xmrig | dc77e0f9b8762aba6513238ce4eca26672659884b146406a21a371d66a74df41

Analysis

max time kernel
120s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/08/2024, 19:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c68df78fb545ea694736ea278fa4cff0N.exe
Size

1.9MB
MD5

c68df78fb545ea694736ea278fa4cff0
SHA1

21273c9d9b467370b10d18104a6d3065ded3ca82
SHA256

dc77e0f9b8762aba6513238ce4eca26672659884b146406a21a371d66a74df41
SHA512

a9a668529db373a3f3c2e175491e79cc4942212e6908ae64114a3d7ddaaab052da027daf1eaa591a74f13b7bc8a8f59be37dea509fe72d9641e60495aa0625e2
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW7r+kQQ7dXQARBa5e0ag2K0hvL71:Lz071uv4BPMkyW10/wKV7hjSe05c2Hw

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 40 IoCs

miner

resource	yara_rule
behavioral2/memory/2172-12-0x00007FF762830000-0x00007FF762C22000-memory.dmp	xmrig
behavioral2/memory/3764-207-0x00007FF6151B0000-0x00007FF6155A2000-memory.dmp	xmrig
behavioral2/memory/1744-221-0x00007FF6382E0000-0x00007FF6386D2000-memory.dmp	xmrig
behavioral2/memory/1452-345-0x00007FF6F28F0000-0x00007FF6F2CE2000-memory.dmp	xmrig
behavioral2/memory/4104-400-0x00007FF690320000-0x00007FF690712000-memory.dmp	xmrig
behavioral2/memory/5072-465-0x00007FF66FE80000-0x00007FF670272000-memory.dmp	xmrig
behavioral2/memory/1816-473-0x00007FF615C50000-0x00007FF616042000-memory.dmp	xmrig
behavioral2/memory/1496-777-0x00007FF710E10000-0x00007FF711202000-memory.dmp	xmrig
behavioral2/memory/4256-857-0x00007FF765EB0000-0x00007FF7662A2000-memory.dmp	xmrig
behavioral2/memory/1064-931-0x00007FF7370F0000-0x00007FF7374E2000-memory.dmp	xmrig
behavioral2/memory/436-954-0x00007FF7CBD90000-0x00007FF7CC182000-memory.dmp	xmrig
behavioral2/memory/2996-930-0x00007FF62E0F0000-0x00007FF62E4E2000-memory.dmp	xmrig
behavioral2/memory/1968-899-0x00007FF747AD0000-0x00007FF747EC2000-memory.dmp	xmrig
behavioral2/memory/744-649-0x00007FF79FC40000-0x00007FF7A0032000-memory.dmp	xmrig
behavioral2/memory/4772-639-0x00007FF653BC0000-0x00007FF653FB2000-memory.dmp	xmrig
behavioral2/memory/712-617-0x00007FF74D6C0000-0x00007FF74DAB2000-memory.dmp	xmrig
behavioral2/memory/1876-552-0x00007FF60BC90000-0x00007FF60C082000-memory.dmp	xmrig
behavioral2/memory/2120-547-0x00007FF67DFF0000-0x00007FF67E3E2000-memory.dmp	xmrig
behavioral2/memory/4348-323-0x00007FF7338B0000-0x00007FF733CA2000-memory.dmp	xmrig
behavioral2/memory/1692-285-0x00007FF78DF70000-0x00007FF78E362000-memory.dmp	xmrig
behavioral2/memory/1232-225-0x00007FF6401C0000-0x00007FF6405B2000-memory.dmp	xmrig
behavioral2/memory/2348-93-0x00007FF6909F0000-0x00007FF690DE2000-memory.dmp	xmrig
behavioral2/memory/3064-71-0x00007FF77AE20000-0x00007FF77B212000-memory.dmp	xmrig
behavioral2/memory/3108-4770-0x00007FF747550000-0x00007FF747942000-memory.dmp	xmrig
behavioral2/memory/1968-5087-0x00007FF747AD0000-0x00007FF747EC2000-memory.dmp	xmrig
behavioral2/memory/1744-5126-0x00007FF6382E0000-0x00007FF6386D2000-memory.dmp	xmrig
behavioral2/memory/1876-5189-0x00007FF60BC90000-0x00007FF60C082000-memory.dmp	xmrig
behavioral2/memory/3764-5124-0x00007FF6151B0000-0x00007FF6155A2000-memory.dmp	xmrig
behavioral2/memory/1816-5119-0x00007FF615C50000-0x00007FF616042000-memory.dmp	xmrig
behavioral2/memory/4348-5220-0x00007FF7338B0000-0x00007FF733CA2000-memory.dmp	xmrig
behavioral2/memory/712-5225-0x00007FF74D6C0000-0x00007FF74DAB2000-memory.dmp	xmrig
behavioral2/memory/4104-5222-0x00007FF690320000-0x00007FF690712000-memory.dmp	xmrig
behavioral2/memory/1232-5212-0x00007FF6401C0000-0x00007FF6405B2000-memory.dmp	xmrig
behavioral2/memory/1064-5240-0x00007FF7370F0000-0x00007FF7374E2000-memory.dmp	xmrig
behavioral2/memory/436-5236-0x00007FF7CBD90000-0x00007FF7CC182000-memory.dmp	xmrig
behavioral2/memory/4256-5265-0x00007FF765EB0000-0x00007FF7662A2000-memory.dmp	xmrig
behavioral2/memory/2120-5256-0x00007FF67DFF0000-0x00007FF67E3E2000-memory.dmp	xmrig
behavioral2/memory/744-5251-0x00007FF79FC40000-0x00007FF7A0032000-memory.dmp	xmrig
behavioral2/memory/1496-5247-0x00007FF710E10000-0x00007FF711202000-memory.dmp	xmrig
behavioral2/memory/4772-5313-0x00007FF653BC0000-0x00007FF653FB2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4420	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2172	AXrCQrt.exe
3064	jEfAeST.exe
2348	uUsGnMP.exe
1968	ZJhmcRE.exe
3108	GqniEMF.exe
3764	XGNbLBr.exe
1744	RDRNCif.exe
1232	QdiNAtv.exe
1692	YeqjHeO.exe
4348	rUoUobh.exe
2996	qGwjOmb.exe
1452	CbhBKHl.exe
4104	MWRZdap.exe
5072	NvjhJGI.exe
1816	MeewkZS.exe
1064	EBnNjye.exe
2120	XIjPjsd.exe
1876	hXwjTZE.exe
712	pbDVUbf.exe
436	iJyrMVU.exe
4772	LRMEaRW.exe
744	IIoPdbr.exe
1496	qDgUcbK.exe
4256	YcuvCVP.exe
4972	nrAQgyb.exe
2360	QOdIRNs.exe
3908	KisKDLj.exe
2472	drMALSD.exe
1508	XNqhqGO.exe
4512	neiibvT.exe
1192	GaqUmiE.exe
3720	CYXvLQX.exe
1568	OALZfsg.exe
64	AARzDov.exe
1396	BVQekVr.exe
2292	tXXLqqc.exe
4280	fYLaAgs.exe
2356	DZyloBh.exe
4600	vBzWdRJ.exe
1808	huHikLS.exe
384	fBTQfTG.exe
4064	zrEVEhj.exe
4004	qCmNAML.exe
5108	KLUhqzi.exe
1980	NvtvRsC.exe
2268	CnBRXWb.exe
2468	pBuOEJa.exe
4428	kjQRUJf.exe
3616	igHILVC.exe
1480	wgAJjXd.exe
3248	yKdTpKF.exe
640	wUHHCRd.exe
3048	rfieiMY.exe
452	EpstSQl.exe
732	DuJnikv.exe
2192	HYqviCR.exe
2064	vhNmJKk.exe
1248	AmuSkkx.exe
748	Grdnxcw.exe
2296	wzgEpOd.exe
1020	UvCuLrF.exe
4476	Ifkxfez.exe
4592	wQSZTlU.exe
4484	OeKkWdW.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1772-0-0x00007FF7B2250000-0x00007FF7B2642000-memory.dmp	upx
behavioral2/files/0x000900000002340c-7.dat	upx
behavioral2/memory/2172-12-0x00007FF762830000-0x00007FF762C22000-memory.dmp	upx
behavioral2/files/0x0007000000023470-23.dat	upx
behavioral2/files/0x0007000000023471-30.dat	upx
behavioral2/files/0x0007000000023490-162.dat	upx
behavioral2/files/0x000700000002347b-121.dat	upx
behavioral2/files/0x000700000002347d-159.dat	upx
behavioral2/memory/3764-207-0x00007FF6151B0000-0x00007FF6155A2000-memory.dmp	upx
behavioral2/memory/1744-221-0x00007FF6382E0000-0x00007FF6386D2000-memory.dmp	upx
behavioral2/memory/1452-345-0x00007FF6F28F0000-0x00007FF6F2CE2000-memory.dmp	upx
behavioral2/memory/4104-400-0x00007FF690320000-0x00007FF690712000-memory.dmp	upx
behavioral2/memory/5072-465-0x00007FF66FE80000-0x00007FF670272000-memory.dmp	upx
behavioral2/memory/1816-473-0x00007FF615C50000-0x00007FF616042000-memory.dmp	upx
behavioral2/memory/1496-777-0x00007FF710E10000-0x00007FF711202000-memory.dmp	upx
behavioral2/memory/4256-857-0x00007FF765EB0000-0x00007FF7662A2000-memory.dmp	upx
behavioral2/memory/1064-931-0x00007FF7370F0000-0x00007FF7374E2000-memory.dmp	upx
behavioral2/memory/436-954-0x00007FF7CBD90000-0x00007FF7CC182000-memory.dmp	upx
behavioral2/memory/2996-930-0x00007FF62E0F0000-0x00007FF62E4E2000-memory.dmp	upx
behavioral2/memory/1968-899-0x00007FF747AD0000-0x00007FF747EC2000-memory.dmp	upx
behavioral2/memory/744-649-0x00007FF79FC40000-0x00007FF7A0032000-memory.dmp	upx
behavioral2/memory/4772-639-0x00007FF653BC0000-0x00007FF653FB2000-memory.dmp	upx
behavioral2/memory/712-617-0x00007FF74D6C0000-0x00007FF74DAB2000-memory.dmp	upx
behavioral2/memory/1876-552-0x00007FF60BC90000-0x00007FF60C082000-memory.dmp	upx
behavioral2/memory/2120-547-0x00007FF67DFF0000-0x00007FF67E3E2000-memory.dmp	upx
behavioral2/memory/4348-323-0x00007FF7338B0000-0x00007FF733CA2000-memory.dmp	upx
behavioral2/memory/1692-285-0x00007FF78DF70000-0x00007FF78E362000-memory.dmp	upx
behavioral2/memory/1232-225-0x00007FF6401C0000-0x00007FF6405B2000-memory.dmp	upx
behavioral2/files/0x0007000000023498-206.dat	upx
behavioral2/files/0x000700000002348e-205.dat	upx
behavioral2/files/0x0007000000023497-190.dat	upx
behavioral2/files/0x0007000000023482-187.dat	upx
behavioral2/files/0x0007000000023496-186.dat	upx
behavioral2/files/0x0007000000023495-185.dat	upx
behavioral2/files/0x0007000000023489-184.dat	upx
behavioral2/files/0x0007000000023494-182.dat	upx
behavioral2/files/0x0007000000023493-178.dat	upx
behavioral2/files/0x0007000000023480-175.dat	upx
behavioral2/files/0x000700000002347e-165.dat	upx
behavioral2/files/0x0007000000023491-163.dat	upx
behavioral2/files/0x0007000000023483-156.dat	upx
behavioral2/files/0x000700000002348d-149.dat	upx
behavioral2/files/0x000700000002348c-148.dat	upx
behavioral2/memory/3108-146-0x00007FF747550000-0x00007FF747942000-memory.dmp	upx
behavioral2/files/0x000700000002348b-144.dat	upx
behavioral2/files/0x0007000000023488-141.dat	upx
behavioral2/files/0x0007000000023492-174.dat	upx
behavioral2/files/0x0007000000023486-131.dat	upx
behavioral2/files/0x0007000000023485-126.dat	upx
behavioral2/files/0x000700000002347a-118.dat	upx
behavioral2/files/0x000700000002348f-155.dat	upx
behavioral2/files/0x0007000000023479-114.dat	upx
behavioral2/files/0x0007000000023475-105.dat	upx
behavioral2/files/0x000700000002348a-143.dat	upx
behavioral2/memory/2348-93-0x00007FF6909F0000-0x00007FF690DE2000-memory.dmp	upx
behavioral2/files/0x0007000000023487-139.dat	upx
behavioral2/files/0x0007000000023481-138.dat	upx
behavioral2/files/0x000700000002347f-90.dat	upx
behavioral2/files/0x0007000000023484-125.dat	upx
behavioral2/files/0x0007000000023476-77.dat	upx
behavioral2/files/0x0007000000023478-96.dat	upx
behavioral2/memory/3064-71-0x00007FF77AE20000-0x00007FF77B212000-memory.dmp	upx
behavioral2/files/0x0007000000023474-60.dat	upx
behavioral2/files/0x0007000000023473-58.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\VTwreCU.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\MZLzqLv.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\tgyZRHu.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\hCjuUYT.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\SzxKIfZ.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\zmJjWGh.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\LVHvVtW.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\pUzNvfG.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\RfFxWSt.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\SiawNIH.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\wzKEUBS.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\mivooXn.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\qpmRGHx.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\BEGGkAI.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\xrLvBeB.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\dmrXHyU.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\DqcuvAl.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\kInxGgQ.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\lUYKXOa.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\VlTQJGu.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\gFhCPLg.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\McvSYcZ.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\FxBqqkx.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\ucWXvQW.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\eJbKuNI.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\IPVdbIL.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\AljNXcs.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\WgFhgVf.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\WLfPCdX.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\MUIBCed.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\ecbJfAJ.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\UrdszDp.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\czBJNCJ.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\bcaqbYm.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\kAwtyUn.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\djJQmBr.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\eSozDDc.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\brokhgW.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\rVKOthO.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\hrPxHYM.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\cTJIBrG.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\AZjsOLN.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\acHTQyj.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\piTkpLH.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\KXlVtts.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\MdAsdCl.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\qjoKxZM.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\lnlFyZC.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\qrhzOBw.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\bzmqApa.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\xdcxWzG.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\REYSdRf.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\Lshvexi.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\CfRnpiO.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\vWpsIJn.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\NDFFKQK.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\TpyMNWt.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\ZbNTnSt.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\aRQxpAq.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\QIZTvaq.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\qIseUXT.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\llCsUmx.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\DhlQDAL.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\tZkYsQq.exe	c68df78fb545ea694736ea278fa4cff0N.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1772	c68df78fb545ea694736ea278fa4cff0N.exe
Token: SeLockMemoryPrivilege	1772	c68df78fb545ea694736ea278fa4cff0N.exe
Token: SeDebugPrivilege	4420	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 4420	1772	c68df78fb545ea694736ea278fa4cff0N.exe	85
PID 1772 wrote to memory of 4420	1772	c68df78fb545ea694736ea278fa4cff0N.exe	85
PID 1772 wrote to memory of 2172	1772	c68df78fb545ea694736ea278fa4cff0N.exe	86
PID 1772 wrote to memory of 2172	1772	c68df78fb545ea694736ea278fa4cff0N.exe	86
PID 1772 wrote to memory of 3064	1772	c68df78fb545ea694736ea278fa4cff0N.exe	87
PID 1772 wrote to memory of 3064	1772	c68df78fb545ea694736ea278fa4cff0N.exe	87
PID 1772 wrote to memory of 2348	1772	c68df78fb545ea694736ea278fa4cff0N.exe	88
PID 1772 wrote to memory of 2348	1772	c68df78fb545ea694736ea278fa4cff0N.exe	88
PID 1772 wrote to memory of 1968	1772	c68df78fb545ea694736ea278fa4cff0N.exe	89
PID 1772 wrote to memory of 1968	1772	c68df78fb545ea694736ea278fa4cff0N.exe	89
PID 1772 wrote to memory of 3108	1772	c68df78fb545ea694736ea278fa4cff0N.exe	90
PID 1772 wrote to memory of 3108	1772	c68df78fb545ea694736ea278fa4cff0N.exe	90
PID 1772 wrote to memory of 3764	1772	c68df78fb545ea694736ea278fa4cff0N.exe	91
PID 1772 wrote to memory of 3764	1772	c68df78fb545ea694736ea278fa4cff0N.exe	91
PID 1772 wrote to memory of 1744	1772	c68df78fb545ea694736ea278fa4cff0N.exe	92
PID 1772 wrote to memory of 1744	1772	c68df78fb545ea694736ea278fa4cff0N.exe	92
PID 1772 wrote to memory of 1232	1772	c68df78fb545ea694736ea278fa4cff0N.exe	93
PID 1772 wrote to memory of 1232	1772	c68df78fb545ea694736ea278fa4cff0N.exe	93
PID 1772 wrote to memory of 1692	1772	c68df78fb545ea694736ea278fa4cff0N.exe	94
PID 1772 wrote to memory of 1692	1772	c68df78fb545ea694736ea278fa4cff0N.exe	94
PID 1772 wrote to memory of 4348	1772	c68df78fb545ea694736ea278fa4cff0N.exe	95
PID 1772 wrote to memory of 4348	1772	c68df78fb545ea694736ea278fa4cff0N.exe	95
PID 1772 wrote to memory of 2996	1772	c68df78fb545ea694736ea278fa4cff0N.exe	96
PID 1772 wrote to memory of 2996	1772	c68df78fb545ea694736ea278fa4cff0N.exe	96
PID 1772 wrote to memory of 1452	1772	c68df78fb545ea694736ea278fa4cff0N.exe	97
PID 1772 wrote to memory of 1452	1772	c68df78fb545ea694736ea278fa4cff0N.exe	97
PID 1772 wrote to memory of 4104	1772	c68df78fb545ea694736ea278fa4cff0N.exe	98
PID 1772 wrote to memory of 4104	1772	c68df78fb545ea694736ea278fa4cff0N.exe	98
PID 1772 wrote to memory of 5072	1772	c68df78fb545ea694736ea278fa4cff0N.exe	99
PID 1772 wrote to memory of 5072	1772	c68df78fb545ea694736ea278fa4cff0N.exe	99
PID 1772 wrote to memory of 1816	1772	c68df78fb545ea694736ea278fa4cff0N.exe	100
PID 1772 wrote to memory of 1816	1772	c68df78fb545ea694736ea278fa4cff0N.exe	100
PID 1772 wrote to memory of 1064	1772	c68df78fb545ea694736ea278fa4cff0N.exe	101
PID 1772 wrote to memory of 1064	1772	c68df78fb545ea694736ea278fa4cff0N.exe	101
PID 1772 wrote to memory of 2120	1772	c68df78fb545ea694736ea278fa4cff0N.exe	102
PID 1772 wrote to memory of 2120	1772	c68df78fb545ea694736ea278fa4cff0N.exe	102
PID 1772 wrote to memory of 1876	1772	c68df78fb545ea694736ea278fa4cff0N.exe	103
PID 1772 wrote to memory of 1876	1772	c68df78fb545ea694736ea278fa4cff0N.exe	103
PID 1772 wrote to memory of 712	1772	c68df78fb545ea694736ea278fa4cff0N.exe	104
PID 1772 wrote to memory of 712	1772	c68df78fb545ea694736ea278fa4cff0N.exe	104
PID 1772 wrote to memory of 4256	1772	c68df78fb545ea694736ea278fa4cff0N.exe	105
PID 1772 wrote to memory of 4256	1772	c68df78fb545ea694736ea278fa4cff0N.exe	105
PID 1772 wrote to memory of 436	1772	c68df78fb545ea694736ea278fa4cff0N.exe	106
PID 1772 wrote to memory of 436	1772	c68df78fb545ea694736ea278fa4cff0N.exe	106
PID 1772 wrote to memory of 3720	1772	c68df78fb545ea694736ea278fa4cff0N.exe	107
PID 1772 wrote to memory of 3720	1772	c68df78fb545ea694736ea278fa4cff0N.exe	107
PID 1772 wrote to memory of 4772	1772	c68df78fb545ea694736ea278fa4cff0N.exe	108
PID 1772 wrote to memory of 4772	1772	c68df78fb545ea694736ea278fa4cff0N.exe	108
PID 1772 wrote to memory of 744	1772	c68df78fb545ea694736ea278fa4cff0N.exe	109
PID 1772 wrote to memory of 744	1772	c68df78fb545ea694736ea278fa4cff0N.exe	109
PID 1772 wrote to memory of 1496	1772	c68df78fb545ea694736ea278fa4cff0N.exe	110
PID 1772 wrote to memory of 1496	1772	c68df78fb545ea694736ea278fa4cff0N.exe	110
PID 1772 wrote to memory of 4972	1772	c68df78fb545ea694736ea278fa4cff0N.exe	111
PID 1772 wrote to memory of 4972	1772	c68df78fb545ea694736ea278fa4cff0N.exe	111
PID 1772 wrote to memory of 2360	1772	c68df78fb545ea694736ea278fa4cff0N.exe	112
PID 1772 wrote to memory of 2360	1772	c68df78fb545ea694736ea278fa4cff0N.exe	112
PID 1772 wrote to memory of 2356	1772	c68df78fb545ea694736ea278fa4cff0N.exe	113
PID 1772 wrote to memory of 2356	1772	c68df78fb545ea694736ea278fa4cff0N.exe	113
PID 1772 wrote to memory of 3908	1772	c68df78fb545ea694736ea278fa4cff0N.exe	114
PID 1772 wrote to memory of 3908	1772	c68df78fb545ea694736ea278fa4cff0N.exe	114
PID 1772 wrote to memory of 2472	1772	c68df78fb545ea694736ea278fa4cff0N.exe	115
PID 1772 wrote to memory of 2472	1772	c68df78fb545ea694736ea278fa4cff0N.exe	115
PID 1772 wrote to memory of 1508	1772	c68df78fb545ea694736ea278fa4cff0N.exe	116
PID 1772 wrote to memory of 1508	1772	c68df78fb545ea694736ea278fa4cff0N.exe	116

