Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-06-2024 16:06

General

  • Target

    6ab5338b31c9f841d84dea109da8a1f0_NeikiAnalytics.exe

  • Size

    1.2MB

  • MD5

    6ab5338b31c9f841d84dea109da8a1f0

  • SHA1

    5f22b7cdc195a9988aafc037f50a4bc5e95f47b4

  • SHA256

    5bd7fea2460a48322b5b0be7ee926ce17042621fc00509af599ca5b52472b56d

  • SHA512

    89a96afe2afae4efb08e59c38df08e052404b9cb269a1daf8eaf3db289cb9c2b045d5d26c0a0802b572862c36be43cfd1dfd0ba52390da7fe611b18e8e406d82

  • SSDEEP

    24576:RVIl/WDGCi7/qkat6Q5aILMCfmAUjzX6xQ0+wCIygDsAUSTsU9m:ROdWCCi7/raZ5aIwC+Agr6SNasZ

Malware Config

Signatures

  • KPOT

    KPOT is an information stealer that steals user data and account credentials.

  • KPOT Core Executable 43 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 59 IoCs
  • Executes dropped EXE 64 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6ab5338b31c9f841d84dea109da8a1f0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\6ab5338b31c9f841d84dea109da8a1f0_NeikiAnalytics.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:748
    • C:\Windows\System\zbuSrhW.exe
      C:\Windows\System\zbuSrhW.exe
      2⤵
      • Executes dropped EXE
      PID:1348
    • C:\Windows\System\fBKIaii.exe
      C:\Windows\System\fBKIaii.exe
      2⤵
      • Executes dropped EXE
      PID:4004
    • C:\Windows\System\VDLtrEL.exe
      C:\Windows\System\VDLtrEL.exe
      2⤵
      • Executes dropped EXE
      PID:3692
    • C:\Windows\System\EJIEiUd.exe
      C:\Windows\System\EJIEiUd.exe
      2⤵
      • Executes dropped EXE
      PID:1664
    • C:\Windows\System\PQxrdbk.exe
      C:\Windows\System\PQxrdbk.exe
      2⤵
      • Executes dropped EXE
      PID:1636
    • C:\Windows\System\TUNEzND.exe
      C:\Windows\System\TUNEzND.exe
      2⤵
      • Executes dropped EXE
      PID:1684
    • C:\Windows\System\EvTlDjf.exe
      C:\Windows\System\EvTlDjf.exe
      2⤵
      • Executes dropped EXE
      PID:2560
    • C:\Windows\System\YmOcBjk.exe
      C:\Windows\System\YmOcBjk.exe
      2⤵
      • Executes dropped EXE
      PID:2088
    • C:\Windows\System\tvHmRMM.exe
      C:\Windows\System\tvHmRMM.exe
      2⤵
      • Executes dropped EXE
      PID:1180
    • C:\Windows\System\FhVZrET.exe
      C:\Windows\System\FhVZrET.exe
      2⤵
      • Executes dropped EXE
      PID:864
    • C:\Windows\System\TmUcUbu.exe
      C:\Windows\System\TmUcUbu.exe
      2⤵
      • Executes dropped EXE
      PID:1372
    • C:\Windows\System\XCdKcCX.exe
      C:\Windows\System\XCdKcCX.exe
      2⤵
      • Executes dropped EXE
      PID:3592
    • C:\Windows\System\ghJQEKf.exe
      C:\Windows\System\ghJQEKf.exe
      2⤵
      • Executes dropped EXE
      PID:5064
    • C:\Windows\System\DKkCHyJ.exe
      C:\Windows\System\DKkCHyJ.exe
      2⤵
      • Executes dropped EXE
      PID:2904
    • C:\Windows\System\owzHwym.exe
      C:\Windows\System\owzHwym.exe
      2⤵
      • Executes dropped EXE
      PID:1352
    • C:\Windows\System\wFBOMLc.exe
      C:\Windows\System\wFBOMLc.exe
      2⤵
      • Executes dropped EXE
      PID:2576
    • C:\Windows\System\XfvRlSP.exe
      C:\Windows\System\XfvRlSP.exe
      2⤵
      • Executes dropped EXE
      PID:2456
    • C:\Windows\System\kCfLpNw.exe
      C:\Windows\System\kCfLpNw.exe
      2⤵
      • Executes dropped EXE
      PID:2884
    • C:\Windows\System\twqNCFf.exe
      C:\Windows\System\twqNCFf.exe
      2⤵
      • Executes dropped EXE
      PID:3520
    • C:\Windows\System\uvtLmeZ.exe
      C:\Windows\System\uvtLmeZ.exe
      2⤵
      • Executes dropped EXE
      PID:3900
    • C:\Windows\System\KawsLLU.exe
      C:\Windows\System\KawsLLU.exe
      2⤵
      • Executes dropped EXE
      PID:3112
    • C:\Windows\System\AQYzTXT.exe
      C:\Windows\System\AQYzTXT.exe
      2⤵
      • Executes dropped EXE
      PID:2588
    • C:\Windows\System\loJjcZf.exe
      C:\Windows\System\loJjcZf.exe
      2⤵
      • Executes dropped EXE
      PID:4268
    • C:\Windows\System\KuJVQNm.exe
      C:\Windows\System\KuJVQNm.exe
      2⤵
      • Executes dropped EXE
      PID:2536
    • C:\Windows\System\dpjlSOu.exe
      C:\Windows\System\dpjlSOu.exe
      2⤵
      • Executes dropped EXE
      PID:4388
    • C:\Windows\System\lNHisQk.exe
      C:\Windows\System\lNHisQk.exe
      2⤵
      • Executes dropped EXE
      PID:3268
    • C:\Windows\System\wESihNp.exe
      C:\Windows\System\wESihNp.exe
      2⤵
      • Executes dropped EXE
      PID:392
    • C:\Windows\System\efnXwuh.exe
      C:\Windows\System\efnXwuh.exe
      2⤵
      • Executes dropped EXE
      PID:1804
    • C:\Windows\System\ZXkdZan.exe
      C:\Windows\System\ZXkdZan.exe
      2⤵
      • Executes dropped EXE
      PID:2236
    • C:\Windows\System\ESJZZND.exe
      C:\Windows\System\ESJZZND.exe
      2⤵
      • Executes dropped EXE
      PID:1148
    • C:\Windows\System\YdvLfSr.exe
      C:\Windows\System\YdvLfSr.exe
      2⤵
      • Executes dropped EXE
      PID:4592
    • C:\Windows\System\eOjlQbx.exe
      C:\Windows\System\eOjlQbx.exe
      2⤵
      • Executes dropped EXE
      PID:4500
    • C:\Windows\System\OTWjJmG.exe
      C:\Windows\System\OTWjJmG.exe
      2⤵
      • Executes dropped EXE
      PID:3160
    • C:\Windows\System\ghvOWEu.exe
      C:\Windows\System\ghvOWEu.exe
      2⤵
      • Executes dropped EXE
      PID:1472
    • C:\Windows\System\KsKUDMi.exe
      C:\Windows\System\KsKUDMi.exe
      2⤵
      • Executes dropped EXE
      PID:2652
    • C:\Windows\System\bFEXGEi.exe
      C:\Windows\System\bFEXGEi.exe
      2⤵
      • Executes dropped EXE
      PID:5048
    • C:\Windows\System\TBOqDRl.exe
      C:\Windows\System\TBOqDRl.exe
      2⤵
      • Executes dropped EXE
      PID:2668
    • C:\Windows\System\DUucwBZ.exe
      C:\Windows\System\DUucwBZ.exe
      2⤵
      • Executes dropped EXE
      PID:2564
    • C:\Windows\System\DbbypOh.exe
      C:\Windows\System\DbbypOh.exe
      2⤵
      • Executes dropped EXE
      PID:2584
    • C:\Windows\System\bpYafNx.exe
      C:\Windows\System\bpYafNx.exe
      2⤵
      • Executes dropped EXE
      PID:3884
    • C:\Windows\System\nSBdGOO.exe
      C:\Windows\System\nSBdGOO.exe
      2⤵
      • Executes dropped EXE
      PID:928
    • C:\Windows\System\ZSHlBPo.exe
      C:\Windows\System\ZSHlBPo.exe
      2⤵
      • Executes dropped EXE
      PID:1236
    • C:\Windows\System\iDtXpLC.exe
      C:\Windows\System\iDtXpLC.exe
      2⤵
      • Executes dropped EXE
      PID:1296
    • C:\Windows\System\UJcKWPt.exe
      C:\Windows\System\UJcKWPt.exe
      2⤵
      • Executes dropped EXE
      PID:2408
    • C:\Windows\System\RvvzSCc.exe
      C:\Windows\System\RvvzSCc.exe
      2⤵
      • Executes dropped EXE
      PID:1428
    • C:\Windows\System\mzYSXkf.exe
      C:\Windows\System\mzYSXkf.exe
      2⤵
      • Executes dropped EXE
      PID:4328
    • C:\Windows\System\DcJUPwD.exe
      C:\Windows\System\DcJUPwD.exe
      2⤵
      • Executes dropped EXE
      PID:2028
    • C:\Windows\System\iKpZvbv.exe
      C:\Windows\System\iKpZvbv.exe
      2⤵
      • Executes dropped EXE
      PID:1020
    • C:\Windows\System\OqpOEeR.exe
      C:\Windows\System\OqpOEeR.exe
      2⤵
      • Executes dropped EXE
      PID:4264
    • C:\Windows\System\uCrLDjV.exe
      C:\Windows\System\uCrLDjV.exe
      2⤵
      • Executes dropped EXE
      PID:2016
    • C:\Windows\System\MFggGSk.exe
      C:\Windows\System\MFggGSk.exe
      2⤵
      • Executes dropped EXE
      PID:1652
    • C:\Windows\System\vAYwoiU.exe
      C:\Windows\System\vAYwoiU.exe
      2⤵
      • Executes dropped EXE
      PID:3548
    • C:\Windows\System\owjDzHK.exe
      C:\Windows\System\owjDzHK.exe
      2⤵
      • Executes dropped EXE
      PID:4220
    • C:\Windows\System\oAYIhqr.exe
      C:\Windows\System\oAYIhqr.exe
      2⤵
      • Executes dropped EXE
      PID:688
    • C:\Windows\System\oNsjzhL.exe
      C:\Windows\System\oNsjzhL.exe
      2⤵
      • Executes dropped EXE
      PID:4252
    • C:\Windows\System\CEFJsHs.exe
      C:\Windows\System\CEFJsHs.exe
      2⤵
      • Executes dropped EXE
      PID:2704
    • C:\Windows\System\GbHqLVc.exe
      C:\Windows\System\GbHqLVc.exe
      2⤵
      • Executes dropped EXE
      PID:4044
    • C:\Windows\System\VeWZjbI.exe
      C:\Windows\System\VeWZjbI.exe
      2⤵
      • Executes dropped EXE
      PID:4280
    • C:\Windows\System\HqnAHSl.exe
      C:\Windows\System\HqnAHSl.exe
      2⤵
      • Executes dropped EXE
      PID:3908
    • C:\Windows\System\KaeRSmc.exe
      C:\Windows\System\KaeRSmc.exe
      2⤵
      • Executes dropped EXE
      PID:4648
    • C:\Windows\System\vdrTlNw.exe
      C:\Windows\System\vdrTlNw.exe
      2⤵
        PID:4976
      • C:\Windows\System\fEbJDtg.exe
        C:\Windows\System\fEbJDtg.exe
        2⤵
        • Executes dropped EXE
        PID:4112
      • C:\Windows\System\YRWyUra.exe
        C:\Windows\System\YRWyUra.exe
        2⤵
        • Executes dropped EXE
        PID:3484
      • C:\Windows\System\hYxEuwU.exe
        C:\Windows\System\hYxEuwU.exe
        2⤵
        • Executes dropped EXE
        PID:2296
      • C:\Windows\System\zDLaqbs.exe
        C:\Windows\System\zDLaqbs.exe
        2⤵
        • Executes dropped EXE
        PID:2724
      • C:\Windows\System\YouqoyB.exe
        C:\Windows\System\YouqoyB.exe
        2⤵
          PID:220
        • C:\Windows\System\fFeSVwh.exe
          C:\Windows\System\fFeSVwh.exe
          2⤵
            PID:1368
          • C:\Windows\System\AZFFmLm.exe
            C:\Windows\System\AZFFmLm.exe
            2⤵
              PID:5096
            • C:\Windows\System\KxHXbPg.exe
              C:\Windows\System\KxHXbPg.exe
              2⤵
                PID:3336
              • C:\Windows\System\ZEQDsIU.exe
                C:\Windows\System\ZEQDsIU.exe
                2⤵
                  PID:4872
                • C:\Windows\System\eZQcVjz.exe
                  C:\Windows\System\eZQcVjz.exe
                  2⤵
                    PID:2364
                  • C:\Windows\System\MyZYRhL.exe
                    C:\Windows\System\MyZYRhL.exe
                    2⤵
                      PID:2056
                    • C:\Windows\System\MujAcFl.exe
                      C:\Windows\System\MujAcFl.exe
                      2⤵
                        PID:4436
                      • C:\Windows\System\yEDwiQY.exe
                        C:\Windows\System\yEDwiQY.exe
                        2⤵
                          PID:4356
                        • C:\Windows\System\ZghwPbN.exe
                          C:\Windows\System\ZghwPbN.exe
                          2⤵
                            PID:3320
                          • C:\Windows\System\GnMELWq.exe
                            C:\Windows\System\GnMELWq.exe
                            2⤵
                              PID:452
                            • C:\Windows\System\GpshSev.exe
                              C:\Windows\System\GpshSev.exe
                              2⤵
                                PID:2600
                              • C:\Windows\System\vEGensb.exe
                                C:\Windows\System\vEGensb.exe
                                2⤵
                                  PID:4508
                                • C:\Windows\System\qOyPVTa.exe
                                  C:\Windows\System\qOyPVTa.exe
                                  2⤵
                                    PID:908
                                  • C:\Windows\System\drcvKJy.exe
                                    C:\Windows\System\drcvKJy.exe
                                    2⤵
                                      PID:2260
                                    • C:\Windows\System\BHDEJdK.exe
                                      C:\Windows\System\BHDEJdK.exe
                                      2⤵
                                        PID:264
                                      • C:\Windows\System\KDUtOfP.exe
                                        C:\Windows\System\KDUtOfP.exe
                                        2⤵
                                          PID:3932
                                        • C:\Windows\System\Nswwqgr.exe
                                          C:\Windows\System\Nswwqgr.exe
                                          2⤵
                                            PID:2436
                                          • C:\Windows\System\nGeWgox.exe
                                            C:\Windows\System\nGeWgox.exe
                                            2⤵
                                              PID:2572
                                            • C:\Windows\System\eLfezwv.exe
                                              C:\Windows\System\eLfezwv.exe
                                              2⤵
                                                PID:1184
                                              • C:\Windows\System\cBvZYUW.exe
                                                C:\Windows\System\cBvZYUW.exe
                                                2⤵
                                                  PID:3152
                                                • C:\Windows\System\eWibkjt.exe
                                                  C:\Windows\System\eWibkjt.exe
                                                  2⤵
                                                    PID:2980
                                                  • C:\Windows\System\KTeFvZh.exe
                                                    C:\Windows\System\KTeFvZh.exe
                                                    2⤵
                                                      PID:2804
                                                    • C:\Windows\System\IZLgjyF.exe
                                                      C:\Windows\System\IZLgjyF.exe
                                                      2⤵
                                                        PID:4468
                                                      • C:\Windows\System\EKIWgaB.exe
                                                        C:\Windows\System\EKIWgaB.exe
                                                        2⤵
                                                          PID:3224
                                                        • C:\Windows\System\bAeiRUV.exe
                                                          C:\Windows\System\bAeiRUV.exe
                                                          2⤵
                                                            PID:3240
                                                          • C:\Windows\System\NpFdxwz.exe
                                                            C:\Windows\System\NpFdxwz.exe
                                                            2⤵
                                                              PID:4120
                                                            • C:\Windows\System\oUduajG.exe
                                                              C:\Windows\System\oUduajG.exe
                                                              2⤵
                                                                PID:4988
                                                              • C:\Windows\System\DFOGPIg.exe
                                                                C:\Windows\System\DFOGPIg.exe
                                                                2⤵
                                                                  PID:1980
                                                                • C:\Windows\System\xUwDQUl.exe
                                                                  C:\Windows\System\xUwDQUl.exe
                                                                  2⤵
                                                                    PID:872
                                                                  • C:\Windows\System\bwaVJhS.exe
                                                                    C:\Windows\System\bwaVJhS.exe
                                                                    2⤵
                                                                      PID:5132
                                                                    • C:\Windows\System\NuDjYwR.exe
                                                                      C:\Windows\System\NuDjYwR.exe
                                                                      2⤵
                                                                        PID:5152
                                                                      • C:\Windows\System\QMwmNhv.exe
                                                                        C:\Windows\System\QMwmNhv.exe
                                                                        2⤵
                                                                          PID:5172
                                                                        • C:\Windows\System\UNGzSAa.exe
                                                                          C:\Windows\System\UNGzSAa.exe
                                                                          2⤵
                                                                            PID:5192
                                                                          • C:\Windows\System\PUjKiPE.exe
                                                                            C:\Windows\System\PUjKiPE.exe
                                                                            2⤵
                                                                              PID:5208
                                                                            • C:\Windows\System\IXbukEI.exe
                                                                              C:\Windows\System\IXbukEI.exe
                                                                              2⤵
                                                                                PID:5240
                                                                              • C:\Windows\System\cThUIon.exe
                                                                                C:\Windows\System\cThUIon.exe
                                                                                2⤵
                                                                                  PID:5264
                                                                                • C:\Windows\System\aFFQJXw.exe
                                                                                  C:\Windows\System\aFFQJXw.exe
                                                                                  2⤵
                                                                                    PID:5284
                                                                                  • C:\Windows\System\WZIIboy.exe
                                                                                    C:\Windows\System\WZIIboy.exe
                                                                                    2⤵
                                                                                      PID:5308
                                                                                    • C:\Windows\System\fCvPzZx.exe
                                                                                      C:\Windows\System\fCvPzZx.exe
                                                                                      2⤵
                                                                                        PID:5332
                                                                                      • C:\Windows\System\kTYozFA.exe
                                                                                        C:\Windows\System\kTYozFA.exe
                                                                                        2⤵
                                                                                          PID:5348
                                                                                        • C:\Windows\System\aUpKvLx.exe
                                                                                          C:\Windows\System\aUpKvLx.exe
                                                                                          2⤵
                                                                                            PID:5372
                                                                                          • C:\Windows\System\FWlHnhO.exe
