xmrig | 58c474a663626806a04966c567ed9baad7a0d14a3b94df7498c4904bbe57345a

Analysis

max time kernel
33s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 21:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
Size

1.5MB
MD5

42ecb8b294336fe21cacc7e436a9e990
SHA1

570b55e9d8500ea4c34cd1f81473aff63f59c388
SHA256

58c474a663626806a04966c567ed9baad7a0d14a3b94df7498c4904bbe57345a
SHA512

048d8eac20822143ebd74f85355b33c195082b3ece906403368bea001e74466cda8fcd8dff63905a125491c62f1f3161ce81385c51289749a68aff8c78eaa519
SSDEEP

24576:zv3/fTLF671TilQFG4P5PmK/lzapbU4w2DyA7lO1eANsT4kwu04a/6eGmsP:Lz071uv4BPm6lgVJUwAdZGvP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 45 IoCs

miner

resource	yara_rule
behavioral2/memory/1860-41-0x00007FF6A5D30000-0x00007FF6A6122000-memory.dmp	xmrig
behavioral2/memory/5016-42-0x00007FF6E19F0000-0x00007FF6E1DE2000-memory.dmp	xmrig
behavioral2/memory/1088-43-0x00007FF787A80000-0x00007FF787E72000-memory.dmp	xmrig
behavioral2/memory/3112-44-0x00007FF68AF20000-0x00007FF68B312000-memory.dmp	xmrig
behavioral2/memory/3668-45-0x00007FF660220000-0x00007FF660612000-memory.dmp	xmrig
behavioral2/memory/2608-63-0x00007FF7B1560000-0x00007FF7B1952000-memory.dmp	xmrig
behavioral2/memory/760-73-0x00007FF65F3D0000-0x00007FF65F7C2000-memory.dmp	xmrig
behavioral2/memory/4848-102-0x00007FF75F2D0000-0x00007FF75F6C2000-memory.dmp	xmrig
behavioral2/memory/2840-139-0x00007FF7A48D0000-0x00007FF7A4CC2000-memory.dmp	xmrig
behavioral2/memory/1892-142-0x00007FF660500000-0x00007FF6608F2000-memory.dmp	xmrig
behavioral2/memory/4892-160-0x00007FF7AF640000-0x00007FF7AFA32000-memory.dmp	xmrig
behavioral2/memory/2288-197-0x00007FF68A8A0000-0x00007FF68AC92000-memory.dmp	xmrig
behavioral2/memory/4516-169-0x00007FF7C3510000-0x00007FF7C3902000-memory.dmp	xmrig
behavioral2/memory/4848-156-0x00007FF75F2D0000-0x00007FF75F6C2000-memory.dmp	xmrig
behavioral2/memory/4108-141-0x00007FF6EB200000-0x00007FF6EB5F2000-memory.dmp	xmrig
behavioral2/memory/3604-140-0x00007FF7C2980000-0x00007FF7C2D72000-memory.dmp	xmrig
behavioral2/memory/876-128-0x00007FF649C90000-0x00007FF64A082000-memory.dmp	xmrig
behavioral2/memory/4736-118-0x00007FF6CE380000-0x00007FF6CE772000-memory.dmp	xmrig
behavioral2/memory/4472-115-0x00007FF71F280000-0x00007FF71F672000-memory.dmp	xmrig
behavioral2/memory/2460-101-0x00007FF74E000000-0x00007FF74E3F2000-memory.dmp	xmrig
behavioral2/memory/496-89-0x00007FF70CBF0000-0x00007FF70CFE2000-memory.dmp	xmrig
behavioral2/memory/3668-1705-0x00007FF660220000-0x00007FF660612000-memory.dmp	xmrig
behavioral2/memory/1860-1746-0x00007FF6A5D30000-0x00007FF6A6122000-memory.dmp	xmrig
behavioral2/memory/3112-1765-0x00007FF68AF20000-0x00007FF68B312000-memory.dmp	xmrig
behavioral2/memory/1088-1760-0x00007FF787A80000-0x00007FF787E72000-memory.dmp	xmrig
behavioral2/memory/5016-1761-0x00007FF6E19F0000-0x00007FF6E1DE2000-memory.dmp	xmrig
behavioral2/memory/2208-2071-0x00007FF6732A0000-0x00007FF673692000-memory.dmp	xmrig
behavioral2/memory/3036-2075-0x00007FF730F40000-0x00007FF731332000-memory.dmp	xmrig
behavioral2/memory/760-2097-0x00007FF65F3D0000-0x00007FF65F7C2000-memory.dmp	xmrig
behavioral2/memory/2460-2099-0x00007FF74E000000-0x00007FF74E3F2000-memory.dmp	xmrig
behavioral2/memory/4472-2101-0x00007FF71F280000-0x00007FF71F672000-memory.dmp	xmrig
behavioral2/memory/2608-2104-0x00007FF7B1560000-0x00007FF7B1952000-memory.dmp	xmrig
behavioral2/memory/496-2117-0x00007FF70CBF0000-0x00007FF70CFE2000-memory.dmp	xmrig
behavioral2/memory/2840-2113-0x00007FF7A48D0000-0x00007FF7A4CC2000-memory.dmp	xmrig
behavioral2/memory/4108-2122-0x00007FF6EB200000-0x00007FF6EB5F2000-memory.dmp	xmrig
behavioral2/memory/1892-2121-0x00007FF660500000-0x00007FF6608F2000-memory.dmp	xmrig
behavioral2/memory/1372-2119-0x00007FF7FB0F0000-0x00007FF7FB4E2000-memory.dmp	xmrig
behavioral2/memory/876-2115-0x00007FF649C90000-0x00007FF64A082000-memory.dmp	xmrig
behavioral2/memory/4736-2111-0x00007FF6CE380000-0x00007FF6CE772000-memory.dmp	xmrig
behavioral2/memory/3604-2109-0x00007FF7C2980000-0x00007FF7C2D72000-memory.dmp	xmrig
behavioral2/memory/5004-2173-0x00007FF6468D0000-0x00007FF646CC2000-memory.dmp	xmrig
behavioral2/memory/4516-2174-0x00007FF7C3510000-0x00007FF7C3902000-memory.dmp	xmrig
behavioral2/memory/3740-2144-0x00007FF7A0E30000-0x00007FF7A1222000-memory.dmp	xmrig
behavioral2/memory/4892-2140-0x00007FF7AF640000-0x00007FF7AFA32000-memory.dmp	xmrig
behavioral2/memory/2288-2199-0x00007FF68A8A0000-0x00007FF68AC92000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	1420	powershell.exe
11	1420	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1420	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3668	FjSDnpf.exe
1860	aFvzXAB.exe
5016	ZKxAuCh.exe
1088	iogHFJc.exe
3112	kTSqcAr.exe
2208	KPrIQsS.exe
3036	FgEMiac.exe
2608	QUbfpya.exe
760	uIhdkiV.exe
496	EeauXvb.exe
2460	ztfTwDJ.exe
876	OjzSeCM.exe
2840	fnrwrhm.exe
4472	zzTWjZd.exe
4736	lWTCTqI.exe
3604	CXvUKTe.exe
4108	OQxBlkQ.exe
1892	hfpVjqj.exe
1372	tGDyzuz.exe
4892	HXUNaJL.exe
3740	oEdVJxd.exe
5004	UHSXBwC.exe
4516	ZsvgsWg.exe
2288	PTeAFTR.exe
4460	FHvIfcY.exe
1796	rGgryIg.exe
5084	FwOyPUX.exe
2836	rfNBNDF.exe
3976	gSxyoLE.exe
1516	lnDCliP.exe
3980	icvtdVe.exe
1432	NqYDYCY.exe
4744	AsYpvfn.exe
1944	pCCXLaY.exe
2104	qrpJTmO.exe
2028	IsTdYxw.exe
1292	HdzzhDR.exe
788	hhIfKKq.exe
4584	TiGbAVq.exe
4008	LimyBAQ.exe
4408	SYODpeX.exe
3224	RVdTung.exe
4068	EmhWjnQ.exe
1068	xCiWJVK.exe
3616	PjizmGA.exe
4780	GmKqRnX.exe
4352	uOGDovt.exe
4844	NZWbabl.exe
4236	OJYSLpZ.exe
4372	bIOSIpC.exe
3084	yMVhRuQ.exe
2696	MEmbeGl.exe
3540	kGmEOST.exe
4048	EkwRGNT.exe
1556	YhjByXX.exe
3992	sAiUhhn.exe
552	OzABJct.exe
2312	vXxWOBd.exe
684	qLczjZj.exe
2024	OiMBlKX.exe
4396	jmYbjcy.exe
4412	HHgMyPa.exe
3852	wjbZxBg.exe
900	Ltkglwj.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4848-0-0x00007FF75F2D0000-0x00007FF75F6C2000-memory.dmp	upx
behavioral2/files/0x0008000000023257-6.dat	upx
behavioral2/files/0x000900000002325c-10.dat	upx
behavioral2/files/0x000700000002325d-8.dat	upx
behavioral2/files/0x000700000002325e-30.dat	upx
behavioral2/files/0x0007000000023261-36.dat	upx
behavioral2/memory/1860-41-0x00007FF6A5D30000-0x00007FF6A6122000-memory.dmp	upx
behavioral2/memory/5016-42-0x00007FF6E19F0000-0x00007FF6E1DE2000-memory.dmp	upx
behavioral2/memory/1088-43-0x00007FF787A80000-0x00007FF787E72000-memory.dmp	upx
behavioral2/memory/3112-44-0x00007FF68AF20000-0x00007FF68B312000-memory.dmp	upx
behavioral2/memory/3668-45-0x00007FF660220000-0x00007FF660612000-memory.dmp	upx
behavioral2/files/0x0008000000023260-50.dat	upx
behavioral2/files/0x000800000002325b-51.dat	upx
behavioral2/memory/2208-55-0x00007FF6732A0000-0x00007FF673692000-memory.dmp	upx
behavioral2/memory/3036-56-0x00007FF730F40000-0x00007FF731332000-memory.dmp	upx
behavioral2/files/0x000800000002325f-59.dat	upx
behavioral2/memory/2608-63-0x00007FF7B1560000-0x00007FF7B1952000-memory.dmp	upx
behavioral2/files/0x0007000000023262-66.dat	upx
behavioral2/files/0x0007000000023264-74.dat	upx
behavioral2/files/0x0007000000023263-75.dat	upx
behavioral2/memory/760-73-0x00007FF65F3D0000-0x00007FF65F7C2000-memory.dmp	upx
behavioral2/files/0x0007000000023265-80.dat	upx
behavioral2/files/0x0007000000023266-92.dat	upx
behavioral2/files/0x0007000000023267-93.dat	upx
behavioral2/memory/4848-102-0x00007FF75F2D0000-0x00007FF75F6C2000-memory.dmp	upx
behavioral2/files/0x000700000002326a-105.dat	upx
behavioral2/files/0x000700000002326d-117.dat	upx
behavioral2/files/0x0007000000023270-132.dat	upx
behavioral2/memory/2840-139-0x00007FF7A48D0000-0x00007FF7A4CC2000-memory.dmp	upx
behavioral2/memory/1892-142-0x00007FF660500000-0x00007FF6608F2000-memory.dmp	upx
behavioral2/memory/3740-145-0x00007FF7A0E30000-0x00007FF7A1222000-memory.dmp	upx
behavioral2/memory/4892-160-0x00007FF7AF640000-0x00007FF7AFA32000-memory.dmp	upx
behavioral2/files/0x0007000000023272-165.dat	upx
behavioral2/files/0x0007000000023274-173.dat	upx
behavioral2/files/0x0007000000023277-184.dat	upx
behavioral2/files/0x0007000000023275-194.dat	upx
behavioral2/files/0x0007000000023278-204.dat	upx
behavioral2/files/0x000700000002327a-210.dat	upx
behavioral2/files/0x0007000000023279-208.dat	upx
behavioral2/files/0x0007000000023276-200.dat	upx
behavioral2/memory/2288-197-0x00007FF68A8A0000-0x00007FF68AC92000-memory.dmp	upx
behavioral2/files/0x0007000000023273-174.dat	upx
behavioral2/memory/4516-169-0x00007FF7C3510000-0x00007FF7C3902000-memory.dmp	upx
behavioral2/files/0x0007000000023271-157.dat	upx
behavioral2/memory/4848-156-0x00007FF75F2D0000-0x00007FF75F6C2000-memory.dmp	upx
behavioral2/files/0x000700000002326f-150.dat	upx
behavioral2/memory/5004-146-0x00007FF6468D0000-0x00007FF646CC2000-memory.dmp	upx
behavioral2/files/0x000700000002326e-148.dat	upx
behavioral2/memory/4108-141-0x00007FF6EB200000-0x00007FF6EB5F2000-memory.dmp	upx
behavioral2/memory/3604-140-0x00007FF7C2980000-0x00007FF7C2D72000-memory.dmp	upx
behavioral2/files/0x000700000002326c-129.dat	upx
behavioral2/memory/876-128-0x00007FF649C90000-0x00007FF64A082000-memory.dmp	upx
behavioral2/files/0x000700000002326b-120.dat	upx
behavioral2/memory/1372-119-0x00007FF7FB0F0000-0x00007FF7FB4E2000-memory.dmp	upx
behavioral2/memory/4736-118-0x00007FF6CE380000-0x00007FF6CE772000-memory.dmp	upx
behavioral2/memory/4472-115-0x00007FF71F280000-0x00007FF71F672000-memory.dmp	upx
behavioral2/memory/2460-101-0x00007FF74E000000-0x00007FF74E3F2000-memory.dmp	upx
behavioral2/files/0x0007000000023269-97.dat	upx
behavioral2/memory/496-89-0x00007FF70CBF0000-0x00007FF70CFE2000-memory.dmp	upx
behavioral2/memory/3668-1705-0x00007FF660220000-0x00007FF660612000-memory.dmp	upx
behavioral2/memory/1860-1746-0x00007FF6A5D30000-0x00007FF6A6122000-memory.dmp	upx
behavioral2/memory/3112-1765-0x00007FF68AF20000-0x00007FF68B312000-memory.dmp	upx
behavioral2/memory/1088-1760-0x00007FF787A80000-0x00007FF787E72000-memory.dmp	upx
behavioral2/memory/5016-1761-0x00007FF6E19F0000-0x00007FF6E1DE2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\lnDCliP.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\CqqEYok.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\hiuAwsC.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\hhIfKKq.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\uOGDovt.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\CwwtWFQ.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\mzjiEfK.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\wtDGaye.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\LWCHlRN.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\BMvipBk.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\BpdlKLR.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\FdfdAYf.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\vXxWOBd.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\rZWGjvl.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\UFLqeAR.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\HcnHVqb.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\FBVwWdW.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\TQwWKQf.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\dDKikuU.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\HdzzhDR.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\NZWbabl.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\OiMBlKX.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\ZJicccF.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\XiJbSnz.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\YsybOgk.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\SWALLnk.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\rkStsHy.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\xCiWJVK.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\QOfGKxJ.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\bhFaMuR.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\JglMMYo.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\QyFYZDn.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\eCHcfVP.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\wHqMflk.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\EkXPzMJ.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\dBXuLJJ.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\QaKjzyu.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\ItWYPEh.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\gojwvES.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\mjBftdx.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\OBuSYdN.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\QvtFWlF.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\xSLIoMg.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\yipWIwT.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\cCsovtj.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\zOPayiT.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\osHlFsZ.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\MFUaeHY.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\WrtrdVh.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\DtpmiCU.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\mYTnjHX.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\MxBIrTH.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\GppKkHx.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\mbZcSTa.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\mxQcpsn.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\XaIiPdh.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\FgRndvt.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\FZCXeOv.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\lDOFaZx.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\oEdVJxd.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\NqYDYCY.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\jKEzFee.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\xovCDqD.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\TstlHfc.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1420	powershell.exe
1420	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
Token: SeDebugPrivilege	1420	powershell.exe
Token: SeLockMemoryPrivilege	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 1420	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	91
PID 4848 wrote to memory of 1420	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	91
PID 4848 wrote to memory of 3668	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	92
PID 4848 wrote to memory of 3668	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	92
PID 4848 wrote to memory of 1860	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	93
PID 4848 wrote to memory of 1860	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	93
PID 4848 wrote to memory of 5016	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	94
PID 4848 wrote to memory of 5016	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	94
PID 4848 wrote to memory of 1088	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	95
PID 4848 wrote to memory of 1088	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	95
PID 4848 wrote to memory of 3112	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	96
PID 4848 wrote to memory of 3112	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	96
PID 4848 wrote to memory of 2208	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	97
PID 4848 wrote to memory of 2208	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	97
PID 4848 wrote to memory of 3036	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	98
PID 4848 wrote to memory of 3036	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	98
PID 4848 wrote to memory of 2608	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	99
PID 4848 wrote to memory of 2608	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	99
PID 4848 wrote to memory of 760	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	100
PID 4848 wrote to memory of 760	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	100
PID 4848 wrote to memory of 2460	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	101
PID 4848 wrote to memory of 2460	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	101
PID 4848 wrote to memory of 496	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	102
PID 4848 wrote to memory of 496	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	102
PID 4848 wrote to memory of 876	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	103
PID 4848 wrote to memory of 876	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	103
PID 4848 wrote to memory of 2840	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	104
PID 4848 wrote to memory of 2840	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	104
PID 4848 wrote to memory of 4472	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	105
PID 4848 wrote to memory of 4472	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	105
PID 4848 wrote to memory of 4736	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	106
PID 4848 wrote to memory of 4736	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	106
PID 4848 wrote to memory of 3604	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	107
PID 4848 wrote to memory of 3604	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	107
PID 4848 wrote to memory of 4108	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	108
PID 4848 wrote to memory of 4108	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	108
PID 4848 wrote to memory of 1892	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	109
PID 4848 wrote to memory of 1892	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	109
PID 4848 wrote to memory of 1372	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	110
PID 4848 wrote to memory of 1372	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	110
PID 4848 wrote to memory of 4892	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	111
PID 4848 wrote to memory of 4892	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	111
PID 4848 wrote to memory of 3740	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	112
PID 4848 wrote to memory of 3740	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	112
PID 4848 wrote to memory of 5004	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	113
PID 4848 wrote to memory of 5004	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	113
PID 4848 wrote to memory of 4516	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	114
PID 4848 wrote to memory of 4516	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	114
PID 4848 wrote to memory of 2288	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	115
PID 4848 wrote to memory of 2288	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	115
PID 4848 wrote to memory of 4460	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	116
PID 4848 wrote to memory of 4460	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	116
PID 4848 wrote to memory of 1796	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	117
PID 4848 wrote to memory of 1796	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	117
PID 4848 wrote to memory of 5084	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	118
PID 4848 wrote to memory of 5084	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	118
PID 4848 wrote to memory of 2836	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	119
PID 4848 wrote to memory of 2836	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	119
PID 4848 wrote to memory of 3976	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	120
PID 4848 wrote to memory of 3976	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	120
PID 4848 wrote to memory of 1516	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	121
PID 4848 wrote to memory of 1516	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	121
PID 4848 wrote to memory of 3980	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	122
PID 4848 wrote to memory of 3980	4848	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	122