C:\Users\Admin\AppData\Local\Temp\c68df78fb545ea694736ea278fa4cff0N.exe
"C:\Users\Admin\AppData\Local\Temp\c68df78fb545ea694736ea278fa4cff0N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4420
- C:\Windows\System\AXrCQrt.exe
  C:\Windows\System\AXrCQrt.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\jEfAeST.exe
  C:\Windows\System\jEfAeST.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\uUsGnMP.exe
  C:\Windows\System\uUsGnMP.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\ZJhmcRE.exe
  C:\Windows\System\ZJhmcRE.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\GqniEMF.exe
  C:\Windows\System\GqniEMF.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\XGNbLBr.exe
  C:\Windows\System\XGNbLBr.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\RDRNCif.exe
  C:\Windows\System\RDRNCif.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\QdiNAtv.exe
  C:\Windows\System\QdiNAtv.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\YeqjHeO.exe
  C:\Windows\System\YeqjHeO.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\rUoUobh.exe
  C:\Windows\System\rUoUobh.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\qGwjOmb.exe
  C:\Windows\System\qGwjOmb.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\CbhBKHl.exe
  C:\Windows\System\CbhBKHl.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\MWRZdap.exe
  C:\Windows\System\MWRZdap.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\NvjhJGI.exe
  C:\Windows\System\NvjhJGI.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\MeewkZS.exe
  C:\Windows\System\MeewkZS.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\EBnNjye.exe
  C:\Windows\System\EBnNjye.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\XIjPjsd.exe
  C:\Windows\System\XIjPjsd.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\hXwjTZE.exe
  C:\Windows\System\hXwjTZE.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\pbDVUbf.exe
  C:\Windows\System\pbDVUbf.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System\YcuvCVP.exe
  C:\Windows\System\YcuvCVP.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\iJyrMVU.exe
  C:\Windows\System\iJyrMVU.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\CYXvLQX.exe
  C:\Windows\System\CYXvLQX.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\LRMEaRW.exe
  C:\Windows\System\LRMEaRW.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\IIoPdbr.exe
  C:\Windows\System\IIoPdbr.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\qDgUcbK.exe
  C:\Windows\System\qDgUcbK.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\nrAQgyb.exe
  C:\Windows\System\nrAQgyb.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\QOdIRNs.exe
  C:\Windows\System\QOdIRNs.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\DZyloBh.exe
  C:\Windows\System\DZyloBh.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\KisKDLj.exe
  C:\Windows\System\KisKDLj.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\drMALSD.exe
  C:\Windows\System\drMALSD.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\XNqhqGO.exe
  C:\Windows\System\XNqhqGO.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\neiibvT.exe
  C:\Windows\System\neiibvT.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\zrEVEhj.exe
  C:\Windows\System\zrEVEhj.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\GaqUmiE.exe
  C:\Windows\System\GaqUmiE.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\OALZfsg.exe
  C:\Windows\System\OALZfsg.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\AARzDov.exe
  C:\Windows\System\AARzDov.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\BVQekVr.exe
  C:\Windows\System\BVQekVr.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\tXXLqqc.exe
  C:\Windows\System\tXXLqqc.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\fYLaAgs.exe
  C:\Windows\System\fYLaAgs.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\vBzWdRJ.exe
  C:\Windows\System\vBzWdRJ.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\huHikLS.exe
  C:\Windows\System\huHikLS.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\fBTQfTG.exe
  C:\Windows\System\fBTQfTG.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\qCmNAML.exe
  C:\Windows\System\qCmNAML.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\KLUhqzi.exe
  C:\Windows\System\KLUhqzi.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\NvtvRsC.exe
  C:\Windows\System\NvtvRsC.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\CnBRXWb.exe
  C:\Windows\System\CnBRXWb.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\pBuOEJa.exe
  C:\Windows\System\pBuOEJa.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\kjQRUJf.exe
  C:\Windows\System\kjQRUJf.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\igHILVC.exe
  C:\Windows\System\igHILVC.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\wgAJjXd.exe
  C:\Windows\System\wgAJjXd.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\yKdTpKF.exe
  C:\Windows\System\yKdTpKF.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\wUHHCRd.exe
  C:\Windows\System\wUHHCRd.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\rfieiMY.exe
  C:\Windows\System\rfieiMY.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\EpstSQl.exe
  C:\Windows\System\EpstSQl.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\DuJnikv.exe
  C:\Windows\System\DuJnikv.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\HYqviCR.exe
  C:\Windows\System\HYqviCR.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\vhNmJKk.exe
  C:\Windows\System\vhNmJKk.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\AmuSkkx.exe
  C:\Windows\System\AmuSkkx.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\Grdnxcw.exe
  C:\Windows\System\Grdnxcw.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\wzgEpOd.exe
  C:\Windows\System\wzgEpOd.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\UvCuLrF.exe
  C:\Windows\System\UvCuLrF.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\Ifkxfez.exe
  C:\Windows\System\Ifkxfez.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\wQSZTlU.exe
  C:\Windows\System\wQSZTlU.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\OeKkWdW.exe
  C:\Windows\System\OeKkWdW.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\ffSwFqj.exe
  C:\Windows\System\ffSwFqj.exe
  2⤵
  PID:2196
- C:\Windows\System\WDJDDPi.exe
  C:\Windows\System\WDJDDPi.exe
  2⤵
  PID:2800
- C:\Windows\System\LrrBAiD.exe
  C:\Windows\System\LrrBAiD.exe
  2⤵
  PID:3068
- C:\Windows\System\wktozHS.exe
  C:\Windows\System\wktozHS.exe
  2⤵
  PID:1552
- C:\Windows\System\RWwkIsu.exe
  C:\Windows\System\RWwkIsu.exe
  2⤵
  PID:4140
- C:\Windows\System\slMTCuB.exe
  C:\Windows\System\slMTCuB.exe
  2⤵
  PID:3940
- C:\Windows\System\NtdtlGQ.exe
  C:\Windows\System\NtdtlGQ.exe
  2⤵
  PID:5128
- C:\Windows\System\JTafGTy.exe
  C:\Windows\System\JTafGTy.exe
  2⤵
  PID:5152
- C:\Windows\System\jjVlHwc.exe
  C:\Windows\System\jjVlHwc.exe
  2⤵
  PID:5176
- C:\Windows\System\drZMFDF.exe
  C:\Windows\System\drZMFDF.exe
  2⤵
  PID:5200
- C:\Windows\System\UUYfEjn.exe
  C:\Windows\System\UUYfEjn.exe
  2⤵
  PID:5216
- C:\Windows\System\WfVvSOk.exe
  C:\Windows\System\WfVvSOk.exe
  2⤵
  PID:5236
- C:\Windows\System\HwmTOwc.exe
  C:\Windows\System\HwmTOwc.exe
  2⤵
  PID:5268
- C:\Windows\System\oSNlMiE.exe
  C:\Windows\System\oSNlMiE.exe
  2⤵
  PID:5284
- C:\Windows\System\xnZmgns.exe
  C:\Windows\System\xnZmgns.exe
  2⤵
  PID:5336
- C:\Windows\System\gVKtQgO.exe
  C:\Windows\System\gVKtQgO.exe
  2⤵
  PID:5356
- C:\Windows\System\AamKSYx.exe
  C:\Windows\System\AamKSYx.exe
  2⤵
  PID:5376
- C:\Windows\System\XbnAmhN.exe
  C:\Windows\System\XbnAmhN.exe
  2⤵
  PID:5400
- C:\Windows\System\ekalamb.exe
  C:\Windows\System\ekalamb.exe
  2⤵
  PID:5428
- C:\Windows\System\PkycSmh.exe
  C:\Windows\System\PkycSmh.exe
  2⤵
  PID:5448
- C:\Windows\System\fRbbmTi.exe
  C:\Windows\System\fRbbmTi.exe
  2⤵
  PID:5472
- C:\Windows\System\ElXwRKO.exe
  C:\Windows\System\ElXwRKO.exe
  2⤵
  PID:5508
- C:\Windows\System\RyvCwIO.exe
  C:\Windows\System\RyvCwIO.exe
  2⤵
  PID:5524
- C:\Windows\System\XftYaUI.exe
  C:\Windows\System\XftYaUI.exe
  2⤵
  PID:5548
- C:\Windows\System\XkWHwnK.exe
  C:\Windows\System\XkWHwnK.exe
  2⤵
  PID:5564
- C:\Windows\System\tgzQhbK.exe
  C:\Windows\System\tgzQhbK.exe
  2⤵
  PID:5588
- C:\Windows\System\yJIsIun.exe
  C:\Windows\System\yJIsIun.exe
  2⤵
  PID:5608
- C:\Windows\System\qMPEEwD.exe
  C:\Windows\System\qMPEEwD.exe
  2⤵
  PID:5628
- C:\Windows\System\MlbLLox.exe
  C:\Windows\System\MlbLLox.exe
  2⤵
  PID:5756
- C:\Windows\System\fAEtRRi.exe
  C:\Windows\System\fAEtRRi.exe
  2⤵
  PID:5772
- C:\Windows\System\iwDUhNP.exe
  C:\Windows\System\iwDUhNP.exe
  2⤵
  PID:5792
- C:\Windows\System\dVSMOwJ.exe
  C:\Windows\System\dVSMOwJ.exe
  2⤵
  PID:5824
- C:\Windows\System\EBvqPLT.exe
  C:\Windows\System\EBvqPLT.exe
  2⤵
  PID:5840
- C:\Windows\System\wolTTHV.exe
  C:\Windows\System\wolTTHV.exe
  2⤵
  PID:5856
- C:\Windows\System\tCnoLTT.exe
  C:\Windows\System\tCnoLTT.exe
  2⤵
  PID:5876
- C:\Windows\System\EKeVZOu.exe
  C:\Windows\System\EKeVZOu.exe
  2⤵
  PID:5896
- C:\Windows\System\xOUzNAl.exe
  C:\Windows\System\xOUzNAl.exe
  2⤵
  PID:5920
- C:\Windows\System\TkZXseG.exe
  C:\Windows\System\TkZXseG.exe
  2⤵
  PID:5936
- C:\Windows\System\PzGjzKg.exe
  C:\Windows\System\PzGjzKg.exe
  2⤵
  PID:5964
- C:\Windows\System\uajrqEj.exe
  C:\Windows\System\uajrqEj.exe
  2⤵
  PID:5992
- C:\Windows\System\PDhJRjb.exe
  C:\Windows\System\PDhJRjb.exe
  2⤵
  PID:6012
- C:\Windows\System\OqorKSH.exe
  C:\Windows\System\OqorKSH.exe
  2⤵
  PID:6028
- C:\Windows\System\BeqPxgm.exe
  C:\Windows\System\BeqPxgm.exe
  2⤵
  PID:6052
- C:\Windows\System\GzloPHt.exe
  C:\Windows\System\GzloPHt.exe
  2⤵
  PID:6068
- C:\Windows\System\zNAddXT.exe
  C:\Windows\System\zNAddXT.exe
  2⤵
  PID:6092
- C:\Windows\System\wSOJCYS.exe
  C:\Windows\System\wSOJCYS.exe
  2⤵
  PID:6112
- C:\Windows\System\kVinArm.exe
  C:\Windows\System\kVinArm.exe
  2⤵
  PID:6132
- C:\Windows\System\pUxrXLg.exe
  C:\Windows\System\pUxrXLg.exe
  2⤵
  PID:2684
- C:\Windows\System\psflYsT.exe
  C:\Windows\System\psflYsT.exe
  2⤵
  PID:2596
- C:\Windows\System\oXcPiHM.exe
  C:\Windows\System\oXcPiHM.exe
  2⤵
  PID:2440
- C:\Windows\System\qzpbWCo.exe
  C:\Windows\System\qzpbWCo.exe
  2⤵
  PID:5008
- C:\Windows\System\JibyBOU.exe
  C:\Windows\System\JibyBOU.exe
  2⤵
  PID:832
- C:\Windows\System\VXOMiyW.exe
  C:\Windows\System\VXOMiyW.exe
  2⤵
  PID:5040
- C:\Windows\System\MQEdPmG.exe
  C:\Windows\System\MQEdPmG.exe
  2⤵
  PID:3104
- C:\Windows\System\lUJFpsb.exe
  C:\Windows\System\lUJFpsb.exe
  2⤵
  PID:1524
- C:\Windows\System\xaszjgh.exe
  C:\Windows\System\xaszjgh.exe
  2⤵
  PID:5144
- C:\Windows\System\ASljGEE.exe
  C:\Windows\System\ASljGEE.exe
  2⤵
  PID:5208
- C:\Windows\System\vAVkyLk.exe
  C:\Windows\System\vAVkyLk.exe
  2⤵
  PID:2532
- C:\Windows\System\sRsFtoH.exe
  C:\Windows\System\sRsFtoH.exe
  2⤵
  PID:2572
- C:\Windows\System\XDgROAH.exe
  C:\Windows\System\XDgROAH.exe
  2⤵
  PID:4444
- C:\Windows\System\gNmLOKg.exe
  C:\Windows\System\gNmLOKg.exe
  2⤵
  PID:3840
- C:\Windows\System\OqjUSCh.exe
  C:\Windows\System\OqjUSCh.exe
  2⤵
  PID:5164
- C:\Windows\System\ROPeEkK.exe
  C:\Windows\System\ROPeEkK.exe
  2⤵
  PID:2376
- C:\Windows\System\UHFEjVY.exe
  C:\Windows\System\UHFEjVY.exe
  2⤵
  PID:4944
- C:\Windows\System\NtoADAY.exe
  C:\Windows\System\NtoADAY.exe
  2⤵
  PID:1296
- C:\Windows\System\XJJSYdt.exe
  C:\Windows\System\XJJSYdt.exe
  2⤵
  PID:4900
- C:\Windows\System\BAhpERA.exe
  C:\Windows\System\BAhpERA.exe
  2⤵
  PID:1604
- C:\Windows\System\eNSRsxX.exe
  C:\Windows\System\eNSRsxX.exe
  2⤵
  PID:5232
- C:\Windows\System\mYTGUaA.exe
  C:\Windows\System\mYTGUaA.exe
  2⤵
  PID:3784
- C:\Windows\System\YsbubXt.exe
  C:\Windows\System\YsbubXt.exe
  2⤵
  PID:5292
- C:\Windows\System\AAaPeKk.exe
  C:\Windows\System\AAaPeKk.exe
  2⤵
  PID:5904
- C:\Windows\System\fMYUnqW.exe
  C:\Windows\System\fMYUnqW.exe
  2⤵
  PID:5952
- C:\Windows\System\NVdNtSg.exe
  C:\Windows\System\NVdNtSg.exe
  2⤵
  PID:5096
- C:\Windows\System\uFtkFxm.exe
  C:\Windows\System\uFtkFxm.exe
  2⤵
  PID:6048
- C:\Windows\System\HGffyha.exe
  C:\Windows\System\HGffyha.exe
  2⤵
  PID:6100
- C:\Windows\System\KDRftTa.exe
  C:\Windows\System\KDRftTa.exe
  2⤵
  PID:408
- C:\Windows\System\wxWpGIA.exe
  C:\Windows\System\wxWpGIA.exe
  2⤵
  PID:5076
- C:\Windows\System\DFQzgKK.exe
  C:\Windows\System\DFQzgKK.exe
  2⤵
  PID:4692
- C:\Windows\System\tZdGnpG.exe
  C:\Windows\System\tZdGnpG.exe
  2⤵
  PID:6160
- C:\Windows\System\xsjdBoU.exe
  C:\Windows\System\xsjdBoU.exe
  2⤵
  PID:6184
- C:\Windows\System\IyqyqWU.exe
  C:\Windows\System\IyqyqWU.exe
  2⤵
  PID:6600
- C:\Windows\System\KhNLemW.exe
  C:\Windows\System\KhNLemW.exe
  2⤵
  PID:6616
- C:\Windows\System\FEbtDjs.exe
  C:\Windows\System\FEbtDjs.exe
  2⤵
  PID:6632
- C:\Windows\System\NYyjvjW.exe
  C:\Windows\System\NYyjvjW.exe
  2⤵
  PID:6648
- C:\Windows\System\JzbQkbN.exe
  C:\Windows\System\JzbQkbN.exe
  2⤵
  PID:6664
- C:\Windows\System\WDDwwXk.exe
  C:\Windows\System\WDDwwXk.exe
  2⤵
  PID:6680
- C:\Windows\System\rsaOUFh.exe
  C:\Windows\System\rsaOUFh.exe
  2⤵
  PID:6696
- C:\Windows\System\ABZEuKy.exe
  C:\Windows\System\ABZEuKy.exe
  2⤵
  PID:6712
- C:\Windows\System\UlsltXa.exe
  C:\Windows\System\UlsltXa.exe
  2⤵
  PID:6728
- C:\Windows\System\ZAOYBIH.exe
  C:\Windows\System\ZAOYBIH.exe
  2⤵
  PID:6744
- C:\Windows\System\hQhlOFC.exe
  C:\Windows\System\hQhlOFC.exe
  2⤵
  PID:6760
- C:\Windows\System\pkdWCzg.exe
  C:\Windows\System\pkdWCzg.exe
  2⤵
  PID:6780
- C:\Windows\System\cjsceXr.exe
  C:\Windows\System\cjsceXr.exe
  2⤵
  PID:6796
- C:\Windows\System\oPqBQKT.exe
  C:\Windows\System\oPqBQKT.exe
  2⤵
  PID:6820
- C:\Windows\System\tJkQpvK.exe
  C:\Windows\System\tJkQpvK.exe
  2⤵
  PID:6844
- C:\Windows\System\okjyRzX.exe
  C:\Windows\System\okjyRzX.exe
  2⤵
  PID:6864
- C:\Windows\System\kNqNgQt.exe
  C:\Windows\System\kNqNgQt.exe
  2⤵
  PID:6884
- C:\Windows\System\XZqqTmj.exe
  C:\Windows\System\XZqqTmj.exe
  2⤵
  PID:6904
- C:\Windows\System\KniYzqq.exe
  C:\Windows\System\KniYzqq.exe
  2⤵
  PID:6924
- C:\Windows\System\RVXAYnx.exe
  C:\Windows\System\RVXAYnx.exe
  2⤵
  PID:6948
- C:\Windows\System\rZLHvQf.exe
  C:\Windows\System\rZLHvQf.exe
  2⤵
  PID:6964
- C:\Windows\System\lGopwLs.exe
  C:\Windows\System\lGopwLs.exe
  2⤵
  PID:6988
- C:\Windows\System\hqBqUgY.exe
  C:\Windows\System\hqBqUgY.exe
  2⤵
  PID:7012
- C:\Windows\System\LjvZUcN.exe
  C:\Windows\System\LjvZUcN.exe
  2⤵
  PID:7032
- C:\Windows\System\FqXOgzf.exe
  C:\Windows\System\FqXOgzf.exe
  2⤵
  PID:7052
- C:\Windows\System\kRzVQCg.exe
  C:\Windows\System\kRzVQCg.exe
  2⤵
  PID:7072
- C:\Windows\System\qIMVxEn.exe
  C:\Windows\System\qIMVxEn.exe
  2⤵
  PID:7112
- C:\Windows\System\FsXsClf.exe
  C:\Windows\System\FsXsClf.exe
  2⤵
  PID:7164
- C:\Windows\System\rZIbdbW.exe
  C:\Windows\System\rZIbdbW.exe
  2⤵
  PID:5364
- C:\Windows\System\LqEorBk.exe
  C:\Windows\System\LqEorBk.exe
  2⤵
  PID:5416
- C:\Windows\System\udfKlJB.exe
  C:\Windows\System\udfKlJB.exe
  2⤵
  PID:5468
- C:\Windows\System\sEGVita.exe
  C:\Windows\System\sEGVita.exe
  2⤵
  PID:5532
- C:\Windows\System\PXfRACz.exe
  C:\Windows\System\PXfRACz.exe
  2⤵
  PID:5572
- C:\Windows\System\KpgKxlc.exe
  C:\Windows\System\KpgKxlc.exe
  2⤵
  PID:5620
- C:\Windows\System\jjQDroz.exe
  C:\Windows\System\jjQDroz.exe
  2⤵
  PID:2428
- C:\Windows\System\lFbcxNS.exe
  C:\Windows\System\lFbcxNS.exe
  2⤵
  PID:3932
- C:\Windows\System\sXuiZQS.exe
  C:\Windows\System\sXuiZQS.exe
  2⤵
  PID:5684
- C:\Windows\System\EUYAxDF.exe
  C:\Windows\System\EUYAxDF.exe
  2⤵
  PID:3228
- C:\Windows\System\HDTGmXk.exe
  C:\Windows\System\HDTGmXk.exe
  2⤵
  PID:5740
- C:\Windows\System\cYtTTrl.exe
  C:\Windows\System\cYtTTrl.exe
  2⤵
  PID:5836
- C:\Windows\System\dYSuhlX.exe
  C:\Windows\System\dYSuhlX.exe
  2⤵
  PID:5888
- C:\Windows\System\MSaGtnZ.exe
  C:\Windows\System\MSaGtnZ.exe
  2⤵
  PID:6020
- C:\Windows\System\EBgrZJP.exe
  C:\Windows\System\EBgrZJP.exe
  2⤵
  PID:2184
- C:\Windows\System\dnAXksf.exe
  C:\Windows\System\dnAXksf.exe
  2⤵
  PID:2436
- C:\Windows\System\rKwlRdN.exe
  C:\Windows\System\rKwlRdN.exe
  2⤵
  PID:4092
- C:\Windows\System\DVjQalN.exe
  C:\Windows\System\DVjQalN.exe
  2⤵
  PID:3948
- C:\Windows\System\lVFeIam.exe
  C:\Windows\System\lVFeIam.exe
  2⤵
  PID:5192
- C:\Windows\System\kfSVguL.exe
  C:\Windows\System\kfSVguL.exe
  2⤵
  PID:2052
- C:\Windows\System\fngGHdn.exe
  C:\Windows\System\fngGHdn.exe
  2⤵
  PID:5280
- C:\Windows\System\tycBEBl.exe
  C:\Windows\System\tycBEBl.exe
  2⤵
  PID:6140