                                                                                            C:\Windows\System\FWlHnhO.exe
                                                                                            2⤵
                                                                                              PID:5400
                                                                                            • C:\Windows\System\LPGyBbp.exe
                                                                                              C:\Windows\System\LPGyBbp.exe
                                                                                              2⤵
                                                                                                PID:5424
                                                                                              • C:\Windows\System\blnltAh.exe
                                                                                                C:\Windows\System\blnltAh.exe
                                                                                                2⤵
                                                                                                  PID:5444
                                                                                                • C:\Windows\System\BFyeoJE.exe
                                                                                                  C:\Windows\System\BFyeoJE.exe
                                                                                                  2⤵
                                                                                                    PID:5464
                                                                                                  • C:\Windows\System\FGPhpIh.exe
                                                                                                    C:\Windows\System\FGPhpIh.exe
                                                                                                    2⤵
                                                                                                      PID:5488
                                                                                                    • C:\Windows\System\DNICUFl.exe
                                                                                                      C:\Windows\System\DNICUFl.exe
                                                                                                      2⤵
                                                                                                        PID:5508
                                                                                                      • C:\Windows\System\gSEYZtN.exe
                                                                                                        C:\Windows\System\gSEYZtN.exe
                                                                                                        2⤵
                                                                                                          PID:5536
                                                                                                        • C:\Windows\System\RNPtqBq.exe
                                                                                                          C:\Windows\System\RNPtqBq.exe
                                                                                                          2⤵
                                                                                                            PID:5552
                                                                                                          • C:\Windows\System\LBYgeEB.exe
                                                                                                            C:\Windows\System\LBYgeEB.exe
                                                                                                            2⤵
                                                                                                              PID:5568
                                                                                                            • C:\Windows\System\NDsWnWU.exe
                                                                                                              C:\Windows\System\NDsWnWU.exe
                                                                                                              2⤵
                                                                                                                PID:5588
                                                                                                              • C:\Windows\System\YbmLaqn.exe
                                                                                                                C:\Windows\System\YbmLaqn.exe
                                                                                                                2⤵
                                                                                                                  PID:5608
                                                                                                                • C:\Windows\System\LEPXVtZ.exe
                                                                                                                  C:\Windows\System\LEPXVtZ.exe
                                                                                                                  2⤵
                                                                                                                    PID:5628
                                                                                                                  • C:\Windows\System\WhiIsgM.exe
                                                                                                                    C:\Windows\System\WhiIsgM.exe
                                                                                                                    2⤵
                                                                                                                      PID:5648
                                                                                                                    • C:\Windows\System\JwUvWKR.exe
                                                                                                                      C:\Windows\System\JwUvWKR.exe
                                                                                                                      2⤵
                                                                                                                        PID:5676
                                                                                                                      • C:\Windows\System\eJVluQZ.exe
                                                                                                                        C:\Windows\System\eJVluQZ.exe
                                                                                                                        2⤵
                                                                                                                          PID:5692
                                                                                                                        • C:\Windows\System\UERViAl.exe
                                                                                                                          C:\Windows\System\UERViAl.exe
                                                                                                                          2⤵
                                                                                                                            PID:5708
                                                                                                                          • C:\Windows\System\KkSqpOw.exe
                                                                                                                            C:\Windows\System\KkSqpOw.exe
                                                                                                                            2⤵
                                                                                                                              PID:5728
                                                                                                                            • C:\Windows\System\OWgCAcd.exe
                                                                                                                              C:\Windows\System\OWgCAcd.exe
                                                                                                                              2⤵
                                                                                                                                PID:5752
                                                                                                                              • C:\Windows\System\cceEnmA.exe
                                                                                                                                C:\Windows\System\cceEnmA.exe
                                                                                                                                2⤵
                                                                                                                                  PID:5768
                                                                                                                                • C:\Windows\System\UaDTxlt.exe
                                                                                                                                  C:\Windows\System\UaDTxlt.exe
                                                                                                                                  2⤵
                                                                                                                                    PID:5788
                                                                                                                                  • C:\Windows\System\sQjkmVB.exe
                                                                                                                                    C:\Windows\System\sQjkmVB.exe
                                                                                                                                    2⤵
                                                                                                                                      PID:5836
                                                                                                                                    • C:\Windows\System\kosstlH.exe
                                                                                                                                      C:\Windows\System\kosstlH.exe
                                                                                                                                      2⤵
                                                                                                                                        PID:5856
                                                                                                                                      • C:\Windows\System\dQblUIL.exe
                                                                                                                                        C:\Windows\System\dQblUIL.exe
                                                                                                                                        2⤵
                                                                                                                                          PID:5872
                                                                                                                                        • C:\Windows\System\tamAWRW.exe
                                                                                                                                          C:\Windows\System\tamAWRW.exe
                                                                                                                                          2⤵
                                                                                                                                            PID:5892
                                                                                                                                          • C:\Windows\System\fmsJFGx.exe
                                                                                                                                            C:\Windows\System\fmsJFGx.exe
                                                                                                                                            2⤵
                                                                                                                                              PID:5908
                                                                                                                                            • C:\Windows\System\iNvfzxX.exe
                                                                                                                                              C:\Windows\System\iNvfzxX.exe
                                                                                                                                              2⤵
                                                                                                                                                PID:5932
                                                                                                                                              • C:\Windows\System\NdLbNjD.exe
                                                                                                                                                C:\Windows\System\NdLbNjD.exe
                                                                                                                                                2⤵
                                                                                                                                                  PID:5952
                                                                                                                                                • C:\Windows\System\unAKjHp.exe
                                                                                                                                                  C:\Windows\System\unAKjHp.exe
                                                                                                                                                  2⤵
                                                                                                                                                    PID:5972
                                                                                                                                                  • C:\Windows\System\jythLiF.exe
                                                                                                                                                    C:\Windows\System\jythLiF.exe
                                                                                                                                                    2⤵
                                                                                                                                                      PID:5992
                                                                                                                                                    • C:\Windows\System\kmmJzme.exe
                                                                                                                                                      C:\Windows\System\kmmJzme.exe
                                                                                                                                                      2⤵
                                                                                                                                                        PID:6016
                                                                                                                                                      • C:\Windows\System\vHPXgVY.exe
                                                                                                                                                        C:\Windows\System\vHPXgVY.exe
                                                                                                                                                        2⤵
                                                                                                                                                          PID:6032
                                                                                                                                                        • C:\Windows\System\majHZxv.exe
                                                                                                                                                          C:\Windows\System\majHZxv.exe
                                                                                                                                                          2⤵
                                                                                                                                                            PID:6048
                                                                                                                                                          • C:\Windows\System\rsWwOea.exe
                                                                                                                                                            C:\Windows\System\rsWwOea.exe
                                                                                                                                                            2⤵
                                                                                                                                                              PID:6064
                                                                                                                                                            • C:\Windows\System\gZxDSga.exe
                                                                                                                                                              C:\Windows\System\gZxDSga.exe
                                                                                                                                                              2⤵
                                                                                                                                                                PID:6080
                                                                                                                                                              • C:\Windows\System\pvzUEBk.exe
                                                                                                                                                                C:\Windows\System\pvzUEBk.exe
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:6104
                                                                                                                                                                • C:\Windows\System\LunJFws.exe
                                                                                                                                                                  C:\Windows\System\LunJFws.exe
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:6124
                                                                                                                                                                  • C:\Windows\System\amkALIz.exe
                                                                                                                                                                    C:\Windows\System\amkALIz.exe