C:\Users\Admin\AppData\Local\Temp\42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1420
- C:\Windows\System\FjSDnpf.exe
  C:\Windows\System\FjSDnpf.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\aFvzXAB.exe
  C:\Windows\System\aFvzXAB.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\ZKxAuCh.exe
  C:\Windows\System\ZKxAuCh.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\iogHFJc.exe
  C:\Windows\System\iogHFJc.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\kTSqcAr.exe
  C:\Windows\System\kTSqcAr.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\KPrIQsS.exe
  C:\Windows\System\KPrIQsS.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\FgEMiac.exe
  C:\Windows\System\FgEMiac.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\QUbfpya.exe
  C:\Windows\System\QUbfpya.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\uIhdkiV.exe
  C:\Windows\System\uIhdkiV.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\ztfTwDJ.exe
  C:\Windows\System\ztfTwDJ.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\EeauXvb.exe
  C:\Windows\System\EeauXvb.exe
  2⤵
  - Executes dropped EXE
  PID:496
- C:\Windows\System\OjzSeCM.exe
  C:\Windows\System\OjzSeCM.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\fnrwrhm.exe
  C:\Windows\System\fnrwrhm.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\zzTWjZd.exe
  C:\Windows\System\zzTWjZd.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\lWTCTqI.exe
  C:\Windows\System\lWTCTqI.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\CXvUKTe.exe
  C:\Windows\System\CXvUKTe.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\OQxBlkQ.exe
  C:\Windows\System\OQxBlkQ.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\hfpVjqj.exe
  C:\Windows\System\hfpVjqj.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\tGDyzuz.exe
  C:\Windows\System\tGDyzuz.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\HXUNaJL.exe
  C:\Windows\System\HXUNaJL.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\oEdVJxd.exe
  C:\Windows\System\oEdVJxd.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\UHSXBwC.exe
  C:\Windows\System\UHSXBwC.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\ZsvgsWg.exe
  C:\Windows\System\ZsvgsWg.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\PTeAFTR.exe
  C:\Windows\System\PTeAFTR.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\FHvIfcY.exe
  C:\Windows\System\FHvIfcY.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\rGgryIg.exe
  C:\Windows\System\rGgryIg.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\FwOyPUX.exe
  C:\Windows\System\FwOyPUX.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\rfNBNDF.exe
  C:\Windows\System\rfNBNDF.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\gSxyoLE.exe
  C:\Windows\System\gSxyoLE.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\lnDCliP.exe
  C:\Windows\System\lnDCliP.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\icvtdVe.exe
  C:\Windows\System\icvtdVe.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\NqYDYCY.exe
  C:\Windows\System\NqYDYCY.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\AsYpvfn.exe
  C:\Windows\System\AsYpvfn.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\pCCXLaY.exe
  C:\Windows\System\pCCXLaY.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\qrpJTmO.exe
  C:\Windows\System\qrpJTmO.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\IsTdYxw.exe
  C:\Windows\System\IsTdYxw.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\HdzzhDR.exe
  C:\Windows\System\HdzzhDR.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\hhIfKKq.exe
  C:\Windows\System\hhIfKKq.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\TiGbAVq.exe
  C:\Windows\System\TiGbAVq.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\LimyBAQ.exe
  C:\Windows\System\LimyBAQ.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\SYODpeX.exe
  C:\Windows\System\SYODpeX.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\RVdTung.exe
  C:\Windows\System\RVdTung.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\EmhWjnQ.exe
  C:\Windows\System\EmhWjnQ.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\xCiWJVK.exe
  C:\Windows\System\xCiWJVK.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\PjizmGA.exe
  C:\Windows\System\PjizmGA.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\GmKqRnX.exe
  C:\Windows\System\GmKqRnX.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\uOGDovt.exe
  C:\Windows\System\uOGDovt.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\NZWbabl.exe
  C:\Windows\System\NZWbabl.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\OJYSLpZ.exe
  C:\Windows\System\OJYSLpZ.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\bIOSIpC.exe
  C:\Windows\System\bIOSIpC.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\yMVhRuQ.exe
  C:\Windows\System\yMVhRuQ.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\MEmbeGl.exe
  C:\Windows\System\MEmbeGl.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\kGmEOST.exe
  C:\Windows\System\kGmEOST.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\EkwRGNT.exe
  C:\Windows\System\EkwRGNT.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\YhjByXX.exe
  C:\Windows\System\YhjByXX.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\sAiUhhn.exe
  C:\Windows\System\sAiUhhn.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\OzABJct.exe
  C:\Windows\System\OzABJct.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\vXxWOBd.exe
  C:\Windows\System\vXxWOBd.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\qLczjZj.exe
  C:\Windows\System\qLczjZj.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\OiMBlKX.exe
  C:\Windows\System\OiMBlKX.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\jmYbjcy.exe
  C:\Windows\System\jmYbjcy.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\HHgMyPa.exe
  C:\Windows\System\HHgMyPa.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\wjbZxBg.exe
  C:\Windows\System\wjbZxBg.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\Ltkglwj.exe
  C:\Windows\System\Ltkglwj.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\PxKuuQi.exe
  C:\Windows\System\PxKuuQi.exe
  2⤵
  PID:5128
- C:\Windows\System\eDdSRFz.exe
  C:\Windows\System\eDdSRFz.exe
  2⤵
  PID:5144
- C:\Windows\System\FIgxdqH.exe
  C:\Windows\System\FIgxdqH.exe
  2⤵
  PID:5168
- C:\Windows\System\jIXKaCC.exe
  C:\Windows\System\jIXKaCC.exe
  2⤵
  PID:5192
- C:\Windows\System\DtpmiCU.exe
  C:\Windows\System\DtpmiCU.exe
  2⤵
  PID:5248
- C:\Windows\System\vaxNjFJ.exe
  C:\Windows\System\vaxNjFJ.exe
  2⤵
  PID:5284
- C:\Windows\System\DkbkxPp.exe
  C:\Windows\System\DkbkxPp.exe
  2⤵
  PID:5308
- C:\Windows\System\LWCHlRN.exe
  C:\Windows\System\LWCHlRN.exe
  2⤵
  PID:5328
- C:\Windows\System\UFPNAgm.exe
  C:\Windows\System\UFPNAgm.exe
  2⤵
  PID:5352
- C:\Windows\System\QWvxhFk.exe
  C:\Windows\System\QWvxhFk.exe
  2⤵
  PID:5376
- C:\Windows\System\ZJicccF.exe
  C:\Windows\System\ZJicccF.exe
  2⤵
  PID:5400
- C:\Windows\System\GMsLBML.exe
  C:\Windows\System\GMsLBML.exe
  2⤵
  PID:5420
- C:\Windows\System\ewbHmMr.exe
  C:\Windows\System\ewbHmMr.exe
  2⤵
  PID:5444
- C:\Windows\System\jBvbeIY.exe
  C:\Windows\System\jBvbeIY.exe
  2⤵
  PID:5468
- C:\Windows\System\BMvipBk.exe
  C:\Windows\System\BMvipBk.exe
  2⤵
  PID:5492
- C:\Windows\System\AQdexqq.exe
  C:\Windows\System\AQdexqq.exe
  2⤵
  PID:5524
- C:\Windows\System\ZTGcyAP.exe
  C:\Windows\System\ZTGcyAP.exe
  2⤵
  PID:5548
- C:\Windows\System\drLoMiz.exe
  C:\Windows\System\drLoMiz.exe
  2⤵
  PID:5568
- C:\Windows\System\zkDaHKJ.exe
  C:\Windows\System\zkDaHKJ.exe
  2⤵
  PID:5592
- C:\Windows\System\DmrqBtr.exe
  C:\Windows\System\DmrqBtr.exe
  2⤵
  PID:5620
- C:\Windows\System\xOfkoQM.exe
  C:\Windows\System\xOfkoQM.exe
  2⤵
  PID:5644
- C:\Windows\System\SbWgYVg.exe
  C:\Windows\System\SbWgYVg.exe
  2⤵
  PID:5664
- C:\Windows\System\JbUGDSp.exe
  C:\Windows\System\JbUGDSp.exe
  2⤵
  PID:5680
- C:\Windows\System\tStsyUC.exe
  C:\Windows\System\tStsyUC.exe
  2⤵
  PID:5700
- C:\Windows\System\lSEJotB.exe
  C:\Windows\System\lSEJotB.exe
  2⤵
  PID:5716
- C:\Windows\System\deUHzJK.exe
  C:\Windows\System\deUHzJK.exe
  2⤵
  PID:5740
- C:\Windows\System\ztuSAol.exe
  C:\Windows\System\ztuSAol.exe
  2⤵
  PID:5776
- C:\Windows\System\ZKFsInZ.exe
  C:\Windows\System\ZKFsInZ.exe
  2⤵
  PID:5800
- C:\Windows\System\bppGpLj.exe
  C:\Windows\System\bppGpLj.exe
  2⤵
  PID:5820
- C:\Windows\System\QyFYZDn.exe
  C:\Windows\System\QyFYZDn.exe
  2⤵
  PID:5840
- C:\Windows\System\HLgwneG.exe
  C:\Windows\System\HLgwneG.exe
  2⤵
  PID:5860
- C:\Windows\System\CjihtRe.exe
  C:\Windows\System\CjihtRe.exe
  2⤵
  PID:5880
- C:\Windows\System\SWALLnk.exe
  C:\Windows\System\SWALLnk.exe
  2⤵
  PID:5900
- C:\Windows\System\iFSpYKw.exe
  C:\Windows\System\iFSpYKw.exe
  2⤵
  PID:5924
- C:\Windows\System\bdWepPy.exe
  C:\Windows\System\bdWepPy.exe
  2⤵
  PID:5940
- C:\Windows\System\xovCDqD.exe
  C:\Windows\System\xovCDqD.exe
  2⤵
  PID:5964
- C:\Windows\System\xpOYuts.exe
  C:\Windows\System\xpOYuts.exe
  2⤵
  PID:6004
- C:\Windows\System\mYTnjHX.exe
  C:\Windows\System\mYTnjHX.exe
  2⤵
  PID:6024
- C:\Windows\System\ndowqpm.exe
  C:\Windows\System\ndowqpm.exe
  2⤵
  PID:6044
- C:\Windows\System\LYSlPlF.exe
  C:\Windows\System\LYSlPlF.exe
  2⤵
  PID:6060
- C:\Windows\System\abWvkUs.exe
  C:\Windows\System\abWvkUs.exe
  2⤵
  PID:6080
- C:\Windows\System\StdLrAn.exe
  C:\Windows\System\StdLrAn.exe
  2⤵
  PID:6096
- C:\Windows\System\IkVJZYO.exe
  C:\Windows\System\IkVJZYO.exe
  2⤵
  PID:6116
- C:\Windows\System\fJakaeF.exe
  C:\Windows\System\fJakaeF.exe
  2⤵
  PID:6132
- C:\Windows\System\zOPayiT.exe
  C:\Windows\System\zOPayiT.exe
  2⤵
  PID:3544
- C:\Windows\System\sBFksNe.exe
  C:\Windows\System\sBFksNe.exe
  2⤵
  PID:5112
- C:\Windows\System\vYSFfuv.exe
  C:\Windows\System\vYSFfuv.exe
  2⤵
  PID:5140
- C:\Windows\System\mcAXCCm.exe
  C:\Windows\System\mcAXCCm.exe
  2⤵
  PID:1300
- C:\Windows\System\JLiYKeS.exe
  C:\Windows\System\JLiYKeS.exe
  2⤵
  PID:5320
- C:\Windows\System\TstlHfc.exe
  C:\Windows\System\TstlHfc.exe
  2⤵
  PID:5344
- C:\Windows\System\dyLZHkh.exe
  C:\Windows\System\dyLZHkh.exe
  2⤵
  PID:5508
- C:\Windows\System\QrFfuDK.exe
  C:\Windows\System\QrFfuDK.exe
  2⤵
  PID:5360
- C:\Windows\System\pvclQNf.exe
  C:\Windows\System\pvclQNf.exe
  2⤵
  PID:5232
- C:\Windows\System\OIFdmEj.exe
  C:\Windows\System\OIFdmEj.exe
  2⤵
  PID:5672
- C:\Windows\System\ClDbMGE.exe
  C:\Windows\System\ClDbMGE.exe
  2⤵
  PID:4692
- C:\Windows\System\kwzQkDa.exe
  C:\Windows\System\kwzQkDa.exe
  2⤵
  PID:5604
- C:\Windows\System\UTXjMki.exe
  C:\Windows\System\UTXjMki.exe
  2⤵
  PID:5408
- C:\Windows\System\AJVLDxr.exe
  C:\Windows\System\AJVLDxr.exe
  2⤵
  PID:5476
- C:\Windows\System\XcpYcRI.exe
  C:\Windows\System\XcpYcRI.exe
  2⤵
  PID:5872
- C:\Windows\System\eCHcfVP.exe
  C:\Windows\System\eCHcfVP.exe
  2⤵
  PID:5736
- C:\Windows\System\vGxnSGz.exe
  C:\Windows\System\vGxnSGz.exe
  2⤵
  PID:5976
- C:\Windows\System\PkxeZeu.exe
  C:\Windows\System\PkxeZeu.exe
  2⤵
  PID:5636
- C:\Windows\System\yidDkGW.exe
  C:\Windows\System\yidDkGW.exe
  2⤵
  PID:5788
- C:\Windows\System\GVxEKiV.exe
  C:\Windows\System\GVxEKiV.exe
  2⤵
  PID:5916
- C:\Windows\System\QOfGKxJ.exe
  C:\Windows\System\QOfGKxJ.exe
  2⤵
  PID:5340
- C:\Windows\System\cDKkkXe.exe
  C:\Windows\System\cDKkkXe.exe
  2⤵
  PID:6164
- C:\Windows\System\HfeOVxt.exe
  C:\Windows\System\HfeOVxt.exe
  2⤵
  PID:6184
- C:\Windows\System\TQwWKQf.exe
  C:\Windows\System\TQwWKQf.exe
  2⤵
  PID:6220
- C:\Windows\System\AIEozkn.exe
  C:\Windows\System\AIEozkn.exe
  2⤵
  PID:6240
- C:\Windows\System\sNRvlDf.exe
  C:\Windows\System\sNRvlDf.exe
  2⤵
  PID:6260
- C:\Windows\System\xoYyiSw.exe
  C:\Windows\System\xoYyiSw.exe
  2⤵
  PID:6276
- C:\Windows\System\AxwBQHU.exe
  C:\Windows\System\AxwBQHU.exe
  2⤵
  PID:6300
- C:\Windows\System\OCKqOZa.exe
  C:\Windows\System\OCKqOZa.exe
  2⤵
  PID:6316
- C:\Windows\System\rJOhjms.exe
  C:\Windows\System\rJOhjms.exe
  2⤵
  PID:6340
- C:\Windows\System\EGRBykY.exe
  C:\Windows\System\EGRBykY.exe
  2⤵
  PID:6356
- C:\Windows\System\TwHGeft.exe
  C:\Windows\System\TwHGeft.exe
  2⤵
  PID:6380
- C:\Windows\System\TbCdAuZ.exe
  C:\Windows\System\TbCdAuZ.exe
  2⤵
  PID:6400
- C:\Windows\System\HBsJEcP.exe
  C:\Windows\System\HBsJEcP.exe
  2⤵
  PID:6428
- C:\Windows\System\eJQpmSL.exe
  C:\Windows\System\eJQpmSL.exe
  2⤵
  PID:6444
- C:\Windows\System\MKOQdPo.exe
  C:\Windows\System\MKOQdPo.exe
  2⤵
  PID:6464
- C:\Windows\System\wdsdHWx.exe
  C:\Windows\System\wdsdHWx.exe
  2⤵
  PID:6488
- C:\Windows\System\uDkPICF.exe
  C:\Windows\System\uDkPICF.exe
  2⤵
  PID:6508
- C:\Windows\System\znrRHxs.exe
  C:\Windows\System\znrRHxs.exe
  2⤵
  PID:6528
- C:\Windows\System\HROMDnG.exe
  C:\Windows\System\HROMDnG.exe
  2⤵
  PID:6544
- C:\Windows\System\NCBqmfg.exe
  C:\Windows\System\NCBqmfg.exe
  2⤵
  PID:6564
- C:\Windows\System\QbjXBlm.exe
  C:\Windows\System\QbjXBlm.exe
  2⤵
  PID:6584
- C:\Windows\System\JJrolHS.exe
  C:\Windows\System\JJrolHS.exe
  2⤵
  PID:6604
- C:\Windows\System\xSLIoMg.exe
  C:\Windows\System\xSLIoMg.exe
  2⤵
  PID:6624
- C:\Windows\System\xwBraDW.exe
  C:\Windows\System\xwBraDW.exe
  2⤵
  PID:6652
- C:\Windows\System\pPkBzpp.exe
  C:\Windows\System\pPkBzpp.exe
  2⤵
  PID:6672
- C:\Windows\System\TIuoFgr.exe
  C:\Windows\System\TIuoFgr.exe
  2⤵
  PID:6692
- C:\Windows\System\cEqvxoY.exe
  C:\Windows\System\cEqvxoY.exe
  2⤵
  PID:6712
- C:\Windows\System\PqTxRbz.exe
  C:\Windows\System\PqTxRbz.exe
  2⤵
  PID:6732
- C:\Windows\System\aBNHHGf.exe
  C:\Windows\System\aBNHHGf.exe
  2⤵
  PID:6752
- C:\Windows\System\ItWYPEh.exe
  C:\Windows\System\ItWYPEh.exe
  2⤵
  PID:6776
- C:\Windows\System\UumiKcV.exe
  C:\Windows\System\UumiKcV.exe
  2⤵
  PID:6792
- C:\Windows\System\rnOREAU.exe
  C:\Windows\System\rnOREAU.exe
  2⤵
  PID:6824
- C:\Windows\System\NhlGhZJ.exe
  C:\Windows\System\NhlGhZJ.exe
  2⤵
  PID:6848
- C:\Windows\System\GZdlnkn.exe
  C:\Windows\System\GZdlnkn.exe
  2⤵
  PID:6864
- C:\Windows\System\CbhckFS.exe
  C:\Windows\System\CbhckFS.exe
  2⤵
  PID:6892
- C:\Windows\System\FHcLUjz.exe
  C:\Windows\System\FHcLUjz.exe
  2⤵
  PID:6912
- C:\Windows\System\jKEzFee.exe
  C:\Windows\System\jKEzFee.exe
  2⤵
  PID:6932
- C:\Windows\System\nWzhnvp.exe
  C:\Windows\System\nWzhnvp.exe
  2⤵
  PID:6960
- C:\Windows\System\hUunlJL.exe
  C:\Windows\System\hUunlJL.exe
  2⤵
  PID:6976
- C:\Windows\System\udEclTj.exe
  C:\Windows\System\udEclTj.exe
  2⤵
  PID:6996
- C:\Windows\System\tafVwBf.exe
  C:\Windows\System\tafVwBf.exe
  2⤵
  PID:7012
- C:\Windows\System\KDwHLoF.exe
  C:\Windows\System\KDwHLoF.exe
  2⤵
  PID:7032
- C:\Windows\System\lXryejf.exe
  C:\Windows\System\lXryejf.exe
  2⤵
  PID:7048
- C:\Windows\System\uKoHLKM.exe
  C:\Windows\System\uKoHLKM.exe
  2⤵
  PID:7064
- C:\Windows\System\bfNSoYU.exe
  C:\Windows\System\bfNSoYU.exe
  2⤵
  PID:7084
- C:\Windows\System\jFwXREQ.exe
  C:\Windows\System\jFwXREQ.exe
  2⤵
  PID:7104
- C:\Windows\System\BpdlKLR.exe
  C:\Windows\System\BpdlKLR.exe
  2⤵
  PID:7124
- C:\Windows\System\YlRSTpt.exe
  C:\Windows\System\YlRSTpt.exe
  2⤵
  PID:7144
- C:\Windows\System\OFEaxQY.exe
  C:\Windows\System\OFEaxQY.exe
  2⤵
  PID:5980
- C:\Windows\System\GeEHFBu.exe
  C:\Windows\System\GeEHFBu.exe
  2⤵
  PID:5772
- C:\Windows\System\bxavwdb.exe
  C:\Windows\System\bxavwdb.exe
  2⤵
  PID:5676
- C:\Windows\System\MxBIrTH.exe
  C:\Windows\System\MxBIrTH.exe
  2⤵
  PID:6128
- C:\Windows\System\AbjtMQm.exe
  C:\Windows\System\AbjtMQm.exe
  2⤵
  PID:5828
- C:\Windows\System\pJsVRer.exe
  C:\Windows\System\pJsVRer.exe
  2⤵
  PID:5488
- C:\Windows\System\RVjzcOf.exe
  C:\Windows\System\RVjzcOf.exe
  2⤵
  PID:3536
- C:\Windows\System\eQfdOKz.exe
  C:\Windows\System\eQfdOKz.exe
  2⤵
  PID:5632
- C:\Windows\System\fVNGLZn.exe
  C:\Windows\System\fVNGLZn.exe
  2⤵
  PID:5212
- C:\Windows\System\mxQcpsn.exe
  C:\Windows\System\mxQcpsn.exe
  2⤵
  PID:5208
- C:\Windows\System\PmKzbdZ.exe
  C:\Windows\System\PmKzbdZ.exe
  2⤵
  PID:6196
- C:\Windows\System\YEGpIMC.exe
  C:\Windows\System\YEGpIMC.exe
  2⤵
  PID:6020
- C:\Windows\System\UFLqeAR.exe
  C:\Windows\System\UFLqeAR.exe
  2⤵
  PID:6068
- C:\Windows\System\HIzxhhu.exe
  C:\Windows\System\HIzxhhu.exe
  2⤵
  PID:6092
- C:\Windows\System\XaIiPdh.exe
  C:\Windows\System\XaIiPdh.exe
  2⤵
  PID:6364
- C:\Windows\System\KTpfVsC.exe
  C:\Windows\System\KTpfVsC.exe
  2⤵
  PID:5460
- C:\Windows\System\gojwvES.exe
  C:\Windows\System\gojwvES.exe
  2⤵
  PID:6440
- C:\Windows\System\osHlFsZ.exe
  C:\Windows\System\osHlFsZ.exe
  2⤵
  PID:6500
- C:\Windows\System\cjSCojA.exe
  C:\Windows\System\cjSCojA.exe
  2⤵
  PID:6576