- C:\Windows\System\hlJIAyF.exe
  C:\Windows\System\hlJIAyF.exe
  2⤵
  PID:6128
- C:\Windows\System\sysHiFT.exe
  C:\Windows\System\sysHiFT.exe
  2⤵
  PID:2168
- C:\Windows\System\EWJJLcS.exe
  C:\Windows\System\EWJJLcS.exe
  2⤵
  PID:6256
- C:\Windows\System\bpifyiU.exe
  C:\Windows\System\bpifyiU.exe
  2⤵
  PID:1956
- C:\Windows\System\PJHzPcX.exe
  C:\Windows\System\PJHzPcX.exe
  2⤵
  PID:4060
- C:\Windows\System\rYYNsKb.exe
  C:\Windows\System\rYYNsKb.exe
  2⤵
  PID:5560
- C:\Windows\System\btKAZQf.exe
  C:\Windows\System\btKAZQf.exe
  2⤵
  PID:6504
- C:\Windows\System\EeLlKPk.exe
  C:\Windows\System\EeLlKPk.exe
  2⤵
  PID:6536
- C:\Windows\System\VGoTsNP.exe
  C:\Windows\System\VGoTsNP.exe
  2⤵
  PID:5168
- C:\Windows\System\NFRdwTz.exe
  C:\Windows\System\NFRdwTz.exe
  2⤵
  PID:6404
- C:\Windows\System\bVAXKcp.exe
  C:\Windows\System\bVAXKcp.exe
  2⤵
  PID:6436
- C:\Windows\System\hWQDtxs.exe
  C:\Windows\System\hWQDtxs.exe
  2⤵
  PID:2944
- C:\Windows\System\eBWUCCC.exe
  C:\Windows\System\eBWUCCC.exe
  2⤵
  PID:3308
- C:\Windows\System\Uuvtiqy.exe
  C:\Windows\System\Uuvtiqy.exe
  2⤵
  PID:6628
- C:\Windows\System\onTltAh.exe
  C:\Windows\System\onTltAh.exe
  2⤵
  PID:6676
- C:\Windows\System\KXlVtts.exe
  C:\Windows\System\KXlVtts.exe
  2⤵
  PID:6720
- C:\Windows\System\BEHusBt.exe
  C:\Windows\System\BEHusBt.exe
  2⤵
  PID:6756
- C:\Windows\System\HCjkqeZ.exe
  C:\Windows\System\HCjkqeZ.exe
  2⤵
  PID:6812
- C:\Windows\System\BwyUlUs.exe
  C:\Windows\System\BwyUlUs.exe
  2⤵
  PID:6856
- C:\Windows\System\EiHFpwc.exe
  C:\Windows\System\EiHFpwc.exe
  2⤵
  PID:6880
- C:\Windows\System\pwxndZS.exe
  C:\Windows\System\pwxndZS.exe
  2⤵
  PID:6920
- C:\Windows\System\SWfBKCx.exe
  C:\Windows\System\SWfBKCx.exe
  2⤵
  PID:6960
- C:\Windows\System\FQfBoCX.exe
  C:\Windows\System\FQfBoCX.exe
  2⤵
  PID:7000
- C:\Windows\System\javtBPQ.exe
  C:\Windows\System\javtBPQ.exe
  2⤵
  PID:7064
- C:\Windows\System\WDNBHsK.exe
  C:\Windows\System\WDNBHsK.exe
  2⤵
  PID:7100
- C:\Windows\System\TdoxVNf.exe
  C:\Windows\System\TdoxVNf.exe
  2⤵
  PID:5324
- C:\Windows\System\BIbVpjy.exe
  C:\Windows\System\BIbVpjy.exe
  2⤵
  PID:5520
- C:\Windows\System\CzYaRzT.exe
  C:\Windows\System\CzYaRzT.exe
  2⤵
  PID:5664
- C:\Windows\System\TaaXsdn.exe
  C:\Windows\System\TaaXsdn.exe
  2⤵
  PID:7172
- C:\Windows\System\IxgcMeC.exe
  C:\Windows\System\IxgcMeC.exe
  2⤵
  PID:7196
- C:\Windows\System\UCmXTJy.exe
  C:\Windows\System\UCmXTJy.exe
  2⤵
  PID:7216
- C:\Windows\System\EeiNrKt.exe
  C:\Windows\System\EeiNrKt.exe
  2⤵
  PID:7236
- C:\Windows\System\NnMjTrx.exe
  C:\Windows\System\NnMjTrx.exe
  2⤵
  PID:7256
- C:\Windows\System\AgNpdbF.exe
  C:\Windows\System\AgNpdbF.exe
  2⤵
  PID:7276
- C:\Windows\System\eokvgKB.exe
  C:\Windows\System\eokvgKB.exe
  2⤵
  PID:7300
- C:\Windows\System\OdERtmY.exe
  C:\Windows\System\OdERtmY.exe
  2⤵
  PID:7316
- C:\Windows\System\wLNrvcV.exe
  C:\Windows\System\wLNrvcV.exe
  2⤵
  PID:7340
- C:\Windows\System\SzRqYoc.exe
  C:\Windows\System\SzRqYoc.exe
  2⤵
  PID:7364
- C:\Windows\System\vyWeJVh.exe
  C:\Windows\System\vyWeJVh.exe
  2⤵
  PID:7388
- C:\Windows\System\PYZzeXq.exe
  C:\Windows\System\PYZzeXq.exe
  2⤵
  PID:7404
- C:\Windows\System\wehDAWg.exe
  C:\Windows\System\wehDAWg.exe
  2⤵
  PID:7428
- C:\Windows\System\pSOjvLH.exe
  C:\Windows\System\pSOjvLH.exe
  2⤵
  PID:7456
- C:\Windows\System\pBYZVAJ.exe
  C:\Windows\System\pBYZVAJ.exe
  2⤵
  PID:7472
- C:\Windows\System\JHKpChF.exe
  C:\Windows\System\JHKpChF.exe
  2⤵
  PID:7496
- C:\Windows\System\MnUoPte.exe
  C:\Windows\System\MnUoPte.exe
  2⤵
  PID:7520
- C:\Windows\System\IkBcxJo.exe
  C:\Windows\System\IkBcxJo.exe
  2⤵
  PID:7540
- C:\Windows\System\ZWEXdsF.exe
  C:\Windows\System\ZWEXdsF.exe
  2⤵
  PID:7564
- C:\Windows\System\SrtUYsU.exe
  C:\Windows\System\SrtUYsU.exe
  2⤵
  PID:7580
- C:\Windows\System\ySRMMqD.exe
  C:\Windows\System\ySRMMqD.exe
  2⤵
  PID:7604
- C:\Windows\System\dBcYGgS.exe
  C:\Windows\System\dBcYGgS.exe
  2⤵
  PID:7628
- C:\Windows\System\ceYBQkp.exe
  C:\Windows\System\ceYBQkp.exe
  2⤵
  PID:7644
- C:\Windows\System\nSxolTH.exe
  C:\Windows\System\nSxolTH.exe
  2⤵
  PID:7668
- C:\Windows\System\AjFVQZt.exe
  C:\Windows\System\AjFVQZt.exe
  2⤵
  PID:7688
- C:\Windows\System\NwRELrq.exe
  C:\Windows\System\NwRELrq.exe
  2⤵
  PID:7708
- C:\Windows\System\JnLeBuQ.exe
  C:\Windows\System\JnLeBuQ.exe
  2⤵
  PID:7728
- C:\Windows\System\aejRXFa.exe
  C:\Windows\System\aejRXFa.exe
  2⤵
  PID:7752
- C:\Windows\System\CVAWwPf.exe
  C:\Windows\System\CVAWwPf.exe
  2⤵
  PID:7768
- C:\Windows\System\TlNsYEO.exe
  C:\Windows\System\TlNsYEO.exe
  2⤵
  PID:7900
- C:\Windows\System\XzhuQpO.exe
  C:\Windows\System\XzhuQpO.exe
  2⤵
  PID:7920
- C:\Windows\System\UFnPonV.exe
  C:\Windows\System\UFnPonV.exe
  2⤵
  PID:7936
- C:\Windows\System\WtDIZAx.exe
  C:\Windows\System\WtDIZAx.exe
  2⤵
  PID:7956
- C:\Windows\System\xKOpBsO.exe
  C:\Windows\System\xKOpBsO.exe
  2⤵
  PID:7972
- C:\Windows\System\hyMvthy.exe
  C:\Windows\System\hyMvthy.exe
  2⤵
  PID:7988
- C:\Windows\System\FeVIgRW.exe
  C:\Windows\System\FeVIgRW.exe
  2⤵
  PID:8004
- C:\Windows\System\WVcUcLT.exe
  C:\Windows\System\WVcUcLT.exe
  2⤵
  PID:8024
- C:\Windows\System\SMiDSlN.exe
  C:\Windows\System\SMiDSlN.exe
  2⤵
  PID:8044
- C:\Windows\System\IaaXCoF.exe
  C:\Windows\System\IaaXCoF.exe
  2⤵
  PID:8068
- C:\Windows\System\mryeOlF.exe
  C:\Windows\System\mryeOlF.exe
  2⤵
  PID:8088
- C:\Windows\System\xqFaHuI.exe
  C:\Windows\System\xqFaHuI.exe
  2⤵
  PID:8112
- C:\Windows\System\UzQTZHM.exe
  C:\Windows\System\UzQTZHM.exe
  2⤵
  PID:8132
- C:\Windows\System\sFMsLEt.exe
  C:\Windows\System\sFMsLEt.exe
  2⤵
  PID:8156
- C:\Windows\System\UmIhaLG.exe
  C:\Windows\System\UmIhaLG.exe
  2⤵
  PID:8184
- C:\Windows\System\EhoMhRU.exe
  C:\Windows\System\EhoMhRU.exe
  2⤵
  PID:4172
- C:\Windows\System\MIKtCeO.exe
  C:\Windows\System\MIKtCeO.exe
  2⤵
  PID:5228
- C:\Windows\System\QYguuGm.exe
  C:\Windows\System\QYguuGm.exe
  2⤵
  PID:6036
- C:\Windows\System\vrJVUnw.exe
  C:\Windows\System\vrJVUnw.exe
  2⤵
  PID:6232
- C:\Windows\System\eBPBMOR.exe
  C:\Windows\System\eBPBMOR.exe
  2⤵
  PID:5396
- C:\Windows\System\drpJvQZ.exe
  C:\Windows\System\drpJvQZ.exe
  2⤵
  PID:7224
- C:\Windows\System\goIWFFJ.exe
  C:\Windows\System\goIWFFJ.exe
  2⤵
  PID:7332
- C:\Windows\System\swgrPQP.exe
  C:\Windows\System\swgrPQP.exe
  2⤵
  PID:7440
- C:\Windows\System\rOSmUzn.exe
  C:\Windows\System\rOSmUzn.exe
  2⤵
  PID:7508
- C:\Windows\System\BcgPKlH.exe
  C:\Windows\System\BcgPKlH.exe
  2⤵
  PID:8196
- C:\Windows\System\GkjNKWs.exe
  C:\Windows\System\GkjNKWs.exe
  2⤵
  PID:8220
- C:\Windows\System\tGBxMvL.exe
  C:\Windows\System\tGBxMvL.exe
  2⤵
  PID:8248
- C:\Windows\System\qtZDYhC.exe
  C:\Windows\System\qtZDYhC.exe
  2⤵
  PID:8264
- C:\Windows\System\CmoFKPd.exe
  C:\Windows\System\CmoFKPd.exe
  2⤵
  PID:8288
- C:\Windows\System\lPGntYE.exe
  C:\Windows\System\lPGntYE.exe
  2⤵
  PID:8312
- C:\Windows\System\OIapNjJ.exe
  C:\Windows\System\OIapNjJ.exe
  2⤵
  PID:8340
- C:\Windows\System\AgwlgNK.exe
  C:\Windows\System\AgwlgNK.exe
  2⤵
  PID:8356
- C:\Windows\System\pvnLizx.exe
  C:\Windows\System\pvnLizx.exe
  2⤵
  PID:8372
- C:\Windows\System\cAivnsp.exe
  C:\Windows\System\cAivnsp.exe
  2⤵
  PID:8388
- C:\Windows\System\SkCCwqK.exe
  C:\Windows\System\SkCCwqK.exe
  2⤵
  PID:8404
- C:\Windows\System\tNAYoGU.exe
  C:\Windows\System\tNAYoGU.exe
  2⤵
  PID:8476
- C:\Windows\System\jGHLivK.exe
  C:\Windows\System\jGHLivK.exe
  2⤵
  PID:8496
- C:\Windows\System\vwCCTsW.exe
  C:\Windows\System\vwCCTsW.exe
  2⤵
  PID:8520
- C:\Windows\System\fJZtmrM.exe
  C:\Windows\System\fJZtmrM.exe
  2⤵
  PID:8544
- C:\Windows\System\RSQXfdZ.exe
  C:\Windows\System\RSQXfdZ.exe
  2⤵
  PID:8572
- C:\Windows\System\UNMJMfZ.exe
  C:\Windows\System\UNMJMfZ.exe
  2⤵
  PID:8600
- C:\Windows\System\HnkQdsN.exe
  C:\Windows\System\HnkQdsN.exe
  2⤵
  PID:8616
- C:\Windows\System\XtVPwcb.exe
  C:\Windows\System\XtVPwcb.exe
  2⤵
  PID:8640
- C:\Windows\System\ulBffzq.exe
  C:\Windows\System\ulBffzq.exe
  2⤵
  PID:7536
- C:\Windows\System\KGRARqc.exe
  C:\Windows\System\KGRARqc.exe
  2⤵
  PID:1432
- C:\Windows\System\wjeXrHK.exe
  C:\Windows\System\wjeXrHK.exe
  2⤵
  PID:6472
- C:\Windows\System\DlVOkSh.exe
  C:\Windows\System\DlVOkSh.exe
  2⤵
  PID:1008
- C:\Windows\System\oTgWvtl.exe
  C:\Windows\System\oTgWvtl.exe
  2⤵
  PID:6660
- C:\Windows\System\XtKpxcZ.exe
  C:\Windows\System\XtKpxcZ.exe
  2⤵
  PID:6752
- C:\Windows\System\gYyARGQ.exe
  C:\Windows\System\gYyARGQ.exe
  2⤵
  PID:6836
- C:\Windows\System\XWRBSRA.exe
  C:\Windows\System\XWRBSRA.exe
  2⤵
  PID:6944
- C:\Windows\System\yqxPUhu.exe
  C:\Windows\System\yqxPUhu.exe
  2⤵
  PID:7024
- C:\Windows\System\ZCHavCb.exe
  C:\Windows\System\ZCHavCb.exe
  2⤵
  PID:7156
- C:\Windows\System\umaXAcD.exe
  C:\Windows\System\umaXAcD.exe
  2⤵
  PID:1504
- C:\Windows\System\rLWCvQt.exe
  C:\Windows\System\rLWCvQt.exe
  2⤵
  PID:7292
- C:\Windows\System\LIZNZJP.exe
  C:\Windows\System\LIZNZJP.exe
  2⤵
  PID:7352
- C:\Windows\System\wfGOlaG.exe
  C:\Windows\System\wfGOlaG.exe
  2⤵
  PID:7464
- C:\Windows\System\CoUHfIq.exe
  C:\Windows\System\CoUHfIq.exe
  2⤵
  PID:8588
- C:\Windows\System\qNrLPSX.exe
  C:\Windows\System\qNrLPSX.exe
  2⤵
  PID:8648
- C:\Windows\System\RdDykeA.exe
  C:\Windows\System\RdDykeA.exe
  2⤵
  PID:7664
- C:\Windows\System\IsjhOsE.exe
  C:\Windows\System\IsjhOsE.exe
  2⤵
  PID:7636
- C:\Windows\System\VIdhOBz.exe
  C:\Windows\System\VIdhOBz.exe
  2⤵
  PID:7764
- C:\Windows\System\myiXdbs.exe
  C:\Windows\System\myiXdbs.exe
  2⤵
  PID:8832
- C:\Windows\System\BACoHCP.exe
  C:\Windows\System\BACoHCP.exe
  2⤵
  PID:8164
- C:\Windows\System\ZDnGqeD.exe
  C:\Windows\System\ZDnGqeD.exe
  2⤵
  PID:8124
- C:\Windows\System\oetjqbr.exe
  C:\Windows\System\oetjqbr.exe
  2⤵
  PID:8080
- C:\Windows\System\RPkDXoz.exe
  C:\Windows\System\RPkDXoz.exe
  2⤵
  PID:8032
- C:\Windows\System\FqyccAz.exe
  C:\Windows\System\FqyccAz.exe
  2⤵
  PID:7996
- C:\Windows\System\sxklxDS.exe
  C:\Windows\System\sxklxDS.exe
  2⤵
  PID:7916
- C:\Windows\System\CDtBwMa.exe
  C:\Windows\System\CDtBwMa.exe
  2⤵
  PID:7884
- C:\Windows\System\GRFkbWT.exe
  C:\Windows\System\GRFkbWT.exe
  2⤵
  PID:8492
- C:\Windows\System\OoSkTeh.exe
  C:\Windows\System\OoSkTeh.exe
  2⤵
  PID:8536
- C:\Windows\System\TwReLAe.exe
  C:\Windows\System\TwReLAe.exe
  2⤵
  PID:7412
- C:\Windows\System\SmJCMdE.exe
  C:\Windows\System\SmJCMdE.exe
  2⤵
  PID:8260
- C:\Windows\System\BybfoLJ.exe
  C:\Windows\System\BybfoLJ.exe
  2⤵
  PID:8384
- C:\Windows\System\ztMWQTM.exe
  C:\Windows\System\ztMWQTM.exe
  2⤵
  PID:8256
- C:\Windows\System\PGytJme.exe
  C:\Windows\System\PGytJme.exe
  2⤵
  PID:8804
- C:\Windows\System\hnKqabN.exe
  C:\Windows\System\hnKqabN.exe
  2⤵
  PID:4612
- C:\Windows\System\pVTuxYt.exe
  C:\Windows\System\pVTuxYt.exe
  2⤵
  PID:9228
- C:\Windows\System\ksDYqPy.exe
  C:\Windows\System\ksDYqPy.exe
  2⤵
  PID:9244
- C:\Windows\System\OkIjBpk.exe
  C:\Windows\System\OkIjBpk.exe
  2⤵
  PID:9272
- C:\Windows\System\yvAYdhE.exe
  C:\Windows\System\yvAYdhE.exe
  2⤵
  PID:9380
- C:\Windows\System\VSaVVgO.exe
  C:\Windows\System\VSaVVgO.exe
  2⤵
  PID:9396
- C:\Windows\System\ObKDHdm.exe
  C:\Windows\System\ObKDHdm.exe
  2⤵
  PID:9412
- C:\Windows\System\Mvamvbg.exe
  C:\Windows\System\Mvamvbg.exe
  2⤵
  PID:9428
- C:\Windows\System\zPyduhL.exe
  C:\Windows\System\zPyduhL.exe
  2⤵
  PID:9584
- C:\Windows\System\YAWlepi.exe
  C:\Windows\System\YAWlepi.exe
  2⤵
  PID:9604
- C:\Windows\System\fczvJLG.exe
  C:\Windows\System\fczvJLG.exe
  2⤵
  PID:9628
- C:\Windows\System\WQaMoGz.exe
  C:\Windows\System\WQaMoGz.exe
  2⤵
  PID:9648
- C:\Windows\System\BYnFiWl.exe
  C:\Windows\System\BYnFiWl.exe
  2⤵
  PID:9664
- C:\Windows\System\aLLHsCF.exe
  C:\Windows\System\aLLHsCF.exe
  2⤵
  PID:9680
- C:\Windows\System\zLuhpIk.exe
  C:\Windows\System\zLuhpIk.exe
  2⤵
  PID:9700
- C:\Windows\System\Thnmxsp.exe
  C:\Windows\System\Thnmxsp.exe
  2⤵
  PID:9716
- C:\Windows\System\ZkXLoJj.exe
  C:\Windows\System\ZkXLoJj.exe
  2⤵
  PID:9732
- C:\Windows\System\vxlyFAP.exe
  C:\Windows\System\vxlyFAP.exe
  2⤵
  PID:9748
- C:\Windows\System\kQlCBLT.exe
  C:\Windows\System\kQlCBLT.exe
  2⤵
  PID:9776
- C:\Windows\System\CyzWYDW.exe
  C:\Windows\System\CyzWYDW.exe
  2⤵
  PID:9800
- C:\Windows\System\YjTolqd.exe
  C:\Windows\System\YjTolqd.exe
  2⤵
  PID:9824
- C:\Windows\System\baaIERj.exe
  C:\Windows\System\baaIERj.exe
  2⤵
  PID:9844
- C:\Windows\System\TBczxij.exe
  C:\Windows\System\TBczxij.exe
  2⤵
  PID:9868
- C:\Windows\System\qWFREAb.exe
  C:\Windows\System\qWFREAb.exe
  2⤵
  PID:9892
- C:\Windows\System\eXPQVHQ.exe
  C:\Windows\System\eXPQVHQ.exe
  2⤵
  PID:9916
- C:\Windows\System\bASwBJz.exe
  C:\Windows\System\bASwBJz.exe
  2⤵
  PID:9932
- C:\Windows\System\PZfbGVO.exe
  C:\Windows\System\PZfbGVO.exe
  2⤵
  PID:9956
- C:\Windows\System\LHfzQND.exe
  C:\Windows\System\LHfzQND.exe
  2⤵
  PID:9976
- C:\Windows\System\BMethAc.exe
  C:\Windows\System\BMethAc.exe
  2⤵
  PID:10000
- C:\Windows\System\Qjujhhw.exe
  C:\Windows\System\Qjujhhw.exe
  2⤵
  PID:10024
- C:\Windows\System\IQqElOV.exe
  C:\Windows\System\IQqElOV.exe
  2⤵
  PID:10176
- C:\Windows\System\ckcCZWo.exe
  C:\Windows\System\ckcCZWo.exe
  2⤵
  PID:10208
- C:\Windows\System\NRqvHIW.exe
  C:\Windows\System\NRqvHIW.exe
  2⤵
  PID:10232
- C:\Windows\System\KeopVJI.exe
  C:\Windows\System\KeopVJI.exe
  2⤵
  PID:8680
- C:\Windows\System\RwaMShr.exe
  C:\Windows\System\RwaMShr.exe
  2⤵
  PID:1476
- C:\Windows\System\iaqopAW.exe
  C:\Windows\System\iaqopAW.exe
  2⤵
  PID:8760
- C:\Windows\System\FCyWgKw.exe
  C:\Windows\System\FCyWgKw.exe
  2⤵
  PID:9136
- C:\Windows\System\IdEmrLq.exe
  C:\Windows\System\IdEmrLq.exe
  2⤵
  PID:8916
- C:\Windows\System\gusBWvB.exe
  C:\Windows\System\gusBWvB.exe
  2⤵
  PID:8608
- C:\Windows\System\EofhNIb.exe
  C:\Windows\System\EofhNIb.exe
  2⤵
  PID:8488
- C:\Windows\System\fQUZkAy.exe
  C:\Windows\System\fQUZkAy.exe
  2⤵
  PID:8348
- C:\Windows\System\ZmZpdmf.exe
  C:\Windows\System\ZmZpdmf.exe
  2⤵
  PID:9060
- C:\Windows\System\ZGkiZyA.exe
  C:\Windows\System\ZGkiZyA.exe
  2⤵
  PID:9204
- C:\Windows\System\XpFrGwH.exe
  C:\Windows\System\XpFrGwH.exe
  2⤵
  PID:7396
- C:\Windows\System\qlYeFGP.exe
  C:\Windows\System\qlYeFGP.exe
  2⤵
  PID:7596
- C:\Windows\System\Nklkuka.exe
  C:\Windows\System\Nklkuka.exe
  2⤵
  PID:6428
- C:\Windows\System\ivKRNqi.exe
  C:\Windows\System\ivKRNqi.exe
  2⤵
  PID:6708
- C:\Windows\System\gjIdpLb.exe
  C:\Windows\System\gjIdpLb.exe
  2⤵
  PID:6916
- C:\Windows\System\JlDHRgy.exe
  C:\Windows\System\JlDHRgy.exe
  2⤵
  PID:7152
- C:\Windows\System\QovyyvG.exe
  C:\Windows\System\QovyyvG.exe
  2⤵
  PID:7324
- C:\Windows\System\iCafOvJ.exe
  C:\Windows\System\iCafOvJ.exe
  2⤵
  PID:7468
- C:\Windows\System\CzBTBgT.exe
  C:\Windows\System\CzBTBgT.exe
  2⤵
  PID:7612
- C:\Windows\System\MNTlsWC.exe
  C:\Windows\System\MNTlsWC.exe
  2⤵
  PID:7680
- C:\Windows\System\VlmaoVL.exe
  C:\Windows\System\VlmaoVL.exe
  2⤵
  PID:8172
- C:\Windows\System\ZJhCEHX.exe
  C:\Windows\System\ZJhCEHX.exe
  2⤵
  PID:8240
- C:\Windows\System\heBapvz.exe
  C:\Windows\System\heBapvz.exe
  2⤵
  PID:8332
- C:\Windows\System\fdaiwKe.exe
  C:\Windows\System\fdaiwKe.exe
  2⤵
  PID:8812
- C:\Windows\System\lHoPuZw.exe
  C:\Windows\System\lHoPuZw.exe
  2⤵
  PID:6192
- C:\Windows\System\KuqwWSQ.exe
  C:\Windows\System\KuqwWSQ.exe
  2⤵
  PID:9252
- C:\Windows\System\YcFDjKF.exe
  C:\Windows\System\YcFDjKF.exe
  2⤵
  PID:9600
- C:\Windows\System\JBXViDU.exe
  C:\Windows\System\JBXViDU.exe
  2⤵
  PID:9644
- C:\Windows\System\gyQTvET.exe
  C:\Windows\System\gyQTvET.exe
  2⤵
  PID:9708
- C:\Windows\System\pUzNvfG.exe
  C:\Windows\System\pUzNvfG.exe
  2⤵
  PID:9796
- C:\Windows\System\Aganpdh.exe
  C:\Windows\System\Aganpdh.exe
  2⤵
  PID:9884
- C:\Windows\System\KlYbiig.exe
  C:\Windows\System\KlYbiig.exe
  2⤵
  PID:9984
- C:\Windows\System\MICfsup.exe
  C:\Windows\System\MICfsup.exe
  2⤵
  PID:10032
- C:\Windows\System\TuoZXdt.exe
  C:\Windows\System\TuoZXdt.exe
  2⤵
  PID:9392
- C:\Windows\System\RdDnxHQ.exe
  C:\Windows\System\RdDnxHQ.exe
  2⤵
  PID:10016
- C:\Windows\System\pUmnUxe.exe
  C:\Windows\System\pUmnUxe.exe
  2⤵
  PID:2520
- C:\Windows\System\SOwzYsj.exe
  C:\Windows\System\SOwzYsj.exe
  2⤵
  PID:9760
- C:\Windows\System\lZYosHq.exe
  C:\Windows\System\lZYosHq.exe
  2⤵
  PID:9840
- C:\Windows\System\oOmmOEY.exe
  C:\Windows\System\oOmmOEY.exe
  2⤵
  PID:9924
- C:\Windows\System\uvYyZkQ.exe
  C:\Windows\System\uvYyZkQ.exe
  2⤵
  PID:4860
- C:\Windows\System\Gnqgobe.exe
  C:\Windows\System\Gnqgobe.exe
  2⤵