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:1708
                                                                                                                                                                    • C:\Windows\System\hRaVFnm.exe
                                                                                                                                                                      C:\Windows\System\hRaVFnm.exe
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:4320
                                                                                                                                                                      • C:\Windows\System\gAToxGh.exe
                                                                                                                                                                        C:\Windows\System\gAToxGh.exe
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:3584
                                                                                                                                                                        • C:\Windows\System\qxQkIFy.exe
                                                                                                                                                                          C:\Windows\System\qxQkIFy.exe
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:4556
                                                                                                                                                                          • C:\Windows\System\edKfOOv.exe
                                                                                                                                                                            C:\Windows\System\edKfOOv.exe
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:3988
                                                                                                                                                                            • C:\Windows\System\lvqVSGA.exe
                                                                                                                                                                              C:\Windows\System\lvqVSGA.exe
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:3604
                                                                                                                                                                              • C:\Windows\System\XbMyOje.exe
                                                                                                                                                                                C:\Windows\System\XbMyOje.exe
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:1496
                                                                                                                                                                                • C:\Windows\System\mymecMp.exe
                                                                                                                                                                                  C:\Windows\System\mymecMp.exe
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:1076
                                                                                                                                                                                  • C:\Windows\System\ODLmwLL.exe
                                                                                                                                                                                    C:\Windows\System\ODLmwLL.exe
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:4756
                                                                                                                                                                                    • C:\Windows\System\MiaNMJo.exe
                                                                                                                                                                                      C:\Windows\System\MiaNMJo.exe
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:5100
                                                                                                                                                                                      • C:\Windows\System\LTJeeue.exe
                                                                                                                                                                                        C:\Windows\System\LTJeeue.exe
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:2224
                                                                                                                                                                                        • C:\Windows\System\HASTblI.exe
                                                                                                                                                                                          C:\Windows\System\HASTblI.exe
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:64
                                                                                                                                                                                          • C:\Windows\System\FUvKeSV.exe
                                                                                                                                                                                            C:\Windows\System\FUvKeSV.exe
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:4128
                                                                                                                                                                                            • C:\Windows\System\LRqkqfx.exe
                                                                                                                                                                                              C:\Windows\System\LRqkqfx.exe
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:5200
                                                                                                                                                                                              • C:\Windows\System\xibRVHT.exe
                                                                                                                                                                                                C:\Windows\System\xibRVHT.exe
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:5344
                                                                                                                                                                                                • C:\Windows\System\UcwJCep.exe
                                                                                                                                                                                                  C:\Windows\System\UcwJCep.exe
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:5520
                                                                                                                                                                                                  • C:\Windows\System\cfbJtdu.exe
                                                                                                                                                                                                    C:\Windows\System\cfbJtdu.exe
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:5560
                                                                                                                                                                                                    • C:\Windows\System\pyeGHmU.exe
                                                                                                                                                                                                      C:\Windows\System\pyeGHmU.exe
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:6160
                                                                                                                                                                                                      • C:\Windows\System\dgJnWXb.exe
                                                                                                                                                                                                        C:\Windows\System\dgJnWXb.exe
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:6184
                                                                                                                                                                                                        • C:\Windows\System\NjzXUWF.exe
                                                                                                                                                                                                          C:\Windows\System\NjzXUWF.exe
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:6224
                                                                                                                                                                                                          • C:\Windows\System\dYaHduL.exe
                                                                                                                                                                                                            C:\Windows\System\dYaHduL.exe
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:6244
                                                                                                                                                                                                            • C:\Windows\System\yNlmbdX.exe
                                                                                                                                                                                                              C:\Windows\System\yNlmbdX.exe
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:6260
                                                                                                                                                                                                              • C:\Windows\System\LXDmRDD.exe
                                                                                                                                                                                                                C:\Windows\System\LXDmRDD.exe
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:6280
                                                                                                                                                                                                                • C:\Windows\System\zIfONxE.exe
                                                                                                                                                                                                                  C:\Windows\System\zIfONxE.exe
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:6300
                                                                                                                                                                                                                  • C:\Windows\System\CdNziyq.exe
                                                                                                                                                                                                                    C:\Windows\System\CdNziyq.exe
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:6320
                                                                                                                                                                                                                    • C:\Windows\System\MfAaYMp.exe
                                                                                                                                                                                                                      C:\Windows\System\MfAaYMp.exe
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:6356
                                                                                                                                                                                                                      • C:\Windows\System\jrezMFr.exe
                                                                                                                                                                                                                        C:\Windows\System\jrezMFr.exe
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:6372
                                                                                                                                                                                                                        • C:\Windows\System\pQySEDb.exe
                                                                                                                                                                                                                          C:\Windows\System\pQySEDb.exe
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:6396
                                                                                                                                                                                                                          • C:\Windows\System\ftsGkyN.exe
                                                                                                                                                                                                                            C:\Windows\System\ftsGkyN.exe
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:6412
                                                                                                                                                                                                                            • C:\Windows\System\VvXeeNy.exe
                                                                                                                                                                                                                              C:\Windows\System\VvXeeNy.exe
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:6432
                                                                                                                                                                                                                              • C:\Windows\System\maaDLnL.exe
                                                                                                                                                                                                                                C:\Windows\System\maaDLnL.exe
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:6452
                                                                                                                                                                                                                                • C:\Windows\System\tsnaFJL.exe
                                                                                                                                                                                                                                  C:\Windows\System\tsnaFJL.exe
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:6476
                                                                                                                                                                                                                                  • C:\Windows\System\sGGehWO.exe
                                                                                                                                                                                                                                    C:\Windows\System\sGGehWO.exe
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:6496
                                                                                                                                                                                                                                    • C:\Windows\System\ySXhYUi.exe
                                                                                                                                                                                                                                      C:\Windows\System\ySXhYUi.exe
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:6516
                                                                                                                                                                                                                                      • C:\Windows\System\JLXZGlh.exe
                                                                                                                                                                                                                                        C:\Windows\System\JLXZGlh.exe
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:6532
                                                                                                                                                                                                                                        • C:\Windows\System\OOTPSXO.exe
                                                                                                                                                                                                                                          C:\Windows\System\OOTPSXO.exe
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:6556
                                                                                                                                                                                                                                          • C:\Windows\System\hPfjhyH.exe
                                                                                                                                                                                                                                            C:\Windows\System\hPfjhyH.exe
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:6572
                                                                                                                                                                                                                                            • C:\Windows\System\ClaFxnN.exe
                                                                                                                                                                                                                                              C:\Windows\System\ClaFxnN.exe
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:6596
                                                                                                                                                                                                                                              • C:\Windows\System\NoDlcSL.exe
                                                                                                                                                                                                                                                C:\Windows\System\NoDlcSL.exe
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:6628
                                                                                                                                                                                                                                                • C:\Windows\System\nZIhwID.exe
                                                                                                                                                                                                                                                  C:\Windows\System\nZIhwID.exe
