fa23e1076b7c3532cc726cebb78130dd599ff14255eea0c3fddc701df

Download Submit
C:\Windows\System\CEoPWTT.exe

Filesize
1.9MB

MD5
57fff7caa715eefaca82361eb38c43a3

SHA1
ff889ec84031e23349f4e5ce155da5f521185b9e

SHA256
c6bef661e9501eb8abaf8926fbfd190e4079491bebe9c1f0dc6244d7e03447f8

SHA512
180659b44b4fd11cadd563d0ee76266613bf7935ca00577331c390f06791d4624c02c43f819fd46f13f61d7a8847d3e4d780ebc7ef16372ca169d1ed23e6e7c3

Download Submit
C:\Windows\System\ExQZPuQ.exe

Filesize
1.9MB

MD5
2c2e01bc0a02aa5be2f69e167d4232c5

SHA1
74cff249848f51e82d225be2a3662b2804fd0001

SHA256
4d5ca2ea055ef515e02ad5c336905335d2d87c3ae5eefb40ec6e7d2dde657692

SHA512
f6caa0798f6b4790520b58198c4fdc8f5526cf494f4b0cb092320ff8c8b2878344e412b271c063ae24eef91b2d19f4da2a1fb007b1adcf69bc660bce076b1781

Download Submit
C:\Windows\System\IxxYDtZ.exe

Filesize
1.9MB

MD5
5205f744edbe4f65307e94ddbe7824cc

SHA1
b65f78d12c8241ec047922a4717a78e5ef7bc57a

SHA256
505db8785b7e1e173b0b945edd4cdd42f5687fabe9e4e86f77f1f372a20aa1b0

SHA512
88c2e60b73cb8952c80de7b9ee9a22b5a2e03fd933eae4f375e55bacedff10f19b12b97a0fb8ae277808d9be745992b57482949303b9cddb2ba547d99f92cc19

Download Submit
C:\Windows\System\LeKqHdi.exe

Filesize
1.9MB

MD5
95b645cb618cc994c9c9c9bec809b6ae

SHA1
23b149da0075437a9c385af7eb819717c5c261df

SHA256
36eccc2d335c173fa36e27946792a8702fded89e2d1a181bea6ed832e2761a6f

SHA512
de51d5c8b8967b685d31f53225bf00d647dd36abcdb7caf6fc8c1219db2ef997f3771a8896a0a29a6d8af4e31f6af9fa85a44928e187d13e3a028ffe3404fb63

Download Submit
C:\Windows\System\MklKKnY.exe

Filesize
1.9MB

MD5
0312b0a34e002f956389c9317168d300

SHA1
0fa7ba40b2ea4ddd0d7ec56ec7ee1eaa030852fd

SHA256
b03e121aed11e7873a89eab4b1b4d35a519874775c12e912ad3ab1b613f828a4

SHA512
bf04406c87bef881d67d2bbe8499ee15d57b6d30e2a5f89d83ae1cbadefbd5a4167529a7a9d1de66dc83c346bbf652f092de80cf414d7850a4b35402707281be

Download Submit
C:\Windows\System\NSeuClE.exe

Filesize
1.9MB

MD5
ba5e19bf8b6a4dbd8dbd6933c3ee6576

SHA1
13102dbac3579ca610055f9e3c65d3defd2ca466

SHA256
86c78e41455fbd8a0d5e75849285d9b299cc4a886945f00485431f8ed327797f

SHA512
bc93ccfe8a446e7024facdf3973fdbbcddb57b674094bad8050342c6617e3783fad6af5eb810a4ba5dcbed7a888016a135974a3a019cdd7e8c49724bc170afb5