  PID:10252
- C:\Windows\System\olfYkkx.exe
  C:\Windows\System\olfYkkx.exe
  2⤵
  PID:10272
- C:\Windows\System\vJRbPvG.exe
  C:\Windows\System\vJRbPvG.exe
  2⤵
  PID:10296
- C:\Windows\System\SWieOiO.exe
  C:\Windows\System\SWieOiO.exe
  2⤵
  PID:10320
- C:\Windows\System\iRtuqcN.exe
  C:\Windows\System\iRtuqcN.exe
  2⤵
  PID:10340
- C:\Windows\System\feEpLex.exe
  C:\Windows\System\feEpLex.exe
  2⤵
  PID:10400
- C:\Windows\System\aomnsPS.exe
  C:\Windows\System\aomnsPS.exe
  2⤵
  PID:10424
- C:\Windows\System\RKnxIiA.exe
  C:\Windows\System\RKnxIiA.exe
  2⤵
  PID:10444
- C:\Windows\System\FyyXkzq.exe
  C:\Windows\System\FyyXkzq.exe
  2⤵
  PID:10472
- C:\Windows\System\CsVamek.exe
  C:\Windows\System\CsVamek.exe
  2⤵
  PID:10492
- C:\Windows\System\ryMAgOl.exe
  C:\Windows\System\ryMAgOl.exe
  2⤵
  PID:10516
- C:\Windows\System\OVaqTyi.exe
  C:\Windows\System\OVaqTyi.exe
  2⤵
  PID:10548
- C:\Windows\System\bhRfafn.exe
  C:\Windows\System\bhRfafn.exe
  2⤵
  PID:10572
- C:\Windows\System\cWPIEls.exe
  C:\Windows\System\cWPIEls.exe
  2⤵
  PID:10592
- C:\Windows\System\gJNsGDs.exe
  C:\Windows\System\gJNsGDs.exe
  2⤵
  PID:10608
- C:\Windows\System\prhDxxY.exe
  C:\Windows\System\prhDxxY.exe
  2⤵
  PID:10628
- C:\Windows\System\BqiUMIT.exe
  C:\Windows\System\BqiUMIT.exe
  2⤵
  PID:10644
- C:\Windows\System\XTpjtFA.exe
  C:\Windows\System\XTpjtFA.exe
  2⤵
  PID:10660
- C:\Windows\System\qbLHSTA.exe
  C:\Windows\System\qbLHSTA.exe
  2⤵
  PID:10676
- C:\Windows\System\FMYepUh.exe
  C:\Windows\System\FMYepUh.exe
  2⤵
  PID:10700
- C:\Windows\System\EtTCTCo.exe
  C:\Windows\System\EtTCTCo.exe
  2⤵
  PID:10728
- C:\Windows\System\JRMEZPD.exe
  C:\Windows\System\JRMEZPD.exe
  2⤵
  PID:10752
- C:\Windows\System\TpyMNWt.exe
  C:\Windows\System\TpyMNWt.exe
  2⤵
  PID:10784
- C:\Windows\System\dEnQcQY.exe
  C:\Windows\System\dEnQcQY.exe
  2⤵
  PID:10804
- C:\Windows\System\tKdzyas.exe
  C:\Windows\System\tKdzyas.exe
  2⤵
  PID:10828
- C:\Windows\System\AbenxnK.exe
  C:\Windows\System\AbenxnK.exe
  2⤵
  PID:10852
- C:\Windows\System\gPCtOoC.exe
  C:\Windows\System\gPCtOoC.exe
  2⤵
  PID:10880
- C:\Windows\System\XnutGmB.exe
  C:\Windows\System\XnutGmB.exe
  2⤵
  PID:10900
- C:\Windows\System\hNAhnpa.exe
  C:\Windows\System\hNAhnpa.exe
  2⤵
  PID:10924
- C:\Windows\System\xPjUJJG.exe
  C:\Windows\System\xPjUJJG.exe
  2⤵
  PID:10940
- C:\Windows\System\RVavifP.exe
  C:\Windows\System\RVavifP.exe
  2⤵
  PID:10964
- C:\Windows\System\wuPheuh.exe
  C:\Windows\System\wuPheuh.exe
  2⤵
  PID:10984
- C:\Windows\System\ylGTywJ.exe
  C:\Windows\System\ylGTywJ.exe
  2⤵
  PID:11008
- C:\Windows\System\JOdfEDB.exe
  C:\Windows\System\JOdfEDB.exe
  2⤵
  PID:11024
- C:\Windows\System\WYoZoAw.exe
  C:\Windows\System\WYoZoAw.exe
  2⤵
  PID:11044
- C:\Windows\System\stqJvBA.exe
  C:\Windows\System\stqJvBA.exe
  2⤵
  PID:11088
- C:\Windows\System\HVIPeBT.exe
  C:\Windows\System\HVIPeBT.exe
  2⤵
  PID:11136
- C:\Windows\System\aHSWcOS.exe
  C:\Windows\System\aHSWcOS.exe
  2⤵
  PID:11160
- C:\Windows\System\CRkWYaK.exe
  C:\Windows\System\CRkWYaK.exe
  2⤵
  PID:11188
- C:\Windows\System\MnnuyGH.exe
  C:\Windows\System\MnnuyGH.exe
  2⤵
  PID:11208
- C:\Windows\System\LCERLQN.exe
  C:\Windows\System\LCERLQN.exe
  2⤵
  PID:11224
- C:\Windows\System\EjSVoMX.exe
  C:\Windows\System\EjSVoMX.exe
  2⤵
  PID:11244
- C:\Windows\System\HYMeqht.exe
  C:\Windows\System\HYMeqht.exe
  2⤵
  PID:10120
- C:\Windows\System\tjomyqh.exe
  C:\Windows\System\tjomyqh.exe
  2⤵
  PID:10152
- C:\Windows\System\VdAHnAu.exe
  C:\Windows\System\VdAHnAu.exe
  2⤵
  PID:10196
- C:\Windows\System\UsuaOCa.exe
  C:\Windows\System\UsuaOCa.exe
  2⤵
  PID:8968
- C:\Windows\System\nHsrcBp.exe
  C:\Windows\System\nHsrcBp.exe
  2⤵
  PID:9264
- C:\Windows\System\YUYYnME.exe
  C:\Windows\System\YUYYnME.exe
  2⤵
  PID:9660
- C:\Windows\System\mxdHsJL.exe
  C:\Windows\System\mxdHsJL.exe
  2⤵
  PID:8512
- C:\Windows\System\FLFMxvw.exe
  C:\Windows\System\FLFMxvw.exe
  2⤵
  PID:7548
- C:\Windows\System\NSFGDvb.exe
  C:\Windows\System\NSFGDvb.exe
  2⤵
  PID:6876
- C:\Windows\System\yTgXgjR.exe
  C:\Windows\System\yTgXgjR.exe
  2⤵
  PID:7284
- C:\Windows\System\WnOMksl.exe
  C:\Windows\System\WnOMksl.exe
  2⤵
  PID:9572
- C:\Windows\System\CpnpPSv.exe
  C:\Windows\System\CpnpPSv.exe
  2⤵
  PID:9944
- C:\Windows\System\GQtJhek.exe
  C:\Windows\System\GQtJhek.exe
  2⤵
  PID:2544
- C:\Windows\System\CpkSpfm.exe
  C:\Windows\System\CpkSpfm.exe
  2⤵
  PID:2788
- C:\Windows\System\NdHLrRl.exe
  C:\Windows\System\NdHLrRl.exe
  2⤵
  PID:8212
- C:\Windows\System\XzUKTRw.exe
  C:\Windows\System\XzUKTRw.exe
  2⤵
  PID:9240
- C:\Windows\System\WnmOYDE.exe
  C:\Windows\System\WnmOYDE.exe
  2⤵
  PID:9744
- C:\Windows\System\zVOhyqF.exe
  C:\Windows\System\zVOhyqF.exe
  2⤵
  PID:9792
- C:\Windows\System\bTegITr.exe
  C:\Windows\System\bTegITr.exe
  2⤵
  PID:10672
- C:\Windows\System\IBrGKII.exe
  C:\Windows\System\IBrGKII.exe
  2⤵
  PID:10760
- C:\Windows\System\tBUHyCg.exe
  C:\Windows\System\tBUHyCg.exe
  2⤵
  PID:9724
- C:\Windows\System\EcTFSeg.exe
  C:\Windows\System\EcTFSeg.exe
  2⤵
  PID:9612
- C:\Windows\System\ptFrlir.exe
  C:\Windows\System\ptFrlir.exe
  2⤵
  PID:10972
- C:\Windows\System\XNBRsjF.exe
  C:\Windows\System\XNBRsjF.exe
  2⤵
  PID:9972
- C:\Windows\System\MrkQVro.exe
  C:\Windows\System\MrkQVro.exe
  2⤵
  PID:10652
- C:\Windows\System\UgDzKww.exe
  C:\Windows\System\UgDzKww.exe
  2⤵
  PID:2092
- C:\Windows\System\etEIWoM.exe
  C:\Windows\System\etEIWoM.exe
  2⤵
  PID:10776
- C:\Windows\System\PWaDHyt.exe
  C:\Windows\System\PWaDHyt.exe
  2⤵
  PID:9536
- C:\Windows\System\bhKMunr.exe
  C:\Windows\System\bhKMunr.exe
  2⤵
  PID:11272
- C:\Windows\System\MJRFNBJ.exe
  C:\Windows\System\MJRFNBJ.exe
  2⤵
  PID:11292
- C:\Windows\System\hxlAGKF.exe
  C:\Windows\System\hxlAGKF.exe
  2⤵
  PID:11316
- C:\Windows\System\ZOgzuen.exe
  C:\Windows\System\ZOgzuen.exe
  2⤵
  PID:11340
- C:\Windows\System\EkdUCdb.exe
  C:\Windows\System\EkdUCdb.exe
  2⤵
  PID:11360
- C:\Windows\System\WrRvkqD.exe
  C:\Windows\System\WrRvkqD.exe
  2⤵
  PID:11392
- C:\Windows\System\TOSVdIV.exe
  C:\Windows\System\TOSVdIV.exe
  2⤵
  PID:11452
- C:\Windows\System\xIgjNXw.exe
  C:\Windows\System\xIgjNXw.exe
  2⤵
  PID:11476
- C:\Windows\System\TnEqrzt.exe
  C:\Windows\System\TnEqrzt.exe
  2⤵
  PID:11500
- C:\Windows\System\fJbFyuw.exe
  C:\Windows\System\fJbFyuw.exe
  2⤵
  PID:11520
- C:\Windows\System\ZLBQzEY.exe
  C:\Windows\System\ZLBQzEY.exe
  2⤵
  PID:11540
- C:\Windows\System\Izdfjzu.exe
  C:\Windows\System\Izdfjzu.exe
  2⤵
  PID:11568
- C:\Windows\System\knnZynX.exe
  C:\Windows\System\knnZynX.exe
  2⤵
  PID:11592
- C:\Windows\System\jQIrkum.exe
  C:\Windows\System\jQIrkum.exe
  2⤵
  PID:11612
- C:\Windows\System\cVKODSi.exe
  C:\Windows\System\cVKODSi.exe
  2⤵
  PID:11636
- C:\Windows\System\eSWuqAb.exe
  C:\Windows\System\eSWuqAb.exe
  2⤵
  PID:11656
- C:\Windows\System\ctzyEXG.exe
  C:\Windows\System\ctzyEXG.exe
  2⤵
  PID:11676
- C:\Windows\System\lIxUTXF.exe
  C:\Windows\System\lIxUTXF.exe
  2⤵
  PID:11700
- C:\Windows\System\npiSbjg.exe
  C:\Windows\System\npiSbjg.exe
  2⤵
  PID:11720
- C:\Windows\System\pZCavRN.exe
  C:\Windows\System\pZCavRN.exe
  2⤵
  PID:11740
- C:\Windows\System\ZKIVhGl.exe
  C:\Windows\System\ZKIVhGl.exe
  2⤵
  PID:11764
- C:\Windows\System\brokhgW.exe
  C:\Windows\System\brokhgW.exe
  2⤵
  PID:11788
- C:\Windows\System\uLVbAOR.exe
  C:\Windows\System\uLVbAOR.exe
  2⤵
  PID:11812
- C:\Windows\System\aOiWbiq.exe
  C:\Windows\System\aOiWbiq.exe
  2⤵
  PID:11836
- C:\Windows\System\wdnSIfE.exe
  C:\Windows\System\wdnSIfE.exe
  2⤵
  PID:11856
- C:\Windows\System\AWKvZwG.exe
  C:\Windows\System\AWKvZwG.exe
  2⤵
  PID:11876
- C:\Windows\System\YzPCgAM.exe
  C:\Windows\System\YzPCgAM.exe
  2⤵
  PID:11904
- C:\Windows\System\nGdkvSc.exe
  C:\Windows\System\nGdkvSc.exe
  2⤵
  PID:11924
- C:\Windows\System\oRnGsIv.exe
  C:\Windows\System\oRnGsIv.exe
  2⤵
  PID:11948
- C:\Windows\System\TEqQsVy.exe
  C:\Windows\System\TEqQsVy.exe
  2⤵
  PID:11972
- C:\Windows\System\RLvQpiM.exe
  C:\Windows\System\RLvQpiM.exe
  2⤵
  PID:11988
- C:\Windows\System\ODzNNwR.exe
  C:\Windows\System\ODzNNwR.exe
  2⤵
  PID:12008
- C:\Windows\System\diWfGnV.exe
  C:\Windows\System\diWfGnV.exe
  2⤵
  PID:12024
- C:\Windows\System\HvCbJru.exe
  C:\Windows\System\HvCbJru.exe
  2⤵
  PID:12044
- C:\Windows\System\UrGwvCt.exe
  C:\Windows\System\UrGwvCt.exe
  2⤵
  PID:12072
- C:\Windows\System\EnAMaXl.exe
  C:\Windows\System\EnAMaXl.exe
  2⤵
  PID:12092
- C:\Windows\System\babrMdO.exe
  C:\Windows\System\babrMdO.exe
  2⤵
  PID:12116
- C:\Windows\System\bgocPLg.exe
  C:\Windows\System\bgocPLg.exe
  2⤵
  PID:12140
- C:\Windows\System\kCXCnzw.exe
  C:\Windows\System\kCXCnzw.exe
  2⤵
  PID:12160
- C:\Windows\System\SdKQmnX.exe
  C:\Windows\System\SdKQmnX.exe
  2⤵
  PID:12180
- C:\Windows\System\bDLzTnv.exe
  C:\Windows\System\bDLzTnv.exe
  2⤵
  PID:12196
- C:\Windows\System\YwKRLsU.exe
  C:\Windows\System\YwKRLsU.exe
  2⤵
  PID:12212
- C:\Windows\System\odBKTWG.exe
  C:\Windows\System\odBKTWG.exe
  2⤵
  PID:12228
- C:\Windows\System\lfqMbJI.exe
  C:\Windows\System\lfqMbJI.exe
  2⤵
  PID:12248
- C:\Windows\System\JdSbmLM.exe
  C:\Windows\System\JdSbmLM.exe
  2⤵
  PID:12264
- C:\Windows\System\scbTuTn.exe
  C:\Windows\System\scbTuTn.exe
  2⤵
  PID:12280
- C:\Windows\System\ctNsPLF.exe
  C:\Windows\System\ctNsPLF.exe
  2⤵
  PID:10932
- C:\Windows\System\rDIkGIu.exe
  C:\Windows\System\rDIkGIu.exe
  2⤵
  PID:8400
- C:\Windows\System\ukDjQEo.exe
  C:\Windows\System\ukDjQEo.exe
  2⤵
  PID:3536
- C:\Windows\System\mGHnogK.exe
  C:\Windows\System\mGHnogK.exe
  2⤵
  PID:10264
- C:\Windows\System\nqSMmFK.exe
  C:\Windows\System\nqSMmFK.exe
  2⤵
  PID:10288
- C:\Windows\System\UnvfjGH.exe
  C:\Windows\System\UnvfjGH.exe
  2⤵
  PID:10352
- C:\Windows\System\QGpajnp.exe
  C:\Windows\System\QGpajnp.exe
  2⤵
  PID:4584
- C:\Windows\System\ehKUFgt.exe
  C:\Windows\System\ehKUFgt.exe
  2⤵
  PID:10436
- C:\Windows\System\PlNquNC.exe
  C:\Windows\System\PlNquNC.exe
  2⤵
  PID:10500
- C:\Windows\System\iuLjGpu.exe
  C:\Windows\System\iuLjGpu.exe
  2⤵
  PID:3756
- C:\Windows\System\VyxsIMx.exe
  C:\Windows\System\VyxsIMx.exe
  2⤵
  PID:10916
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 10916 -s 28
    3⤵
    PID:13220
- C:\Windows\System\KjHTAMG.exe
  C:\Windows\System\KjHTAMG.exe
  2⤵
  PID:10848
- C:\Windows\System\emHhSSc.exe
  C:\Windows\System\emHhSSc.exe
  2⤵
  PID:7044
- C:\Windows\System\PYbazuW.exe
  C:\Windows\System\PYbazuW.exe
  2⤵
  PID:7492
- C:\Windows\System\UGcIfiw.exe
  C:\Windows\System\UGcIfiw.exe
  2⤵
  PID:7556
- C:\Windows\System\MFLwJKP.exe
  C:\Windows\System\MFLwJKP.exe
  2⤵
  PID:11380
- C:\Windows\System\qFAZroS.exe
  C:\Windows\System\qFAZroS.exe
  2⤵
  PID:11032
- C:\Windows\System\LjEMFbD.exe
  C:\Windows\System\LjEMFbD.exe
  2⤵
  PID:11096
- C:\Windows\System\ZeydMpl.exe
  C:\Windows\System\ZeydMpl.exe
  2⤵
  PID:11124
- C:\Windows\System\nRbvtoc.exe
  C:\Windows\System\nRbvtoc.exe
  2⤵
  PID:11156
- C:\Windows\System\ffztNqt.exe
  C:\Windows\System\ffztNqt.exe
  2⤵
  PID:11236
- C:\Windows\System\GMFoePa.exe
  C:\Windows\System\GMFoePa.exe
  2⤵
  PID:4008
- C:\Windows\System\cCjGxTz.exe
  C:\Windows\System\cCjGxTz.exe
  2⤵
  PID:4720
- C:\Windows\System\rzGNBQh.exe
  C:\Windows\System\rzGNBQh.exe
  2⤵
  PID:11516
- C:\Windows\System\CTDWqUG.exe
  C:\Windows\System\CTDWqUG.exe
  2⤵
  PID:11584
- C:\Windows\System\xXdRAsP.exe
  C:\Windows\System\xXdRAsP.exe
  2⤵
  PID:11692
- C:\Windows\System\cJFJgIE.exe
  C:\Windows\System\cJFJgIE.exe
  2⤵
  PID:11708
- C:\Windows\System\JrmpVWG.exe
  C:\Windows\System\JrmpVWG.exe
  2⤵
  PID:11800
- C:\Windows\System\unaLhhJ.exe
  C:\Windows\System\unaLhhJ.exe
  2⤵
  PID:11844
- C:\Windows\System\PnIjRVQ.exe
  C:\Windows\System\PnIjRVQ.exe
  2⤵
  PID:12312
- C:\Windows\System\qEIZPHh.exe
  C:\Windows\System\qEIZPHh.exe
  2⤵
  PID:12336
- C:\Windows\System\SfSswpI.exe
  C:\Windows\System\SfSswpI.exe
  2⤵
  PID:12364
- C:\Windows\System\gGVtxYb.exe
  C:\Windows\System\gGVtxYb.exe
  2⤵
  PID:12392
- C:\Windows\System\bptRhwC.exe
  C:\Windows\System\bptRhwC.exe
  2⤵
  PID:12412
- C:\Windows\System\DtSUnmE.exe
  C:\Windows\System\DtSUnmE.exe
  2⤵
  PID:12436
- C:\Windows\System\RGDKAGN.exe
  C:\Windows\System\RGDKAGN.exe
  2⤵
  PID:12456
- C:\Windows\System\WIcifKy.exe
  C:\Windows\System\WIcifKy.exe
  2⤵
  PID:12476
- C:\Windows\System\fnsRcRF.exe
  C:\Windows\System\fnsRcRF.exe
  2⤵
  PID:12492
- C:\Windows\System\GqiWaTO.exe
  C:\Windows\System\GqiWaTO.exe
  2⤵
  PID:12516
- C:\Windows\System\JyoqKvM.exe
  C:\Windows\System\JyoqKvM.exe
  2⤵
  PID:12536
- C:\Windows\System\euSyauz.exe
  C:\Windows\System\euSyauz.exe
  2⤵
  PID:12556
- C:\Windows\System\mlGCBmE.exe
  C:\Windows\System\mlGCBmE.exe
  2⤵
  PID:12576
- C:\Windows\System\YQMpQxh.exe
  C:\Windows\System\YQMpQxh.exe
  2⤵
  PID:12596
- C:\Windows\System\YDWEHZF.exe
  C:\Windows\System\YDWEHZF.exe
  2⤵
  PID:12616
- C:\Windows\System\iLzfpuT.exe
  C:\Windows\System\iLzfpuT.exe
  2⤵
  PID:13124
- C:\Windows\System\SlQfbuG.exe
  C:\Windows\System\SlQfbuG.exe
  2⤵
  PID:13144
- C:\Windows\System\GxXDQAN.exe
  C:\Windows\System\GxXDQAN.exe
  2⤵
  PID:13212
- C:\Windows\System\jvwqROb.exe
  C:\Windows\System\jvwqROb.exe
  2⤵
  PID:13236
- C:\Windows\System\febRJTt.exe
  C:\Windows\System\febRJTt.exe
  2⤵
  PID:13256
- C:\Windows\System\XRQMcjz.exe
  C:\Windows\System\XRQMcjz.exe
  2⤵
  PID:13276
- C:\Windows\System\ORIxiUs.exe
  C:\Windows\System\ORIxiUs.exe
  2⤵
  PID:13304
- C:\Windows\System\jyGyLrr.exe
  C:\Windows\System\jyGyLrr.exe
  2⤵
  PID:7624
- C:\Windows\System\nYphGcQ.exe
  C:\Windows\System\nYphGcQ.exe
  2⤵
  PID:11980
- C:\Windows\System\ElmCJMo.exe
  C:\Windows\System\ElmCJMo.exe
  2⤵
  PID:11996
- C:\Windows\System\PfqSZcI.exe
  C:\Windows\System\PfqSZcI.exe
  2⤵
  PID:12040
- C:\Windows\System\wSNdFMN.exe
  C:\Windows\System\wSNdFMN.exe
  2⤵
  PID:11324
- C:\Windows\System\cXJYBtl.exe
  C:\Windows\System\cXJYBtl.exe
  2⤵
  PID:1588
- C:\Windows\System\gOXAaya.exe
  C:\Windows\System\gOXAaya.exe
  2⤵
  PID:10736
- C:\Windows\System\lHaeIfC.exe
  C:\Windows\System\lHaeIfC.exe
  2⤵
  PID:11696
- C:\Windows\System\bNGCAtg.exe
  C:\Windows\System\bNGCAtg.exe
  2⤵
  PID:11956
- C:\Windows\System\pYAvBpG.exe
  C:\Windows\System\pYAvBpG.exe
  2⤵
  PID:12240
- C:\Windows\System\moHLdjT.exe
  C:\Windows\System\moHLdjT.exe
  2⤵
  PID:12712
- C:\Windows\System\nHxumod.exe
  C:\Windows\System\nHxumod.exe
  2⤵
  PID:12740
- C:\Windows\System\TmmFtVv.exe
  C:\Windows\System\TmmFtVv.exe
  2⤵
  PID:12764
- C:\Windows\System\XFuIwQq.exe
  C:\Windows\System\XFuIwQq.exe
  2⤵
  PID:12788
- C:\Windows\System\XUeUYDN.exe
  C:\Windows\System\XUeUYDN.exe
  2⤵
  PID:12984
- C:\Windows\System\ALCvVPY.exe
  C:\Windows\System\ALCvVPY.exe
  2⤵
  PID:12924
- C:\Windows\System\jrQRbQO.exe
  C:\Windows\System\jrQRbQO.exe
  2⤵
  PID:13184
- C:\Windows\System\DCzzXVe.exe
  C:\Windows\System\DCzzXVe.exe
  2⤵
  PID:13196
- C:\Windows\System\hmuDyWi.exe
  C:\Windows\System\hmuDyWi.exe
  2⤵
  PID:13296
- C:\Windows\System\AXOMHJL.exe
  C:\Windows\System\AXOMHJL.exe
  2⤵
  PID:8280
- C:\Windows\System\AmLrHJk.exe
  C:\Windows\System\AmLrHJk.exe
  2⤵
  PID:932
- C:\Windows\System\lgRZwTP.exe
  C:\Windows\System\lgRZwTP.exe
  2⤵
  PID:10136
- C:\Windows\System\tjImkWc.exe
  C:\Windows\System\tjImkWc.exe
  2⤵
  PID:13100
- C:\Windows\System\FuaINNY.exe
  C:\Windows\System\FuaINNY.exe
  2⤵
  PID:13000
- C:\Windows\System\daGzgUJ.exe
  C:\Windows\System\daGzgUJ.exe
  2⤵
  PID:13160
- C:\Windows\System\EnrJzpp.exe
  C:\Windows\System\EnrJzpp.exe
  2⤵
  PID:12448
- C:\Windows\System\rwGySio.exe
  C:\Windows\System\rwGySio.exe
  2⤵
  PID:13272
- C:\Windows\System\lrLHjtQ.exe
  C:\Windows\System\lrLHjtQ.exe
  2⤵
  PID:11884
- C:\Windows\System\DXIbajl.exe
  C:\Windows\System\DXIbajl.exe
  2⤵
  PID:11020
- C:\Windows\System\KZTCDBM.exe
  C:\Windows\System\KZTCDBM.exe
  2⤵
  PID:11468
- C:\Windows\System\ahHsSdD.exe
  C:\Windows\System\ahHsSdD.exe
  2⤵
  PID:13108
- C:\Windows\System\qcZkVBz.exe
  C:\Windows\System\qcZkVBz.exe
  2⤵
  PID:12016
- C:\Windows\System\sdfLgoT.exe
  C:\Windows\System\sdfLgoT.exe
  2⤵
  PID:3128
- C:\Windows\System\bMsiqgd.exe
  C:\Windows\System\bMsiqgd.exe
  2⤵
  PID:12612
- C:\Windows\System\sWPbhiQ.exe
  C:\Windows\System\sWPbhiQ.exe
  2⤵
  PID:10008
- C:\Windows\System\NgEXNUD.exe
  C:\Windows\System\NgEXNUD.exe
  2⤵
  PID:12668
- C:\Windows\System\LMYknoW.exe
  C:\Windows\System\LMYknoW.exe
  2⤵
  PID:12824
- C:\Windows\System\ApibaHV.exe
  C:\Windows\System\ApibaHV.exe
  2⤵
  PID:9596
- C:\Windows\System\TcnfVWZ.exe