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:6644
                                                                                                                                                                                                                                                  • C:\Windows\System\KOkTGWk.exe
                                                                                                                                                                                                                                                    C:\Windows\System\KOkTGWk.exe
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:6660
                                                                                                                                                                                                                                                    • C:\Windows\System\XPlEJXL.exe
                                                                                                                                                                                                                                                      C:\Windows\System\XPlEJXL.exe
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:6688
                                                                                                                                                                                                                                                      • C:\Windows\System\DPxqrzV.exe
                                                                                                                                                                                                                                                        C:\Windows\System\DPxqrzV.exe
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:6724
                                                                                                                                                                                                                                                        • C:\Windows\System\aiNWzjT.exe
                                                                                                                                                                                                                                                          C:\Windows\System\aiNWzjT.exe
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:6740
                                                                                                                                                                                                                                                          • C:\Windows\System\zcqCcWB.exe
                                                                                                                                                                                                                                                            C:\Windows\System\zcqCcWB.exe
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:6756
                                                                                                                                                                                                                                                            • C:\Windows\System\ebqOhUS.exe
                                                                                                                                                                                                                                                              C:\Windows\System\ebqOhUS.exe
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:6776
                                                                                                                                                                                                                                                              • C:\Windows\System\CiZDbTd.exe
                                                                                                                                                                                                                                                                C:\Windows\System\CiZDbTd.exe
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:6804
                                                                                                                                                                                                                                                                • C:\Windows\System\mNPibmN.exe
                                                                                                                                                                                                                                                                  C:\Windows\System\mNPibmN.exe
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:6828
                                                                                                                                                                                                                                                                  • C:\Windows\System\zoakREF.exe
                                                                                                                                                                                                                                                                    C:\Windows\System\zoakREF.exe
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:6848
                                                                                                                                                                                                                                                                    • C:\Windows\System\cTTMAPn.exe
                                                                                                                                                                                                                                                                      C:\Windows\System\cTTMAPn.exe
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:6872
                                                                                                                                                                                                                                                                      • C:\Windows\System\tHBUWfp.exe
                                                                                                                                                                                                                                                                        C:\Windows\System\tHBUWfp.exe
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:6888
                                                                                                                                                                                                                                                                        • C:\Windows\System\GLohAES.exe
                                                                                                                                                                                                                                                                          C:\Windows\System\GLohAES.exe
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:6908
                                                                                                                                                                                                                                                                          • C:\Windows\System\UVCsBBY.exe
                                                                                                                                                                                                                                                                            C:\Windows\System\UVCsBBY.exe
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:6928
                                                                                                                                                                                                                                                                            • C:\Windows\System\BVHrRhl.exe
                                                                                                                                                                                                                                                                              C:\Windows\System\BVHrRhl.exe
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:6976
                                                                                                                                                                                                                                                                              • C:\Windows\System\TstvOub.exe
                                                                                                                                                                                                                                                                                C:\Windows\System\TstvOub.exe
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:6992
                                                                                                                                                                                                                                                                                • C:\Windows\System\ocrHWib.exe
                                                                                                                                                                                                                                                                                  C:\Windows\System\ocrHWib.exe
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:7016
                                                                                                                                                                                                                                                                                  • C:\Windows\System\Ktzeicf.exe
                                                                                                                                                                                                                                                                                    C:\Windows\System\Ktzeicf.exe
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:7036
                                                                                                                                                                                                                                                                                    • C:\Windows\System\DgZkuTI.exe
                                                                                                                                                                                                                                                                                      C:\Windows\System\DgZkuTI.exe
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:7052
                                                                                                                                                                                                                                                                                      • C:\Windows\System\gZffbML.exe
                                                                                                                                                                                                                                                                                        C:\Windows\System\gZffbML.exe
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:7072
                                                                                                                                                                                                                                                                                        • C:\Windows\System\UUXXUBB.exe
                                                                                                                                                                                                                                                                                          C:\Windows\System\UUXXUBB.exe
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:7096
                                                                                                                                                                                                                                                                                          • C:\Windows\System\XQLDmdk.exe
                                                                                                                                                                                                                                                                                            C:\Windows\System\XQLDmdk.exe
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:7120
                                                                                                                                                                                                                                                                                            • C:\Windows\System\uNadobA.exe
                                                                                                                                                                                                                                                                                              C:\Windows\System\uNadobA.exe
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:7144
                                                                                                                                                                                                                                                                                              • C:\Windows\System\tAzBQJV.exe
                                                                                                                                                                                                                                                                                                C:\Windows\System\tAzBQJV.exe
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:7164
                                                                                                                                                                                                                                                                                                • C:\Windows\System\mTPzyAc.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\System\mTPzyAc.exe
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:1132
                                                                                                                                                                                                                                                                                                  • C:\Windows\System\PYNBuJk.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\System\PYNBuJk.exe
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:4108
                                                                                                                                                                                                                                                                                                    • C:\Windows\System\DAEOFmY.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\System\DAEOFmY.exe
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:5684
                                                                                                                                                                                                                                                                                                      • C:\Windows\System\NECzHna.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\System\NECzHna.exe
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:3528
                                                                                                                                                                                                                                                                                                        • C:\Windows\System\rcJkAvI.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\System\rcJkAvI.exe
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:3756
                                                                                                                                                                                                                                                                                                          • C:\Windows\System\gPZIhEi.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\System\gPZIhEi.exe
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:5880
                                                                                                                                                                                                                                                                                                            • C:\Windows\System\lLLpviZ.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\System\lLLpviZ.exe
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:5960
                                                                                                                                                                                                                                                                                                              • C:\Windows\System\DyVRorf.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\System\DyVRorf.exe
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:6004
                                                                                                                                                                                                                                                                                                                • C:\Windows\System\LwNzZFW.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\System\LwNzZFW.exe
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                    PID:6056
                                                                                                                                                                                                                                                                                                                  • C:\Windows\System\LAejfyg.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\System\LAejfyg.exe
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:4924
                                                                                                                                                                                                                                                                                                                    • C:\Windows\System\SaIdBbd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\System\SaIdBbd.exe
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                        PID:4408
                                                                                                                                                                                                                                                                                                                      • C:\Windows\System\OHIbeHi.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\System\OHIbeHi.exe
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                          PID:5408