- C:\Windows\System\DBiZxxb.exe
  C:\Windows\System\DBiZxxb.exe
  2⤵
  PID:6596
- C:\Windows\System\dDKikuU.exe
  C:\Windows\System\dDKikuU.exe
  2⤵
  PID:6636
- C:\Windows\System\AIhbFfn.exe
  C:\Windows\System\AIhbFfn.exe
  2⤵
  PID:6664
- C:\Windows\System\bhFaMuR.exe
  C:\Windows\System\bhFaMuR.exe
  2⤵
  PID:6744
- C:\Windows\System\cqXjPKV.exe
  C:\Windows\System\cqXjPKV.exe
  2⤵
  PID:6784
- C:\Windows\System\JBIlgnZ.exe
  C:\Windows\System\JBIlgnZ.exe
  2⤵
  PID:5868
- C:\Windows\System\uIEEFUA.exe
  C:\Windows\System\uIEEFUA.exe
  2⤵
  PID:6684
- C:\Windows\System\rkStsHy.exe
  C:\Windows\System\rkStsHy.exe
  2⤵
  PID:7004
- C:\Windows\System\OMgJHEI.exe
  C:\Windows\System\OMgJHEI.exe
  2⤵
  PID:7136
- C:\Windows\System\XSnDImZ.exe
  C:\Windows\System\XSnDImZ.exe
  2⤵
  PID:5796
- C:\Windows\System\iuKelQR.exe
  C:\Windows\System\iuKelQR.exe
  2⤵
  PID:7188
- C:\Windows\System\BJjTRdP.exe
  C:\Windows\System\BJjTRdP.exe
  2⤵
  PID:7212
- C:\Windows\System\TXHhZiS.exe
  C:\Windows\System\TXHhZiS.exe
  2⤵
  PID:7236
- C:\Windows\System\uWVnFFj.exe
  C:\Windows\System\uWVnFFj.exe
  2⤵
  PID:7260
- C:\Windows\System\BnuDqMc.exe
  C:\Windows\System\BnuDqMc.exe
  2⤵
  PID:7276
- C:\Windows\System\SnnPeiw.exe
  C:\Windows\System\SnnPeiw.exe
  2⤵
  PID:7296
- C:\Windows\System\mjBftdx.exe
  C:\Windows\System\mjBftdx.exe
  2⤵
  PID:7328
- C:\Windows\System\uulpsdD.exe
  C:\Windows\System\uulpsdD.exe
  2⤵
  PID:7352
- C:\Windows\System\FyzztWt.exe
  C:\Windows\System\FyzztWt.exe
  2⤵
  PID:7368
- C:\Windows\System\kIZxOAf.exe
  C:\Windows\System\kIZxOAf.exe
  2⤵
  PID:7392
- C:\Windows\System\VGAJzUN.exe
  C:\Windows\System\VGAJzUN.exe
  2⤵
  PID:7448
- C:\Windows\System\rufWQtl.exe
  C:\Windows\System\rufWQtl.exe
  2⤵
  PID:7468
- C:\Windows\System\xkeNaPy.exe
  C:\Windows\System\xkeNaPy.exe
  2⤵
  PID:7488
- C:\Windows\System\OWnDFgu.exe
  C:\Windows\System\OWnDFgu.exe
  2⤵
  PID:7508
- C:\Windows\System\KIJOKDh.exe
  C:\Windows\System\KIJOKDh.exe
  2⤵
  PID:7528
- C:\Windows\System\oLRfHmp.exe
  C:\Windows\System\oLRfHmp.exe
  2⤵
  PID:7552
- C:\Windows\System\GTZpmzr.exe
  C:\Windows\System\GTZpmzr.exe
  2⤵
  PID:7576
- C:\Windows\System\kullbyV.exe
  C:\Windows\System\kullbyV.exe
  2⤵
  PID:7592
- C:\Windows\System\FHYYEjL.exe
  C:\Windows\System\FHYYEjL.exe
  2⤵
  PID:7616
- C:\Windows\System\WDLeKUc.exe
  C:\Windows\System\WDLeKUc.exe
  2⤵
  PID:7636
- C:\Windows\System\wnMzRhV.exe
  C:\Windows\System\wnMzRhV.exe
  2⤵
  PID:7660
- C:\Windows\System\iTznzKo.exe
  C:\Windows\System\iTznzKo.exe
  2⤵
  PID:7680
- C:\Windows\System\XbppWEb.exe
  C:\Windows\System\XbppWEb.exe
  2⤵
  PID:7700
- C:\Windows\System\YMZcJOV.exe
  C:\Windows\System\YMZcJOV.exe
  2⤵
  PID:7716
- C:\Windows\System\HcnHVqb.exe
  C:\Windows\System\HcnHVqb.exe
  2⤵
  PID:7740
- C:\Windows\System\FBVwWdW.exe
  C:\Windows\System\FBVwWdW.exe
  2⤵
  PID:7756
- C:\Windows\System\mzjiEfK.exe
  C:\Windows\System\mzjiEfK.exe
  2⤵
  PID:7776
- C:\Windows\System\typBiqc.exe
  C:\Windows\System\typBiqc.exe
  2⤵
  PID:7796
- C:\Windows\System\zcZMOUC.exe
  C:\Windows\System\zcZMOUC.exe
  2⤵
  PID:7812
- C:\Windows\System\UhxRgLI.exe
  C:\Windows\System\UhxRgLI.exe
  2⤵
  PID:7832
- C:\Windows\System\CTvLwCO.exe
  C:\Windows\System\CTvLwCO.exe
  2⤵
  PID:7848
- C:\Windows\System\BtWhPph.exe
  C:\Windows\System\BtWhPph.exe
  2⤵
  PID:7872
- C:\Windows\System\ghyOtCE.exe
  C:\Windows\System\ghyOtCE.exe
  2⤵
  PID:7892
- C:\Windows\System\eHdKKlg.exe
  C:\Windows\System\eHdKKlg.exe
  2⤵
  PID:7908
- C:\Windows\System\jbQhHyY.exe
  C:\Windows\System\jbQhHyY.exe
  2⤵
  PID:7932
- C:\Windows\System\OBuSYdN.exe
  C:\Windows\System\OBuSYdN.exe
  2⤵
  PID:7948
- C:\Windows\System\NLdgzxM.exe
  C:\Windows\System\NLdgzxM.exe
  2⤵
  PID:7972
- C:\Windows\System\bnnUFZW.exe
  C:\Windows\System\bnnUFZW.exe
  2⤵
  PID:7988
- C:\Windows\System\FepyJed.exe
  C:\Windows\System\FepyJed.exe
  2⤵
  PID:8008
- C:\Windows\System\aCtDghJ.exe
  C:\Windows\System\aCtDghJ.exe
  2⤵
  PID:8028
- C:\Windows\System\HULcEsi.exe
  C:\Windows\System\HULcEsi.exe
  2⤵
  PID:8048
- C:\Windows\System\JglMMYo.exe
  C:\Windows\System\JglMMYo.exe
  2⤵
  PID:8068
- C:\Windows\System\kbQcKlm.exe
  C:\Windows\System\kbQcKlm.exe
  2⤵
  PID:8084
- C:\Windows\System\MnHxgJP.exe
  C:\Windows\System\MnHxgJP.exe
  2⤵
  PID:8104
- C:\Windows\System\XkTTazz.exe
  C:\Windows\System\XkTTazz.exe
  2⤵
  PID:8124
- C:\Windows\System\XuCQWvb.exe
  C:\Windows\System\XuCQWvb.exe
  2⤵
  PID:8144
- C:\Windows\System\MnlNnNe.exe
  C:\Windows\System\MnlNnNe.exe
  2⤵
  PID:8168
- C:\Windows\System\kVueKHf.exe
  C:\Windows\System\kVueKHf.exe
  2⤵
  PID:8188
- C:\Windows\System\JBPcJdi.exe
  C:\Windows\System\JBPcJdi.exe
  2⤵
  PID:6804
- C:\Windows\System\fFnjQXG.exe
  C:\Windows\System\fFnjQXG.exe
  2⤵
  PID:6216
- C:\Windows\System\AHIoOsm.exe
  C:\Windows\System\AHIoOsm.exe
  2⤵
  PID:6268
- C:\Windows\System\bWmbyhb.exe
  C:\Windows\System\bWmbyhb.exe
  2⤵
  PID:700
- C:\Windows\System\yfAChTq.exe
  C:\Windows\System\yfAChTq.exe
  2⤵
  PID:6480
- C:\Windows\System\VesPEVz.exe
  C:\Windows\System\VesPEVz.exe
  2⤵
  PID:6308
- C:\Windows\System\NMXhvrM.exe
  C:\Windows\System\NMXhvrM.exe
  2⤵
  PID:6592
- C:\Windows\System\qZUttzZ.exe
  C:\Windows\System\qZUttzZ.exe
  2⤵
  PID:3656
- C:\Windows\System\azQazxx.exe
  C:\Windows\System\azQazxx.exe
  2⤵
  PID:6460
- C:\Windows\System\kcWuoAT.exe
  C:\Windows\System\kcWuoAT.exe
  2⤵
  PID:6536
- C:\Windows\System\WRUpNij.exe
  C:\Windows\System\WRUpNij.exe
  2⤵
  PID:6552
- C:\Windows\System\xExTOjr.exe
  C:\Windows\System\xExTOjr.exe
  2⤵
  PID:5816
- C:\Windows\System\uHFaPsR.exe
  C:\Windows\System\uHFaPsR.exe
  2⤵
  PID:5616
- C:\Windows\System\AAfYWyH.exe
  C:\Windows\System\AAfYWyH.exe
  2⤵
  PID:7040
- C:\Windows\System\QvtFWlF.exe
  C:\Windows\System\QvtFWlF.exe
  2⤵
  PID:8200
- C:\Windows\System\UGWKWxG.exe
  C:\Windows\System\UGWKWxG.exe
  2⤵
  PID:8216
- C:\Windows\System\XiJbSnz.exe
  C:\Windows\System\XiJbSnz.exe
  2⤵
  PID:8232
- C:\Windows\System\eqWCFOz.exe
  C:\Windows\System\eqWCFOz.exe
  2⤵
  PID:8312
- C:\Windows\System\aocvhgz.exe
  C:\Windows\System\aocvhgz.exe
  2⤵
  PID:8364
- C:\Windows\System\gSknyoi.exe
  C:\Windows\System\gSknyoi.exe
  2⤵
  PID:8384
- C:\Windows\System\JdgfSmd.exe
  C:\Windows\System\JdgfSmd.exe
  2⤵
  PID:8400
- C:\Windows\System\GppKkHx.exe
  C:\Windows\System\GppKkHx.exe
  2⤵
  PID:8428
- C:\Windows\System\yipWIwT.exe
  C:\Windows\System\yipWIwT.exe
  2⤵
  PID:8444
- C:\Windows\System\YlEtpYn.exe
  C:\Windows\System\YlEtpYn.exe
  2⤵
  PID:8464
- C:\Windows\System\qbwaHLg.exe
  C:\Windows\System\qbwaHLg.exe
  2⤵
  PID:8484
- C:\Windows\System\kIxeTgP.exe
  C:\Windows\System\kIxeTgP.exe
  2⤵
  PID:8512
- C:\Windows\System\CwwtWFQ.exe
  C:\Windows\System\CwwtWFQ.exe
  2⤵
  PID:8528
- C:\Windows\System\nHdqMYi.exe
  C:\Windows\System\nHdqMYi.exe
  2⤵
  PID:8568
- C:\Windows\System\BmwVYFK.exe
  C:\Windows\System\BmwVYFK.exe
  2⤵
  PID:8596
- C:\Windows\System\JvCgyMv.exe
  C:\Windows\System\JvCgyMv.exe
  2⤵
  PID:8616
- C:\Windows\System\PoqCXSX.exe
  C:\Windows\System\PoqCXSX.exe
  2⤵
  PID:8768
- C:\Windows\System\PdTjSEz.exe
  C:\Windows\System\PdTjSEz.exe
  2⤵
  PID:8872
- C:\Windows\System\YsybOgk.exe
  C:\Windows\System\YsybOgk.exe
  2⤵
  PID:8892
- C:\Windows\System\zvEDwUH.exe
  C:\Windows\System\zvEDwUH.exe
  2⤵
  PID:8908
- C:\Windows\System\jAAMCIJ.exe
  C:\Windows\System\jAAMCIJ.exe
  2⤵
  PID:8932
- C:\Windows\System\mGwUTjr.exe
  C:\Windows\System\mGwUTjr.exe
  2⤵
  PID:8960
- C:\Windows\System\wHqMflk.exe
  C:\Windows\System\wHqMflk.exe
  2⤵
  PID:8976
- C:\Windows\System\bJqvkst.exe
  C:\Windows\System\bJqvkst.exe
  2⤵
  PID:6352
- C:\Windows\System\csSaIpZ.exe
  C:\Windows\System\csSaIpZ.exe
  2⤵
  PID:7820
- C:\Windows\System\xGgmAsD.exe
  C:\Windows\System\xGgmAsD.exe
  2⤵
  PID:6992
- C:\Windows\System\MFUaeHY.exe
  C:\Windows\System\MFUaeHY.exe
  2⤵
  PID:6872
- C:\Windows\System\fETXMpP.exe
  C:\Windows\System\fETXMpP.exe
  2⤵
  PID:7056
- C:\Windows\System\bdvVhOn.exe
  C:\Windows\System\bdvVhOn.exe
  2⤵
  PID:5996
- C:\Windows\System\ETOBEOr.exe
  C:\Windows\System\ETOBEOr.exe
  2⤵
  PID:7208
- C:\Windows\System\CqqEYok.exe
  C:\Windows\System\CqqEYok.exe
  2⤵
  PID:6108
- C:\Windows\System\fesBoAc.exe
  C:\Windows\System\fesBoAc.exe
  2⤵
  PID:8116
- C:\Windows\System\cviuddV.exe
  C:\Windows\System\cviuddV.exe
  2⤵
  PID:8076
- C:\Windows\System\kfsQMrO.exe
  C:\Windows\System\kfsQMrO.exe
  2⤵
  PID:6708
- C:\Windows\System\sdmizfL.exe
  C:\Windows\System\sdmizfL.exe
  2⤵
  PID:8624
- C:\Windows\System\dfgayVt.exe
  C:\Windows\System\dfgayVt.exe
  2⤵
  PID:8224
- C:\Windows\System\qIJBwky.exe
  C:\Windows\System\qIJBwky.exe
  2⤵
  PID:7268
- C:\Windows\System\ppLlztH.exe
  C:\Windows\System\ppLlztH.exe
  2⤵
  PID:7228
- C:\Windows\System\mGVIByw.exe
  C:\Windows\System\mGVIByw.exe
  2⤵
  PID:7400
- C:\Windows\System\rZWGjvl.exe
  C:\Windows\System\rZWGjvl.exe
  2⤵
  PID:7340
- C:\Windows\System\XbkCoXQ.exe
  C:\Windows\System\XbkCoXQ.exe
  2⤵
  PID:7440
- C:\Windows\System\oJNgOha.exe
  C:\Windows\System\oJNgOha.exe
  2⤵
  PID:7500
- C:\Windows\System\RXWslbp.exe
  C:\Windows\System\RXWslbp.exe
  2⤵
  PID:7536
- C:\Windows\System\WsTAUtD.exe
  C:\Windows\System\WsTAUtD.exe
  2⤵
  PID:7600
- C:\Windows\System\KnvvcZc.exe
  C:\Windows\System\KnvvcZc.exe
  2⤵
  PID:7632
- C:\Windows\System\EuRqBQt.exe
  C:\Windows\System\EuRqBQt.exe
  2⤵
  PID:7692
- C:\Windows\System\PRlUvWY.exe
  C:\Windows\System\PRlUvWY.exe
  2⤵
  PID:7788
- C:\Windows\System\UlctHDw.exe
  C:\Windows\System\UlctHDw.exe
  2⤵
  PID:7856
- C:\Windows\System\azHsDuU.exe
  C:\Windows\System\azHsDuU.exe
  2⤵
  PID:7884
- C:\Windows\System\pcbSEII.exe
  C:\Windows\System\pcbSEII.exe
  2⤵
  PID:7924
- C:\Windows\System\fGwQKfp.exe
  C:\Windows\System\fGwQKfp.exe
  2⤵
  PID:9288
- C:\Windows\System\VNlCFBs.exe
  C:\Windows\System\VNlCFBs.exe
  2⤵
  PID:9512
- C:\Windows\System\eogeZJu.exe
  C:\Windows\System\eogeZJu.exe
  2⤵
  PID:9536
- C:\Windows\System\LmRVtBd.exe
  C:\Windows\System\LmRVtBd.exe
  2⤵
  PID:9552
- C:\Windows\System\LrTmRdo.exe
  C:\Windows\System\LrTmRdo.exe
  2⤵
  PID:9568
- C:\Windows\System\GxYJeoS.exe
  C:\Windows\System\GxYJeoS.exe
  2⤵
  PID:9588
- C:\Windows\System\EYPrhDu.exe
  C:\Windows\System\EYPrhDu.exe
  2⤵
  PID:9608
- C:\Windows\System\wmvpJuU.exe
  C:\Windows\System\wmvpJuU.exe
  2⤵
  PID:9636
- C:\Windows\System\pmkNaJS.exe
  C:\Windows\System\pmkNaJS.exe
  2⤵
  PID:9656
- C:\Windows\System\vEaRcVe.exe
  C:\Windows\System\vEaRcVe.exe
  2⤵
  PID:9676
- C:\Windows\System\YxjMpfU.exe
  C:\Windows\System\YxjMpfU.exe
  2⤵
  PID:9700
- C:\Windows\System\bnuTkry.exe
  C:\Windows\System\bnuTkry.exe
  2⤵
  PID:9896
- C:\Windows\System\jVmDlov.exe
  C:\Windows\System\jVmDlov.exe
  2⤵
  PID:9924
- C:\Windows\System\ULFUBaj.exe
  C:\Windows\System\ULFUBaj.exe
  2⤵
  PID:9948
- C:\Windows\System\PrlCJCe.exe
  C:\Windows\System\PrlCJCe.exe
  2⤵
  PID:9968
- C:\Windows\System\wtDGaye.exe
  C:\Windows\System\wtDGaye.exe
  2⤵
  PID:9988
- C:\Windows\System\IyRNxNT.exe
  C:\Windows\System\IyRNxNT.exe
  2⤵
  PID:10060
- C:\Windows\System\IpBDCXd.exe
  C:\Windows\System\IpBDCXd.exe
  2⤵
  PID:10076
- C:\Windows\System\NldlYDO.exe
  C:\Windows\System\NldlYDO.exe
  2⤵
  PID:10096
- C:\Windows\System\ggSxPuL.exe
  C:\Windows\System\ggSxPuL.exe
  2⤵
  PID:10116
- C:\Windows\System\TpaOLEL.exe
  C:\Windows\System\TpaOLEL.exe
  2⤵
  PID:10136
- C:\Windows\System\OmFCnxm.exe
  C:\Windows\System\OmFCnxm.exe
  2⤵
  PID:10156
- C:\Windows\System\cCsovtj.exe
  C:\Windows\System\cCsovtj.exe
  2⤵
  PID:10176
- C:\Windows\System\OnZlEIW.exe
  C:\Windows\System\OnZlEIW.exe
  2⤵
  PID:9060
- C:\Windows\System\isKWbxx.exe
  C:\Windows\System\isKWbxx.exe
  2⤵
  PID:9120
- C:\Windows\System\rdItCoE.exe
  C:\Windows\System\rdItCoE.exe
  2⤵
  PID:9088
- C:\Windows\System\yRlEzNK.exe
  C:\Windows\System\yRlEzNK.exe
  2⤵
  PID:3872
- C:\Windows\System\qZeYlzd.exe
  C:\Windows\System\qZeYlzd.exe
  2⤵
  PID:7224
- C:\Windows\System\LWRDhIA.exe
  C:\Windows\System\LWRDhIA.exe
  2⤵
  PID:8140
- C:\Windows\System\MYCBmDc.exe
  C:\Windows\System\MYCBmDc.exe
  2⤵
  PID:8060
- C:\Windows\System\SBOslNf.exe
  C:\Windows\System\SBOslNf.exe
  2⤵
  PID:6036
- C:\Windows\System\NvaQznE.exe
  C:\Windows\System\NvaQznE.exe
  2⤵
  PID:9304
- C:\Windows\System\StfwdvU.exe
  C:\Windows\System\StfwdvU.exe
  2⤵
  PID:7524
- C:\Windows\System\YbpESKt.exe
  C:\Windows\System\YbpESKt.exe
  2⤵
  PID:7364
- C:\Windows\System\mbZcSTa.exe
  C:\Windows\System\mbZcSTa.exe
  2⤵
  PID:7404
- C:\Windows\System\fnsVklI.exe
  C:\Windows\System\fnsVklI.exe
  2⤵
  PID:8540
- C:\Windows\System\JYTsFRR.exe
  C:\Windows\System\JYTsFRR.exe
  2⤵
  PID:7712
- C:\Windows\System\EkXPzMJ.exe
  C:\Windows\System\EkXPzMJ.exe
  2⤵
  PID:7880
- C:\Windows\System\CrWaeiY.exe
  C:\Windows\System\CrWaeiY.exe
  2⤵
  PID:8020
- C:\Windows\System\uvvwJoA.exe
  C:\Windows\System\uvvwJoA.exe
  2⤵
  PID:6056
- C:\Windows\System\cSTBgap.exe
  C:\Windows\System\cSTBgap.exe
  2⤵
  PID:6332
- C:\Windows\System\XpthGEc.exe
  C:\Windows\System\XpthGEc.exe
  2⤵
  PID:7708
- C:\Windows\System\nyowRuI.exe
  C:\Windows\System\nyowRuI.exe
  2⤵
  PID:7520
- C:\Windows\System\FZCXeOv.exe
  C:\Windows\System\FZCXeOv.exe
  2⤵
  PID:8208
- C:\Windows\System\uyHOGPD.exe
  C:\Windows\System\uyHOGPD.exe
  2⤵
  PID:9580
- C:\Windows\System\VjstzPD.exe
  C:\Windows\System\VjstzPD.exe
  2⤵
  PID:9620
- C:\Windows\System\JHULPAR.exe
  C:\Windows\System\JHULPAR.exe
  2⤵
  PID:8592
- C:\Windows\System\KtnMbjF.exe
  C:\Windows\System\KtnMbjF.exe
  2⤵
  PID:8712
- C:\Windows\System\dBXuLJJ.exe
  C:\Windows\System\dBXuLJJ.exe
  2⤵
  PID:6412
- C:\Windows\System\qBmVneD.exe
  C:\Windows\System\qBmVneD.exe
  2⤵
  PID:9600
- C:\Windows\System\FdfdAYf.exe
  C:\Windows\System\FdfdAYf.exe
  2⤵
  PID:9644
- C:\Windows\System\iUbTqVa.exe
  C:\Windows\System\iUbTqVa.exe
  2⤵
  PID:9688
- C:\Windows\System\NGnOvyd.exe
  C:\Windows\System\NGnOvyd.exe
  2⤵
  PID:9964
- C:\Windows\System\nCuogWb.exe
  C:\Windows\System\nCuogWb.exe
  2⤵
  PID:9560
- C:\Windows\System\UvTuTxE.exe
  C:\Windows\System\UvTuTxE.exe
  2⤵
  PID:9508
- C:\Windows\System\zzSvOiX.exe
  C:\Windows\System\zzSvOiX.exe
  2⤵
  PID:9476
- C:\Windows\System\omPRsgC.exe
  C:\Windows\System\omPRsgC.exe
  2⤵
  PID:9408
- C:\Windows\System\KnIuwDL.exe
  C:\Windows\System\KnIuwDL.exe
  2⤵
  PID:9932
- C:\Windows\System\hiuAwsC.exe
  C:\Windows\System\hiuAwsC.exe
  2⤵
  PID:9796
- C:\Windows\System\dPVJajU.exe
  C:\Windows\System\dPVJajU.exe
  2⤵
  PID:9828
- C:\Windows\System\wgKXBwq.exe
  C:\Windows\System\wgKXBwq.exe
  2⤵
  PID:10204
- C:\Windows\System\RsyiFAs.exe
  C:\Windows\System\RsyiFAs.exe
  2⤵
  PID:10040
- C:\Windows\System\yelaiPW.exe
  C:\Windows\System\yelaiPW.exe
  2⤵
  PID:10084
- C:\Windows\System\BQQcviV.exe
  C:\Windows\System\BQQcviV.exe
  2⤵
  PID:10108
- C:\Windows\System\JHigmrG.exe
  C:\Windows\System\JHigmrG.exe
  2⤵
  PID:10144
- C:\Windows\System\UsXsiLf.exe
  C:\Windows\System\UsXsiLf.exe
  2⤵
  PID:10168
- C:\Windows\System\lDOFaZx.exe
  C:\Windows\System\lDOFaZx.exe
  2⤵
  PID:6688
- C:\Windows\System\CYrlkdB.exe
  C:\Windows\System\CYrlkdB.exe
  2⤵
  PID:2360
- C:\Windows\System\mxmNpPH.exe
  C:\Windows\System\mxmNpPH.exe
  2⤵
  PID:8308
- C:\Windows\System\njJAaoL.exe
  C:\Windows\System\njJAaoL.exe
  2⤵
  PID:10256
- C:\Windows\System\qGyQbgl.exe
  C:\Windows\System\qGyQbgl.exe
  2⤵
  PID:10284
- C:\Windows\System\VDMSvyy.exe
  C:\Windows\System\VDMSvyy.exe
  2⤵
  PID:10304
- C:\Windows\System\vUpUsnO.exe
  C:\Windows\System\vUpUsnO.exe
  2⤵
  PID:10324
- C:\Windows\System\MJIuciy.exe
  C:\Windows\System\MJIuciy.exe
  2⤵
  PID:10340
- C:\Windows\System\fQTjASg.exe
  C:\Windows\System\fQTjASg.exe
  2⤵
  PID:10376
- C:\Windows\System\XZNaWfm.exe
  C:\Windows\System\XZNaWfm.exe
  2⤵
  PID:10396
- C:\Windows\System\vQxTsLW.exe
  C:\Windows\System\vQxTsLW.exe
  2⤵
  PID:10412
- C:\Windows\System\RWwtuXB.exe
  C:\Windows\System\RWwtuXB.exe
  2⤵
  PID:10428
- C:\Windows\System\FgRndvt.exe
  C:\Windows\System\FgRndvt.exe
  2⤵
  PID:10444
- C:\Windows\System\ZpUjwVd.exe
  C:\Windows\System\ZpUjwVd.exe
  2⤵
  PID:10472
- C:\Windows\System\FqLPuIL.exe
  C:\Windows\System\FqLPuIL.exe
  2⤵
  PID:10488
- C:\Windows\System\QWjXyrP.exe
  C:\Windows\System\QWjXyrP.exe
  2⤵
  PID:10504
- C:\Windows\System\kqovAjs.exe
  C:\Windows\System\kqovAjs.exe
  2⤵
  PID:10520
- C:\Windows\System\KTkmgUA.exe
  C:\Windows\System\KTkmgUA.exe
  2⤵
  PID:10536
- C:\Windows\System\QaKjzyu.exe
  C:\Windows\System\QaKjzyu.exe
  2⤵
  PID:10552
- C:\Windows\System\WrtrdVh.exe
  C:\Windows\System\WrtrdVh.exe
  2⤵
  PID:10568
- C:\Windows\System\kMmgqvz.exe