  C:\Windows\System\TcnfVWZ.exe
  2⤵
  PID:11268
- C:\Windows\System\osPobnJ.exe
  C:\Windows\System\osPobnJ.exe
  2⤵
  PID:10980
- C:\Windows\System\ZLIeSzE.exe
  C:\Windows\System\ZLIeSzE.exe
  2⤵
  PID:12780
- C:\Windows\System\qLEkgKb.exe
  C:\Windows\System\qLEkgKb.exe
  2⤵
  PID:12640
- C:\Windows\System\jcFrjtJ.exe
  C:\Windows\System\jcFrjtJ.exe
  2⤵
  PID:1680
- C:\Windows\System\qcGEKAD.exe
  C:\Windows\System\qcGEKAD.exe
  2⤵
  PID:12512
- C:\Windows\System\voXhVLV.exe
  C:\Windows\System\voXhVLV.exe
  2⤵
  PID:13244
- C:\Windows\System\KvCJCeK.exe
  C:\Windows\System\KvCJCeK.exe
  2⤵
  PID:12376
- C:\Windows\System\kVkTQRK.exe
  C:\Windows\System\kVkTQRK.exe
  2⤵
  PID:11472
- C:\Windows\System\jpRLZxH.exe
  C:\Windows\System\jpRLZxH.exe
  2⤵
  PID:12064
- C:\Windows\System\tzOKJDP.exe
  C:\Windows\System\tzOKJDP.exe
  2⤵
  PID:10796
- C:\Windows\System\sQFvHRe.exe
  C:\Windows\System\sQFvHRe.exe
  2⤵
  PID:12192
- C:\Windows\System\yyKPGMZ.exe
  C:\Windows\System\yyKPGMZ.exe
  2⤵
  PID:10372
- C:\Windows\System\iEdTpin.exe
  C:\Windows\System\iEdTpin.exe
  2⤵
  PID:12912
- C:\Windows\System\bdFTigS.exe
  C:\Windows\System\bdFTigS.exe
  2⤵
  PID:13176
- C:\Windows\System\qCFUuAv.exe
  C:\Windows\System\qCFUuAv.exe
  2⤵
  PID:10336
- C:\Windows\System\VUqzdcW.exe
  C:\Windows\System\VUqzdcW.exe
  2⤵
  PID:4364
- C:\Windows\System\lyqzVoZ.exe
  C:\Windows\System\lyqzVoZ.exe
  2⤵
  PID:12348
- C:\Windows\System\RpCfKrF.exe
  C:\Windows\System\RpCfKrF.exe
  2⤵
  PID:11932
- C:\Windows\System\VPzAQvs.exe
  C:\Windows\System\VPzAQvs.exe
  2⤵
  PID:11256
- C:\Windows\System\ppltZHf.exe
  C:\Windows\System\ppltZHf.exe
  2⤵
  PID:12260
- C:\Windows\System\DZlSkXW.exe
  C:\Windows\System\DZlSkXW.exe
  2⤵
  PID:2912
- C:\Windows\System\eHUHllj.exe
  C:\Windows\System\eHUHllj.exe
  2⤵
  PID:10420
- C:\Windows\System\OOjeiOm.exe
  C:\Windows\System\OOjeiOm.exe
  2⤵
  PID:12204
- C:\Windows\System\dhQtTpb.exe
  C:\Windows\System\dhQtTpb.exe
  2⤵
  PID:10432
- C:\Windows\System\snFdAmy.exe
  C:\Windows\System\snFdAmy.exe
  2⤵
  PID:12808
- C:\Windows\System\pdBlcAY.exe
  C:\Windows\System\pdBlcAY.exe
  2⤵
  PID:13016
- C:\Windows\System\nrFLeSL.exe
  C:\Windows\System\nrFLeSL.exe
  2⤵
  PID:10720
- C:\Windows\System\RpQNAZZ.exe
  C:\Windows\System\RpQNAZZ.exe
  2⤵
  PID:13088
- C:\Windows\System\DISTuBr.exe
  C:\Windows\System\DISTuBr.exe
  2⤵
  PID:12960
- C:\Windows\System\XJGVxYU.exe
  C:\Windows\System\XJGVxYU.exe
  2⤵
  PID:4328
- C:\Windows\System\efWGqnA.exe
  C:\Windows\System\efWGqnA.exe
  2⤵
  PID:13120
- C:\Windows\System\drifbEl.exe
  C:\Windows\System\drifbEl.exe
  2⤵
  PID:11492
- C:\Windows\System\MOHzlcR.exe
  C:\Windows\System\MOHzlcR.exe
  2⤵
  PID:11644
- C:\Windows\System\XCsPqjt.exe
  C:\Windows\System\XCsPqjt.exe
  2⤵
  PID:7096
- C:\Windows\System\MRtETpG.exe
  C:\Windows\System\MRtETpG.exe
  2⤵
  PID:11736
- C:\Windows\System\fDEMtYC.exe
  C:\Windows\System\fDEMtYC.exe
  2⤵
  PID:13044
- C:\Windows\System\TqWqKcy.exe
  C:\Windows\System\TqWqKcy.exe
  2⤵
  PID:7740
- C:\Windows\System\FFexPQL.exe
  C:\Windows\System\FFexPQL.exe
  2⤵
  PID:11388
- C:\Windows\System\VxRSOQu.exe
  C:\Windows\System\VxRSOQu.exe
  2⤵
  PID:10960
- C:\Windows\System\rmZfgnQ.exe
  C:\Windows\System\rmZfgnQ.exe
  2⤵
  PID:13220
- C:\Windows\System\cjhCarR.exe
  C:\Windows\System\cjhCarR.exe
  2⤵
  PID:12700
- C:\Windows\System\pJpwEPt.exe
  C:\Windows\System\pJpwEPt.exe
  2⤵
  PID:3688
- C:\Windows\System\iafcRoW.exe
  C:\Windows\System\iafcRoW.exe
  2⤵
  PID:12156
- C:\Windows\System\xDRlpDr.exe
  C:\Windows\System\xDRlpDr.exe
  2⤵
  PID:12852
- C:\Windows\System\KBxNbMx.exe
  C:\Windows\System\KBxNbMx.exe
  2⤵
  PID:12068
- C:\Windows\System\jpTpyjS.exe
  C:\Windows\System\jpTpyjS.exe
  2⤵
  PID:1668
- C:\Windows\System\oFQBgAb.exe
  C:\Windows\System\oFQBgAb.exe
  2⤵
  PID:5872
- C:\Windows\System\jYawzbm.exe
  C:\Windows\System\jYawzbm.exe
  2⤵
  PID:10508
- C:\Windows\System\OPSqJkO.exe
  C:\Windows\System\OPSqJkO.exe
  2⤵
  PID:952
- C:\Windows\System\TYNjAhr.exe
  C:\Windows\System\TYNjAhr.exe
  2⤵
  PID:10464
- C:\Windows\System\nDlaDGS.exe
  C:\Windows\System\nDlaDGS.exe
  2⤵
  PID:4880
- C:\Windows\System\YPQGRIb.exe
  C:\Windows\System\YPQGRIb.exe
  2⤵
  PID:4628
- C:\Windows\System\MRMQqvY.exe
  C:\Windows\System\MRMQqvY.exe
  2⤵
  PID:1788
- C:\Windows\System\QhhhFOV.exe
  C:\Windows\System\QhhhFOV.exe
  2⤵
  PID:3160
- C:\Windows\System\rEvSuoK.exe
  C:\Windows\System\rEvSuoK.exe
  2⤵
  PID:11064
- C:\Windows\System\nvhogBw.exe
  C:\Windows\System\nvhogBw.exe
  2⤵
  PID:1388
- C:\Windows\System\wQvphND.exe
  C:\Windows\System\wQvphND.exe
  2⤵
  PID:11444
- C:\Windows\System\CXIlXRi.exe
  C:\Windows\System\CXIlXRi.exe
  2⤵
  PID:12732
- C:\Windows\System\YZwhyNC.exe
  C:\Windows\System\YZwhyNC.exe
  2⤵
  PID:13300
- C:\Windows\System\LxrkZbj.exe
  C:\Windows\System\LxrkZbj.exe
  2⤵
  PID:10936
- C:\Windows\System\JWRHjQO.exe
  C:\Windows\System\JWRHjQO.exe
  2⤵
  PID:1104
- C:\Windows\System\vlVQqTz.exe
  C:\Windows\System\vlVQqTz.exe
  2⤵
  PID:4436
- C:\Windows\System\MDbCaXx.exe
  C:\Windows\System\MDbCaXx.exe
  2⤵
  PID:4464
- C:\Windows\System\EMixvCE.exe
  C:\Windows\System\EMixvCE.exe
  2⤵
  PID:11332
- C:\Windows\System\mZvKUEv.exe
  C:\Windows\System\mZvKUEv.exe
  2⤵
  PID:12508
- C:\Windows\System\QGgtrsG.exe
  C:\Windows\System\QGgtrsG.exe
  2⤵
  PID:1576
- C:\Windows\System\NdhqNta.exe
  C:\Windows\System\NdhqNta.exe
  2⤵
  PID:1888
- C:\Windows\System\DpLfggE.exe
  C:\Windows\System\DpLfggE.exe
  2⤵
  PID:4380
- C:\Windows\System\MtFiFGZ.exe
  C:\Windows\System\MtFiFGZ.exe
  2⤵
  PID:4820
- C:\Windows\System\TTKAIgk.exe
  C:\Windows\System\TTKAIgk.exe
  2⤵
  PID:3376
- C:\Windows\System\NTvviaC.exe
  C:\Windows\System\NTvviaC.exe
  2⤵
  PID:2548
- C:\Windows\System\IFiwRFY.exe
  C:\Windows\System\IFiwRFY.exe
  2⤵
  PID:9476
- C:\Windows\System\vUnUWLf.exe
  C:\Windows\System\vUnUWLf.exe
  2⤵
  PID:3416
- C:\Windows\System\HSZOmJV.exe
  C:\Windows\System\HSZOmJV.exe
  2⤵
  PID:1964
- C:\Windows\System\ZQmROaw.exe
  C:\Windows\System\ZQmROaw.exe
  2⤵
  PID:4244
- C:\Windows\System\Qcsxvxw.exe
  C:\Windows\System\Qcsxvxw.exe
  2⤵
  PID:3432
- C:\Windows\System\MZortWM.exe
  C:\Windows\System\MZortWM.exe
  2⤵
  PID:1220
- C:\Windows\System\RehOsRB.exe
  C:\Windows\System\RehOsRB.exe
  2⤵
  PID:4036
- C:\Windows\System\jGspEzx.exe
  C:\Windows\System\jGspEzx.exe
  2⤵
  PID:2916
- C:\Windows\System\iGQNQDZ.exe
  C:\Windows\System\iGQNQDZ.exe
  2⤵
  PID:13344
- C:\Windows\System\FqqzDAj.exe
  C:\Windows\System\FqqzDAj.exe
  2⤵
  PID:13396
- C:\Windows\System\dprqIdb.exe
  C:\Windows\System\dprqIdb.exe
  2⤵
  PID:13460
- C:\Windows\System\EYTgWbO.exe
  C:\Windows\System\EYTgWbO.exe
  2⤵
  PID:13492
- C:\Windows\System\RArssEI.exe
  C:\Windows\System\RArssEI.exe
  2⤵
  PID:13520
- C:\Windows\System\QXjMpUx.exe
  C:\Windows\System\QXjMpUx.exe
  2⤵
  PID:13548
- C:\Windows\System\WuolxSP.exe
  C:\Windows\System\WuolxSP.exe
  2⤵
  PID:13576
- C:\Windows\System\qhJdnKM.exe
  C:\Windows\System\qhJdnKM.exe
  2⤵
  PID:13616
- C:\Windows\System\DyWzIuf.exe
  C:\Windows\System\DyWzIuf.exe
  2⤵
  PID:13644
- C:\Windows\System\SxUGDAv.exe
  C:\Windows\System\SxUGDAv.exe
  2⤵
  PID:13668
- C:\Windows\System\djNsOgc.exe
  C:\Windows\System\djNsOgc.exe
  2⤵
  PID:13696
- C:\Windows\System\pAhkfjY.exe
  C:\Windows\System\pAhkfjY.exe
  2⤵
  PID:13720
- C:\Windows\System\GEjcGRa.exe
  C:\Windows\System\GEjcGRa.exe
  2⤵
  PID:13780
- C:\Windows\System\wjohMmg.exe
  C:\Windows\System\wjohMmg.exe
  2⤵
  PID:13804
- C:\Windows\System\GTLyBGy.exe
  C:\Windows\System\GTLyBGy.exe
  2⤵
  PID:13900
- C:\Windows\System\qoOKHJu.exe
  C:\Windows\System\qoOKHJu.exe
  2⤵
  PID:13920
- C:\Windows\System\QlVehWY.exe
  C:\Windows\System\QlVehWY.exe
  2⤵
  PID:13984
- C:\Windows\System\Ftsnjoj.exe
  C:\Windows\System\Ftsnjoj.exe
  2⤵
  PID:14012
- C:\Windows\System\PIhgcWG.exe
  C:\Windows\System\PIhgcWG.exe
  2⤵
  PID:14048
- C:\Windows\System\BrQhEUq.exe
  C:\Windows\System\BrQhEUq.exe
  2⤵
  PID:14084
- C:\Windows\System\iIheLmW.exe
  C:\Windows\System\iIheLmW.exe
  2⤵
  PID:14104
- C:\Windows\System\SaNqTol.exe
  C:\Windows\System\SaNqTol.exe
  2⤵
  PID:14140
- C:\Windows\System\LyUBUkR.exe
  C:\Windows\System\LyUBUkR.exe
  2⤵
  PID:14160
- C:\Windows\System\gaVgzEo.exe
  C:\Windows\System\gaVgzEo.exe
  2⤵
  PID:14268
- C:\Windows\System\xljICYn.exe
  C:\Windows\System\xljICYn.exe
  2⤵
  PID:14300
- C:\Windows\System\PdwostM.exe
  C:\Windows\System\PdwostM.exe
  2⤵
  PID:14316
- C:\Windows\System\VdZbnVV.exe
  C:\Windows\System\VdZbnVV.exe
  2⤵
  PID:4904
- C:\Windows\System\iXpEDfF.exe
  C:\Windows\System\iXpEDfF.exe
  2⤵
  PID:3180
- C:\Windows\System\OOIMJJa.exe
  C:\Windows\System\OOIMJJa.exe
  2⤵
  PID:912
- C:\Windows\System\oKnjZJv.exe
  C:\Windows\System\oKnjZJv.exe
  2⤵
  PID:13340
- C:\Windows\System\GdeYjgh.exe
  C:\Windows\System\GdeYjgh.exe
  2⤵
  PID:13516
- C:\Windows\System\tbCsfrZ.exe
  C:\Windows\System\tbCsfrZ.exe
  2⤵
  PID:3404
- C:\Windows\System\eBLgclP.exe
  C:\Windows\System\eBLgclP.exe
  2⤵
  PID:13440
- C:\Windows\System\YscZFbE.exe
  C:\Windows\System\YscZFbE.exe
  2⤵
  PID:13380
- C:\Windows\System\hGrEkwj.exe
  C:\Windows\System\hGrEkwj.exe
  2⤵
  PID:13424
- C:\Windows\System\IMxhRgG.exe
  C:\Windows\System\IMxhRgG.exe
  2⤵
  PID:3884
- C:\Windows\System\jkCYmXj.exe
  C:\Windows\System\jkCYmXj.exe
  2⤵
  PID:13452
- C:\Windows\System\yprVsYk.exe
  C:\Windows\System\yprVsYk.exe
  2⤵
  PID:13640
- C:\Windows\System\BdjXVgZ.exe
  C:\Windows\System\BdjXVgZ.exe
  2⤵
  PID:13660
- C:\Windows\System\XkNRIqP.exe
  C:\Windows\System\XkNRIqP.exe
  2⤵
  PID:5372
- C:\Windows\System\UIAbXPw.exe
  C:\Windows\System\UIAbXPw.exe
  2⤵
  PID:13688
- C:\Windows\System\rKqQSxw.exe
  C:\Windows\System\rKqQSxw.exe
  2⤵
  PID:4588
- C:\Windows\System\dQPDkaq.exe
  C:\Windows\System\dQPDkaq.exe
  2⤵
  PID:2976
- C:\Windows\System\FGzdKBu.exe
  C:\Windows\System\FGzdKBu.exe
  2⤵
  PID:13884
- C:\Windows\System\BfSbuHW.exe
  C:\Windows\System\BfSbuHW.exe
  2⤵
  PID:4284
- C:\Windows\System\wXfLHvJ.exe
  C:\Windows\System\wXfLHvJ.exe
  2⤵
  PID:4776
- C:\Windows\System\QkYMBSw.exe
  C:\Windows\System\QkYMBSw.exe
  2⤵
  PID:4296
- C:\Windows\System\wYrBAeh.exe
  C:\Windows\System\wYrBAeh.exe
  2⤵
  PID:14040
- C:\Windows\System\dWAsBby.exe
  C:\Windows\System\dWAsBby.exe
  2⤵
  PID:14092
- C:\Windows\System\MRkquOw.exe
  C:\Windows\System\MRkquOw.exe
  2⤵
  PID:13892
- C:\Windows\System\FDdFXwm.exe
  C:\Windows\System\FDdFXwm.exe
  2⤵
  PID:13972
- C:\Windows\System\AfYQhZZ.exe
  C:\Windows\System\AfYQhZZ.exe
  2⤵
  PID:2344
- C:\Windows\System\hSmzYIJ.exe
  C:\Windows\System\hSmzYIJ.exe
  2⤵
  PID:14044
- C:\Windows\System\HGykZht.exe
  C:\Windows\System\HGykZht.exe
  2⤵
  PID:14064
- C:\Windows\System\wHjtmIq.exe
  C:\Windows\System\wHjtmIq.exe
  2⤵
  PID:14100
- C:\Windows\System\hlsKDCE.exe
  C:\Windows\System\hlsKDCE.exe
  2⤵
  PID:14008
- C:\Windows\System\yayndts.exe
  C:\Windows\System\yayndts.exe
  2⤵
  PID:5712
- C:\Windows\System\AqezNpH.exe
  C:\Windows\System\AqezNpH.exe
  2⤵
  PID:1160
- C:\Windows\System\LXNgLGG.exe
  C:\Windows\System\LXNgLGG.exe
  2⤵
  PID:5188
- C:\Windows\System\yJAvbfl.exe
  C:\Windows\System\yJAvbfl.exe
  2⤵
  PID:5748
- C:\Windows\System\hqvMhte.exe
  C:\Windows\System\hqvMhte.exe
  2⤵
  PID:5976
- C:\Windows\System\ZcHQGQn.exe
  C:\Windows\System\ZcHQGQn.exe
  2⤵
  PID:4472
- C:\Windows\System\ZXbIxRb.exe
  C:\Windows\System\ZXbIxRb.exe
  2⤵
  PID:2676
- C:\Windows\System\cIYGOlq.exe
  C:\Windows\System\cIYGOlq.exe
  2⤵
  PID:2836
- C:\Windows\System\acVmFig.exe
  C:\Windows\System\acVmFig.exe
  2⤵
  PID:2508
- C:\Windows\System\lWtlvGE.exe
  C:\Windows\System\lWtlvGE.exe
  2⤵
  PID:5980
- C:\Windows\System\gDgyEhW.exe
  C:\Windows\System\gDgyEhW.exe
  2⤵
  PID:5328
- C:\Windows\System\XpMCYQz.exe
  C:\Windows\System\XpMCYQz.exe
  2⤵
  PID:1368
- C:\Windows\System\XHSlKVr.exe
  C:\Windows\System\XHSlKVr.exe
  2⤵
  PID:1448
- C:\Windows\System\BbMKAEo.exe
  C:\Windows\System\BbMKAEo.exe
  2⤵
  PID:13540
- C:\Windows\System\drdvRBK.exe
  C:\Windows\System\drdvRBK.exe
  2⤵
  PID:2816
- C:\Windows\System\PeupuBX.exe
  C:\Windows\System\PeupuBX.exe
  2⤵
  PID:5332
- C:\Windows\System\ToluCCN.exe
  C:\Windows\System\ToluCCN.exe
  2⤵
  PID:13868
- C:\Windows\System\jonuWAP.exe
  C:\Windows\System\jonuWAP.exe
  2⤵
  PID:6292
- C:\Windows\System\WEojJAB.exe
  C:\Windows\System\WEojJAB.exe
  2⤵
  PID:13816
- C:\Windows\System\rBJTPlK.exe
  C:\Windows\System\rBJTPlK.exe
  2⤵
  PID:13888
- C:\Windows\System\bOyUJQt.exe
  C:\Windows\System\bOyUJQt.exe
  2⤵
  PID:5296
- C:\Windows\System\PVzFKFq.exe
  C:\Windows\System\PVzFKFq.exe
  2⤵
  PID:14032
- C:\Windows\System\vKpbyqe.exe
  C:\Windows\System\vKpbyqe.exe
  2⤵
  PID:13592
- C:\Windows\System\KCmWqbF.exe
  C:\Windows\System\KCmWqbF.exe
  2⤵
  PID:3648
- C:\Windows\System\jlXXauS.exe
  C:\Windows\System\jlXXauS.exe
  2⤵
  PID:6316
- C:\Windows\System\nUboKUu.exe
  C:\Windows\System\nUboKUu.exe
  2⤵
  PID:5320
- C:\Windows\System\VvgPMHB.exe
  C:\Windows\System\VvgPMHB.exe
  2⤵
  PID:13964
- C:\Windows\System\KINbPss.exe
  C:\Windows\System\KINbPss.exe
  2⤵
  PID:6336
- C:\Windows\System\uEqdDbC.exe
  C:\Windows\System\uEqdDbC.exe
  2⤵
  PID:5680
- C:\Windows\System\hbXXjvP.exe
  C:\Windows\System\hbXXjvP.exe
  2⤵
  PID:14244
- C:\Windows\System\sfYPWuM.exe
  C:\Windows\System\sfYPWuM.exe
  2⤵
  PID:13328
- C:\Windows\System\Ceajatt.exe
  C:\Windows\System\Ceajatt.exe
  2⤵
  PID:7128
- C:\Windows\System\OslBAZh.exe
  C:\Windows\System\OslBAZh.exe
  2⤵
  PID:3424
- C:\Windows\System\SNwoFvs.exe
  C:\Windows\System\SNwoFvs.exe
  2⤵
  PID:6080
- C:\Windows\System\QKTEgWn.exe
  C:\Windows\System\QKTEgWn.exe
  2⤵
  PID:6592
- C:\Windows\System\xpEyJKg.exe
  C:\Windows\System\xpEyJKg.exe
  2⤵
  PID:6484
- C:\Windows\System\pAACNqP.exe
  C:\Windows\System\pAACNqP.exe
  2⤵
  PID:6516
- C:\Windows\System\TLMkwux.exe
  C:\Windows\System\TLMkwux.exe
  2⤵
  PID:13628
- C:\Windows\System\daITWhr.exe
  C:\Windows\System\daITWhr.exe
  2⤵
  PID:13408
- C:\Windows\System\XtPyQMs.exe
  C:\Windows\System\XtPyQMs.exe
  2⤵
  PID:6540
- C:\Windows\System\IDSaKDP.exe
  C:\Windows\System\IDSaKDP.exe
  2⤵
  PID:6556
- C:\Windows\System\rXawGFq.exe
  C:\Windows\System\rXawGFq.exe
  2⤵
  PID:6776
- C:\Windows\System\YXPUnbB.exe
  C:\Windows\System\YXPUnbB.exe
  2⤵
  PID:13832
- C:\Windows\System\dOUBgRX.exe
  C:\Windows\System\dOUBgRX.exe
  2⤵
  PID:2512
- C:\Windows\System\UzxVgcQ.exe
  C:\Windows\System\UzxVgcQ.exe
  2⤵
  PID:6312
- C:\Windows\System\nrGtpsE.exe
  C:\Windows\System\nrGtpsE.exe
  2⤵
  PID:7088
- C:\Windows\System\nsWMuli.exe
  C:\Windows\System\nsWMuli.exe
  2⤵
  PID:2692
- C:\Windows\System\FQQOZJN.exe
  C:\Windows\System\FQQOZJN.exe
  2⤵
  PID:5484
- C:\Windows\System\ijFhMdA.exe
  C:\Windows\System\ijFhMdA.exe
  2⤵
  PID:3212
- C:\Windows\System\bJNMkiK.exe
  C:\Windows\System\bJNMkiK.exe
  2⤵
  PID:6444
- C:\Windows\System\lEbEXyK.exe
  C:\Windows\System\lEbEXyK.exe
  2⤵
  PID:4536
- C:\Windows\System\aZOapKc.exe
  C:\Windows\System\aZOapKc.exe
  2⤵
  PID:5196
- C:\Windows\System\WmSzhMp.exe
  C:\Windows\System\WmSzhMp.exe
  2⤵
  PID:3496
- C:\Windows\System\hSArEwt.exe
  C:\Windows\System\hSArEwt.exe
  2⤵
  PID:6508
- C:\Windows\System\GNjPByv.exe
  C:\Windows\System\GNjPByv.exe
  2⤵
  PID:4732
- C:\Windows\System\VcSEVbx.exe
  C:\Windows\System\VcSEVbx.exe
  2⤵
  PID:13508
- C:\Windows\System\vidUKUD.exe
  C:\Windows\System\vidUKUD.exe
  2⤵
  PID:5668
- C:\Windows\System\ZoMRinn.exe
  C:\Windows\System\ZoMRinn.exe
  2⤵
  PID:6588
- C:\Windows\System\ttMIdul.exe
  C:\Windows\System\ttMIdul.exe
  2⤵
  PID:14352
- C:\Windows\System\LtAyqhc.exe
  C:\Windows\System\LtAyqhc.exe
  2⤵
  PID:14376
- C:\Windows\System\IrCMdYp.exe
  C:\Windows\System\IrCMdYp.exe
  2⤵
  PID:14588
- C:\Windows\System\kjammXq.exe
  C:\Windows\System\kjammXq.exe
  2⤵
  PID:14692
- C:\Windows\System\MhKgxrI.exe
  C:\Windows\System\MhKgxrI.exe
  2⤵
  PID:14708
- C:\Windows\System\PhUYvgr.exe
  C:\Windows\System\PhUYvgr.exe
  2⤵
  PID:14724
- C:\Windows\System\EznmytW.exe
  C:\Windows\System\EznmytW.exe
  2⤵
  PID:14740
- C:\Windows\System\LIAhTmZ.exe
  C:\Windows\System\LIAhTmZ.exe
  2⤵
  PID:14788
- C:\Windows\System\MxRbKlO.exe
  C:\Windows\System\MxRbKlO.exe
  2⤵
  PID:14912
- C:\Windows\System\VdnfwWU.exe
  C:\Windows\System\VdnfwWU.exe
  2⤵
  PID:14940
- C:\Windows\System\AYCsmCj.exe
  C:\Windows\System\AYCsmCj.exe
  2⤵
  PID:14980
- C:\Windows\System\JfOvcPi.exe
  C:\Windows\System\JfOvcPi.exe
  2⤵
  PID:15008
- C:\Windows\System\rjySXrg.exe
  C:\Windows\System\rjySXrg.exe
  2⤵
  PID:15140