Download Submit
C:\Windows\System\RsLulwv.exe

Filesize
1.9MB

MD5
d93b60f4f6fc2a0b22ede76dd4017872

SHA1
cbd8ea17264a1363c0c42f43b934b50bd6760611

SHA256
f8acb563eacfa67785ec3b10caea724e89bdfce71fb7ad5cde5b4aa88c53a3df

SHA512
6fc737cc39af8b4f6eb899840792478b0b490e05c4f2d905b4c3f6a28ab632fe295ab6b30e7f75834e67956f7a275438d6f61b34400764b95063f9ba2dd3d37d

Download Submit
C:\Windows\System\UvDxvme.exe

Filesize
1.9MB

MD5
0c25c795aa5e8348de0a6ac9e851f141

SHA1
192685fefc0f188ca58c74784370dec6fdbecfaf

SHA256
44a606661dc4a326cc75ebdb05358ca74a8bcd3c55ba5555b63fa0c5d13555d0

SHA512
d6d86d7becfb066b051d2ec8f15ccee8995d2e6a14f70fe355a760f858ff2538ed79f7085579bdc8182df92994502db3fb90ee0d733d62144d5114f34bd67e6a

Download Submit
C:\Windows\System\UwuYPFT.exe

Filesize
1.9MB

MD5
684fbb37c4e1f3872d55178371416e69

SHA1
9a4f9b86a8cdfbe541c72b5f7b8d082315485267

SHA256
aab75924e173b14ac30ec87a2c603ae069f2e8a52227815dccd48ea843ca61d4

SHA512
795fab713068176e9310f53147b077944dc816a528c9fc573b81b6e4ed07c8eaa4940738383f4744d707c3c39964bfc3363bc46b4e71ee110f07bd1feb66f442

Download Submit
C:\Windows\System\VqgvIFC.exe

Filesize
1.9MB

MD5
00f9288a0cfc3abd419c4e3d4b2ed12d

SHA1
b134e473e49cfd062b411830a71f351f2098ea97

SHA256
5a56dbbe81167a11421da86ca6ff117099fc03a0ec9c7d26916a6c5259792fcd

SHA512
729501fc72c0b78b79907bc504b1a9fd4ef8bad5c5882fc55a4383f9486cefac838d41a712bde5ae52d9d68692661a66def3accc07b6aa10f5deb5eeca497108

Download Submit
C:\Windows\System\WXHFXHa.exe

Filesize
1.9MB

MD5
14f02b4e7c75442208a38a425b483fe1

SHA1
e5b0f0e9fb76fbb92777b065be51e9fcca9d7f23

SHA256
95ae09e2fd9b8ed2b066f29685ab1325c402acd21956e5d678ded303901f61b0

SHA512
e54cc0c4b6da8a174de095a98009275ae718267144bd85c79e7321fb5281dd71c74b247abb407fa3176a80869543463a734e3ff7a04303cf866388bf2a9ee67c

Download Submit
C:\Windows\System\WasHeUU.exe

Filesize
1.9MB

MD5
7340b6225ff51a7384c5cc85afe148eb

SHA1
06c1492f860ab5cb0344d5868abbacde6e66642d

SHA256
3629c729fc17469fdc7d4d72291b406c229b90043b55b2c75a56a752b6976d9a

SHA512
97fd529ee20d40331af56773eea2097356635bb4f3e590f0e21c39fb0d2d9bcc796f82b5e84ce756f1b7a6d2a966dee16b3aff80eaeb126c11c67d52a77cc170

Download Submit
C:\Windows\System\aHitVZZ.exe

Filesize
1.9MB

MD5
592528f3e40748d26c207e6966d9eff5

SHA1
a7b26e559e082d65c2ffbea373e6b14c754a6208

SHA256
8fcd9cd11fe860b1c54d3569a803d32cb5b04322c7a6647212e2ffd54bcdf3ed

SHA512
b02fb7c7d07f286fecd4599d627201ab42be02844ee38570c25385b6374e570c3156486895ed85684287d7b11f2b6ba082ce569ef7227a1b8c4e769bff6e3560