                                                                                                                                                                                                                                                                                                                        • C:\Windows\System\ecIBjXO.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\System\ecIBjXO.exe
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                            PID:5436
                                                                                                                                                                                                                                                                                                                          • C:\Windows\System\oBreQfh.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\System\oBreQfh.exe
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:5472
                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\GSxOIcv.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\System\GSxOIcv.exe
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                PID:316
                                                                                                                                                                                                                                                                                                                              • C:\Windows\System\UpLzsmK.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\System\UpLzsmK.exe
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                  PID:1596
                                                                                                                                                                                                                                                                                                                                • C:\Windows\System\yCzugbp.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\System\yCzugbp.exe
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                    PID:5564
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System\RpkNSCd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\System\RpkNSCd.exe
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                      PID:6156
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System\sAtgazp.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\System\sAtgazp.exe
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                        PID:6276
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System\WSEslfp.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\System\WSEslfp.exe
                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                          PID:5624
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System\zvFPvqD.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\System\zvFPvqD.exe
                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                            PID:4336
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System\wSUDFcr.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\System\wSUDFcr.exe
                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                              PID:7172
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\DHETpTg.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\System\DHETpTg.exe
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                PID:7188
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System\gtJHGFX.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\System\gtJHGFX.exe
                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                  PID:7208
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System\SiUaeuW.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System\SiUaeuW.exe
                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                    PID:7224
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System\lIzmLJR.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System\lIzmLJR.exe
                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                      PID:7244
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System\oaAdaGa.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System\oaAdaGa.exe
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                        PID:7264
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System\Gstkqnm.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System\Gstkqnm.exe
                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                          PID:7292
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System\hrADzis.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System\hrADzis.exe
                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                            PID:7312
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System\DRTwqLl.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System\DRTwqLl.exe
                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                              PID:7332
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\cmhihud.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System\cmhihud.exe
                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                PID:7352
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System\zYvvxdb.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System\zYvvxdb.exe
                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:7368
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System\vQroNBC.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System\vQroNBC.exe
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:7392
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System\DOSEDmW.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System\DOSEDmW.exe
                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:7412
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System\IwcfwyE.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System\IwcfwyE.exe
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:7432
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System\rWTSlrg.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System\rWTSlrg.exe
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:7452
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System\fFMKDRO.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System\fFMKDRO.exe
                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:7468
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System\GMeBrMT.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System\GMeBrMT.exe
                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:7488
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\geGtRix.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System\geGtRix.exe
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:7508
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System\FqnlKBl.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System\FqnlKBl.exe
                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:7532
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System\yshyybX.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System\yshyybX.exe
                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:7552
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System\zGcLbDz.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System\zGcLbDz.exe
                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:7580
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System\uDdTczu.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System\uDdTczu.exe
                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:7600
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System\IJjvmrQ.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System\IJjvmrQ.exe
                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:7620
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System\gjZEqEN.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System\gjZEqEN.exe
                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:7636
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System\bOoNohf.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System\bOoNohf.exe
                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:7652
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\xvGTQCN.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System\xvGTQCN.exe
                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:7672
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System\nKKobMn.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System\nKKobMn.exe
                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:7688
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System\bytRNEW.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System\bytRNEW.exe
                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:7708
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System\CgKZxIP.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System\CgKZxIP.exe
                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:7728
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System\yotLjso.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System\yotLjso.exe
                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:7752
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System\CCMkqwJ.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System\CCMkqwJ.exe
                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:7768
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System\oEeQpIe.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System\oEeQpIe.exe
                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:7784
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System\LKPVJjd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System\LKPVJjd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:7804
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\VRVFayK.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System\VRVFayK.exe
                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:7828
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System\TVqlLkQ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System\TVqlLkQ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7844
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System\suZycBf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System\suZycBf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7864
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System\mQxocMH.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System\mQxocMH.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7884
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System\coetKfE.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System\coetKfE.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7904
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System\hXpgBkZ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System\hXpgBkZ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8144
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System\NhDMaCN.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System\NhDMaCN.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:8160
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System\UdjkxQu.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System\UdjkxQu.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8176
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\dMBjRcN.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System\dMBjRcN.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1044
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System\DDqFIub.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System\DDqFIub.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6392
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System\TmXCPMw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System\TmXCPMw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5724
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System\AKYrroL.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System\AKYrroL.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5740
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System\sBZMVwO.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System\sBZMVwO.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6540
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System\nnbXfJq.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System\nnbXfJq.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5784
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System\oYqMeDF.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System\oYqMeDF.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5804
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System\HKLTEVS.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System\HKLTEVS.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2928
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\YuBWObB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System\YuBWObB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5124
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System\mrFGLWN.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System\mrFGLWN.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5160
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System\TUTHhCg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System\TUTHhCg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:404
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System\XAaRVHw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System\XAaRVHw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5180
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System\zDaPrdD.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System\zDaPrdD.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5216
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System\tPEJMKU.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System\tPEJMKU.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5944
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System\uzbbVPE.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System\uzbbVPE.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5984
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System\ZAPMRAa.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System\ZAPMRAa.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5260
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\qOZZsiY.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System\qOZZsiY.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5296
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System\yxarygj.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System\yxarygj.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System\uJxONka.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System\uJxONka.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System\yqPfxxD.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System\yqPfxxD.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System\FnXxZwP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System\FnXxZwP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System\nFUuypv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System\nFUuypv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System\RssMdbM.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System\RssMdbM.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System\GdBClic.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System\GdBClic.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\JFhhcHl.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System\JFhhcHl.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System\clemYjQ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System\clemYjQ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System\TYYQers.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System\TYYQers.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System\dTCCiFX.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System\dTCCiFX.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System\KunKDhg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System\KunKDhg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System\JLxtXeb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System\JLxtXeb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System\JODQPew.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System\JODQPew.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System\WfspskW.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System\WfspskW.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\ahUPjjg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System\ahUPjjg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System\OfQyonA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System\OfQyonA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System\jOGNChX.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System\jOGNChX.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System\SqrnjbR.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System\SqrnjbR.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System\TExLooL.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System\TExLooL.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System\VicBJGp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System\VicBJGp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System\AdflKOJ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System\AdflKOJ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System\QuwBSdT.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System\QuwBSdT.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\qkyKLml.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System\qkyKLml.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System\HCfEJIY.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System\HCfEJIY.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System\vUBBBab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System\vUBBBab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System\bJUXlcY.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System\bJUXlcY.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System\ANEtkjn.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System\ANEtkjn.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System\ZrNJfEz.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System\ZrNJfEz.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System\tEWaATe.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System\tEWaATe.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System\ZyRGwgW.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System\ZyRGwgW.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\cXesVRc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System\cXesVRc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System\SWbMsoC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System\SWbMsoC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System\SUftGII.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System\SUftGII.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System\SUzvniN.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System\SUzvniN.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System\CmrFGFi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System\CmrFGFi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System\rUssVbN.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System\rUssVbN.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System\ikKbASw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System\ikKbASw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System\IQUJJhL.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System\IQUJJhL.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\lEQrsly.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System\lEQrsly.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7776