- C:\Windows\System\kwxTkad.exe
  C:\Windows\System\kwxTkad.exe
  2⤵
  PID:15164
- C:\Windows\System\DAyPyhG.exe
  C:\Windows\System\DAyPyhG.exe
  2⤵
  PID:15184
- C:\Windows\System\QSitlRX.exe
  C:\Windows\System\QSitlRX.exe
  2⤵
  PID:15208
- C:\Windows\System\btUHqCe.exe
  C:\Windows\System\btUHqCe.exe
  2⤵
  PID:15248
- C:\Windows\System\LDSrLhG.exe
  C:\Windows\System\LDSrLhG.exe
  2⤵
  PID:15288
- C:\Windows\System\wEIiGvY.exe
  C:\Windows\System\wEIiGvY.exe
  2⤵
  PID:15320
- C:\Windows\System\szehkfy.exe
  C:\Windows\System\szehkfy.exe
  2⤵
  PID:15352
- C:\Windows\System\ZCiPGya.exe
  C:\Windows\System\ZCiPGya.exe
  2⤵
  PID:3812
- C:\Windows\System\LkOKlAO.exe
  C:\Windows\System\LkOKlAO.exe
  2⤵
  PID:6548
- C:\Windows\System\CllBbLv.exe
  C:\Windows\System\CllBbLv.exe
  2⤵
  PID:4032
- C:\Windows\System\xWOIBFR.exe
  C:\Windows\System\xWOIBFR.exe
  2⤵
  PID:6400
- C:\Windows\System\mOoiMlK.exe
  C:\Windows\System\mOoiMlK.exe
  2⤵
  PID:1776
- C:\Windows\System\vszYFdm.exe
  C:\Windows\System\vszYFdm.exe
  2⤵
  PID:5032
- C:\Windows\System\bxEwFAw.exe
  C:\Windows\System\bxEwFAw.exe
  2⤵
  PID:6808
- C:\Windows\System\xHnFgoi.exe
  C:\Windows\System\xHnFgoi.exe
  2⤵
  PID:1516
- C:\Windows\System\uzMheOG.exe
  C:\Windows\System\uzMheOG.exe
  2⤵
  PID:2072
- C:\Windows\System\wmcgxsH.exe
  C:\Windows\System\wmcgxsH.exe
  2⤵
  PID:4396
- C:\Windows\System\ANquISr.exe
  C:\Windows\System\ANquISr.exe
  2⤵
  PID:6852
- C:\Windows\System\EHtADuE.exe
  C:\Windows\System\EHtADuE.exe
  2⤵
  PID:4748
- C:\Windows\System\UcueeVD.exe
  C:\Windows\System\UcueeVD.exe
  2⤵
  PID:5352
- C:\Windows\System\ajDBAXe.exe
  C:\Windows\System\ajDBAXe.exe
  2⤵
  PID:14432
- C:\Windows\System\fTqStql.exe
  C:\Windows\System\fTqStql.exe
  2⤵
  PID:6940
- C:\Windows\System\zsCXdxJ.exe
  C:\Windows\System\zsCXdxJ.exe
  2⤵
  PID:5688
- C:\Windows\System\uAtHhdH.exe
  C:\Windows\System\uAtHhdH.exe
  2⤵
  PID:5656
- C:\Windows\System\WKQTafB.exe
  C:\Windows\System\WKQTafB.exe
  2⤵
  PID:14036
- C:\Windows\System\dbCRdcU.exe
  C:\Windows\System\dbCRdcU.exe
  2⤵
  PID:14256
- C:\Windows\System\QHUnMnq.exe
  C:\Windows\System\QHUnMnq.exe
  2⤵
  PID:7784
- C:\Windows\System\yCMTIhG.exe
  C:\Windows\System\yCMTIhG.exe
  2⤵
  PID:2432
- C:\Windows\System\NObCrqH.exe
  C:\Windows\System\NObCrqH.exe
  2⤵
  PID:6040
- C:\Windows\System\fXJeMUm.exe
  C:\Windows\System\fXJeMUm.exe
  2⤵
  PID:5636
- C:\Windows\System\FyYekpE.exe
  C:\Windows\System\FyYekpE.exe
  2⤵
  PID:14396
- C:\Windows\System\SqAxgHu.exe
  C:\Windows\System\SqAxgHu.exe
  2⤵
  PID:1400
- C:\Windows\System\TdOKKEC.exe
  C:\Windows\System\TdOKKEC.exe
  2⤵
  PID:7780
- C:\Windows\System\mfXpbMq.exe
  C:\Windows\System\mfXpbMq.exe
  2⤵
  PID:5932
- C:\Windows\System\abEHxSh.exe
  C:\Windows\System\abEHxSh.exe
  2⤵
  PID:14512
- C:\Windows\System\CoZyhog.exe
  C:\Windows\System\CoZyhog.exe
  2⤵
  PID:14652
- C:\Windows\System\WGwnTVu.exe
  C:\Windows\System\WGwnTVu.exe
  2⤵
  PID:7528
- C:\Windows\System\QfzbJHP.exe
  C:\Windows\System\QfzbJHP.exe
  2⤵
  PID:4384
- C:\Windows\System\DhlQDAL.exe
  C:\Windows\System\DhlQDAL.exe
  2⤵
  PID:14584
- C:\Windows\System\NgAvwKb.exe
  C:\Windows\System\NgAvwKb.exe
  2⤵
  PID:14612
- C:\Windows\System\OFgtHFp.exe
  C:\Windows\System\OFgtHFp.exe
  2⤵
  PID:8296
- C:\Windows\System\CIQNysT.exe
  C:\Windows\System\CIQNysT.exe
  2⤵
  PID:14640
- C:\Windows\System\eovpzlZ.exe
  C:\Windows\System\eovpzlZ.exe
  2⤵
  PID:7552
- C:\Windows\System\kPnAjNE.exe
  C:\Windows\System\kPnAjNE.exe
  2⤵
  PID:14704
- C:\Windows\System\XSygpeC.exe
  C:\Windows\System\XSygpeC.exe
  2⤵
  PID:14804
- C:\Windows\System\RwWqHgj.exe
  C:\Windows\System\RwWqHgj.exe
  2⤵
  PID:7880
- C:\Windows\System\LtuVxNA.exe
  C:\Windows\System\LtuVxNA.exe
  2⤵
  PID:15020
- C:\Windows\System\sZYpzHb.exe
  C:\Windows\System\sZYpzHb.exe
  2⤵
  PID:14884
- C:\Windows\System\utNNXrV.exe
  C:\Windows\System\utNNXrV.exe
  2⤵
  PID:15196
- C:\Windows\System\zxVplNa.exe
  C:\Windows\System\zxVplNa.exe
  2⤵
  PID:15072
- C:\Windows\System\JNMawwB.exe
  C:\Windows\System\JNMawwB.exe
  2⤵
  PID:14936
- C:\Windows\System\bUaIhwv.exe
  C:\Windows\System\bUaIhwv.exe
  2⤵
  PID:15100
- C:\Windows\System\UkVbEMU.exe
  C:\Windows\System\UkVbEMU.exe
  2⤵
  PID:13828
- C:\Windows\System\EeifaJb.exe
  C:\Windows\System\EeifaJb.exe
  2⤵
  PID:6596
- C:\Windows\System\oioafJn.exe
  C:\Windows\System\oioafJn.exe
  2⤵
  PID:7952
- C:\Windows\System\MAVQzmM.exe
  C:\Windows\System\MAVQzmM.exe
  2⤵
  PID:15264
- C:\Windows\System\pyiQNMq.exe
  C:\Windows\System\pyiQNMq.exe
  2⤵
  PID:6500
- C:\Windows\System\VEnApLY.exe
  C:\Windows\System\VEnApLY.exe
  2⤵
  PID:3876
- C:\Windows\System\dculqtt.exe
  C:\Windows\System\dculqtt.exe
  2⤵
  PID:13736
- C:\Windows\System\Ydycand.exe
  C:\Windows\System\Ydycand.exe
  2⤵
  PID:15228
- C:\Windows\System\XvGlZyx.exe
  C:\Windows\System\XvGlZyx.exe
  2⤵
  PID:13764
- C:\Windows\System\VPOyDbM.exe
  C:\Windows\System\VPOyDbM.exe
  2⤵
  PID:15304
- C:\Windows\System\WXSfLYQ.exe
  C:\Windows\System\WXSfLYQ.exe
  2⤵
  PID:8664
- C:\Windows\System\SpjDHhd.exe
  C:\Windows\System\SpjDHhd.exe
  2⤵
  PID:8300
- C:\Windows\System\dWHGdRL.exe
  C:\Windows\System\dWHGdRL.exe
  2⤵
  PID:5248
- C:\Windows\System\iBppQhN.exe
  C:\Windows\System\iBppQhN.exe
  2⤵
  PID:6376
- C:\Windows\System\yVgcgax.exe
  C:\Windows\System\yVgcgax.exe
  2⤵
  PID:5984
- C:\Windows\System\fUXbjeN.exe
  C:\Windows\System\fUXbjeN.exe
  2⤵
  PID:8724
- C:\Windows\System\RXQonFl.exe
  C:\Windows\System\RXQonFl.exe
  2⤵
  PID:1136
- C:\Windows\System\HyQelCi.exe
  C:\Windows\System\HyQelCi.exe
  2⤵
  PID:8984
- C:\Windows\System\uchSThN.exe
  C:\Windows\System\uchSThN.exe
  2⤵
  PID:6220
- C:\Windows\System\GFKpank.exe
  C:\Windows\System\GFKpank.exe
  2⤵
  PID:8960
- C:\Windows\System\iybhmvZ.exe
  C:\Windows\System\iybhmvZ.exe
  2⤵
  PID:14180
- C:\Windows\System\fehQHLB.exe
  C:\Windows\System\fehQHLB.exe
  2⤵
  PID:7788
- C:\Windows\System\tbNDPEv.exe
  C:\Windows\System\tbNDPEv.exe
  2⤵
  PID:7160
- C:\Windows\System\vBatrYz.exe
  C:\Windows\System\vBatrYz.exe
  2⤵
  PID:8796
- C:\Windows\System\MwRKakf.exe
  C:\Windows\System\MwRKakf.exe
  2⤵
  PID:8676
- C:\Windows\System\YJEEbvs.exe
  C:\Windows\System\YJEEbvs.exe
  2⤵
  PID:14492
- C:\Windows\System\oAogPBR.exe
  C:\Windows\System\oAogPBR.exe
  2⤵
  PID:8828
- C:\Windows\System\BlpKgNg.exe
  C:\Windows\System\BlpKgNg.exe
  2⤵
  PID:8580
- C:\Windows\System\SNSHffR.exe
  C:\Windows\System\SNSHffR.exe
  2⤵
  PID:9044
- C:\Windows\System\lRZOkhj.exe
  C:\Windows\System\lRZOkhj.exe
  2⤵
  PID:9160
- C:\Windows\System\vCHlNOv.exe
  C:\Windows\System\vCHlNOv.exe
  2⤵
  PID:7812
- C:\Windows\System\BZRNUib.exe
  C:\Windows\System\BZRNUib.exe
  2⤵
  PID:8920
- C:\Windows\System\kdVrlAo.exe
  C:\Windows\System\kdVrlAo.exe
  2⤵
  PID:8936
- C:\Windows\System\fLjtVAQ.exe
  C:\Windows\System\fLjtVAQ.exe
  2⤵
  PID:7212
- C:\Windows\System\VGUTBew.exe
  C:\Windows\System\VGUTBew.exe
  2⤵
  PID:7868
- C:\Windows\System\XJKFEHY.exe
  C:\Windows\System\XJKFEHY.exe
  2⤵
  PID:7296
- C:\Windows\System\eiCHDqp.exe
  C:\Windows\System\eiCHDqp.exe
  2⤵
  PID:9112
- C:\Windows\System\swLggXc.exe
  C:\Windows\System\swLggXc.exe
  2⤵
  PID:8104
- C:\Windows\System\dLPXbjw.exe
  C:\Windows\System\dLPXbjw.exe
  2⤵
  PID:5604
- C:\Windows\System\IFBIfby.exe
  C:\Windows\System\IFBIfby.exe
  2⤵
  PID:7864
- C:\Windows\System\HuCyFQN.exe
  C:\Windows\System\HuCyFQN.exe
  2⤵
  PID:8176
- C:\Windows\System\iJmjQIg.exe
  C:\Windows\System\iJmjQIg.exe
  2⤵
  PID:9144
- C:\Windows\System\eWGrPIu.exe
  C:\Windows\System\eWGrPIu.exe
  2⤵
  PID:6304
- C:\Windows\System\AcKWJFu.exe
  C:\Windows\System\AcKWJFu.exe
  2⤵
  PID:14488
- C:\Windows\System\bbKioVT.exe
  C:\Windows\System\bbKioVT.exe
  2⤵
  PID:14824
- C:\Windows\System\HOyyvcl.exe
  C:\Windows\System\HOyyvcl.exe
  2⤵
  PID:7420
- C:\Windows\System\BLddTeg.exe
  C:\Windows\System\BLddTeg.exe
  2⤵
  PID:8036
- C:\Windows\System\GcCwjuL.exe
  C:\Windows\System\GcCwjuL.exe
  2⤵
  PID:7416
- C:\Windows\System\KykcfJH.exe
  C:\Windows\System\KykcfJH.exe
  2⤵
  PID:14928
- C:\Windows\System\fJdXFng.exe
  C:\Windows\System\fJdXFng.exe
  2⤵
  PID:7560
- C:\Windows\System\HxoQBOM.exe
  C:\Windows\System\HxoQBOM.exe
  2⤵
  PID:7504
- C:\Windows\System\DlHjJqF.exe
  C:\Windows\System\DlHjJqF.exe
  2⤵
  PID:6576
- C:\Windows\System\aJZfIAl.exe
  C:\Windows\System\aJZfIAl.exe
  2⤵
  PID:8076
- C:\Windows\System\ycuQWUk.exe
  C:\Windows\System\ycuQWUk.exe
  2⤵
  PID:6568
- C:\Windows\System\tZkYsQq.exe
  C:\Windows\System\tZkYsQq.exe
  2⤵
  PID:6572
- C:\Windows\System\DYtFZLy.exe
  C:\Windows\System\DYtFZLy.exe
  2⤵
  PID:14908
- C:\Windows\System\dUncDYf.exe
  C:\Windows\System\dUncDYf.exe
  2⤵
  PID:6196
- C:\Windows\System\sSGdQml.exe
  C:\Windows\System\sSGdQml.exe
  2⤵
  PID:6204
- C:\Windows\System\ludiOHf.exe
  C:\Windows\System\ludiOHf.exe
  2⤵
  PID:7892
- C:\Windows\System\OCeblKH.exe
  C:\Windows\System\OCeblKH.exe
  2⤵
  PID:9340
- C:\Windows\System\YwlNVPz.exe
  C:\Windows\System\YwlNVPz.exe
  2⤵
  PID:6296
- C:\Windows\System\tbcvGzy.exe
  C:\Windows\System\tbcvGzy.exe
  2⤵
  PID:8704
- C:\Windows\System\RBuaTyd.exe
  C:\Windows\System\RBuaTyd.exe
  2⤵
  PID:8972
- C:\Windows\System\bCXREGS.exe
  C:\Windows\System\bCXREGS.exe
  2⤵
  PID:1624
- C:\Windows\System\dCphYmZ.exe
  C:\Windows\System\dCphYmZ.exe
  2⤵
  PID:9500
- C:\Windows\System\MKcLPBh.exe
  C:\Windows\System\MKcLPBh.exe
  2⤵
  PID:14368
- C:\Windows\System\sKOxiig.exe
  C:\Windows\System\sKOxiig.exe
  2⤵
  PID:9172
- C:\Windows\System\ZrqVYee.exe
  C:\Windows\System\ZrqVYee.exe
  2⤵
  PID:8816
- C:\Windows\System\fdEbgPT.exe
  C:\Windows\System\fdEbgPT.exe
  2⤵
  PID:8996
- C:\Windows\System\PlWfjrT.exe
  C:\Windows\System\PlWfjrT.exe
  2⤵
  PID:14808
- C:\Windows\System\IcWpMOe.exe
  C:\Windows\System\IcWpMOe.exe
  2⤵
  PID:7828
- C:\Windows\System\bfvYoJb.exe
  C:\Windows\System\bfvYoJb.exe
  2⤵
  PID:3008
- C:\Windows\System\iNEfBqn.exe
  C:\Windows\System\iNEfBqn.exe
  2⤵
  PID:4712
- C:\Windows\System\SnQppCf.exe
  C:\Windows\System\SnQppCf.exe
  2⤵
  PID:6300
- C:\Windows\System\crXJLcy.exe
  C:\Windows\System\crXJLcy.exe
  2⤵
  PID:5868
- C:\Windows\System\XfKPUvj.exe
  C:\Windows\System\XfKPUvj.exe
  2⤵
  PID:7852
- C:\Windows\System\udNQbPv.exe
  C:\Windows\System\udNQbPv.exe
  2⤵
  PID:9120
- C:\Windows\System\zlicqfB.exe
  C:\Windows\System\zlicqfB.exe
  2⤵
  PID:8776
- C:\Windows\System\qbEcolE.exe
  C:\Windows\System\qbEcolE.exe
  2⤵
  PID:8040
- C:\Windows\System\XlSlxCf.exe
  C:\Windows\System\XlSlxCf.exe
  2⤵
  PID:8084
- C:\Windows\System\YCZpvug.exe
  C:\Windows\System\YCZpvug.exe
  2⤵
  PID:6692
- C:\Windows\System\yNBAVzj.exe
  C:\Windows\System\yNBAVzj.exe
  2⤵
  PID:3412
- C:\Windows\System\MrYhoXf.exe
  C:\Windows\System\MrYhoXf.exe
  2⤵
  PID:9672
- C:\Windows\System\NcvXFFe.exe
  C:\Windows\System\NcvXFFe.exe
  2⤵
  PID:10124
- C:\Windows\System\nCIeicC.exe
  C:\Windows\System\nCIeicC.exe
  2⤵
  PID:7484
- C:\Windows\System\uhjzXIw.exe
  C:\Windows\System\uhjzXIw.exe
  2⤵
  PID:9016
- C:\Windows\System\qrnqMTS.exe
  C:\Windows\System\qrnqMTS.exe
  2⤵
  PID:7944
- C:\Windows\System\IhgFoSC.exe
  C:\Windows\System\IhgFoSC.exe
  2⤵
  PID:8244
- C:\Windows\System\LLBoitQ.exe
  C:\Windows\System\LLBoitQ.exe
  2⤵
  PID:7264
- C:\Windows\System\xJkyuNq.exe
  C:\Windows\System\xJkyuNq.exe
  2⤵
  PID:8880
- C:\Windows\System\KVpOhlr.exe
  C:\Windows\System\KVpOhlr.exe
  2⤵
  PID:8064
- C:\Windows\System\mNpXBIS.exe
  C:\Windows\System\mNpXBIS.exe
  2⤵
  PID:3236
- C:\Windows\System\PRxwmxS.exe
  C:\Windows\System\PRxwmxS.exe
  2⤵
  PID:9452
- C:\Windows\System\MRYzspv.exe
  C:\Windows\System\MRYzspv.exe
  2⤵
  PID:8516
- C:\Windows\System\gPQTGjT.exe
  C:\Windows\System\gPQTGjT.exe
  2⤵
  PID:10172
- C:\Windows\System\qXcnwOl.exe
  C:\Windows\System\qXcnwOl.exe
  2⤵
  PID:9140
- C:\Windows\System\zPSZSLo.exe
  C:\Windows\System\zPSZSLo.exe
  2⤵
  PID:10052
- C:\Windows\System\vvTSciR.exe
  C:\Windows\System\vvTSciR.exe
  2⤵
  PID:9616
- C:\Windows\System\jBKtqvC.exe
  C:\Windows\System\jBKtqvC.exe
  2⤵
  PID:7640
- C:\Windows\System\eSvvDZu.exe
  C:\Windows\System\eSvvDZu.exe
  2⤵
  PID:9488
- C:\Windows\System\uLEsBFc.exe
  C:\Windows\System\uLEsBFc.exe
  2⤵
  PID:8484
- C:\Windows\System\lgEOuzp.exe
  C:\Windows\System\lgEOuzp.exe
  2⤵
  PID:8460
- C:\Windows\System\SaUvdpz.exe
  C:\Windows\System\SaUvdpz.exe
  2⤵
  PID:7932
- C:\Windows\System\FpDaIkN.exe
  C:\Windows\System\FpDaIkN.exe
  2⤵
  PID:7684
- C:\Windows\System\wJYiLPr.exe
  C:\Windows\System\wJYiLPr.exe
  2⤵
  PID:8560
- C:\Windows\System\JsAyKDQ.exe
  C:\Windows\System\JsAyKDQ.exe
  2⤵
  PID:11052
- C:\Windows\System\DDtzsaL.exe
  C:\Windows\System\DDtzsaL.exe
  2⤵
  PID:9336
- C:\Windows\System\jqzexIq.exe
  C:\Windows\System\jqzexIq.exe
  2⤵
  PID:7720
- C:\Windows\System\kSTUiED.exe
  C:\Windows\System\kSTUiED.exe
  2⤵
  PID:6216
- C:\Windows\System\JTPWWkV.exe
  C:\Windows\System\JTPWWkV.exe
  2⤵
  PID:11104
- C:\Windows\System\BHJyYzD.exe
  C:\Windows\System\BHJyYzD.exe
  2⤵
  PID:10384
- C:\Windows\System\BdffqDg.exe
  C:\Windows\System\BdffqDg.exe
  2⤵
  PID:9284
- C:\Windows\System\QQOZaHw.exe
  C:\Windows\System\QQOZaHw.exe
  2⤵
  PID:9552
- C:\Windows\System\JBsGmmc.exe
  C:\Windows\System\JBsGmmc.exe
  2⤵
  PID:10184
- C:\Windows\System\fSMelTv.exe
  C:\Windows\System\fSMelTv.exe
  2⤵
  PID:7384
- C:\Windows\System\HqMvmbs.exe
  C:\Windows\System\HqMvmbs.exe
  2⤵
  PID:6168
- C:\Windows\System\GnHXGBY.exe
  C:\Windows\System\GnHXGBY.exe
  2⤵
  PID:14564
- C:\Windows\System\LbqMFqZ.exe
  C:\Windows\System\LbqMFqZ.exe
  2⤵
  PID:7804
- C:\Windows\System\dhTnCRL.exe
  C:\Windows\System\dhTnCRL.exe
  2⤵
  PID:14732
- C:\Windows\System\GWMQsdT.exe
  C:\Windows\System\GWMQsdT.exe
  2⤵
  PID:14996
- C:\Windows\System\xBnZNjA.exe
  C:\Windows\System\xBnZNjA.exe
  2⤵
  PID:8848
- C:\Windows\System\XNriJwJ.exe
  C:\Windows\System\XNriJwJ.exe
  2⤵
  PID:6416
- C:\Windows\System\DZEdcRM.exe
  C:\Windows\System\DZEdcRM.exe
  2⤵
  PID:10708
- C:\Windows\System\KOGQGDM.exe
  C:\Windows\System\KOGQGDM.exe
  2⤵
  PID:9116
- C:\Windows\System\NBSHyrf.exe
  C:\Windows\System\NBSHyrf.exe
  2⤵
  PID:8756
- C:\Windows\System\FQlKcuf.exe
  C:\Windows\System\FQlKcuf.exe
  2⤵
  PID:10600
- C:\Windows\System\PsOtCVZ.exe
  C:\Windows\System\PsOtCVZ.exe
  2⤵
  PID:11148
- C:\Windows\System\AMEQBkQ.exe
  C:\Windows\System\AMEQBkQ.exe
  2⤵
  PID:11076
- C:\Windows\System\XAXLJxL.exe
  C:\Windows\System\XAXLJxL.exe
  2⤵
  PID:11128
- C:\Windows\System\XOTOqYi.exe
  C:\Windows\System\XOTOqYi.exe
  2⤵
  PID:10688
- C:\Windows\System\gXIyeGa.exe
  C:\Windows\System\gXIyeGa.exe
  2⤵
  PID:10740
- C:\Windows\System\sxOdJLU.exe
  C:\Windows\System\sxOdJLU.exe
  2⤵
  PID:5556
- C:\Windows\System\gpOHldc.exe
  C:\Windows\System\gpOHldc.exe
  2⤵
  PID:8808
- C:\Windows\System\nZQJuwa.exe
  C:\Windows\System\nZQJuwa.exe
  2⤵
  PID:6832
- C:\Windows\System\AOFFOwn.exe
  C:\Windows\System\AOFFOwn.exe
  2⤵
  PID:9968
- C:\Windows\System\qZhiERn.exe
  C:\Windows\System\qZhiERn.exe
  2⤵
  PID:8864
- C:\Windows\System\cNVVcHR.exe
  C:\Windows\System\cNVVcHR.exe
  2⤵
  PID:10604
- C:\Windows\System\jYaLOBQ.exe
  C:\Windows\System\jYaLOBQ.exe
  2⤵
  PID:10544
- C:\Windows\System\ZdExkoe.exe
  C:\Windows\System\ZdExkoe.exe
  2⤵
  PID:10512
- C:\Windows\System\VUtfEzC.exe
  C:\Windows\System\VUtfEzC.exe
  2⤵
  PID:6912
- C:\Windows\System\iYYsjQS.exe
  C:\Windows\System\iYYsjQS.exe
  2⤵
  PID:9772
- C:\Windows\System\CsriXPV.exe
  C:\Windows\System\CsriXPV.exe
  2⤵
  PID:8912
- C:\Windows\System\jQvQjNA.exe
  C:\Windows\System\jQvQjNA.exe
  2⤵
  PID:9964
- C:\Windows\System\uLlCdtD.exe
  C:\Windows\System\uLlCdtD.exe
  2⤵
  PID:5496
- C:\Windows\System\tgRKqUM.exe
  C:\Windows\System\tgRKqUM.exe
  2⤵
  PID:7268
- C:\Windows\System\NxuPQIu.exe
  C:\Windows\System\NxuPQIu.exe
  2⤵
  PID:12724
- C:\Windows\System\qiDubPE.exe
  C:\Windows\System\qiDubPE.exe
  2⤵
  PID:11488
- C:\Windows\System\NOIlYhG.exe
  C:\Windows\System\NOIlYhG.exe
  2⤵
  PID:11440
- C:\Windows\System\NaStXhK.exe
  C:\Windows\System\NaStXhK.exe
  2⤵
  PID:11120
- C:\Windows\System\mMxeaer.exe
  C:\Windows\System\mMxeaer.exe
  2⤵
  PID:3044
- C:\Windows\System\JSrNVdF.exe
  C:\Windows\System\JSrNVdF.exe
  2⤵
  PID:9560
- C:\Windows\System\tBvPSPY.exe
  C:\Windows\System\tBvPSPY.exe
  2⤵
  PID:11180
- C:\Windows\System\MJNCVuZ.exe
  C:\Windows\System\MJNCVuZ.exe
  2⤵
  PID:10624
- C:\Windows\System\yeZqTnE.exe
  C:\Windows\System\yeZqTnE.exe
  2⤵
  PID:12244
- C:\Windows\System\IkaaMkQ.exe
  C:\Windows\System\IkaaMkQ.exe
  2⤵
  PID:11280