  C:\Windows\System\kMmgqvz.exe
  2⤵
  PID:10584
- C:\Windows\System\phmCRiB.exe
  C:\Windows\System\phmCRiB.exe
  2⤵
  PID:10604
- C:\Windows\System\PxxLNhe.exe
  C:\Windows\System\PxxLNhe.exe
  2⤵
  PID:10624
- C:\Windows\System\EUfvAXO.exe
  C:\Windows\System\EUfvAXO.exe
  2⤵
  PID:10648
- C:\Windows\System\PGHteec.exe
  C:\Windows\System\PGHteec.exe
  2⤵
  PID:10668
- C:\Windows\System\qdetqCA.exe
  C:\Windows\System\qdetqCA.exe
  2⤵
  PID:10692
- C:\Windows\System\gzWUDeb.exe
  C:\Windows\System\gzWUDeb.exe
  2⤵
  PID:10708
- C:\Windows\System\vNkTYrX.exe
  C:\Windows\System\vNkTYrX.exe
  2⤵
  PID:10732
- C:\Windows\System\PoRNewg.exe
  C:\Windows\System\PoRNewg.exe
  2⤵
  PID:10756
- C:\Windows\System\YEiShpQ.exe
  C:\Windows\System\YEiShpQ.exe
  2⤵
  PID:10772
- C:\Windows\System\QGaTFzs.exe
  C:\Windows\System\QGaTFzs.exe
  2⤵
  PID:10796
- C:\Windows\System\rMKvbvl.exe
  C:\Windows\System\rMKvbvl.exe
  2⤵
  PID:10812
- C:\Windows\System\gLHokPe.exe
  C:\Windows\System\gLHokPe.exe
  2⤵
  PID:10828
- C:\Windows\System\bOcAlHG.exe
  C:\Windows\System\bOcAlHG.exe
  2⤵
  PID:10928
- C:\Windows\System\ZDvCjZi.exe
  C:\Windows\System\ZDvCjZi.exe
  2⤵
  PID:10948
- C:\Windows\System\JOcMgtw.exe
  C:\Windows\System\JOcMgtw.exe
  2⤵
  PID:10964
- C:\Windows\System\DgYIsaz.exe
  C:\Windows\System\DgYIsaz.exe
  2⤵
  PID:10980
- C:\Windows\System\YsszbJY.exe
  C:\Windows\System\YsszbJY.exe
  2⤵
  PID:11044
- C:\Windows\System\RKmZFig.exe
  C:\Windows\System\RKmZFig.exe
  2⤵
  PID:11068
- C:\Windows\System\iQtpdrX.exe
  C:\Windows\System\iQtpdrX.exe
  2⤵
  PID:11084
- C:\Windows\System\guyzbbg.exe
  C:\Windows\System\guyzbbg.exe
  2⤵
  PID:10840
- C:\Windows\System\kBtvAeX.exe
  C:\Windows\System\kBtvAeX.exe
  2⤵
  PID:10940
- C:\Windows\System\lAmWlGD.exe
  C:\Windows\System\lAmWlGD.exe
  2⤵
  PID:9564
- C:\Windows\System\cUymvrB.exe
  C:\Windows\System\cUymvrB.exe
  2⤵
  PID:10896
- C:\Windows\System\jylGESi.exe
  C:\Windows\System\jylGESi.exe
  2⤵
  PID:6844
- C:\Windows\System\pGzdppA.exe
  C:\Windows\System\pGzdppA.exe
  2⤵
  PID:7360
- C:\Windows\System\GBpmxFm.exe
  C:\Windows\System\GBpmxFm.exe
  2⤵
  PID:10988
- C:\Windows\System\KAkWzuG.exe
  C:\Windows\System\KAkWzuG.exe
  2⤵
  PID:11060
- C:\Windows\System\VtbeZZn.exe
  C:\Windows\System\VtbeZZn.exe
  2⤵
  PID:11124
- C:\Windows\System\JsyXuVS.exe
  C:\Windows\System\JsyXuVS.exe
  2⤵
  PID:11232
- C:\Windows\System\TBRahxX.exe
  C:\Windows\System\TBRahxX.exe
  2⤵
  PID:1752
- C:\Windows\System\cnbbTvg.exe
  C:\Windows\System\cnbbTvg.exe
  2⤵
  PID:9604
- C:\Windows\System\cUIzuOl.exe
  C:\Windows\System\cUIzuOl.exe
  2⤵
  PID:10248
- C:\Windows\System\BpoGgEH.exe
  C:\Windows\System\BpoGgEH.exe
  2⤵
  PID:10512
- C:\Windows\System\XAlWZzG.exe
  C:\Windows\System\XAlWZzG.exe
  2⤵
  PID:10580
- C:\Windows\System\USAXgYw.exe
  C:\Windows\System\USAXgYw.exe
  2⤵
  PID:10752
- C:\Windows\System\fszkWob.exe
  C:\Windows\System\fszkWob.exe
  2⤵
  PID:10824
- C:\Windows\System\pSVLPVA.exe
  C:\Windows\System\pSVLPVA.exe
  2⤵
  PID:5660
- C:\Windows\System\TEKmyle.exe
  C:\Windows\System\TEKmyle.exe
  2⤵
  PID:9260
- C:\Windows\System\OHScuPz.exe
  C:\Windows\System\OHScuPz.exe
  2⤵
  PID:4252
- C:\Windows\System\IOSqJni.exe
  C:\Windows\System\IOSqJni.exe
  2⤵
  PID:11012
- C:\Windows\System\eXPWFic.exe
  C:\Windows\System\eXPWFic.exe
  2⤵
  PID:11216
- C:\Windows\System\vgtRYET.exe
  C:\Windows\System\vgtRYET.exe
  2⤵
  PID:11208
- C:\Windows\System\ajfFcQv.exe
  C:\Windows\System\ajfFcQv.exe
  2⤵
  PID:8092
- C:\Windows\System\DHsslVL.exe
  C:\Windows\System\DHsslVL.exe
  2⤵
  PID:4208
- C:\Windows\System\CInwDJd.exe
  C:\Windows\System\CInwDJd.exe
  2⤵
  PID:3272
- C:\Windows\System\npEuOAn.exe
  C:\Windows\System\npEuOAn.exe
  2⤵
  PID:4508
- C:\Windows\System\YgjDRbE.exe
  C:\Windows\System\YgjDRbE.exe
  2⤵
  PID:3276
- C:\Windows\System\hZJXRkm.exe
  C:\Windows\System\hZJXRkm.exe
  2⤵
  PID:10916
- C:\Windows\System\TcNvWgU.exe
  C:\Windows\System\TcNvWgU.exe
  2⤵
  PID:11248
- C:\Windows\System\iqfQQGJ.exe
  C:\Windows\System\iqfQQGJ.exe
  2⤵
  PID:2844
- C:\Windows\System\YwWKwHX.exe
  C:\Windows\System\YwWKwHX.exe
  2⤵
  PID:11276
- C:\Windows\System\aioHJmI.exe
  C:\Windows\System\aioHJmI.exe
  2⤵
  PID:11292
- C:\Windows\System\lEwkgPj.exe
  C:\Windows\System\lEwkgPj.exe
  2⤵
  PID:11320
- C:\Windows\System\FIskWdj.exe
  C:\Windows\System\FIskWdj.exe
  2⤵
  PID:11336
- C:\Windows\System\CwAiRaL.exe
  C:\Windows\System\CwAiRaL.exe
  2⤵
  PID:11368
- C:\Windows\System\NUPuczp.exe
  C:\Windows\System\NUPuczp.exe
  2⤵
  PID:11384
- C:\Windows\System\qcTEFCD.exe
  C:\Windows\System\qcTEFCD.exe
  2⤵
  PID:11400
- C:\Windows\System\eSpHNAi.exe
  C:\Windows\System\eSpHNAi.exe
  2⤵
  PID:11420
- C:\Windows\System\DYclWDv.exe
  C:\Windows\System\DYclWDv.exe
  2⤵
  PID:11440
- C:\Windows\System\fyMbbum.exe
  C:\Windows\System\fyMbbum.exe
  2⤵
  PID:11460
- C:\Windows\System\aUFRGpP.exe
  C:\Windows\System\aUFRGpP.exe
  2⤵
  PID:11476
- C:\Windows\System\qJFjDjL.exe
  C:\Windows\System\qJFjDjL.exe
  2⤵
  PID:11548
- C:\Windows\System\fQakhvE.exe
  C:\Windows\System\fQakhvE.exe
  2⤵
  PID:11564
- C:\Windows\System\vgbbBIp.exe
  C:\Windows\System\vgbbBIp.exe
  2⤵
  PID:11588
- C:\Windows\System\rrhfUde.exe
  C:\Windows\System\rrhfUde.exe
  2⤵
  PID:11616
- C:\Windows\System\kpKxxyG.exe
  C:\Windows\System\kpKxxyG.exe
  2⤵
  PID:11636
- C:\Windows\System\nxJHexy.exe
  C:\Windows\System\nxJHexy.exe
  2⤵
  PID:11660
- C:\Windows\System\rCiCDBg.exe
  C:\Windows\System\rCiCDBg.exe
  2⤵
  PID:11676
- C:\Windows\System\pKZADsl.exe
  C:\Windows\System\pKZADsl.exe
  2⤵
  PID:11824
- C:\Windows\System\GORMsHz.exe
  C:\Windows\System\GORMsHz.exe
  2⤵
  PID:11880
- C:\Windows\System\WOuuQkS.exe
  C:\Windows\System\WOuuQkS.exe
  2⤵
  PID:11908
- C:\Windows\System\eBThbya.exe
  C:\Windows\System\eBThbya.exe
  2⤵
  PID:11928
- C:\Windows\System\DZvUKXj.exe
  C:\Windows\System\DZvUKXj.exe
  2⤵
  PID:11948
- C:\Windows\System\GyJaYJO.exe
  C:\Windows\System\GyJaYJO.exe
  2⤵
  PID:11972
- C:\Windows\System\AiidNcy.exe
  C:\Windows\System\AiidNcy.exe
  2⤵
  PID:11992
- C:\Windows\System\SWeqAoi.exe
  C:\Windows\System\SWeqAoi.exe
  2⤵
  PID:12008
- C:\Windows\System\keCGCYV.exe
  C:\Windows\System\keCGCYV.exe
  2⤵
  PID:12032
- C:\Windows\System\jnHShcJ.exe
  C:\Windows\System\jnHShcJ.exe
  2⤵
  PID:12048
- C:\Windows\System\zrrZIkj.exe
  C:\Windows\System\zrrZIkj.exe
  2⤵
  PID:12064
- C:\Windows\System\yCONiyc.exe
  C:\Windows\System\yCONiyc.exe
  2⤵
  PID:12084
- C:\Windows\System\asayIkr.exe
  C:\Windows\System\asayIkr.exe
  2⤵
  PID:12124
- C:\Windows\System\uWvmYoD.exe
  C:\Windows\System\uWvmYoD.exe
  2⤵
  PID:12148
- C:\Windows\System\CwQILCW.exe
  C:\Windows\System\CwQILCW.exe
  2⤵
  PID:12164
- C:\Windows\System\BzKHqiv.exe
  C:\Windows\System\BzKHqiv.exe
  2⤵
  PID:12192
- C:\Windows\System\xHTCStl.exe
  C:\Windows\System\xHTCStl.exe
  2⤵
  PID:12212
- C:\Windows\System\qUolQho.exe
  C:\Windows\System\qUolQho.exe
  2⤵
  PID:12236
- C:\Windows\System\fsBMRJX.exe
  C:\Windows\System\fsBMRJX.exe
  2⤵
  PID:12256
- C:\Windows\System\kqlRpgg.exe
  C:\Windows\System\kqlRpgg.exe
  2⤵
  PID:12280
- C:\Windows\System\oOsykoG.exe
  C:\Windows\System\oOsykoG.exe
  2⤵
  PID:2944
- C:\Windows\System\zkoEiiG.exe
  C:\Windows\System\zkoEiiG.exe
  2⤵
  PID:11092
- C:\Windows\System\bBApQiu.exe
  C:\Windows\System\bBApQiu.exe
  2⤵
  PID:11352
- C:\Windows\System\QhfMRAi.exe
  C:\Windows\System\QhfMRAi.exe
  2⤵
  PID:11288
- C:\Windows\System\raYFlJj.exe
  C:\Windows\System\raYFlJj.exe
  2⤵
  PID:11328
- C:\Windows\System\CYCyksG.exe
  C:\Windows\System\CYCyksG.exe
  2⤵
  PID:11436
- C:\Windows\System\QPdScVA.exe
  C:\Windows\System\QPdScVA.exe
  2⤵
  PID:11472
- C:\Windows\System\piNgOzn.exe
  C:\Windows\System\piNgOzn.exe
  2⤵
  PID:11520
- C:\Windows\System\cKseBIu.exe
  C:\Windows\System\cKseBIu.exe
  2⤵
  PID:11556
- C:\Windows\System\KCMsBfi.exe
  C:\Windows\System\KCMsBfi.exe
  2⤵
  PID:11684
- C:\Windows\System\wMgvhUi.exe
  C:\Windows\System\wMgvhUi.exe
  2⤵
  PID:11608
- C:\Windows\System\KbAOiRX.exe
  C:\Windows\System\KbAOiRX.exe
  2⤵
  PID:11716
- C:\Windows\System\rCUMMPG.exe
  C:\Windows\System\rCUMMPG.exe
  2⤵
  PID:11904
- C:\Windows\System\VKRvUPi.exe
  C:\Windows\System\VKRvUPi.exe
  2⤵
  PID:11896
- C:\Windows\System\rNTXFrt.exe
  C:\Windows\System\rNTXFrt.exe
  2⤵
  PID:12000
- C:\Windows\System\pXShpDW.exe
  C:\Windows\System\pXShpDW.exe
  2⤵
  PID:11988
- C:\Windows\System\XVuwFIn.exe
  C:\Windows\System\XVuwFIn.exe
  2⤵
  PID:12076
- C:\Windows\System\hMOrHHA.exe
  C:\Windows\System\hMOrHHA.exe
  2⤵
  PID:12144
- C:\Windows\System\WVOAVsV.exe
  C:\Windows\System\WVOAVsV.exe
  2⤵
  PID:12188
- C:\Windows\System\OOArOMk.exe
  C:\Windows\System\OOArOMk.exe
  2⤵
  PID:12060
- C:\Windows\System\RVfJaUT.exe
  C:\Windows\System\RVfJaUT.exe
  2⤵
  PID:12092
- C:\Windows\System\yWgqOdA.exe
  C:\Windows\System\yWgqOdA.exe
  2⤵
  PID:12252
- C:\Windows\System\BarWFeE.exe
  C:\Windows\System\BarWFeE.exe
  2⤵
  PID:2044
- C:\Windows\System\zKadrIr.exe
  C:\Windows\System\zKadrIr.exe
  2⤵
  PID:4024
- C:\Windows\System\xEMxsEN.exe
  C:\Windows\System\xEMxsEN.exe
  2⤵
  PID:11300
- C:\Windows\System\BsuRhmH.exe
  C:\Windows\System\BsuRhmH.exe
  2⤵
  PID:12116
- C:\Windows\System\hBHUlPd.exe
  C:\Windows\System\hBHUlPd.exe
  2⤵
  PID:11820
- C:\Windows\System\gYpwwsC.exe
  C:\Windows\System\gYpwwsC.exe
  2⤵
  PID:12304
- C:\Windows\System\hYxNeie.exe
  C:\Windows\System\hYxNeie.exe
  2⤵
  PID:12324
- C:\Windows\System\hKuNdgx.exe
  C:\Windows\System\hKuNdgx.exe
  2⤵
  PID:12344
- C:\Windows\System\ceFoXzc.exe
  C:\Windows\System\ceFoXzc.exe
  2⤵
  PID:12368
- C:\Windows\System\WZpvsnG.exe
  C:\Windows\System\WZpvsnG.exe
  2⤵
  PID:12384
- C:\Windows\System\LSbtPYs.exe
  C:\Windows\System\LSbtPYs.exe
  2⤵
  PID:12412
- C:\Windows\System\jMFyDms.exe
  C:\Windows\System\jMFyDms.exe
  2⤵
  PID:12516
- C:\Windows\System\DksaHbL.exe
  C:\Windows\System\DksaHbL.exe
  2⤵
  PID:12536
- C:\Windows\System\vaJGYGD.exe
  C:\Windows\System\vaJGYGD.exe
  2⤵
  PID:12556
- C:\Windows\System\YKozTnL.exe
  C:\Windows\System\YKozTnL.exe
  2⤵
  PID:12732
- C:\Windows\System\LusuAYQ.exe
  C:\Windows\System\LusuAYQ.exe
  2⤵
  PID:12768
- C:\Windows\System\LIFGHaN.exe
  C:\Windows\System\LIFGHaN.exe
  2⤵
  PID:12792
- C:\Windows\System\DiDFEcn.exe
  C:\Windows\System\DiDFEcn.exe
  2⤵
  PID:12812
- C:\Windows\System\aohxiuy.exe
  C:\Windows\System\aohxiuy.exe
  2⤵
  PID:12832
- C:\Windows\System\NErXoGl.exe
  C:\Windows\System\NErXoGl.exe
  2⤵
  PID:12856
- C:\Windows\System\MrBOcwy.exe
  C:\Windows\System\MrBOcwy.exe
  2⤵
  PID:12876
- C:\Windows\System\UiKEvVf.exe
  C:\Windows\System\UiKEvVf.exe
  2⤵
  PID:12904
- C:\Windows\System\KJADQuD.exe
  C:\Windows\System\KJADQuD.exe
  2⤵
  PID:12924
- C:\Windows\System\vLQOGkA.exe
  C:\Windows\System\vLQOGkA.exe
  2⤵
  PID:12940
- C:\Windows\System\VWVVuDo.exe
  C:\Windows\System\VWVVuDo.exe
  2⤵
  PID:12964
- C:\Windows\System\kcRftYZ.exe
  C:\Windows\System\kcRftYZ.exe
  2⤵
  PID:12984
- C:\Windows\System\exhHJoB.exe
  C:\Windows\System\exhHJoB.exe
  2⤵
  PID:13296
- C:\Windows\System\EGayxpE.exe
  C:\Windows\System\EGayxpE.exe
  2⤵
  PID:692
- C:\Windows\System\TyhyydM.exe
  C:\Windows\System\TyhyydM.exe
  2⤵
  PID:12320
- C:\Windows\System\tdWYrgw.exe
  C:\Windows\System\tdWYrgw.exe
  2⤵
  PID:11628
- C:\Windows\System\MkcPAlV.exe
  C:\Windows\System\MkcPAlV.exe
  2⤵
  PID:12448
- C:\Windows\System\fdpeobB.exe
  C:\Windows\System\fdpeobB.exe
  2⤵
  PID:11416
- C:\Windows\System\AczHRtY.exe
  C:\Windows\System\AczHRtY.exe
  2⤵
  PID:12160
- C:\Windows\System\qKHgkFS.exe
  C:\Windows\System\qKHgkFS.exe
  2⤵
  PID:11312
- C:\Windows\System\DkNXHsh.exe
  C:\Windows\System\DkNXHsh.exe
  2⤵
  PID:11764
- C:\Windows\System\nxlbVIJ.exe
  C:\Windows\System\nxlbVIJ.exe
  2⤵
  PID:12624
- C:\Windows\System\RdvKNsf.exe
  C:\Windows\System\RdvKNsf.exe
  2⤵
  PID:12296
- C:\Windows\System\xjqYozh.exe
  C:\Windows\System\xjqYozh.exe
  2⤵
  PID:12356
- C:\Windows\System\VjUYEgQ.exe
  C:\Windows\System\VjUYEgQ.exe
  2⤵
  PID:12392
- C:\Windows\System\GpSPGbC.exe
  C:\Windows\System\GpSPGbC.exe
  2⤵
  PID:12504
- C:\Windows\System\HgkGiBQ.exe
  C:\Windows\System\HgkGiBQ.exe
  2⤵
  PID:12532
- C:\Windows\System\bssSXWc.exe
  C:\Windows\System\bssSXWc.exe
  2⤵
  PID:12656
- C:\Windows\System\zTroSNL.exe
  C:\Windows\System\zTroSNL.exe
  2⤵
  PID:12760
- C:\Windows\System\RnAaQBK.exe
  C:\Windows\System\RnAaQBK.exe
  2⤵
  PID:12956
- C:\Windows\System\TYYrYBz.exe
  C:\Windows\System\TYYrYBz.exe
  2⤵
  PID:13036
- C:\Windows\System\kxgGjRU.exe
  C:\Windows\System\kxgGjRU.exe
  2⤵
  PID:13052
- C:\Windows\System\idyrsYW.exe
  C:\Windows\System\idyrsYW.exe
  2⤵
  PID:12896
- C:\Windows\System\EGDciLC.exe
  C:\Windows\System\EGDciLC.exe
  2⤵
  PID:12932
- C:\Windows\System\QPETztr.exe
  C:\Windows\System\QPETztr.exe
  2⤵
  PID:12972
- C:\Windows\System\gKBvNDC.exe
  C:\Windows\System\gKBvNDC.exe
  2⤵
  PID:11888
- C:\Windows\System\dNBwwsx.exe
  C:\Windows\System\dNBwwsx.exe
  2⤵
  PID:11700
- C:\Windows\System\tEwtIBo.exe
  C:\Windows\System\tEwtIBo.exe
  2⤵
  PID:12264
- C:\Windows\System\KTYovFf.exe
  C:\Windows\System\KTYovFf.exe
  2⤵
  PID:12336
- C:\Windows\System\pWFlCPl.exe
  C:\Windows\System\pWFlCPl.exe
  2⤵
  PID:12472
- C:\Windows\System\FAyZCZH.exe
  C:\Windows\System\FAyZCZH.exe
  2⤵
  PID:12376
- C:\Windows\System\tOFMzwA.exe
  C:\Windows\System\tOFMzwA.exe
  2⤵
  PID:12620
- C:\Windows\System\opKgeOc.exe
  C:\Windows\System\opKgeOc.exe
  2⤵
  PID:12996
- C:\Windows\System\KspOSYE.exe
  C:\Windows\System\KspOSYE.exe
  2⤵
  PID:1220
- C:\Windows\System\zArupjV.exe
  C:\Windows\System\zArupjV.exe
  2⤵
  PID:2132
- C:\Windows\System\CisJAkH.exe
  C:\Windows\System\CisJAkH.exe
  2⤵
  PID:12644
- C:\Windows\System\VDOGGWS.exe
  C:\Windows\System\VDOGGWS.exe
  2⤵
  PID:12692
- C:\Windows\System\QDjFGDL.exe
  C:\Windows\System\QDjFGDL.exe
  2⤵
  PID:13164
- C:\Windows\System\SFEtnXF.exe
  C:\Windows\System\SFEtnXF.exe
  2⤵
  PID:4680
- C:\Windows\System\rBfjqIN.exe
  C:\Windows\System\rBfjqIN.exe
  2⤵
  PID:260
- C:\Windows\System\zTDxvGA.exe
  C:\Windows\System\zTDxvGA.exe
  2⤵
  PID:12636
- C:\Windows\System\SgMnnCE.exe
  C:\Windows\System\SgMnnCE.exe
  2⤵
  PID:12920
- C:\Windows\System\mKJUpKe.exe
  C:\Windows\System\mKJUpKe.exe
  2⤵
  PID:4452
- C:\Windows\System\kuGxbwp.exe
  C:\Windows\System\kuGxbwp.exe
  2⤵
  PID:1756
- C:\Windows\System\yFkRjCP.exe
  C:\Windows\System\yFkRjCP.exe
  2⤵
  PID:1188
- C:\Windows\System\HIXpDsK.exe
  C:\Windows\System\HIXpDsK.exe
  2⤵
  PID:13196
- C:\Windows\System\KVWSEhZ.exe
  C:\Windows\System\KVWSEhZ.exe
  2⤵
  PID:4428
- C:\Windows\System\LJbzpic.exe
  C:\Windows\System\LJbzpic.exe
  2⤵
  PID:12752
- C:\Windows\System\xrJVjGS.exe
  C:\Windows\System\xrJVjGS.exe
  2⤵
  PID:11916
- C:\Windows\System\zetoaNv.exe
  C:\Windows\System\zetoaNv.exe
  2⤵
  PID:12884
- C:\Windows\System\gUBENzR.exe
  C:\Windows\System\gUBENzR.exe
  2⤵
  PID:4544
- C:\Windows\System\ZGdypSk.exe
  C:\Windows\System\ZGdypSk.exe
  2⤵
  PID:4608
- C:\Windows\System\HRIJmgc.exe
  C:\Windows\System\HRIJmgc.exe
  2⤵
  PID:2532
- C:\Windows\System\QRrjeYg.exe
  C:\Windows\System\QRrjeYg.exe
  2⤵
  PID:2820
- C:\Windows\System\lQdevWl.exe
  C:\Windows\System\lQdevWl.exe
  2⤵
  PID:464
- C:\Windows\System\mtnVGsW.exe
  C:\Windows\System\mtnVGsW.exe
  2⤵
  PID:13324
- C:\Windows\System\XHlZciR.exe
  C:\Windows\System\XHlZciR.exe
  2⤵
  PID:13424
- C:\Windows\System\omGvlmt.exe
  C:\Windows\System\omGvlmt.exe
  2⤵
  PID:13452
- C:\Windows\System\zcNscNh.exe
  C:\Windows\System\zcNscNh.exe
  2⤵
  PID:13616
- C:\Windows\System\fGNsIUb.exe
  C:\Windows\System\fGNsIUb.exe
  2⤵
  PID:13632
- C:\Windows\System\jXUPSgR.exe
  C:\Windows\System\jXUPSgR.exe
  2⤵
  PID:13652
- C:\Windows\System\bfdORSK.exe
  C:\Windows\System\bfdORSK.exe
  2⤵
  PID:13672
- C:\Windows\System\laGgNoF.exe
  C:\Windows\System\laGgNoF.exe
  2⤵
  PID:13696
- C:\Windows\System\rncwJJo.exe
  C:\Windows\System\rncwJJo.exe
  2⤵
  PID:13788
- C:\Windows\System\ubyLPvj.exe
  C:\Windows\System\ubyLPvj.exe
  2⤵
  PID:13808
- C:\Windows\System\mHRUGDN.exe
  C:\Windows\System\mHRUGDN.exe
  2⤵
  PID:13828
- C:\Windows\System\QrKksRz.exe
  C:\Windows\System\QrKksRz.exe
  2⤵
  PID:13848
- C:\Windows\System\mDpiSbb.exe
  C:\Windows\System\mDpiSbb.exe
  2⤵
  PID:13868
- C:\Windows\System\ZoOhBrb.exe
  C:\Windows\System\ZoOhBrb.exe
  2⤵
  PID:13900
- C:\Windows\System\FVZOPMq.exe
  C:\Windows\System\FVZOPMq.exe
  2⤵
  PID:13920
- C:\Windows\System\urdtSbq.exe
  C:\Windows\System\urdtSbq.exe
  2⤵
  PID:13936
- C:\Windows\System\Gpxwctp.exe
  C:\Windows\System\Gpxwctp.exe