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MITRE ATT&CK Matrix

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\AQYzTXT.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              c78a027765f08f4e8e21ee5d85cf900a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ae0348b2546f3b105f363997525e24d8eb00ae33

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              83f3a525b97def2b85781e09945cf8279f132304f7c721f3108833bfca99b87c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              898a5f9d4795f4372b6b5568a71a45793387b1abdcf5aff68b6facf7e77c600bc49df57e7c7e875d8dedb3f4a66fb5df213ec06cd3b4361466ab08e540f31e18

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\DKkCHyJ.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              d423bc70c21567c1857b6cc6957803fd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1ddf7412f5b44b49867cc4e4de7802200785edf5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              f850f94f73d757ebb6be4ef0d2a1d5508ef0c93bd9fed375699172e0b4504e55

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              a66a6ac1ea786e8ecf44513df51e1e2c405dcf3a4bd141341b1e86cea1a73d6814796f3bf45e104d8bea69d61400171a8ef847c0233fa110273eb91458f19efd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\DUucwBZ.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              9e0d297fdc3a7068f887c395ce309c5f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2081bc0263eabd45b9ffd464be8b01b3e38ef1e6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1a29cead4973237829e131bdbb7bea287fd67dce49dd66e040fd81f1dc3a68ca

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              bffeb248ee706b1b3360786ce2c138cc833661ea0bd81ff4b333bd13cbbee6f866ae9054ef9abcc1be3b77b37173e3a19ce7de6ab16839bef920c637b87604da

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\DbbypOh.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              8d459e462d10b60108e0b4af59086a03

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              d4ed19472fddc9869d5f8a9d7ce0158c0a3bf2c2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              c69f51b5d48629c44f8ea6f9caab2ccf1fdee2174a786d2934df37980649e5f9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2dcf6fa93a64b0fd0fc4e0486cbd6a0b94aa370c637e01900fc7323112ec87be791189f6876612ba04fb1e32e9efbf8d7898e4db14e936a325f7b3b70532997d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\EJIEiUd.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6837f2dcdf7f38bef2e8e2f5e615cd5a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              91d8122d33b454ed5ec72f7089b89f7b24f04436

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              bbd9507fe5079e1e558522d61fc6479ebc67fbf9d7e7acf4e52d10aaa9dd7310

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              7fc40eed7aebd02b066eed59cee7aa20b48bb7ffc75dbede4d284e9fac02ce2df357ec98ab74fbdf85a75eae6e820474a2f227cb20235751985801964dd61967

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\ESJZZND.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              490a7a0d423b97af434748501af5e535

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              f314d8d40f10eff2d2871636a3fa8409feca2530

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              8145e05ea7f7f77e5bdffb3f6d06efa713fea9e8e4d9332a014780f4d35108cf

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              99707e9e315761e95b139c0407064cfaa8869456439a11a6c329dfcded2bb506e89ad6527d68ea1cbbfc8f774fa0980d9b08298ffdb3d50b5363924d4b94601b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\EvTlDjf.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              41a22d625aacde862c4cc82f95229b46

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              d1b03815b7746d101cbef86a8236dedc22c0e386

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              9c4c05b822eb3d1d224580872a42750931fb076ba5687219d2a7faf6d402bca0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              712b0558d1e2d44bf6fba9e633c0fe5e5499d7bafcfc126364727506bc8b66e780ed9830c581f500e86de99413255303df4779c0c15948c701614e79cac5badb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\FhVZrET.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              a47e37fd7dfd3910d77240a12d478ba2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              bb14e1ce00a626099ffbf4ebf2780ee4e2aee178

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              326759e4c22896d23a4dfb8e5633e1eb5c0bafbe7c87566a9b7ca384dbdbf0a7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              c55ff322c27cef3fd6bb5976958fe00b4dadb9723bd4a7bf6023285af9a36612343329693839cdf78214b135e9303160fb368181903ee0a9a87c4ee181fbbc8a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\KawsLLU.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              7aa8ba62a97fbb2eddc098cfa4b24d57

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              da8285a8c0b9b1cffa8491c2d23dbdf70677f299

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              29f2a5c8ea4269b118b163e2bdf73d5a3108b558aa8068e4d40a4fcf2762be69

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              e9ac08d98b456145369f8bc78a2f14e51af556e861f012f34f260b94f70b0dffa74fb0a8af9b5c5178028e5f44d4726b56ffbebd19c4e47d934a0042ae340055

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\KsKUDMi.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              944cf1a7cff136ef2f14dd773a803f2c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              773c8a11077fef141dbc57b46211c4bf2837798c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              83e191369783b1b23b41a9c040aac6b960374cca8c1baf50010fafea27f3b3f1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              90e29857de1d6c134f02fb094afdc6008a27ed81d58e136b554ac26e262a475ae1bec547d22fc250198732a559f9a8927475a6577e11514e34632457fe338f98

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\KuJVQNm.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              aa4a2a5799a9d94e4930c53b3637599d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              0e6e22319514b80f0e9efbca55f24adf37d702a9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6f4f2cc4c9d02b88ec9f37f9b49c56ca395da410920dcbd43a1d9584da8e737a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              80f3cfe80aac54593ead43041ae223a84ba9612acd676f79602956ec168076fe56fd5c9c2ee1f8d07ad64c506dd7b2c277464963c7324eb05c1c3647592b4312

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\OTWjJmG.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              324959bbf7b59f9c65cc84881249c15d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              0712540a48806c3bae0e05ba37c71e893ea99176

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              9b46f562c5f5239b97e32b99733912ea84a8feed2a59f47a95e2b16ecfeec822

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              bcdb09bc898d0df52a2e7ae8366d093c31d76968d851ab673c6704358b465daa00dc638ec597e2e958a50baec4d9c4d195074588a4cf8864cadbd62fb86c2a20

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\PQxrdbk.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              f828e6cccfb817fb74d7900f65a397a2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ed6e70eaa45e9e82b8d486e67f893504ae42ff70

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              886efa3382893fb9b51fe74ac3f21cfc28b49e61df9cfb57c92f23269d84c554

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              bce41fc1953175a740e1e785769ddd0d9d0c237c0e1e40de57f57233526c1e824763758511705e67e4bd061aeecb3d7bd7babf15649d5f3685664ac6f6410167

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\TBOqDRl.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              bd9ba040371fdd7c80390eda17e79130

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              8a5fb4b4755fa9869e8a6b42db52d4281e651b09

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4d9cde3119a547bb336f82617e6a2ccd8230f0238ee2eb0ef781ad72935e0e50

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              490d935ec1b42c1ed490e018ef5be9d2b75f8e1fba783cef686ddf3d511f4509d47a15ac4c3cc9287c35cb3abb0cc66ee724bb210df26512a3f8b29e38930dfd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\TUNEzND.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              d6bbcb390a8f187622b14a246f84bc56

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1b4c5b16575e28a88222d438c975bea5a256c32f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              149d98beb5b93db71ea54a76a80e6710e958bc18d96c3dfe478cb4f36cf91e30

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              f8e8f8045b1ad3e9b6700900c5f74952b921dd843e528eb28ab4d4baa41a673979e99670abbe3f91e206da32886df1f721da115f32a6b0625f699e4d64e229ae