Download Submit
C:\Windows\System\aaSbpZW.exe

Filesize
1.9MB

MD5
989645758487fb5de77e380f071fb7cc

SHA1
f05b14cf81187e7e291d3832788686d7cce68c7f

SHA256
b711e4c856c9248590db7d8470665ae1f66e0efde0e6e3e06feb5aa3eb48b756

SHA512
6a5266061fa47b9e094aaf5a588c75a5346b7a5da122a10346706e9c38eb4bfcca6625e0619f060fa2d4c012221b565cc32f548554f74a1b2eb49aa07d55187a

Download Submit
C:\Windows\System\ajRxkPU.exe

Filesize
1.9MB

MD5
9a1b65bfc87809d6b424a80c86307503

SHA1
0eff0c1362da35100afdfbda013921096d0ee792

SHA256
2fa475cab76c76e925ff89f89a93a309a81bc6f1d568d1d7b164d6e933167ed2

SHA512
b53e40430d0b327cad77381aa74f4f6568461b7f15c1e8dba53d3ee825f17e353d87ee96b0bf39f637c6f9338e1b2002e3002c134e131be52f39c3128c6f88da

Download Submit
C:\Windows\System\bCVaxeQ.exe

Filesize
1.9MB

MD5
0356e856aa3e3be3273a414d50828411

SHA1
b1e539ff65a77eec751a661ad3d6c5d5aa4ee66e

SHA256
adf2086faf100bf8f90127b01e117355a10d7f0453bb2e99d846c32bca2a38cc

SHA512
fbb74280a4feccb902c2e3747639d040d16619c9b00734c2f83ca0e937a88085ba8007f8544cf88acadd30d0a271e3322c1c01fc00b5bb076ecee5139e276b18

Download Submit
C:\Windows\System\bSOiuqG.exe

Filesize
1.9MB

MD5
917b430338b753d455983294f08bc34c

SHA1
709d5ff0810218851f20d29d0ea759c0984f5e1f

SHA256
ed9cd3312adc7abeeccdb5388311fef603e204797cea24a95f408fe0bef66859

SHA512
c8fa3d2a56a44866242127bf9d3cd8c780227a2bd1712636d6e228cbf1ee3b5de884e7f546993c9de5a7b0f3d2c0eb0dc83de79eea8a673b2c3fd9a887364691

Download Submit
C:\Windows\System\bXBMPCh.exe

Filesize
1.9MB

MD5
65cc51386ada3f354bac5af3737184ba

SHA1
3322b066bfa32cfe2891491b62945a2ae2377c35

SHA256
f4f6dacc765c94b3c39d9ee6f06755e925d8e632a27c505a2d40aba43ca271c0

SHA512
861321b008791ecb93ae466ce09c079fdee15bd9bba6184d8ef4141bafe66beace99384c5a5caac5af2631856bb292c4c9e6149e48885d6acf5e0c8d45a25017

Download Submit
C:\Windows\System\cumoQOw.exe

Filesize
1.9MB

MD5
905b19b28b9fa18ae17b24358470d6a3

SHA1
4c7b5b59d735c0fc839afd79047cb6ab91c29d76

SHA256
12868f9b65ce3abfdf7c33c8b3cfec63da61c637d15f701690f20ba40f054bcb

SHA512
4da338565928beb5178044be29fd897d6117f37d158bbb160478a18578614edbdcc2282449cce66f3a182d30d8497d52947fa2f6322c364caa80dbe4fbb01c75

Download Submit
C:\Windows\System\gHFKtIh.exe

Filesize
1.9MB

MD5
3802eed5bf0522c00dba66dfa5ed6541

SHA1
d580b1ac7d33f6a48cfe6cf26714060d2a86c9bd

SHA256
ae51511f0709c15653d7db082c040e9a6596d88093a7cecb678996a478f7f0da

SHA512
7157aa085e6817b647f312937fcd687c65e75a28a32a94f945869fa9a307d9cdb2044d9db63811ddb9635a2439aa38a6486ce42ed64830f4c61d3c47449a0486