  2⤵
  PID:13968
- C:\Windows\System\dvHNUaY.exe
  C:\Windows\System\dvHNUaY.exe
  2⤵
  PID:13988
- C:\Windows\System\BqFTQAp.exe
  C:\Windows\System\BqFTQAp.exe
  2⤵
  PID:14012
- C:\Windows\System\cVjvEzt.exe
  C:\Windows\System\cVjvEzt.exe
  2⤵
  PID:14080
- C:\Windows\System\EjuUqOO.exe
  C:\Windows\System\EjuUqOO.exe
  2⤵
  PID:14096
- C:\Windows\System\dIUtBRC.exe
  C:\Windows\System\dIUtBRC.exe
  2⤵
  PID:14112
- C:\Windows\System\bTPyLkW.exe
  C:\Windows\System\bTPyLkW.exe
  2⤵
  PID:14132
- C:\Windows\System\SjMpJua.exe
  C:\Windows\System\SjMpJua.exe
  2⤵
  PID:14152
- C:\Windows\System\UyFISzA.exe
  C:\Windows\System\UyFISzA.exe
  2⤵
  PID:13404
- C:\Windows\System\CxmZKsU.exe
  C:\Windows\System\CxmZKsU.exe
  2⤵
  PID:2520
- C:\Windows\System\kHVlTfX.exe
  C:\Windows\System\kHVlTfX.exe
  2⤵
  PID:2284
- C:\Windows\System\sNzVqml.exe
  C:\Windows\System\sNzVqml.exe
  2⤵
  PID:12452
- C:\Windows\System\OYJefAf.exe
  C:\Windows\System\OYJefAf.exe
  2⤵
  PID:13412
- C:\Windows\System\YuDxBXI.exe
  C:\Windows\System\YuDxBXI.exe
  2⤵
  PID:2416
- C:\Windows\System\bOudFyH.exe
  C:\Windows\System\bOudFyH.exe
  2⤵
  PID:13572
- C:\Windows\System\RPyWbaC.exe
  C:\Windows\System\RPyWbaC.exe
  2⤵
  PID:564
- C:\Windows\System\VEJmyxM.exe
  C:\Windows\System\VEJmyxM.exe
  2⤵
  PID:13504
- C:\Windows\System\rTALXYT.exe
  C:\Windows\System\rTALXYT.exe
  2⤵
  PID:13760
- C:\Windows\System\WOiQgLD.exe
  C:\Windows\System\WOiQgLD.exe
  2⤵
  PID:13684
- C:\Windows\System\VRifNXD.exe
  C:\Windows\System\VRifNXD.exe
  2⤵
  PID:13776
- C:\Windows\System\WwnSMbD.exe
  C:\Windows\System\WwnSMbD.exe
  2⤵
  PID:13844
- C:\Windows\System\ErjgVPP.exe
  C:\Windows\System\ErjgVPP.exe
  2⤵
  PID:13556
- C:\Windows\System\CiwgiPy.exe
  C:\Windows\System\CiwgiPy.exe
  2⤵
  PID:13604
- C:\Windows\System\wTduuqd.exe
  C:\Windows\System\wTduuqd.exe
  2⤵
  PID:13908
- C:\Windows\System\PgWtaBc.exe
  C:\Windows\System\PgWtaBc.exe
  2⤵
  PID:13648
- C:\Windows\System\KJPVUWs.exe
  C:\Windows\System\KJPVUWs.exe
  2⤵
  PID:3868
- C:\Windows\System\iCXqzjj.exe
  C:\Windows\System\iCXqzjj.exe
  2⤵
  PID:13744
- C:\Windows\System\PlcnGZK.exe
  C:\Windows\System\PlcnGZK.exe
  2⤵
  PID:1984
- C:\Windows\System\GeeSvsu.exe
  C:\Windows\System\GeeSvsu.exe
  2⤵
  PID:13820
- C:\Windows\System\NspwNjL.exe
  C:\Windows\System\NspwNjL.exe
  2⤵
  PID:13880
- C:\Windows\System\fHbRTLV.exe
  C:\Windows\System\fHbRTLV.exe
  2⤵
  PID:13888
- C:\Windows\System\pjQxtPU.exe
  C:\Windows\System\pjQxtPU.exe
  2⤵
  PID:14148
- C:\Windows\System\HrEDbRA.exe
  C:\Windows\System\HrEDbRA.exe
  2⤵
  PID:14268
- C:\Windows\System\DOTiABX.exe
  C:\Windows\System\DOTiABX.exe
  2⤵
  PID:14160
- C:\Windows\System\TIDbBsx.exe
  C:\Windows\System\TIDbBsx.exe
  2⤵
  PID:14024
- C:\Windows\System\SmzTjDo.exe
  C:\Windows\System\SmzTjDo.exe
  2⤵
  PID:14048
- C:\Windows\System\uriYfbl.exe
  C:\Windows\System\uriYfbl.exe
  2⤵
  PID:14064
- C:\Windows\System\pmvmOlE.exe
  C:\Windows\System\pmvmOlE.exe
  2⤵
  PID:14104
- C:\Windows\System\lEcklei.exe
  C:\Windows\System\lEcklei.exe
  2⤵
  PID:5224
- C:\Windows\System\HfQdxVm.exe
  C:\Windows\System\HfQdxVm.exe
  2⤵
  PID:2352
- C:\Windows\System\umgzvUQ.exe
  C:\Windows\System\umgzvUQ.exe
  2⤵
  PID:3644
- C:\Windows\System\NXaFMtf.exe
  C:\Windows\System\NXaFMtf.exe
  2⤵
  PID:13856
- C:\Windows\System\ZDRumXb.exe
  C:\Windows\System\ZDRumXb.exe
  2⤵
  PID:5204
- C:\Windows\System\ITxQEpX.exe
  C:\Windows\System\ITxQEpX.exe
  2⤵
  PID:1172
- C:\Windows\System\tYKirji.exe
  C:\Windows\System\tYKirji.exe
  2⤵
  PID:13948
- C:\Windows\System\UnxpuKq.exe
  C:\Windows\System\UnxpuKq.exe
  2⤵
  PID:14188
- C:\Windows\System\WMFSiKP.exe
  C:\Windows\System\WMFSiKP.exe
  2⤵
  PID:1924
- C:\Windows\System\tAeLpqw.exe
  C:\Windows\System\tAeLpqw.exe
  2⤵
  PID:5556
- C:\Windows\System\lPrPhHp.exe
  C:\Windows\System\lPrPhHp.exe
  2⤵
  PID:5608
- C:\Windows\System\MakCSUE.exe
  C:\Windows\System\MakCSUE.exe
  2⤵
  PID:5416
- C:\Windows\System\aNNddbF.exe
  C:\Windows\System\aNNddbF.exe
  2⤵
  PID:5136
- C:\Windows\System\hSZumgZ.exe
  C:\Windows\System\hSZumgZ.exe
  2⤵
  PID:12676
- C:\Windows\System\pqfABDW.exe
  C:\Windows\System\pqfABDW.exe
  2⤵
  PID:13524
- C:\Windows\System\TeNbxjv.exe
  C:\Windows\System\TeNbxjv.exe
  2⤵
  PID:4776
- C:\Windows\System\sAkrrfK.exe
  C:\Windows\System\sAkrrfK.exe
  2⤵
  PID:3096
- C:\Windows\System\AvSqAQK.exe
  C:\Windows\System\AvSqAQK.exe
  2⤵
  PID:5988
- C:\Windows\System\piHAvam.exe
  C:\Windows\System\piHAvam.exe
  2⤵
  PID:5156
- C:\Windows\System\iWhGpqI.exe
  C:\Windows\System\iWhGpqI.exe
  2⤵
  PID:5888
- C:\Windows\System\kLBrzhL.exe
  C:\Windows\System\kLBrzhL.exe
  2⤵
  PID:13704
- C:\Windows\System\YZMmYuf.exe
  C:\Windows\System\YZMmYuf.exe
  2⤵
  PID:5396
- C:\Windows\System\UzlWbtQ.exe
  C:\Windows\System\UzlWbtQ.exe
  2⤵
  PID:6104
- C:\Windows\System\hSevQrN.exe
  C:\Windows\System\hSevQrN.exe
  2⤵
  PID:6900
- C:\Windows\System\jLvfTIf.exe
  C:\Windows\System\jLvfTIf.exe
  2⤵
  PID:2592
- C:\Windows\System\LmUvIfv.exe
  C:\Windows\System\LmUvIfv.exe
  2⤵
  PID:13112
- C:\Windows\System\BxFPbVI.exe
  C:\Windows\System\BxFPbVI.exe
  2⤵
  PID:13624
- C:\Windows\System\vVMGmNU.exe
  C:\Windows\System\vVMGmNU.exe
  2⤵
  PID:3752
- C:\Windows\System\BDjgCNs.exe
  C:\Windows\System\BDjgCNs.exe
  2⤵
  PID:6772
- C:\Windows\System\acJDIAE.exe
  C:\Windows\System\acJDIAE.exe
  2⤵
  PID:3772
- C:\Windows\System\yHAAHLR.exe
  C:\Windows\System\yHAAHLR.exe
  2⤵
  PID:13400
- C:\Windows\System\uodmIVv.exe
  C:\Windows\System\uodmIVv.exe
  2⤵
  PID:14044
- C:\Windows\System\qUUwwHb.exe
  C:\Windows\System\qUUwwHb.exe
  2⤵
  PID:1164
- C:\Windows\System\KpsECsG.exe
  C:\Windows\System\KpsECsG.exe
  2⤵
  PID:5176
- C:\Windows\System\kEClSVs.exe
  C:\Windows\System\kEClSVs.exe
  2⤵
  PID:3164
- C:\Windows\System\NfJtFeU.exe
  C:\Windows\System\NfJtFeU.exe
  2⤵
  PID:3968
- C:\Windows\System\WdNZOpK.exe
  C:\Windows\System\WdNZOpK.exe
  2⤵
  PID:5560
- C:\Windows\System\wfneSdQ.exe
  C:\Windows\System\wfneSdQ.exe
  2⤵
  PID:4072
- C:\Windows\System\Amzgovl.exe
  C:\Windows\System\Amzgovl.exe
  2⤵
  PID:14092
- C:\Windows\System\DaaYCHk.exe
  C:\Windows\System\DaaYCHk.exe
  2⤵
  PID:436
- C:\Windows\System\ZEFoHTo.exe
  C:\Windows\System\ZEFoHTo.exe
  2⤵
  PID:6888
- C:\Windows\System\bqlbxmK.exe
  C:\Windows\System\bqlbxmK.exe
  2⤵
  PID:4676
- C:\Windows\System\ugelzDI.exe
  C:\Windows\System\ugelzDI.exe
  2⤵
  PID:13488
- C:\Windows\System\OdmIOiy.exe
  C:\Windows\System\OdmIOiy.exe
  2⤵
  PID:7460
- C:\Windows\System\AUseVDD.exe
  C:\Windows\System\AUseVDD.exe
  2⤵
  PID:6876
- C:\Windows\System\sKbGAje.exe
  C:\Windows\System\sKbGAje.exe
  2⤵
  PID:7132
- C:\Windows\System\vXpudMo.exe
  C:\Windows\System\vXpudMo.exe
  2⤵
  PID:13392
- C:\Windows\System\MBXCzSG.exe
  C:\Windows\System\MBXCzSG.exe
  2⤵
  PID:5956
- C:\Windows\System\zmzFtFu.exe
  C:\Windows\System\zmzFtFu.exe
  2⤵
  PID:5580
- C:\Windows\System\eQmscob.exe
  C:\Windows\System\eQmscob.exe
  2⤵
  PID:8276
- C:\Windows\System\arQQOTm.exe
  C:\Windows\System\arQQOTm.exe
  2⤵
  PID:6928
- C:\Windows\System\tKZCVpK.exe
  C:\Windows\System\tKZCVpK.exe
  2⤵
  PID:7308
- C:\Windows\System\pdRxdfu.exe
  C:\Windows\System\pdRxdfu.exe
  2⤵
  PID:7416
- C:\Windows\System\OOTGIOA.exe
  C:\Windows\System\OOTGIOA.exe
  2⤵
  PID:5532
- C:\Windows\System\JHnUbHP.exe
  C:\Windows\System\JHnUbHP.exe
  2⤵
  PID:5584
- C:\Windows\System\bvFRYng.exe
  C:\Windows\System\bvFRYng.exe
  2⤵
  PID:7764
- C:\Windows\System\hEBQQNy.exe
  C:\Windows\System\hEBQQNy.exe
  2⤵
  PID:8112
- C:\Windows\System\haQAiMe.exe
  C:\Windows\System\haQAiMe.exe
  2⤵
  PID:4964
- C:\Windows\System\idwRORx.exe
  C:\Windows\System\idwRORx.exe
  2⤵
  PID:8056
- C:\Windows\System\lnpLkLs.exe
  C:\Windows\System\lnpLkLs.exe
  2⤵
  PID:12976
- C:\Windows\System\JZUJMEn.exe
  C:\Windows\System\JZUJMEn.exe
  2⤵
  PID:5752
- C:\Windows\System\cryJxhK.exe
  C:\Windows\System\cryJxhK.exe
  2⤵
  PID:13960
- C:\Windows\System\SfGrnvp.exe
  C:\Windows\System\SfGrnvp.exe
  2⤵
  PID:8160
- C:\Windows\System\nOUGTqS.exe
  C:\Windows\System\nOUGTqS.exe
  2⤵
  PID:5992
- C:\Windows\System\YAYvuZG.exe
  C:\Windows\System\YAYvuZG.exe
  2⤵
  PID:11224
- C:\Windows\System\SRbzNNt.exe
  C:\Windows\System\SRbzNNt.exe
  2⤵
  PID:8632
- C:\Windows\System\vfUcgrf.exe
  C:\Windows\System\vfUcgrf.exe
  2⤵
  PID:9208
- C:\Windows\System\ybibQjG.exe
  C:\Windows\System\ybibQjG.exe
  2⤵
  PID:6768
- C:\Windows\System\dIgBfnp.exe
  C:\Windows\System\dIgBfnp.exe
  2⤵
  PID:5264
- C:\Windows\System\cyfffGs.exe
  C:\Windows\System\cyfffGs.exe
  2⤵
  PID:13532
- C:\Windows\System\Ilhxavq.exe
  C:\Windows\System\Ilhxavq.exe
  2⤵
  PID:4052
- C:\Windows\System\KQhDsSw.exe
  C:\Windows\System\KQhDsSw.exe
  2⤵
  PID:5792
- C:\Windows\System\ZxDDZOw.exe
  C:\Windows\System\ZxDDZOw.exe
  2⤵
  PID:8808
- C:\Windows\System\FwaxCiU.exe
  C:\Windows\System\FwaxCiU.exe
  2⤵
  PID:7572
- C:\Windows\System\OemRBYo.exe
  C:\Windows\System\OemRBYo.exe
  2⤵
  PID:12552
- C:\Windows\System\rAQyBuE.exe
  C:\Windows\System\rAQyBuE.exe
  2⤵
  PID:8836
- C:\Windows\System\yytXpNQ.exe
  C:\Windows\System\yytXpNQ.exe
  2⤵
  PID:9012
- C:\Windows\System\MaloiDD.exe
  C:\Windows\System\MaloiDD.exe
  2⤵
  PID:8996
- C:\Windows\System\TdIzXTa.exe
  C:\Windows\System\TdIzXTa.exe
  2⤵
  PID:9036
- C:\Windows\System\nBhwcUC.exe
  C:\Windows\System\nBhwcUC.exe
  2⤵
  PID:8420
- C:\Windows\System\COrIILG.exe
  C:\Windows\System\COrIILG.exe
  2⤵
  PID:10716
- C:\Windows\System\sSRllZv.exe
  C:\Windows\System\sSRllZv.exe
  2⤵
  PID:4492
- C:\Windows\System\aCuItAz.exe
  C:\Windows\System\aCuItAz.exe
  2⤵
  PID:8700
- C:\Windows\System\yckNztY.exe
  C:\Windows\System\yckNztY.exe
  2⤵
  PID:6884
- C:\Windows\System\ocuhRPY.exe
  C:\Windows\System\ocuhRPY.exe
  2⤵
  PID:6948
- C:\Windows\System\ZgFVzlf.exe
  C:\Windows\System\ZgFVzlf.exe
  2⤵
  PID:1132
- C:\Windows\System\VOHqVpr.exe
  C:\Windows\System\VOHqVpr.exe
  2⤵
  PID:9124
- C:\Windows\System\ccmvfrF.exe
  C:\Windows\System\ccmvfrF.exe
  2⤵
  PID:5896
- C:\Windows\System\eAfVOtP.exe
  C:\Windows\System\eAfVOtP.exe
  2⤵
  PID:5268
- C:\Windows\System\LSTZjkb.exe
  C:\Windows\System\LSTZjkb.exe
  2⤵
  PID:9176
- C:\Windows\System\aHXkjwx.exe
  C:\Windows\System\aHXkjwx.exe
  2⤵
  PID:6256
- C:\Windows\System\nDmmAGY.exe
  C:\Windows\System\nDmmAGY.exe
  2⤵
  PID:8840
- C:\Windows\System\NaPSwzE.exe
  C:\Windows\System\NaPSwzE.exe
  2⤵
  PID:7736
- C:\Windows\System\bYHsiWf.exe
  C:\Windows\System\bYHsiWf.exe
  2⤵
  PID:8816
- C:\Windows\System\rXKbVDZ.exe
  C:\Windows\System\rXKbVDZ.exe
  2⤵
  PID:8300
- C:\Windows\System\faIFxWa.exe
  C:\Windows\System\faIFxWa.exe
  2⤵
  PID:9108
- C:\Windows\System\CBzdbSz.exe
  C:\Windows\System\CBzdbSz.exe
  2⤵
  PID:7980
- C:\Windows\System\ntuXQnP.exe
  C:\Windows\System\ntuXQnP.exe
  2⤵
  PID:7960
- C:\Windows\System\pzQYdrf.exe
  C:\Windows\System\pzQYdrf.exe
  2⤵
  PID:7304
- C:\Windows\System\iOaaPHH.exe
  C:\Windows\System\iOaaPHH.exe
  2⤵
  PID:7420
- C:\Windows\System\TauoBsE.exe
  C:\Windows\System\TauoBsE.exe
  2⤵
  PID:6660
- C:\Windows\System\etAhBnE.exe
  C:\Windows\System\etAhBnE.exe
  2⤵
  PID:7348
- C:\Windows\System\tYnHdjB.exe
  C:\Windows\System\tYnHdjB.exe
  2⤵
  PID:8800
- C:\Windows\System\tjoQfWc.exe
  C:\Windows\System\tjoQfWc.exe
  2⤵
  PID:5612
- C:\Windows\System\xPsNBSB.exe
  C:\Windows\System\xPsNBSB.exe
  2⤵
  PID:8612
- C:\Windows\System\BPDGkIA.exe
  C:\Windows\System\BPDGkIA.exe
  2⤵
  PID:13800
- C:\Windows\System\Hyasasi.exe
  C:\Windows\System\Hyasasi.exe
  2⤵
  PID:14272
- C:\Windows\System\ICwvILf.exe
  C:\Windows\System\ICwvILf.exe
  2⤵
  PID:8664
- C:\Windows\System\rtOThpH.exe
  C:\Windows\System\rtOThpH.exe
  2⤵
  PID:13596
- C:\Windows\System\LXJIGts.exe
  C:\Windows\System\LXJIGts.exe
  2⤵
  PID:8180
- C:\Windows\System\ejjLnkW.exe
  C:\Windows\System\ejjLnkW.exe
  2⤵
  PID:9200
- C:\Windows\System\MQiTtqc.exe
  C:\Windows\System\MQiTtqc.exe
  2⤵
  PID:7116
- C:\Windows\System\vKcIDBW.exe
  C:\Windows\System\vKcIDBW.exe
  2⤵
  PID:7672
- C:\Windows\System\RhJyAwH.exe
  C:\Windows\System\RhJyAwH.exe
  2⤵
  PID:5640
- C:\Windows\System\AAZVlYf.exe
  C:\Windows\System\AAZVlYf.exe
  2⤵
  PID:9104
- C:\Windows\System\HHAaXrn.exe
  C:\Windows\System\HHAaXrn.exe
  2⤵
  PID:8644
- C:\Windows\System\hDPfJwH.exe
  C:\Windows\System\hDPfJwH.exe
  2⤵
  PID:8016
- C:\Windows\System\Nhanltw.exe
  C:\Windows\System\Nhanltw.exe
  2⤵
  PID:6336
- C:\Windows\System\ArxCEVa.exe
  C:\Windows\System\ArxCEVa.exe
  2⤵
  PID:8720
- C:\Windows\System\yAnudXW.exe
  C:\Windows\System\yAnudXW.exe
  2⤵
  PID:7564
- C:\Windows\System\YGlCTgn.exe
  C:\Windows\System\YGlCTgn.exe
  2⤵
  PID:8024
- C:\Windows\System\KdYXvgd.exe
  C:\Windows\System\KdYXvgd.exe
  2⤵
  PID:7344
- C:\Windows\System\NGDsegF.exe
  C:\Windows\System\NGDsegF.exe
  2⤵
  PID:8292
- C:\Windows\System\rslJQpH.exe
  C:\Windows\System\rslJQpH.exe
  2⤵
  PID:5480
- C:\Windows\System\hKlngKx.exe
  C:\Windows\System\hKlngKx.exe
  2⤵
  PID:14344
- C:\Windows\System\IJkCvBy.exe
  C:\Windows\System\IJkCvBy.exe
  2⤵
  PID:14360
- C:\Windows\System\BaVzqXK.exe
  C:\Windows\System\BaVzqXK.exe
  2⤵
  PID:14380
- C:\Windows\System\XYVXBFq.exe
  C:\Windows\System\XYVXBFq.exe
  2⤵
  PID:14396
- C:\Windows\System\mDNKokB.exe
  C:\Windows\System\mDNKokB.exe
  2⤵
  PID:14416
- C:\Windows\System\eRFxHpz.exe
  C:\Windows\System\eRFxHpz.exe
  2⤵
  PID:14440
- C:\Windows\System\fjWeFUk.exe
  C:\Windows\System\fjWeFUk.exe
  2⤵
  PID:14460
- C:\Windows\System\DHeweeu.exe
  C:\Windows\System\DHeweeu.exe
  2⤵
  PID:14484
- C:\Windows\System\BaouKga.exe
  C:\Windows\System\BaouKga.exe
  2⤵
  PID:14508
- C:\Windows\System\wEmIBIL.exe
  C:\Windows\System\wEmIBIL.exe
  2⤵
  PID:14528
- C:\Windows\System\ozBPOYB.exe
  C:\Windows\System\ozBPOYB.exe
  2⤵
  PID:14548
- C:\Windows\System\xjogHcO.exe
  C:\Windows\System\xjogHcO.exe
  2⤵
  PID:14568
- C:\Windows\System\kRegvDC.exe
  C:\Windows\System\kRegvDC.exe
  2⤵
  PID:14592
- C:\Windows\System\nDdFjUE.exe
  C:\Windows\System\nDdFjUE.exe
  2⤵
  PID:14616
- C:\Windows\System\wgkqzdl.exe
  C:\Windows\System\wgkqzdl.exe
  2⤵
  PID:14632
- C:\Windows\System\eAwHSHN.exe
  C:\Windows\System\eAwHSHN.exe
  2⤵
  PID:14656
- C:\Windows\System\ypnhLuN.exe
  C:\Windows\System\ypnhLuN.exe
  2⤵
  PID:14676
- C:\Windows\System\zcwmxAC.exe
  C:\Windows\System\zcwmxAC.exe
  2⤵
  PID:14704
- C:\Windows\System\zfLlPHN.exe
  C:\Windows\System\zfLlPHN.exe
  2⤵
  PID:14720
- C:\Windows\System\mEDUWgU.exe
  C:\Windows\System\mEDUWgU.exe
  2⤵
  PID:14736
- C:\Windows\System\TOadoHK.exe
  C:\Windows\System\TOadoHK.exe
  2⤵
  PID:14752
- C:\Windows\System\WuLOguH.exe
  C:\Windows\System\WuLOguH.exe
  2⤵
  PID:14768
- C:\Windows\System\MQIGJrR.exe
  C:\Windows\System\MQIGJrR.exe
  2⤵
  PID:14784
- C:\Windows\System\nmHxlaa.exe
  C:\Windows\System\nmHxlaa.exe
  2⤵
  PID:14804
- C:\Windows\System\bjHVpJx.exe
  C:\Windows\System\bjHVpJx.exe
  2⤵
  PID:14824
- C:\Windows\System\xjigakG.exe
  C:\Windows\System\xjigakG.exe
  2⤵
  PID:14852
- C:\Windows\System\LurySkh.exe
  C:\Windows\System\LurySkh.exe
  2⤵
  PID:14868
- C:\Windows\System\wHFZeSd.exe
  C:\Windows\System\wHFZeSd.exe
  2⤵
  PID:14884
- C:\Windows\System\jMHGBLh.exe
  C:\Windows\System\jMHGBLh.exe
  2⤵
  PID:14900
- C:\Windows\System\NXwYhYH.exe
  C:\Windows\System\NXwYhYH.exe
  2⤵
  PID:14920
- C:\Windows\System\eEkcNMR.exe
  C:\Windows\System\eEkcNMR.exe
  2⤵
  PID:14936
- C:\Windows\System\awJVmtR.exe
  C:\Windows\System\awJVmtR.exe
  2⤵
  PID:14960
- C:\Windows\System\NRZdiRD.exe
  C:\Windows\System\NRZdiRD.exe
  2⤵
  PID:14980
- C:\Windows\System\LUlkQII.exe
  C:\Windows\System\LUlkQII.exe
  2⤵
  PID:15004
- C:\Windows\System\qcqIOeV.exe
  C:\Windows\System\qcqIOeV.exe
  2⤵
  PID:15028
- C:\Windows\System\eslhufK.exe
  C:\Windows\System\eslhufK.exe
  2⤵
  PID:15052
- C:\Windows\System\OPSOYBN.exe
  C:\Windows\System\OPSOYBN.exe
  2⤵
  PID:15072
- C:\Windows\System\Nxboecc.exe
  C:\Windows\System\Nxboecc.exe
  2⤵
  PID:15096
- C:\Windows\System\ZoWeKyZ.exe
  C:\Windows\System\ZoWeKyZ.exe
  2⤵
  PID:15116
- C:\Windows\System\ujvKKMI.exe
  C:\Windows\System\ujvKKMI.exe
  2⤵
  PID:15132
- C:\Windows\System\uztEsSZ.exe
  C:\Windows\System\uztEsSZ.exe
  2⤵
  PID:15152
- C:\Windows\System\USVExFB.exe
  C:\Windows\System\USVExFB.exe
  2⤵
  PID:15180
- C:\Windows\System\UfeVYOg.exe
  C:\Windows\System\UfeVYOg.exe
  2⤵
  PID:15200
- C:\Windows\System\UIkFIEU.exe
  C:\Windows\System\UIkFIEU.exe
  2⤵
  PID:15220
- C:\Windows\System\vYDFoWF.exe
  C:\Windows\System\vYDFoWF.exe
  2⤵
  PID:15236
- C:\Windows\System\EogrCJv.exe
  C:\Windows\System\EogrCJv.exe
  2⤵
  PID:15256