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\TmUcUbu.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6a7f5f377bdbb902e5b8e1898ca479af

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2e9a32e5f57c7350ef4530d73282fc0daf2f2de2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5382cc6a382563744b94fdcd9918d26e53990675262472b7c71016b6335cd97a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              f32e848da6be56da98d1eba0df435ef37efbf4c320495ebee02e3a524dfd6d749818d54fd66692b76f55cace792fe61bf6e798d883439f306889ddd6536206e8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\UJcKWPt.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1d18bc4e9060a7a100b2b55cb1a89e4b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5e049bec74af4b9271c05979b7b0a10d8e43dad1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ea3e458f27f82307f68b00096f08916485cab7d2ce933e5a30af57fc348da14f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              d8689a0418bbb9897adb1c139438db5d63559a5b53e0452217d0f3fc49ee4f6029dd4d3733ebf0217a9e2c7d13319e1b5b1f4ae3dc088521e9eefc6493735389

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\VDLtrEL.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              55c6f52b20b08f1ed438ca58c2dc4d20

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              acb3ab5424e686544ca344f9eb5ad4c86dbf5b20

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              19f69d9c72194cad2a35e9d9123c1db24acd3657c43d077d38b51ea3e199782a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ee96ab849b4786f420c77896efa54bda16b774f12153962d336cf246bec6c9faaa4f13fb3a5bb366a79678fce3537834ac5138066fe2f855d7936e526c2c77c4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\XCdKcCX.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2ff4c717e4d88b5844682dcf29a31a12

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              e17ba2c94a9ec098a3ed478e5543eed29bab0194

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              0ee6ea5923731aeea23e48cbe85721ef8c70b40f9fdf98fdfabd51230e0675c5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              dd57678988aa421cd70323d20a9cd03f7cebf173a1f44562ab07599a46a80d2209d54e00ddc69f739d0bfbbc70e653064118743f61d0f437fe45b43d9bb8f847

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\XfvRlSP.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              0890d5bc0690c4358eeaa5d0f051350d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              dda85bb10bf8cc53257432527c144d27049f6512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              7b44fe6068069444ac218b6c862eade37889fe05c39c7d371d4191f4c8a90127

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              7ce0a4343f3e79cd8cbdb5742f0a0c71a4d71b90314c38eacac47e01d1300e5652e8bbac37b8bf4de51581da0b8c4015333a14cea19aaeda93dd4cded45537dc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\YdvLfSr.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ca5599828bb4b5944aa6a6c0a7223036

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              75ce3ed48c39957e79b03e4f5059e8bf7074508a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              bf04e33c3573e6be4080cd9c6abb890f8ba969be415ef0fd9fad46c9483e10ae

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              27ed1d1aaae8c9fd880feefd22d9fddc40a9736819a0592c452936ef3c6e8463552babfe1c8e96652d35dc5607472910a7f99e98f9bcf31d1879b76d172962e4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\YmOcBjk.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              9903d0b2334ffcb3e50613c0347488bf

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              f59bfd1a8038279bf5468815a3f267cf95944c1c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              c424f053cd66306195b2bdb2f1dcc30e599b324eec4973cc993b1558e68f14c3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              d78fbc3a633669b234fb6a702a9bec0229bb5c83c5d334705fc12fa61ea0184df4a84a3bba2a095a635108e8421840aaeb6b4dfc9a093b74be8d4a437f72a988

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\ZSHlBPo.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              c0396a6b611a82b711aa1422910cc4bd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              f4edce3ed156d5631be44809b44a3d75f9f9b205

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              0262eea0022e46c36cfb6bd08a07c90fb8b577d8e33e998dc3c38f99a62e58cf

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              644a348effd241dcd0ecb137a74dad2ab8fbcf93ba1e302c1db878279a3638d77ba2232a3b74d9ffea015cb8e357be4a1fe38a1a94b44caa170f392ef32a5b1e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\ZXkdZan.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1403aea91470bcc0b3e3c3d03983c68e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              44aa11ec6698ceb16bcd3f1e2ca10c36b0383cb1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              621d00ae410d487a3d956780c01b9c301506540a6e4f66b8579e40af322fe69c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4dc764df29c1cc6f149be4f1c1f2367d2e752ff53586ede45a422c81784a2a96096f86cd6dae6b240765a24a44e256adaacdd9d0d09a67c4a5d83166680a3882

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\bFEXGEi.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ff87e206bff731c1a52cc1a3aa3bc56a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              9fd94d8baebe9734fa0dc5846b779f7c109b80f2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              bc8e37aa06a40f30999e35c8e3df9d2d40412d0010941c7b26a141f11f8c3bd0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              510eb7da8133dbdfbace63463ef29aa80db74316154be8b9987dcdf60f681a72701e95625b3efd07851f7473bd69670777bdbd70f9aa4e59727df76ecece3f3f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\bpYafNx.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2668fa1508a658bba101cdcb0ce44733

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              46b29cd1dddbc7329c851907aa18847439734710

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              47ab70180d8d1dad06766ffdff8a73519c4f408ca19d46cec35683ccce598a1c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1fd76a653026915c3ac83d2d82eea5f3342d0e00cd1e71d94cf479ef815eabb85e048d89c9744f3309be5f8b8dcb032d3e75136f4a5afdef9871ecbd5c80c8be

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\dpjlSOu.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              c324b95d4693e8f59c4a47a1855fce8b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5701fa5dc2708984ab98fb3f6b7f556c79340e60

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              7b6c8cf13537a3e50a9a119da8b9c44ecb6f0c0a862c03055387b7dd64526ef8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              01bf6c560a1a337dcd3ec890df7dd04eb3e751b73e9a1fa29fcbdacdedd384edbd2294135e949ae17bb03571df7f62f3e8db9d49daa3df883b274e7a04782740

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\eOjlQbx.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              cb13752d1e631abdd6d0f79796f57e31

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              397d8261281b589ba0e8407071f401995c0ddbfb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              80a816bea25f8e5afb15fbbc88cb7028605fb696133c5c56fc0baa411b2bd5c6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              454774f0f337761d096a3f41cc1e89784c60eb32bd84363efd85eeca8d066fb3322833fadb31f06adace40c990158b1d3b04bc19f1fd03ac8f92825e03f8ec12

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\efnXwuh.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1d6ffee68d8b93182c5c897d3cafaf27

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              be5575adf1b89e685713cbfdc6d8827b92ed59ed

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              aebbef25c3d167e9e0c68d9bfcf26cbe0d823134fffef365d07648d53d77f9ba

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              313ae86e4cf1da9c1c6f0da36eaaa027e519f88eb820ab50487aa43046be40a6c1b98c2d50e97d7b18de498bec660af9849762cfab244ca36a93a65ba70eb436

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\fBKIaii.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              a2877c36917dae93832ce92e24248952

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2772de7a673178822176fed11b1fc5c6968c5ebb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              7955c6fe18db8551c21d4bea6dc06d932ef5b7bead00bcac538d582bd85b098e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              a3d4ff5e044611abae4f90b64814a9ac67b897e8c026d3bb7e95e2135c0996a124dee34048926d3c49da8407f2bfa4980176601b0d4920c222e9f82298241a46

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\ghJQEKf.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              d5f4311f0a437702dd50054b6683ecbe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              af9abb8d417595e637404b366964656ce9b22c67

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              996afeec01b488cce8d88e354ceb7ed924bb238eab46d1492811f9a4bd51ce56

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              a93c4f20928fc69b465a017470410b7f882efad612220868e97ff41715b08994d4279f535af580db662395f6dff210ea9c817804f615a8930c3a26d23f954074

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\iDtXpLC.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              7792bc8415d938629bb0e2a2a8ab14b5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              d405e51c71c0f230501492241bd2d2551b64c0e1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ecc4bf9590eb641e3d07330c34771a1aae2f87f7c2f32f9760cfe459ab4f6718

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2aa663f2c51a2632d328ffc574e2b2d77d471611ea7cedc2da2c5e57af88e28f7623a98598dd12a9e87562708c0bf10898ad415db31089cc6833cc5c9f78ce75

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\kCfLpNw.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              9d054024537bf9b06cac2e6b2c51b7eb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6d434194ff48105e03f46c66f00210b3c6793712

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              a04bf6f3bb45b2c6f5880b0e335f3c1148561adb8cda6917a4c5a0d2b10c9376

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              fdfcd3f170811d1abf88e1fdc78f4399b8aae2a13ee7b24ecc87d57b10bbfa36f81ed66acd32e32337e1799daa0a2468611c265d4413f2b807154d836cf7a56d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\lNHisQk.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              83939138a889733cd496b147ab7de7dc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3a25fe026f68a389c4da16e887de93817374672c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              9711629a000960ffb794c0386b10b2e3a65db9f752a53ff359459115116e7cd9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              7a378af85eec6138fdc22c43e95ec7000ddf444df031ae5ec570c87d67af00f63d08e010482f52c2209fed8932ddc7cb303d938d582ff1a175e765912052ac2f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\loJjcZf.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4f402939a996ac111f357479990a0c53