Download Submit
C:\Windows\System\kAuLIMC.exe

Filesize
1.9MB

MD5
83c71511983739bc86689c10e7c44000

SHA1
5d96e3a118bc9ea13c35281e2d147ac451cde333

SHA256
d366b7523d984b2177557b8e213798fc0e222041f9c87bee997abc2c30bf58bb

SHA512
edbfde4f90662575847c07c8f31bfe2ecbcb4829109668f7722d9acd5ac2b32f4f71c9252a1f8e5ded9cf4bf2a22e7d3589cf728d20d637e38682ab6a8189bd6

Download Submit
C:\Windows\System\kCuqUnH.exe

Filesize
1.9MB

MD5
9f978cbe1696fe3b3999eecd2a19395a

SHA1
5e447e3d689d9a5a0e8f6fa349ea0b83aab84e31

SHA256
ae38ab79471202536e0c55b56f9788406867cd60bc07a81fb3b399a787738bbb

SHA512
065f38316225e24f7548e6b72ea8e371cf2e8697f744b6dbe6c10ef13bcf08b2e707d78dddf2b36164333ad5042e376c3368c626ae65422c82d256939fab763f

Download Submit
C:\Windows\System\llPaPRb.exe

Filesize
1.9MB

MD5
393aba389d56e3e45206cba6fb3570d6

SHA1
21d1198c5173b6682c5a02a4b856e86b12d67e0f

SHA256
9d1e411017ddd047202898641ca6793b982b4fe291ee5fba555a417d6a75c7c4

SHA512
76905b5426e68e1e0c8b6f942e5b75fb910f8424b725cd63cd0d6f6b635f619fbeae300640929d5e7093103a8654e2254545a3700c7bb20b61f221584e19defe

Download Submit
C:\Windows\System\nOCzSII.exe

Filesize
1.9MB

MD5
af7a56993c0a986e6e3c739b9975ada7

SHA1
98118715e224518a21fa186b1ed5b8997af89e47

SHA256
15b3c63ee77b48e2b2a3bea728d6362348ca17e71c27a54bf5d8466f7be0fd30

SHA512
f3d8ef0ba4ff963ab7332251e13a1f713a6f67f0af045aa5e0122c8e45c502698c503daf937c062b42bba567dd5d286e19590c81620dc7b75a747d89ed3b5639

Download Submit
C:\Windows\System\nukESeq.exe

Filesize
1.9MB

MD5
de21ec4af46d17c85f79ea8b89faab6a

SHA1
e12d48d7b9e4f6481b4cb7d89db7a1e8043049ca

SHA256
adc753f1b3d28cd0bd84dd85a1220b6b06ba6397a5e36d7aa89c63580df06cc4

SHA512
0a233f79d13210bd492093749525145b40cae6069d9612b1375eb1f0e09fcd0f5fb6ce872d405ca4a8ba7e91986e0e5455a53c4c93eb1136f3e4e286d71585ed

Download Submit
C:\Windows\System\spBHhtl.exe

Filesize
1.9MB

MD5
238fba356cda665af84e60f6945eb7a9

SHA1
1a14a227a7bcf5ea299eec63918de3a72d851d0a

SHA256
5eb65ceaafe6a0e8b456165bf2a0ed50882eeb12ee9551fa744117b01202e9af

SHA512
2d9022e303cffb3ff0a07dacee1e36594b650dca5065727aaf748a4516753109a29729e6cd7d9209b9ca3a5d08e6fe2e8ef1cfbac1a7bea41c96c1746a6294e9

Download Submit
C:\Windows\System\tWpBbxt.exe

Filesize
1.9MB

MD5
37e24395da6ae06e7a728a9d7e59012c

SHA1
bdf25f259b757e6fc717191981f5d04ef3dcc49d

SHA256
bae7edde56999cb3cf0c2d77b6bb5f0efae0929f3d23af4750e82a779521edb6

SHA512
2ce6ee6cac72e1853912aa50c029da1bb09827db8887cb5a04c0e72061d1eec90acfb8e09d7731e63d7b8b52caae76aa06b0d17fa8ab48984c0b32a27db34e76