- C:\Windows\System\vgdaOpy.exe
  C:\Windows\System\vgdaOpy.exe
  2⤵
  PID:15276
- C:\Windows\System\tdbzPNr.exe
  C:\Windows\System\tdbzPNr.exe
  2⤵
  PID:15296
- C:\Windows\System\DyhWtFX.exe
  C:\Windows\System\DyhWtFX.exe
  2⤵
  PID:15316
- C:\Windows\System\yGQOOUF.exe
  C:\Windows\System\yGQOOUF.exe
  2⤵
  PID:8504
- C:\Windows\System\uxPNPrg.exe
  C:\Windows\System\uxPNPrg.exe
  2⤵
  PID:9348
- C:\Windows\System\JYMZCEP.exe
  C:\Windows\System\JYMZCEP.exe
  2⤵
  PID:7176
- C:\Windows\System\nidHaxJ.exe
  C:\Windows\System\nidHaxJ.exe
  2⤵
  PID:11900
- C:\Windows\System\FOitenf.exe
  C:\Windows\System\FOitenf.exe
  2⤵
  PID:14608
- C:\Windows\System\FHuOxpS.exe
  C:\Windows\System\FHuOxpS.exe
  2⤵
  PID:14644
- C:\Windows\System\cJsGNTV.exe
  C:\Windows\System\cJsGNTV.exe
  2⤵
  PID:8828
- C:\Windows\System\eOetJTE.exe
  C:\Windows\System\eOetJTE.exe
  2⤵
  PID:9140
- C:\Windows\System\DblUDNW.exe
  C:\Windows\System\DblUDNW.exe
  2⤵
  PID:8904
- C:\Windows\System\FHcyNNl.exe
  C:\Windows\System\FHcyNNl.exe
  2⤵
  PID:9004
- C:\Windows\System\KyKxSNx.exe
  C:\Windows\System\KyKxSNx.exe
  2⤵
  PID:14876
- C:\Windows\System\tAZnwse.exe
  C:\Windows\System\tAZnwse.exe
  2⤵
  PID:4592
- C:\Windows\System\QBCjuEX.exe
  C:\Windows\System\QBCjuEX.exe
  2⤵
  PID:7568
- C:\Windows\System\TjrfWId.exe
  C:\Windows\System\TjrfWId.exe
  2⤵
  PID:8424
- C:\Windows\System\iNGeNXk.exe
  C:\Windows\System\iNGeNXk.exe
  2⤵
  PID:8440
- C:\Windows\System\VXhEfRk.exe
  C:\Windows\System\VXhEfRk.exe
  2⤵
  PID:6088
- C:\Windows\System\jxQpXRr.exe
  C:\Windows\System\jxQpXRr.exe
  2⤵
  PID:15312
- C:\Windows\System\hwnbuBM.exe
  C:\Windows\System\hwnbuBM.exe
  2⤵
  PID:14368
- C:\Windows\System\nzLwBJR.exe
  C:\Windows\System\nzLwBJR.exe
  2⤵
  PID:14392
- C:\Windows\System\ZUAFnAT.exe
  C:\Windows\System\ZUAFnAT.exe
  2⤵
  PID:12340
- C:\Windows\System\MVZeqLv.exe
  C:\Windows\System\MVZeqLv.exe
  2⤵
  PID:8856
- C:\Windows\System\RMPcOTf.exe
  C:\Windows\System\RMPcOTf.exe
  2⤵
  PID:14432
- C:\Windows\System\kRdfhPS.exe
  C:\Windows\System\kRdfhPS.exe
  2⤵
  PID:14524
- C:\Windows\System\QqDkAMJ.exe
  C:\Windows\System\QqDkAMJ.exe
  2⤵
  PID:14564
- C:\Windows\System\mlpbACy.exe
  C:\Windows\System\mlpbACy.exe
  2⤵
  PID:9336
- C:\Windows\System\AIorTwE.exe
  C:\Windows\System\AIorTwE.exe
  2⤵
  PID:8704
- C:\Windows\System\GiWFaWs.exe
  C:\Windows\System\GiWFaWs.exe
  2⤵
  PID:14700
- C:\Windows\System\VPytUrV.exe
  C:\Windows\System\VPytUrV.exe
  2⤵
  PID:14712
- C:\Windows\System\ZRheqox.exe
  C:\Windows\System\ZRheqox.exe
  2⤵
  PID:9452
- C:\Windows\System\dJOWXTK.exe
  C:\Windows\System\dJOWXTK.exe
  2⤵
  PID:9840
- C:\Windows\System\mbDKeaX.exe
  C:\Windows\System\mbDKeaX.exe
  2⤵
  PID:8252
- C:\Windows\System\uOGWhXL.exe
  C:\Windows\System\uOGWhXL.exe
  2⤵
  PID:6396
- C:\Windows\System\NePOmEx.exe
  C:\Windows\System\NePOmEx.exe
  2⤵
  PID:9884
- C:\Windows\System\jKzfbXc.exe
  C:\Windows\System\jKzfbXc.exe
  2⤵
  PID:10124
- C:\Windows\System\wKnInIc.exe
  C:\Windows\System\wKnInIc.exe
  2⤵
  PID:8708
- C:\Windows\System\BFKUMXu.exe
  C:\Windows\System\BFKUMXu.exe
  2⤵
  PID:7540
- C:\Windows\System\cOzpbIW.exe
  C:\Windows\System\cOzpbIW.exe
  2⤵
  PID:14908
- C:\Windows\System\yQtkcyc.exe
  C:\Windows\System\yQtkcyc.exe
  2⤵
  PID:14988
- C:\Windows\System\dvJVHjS.exe
  C:\Windows\System\dvJVHjS.exe
  2⤵
  PID:9532
- C:\Windows\System\UIzGTvm.exe
  C:\Windows\System\UIzGTvm.exe
  2⤵
  PID:9472
- C:\Windows\System\jHojLLc.exe
  C:\Windows\System\jHojLLc.exe
  2⤵
  PID:7844
- C:\Windows\System\rnNtXBG.exe
  C:\Windows\System\rnNtXBG.exe
  2⤵
  PID:9428
- C:\Windows\System\LszBzgd.exe
  C:\Windows\System\LszBzgd.exe
  2⤵
  PID:9760
- C:\Windows\System\BMeOSOC.exe
  C:\Windows\System\BMeOSOC.exe
  2⤵
  PID:14500
- C:\Windows\System\rgpiMRD.exe
  C:\Windows\System\rgpiMRD.exe
  2⤵
  PID:8196
- C:\Windows\System\dtIvWnI.exe
  C:\Windows\System\dtIvWnI.exe
  2⤵
  PID:7180
- C:\Windows\System\ADINJra.exe
  C:\Windows\System\ADINJra.exe
  2⤵
  PID:10356
- C:\Windows\System\QRoqveB.exe
  C:\Windows\System\QRoqveB.exe
  2⤵
  PID:9220
- C:\Windows\System\XDtwDRb.exe
  C:\Windows\System\XDtwDRb.exe
  2⤵
  PID:15208
- C:\Windows\System\qMxPIYH.exe
  C:\Windows\System\qMxPIYH.exe
  2⤵
  PID:9276
- C:\Windows\System\zsYpJxr.exe
  C:\Windows\System\zsYpJxr.exe
  2⤵
  PID:9280
- C:\Windows\System\SjpjhFD.exe
  C:\Windows\System\SjpjhFD.exe
  2⤵
  PID:14388
- C:\Windows\System\YZyNZGy.exe
  C:\Windows\System\YZyNZGy.exe
  2⤵
  PID:10596
- C:\Windows\System\HQnwsyR.exe
  C:\Windows\System\HQnwsyR.exe
  2⤵
  PID:10680
- C:\Windows\System\QbqLEDS.exe
  C:\Windows\System\QbqLEDS.exe
  2⤵
  PID:10784
- C:\Windows\System\dhJlJys.exe
  C:\Windows\System\dhJlJys.exe
  2⤵
  PID:9596
- C:\Windows\System\RFkiGkg.exe
  C:\Windows\System\RFkiGkg.exe
  2⤵
  PID:14520
- C:\Windows\System\RJWgPZO.exe
  C:\Windows\System\RJWgPZO.exe
  2⤵
  PID:11024
- C:\Windows\System\KOnKcXZ.exe
  C:\Windows\System\KOnKcXZ.exe
  2⤵
  PID:532
- C:\Windows\System\XuLfgoa.exe
  C:\Windows\System\XuLfgoa.exe
  2⤵
  PID:9668
- C:\Windows\System\geiChMJ.exe
  C:\Windows\System\geiChMJ.exe
  2⤵
  PID:6984
- C:\Windows\System\VoXeUof.exe
  C:\Windows\System\VoXeUof.exe
  2⤵
  PID:11164
- C:\Windows\System\GPkwTBY.exe
  C:\Windows\System\GPkwTBY.exe
  2⤵
  PID:9528
- C:\Windows\System\ZGLydZC.exe
  C:\Windows\System\ZGLydZC.exe
  2⤵
  PID:15372
- C:\Windows\System\CTJlTOq.exe
  C:\Windows\System\CTJlTOq.exe
  2⤵
  PID:15676
- C:\Windows\System\uSzVACB.exe
  C:\Windows\System\uSzVACB.exe
  2⤵
  PID:15692
- C:\Windows\System\BTBmWEL.exe
  C:\Windows\System\BTBmWEL.exe
  2⤵
  PID:15720
- C:\Windows\System\sihbAdm.exe
  C:\Windows\System\sihbAdm.exe
  2⤵
  PID:15764
- C:\Windows\System\EfXGpeF.exe
  C:\Windows\System\EfXGpeF.exe
  2⤵
  PID:15784
- C:\Windows\System\DIrqNBa.exe
  C:\Windows\System\DIrqNBa.exe
  2⤵
  PID:15800
- C:\Windows\System\PsBZmLd.exe
  C:\Windows\System\PsBZmLd.exe
  2⤵
  PID:15820
- C:\Windows\System\oJDqvnN.exe
  C:\Windows\System\oJDqvnN.exe
  2⤵
  PID:15840
- C:\Windows\System\mPqYzeE.exe
  C:\Windows\System\mPqYzeE.exe
  2⤵
  PID:15860
- C:\Windows\System\lDyxyTF.exe
  C:\Windows\System\lDyxyTF.exe
  2⤵
  PID:15876
- C:\Windows\System\WxCTXKu.exe
  C:\Windows\System\WxCTXKu.exe
  2⤵
  PID:15892
- C:\Windows\System\wvIOMVv.exe
  C:\Windows\System\wvIOMVv.exe
  2⤵
  PID:15912
- C:\Windows\System\NaZEohs.exe
  C:\Windows\System\NaZEohs.exe
  2⤵
  PID:15936
- C:\Windows\System\HcnjHrM.exe
  C:\Windows\System\HcnjHrM.exe
  2⤵
  PID:16212
- C:\Windows\System\QhfzsWn.exe
  C:\Windows\System\QhfzsWn.exe
  2⤵
  PID:16236
- C:\Windows\System\vVeCmSr.exe
  C:\Windows\System\vVeCmSr.exe
  2⤵
  PID:16256
- C:\Windows\System\vsFxpAn.exe
  C:\Windows\System\vsFxpAn.exe
  2⤵
  PID:16284
- C:\Windows\System\eDClRyj.exe
  C:\Windows\System\eDClRyj.exe
  2⤵
  PID:16312
- C:\Windows\System\LwlWtji.exe
  C:\Windows\System\LwlWtji.exe
  2⤵
  PID:10744
- C:\Windows\System\NDTHhYw.exe
  C:\Windows\System\NDTHhYw.exe
  2⤵
  PID:9412
- C:\Windows\System\YIcIvsx.exe
  C:\Windows\System\YIcIvsx.exe
  2⤵
  PID:9940
- C:\Windows\System\khoUYSP.exe
  C:\Windows\System\khoUYSP.exe
  2⤵
  PID:8152
- C:\Windows\System\WBmmrHW.exe
  C:\Windows\System\WBmmrHW.exe
  2⤵
  PID:9404
- C:\Windows\System\CxUlynn.exe
  C:\Windows\System\CxUlynn.exe
  2⤵
  PID:11120
- C:\Windows\System\XDZsdbI.exe
  C:\Windows\System\XDZsdbI.exe
  2⤵
  PID:7248
- C:\Windows\System\TIdzqjl.exe
  C:\Windows\System\TIdzqjl.exe
  2⤵
  PID:8764
- C:\Windows\System\vPVNBnF.exe
  C:\Windows\System\vPVNBnF.exe
  2⤵
  PID:10484
- C:\Windows\System\CJAbdRw.exe
  C:\Windows\System\CJAbdRw.exe
  2⤵
  PID:10516
- C:\Windows\System\hDumbWz.exe
  C:\Windows\System\hDumbWz.exe
  2⤵
  PID:10620
- C:\Windows\System\qQzKbXy.exe
  C:\Windows\System\qQzKbXy.exe
  2⤵
  PID:11204
- C:\Windows\System\ZusCLUw.exe
  C:\Windows\System\ZusCLUw.exe
  2⤵
  PID:13612
- C:\Windows\System\HklyuGi.exe
  C:\Windows\System\HklyuGi.exe
  2⤵
  PID:10440
- C:\Windows\System\BAooZUH.exe
  C:\Windows\System\BAooZUH.exe
  2⤵
  PID:10012
- C:\Windows\System\DvuQdnA.exe
  C:\Windows\System\DvuQdnA.exe
  2⤵
  PID:11252
- C:\Windows\System\Nhvpiqt.exe
  C:\Windows\System\Nhvpiqt.exe
  2⤵
  PID:9892
- C:\Windows\System\azGsiQa.exe
  C:\Windows\System\azGsiQa.exe
  2⤵
  PID:9096
- C:\Windows\System\ehkVbqY.exe
  C:\Windows\System\ehkVbqY.exe
  2⤵
  PID:9188
- C:\Windows\System\oOReOZZ.exe
  C:\Windows\System\oOReOZZ.exe
  2⤵
  PID:5784
- C:\Windows\System\NzokUqW.exe
  C:\Windows\System\NzokUqW.exe
  2⤵
  PID:10908
- C:\Windows\System\jTbwQoK.exe
  C:\Windows\System\jTbwQoK.exe
  2⤵
  PID:9172
- C:\Windows\System\QkvfiPQ.exe
  C:\Windows\System\QkvfiPQ.exe
  2⤵
  PID:6944
- C:\Windows\System\ttBHSuM.exe
  C:\Windows\System\ttBHSuM.exe
  2⤵
  PID:11040
- C:\Windows\System\GZJPvUQ.exe
  C:\Windows\System\GZJPvUQ.exe
  2⤵
  PID:15328
- C:\Windows\System\rRHwIsE.exe
  C:\Windows\System\rRHwIsE.exe
  2⤵
  PID:10888
- C:\Windows\System\GujZRFE.exe
  C:\Windows\System\GujZRFE.exe
  2⤵
  PID:14544
- C:\Windows\System\wSSnceX.exe
  C:\Windows\System\wSSnceX.exe
  2⤵
  PID:15036
- C:\Windows\System\cXcvJro.exe
  C:\Windows\System\cXcvJro.exe
  2⤵
  PID:10600
- C:\Windows\System\rJkURyG.exe
  C:\Windows\System\rJkURyG.exe
  2⤵
  PID:5836
- C:\Windows\System\ziYgzFN.exe
  C:\Windows\System\ziYgzFN.exe
  2⤵
  PID:15228
- C:\Windows\System\VJhenCO.exe
  C:\Windows\System\VJhenCO.exe
  2⤵
  PID:9872
- C:\Windows\System\uHpfXde.exe
  C:\Windows\System\uHpfXde.exe
  2⤵
  PID:10296
- C:\Windows\System\VOacgTb.exe
  C:\Windows\System\VOacgTb.exe
  2⤵
  PID:10320
- C:\Windows\System\FWxwveN.exe
  C:\Windows\System\FWxwveN.exe
  2⤵
  PID:15588
- C:\Windows\System\PyHKmLs.exe
  C:\Windows\System\PyHKmLs.exe
  2⤵
  PID:7964
- C:\Windows\System\ngjvEvi.exe
  C:\Windows\System\ngjvEvi.exe
  2⤵
  PID:16036
- C:\Windows\System\QYIdyMu.exe
  C:\Windows\System\QYIdyMu.exe
  2⤵
  PID:10336
- C:\Windows\System\DTCuMej.exe
  C:\Windows\System\DTCuMej.exe
  2⤵
  PID:10208
- C:\Windows\System\qurtLcl.exe
  C:\Windows\System\qurtLcl.exe
  2⤵
  PID:5808
- C:\Windows\System\CqAYbCp.exe
  C:\Windows\System\CqAYbCp.exe
  2⤵
  PID:16064
- C:\Windows\System\umUdmYT.exe
  C:\Windows\System\umUdmYT.exe
  2⤵
  PID:15688
- C:\Windows\System\rnmFZoH.exe
  C:\Windows\System\rnmFZoH.exe
  2⤵
  PID:11816
- C:\Windows\System\bgSfkva.exe
  C:\Windows\System\bgSfkva.exe
  2⤵
  PID:15400
- C:\Windows\System\VPlMpSj.exe
  C:\Windows\System\VPlMpSj.exe
  2⤵
  PID:11268
- C:\Windows\System\ARNldFp.exe
  C:\Windows\System\ARNldFp.exe
  2⤵
  PID:11100
- C:\Windows\System\zpwpMCH.exe
  C:\Windows\System\zpwpMCH.exe
  2⤵
  PID:11688
- C:\Windows\System\pnFoNAF.exe
  C:\Windows\System\pnFoNAF.exe
  2⤵
  PID:15644
- C:\Windows\System\fkzfCWi.exe
  C:\Windows\System\fkzfCWi.exe
  2⤵
  PID:11712
- C:\Windows\System\ceQGiMP.exe
  C:\Windows\System\ceQGiMP.exe
  2⤵
  PID:11740
- C:\Windows\System\eQBvDXy.exe
  C:\Windows\System\eQBvDXy.exe
  2⤵
  PID:11744
- C:\Windows\System\yiJdCTB.exe
  C:\Windows\System\yiJdCTB.exe
  2⤵
  PID:11808
- C:\Windows\System\owSpKGQ.exe
  C:\Windows\System\owSpKGQ.exe
  2⤵
  PID:9320
- C:\Windows\System\HeoBqnz.exe
  C:\Windows\System\HeoBqnz.exe
  2⤵
  PID:16104
- C:\Windows\System\KhdRycS.exe
  C:\Windows\System\KhdRycS.exe
  2⤵
  PID:15776
- C:\Windows\System\gsPDTCp.exe
  C:\Windows\System\gsPDTCp.exe
  2⤵
  PID:16152
- C:\Windows\System\USLceal.exe
  C:\Windows\System\USLceal.exe
  2⤵
  PID:16172
- C:\Windows\System\rnDicLt.exe
  C:\Windows\System\rnDicLt.exe
  2⤵
  PID:10128
- C:\Windows\System\uhZpsHg.exe
  C:\Windows\System\uhZpsHg.exe
  2⤵
  PID:11504
- C:\Windows\System\KONjuYt.exe
  C:\Windows\System\KONjuYt.exe
  2⤵
  PID:16228
- C:\Windows\System\TurRxZD.exe
  C:\Windows\System\TurRxZD.exe
  2⤵
  PID:16000
- C:\Windows\System\xVFXTAY.exe
  C:\Windows\System\xVFXTAY.exe
  2⤵
  PID:3200
- C:\Windows\System\YmLLhpg.exe
  C:\Windows\System\YmLLhpg.exe
  2⤵
  PID:11648
- C:\Windows\System\TpxjntO.exe
  C:\Windows\System\TpxjntO.exe
  2⤵
  PID:16088
- C:\Windows\System\mNfVxCa.exe
  C:\Windows\System\mNfVxCa.exe
  2⤵
  PID:10004
- C:\Windows\System\oHUksEg.exe
  C:\Windows\System\oHUksEg.exe
  2⤵
  PID:16204
- C:\Windows\System\NPsVyIm.exe
  C:\Windows\System\NPsVyIm.exe
  2⤵
  PID:8288
- C:\Windows\System\OGKAOMh.exe
  C:\Windows\System\OGKAOMh.exe
  2⤵
  PID:11980
- C:\Windows\System\nitwVri.exe
  C:\Windows\System\nitwVri.exe
  2⤵
  PID:13180
- C:\Windows\System\HiARlor.exe
  C:\Windows\System\HiARlor.exe
  2⤵
  PID:15432
- C:\Windows\System\wufwfHo.exe
  C:\Windows\System\wufwfHo.exe
  2⤵
  PID:15392
- C:\Windows\System\FLwwQtV.exe
  C:\Windows\System\FLwwQtV.exe
  2⤵
  PID:12120
- C:\Windows\System\hUkufch.exe
  C:\Windows\System\hUkufch.exe
  2⤵
  PID:7944
- C:\Windows\System\rcPShKI.exe
  C:\Windows\System\rcPShKI.exe
  2⤵
  PID:9268
- C:\Windows\System\LQpcyXx.exe
  C:\Windows\System\LQpcyXx.exe
  2⤵
  PID:12592
- C:\Windows\System\AdirvEj.exe
  C:\Windows\System\AdirvEj.exe
  2⤵
  PID:12488
- C:\Windows\System\izBZiLM.exe
  C:\Windows\System\izBZiLM.exe
  2⤵
  PID:9308
- C:\Windows\System\dQHfKHw.exe
  C:\Windows\System\dQHfKHw.exe
  2⤵
  PID:15716
- C:\Windows\System\QhuOgUL.exe
  C:\Windows\System\QhuOgUL.exe
  2⤵
  PID:12480
- C:\Windows\System\hvnOSpg.exe
  C:\Windows\System\hvnOSpg.exe
  2⤵
  PID:7252
- C:\Windows\System\HUOzcAe.exe
  C:\Windows\System\HUOzcAe.exe
  2⤵
  PID:9876
- C:\Windows\System\alxnsSs.exe
  C:\Windows\System\alxnsSs.exe
  2⤵
  PID:10844
- C:\Windows\System\AguvXWn.exe
  C:\Windows\System\AguvXWn.exe
  2⤵
  PID:15968
- C:\Windows\System\CPhrZEr.exe
  C:\Windows\System\CPhrZEr.exe
  2⤵
  PID:10632
- C:\Windows\System\HHnOONs.exe
  C:\Windows\System\HHnOONs.exe
  2⤵
  PID:8176
- C:\Windows\System\GyVstMW.exe
  C:\Windows\System\GyVstMW.exe
  2⤵
  PID:7548
- C:\Windows\System\IHGMtDL.exe
  C:\Windows\System\IHGMtDL.exe
  2⤵
  PID:4388
- C:\Windows\System\pkretxi.exe
  C:\Windows\System\pkretxi.exe
  2⤵
  PID:15340
- C:\Windows\System\qnVmuJr.exe
  C:\Windows\System\qnVmuJr.exe
  2⤵
  PID:16328
- C:\Windows\System\jARNmil.exe
  C:\Windows\System\jARNmil.exe
  2⤵
  PID:11784
- C:\Windows\System\uVeJZnR.exe
  C:\Windows\System\uVeJZnR.exe
  2⤵
  PID:13240
- C:\Windows\System\mBzrUJR.exe
  C:\Windows\System\mBzrUJR.exe
  2⤵
  PID:14204
- C:\Windows\System\SSwtTdJ.exe
  C:\Windows\System\SSwtTdJ.exe
  2⤵
  PID:14316
- C:\Windows\System\seWTZyc.exe
  C:\Windows\System\seWTZyc.exe
  2⤵
  PID:13228
- C:\Windows\System\yMMklPB.exe
  C:\Windows\System\yMMklPB.exe
  2⤵
  PID:2464
- C:\Windows\System\RzKTFeF.exe
  C:\Windows\System\RzKTFeF.exe
  2⤵
  PID:12204
- C:\Windows\System\GmvbljI.exe
  C:\Windows\System\GmvbljI.exe
  2⤵
  PID:12608
- C:\Windows\System\kjeXElU.exe
  C:\Windows\System\kjeXElU.exe
  2⤵
  PID:12992
- C:\Windows\System\SLVBUpz.exe
  C:\Windows\System\SLVBUpz.exe
  2⤵
  PID:12680
- C:\Windows\System\rtnDSxR.exe
  C:\Windows\System\rtnDSxR.exe
  2⤵
  PID:12672
- C:\Windows\System\xsIjogR.exe
  C:\Windows\System\xsIjogR.exe
  2⤵
  PID:9232
- C:\Windows\System\NDmSeIk.exe
  C:\Windows\System\NDmSeIk.exe
  2⤵
  PID:16372
- C:\Windows\System\sAFJucr.exe
  C:\Windows\System\sAFJucr.exe
  2⤵
  PID:4020
- C:\Windows\System\JjrIPmT.exe
  C:\Windows\System\JjrIPmT.exe
  2⤵
  PID:12024
- C:\Windows\System\vvOodIF.exe
  C:\Windows\System\vvOodIF.exe
  2⤵
  PID:10532
- C:\Windows\System\ZstLguX.exe
  C:\Windows\System\ZstLguX.exe
  2⤵
  PID:13160
- C:\Windows\System\jWcJgSV.exe
  C:\Windows\System\jWcJgSV.exe
  2⤵
  PID:3620
- C:\Windows\System\EXBIhuj.exe
  C:\Windows\System\EXBIhuj.exe
  2⤵
  PID:1232
- C:\Windows\System\SxqjEbP.exe
  C:\Windows\System\SxqjEbP.exe
  2⤵
  PID:1124
- C:\Windows\System\lheNxML.exe
  C:\Windows\System\lheNxML.exe
  2⤵
  PID:9504
- C:\Windows\System\QNMIOOa.exe
  C:\Windows\System\QNMIOOa.exe
  2⤵
  PID:10188
- C:\Windows\System\OcJBifx.exe
  C:\Windows\System\OcJBifx.exe
  2⤵
  PID:16360
- C:\Windows\System\GCuuSzI.exe
  C:\Windows\System\GCuuSzI.exe
  2⤵
  PID:13464
- C:\Windows\System\gAAVlsS.exe
  C:\Windows\System\gAAVlsS.exe
  2⤵
  PID:13000
- C:\Windows\System\telmcPz.exe
  C:\Windows\System\telmcPz.exe
  2⤵
  PID:7140
- C:\Windows\System\GGEkEPr.exe
  C:\Windows\System\GGEkEPr.exe
  2⤵
  PID:11168
- C:\Windows\System\oDzdzal.exe
  C:\Windows\System\oDzdzal.exe
  2⤵
  PID:12744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:12476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=fallback-handler --database="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --exception-pointers=53532474917056 --process=260 /prefetch:7 --thread=4204
1⤵
PID:12916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3ilkizvs.szp.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CXvUKTe.exe