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:3216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ptnljs2s.ivq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AARzDov.exe

Filesize
1.9MB

MD5
794018fbad14bda1ae372350ddea4f5c

SHA1
e0879a7c9a1bcfede401fd4e1ba005b7ffdf8004

SHA256
95d15507775f062a917e7c3a01b962adef552fcf19a3a7cdc7f7e0ab06ae1f04

SHA512
ad2f95f9e3aa84714cc75a4f697e15468ef9862ed6c36949047a618e3f5d235ba52a1835d03c2d0f4b4ccffb2dea1b6311fb56d73c12dae115417b22fbb008a9

Download Submit
C:\Windows\System\AXrCQrt.exe

Filesize
1.9MB

MD5
9dc5b76c4f609966f33cade7ba091a3e

SHA1
5f90b02a458c2c6b9d3f1e6e84733e3e456a1ec8

SHA256
184866838e6a034ae59d7dff976bd0f3f210d532b667e1e0aff229bbad1aa311

SHA512
e120f265041f517e86f4ea75bd7a5ee2527275f07316ef655528d0012896bf12902b45657d22abd68834f3aebb933f6216a53e58105ebdaee371691a1c63a792

Download Submit
C:\Windows\System\BVQekVr.exe

Filesize
1.9MB

MD5
a29afff4ee6da8d6b34a11c2959a9450

SHA1
29945858ac1ddf8e34d84f9cb4c731f098d0690b

SHA256
4d3535a0ada7c208fb77b406fef393546b5c3abb2f4856d63365c08d1cc416a7

SHA512
0ca2b1d8ed3c1c43b700e41cd610be2a2c5af9725f2ccb8667e64bb9e71447a48651c0b8a59be77bf297f0f5d8fcd4d1f0d4923dddc95c9308144780257e02cd

Download Submit
C:\Windows\System\CYXvLQX.exe

Filesize
1.9MB

MD5
42a1c2f3a72df9a678ee9bcb2d82513f

SHA1
163f8cc616196a48341f6ab2883ce96aa668b7cf

SHA256
f06f5ab7ac43cf40325e56b79809383fe1f33200c44cbb4525d5a2180b9f98da

SHA512
8456f38c87ac994439bd7f3abb16622bc6358fdabc322ffa34820c826ce0fc3ab19a2d052cd33851047b5ea6959052166b16cf210f2ec2e481ba16002516e633

Download Submit
C:\Windows\System\CbhBKHl.exe

Filesize
1.9MB

MD5
f51c6cb61d875349f26c806e5b715c21

SHA1
58316b6dc67453b398019996cbdb2f39fe7dd3f8

SHA256
34e343dbf053c69061ce7a3302e8218b7a936c0b84b21774d2e8f24aef5d3e86

SHA512
7c6d809b34a32aba7b9bbcf4630741836538d4281d02932e2b48f3caccef5a79984dbbd8cfc04b5d2612dc39e228e0b3611ef2a067279fa9451a6d60eb1065a9

Download Submit
C:\Windows\System\DZyloBh.exe

Filesize
1.9MB

MD5
667fee43b508c2c3d37ce5d3865de357

SHA1
080cb22f97e633f29fe2a380872904c7f5072b3b

SHA256
83f524a4cfc9f50265c5b60f1c7ce33a0748b21c4b2e323620f71c127c07cf1c

SHA512
b82b43911a83a439fb8fabbdae9ea42e26c6f331f277508266838f4aaa8b71d2f10bcd3d12d0e7446eb3313cef7e5e41412ef8f680a78694c0bb74e638d74340

Download Submit
C:\Windows\System\EBnNjye.exe

Filesize
1.9MB

MD5
ba770d9c74fd0e9d4db06b6e14fecc67

SHA1
02da7907891ee0cd1c11fc39fc5adc926dc07e43

SHA256
51fda705f064374aa0f6a62969a670b6785cf3f3408805fc052bfbd1a40c258a

SHA512
fa1317ec06c63d32bce59221362fa4f85945da70ec7c814ec7f79cdabf9ded8ad4c0c5c5e6e0d6520175d0a2f4b5f01fef448754503e3522b1bccfab9d0270f3

Download Submit
C:\Windows\System\GaqUmiE.exe

Filesize
1.9MB

MD5
0b2354a1ec725fc05e77196d3f0bd582

SHA1
6c75fd67d4d1d95629ab70a30d6bde50d1e1e443

SHA256
3e3284ca7f6a588cec5c1886372dc19ea8f42c2a28b1163d5ab53814180d8a60

SHA512
fae173db7fc4d72d4c93e350061ce4faad46953475eef5cceda8b95eed34cec6d0163a459314fca5a7c357f6f3ec9f9160b8fcfedb44a7774b9773dd4b2e35b7

Download Submit
C:\Windows\System\GqniEMF.exe

Filesize
1.9MB

MD5
a7fc6c8539baaad15c575dea14064bf4

SHA1
3be5ae22891a9aa1338b4adccf293d6ab633885a

SHA256
02b81e6db3e77e74c78a3ca7943d52e5c4ee6d634a7a76860fe06d5da106dc16

SHA512
f4d70eeab466b3143ff1c678d549e3497cd8d58ff150b149940c5c1aa1c3e4f97fcca4e0f828da7c056f377f24d723a715bf8e66b78fe309edc3b90ec1090701

Download Submit
C:\Windows\System\IIoPdbr.exe

Filesize
1.9MB

MD5
fa7ed45b18c3d82b0ba3b481efcac1a1

SHA1
7315c8c251cc89476f846aa45b867e5fb1fbc848

SHA256
297d879abdb3c41766b79c4587d3a561e1c9f828b9da4395ffc4fd027e29ab53

SHA512
312253515e26dee310b5def5c57e16210697460bedc961c084608c61a3dbb7779470af2cae98fbd218938b48d2ac5c48cce5483d6f415e2aceee9c7d9594d889

Download Submit
C:\Windows\System\KisKDLj.exe

Filesize
1.9MB

MD5
66c3d3106279ce990daad2f1478f46b2

SHA1
944927a6c5282134d926e94afba3a08de64a77c9

SHA256
30a5df9e7ed38d18e2d9826415bf9088a056ee570f8558e3bce564a736d63af6

SHA512
36ee94832368f2645f3c9e69490ca49ef958cb214fc8a2c89ec4390bb956fb68a83d1470783736769ac223e2d37f3d486c59e463884d084bea15df1615986432

Download Submit
C:\Windows\System\LRMEaRW.exe

Filesize
1.9MB

MD5
ed80af310dad9af18e99bbc6ae873558

SHA1
d516dc735944127146b9b335a212620bba54f8bf

SHA256
3c813221bd6699033ea9236cd89d46ace314920bdb3aad830f8d1a3effede32f

SHA512
3397bf1692de7f58569a08e8425985bfb4bb9d4e35c9dbc0cbd0c9c193a3d71493999c069a58ef7f68084301bbf30043cf59c124a7fd2cfba3ad06b7b7d8e8c6

Download Submit
C:\Windows\System\MWRZdap.exe

Filesize
1.9MB

MD5
d5f2d350d4282bed5b075584c2a8d9bf

SHA1
093b946bfc0c8980835012ae09fff8dd62af5605

SHA256
1b252db17df5aaad6dacdf97e7ed5cf602554d6db3ba3e8a58746e9797abdfa2

SHA512
91cefbbe09a220aba7c0881c1f35160e0be19d7033071a3ba237cc68efe2cc1d44cbef0dcf53725b66fcb3b0d32184834aa5230d03dba58f576867f9a1744779

Download Submit
C:\Windows\System\MeewkZS.exe

Filesize
1.9MB

MD5
8bf57f59d566d3402efcd3bc4743761b

SHA1
cf10ef72eff3eb364dbf28bd4046c3ccbf7aa8e3

SHA256
8974e2e44c47eff650ced20f93d7887c0323b1b77311ec44e02966738a63b8a8

SHA512
f5bdfcbbb2aa77d7de1dbf1b010cd16c5bf1b12580658d12f83b5f8b48560b17ae3a7d47e0c8ade335a820b69fcc4f335671dc36d8b0b58c65f396639997fc2c