Download Submit
C:\Windows\System\vWnflBI.exe

Filesize
1.9MB

MD5
047d162019c9a18b0d0b04462715a1b1

SHA1
ff356f1a21c3222eb5c197ba21b21fb424c755f8

SHA256
2053f90600971d0dd35b6f13a2eba0caa875490a2e639d231d1a45b1d63f6494

SHA512
84e1e5dbc60466eb4e9ea363da9ee5cb75548bbf0a3cb11935f29596b51ffa67f90966ff0877a4e736c7636b3bec43f19040dabe920216b58a64cb5c2a12b0dc

Download Submit
C:\Windows\System\wQaUCfn.exe

Filesize
1.9MB

MD5
4be59ea9d32318202bbf1a10a4e6dc70

SHA1
6f00e7d9c321abe1cb6f6226e7d134784035b9a0

SHA256
1aa3c98c2832a45cd6ab147a38031bfba42b4b12fa48d2793c8f84b3779d5913

SHA512
b252fedcb11d6e0dc564db55f4baeb38fb51e42406d699baf9ac8c5579409f1c0c76a90199f591d7fdadd1727961a610e8c2ebe9cd7d0a7c94069a171281e0c5

Download Submit
C:\Windows\System\wrvZkKk.exe

Filesize
1.9MB

MD5
5074217c496ede5a6682217c22faf088

SHA1
f03f8a7266a3a023530220c65dc533e8f1159bc4

SHA256
1298147572f5d8f1e384af209bfc745d2e94bf70b86e0c0f6deefaa3540ec0f3

SHA512
1ffceee0c44d2cc55dce5b22fce2523df14c3e4a340c76e4627925f1ac8e1437eb321a84ceb82447da24b1607f1a1edbb08564d196d8c9ba3e4619267c84dc32

Download Submit
C:\Windows\System\xuhZEzW.exe

Filesize
1.9MB

MD5
ab7e9c153d7cf99319b07e67e6c28c56

SHA1
1d08ddab34305c65a62d232945ae4f31dd0e826a

SHA256
b4c9f2291cbb8197489d3af3b35e8d07df217637659a6b2d33b8163ce4adfbef

SHA512
5144277c5a17487030d0f79369330201d08376f820b24ef44631094885053f54a7cb6b8160adb1a34841925329f32219ed42f0dc68a72daef1f8321e5858ffbf