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              852316d559eacb584cf32cfe7d9c227f664e15c1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              55452eea8db27d3e07a6507dc9991495c18a019183f92e452f97e41f3e3eb8e9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              8e6c9a731fa8be24ff8f918ab0ee75304bcfa6866a77d0c17c65341c0652e65c8dd895d6780b36efa65778549378ad6a4713d374128bd236c513014569bbee00

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\nSBdGOO.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              aca89fffaea8a26296ef68f167152560

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              cd3430e235632a6ddb3edf4c1f34d7c7b92aefea

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              277a39169c7e71bf3439a3f60eedf518da3ba1eb9f2867542d3088154e45a97c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ff356da3bc689a04b6225eca2afcc52711661cca7c87b99408031ea30e7de920ef415d76a3cc6045085cd7f8e07daca7753df6261a743c14b3fff5a0fdbf8d5a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\owzHwym.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              9e9d1c2ee164dfe294e59fc0731b93c3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5b575587b3e018fb3763694281ba55c179a55fd2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              bbfa5aa00730c27fbf9fae6e811512cf9d0b98af0dca8a7e5317d45683c3dd17

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              14dbaaaa3fa8ec216b3703c3a2d453f24011a62d53a6074abbf041d62329181efcb26df14e41098f9572d806b1044d1565ede85f7be3135f7aba9f14c2971cf2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\tvHmRMM.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              a917093ab3dc124d10080b793fd68025

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              650897cca8c9e02953d5848f26b080311d59422a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1ba977f5911779c9dca3b986856a4a9f251be6f8474e380da8e7188d3b70c8aa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              42928f35bc7a54a72a13224691970a087295c87f5ada95f84934e73505f32beba34789e17e984b4471f7ba2294bdee0dc30ca7d3e8daa3fe94c6b34cab7acfad

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\twqNCFf.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              0bb602f0ab7f12c7f1dcd26815c9e189

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3a91518c7346454d6ba69fa7399613350289ab65

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5d1b4214d650e06c203d0e93a54c65c762678812b7985490108674a55ae600ab

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              bcb5b1b8161d3316be7f1597a833845851f5eb56a8096130a741889be97cdcf482d46f3ac71919c6f72c03be8e25f87a44951741e040f9af08b6fefc1a72e759

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\uvtLmeZ.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              c1f723a8f5908bd473144149261a034c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              d0814b2aa6a83acb0fb678648d99f882d793d3df

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              c213f981c49809a021aa8873e46b66f465a850a9d9ea1bb6c50f7245fc954d5d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              7d37a354a2d9c210bfc0020cf15f372165c940743058f8109c6f4fba4b9c825d48b1ff95b0755a895aa625315ee99103e4c43e405c78d79e6c8cd83b13b39af6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\wESihNp.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              dd5ae60bec5a7bbfcba5cf1843a50051

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              24252c8a1c5147668e9ef46f01b35e3f0de8284d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6d73e68cf92c9a217577165e67a92bec1c5220f30c1e072a22470c94704a75d8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              f57dd2ac22f0ae198771ceae407b05db0ed9e227ea4d903a3ecc0ade8ce3b518ca10d84fa2f17022b363e94b03a3535f74904d543554c5df138d6b9d12ec573c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\wFBOMLc.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              142a7aa8520888807b82efcfd6cfa10a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              de5a6c6a30cd6e947cf8b424160ce188727b7c09

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              f3b3544609729990bf5d027013a0046927ddf6eb69ab1e36f3ce01e30084c166

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3fa4f9f91543a68ac33979e367b9fb57b047bc774af494103303403f2dc4aa23d0e76140361560eeee63a99a20e3bb15ef61ae53ae77f3522655e90f4927a586

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System\zbuSrhW.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6daa6a7dbc38181263e59d00df927b42

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              abccd09e1ab52b648199c0a8b4f1a8f95fb0c058

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              b12f2b0e060b34ece13106ad6e16f48a6693d0914e7c97447ef11ea4ab3934f3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              0a8dca4f1d21ffd1ab283555f1e12da86b1087a9183f23708cf4650f0f5107ef6e0fb539c7a0ded73ff89fa80056739da1087149baa3346be8e716545d5d0e18

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/392-716-0x00007FF6F63A0000-0x00007FF6F66F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/392-1239-0x00007FF6F63A0000-0x00007FF6F66F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/748-0-0x00007FF6766E0000-0x00007FF676A31000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/748-1-0x000001DCF7230000-0x000001DCF7240000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              64KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/748-1166-0x00007FF6766E0000-0x00007FF676A31000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/864-269-0x00007FF68EA30000-0x00007FF68ED81000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/864-1240-0x00007FF68EA30000-0x00007FF68ED81000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/1180-1231-0x00007FF66CFD0000-0x00007FF66D321000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/1180-209-0x00007FF66CFD0000-0x00007FF66D321000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/1180-1170-0x00007FF66CFD0000-0x00007FF66D321000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/1348-21-0x00007FF62F850000-0x00007FF62FBA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/1348-1204-0x00007FF62F850000-0x00007FF62FBA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/1352-1223-0x00007FF7DE280000-0x00007FF7DE5D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/1352-715-0x00007FF7DE280000-0x00007FF7DE5D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/1372-272-0x00007FF67EA10000-0x00007FF67ED61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/1372-1220-0x00007FF67EA10000-0x00007FF67ED61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/1636-1168-0x00007FF709500000-0x00007FF709851000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/1636-96-0x00007FF709500000-0x00007FF709851000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/1636-1210-0x00007FF709500000-0x00007FF709851000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/1664-1206-0x00007FF642770000-0x00007FF642AC1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/1664-721-0x00007FF642770000-0x00007FF642AC1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/1684-722-0x00007FF63B670000-0x00007FF63B9C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/1684-1237-0x00007FF63B670000-0x00007FF63B9C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/1804-1272-0x00007FF744C80000-0x00007FF744FD1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/1804-717-0x00007FF744C80000-0x00007FF744FD1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2088-147-0x00007FF6E1640000-0x00007FF6E1991000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2088-1212-0x00007FF6E1640000-0x00007FF6E1991000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2236-1246-0x00007FF78CA30000-0x00007FF78CD81000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2236-718-0x00007FF78CA30000-0x00007FF78CD81000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2456-707-0x00007FF6A6B90000-0x00007FF6A6EE1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2456-1281-0x00007FF6A6B90000-0x00007FF6A6EE1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2536-1242-0x00007FF7D0390000-0x00007FF7D06E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2536-712-0x00007FF7D0390000-0x00007FF7D06E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2560-99-0x00007FF617C40000-0x00007FF617F91000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2560-1214-0x00007FF617C40000-0x00007FF617F91000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2576-608-0x00007FF7137D0000-0x00007FF713B21000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2576-1250-0x00007FF7137D0000-0x00007FF713B21000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2588-1219-0x00007FF65F860000-0x00007FF65FBB1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2588-710-0x00007FF65F860000-0x00007FF65FBB1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2884-1248-0x00007FF671490000-0x00007FF6717E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2884-709-0x00007FF671490000-0x00007FF6717E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2904-603-0x00007FF6B3F30000-0x00007FF6B4281000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/2904-1265-0x00007FF6B3F30000-0x00007FF6B4281000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/3112-1235-0x00007FF763CA0000-0x00007FF763FF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/3112-723-0x00007FF763CA0000-0x00007FF763FF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/3268-1225-0x00007FF715A10000-0x00007FF715D61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/3268-714-0x00007FF715A10000-0x00007FF715D61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/3520-719-0x00007FF784090000-0x00007FF7843E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/3520-1276-0x00007FF784090000-0x00007FF7843E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/3592-1228-0x00007FF7FFC40000-0x00007FF7FFF91000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/3592-344-0x00007FF7FFC40000-0x00007FF7FFF91000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/3692-1208-0x00007FF676170000-0x00007FF6764C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/3692-51-0x00007FF676170000-0x00007FF6764C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/3692-1169-0x00007FF676170000-0x00007FF6764C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/3900-720-0x00007FF769A30000-0x00007FF769D81000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/3900-1274-0x00007FF769A30000-0x00007FF769D81000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/4004-1216-0x00007FF7981A0000-0x00007FF7984F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/4004-1167-0x00007FF7981A0000-0x00007FF7984F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/4004-42-0x00007FF7981A0000-0x00007FF7984F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/4268-711-0x00007FF78A2B0000-0x00007FF78A601000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/4268-1233-0x00007FF78A2B0000-0x00007FF78A601000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/4388-713-0x00007FF6E1DA0000-0x00007FF6E20F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/4388-1226-0x00007FF6E1DA0000-0x00007FF6E20F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/5064-464-0x00007FF703BB0000-0x00007FF703F01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • memory/5064-1244-0x00007FF703BB0000-0x00007FF703F01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3.3MB