Filesize
1.5MB

MD5
863524274f938775556f15b64f9f015b

SHA1
c8da1ba1b64243b435b352c27fccb9cb77092606

SHA256
2fd2f20e293b2a9d49878da33072a24709ea11aedd6e43f67df61e98a6057ab3

SHA512
6c4e1f8072236bbe2fd0e241930a29747ed26b956c6db3782c1a848efb3095263215f9204558936810833ab38710dbae4f27ff18087424b29a256290f0863488

Download Submit
C:\Windows\System\EeauXvb.exe

Filesize
1.5MB

MD5
ec3b1d84aaf2840b01cb1f51a88171fe

SHA1
d6ebdbb26ff29f7506cb01444cd56bfbe6aecea4

SHA256
3e70e9f835d90c49e9b5c901539a875bd9abc3ccd499072d2162612e102c3a95

SHA512
4767d6871a1dc121b328f695b160cbb78bb4ba68ea75d4ab97e55f85ceb5bfc9620469301c7751b9d0b39777f5eeda5712c233636c80a4f319af22550d344ee7

Download Submit
C:\Windows\System\FHvIfcY.exe

Filesize
1.5MB

MD5
cdc1d61dfe602e20bfece09e25728b26

SHA1
00d71cc753fb52c80592e69a18f857da4c02747e

SHA256
6090db986475ae423b6233ede4ac8a0beeffebf363c7b688298880ac8540474d

SHA512
26615748b8654a98255d508ff2888fa40b89d132192644868c0b468969938b3c181e40d858e8e7bfefe9e8790dae097b3dc5eafabc2a656ebee6dae27b91ae01

Download Submit
C:\Windows\System\FgEMiac.exe

Filesize
1.5MB

MD5
424094239f51d1461d6f0978cc042069

SHA1
c870547acc45143d5e0017156dc57c3678b9891f

SHA256
7c465705f58ce7c3ec1f3174aaa8b06647188cf33b4857e51af9581222cea0a4

SHA512
21bd16ecce6d758098cbd20e98fd48fef2621255bcf6db6e5edaa6d0ff64de0aef38c472bde3a4b2dbd93d0e010f68af21f2692862136d36a00560a4a9556646

Download Submit
C:\Windows\System\FjSDnpf.exe

Filesize
1.5MB

MD5
6eb52fe19be50bc33950f4b3290675b6

SHA1
01c70516f04375086f9366ee65457dd3e32a6504

SHA256
4128404b5369c43bde27901932b49419405a634bbfb938c9e8471531a90baef5

SHA512
032a7a679c076add3482c9dbcf106d24fbea38341431784cbc97504c51b1db36b7707300c81cdddcd4bb980022a755d5398489db170e382e1877a227286342fd

Download Submit
C:\Windows\System\FwOyPUX.exe

Filesize
1.5MB

MD5
b9622b37442c2c6b11b3c03e324bb560

SHA1
b1b04d7e3e13806ff5cc306ef0f51222eb87682a

SHA256
8f73202ab51d3dacb34bb051765e49c07181661684f95e7ae223db4ced5fd2e2

SHA512
df7df89b06f59207f662c0d5c2725f60b76dbc8e64e0f0fa347a5155d67ca5e1de358ad845e7cdb0cef7d94e1cfc884030d756f8a6bb7068cb9c099736429012

Download Submit
C:\Windows\System\HXUNaJL.exe

Filesize
1.5MB

MD5
6383214705ebc7524a5c66aac789e29c

SHA1
ed47541f5bc07e8e9318b230fc3ba1fcb355b683

SHA256
04d8aa66218d7f91a3eeefcf92458b4c7bc59169d459cb2aa211fe8ec95dbd33

SHA512
7b59f15c00971e565f2d747e646780387c73240df8e08e29488a8a735c610a4ff885781c2f7cf161ec5ea4225b4c438c15bf675c21db26c724fd0912f8a8806d