Download Submit
memory/348-2131-0x00007FF6261A0000-0x00007FF6264F4000-memory.dmp

Filesize
3.3MB

Download
memory/348-57-0x00007FF6261A0000-0x00007FF6264F4000-memory.dmp

Filesize
3.3MB

Download
memory/748-2154-0x00007FF6C4D80000-0x00007FF6C50D4000-memory.dmp

Filesize
3.3MB

Download
memory/748-2123-0x00007FF6C4D80000-0x00007FF6C50D4000-memory.dmp

Filesize
3.3MB

Download
memory/748-69-0x00007FF6C4D80000-0x00007FF6C50D4000-memory.dmp

Filesize
3.3MB

Download
memory/1128-2127-0x00007FF7F2DB0000-0x00007FF7F3104000-memory.dmp

Filesize
3.3MB

Download
memory/1128-19-0x00007FF7F2DB0000-0x00007FF7F3104000-memory.dmp

Filesize
3.3MB

Download
memory/1128-1779-0x00007FF7F2DB0000-0x00007FF7F3104000-memory.dmp

Filesize
3.3MB

Download
memory/1144-1774-0x00007FF669530000-0x00007FF669884000-memory.dmp

Filesize
3.3MB

Download
memory/1144-1-0x000002A595430000-0x000002A595440000-memory.dmp

Filesize
64KB

Download
memory/1144-0-0x00007FF669530000-0x00007FF669884000-memory.dmp

Filesize
3.3MB

Download
memory/1464-2143-0x00007FF6079D0000-0x00007FF607D24000-memory.dmp

Filesize
3.3MB

Download
memory/1464-148-0x00007FF6079D0000-0x00007FF607D24000-memory.dmp

Filesize
3.3MB

Download
memory/1492-6-0x00007FF616230000-0x00007FF616584000-memory.dmp

Filesize
3.3MB

Download
memory/1492-2126-0x00007FF616230000-0x00007FF616584000-memory.dmp

Filesize
3.3MB

Download
memory/1492-2120-0x00007FF616230000-0x00007FF616584000-memory.dmp

Filesize
3.3MB

Download
memory/1532-201-0x00007FF73CE40000-0x00007FF73D194000-memory.dmp

Filesize
3.3MB

Download
memory/1532-2151-0x00007FF73CE40000-0x00007FF73D194000-memory.dmp

Filesize
3.3MB

Download
memory/1620-166-0x00007FF716B10000-0x00007FF716E64000-memory.dmp

Filesize
3.3MB

Download
memory/1620-2152-0x00007FF716B10000-0x00007FF716E64000-memory.dmp

Filesize
3.3MB

Download
memory/1664-2138-0x00007FF615960000-0x00007FF615CB4000-memory.dmp

Filesize
3.3MB

Download
memory/1664-131-0x00007FF615960000-0x00007FF615CB4000-memory.dmp

Filesize
3.3MB

Download
memory/1872-183-0x00007FF65D000000-0x00007FF65D354000-memory.dmp

Filesize
3.3MB

Download
memory/1872-2149-0x00007FF65D000000-0x00007FF65D354000-memory.dmp

Filesize
3.3MB

Download
memory/1888-2148-0x00007FF7D41A0000-0x00007FF7D44F4000-memory.dmp

Filesize
3.3MB

Download
memory/1888-172-0x00007FF7D41A0000-0x00007FF7D44F4000-memory.dmp

Filesize
3.3MB

Download
memory/2312-2153-0x00007FF7DC230000-0x00007FF7DC584000-memory.dmp

Filesize
3.3MB

Download
memory/2312-205-0x00007FF7DC230000-0x00007FF7DC584000-memory.dmp

Filesize
3.3MB

Download
memory/2396-2142-0x00007FF6C5920000-0x00007FF6C5C74000-memory.dmp

Filesize
3.3MB

Download
memory/2396-142-0x00007FF6C5920000-0x00007FF6C5C74000-memory.dmp

Filesize
3.3MB

Download
memory/2648-2132-0x00007FF7B5740000-0x00007FF7B5A94000-memory.dmp

Filesize
3.3MB

Download
memory/2648-61-0x00007FF7B5740000-0x00007FF7B5A94000-memory.dmp

Filesize
3.3MB

Download
memory/2968-73-0x00007FF627620000-0x00007FF627974000-memory.dmp

Filesize
3.3MB

Download
memory/2968-2136-0x00007FF627620000-0x00007FF627974000-memory.dmp

Filesize
3.3MB

Download
memory/2980-79-0x00007FF6BCA60000-0x00007FF6BCDB4000-memory.dmp

Filesize
3.3MB

Download
memory/2980-2137-0x00007FF6BCA60000-0x00007FF6BCDB4000-memory.dmp

Filesize
3.3MB

Download
memory/3132-2147-0x00007FF7F9770000-0x00007FF7F9AC4000-memory.dmp

Filesize
3.3MB

Download
memory/3132-189-0x00007FF7F9770000-0x00007FF7F9AC4000-memory.dmp

Filesize
3.3MB

Download
memory/3144-102-0x00007FF755DC0000-0x00007FF756114000-memory.dmp

Filesize
3.3MB

Download
memory/3144-2140-0x00007FF755DC0000-0x00007FF756114000-memory.dmp

Filesize
3.3MB

Download
memory/3144-2124-0x00007FF755DC0000-0x00007FF756114000-memory.dmp

Filesize
3.3MB

Download
memory/3180-125-0x00007FF67ABD0000-0x00007FF67AF24000-memory.dmp

Filesize
3.3MB

Download
memory/3180-2141-0x00007FF67ABD0000-0x00007FF67AF24000-memory.dmp

Filesize
3.3MB

Download
memory/3572-2139-0x00007FF6AC9B0000-0x00007FF6ACD04000-memory.dmp

Filesize
3.3MB

Download
memory/3572-119-0x00007FF6AC9B0000-0x00007FF6ACD04000-memory.dmp

Filesize
3.3MB

Download
memory/3708-2121-0x00007FF7FBF10000-0x00007FF7FC264000-memory.dmp

Filesize
3.3MB

Download
memory/3708-45-0x00007FF7FBF10000-0x00007FF7FC264000-memory.dmp

Filesize
3.3MB

Download
memory/3708-2133-0x00007FF7FBF10000-0x00007FF7FC264000-memory.dmp

Filesize
3.3MB

Download
memory/3868-197-0x00007FF77E7D0000-0x00007FF77EB24000-memory.dmp

Filesize
3.3MB

Download
memory/3868-2146-0x00007FF77E7D0000-0x00007FF77EB24000-memory.dmp

Filesize
3.3MB

Download
memory/3968-2144-0x00007FF7AB8F0000-0x00007FF7ABC44000-memory.dmp

Filesize
3.3MB

Download
memory/3968-108-0x00007FF7AB8F0000-0x00007FF7ABC44000-memory.dmp

Filesize
3.3MB

Download
memory/3968-2125-0x00007FF7AB8F0000-0x00007FF7ABC44000-memory.dmp

Filesize
3.3MB

Download
memory/3972-2134-0x00007FF7F9040000-0x00007FF7F9394000-memory.dmp

Filesize
3.3MB

Download
memory/3972-96-0x00007FF7F9040000-0x00007FF7F9394000-memory.dmp

Filesize
3.3MB

Download
memory/4140-2128-0x00007FF68CDB0000-0x00007FF68D104000-memory.dmp

Filesize
3.3MB

Download
memory/4140-2122-0x00007FF68CDB0000-0x00007FF68D104000-memory.dmp

Filesize
3.3MB

Download
memory/4140-33-0x00007FF68CDB0000-0x00007FF68D104000-memory.dmp

Filesize
3.3MB

Download
memory/4448-85-0x00007FF6146D0000-0x00007FF614A24000-memory.dmp

Filesize
3.3MB

Download
memory/4448-2135-0x00007FF6146D0000-0x00007FF614A24000-memory.dmp

Filesize
3.3MB

Download
memory/4460-2129-0x00007FF61ADB0000-0x00007FF61B104000-memory.dmp

Filesize
3.3MB

Download
memory/4460-52-0x00007FF61ADB0000-0x00007FF61B104000-memory.dmp

Filesize
3.3MB

Download
memory/4520-53-0x00007FF665FA0000-0x00007FF6662F4000-memory.dmp

Filesize
3.3MB

Download
memory/4520-2130-0x00007FF665FA0000-0x00007FF6662F4000-memory.dmp

Filesize
3.3MB

Download
memory/4928-2145-0x00007FF717F40000-0x00007FF718294000-memory.dmp

Filesize
3.3MB

Download
memory/4928-154-0x00007FF717F40000-0x00007FF718294000-memory.dmp

Filesize
3.3MB

Download
memory/4972-2150-0x00007FF6CDEF0000-0x00007FF6CE244000-memory.dmp

Filesize
3.3MB

Download
memory/4972-160-0x00007FF6CDEF0000-0x00007FF6CE244000-memory.dmp

Filesize
3.3MB

Download