Download Submit
C:\Windows\System\KPrIQsS.exe

Filesize
1.5MB

MD5
296e2a2461c51d04079b5907d23cdb69

SHA1
24ff7d5adf3136d787c7ecc1aaae7cba59b68c9f

SHA256
a7fb9d51e5781966408b99559369c56e3dbc663d871a3ee46c6453dd6ce2249a

SHA512
2573627387dbbbbbc733bdcf6878391710b9450ebc0989743c6c1a5bb49969edbedee4c4b161c09db591decf4f4944ceb545a759fd14bdca469a027bfab7f2d2

Download Submit
C:\Windows\System\NqYDYCY.exe

Filesize
1.5MB

MD5
fc3f8fd4acf0d9724b809b94de22e706

SHA1
3dec27752877f1908e656e71d7d5dce91d641bc7

SHA256
e93de410289f170c66ca190980d02140c6920bec0b8fbb2f7cdc7ee10d1b3ca0

SHA512
f4f010ae523a46c0b1391a614c7d2a61538a12ee985e5c3f8432b445f2dcd04c84bdd656a81e88ff5166559346b0b8371423e316121d0b49343928eb5bdffe67

Download Submit
C:\Windows\System\OQxBlkQ.exe

Filesize
1.5MB

MD5
82efc324e9b05bfa82fc4d929a54debd

SHA1
2fe96917b6a8bd179255c43d9d877ae29c51770d

SHA256
ad4afdf985a65e2011c74127474d75131ea1a01150ddf0cab6a8d43f524246d4

SHA512
8050f7548496d7577931107f58511fd778173f7a738f6c44163ccb05017302d04f98a9f1cc837532b61c403ca85f11a93b66f4a84fec9742dab44639e9998806

Download Submit
C:\Windows\System\OjzSeCM.exe

Filesize
1.5MB

MD5
0eaf9be6adac6f8c358d6125f61f5a45

SHA1
f685a93f6519eaafeced04d88e8326224009ea16

SHA256
0dca0dd7c2ad01f955e950b215d0208a4ce4ec6ecb3fac594e1f296b2a83fdaf

SHA512
4340b3b4357840fb62aba5f42a5d7adbb618014701fbb7eef4f6b4eb32a573ff45ccb78071cc4bb35716ab5903a14d5777b97a97588d69d0e7728cdd702dea5b

Download Submit
C:\Windows\System\PTeAFTR.exe

Filesize
1.5MB

MD5
87aaa0e3c33126f40cd4a07dac9cbc43

SHA1
6d8859054b0a051cbd63b7fdcd862ab8de8f5c07

SHA256
3f0e905fa3a5d5d6e005f61b15c48b2c20556ce32ec7cfd46f6c035cc66b7f9a

SHA512
969ebf9318191b7b46533fcb7a687b34a9c8ed2702faa695054b3111832225f9dcc1b02b30ac044aa0fa69becd81ac3bd7da58c58b20aa4c44add48db26954bc

Download Submit
C:\Windows\System\QUbfpya.exe

Filesize
1.5MB

MD5
d7422e4dd9a7005a5621329f085f2bc4

SHA1
631a68c8b8bcb38938ebf10c91458cd8f36f2537

SHA256
86e99e18e5858b9d82f648bf4bae0a55a9696243cc7651593b615d79fed1f5c2

SHA512
206c81f7e6f31fe0cb9760854d0da9264daa683bb32cc29a5255748e17fd468d62658c5ee67b705f332ba4b05b667277e9c6f80ab39679f1a5a18647357ddd12

Download Submit
C:\Windows\System\UHSXBwC.exe

Filesize
1.5MB

MD5
ddddec18d690bd4eadd6e0ca7591df1c

SHA1
bcf8e4a4678a828395e748d3e3fe5095962ace23

SHA256
581c6ac71121f24f60bd28f5604a721656ae3ef6c68b3e308d1c4eb42ad50aea

SHA512
26c623c0021ff7f2a594b1c13493593c068d7d8469dcbda357249e2be0aeee82ab489296bc27c18fe9ddc6fb4a29bf90fc80ce89a15de59a4ae377bf4765d894

Download Submit
C:\Windows\System\ZKxAuCh.exe

Filesize
1.5MB

MD5
e5ede7e1d81719e02d63856887263106

SHA1
7b12c72aa87c9e0ff9cd2a9cd696891a6c10b2cc

SHA256
c8b45e9aba89fa900c7b76c7bc8ef1bb57bfaeaca87e140a45e2ae32c5b4e512

SHA512
93e484b1c63a7d80289aaec90057c6200b2d83ae7fbfdf9fb459f69a5605e7739b6fcf6aa16e1301919ae283f2342d6dc087d30dc2aaae71e030dfa55e63837f

Download Submit
C:\Windows\System\ZsvgsWg.exe

Filesize
1.5MB

MD5
c33784595e09f0c0272013ef65dfba50

SHA1
56c682e38b73474972b63aa7517642d20e235c48

SHA256
c0694f77f44ee6d35c54199fb37ba49f6e52d1dad6975348862a0e4bbd73878b

SHA512
35559f0f2fc6a789edd19f47fba2f67836a01dcba829b742241c46d58f80237ebf66efa6a5629bfcd46c1b42d351857234101a13455ff8431e2c70e9e9be451e

Download Submit
C:\Windows\System\aFvzXAB.exe

Filesize
1.5MB

MD5
351d5500bf1283e2ead69a1ee97622f7

SHA1
2e3a8a23f629e618c8d11d07e0b686db6c3273eb

SHA256
6701394135fd48722fb06b903a9c680d8ecd17997850f70c2790b1710af2cedf

SHA512
881bf8321e521ed62977fcc6a8bf13710cf163cde012e6b87cf0ebf26d3ad7807ae9be2b31ed3636683533ad2a49bf6ecd3fd5e9cfcc4c3a6049514d5639569a

Download Submit
C:\Windows\System\fnrwrhm.exe

Filesize
1.5MB

MD5
ece9dc20894708c4caecfd51f24da114

SHA1
e11096ee32834ca773d431dd7433a86d80587ba1

SHA256
d29779f078b914d4b90d88917e62b01ef4a248a2b9b957ccd527ec932ca95beb

SHA512
5078e77c32c5ffcaf93b7c9f888b8483d2c0350b11ae95bd8d4103400636b0e8fc8a69c6565b5257445cd55bf34ca5cd3c7518f5385248f5af50b04e450ab1c5

Download Submit
C:\Windows\System\gSxyoLE.exe

Filesize
1.5MB

MD5
c9d9e20cf311f3141734ef737fb984c4

SHA1
68efcbf7b578cfa8fc2315b4e0b2d50d1e1eb4e3

SHA256
d5b91cf0a31e698256ee56341d06b0d5986e1d7552a1cf4a3e788ecff3bb5d33

SHA512
15f8987c615caf61f112b596955ec5e78ea3aec087746ec3e20593b84450da4d6daafdb1f59449933ce04d7b984d2abd8f656b6bfd0b37d5a1135e0a44e8f21a

Download Submit
C:\Windows\System\hfpVjqj.exe

Filesize
1.5MB

MD5
6e9b7efc9f13ccd9bc4c91db0f31e388

SHA1
1b9c71069d246c8ed9b1d647d88df4881b3857a6

SHA256
2d123e4366947b591add79c04c26cff4933d4d583aaca5c9b612b35695c8963b

SHA512
960e5ba3b43565c744cf86d3fddfd4e6d8df8e9ffc65dd23a39b88aa950c32863592a23cddc8a6d2577fb06df922207c5c58f3b02429e070420cf832d70e05bc

Download Submit
C:\Windows\System\icvtdVe.exe

Filesize
1.5MB

MD5
b88f70bd2df477c1fdf18e4e8b9d18c9

SHA1
fe03e150077bb55b537ff03062dd3bfc8e88e213

SHA256
81fd8430bfec9fa54ad5a4a426c1065694fcafc1161bc5bab75b5687b1bd9cb4

SHA512
89870db855c5a0c8665c32bfb8592314f55c7be999158d558a4a9f38f87e8f6664e38240e2c8493ac9e1b3a70d39ae676271ef0638e67f37ed4933ba6fc59e79

Download Submit
C:\Windows\System\iogHFJc.exe

Filesize
1.5MB

MD5
b8f0f91265076bd0e814fb96ad4d17d4

SHA1
5253caf9f976d83a91e936de827a22694435a9dd

SHA256
eba3eed1bc1994c544aa1808520b5316bb2e3f92f8e94206fe16f08ed7c9d17d

SHA512
01dfcb5e5d53be8ee426ffb236491f221fedc497e00e6b4956eb9b61068d14b52a28639436d847b7c1ae1ebb875a1e93e050e81515cca65a98b2af675c60abf4

Download Submit
C:\Windows\System\kTSqcAr.exe

Filesize
1.5MB

MD5
fe93872d2e0ea8335eef43d870906f60

SHA1
0c55132e15d1ac5207c9da137becfec37eb5db12

SHA256
2024627c8d95059bedef8fb546eee971a6121b891fabc16035b51dec39f3bc75

SHA512
5cc85ec33ce6b54e8c597e7ad33a1a6efda30b469ddd1e64a68d582d2945a04ce79a3ccf9af7962d3b66c661af843dff95c2900001d1f6cd9f14d682597f1e74

Download Submit
C:\Windows\System\lWTCTqI.exe

Filesize
1.5MB

MD5
c7eb8c60fc232cc34a9584b1c6da92cb

SHA1
d73e957bff6b9455496598c7af7dde696bae4cf6

SHA256
6ad9c1c904479eb6a13f0f4b79c439c3972ccd6c5fd69e728c4902769ac4901f

SHA512
ee6731b2fc45d2f6d36b771dddd83c1c21f3a253b4644cc3554e3051f95cbc221d3823c8ce31fbd739efcb0086c71230a9ead58ff18d55e805bbe006a96d6961

Download Submit
C:\Windows\System\lnDCliP.exe

Filesize
1.5MB

MD5
2eb8fa563ddc2cdf5a6e16e3ecc21e8f

SHA1
0dcf62b09da34c66963a808c15be146258b29ba4

SHA256
64272bf43443b754f42175c3f28a0aa3b87bda926fe9b8c702f883a6358f83c6

SHA512
f4537b16e414df3d46ca89d67024fd8a2eaeecab6074a4180018bbd46776025fb1b05fc52ca5ff56975fb2db323d6adaa351cc2a3cbc2c10258d1f56ce91d359

Download Submit
C:\Windows\System\oEdVJxd.exe

Filesize
1.5MB

MD5
070fee47dfc0d30a33bee170409cf6e3

SHA1
ae887570fba35c42b8e824357c25bca6befcac05

SHA256
c6426ae57c479998dc45386d88cd85d85e680502f8e8729a67c581ef1e0a9c1c

SHA512
ab3237ccefd7dc58c62b6577114e465f0254476bd93f80043243531ea58e430095a28de8227cfcc9b58569fa8393c08d2ddf4c494827254b1c09a248defd319e

Download Submit
C:\Windows\System\rGgryIg.exe

Filesize
1.5MB

MD5
b64b5528cb591a2b1c8fc3486ae551a7

SHA1
969b825928aaf90b4bd4121781d9256e10a7b253

SHA256
b0c6ec8e0fbdb8583f670540889be932e9787b497cbaf22a4c03c7c0e83132fd

SHA512
4547f9d67de15658d639588a511fbfd1808e5aa2c1ea7a6b9747113fcbca7d36707e7b8c94b427c94d533097f7773cc456ef5cbe55cd5aca9ac44d8bdaaae83a

Download Submit
C:\Windows\System\rfNBNDF.exe

Filesize
1.5MB

MD5
84afb96db9d69c3b582e13c7a28f7ec0

SHA1
176224b60248a519de24d1e1c5deaa97bbbec756

SHA256
216253ec04ab32d5291d04770cca37f76b3afd8e78917157b7b6ab78dd1e6c78

SHA512
e92245f76bef509db4b94c854b3337072190ea25f6f0d76ff402c9ece040a99b0c71fe36260e2ecbee49854a722e6eaaded36e90fe4379fe9a81792b8a2f1742

Download Submit
C:\Windows\System\tGDyzuz.exe

Filesize
1.5MB

MD5
4fb0fbea97954f057a5667217b3e485c

SHA1
bedacac605c21aca55ab12fa568c1cc44b273565

SHA256
97e71d28646d21c3ba3d8567fc0be01bb878a7c98f71d4b6e8df8b9efabff24d

SHA512
33a223c4e6fbbf9b14ac16c9f104e7e4fde43286bb53985d35256db4272d0ff6e3fe32149e5454fb73ae8a86a7093a7bddd86101b7e7838dc72085abf059fa27

Download Submit
C:\Windows\System\uIhdkiV.exe

Filesize
1.5MB

MD5
73036013cad79edd922cd404294d8303

SHA1
ad18e4648f0267bdbec8af9f69957ac71fa9b941

SHA256
66ddfd4a895d81b79b258cf8628e2ab81a8dc4f28d57129f533b180e70c048b2

SHA512
bda43ca8d79a13fc7016c7e21e20bd86bbf81d78b1d8c4971e5e9d8c1774a43b916d7710ecaace4e260a56fba0cd09caf277aa3c32a426bda2757fc9c43ec6d2

Download Submit
C:\Windows\System\ztfTwDJ.exe

Filesize
1.5MB

MD5
68bc06fda0aea915eaa7625047b95edc

SHA1
ddfda2df7605ec5e13ba139fbe101a547d64c6bc

SHA256
8060ca78064ff79b72e101be2aa682750a2105a7c75d4410145cff9b84d99c29

SHA512
40e6680f356d6be6332f5acd0f8eb461c1795bfe11e01e558f0a12b80bfcfdd55d7516f8cca2e84bac6f4d457c4ca4ac709bb49b5c31e1f0ed96ae55528bf788

Download Submit
C:\Windows\System\zzTWjZd.exe

Filesize
1.5MB

MD5
4d305a46832fc07b611dee13eb3cac84

SHA1
105210686ece43e3cf63b3807bbfb5d9a05f7ea5

SHA256
4d25a6bd059c6e23f92f39394df6256ff5eb04d842176dd049a55de3388909a8

SHA512
f28f6bc67fd0ce0e0dd0a447c1fdada1fef1c3c7bb0ca2ea38c4622bdb6c65383551290f6e503ed84563302aee050276208a031326358523ea2e2ac08b8a5395

Download Submit
memory/496-2117-0x00007FF70CBF0000-0x00007FF70CFE2000-memory.dmp

Filesize
3.9MB

Download
memory/496-89-0x00007FF70CBF0000-0x00007FF70CFE2000-memory.dmp

Filesize
3.9MB

Download
memory/760-73-0x00007FF65F3D0000-0x00007FF65F7C2000-memory.dmp

Filesize
3.9MB

Download
memory/760-2097-0x00007FF65F3D0000-0x00007FF65F7C2000-memory.dmp

Filesize
3.9MB

Download
memory/876-2115-0x00007FF649C90000-0x00007FF64A082000-memory.dmp

Filesize
3.9MB

Download
memory/876-128-0x00007FF649C90000-0x00007FF64A082000-memory.dmp

Filesize
3.9MB

Download
memory/1088-43-0x00007FF787A80000-0x00007FF787E72000-memory.dmp

Filesize
3.9MB

Download
memory/1088-1760-0x00007FF787A80000-0x00007FF787E72000-memory.dmp

Filesize
3.9MB

Download
memory/1372-2119-0x00007FF7FB0F0000-0x00007FF7FB4E2000-memory.dmp

Filesize
3.9MB

Download
memory/1372-119-0x00007FF7FB0F0000-0x00007FF7FB4E2000-memory.dmp

Filesize
3.9MB

Download
memory/1420-24-0x00000162ADF70000-0x00000162ADF92000-memory.dmp

Filesize
136KB

Download
memory/1420-198-0x00007FFE6DE90000-0x00007FFE6E951000-memory.dmp

Filesize
10.8MB

Download
memory/1420-1123-0x00000162AECD0000-0x00000162AF476000-memory.dmp

Filesize
7.6MB

Download
memory/1420-40-0x00007FFE6DE90000-0x00007FFE6E951000-memory.dmp

Filesize
10.8MB

Download
memory/1420-39-0x00007FFE6DE90000-0x00007FFE6E951000-memory.dmp

Filesize
10.8MB

Download
memory/1420-3-0x00007FFE6DE93000-0x00007FFE6DE95000-memory.dmp

Filesize
8KB

Download
memory/1420-196-0x00007FFE6DE93000-0x00007FFE6DE95000-memory.dmp

Filesize
8KB

Download
memory/1420-193-0x00007FFE6DE90000-0x00007FFE6E951000-memory.dmp

Filesize
10.8MB

Download
memory/1860-41-0x00007FF6A5D30000-0x00007FF6A6122000-memory.dmp

Filesize
3.9MB

Download
memory/1860-1746-0x00007FF6A5D30000-0x00007FF6A6122000-memory.dmp

Filesize
3.9MB

Download
memory/1892-2121-0x00007FF660500000-0x00007FF6608F2000-memory.dmp

Filesize
3.9MB

Download
memory/1892-142-0x00007FF660500000-0x00007FF6608F2000-memory.dmp

Filesize
3.9MB

Download
memory/2208-2071-0x00007FF6732A0000-0x00007FF673692000-memory.dmp

Filesize
3.9MB

Download
memory/2208-55-0x00007FF6732A0000-0x00007FF673692000-memory.dmp

Filesize
3.9MB

Download
memory/2288-2199-0x00007FF68A8A0000-0x00007FF68AC92000-memory.dmp

Filesize
3.9MB

Download
memory/2288-197-0x00007FF68A8A0000-0x00007FF68AC92000-memory.dmp

Filesize
3.9MB

Download
memory/2460-101-0x00007FF74E000000-0x00007FF74E3F2000-memory.dmp

Filesize
3.9MB

Download
memory/2460-2099-0x00007FF74E000000-0x00007FF74E3F2000-memory.dmp

Filesize
3.9MB

Download
memory/2608-2104-0x00007FF7B1560000-0x00007FF7B1952000-memory.dmp

Filesize
3.9MB

Download
memory/2608-63-0x00007FF7B1560000-0x00007FF7B1952000-memory.dmp

Filesize
3.9MB

Download
memory/2840-2113-0x00007FF7A48D0000-0x00007FF7A4CC2000-memory.dmp

Filesize
3.9MB

Download
memory/2840-139-0x00007FF7A48D0000-0x00007FF7A4CC2000-memory.dmp

Filesize
3.9MB

Download
memory/3036-2075-0x00007FF730F40000-0x00007FF731332000-memory.dmp

Filesize
3.9MB

Download
memory/3036-56-0x00007FF730F40000-0x00007FF731332000-memory.dmp

Filesize
3.9MB

Download
memory/3112-44-0x00007FF68AF20000-0x00007FF68B312000-memory.dmp

Filesize
3.9MB

Download
memory/3112-1765-0x00007FF68AF20000-0x00007FF68B312000-memory.dmp

Filesize
3.9MB

Download
memory/3604-2109-0x00007FF7C2980000-0x00007FF7C2D72000-memory.dmp

Filesize
3.9MB

Download
memory/3604-140-0x00007FF7C2980000-0x00007FF7C2D72000-memory.dmp

Filesize
3.9MB

Download
memory/3668-1705-0x00007FF660220000-0x00007FF660612000-memory.dmp

Filesize
3.9MB

Download
memory/3668-45-0x00007FF660220000-0x00007FF660612000-memory.dmp

Filesize
3.9MB

Download
memory/3740-145-0x00007FF7A0E30000-0x00007FF7A1222000-memory.dmp

Filesize
3.9MB

Download
memory/3740-2144-0x00007FF7A0E30000-0x00007FF7A1222000-memory.dmp

Filesize
3.9MB

Download
memory/4108-2122-0x00007FF6EB200000-0x00007FF6EB5F2000-memory.dmp

Filesize
3.9MB

Download
memory/4108-141-0x00007FF6EB200000-0x00007FF6EB5F2000-memory.dmp

Filesize
3.9MB

Download
memory/4472-2101-0x00007FF71F280000-0x00007FF71F672000-memory.dmp

Filesize
3.9MB

Download
memory/4472-115-0x00007FF71F280000-0x00007FF71F672000-memory.dmp

Filesize
3.9MB

Download
memory/4516-2174-0x00007FF7C3510000-0x00007FF7C3902000-memory.dmp

Filesize
3.9MB

Download
memory/4516-169-0x00007FF7C3510000-0x00007FF7C3902000-memory.dmp

Filesize
3.9MB

Download
memory/4736-2111-0x00007FF6CE380000-0x00007FF6CE772000-memory.dmp

Filesize
3.9MB

Download
memory/4736-118-0x00007FF6CE380000-0x00007FF6CE772000-memory.dmp

Filesize
3.9MB

Download
memory/4848-102-0x00007FF75F2D0000-0x00007FF75F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/4848-156-0x00007FF75F2D0000-0x00007FF75F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/4848-1-0x000001BCB1210000-0x000001BCB1220000-memory.dmp

Filesize
64KB

Download
memory/4848-0-0x00007FF75F2D0000-0x00007FF75F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/4892-160-0x00007FF7AF640000-0x00007FF7AFA32000-memory.dmp

Filesize
3.9MB

Download
memory/4892-2140-0x00007FF7AF640000-0x00007FF7AFA32000-memory.dmp

Filesize
3.9MB

Download
memory/5004-146-0x00007FF6468D0000-0x00007FF646CC2000-memory.dmp

Filesize
3.9MB

Download
memory/5004-2173-0x00007FF6468D0000-0x00007FF646CC2000-memory.dmp

Filesize
3.9MB

Download
memory/5016-1761-0x00007FF6E19F0000-0x00007FF6E1DE2000-memory.dmp

Filesize
3.9MB

Download
memory/5016-42-0x00007FF6E19F0000-0x00007FF6E1DE2000-memory.dmp

Filesize
3.9MB

Download