Download Submit
C:\Windows\System\NvjhJGI.exe

Filesize
1.9MB

MD5
a3b9ee98df8d3c57807952e13e564d2f

SHA1
f968e83105801743f2fa18db64fef66474355e61

SHA256
bffd601de39404aa00ae9ab70e9b3a80a9ea397126af98051b66e7050e2a54bb

SHA512
556335cc7c03ffac81fd924e12a634f368c72a99895dc24e5fc25181ae261c5a26975e8a4e509145e37efb4e58f96d8c44db679fe89616e40735ae18c1c7ae55

Download Submit
C:\Windows\System\OALZfsg.exe

Filesize
1.9MB

MD5
2dc14440ac86209220505ec62923fbe3

SHA1
d352e67fdb5fff6c73a31d0b18f452898e3020cb

SHA256
141518619b34675afea752414614db98be0762f4d06b65cb866248def0efc606

SHA512
d7626826f30e33227e80662f91a43024d15ae987fe3489b67f8754e65ea84706a928c0c9f779f5b7a07cad4038dead7e1f09b0d7f1590df30a9dc753673a5e6a

Download Submit
C:\Windows\System\QOdIRNs.exe

Filesize
1.9MB

MD5
b1568bf582e56a5d71b267382bd51d99

SHA1
266eb3ee655dcd8082743a51a72456b1b206cc22

SHA256
9a6d9b1834a374246f723bb42ad6e8eada84474b11f06a459684c1f6d91a3d5d

SHA512
c3b805e2f306fa4e022c3c2022120f7f5e6ad788392fec863757c023eb7129506f360b714a7f2fe07533391fd3916bb26c595c807213956579f17dba534c7b40

Download Submit
C:\Windows\System\QdiNAtv.exe

Filesize
1.9MB

MD5
8178e29caafbda4ca566b85e6b014baf

SHA1
1d464ae16101400fc0e5a5f58029ae1d477a8564

SHA256
fad7fd14c927201912e92d78e3bc7418ca04053bef6a3c91f304555d0c712f72

SHA512
50e1f519cbff4f308ea0ff234403b2905ab3cd67ff3adfcc86f6b4ae702f854c72a24076722ba6e163498bfbaa922d8b04fac25bf20182a3846b2583b570fbfa

Download Submit
C:\Windows\System\RDRNCif.exe

Filesize
1.9MB

MD5
b83fb751b03a31df5f0c518bdf0d3a50

SHA1
5983af724ee506af7f8bcf6498bcad071626d0bc

SHA256
c19c3ac63e03f1ade7a0404b469535d2d7f6c515ae2798a9378a90396ee0fa15

SHA512
fcce28c28b7e7f2fa4049ab0be8a0656ab6942b0d8d3d65d0ef4254bb96c940639663a30e002d940fe809d6b74d826ffec6539f79a836354f0941587000c3505

Download Submit
C:\Windows\System\XGNbLBr.exe

Filesize
1.9MB

MD5
900e3b34630a903388d052a155b5277c

SHA1
95699b95120bb44f81e91226b23a14c9a855103b

SHA256
382fffbbdb1f0671c977d17db6c03327244c5900f7b2cd87516ffdc28f57ea57

SHA512
a3e77f61d2c9cbd787f1ddab249dd78585082d68847186255800f89a2ecb464eee1261b7ec925bac0eef5f1db3f479310a1a35f63da1eed52f3ad8cc034b0a6b

Download Submit
C:\Windows\System\XIjPjsd.exe

Filesize
1.9MB

MD5
6e1784ab2bdd0f98844b8870c60acf21

SHA1
d5b7ed705624296d56904ddd396e3de203da0d8f

SHA256
0567fb741d00a5353cc9cb02b5b16f5e58f55475bc7b0203321750b08879fa2a

SHA512
3ed29aa5938dace5d52b4e3dba310a88d2e5f06870fb13d02c4933f13e16609f95c1ae01e05602805e1b4b9f24949a48bb6d2208cc0622a1cd2c2d43c807ab04

Download Submit
C:\Windows\System\XNqhqGO.exe

Filesize
1.9MB

MD5
a2376995e2bcc7d6d795f8a9fb5c92af

SHA1
ca8d17e89d18c772c2936f8ca4a0488386b2fcf6

SHA256
38f017f88283dec568ff486118feb8c35a7075f9000bb972c1a3c77f6c4173e8

SHA512
56e339a86c6f976d78cc054f08923faff4cb2a213f5c6ff62d919c100c85ac3dedc9e3fcc44ac62007d1de6c3ce3f1489b2e2d1218e04c8955625213e2dd9228

Download Submit
C:\Windows\System\YcuvCVP.exe

Filesize
1.9MB

MD5
d174ae1ca4b5cc684048e97d9fc9ee35

SHA1
d46846b27b74e894abbf4bdcdcf0e3e6ba06040d

SHA256
9e87da1aedccb99000f0af9e3135d25a88a58d8598e56f76b1e7e6e42b501b14

SHA512
62633a4c2b317a34192d869ea7e98274b9c993bae9e385fe74e882e78de9a5e51b18e27d610f70e8c6b6f72c350780e027e982f4dcff460116b647bba8929bd7

Download Submit
C:\Windows\System\YeqjHeO.exe

Filesize
1.9MB

MD5
66103373687ca9152271cac17a05fd2d

SHA1
8eecb066afa4a47bb4827bb1aa93414cd8df929c

SHA256
8de10ad3e1c6c98dc1ff5c29fc4abee750ece066cf949d5b7ea07d582a2ab456

SHA512
8196f3dd1392be38f22e46d36752dd779467d0e7115d1d90c22e66a0cb04e64ac9ace7eec3019efb72a6a4ca083c3cd5ca4b8f869135d5b9d45f2caf91a226e2

Download Submit
C:\Windows\System\ZJhmcRE.exe

Filesize
1.9MB

MD5
3fd0eb9d088174bc52e767d6f9ed1e99

SHA1
61a7748ebda11797c3bd91b2b14094f949b2a8f8

SHA256
29e8c0961f1993aa5abdd285cbe4f7b1bc234ad3b59bc8dd3b727e85eacfd11e

SHA512
df214327a3558abdec9445b5453bd3feacadc4f7c7969f33cf7ab9ee1504843e8f9426c81507f0c9ffa1df3685f6846d497fedd61d7639f6fbe6cf260ba32fe3

Download Submit
C:\Windows\System\drMALSD.exe

Filesize
1.9MB

MD5
ff852ed150ff5e060fe759f241f54ea7

SHA1
7d045189b274a747e5e54f9574f603e4b1ee8218

SHA256
e3264fbe716e79a06a8a2e2187c71fa968d1c099f9202b487efc2a28480ea8fd

SHA512
b604dc903a6c279a642a8c23387a055d76bef21fc9cfcc9f1aa4e31af56ac3f458a35ae7432c7de542918830833763ba3e5b9cacdbb14dbca579abb02fe2c23e

Download Submit
C:\Windows\System\fBTQfTG.exe

Filesize
1.9MB

MD5
8ce76b3e912af9658ed08ed3942ba618

SHA1
be5a29f92239cc4c656def1499c6b60e67bb382d

SHA256
148d47d246c7263c7005360c3cb5fd58d6e8acfa4de5f1be193290c11c6e7087

SHA512
2a83483fbb86938a21d93961760caa46147d2b88eb5c686dfa1d74a8fd956871d3a5637aacf1eb005c1b5eccf0edf4d59c1e0c42f79cabba689b2808525ea58b

Download Submit
C:\Windows\System\fYLaAgs.exe

Filesize
1.9MB

MD5
3ab24894ffd9f947c77f4d78c4f137eb

SHA1
4b32c3eb137925b35c0860ecbdc484a51e304167

SHA256
058c3cde87dc2289d88adfef454d7c57a0dad54db1708c77a933b3a35bfb9f4e

SHA512
d56862991cde0f082647b892eb5b3b27d2f76a53e4700ef6b17dd1c13198db106317cdbdccaec02f7dddcd9aef89a093f15c5f3d45cf07589d78c399901bc706

Download Submit
C:\Windows\System\hXwjTZE.exe

Filesize
1.9MB

MD5
03ccdae213f847eae1e5e467cce84c59

SHA1
2b2213524c99ae1eb59add52f2255acc2a934239

SHA256
5fab0ff374a0f03fa494d22af392825aa42d305d2940a0b8b97f7c63d8c8d819

SHA512
246cec9d5cc76abe55a6cf11de34364f7a91d72b7f9e1bb3b415eb1da5e48b06add85ab77255503ead2745466d2d158f80b9d3c41c350db6d81c5dab3d8845d6

Download Submit
C:\Windows\System\huHikLS.exe

Filesize
1.9MB

MD5
c4c53a210c9fa38f52bf75f67a45d500

SHA1
588847e3c5f7d02234acc9f818f14dbc02510e8a

SHA256
db713a78e631a580bae60cf4f36de4d7f8e576625619ac066e5806bb6d69c508

SHA512
a9145f397dd6d68ea1413ffc003d21a0d1bd15dcbbe4080ef159082592e1ecb4154913efc128667ea08df1c144629e095adc85e371627a6c72010dc695d3ab62

Download Submit
C:\Windows\System\iJyrMVU.exe

Filesize
1.9MB

MD5
315b4b839ce8663b3d69070b30125a94

SHA1
7abb7f41bfdd5736558f4a704bf83ed0d79e515a

SHA256
6c194c3abc245cd3a4c53d4294ce9bd7205967525e462b8f38f788cdaa797929

SHA512
92b7b6ebd6b028a2e0a262c5f2bca01b94f6a82c62e5afd02cd34114357927c477df354d8e8d27b275e2c90358dcf2375332d5be987f667b5132e592ea5d4f2f

Download Submit
C:\Windows\System\jEfAeST.exe

Filesize
1.9MB

MD5
8d72132d35bc73c15f5d4e1a1c82174c

SHA1
5873a7e25e74127acc7cb6789748dd9f50b35e32

SHA256
0d21f411ffffae61a6d5fd81a11ed4091addad644adb7b47adb31f621b7d4dbe

SHA512
d397a3f4361ffe73af6c6f4594259d02e0451200ba37c5da6e055df93f5aa7c474a1626d8a7bc75e7452436781b7b7c673d283fecf286ee5b484eca2741afde4

Download Submit
C:\Windows\System\neiibvT.exe

Filesize
1.9MB

MD5
9375392a4ebfdb91a09e12ff5e1bbc2c

SHA1
caa3f9929c39586bf89427bb991b30726ee3a813

SHA256
50d35fb048e9580509131dc2ff7e1cf06627132e113c9d7e2ed7b5d24df5146d

SHA512
2ae262d40a94344bf788b14deefb9b5b6e00a788be110482833e3fc0fdc088fb71f153b48f9ba74af96615c0c08cd04b1c903a2f61ce1bd84891163acf11c16c

Download Submit
C:\Windows\System\nrAQgyb.exe

Filesize
1.9MB

MD5
99beaf09bb462d810ab4fd82b3a43b80

SHA1
556a9f7b77bfdae9dc7442c0dab5906335419779

SHA256
8c79c15058eeadc249834222d3bdf78c6dccb754e36e108e94c1bc0589a5a10d

SHA512
00e635a533e0eb243420d389cd3291740aeef204811ac934da2be07419318c9317b7473ad2484803dd3d70cced132baa80f74356da331a1627c3b9c5088e4eac

Download Submit
C:\Windows\System\pbDVUbf.exe

Filesize
1.9MB

MD5
4a9d978211ce6ad2d258a96e0baebbcf

SHA1
d2fe6efdea54baabe47ce2d14f60f0c43ad3b153

SHA256
b489182f995d8588d0f63183968f5eb0f67f0a69bcbe4dffe673ddb4d6a1c129

SHA512
89357f42f58b1c3a626efe95399226239f8db88a084f6211997a5d8107c74b3df36c37f7d5a1938408b84d9e8b2c2e2527dd7df4f26f4fe66209b89f9966687b

Download Submit
C:\Windows\System\qCmNAML.exe

Filesize
1.9MB

MD5
017fc5757a2b504c48b5cb621479d062

SHA1
4448581cd6d398d6ea4c14e4b8f7738ca29d1a8d

SHA256
3b8c6b9d9efcc404243a0365dd95d1b2f1a68a1894247b18d94212d118830837

SHA512
131be57fd30db1d5b8d4a0753878e499b559657fbda9f304d8fbe2e24f94c4d05f7a22357e64649e552e1377546b9da3f2a3b26a7808bc11b2e71324ec64d95a

Download Submit
C:\Windows\System\qDgUcbK.exe

Filesize
1.9MB

MD5
c31e145fbf630cb83804b2f60f292c5d

SHA1
fb1faa4802e590d699d85e7d436bf0788cd81fd4

SHA256
60d2205d03138ae1771f6e3594a56492bba78545ceb314ef7636fd23e4ca2175

SHA512
09199ff053de4c64e6aa51d04a5a31b188e0000088f4915348b0a2a286f414939e42f23150671ff8c418fa8365da2481928accae1be4ae7dacefa59ccc8c8889

Download Submit
C:\Windows\System\qGwjOmb.exe

Filesize
1.9MB

MD5
e59b983ec0fb524e947e534bf5c0f7ca

SHA1
fd5ae50c796cf31a8411df56a21bf5831dd29142

SHA256
0e45f5634e217b7c8c97001028a44f34e5681d894d519cee440721ffc60aa703

SHA512
6f2b9649f74dad817bc4ad4ebbc5ee4bc02eb2cfcb9fd89d18d7fcfa9ea38aa61ebefbeb3606d28dc33e3fdb770a4db444ea78cc4937be884ac334a8d79601ad

Download Submit
C:\Windows\System\rUoUobh.exe

Filesize
1.9MB

MD5
382662f737cf766426d4e923ca5e2b63

SHA1
179baae41f85afb0cd806d539698aea4592a888c

SHA256
2244803dd5c6da948c877fa52a96379d5f2d20e849a13cee34bd53b28e85d041

SHA512
56e9b45c6d69ed793583908c63abbfc37c7cfc5dfc4e55fc0c16132c5395155de28029ea8fc764d61db1c28786b891c27fe83ae6db0aef47fef161ebe9136d09

Download Submit
C:\Windows\System\tXXLqqc.exe

Filesize
1.9MB

MD5
2ef51533880b8db0238d2b2d664dd592

SHA1
01e6dfd927abecbea528ea2e1555ff231edf41f9

SHA256
ce78d4965d8373d9aa5c51c799ef6c20a7c55a8083fb7a76ad189914d308aa8b

SHA512
05ed8b372cea1fa5828e73f640efbffdd8612cff4ff7fb8c3c33de0cf0c56d52bf1c28f1f52ba26d907b55070a9e17f739f79311eea48096ad69c06fdb495d4b

Download Submit
C:\Windows\System\thkQFsI.exe

Filesize
8B

MD5
da57f1becac58004cc11aafbac9e09ca

SHA1
b10ccea8b5844c4e8d6fccbb9815e810cde69838

SHA256
ebaef8bc612201e925938625599b5517f3827c047e83e2d93ad964b1f0fc66c1

SHA512
134947446589a9d8f325a68a96129fcb35c181e2720e2909cc3e1b835dd8deb0df283f79601a79fabb8300a57762038cb8a3dfbbf02b69bb7a9fa5482a4881f4

Download Submit
C:\Windows\System\uUsGnMP.exe

Filesize
1.9MB

MD5
90f08416580c34d9952a510f525f57f5

SHA1
d920dd50fb74fb56fb349dc4d5c15d767392d36a

SHA256
b9cb7df4a286f8141322669398900a0f7742c65307b259eb8ee2c8e038147e37

SHA512
5097f15c455028b5236a331844f328514747f61efd5d45623e12dc975e1b5326d735fde3cb0ded732c39eab57f3e4557cc115f4a1599c167d424894af8aaf296

Download Submit
C:\Windows\System\vBzWdRJ.exe

Filesize
1.9MB

MD5
b4f6d13724183e3d72149f49aac9f816

SHA1
be71e7af279df4be80aa093d2fd5a36416f8c989

SHA256
c0c8c0e5d160e6c257980b13a7aeb417b262420e45e491342b52acd50e8dfe8e

SHA512
14032b7a9bca4265bb0c4e745a4b279e6de3087b5273208594fbc7febce513f2dbe118914da30ed8d6c0d510390bfcdd124f66c94b8e5b9986a7d5138e32f657

Download Submit
C:\Windows\System\zrEVEhj.exe

Filesize
1.9MB

MD5
bb2ce7bb69cae50cef993b8b84664d8e

SHA1
ef3fc42a5be1322716e31e76f82a37140a47e723

SHA256
6b8b08b2885a85e627c83e6828268dc5cc0ac99ae4213ba87e184752966cbb63

SHA512
33e6d74191b1059caeb24e0faabbb5b7f4ffe46afb3d31fb53ba4c472f277285808d397b5414a473df207c9e5a4efed5c228026163b5ab13c3a3394ec0bfcc04

Download Submit
memory/436-954-0x00007FF7CBD90000-0x00007FF7CC182000-memory.dmp

Filesize
3.9MB

Download
memory/436-5236-0x00007FF7CBD90000-0x00007FF7CC182000-memory.dmp

Filesize
3.9MB

Download
memory/712-5225-0x00007FF74D6C0000-0x00007FF74DAB2000-memory.dmp

Filesize
3.9MB

Download
memory/712-617-0x00007FF74D6C0000-0x00007FF74DAB2000-memory.dmp

Filesize
3.9MB

Download
memory/744-5251-0x00007FF79FC40000-0x00007FF7A0032000-memory.dmp

Filesize
3.9MB

Download
memory/744-649-0x00007FF79FC40000-0x00007FF7A0032000-memory.dmp

Filesize
3.9MB

Download
memory/1064-931-0x00007FF7370F0000-0x00007FF7374E2000-memory.dmp

Filesize
3.9MB

Download
memory/1064-5240-0x00007FF7370F0000-0x00007FF7374E2000-memory.dmp

Filesize
3.9MB

Download
memory/1232-5212-0x00007FF6401C0000-0x00007FF6405B2000-memory.dmp

Filesize
3.9MB

Download
memory/1232-225-0x00007FF6401C0000-0x00007FF6405B2000-memory.dmp

Filesize
3.9MB

Download
memory/1452-345-0x00007FF6F28F0000-0x00007FF6F2CE2000-memory.dmp

Filesize
3.9MB

Download
memory/1496-777-0x00007FF710E10000-0x00007FF711202000-memory.dmp

Filesize
3.9MB

Download
memory/1496-5247-0x00007FF710E10000-0x00007FF711202000-memory.dmp

Filesize
3.9MB

Download
memory/1692-285-0x00007FF78DF70000-0x00007FF78E362000-memory.dmp

Filesize
3.9MB

Download
memory/1744-221-0x00007FF6382E0000-0x00007FF6386D2000-memory.dmp

Filesize
3.9MB

Download
memory/1744-5126-0x00007FF6382E0000-0x00007FF6386D2000-memory.dmp

Filesize
3.9MB

Download
memory/1772-0-0x00007FF7B2250000-0x00007FF7B2642000-memory.dmp

Filesize
3.9MB

Download
memory/1772-1-0x000002E481000000-0x000002E481010000-memory.dmp

Filesize
64KB

Download
memory/1816-473-0x00007FF615C50000-0x00007FF616042000-memory.dmp

Filesize
3.9MB

Download
memory/1816-5119-0x00007FF615C50000-0x00007FF616042000-memory.dmp

Filesize
3.9MB

Download
memory/1876-552-0x00007FF60BC90000-0x00007FF60C082000-memory.dmp

Filesize
3.9MB

Download
memory/1876-5189-0x00007FF60BC90000-0x00007FF60C082000-memory.dmp

Filesize
3.9MB

Download
memory/1968-899-0x00007FF747AD0000-0x00007FF747EC2000-memory.dmp

Filesize
3.9MB

Download
memory/1968-5087-0x00007FF747AD0000-0x00007FF747EC2000-memory.dmp

Filesize
3.9MB

Download
memory/2120-547-0x00007FF67DFF0000-0x00007FF67E3E2000-memory.dmp

Filesize
3.9MB

Download
memory/2120-5256-0x00007FF67DFF0000-0x00007FF67E3E2000-memory.dmp

Filesize
3.9MB

Download
memory/2172-12-0x00007FF762830000-0x00007FF762C22000-memory.dmp

Filesize
3.9MB

Download
memory/2348-93-0x00007FF6909F0000-0x00007FF690DE2000-memory.dmp

Filesize
3.9MB

Download
memory/2996-930-0x00007FF62E0F0000-0x00007FF62E4E2000-memory.dmp

Filesize
3.9MB

Download
memory/3064-71-0x00007FF77AE20000-0x00007FF77B212000-memory.dmp

Filesize
3.9MB

Download
memory/3108-4770-0x00007FF747550000-0x00007FF747942000-memory.dmp

Filesize
3.9MB

Download
memory/3108-146-0x00007FF747550000-0x00007FF747942000-memory.dmp

Filesize
3.9MB

Download
memory/3764-5124-0x00007FF6151B0000-0x00007FF6155A2000-memory.dmp

Filesize
3.9MB

Download
memory/3764-207-0x00007FF6151B0000-0x00007FF6155A2000-memory.dmp

Filesize
3.9MB

Download
memory/4104-5222-0x00007FF690320000-0x00007FF690712000-memory.dmp

Filesize
3.9MB

Download
memory/4104-400-0x00007FF690320000-0x00007FF690712000-memory.dmp

Filesize
3.9MB

Download
memory/4256-5265-0x00007FF765EB0000-0x00007FF7662A2000-memory.dmp

Filesize
3.9MB

Download
memory/4256-857-0x00007FF765EB0000-0x00007FF7662A2000-memory.dmp

Filesize
3.9MB

Download
memory/4348-323-0x00007FF7338B0000-0x00007FF733CA2000-memory.dmp

Filesize
3.9MB

Download
memory/4348-5220-0x00007FF7338B0000-0x00007FF733CA2000-memory.dmp

Filesize
3.9MB

Download
memory/4420-49-0x00007FF8FF0F0000-0x00007FF8FFBB1000-memory.dmp

Filesize
10.8MB

Download
memory/4420-200-0x000001D0CF0F0000-0x000001D0CF112000-memory.dmp

Filesize
136KB

Download
memory/4420-3-0x00007FF8FF0F3000-0x00007FF8FF0F5000-memory.dmp

Filesize
8KB

Download
memory/4420-2324-0x00007FF8FF0F0000-0x00007FF8FFBB1000-memory.dmp

Filesize
10.8MB

Download
memory/4420-898-0x00007FF8FF0F0000-0x00007FF8FFBB1000-memory.dmp

Filesize
10.8MB

Download
memory/4772-639-0x00007FF653BC0000-0x00007FF653FB2000-memory.dmp

Filesize
3.9MB

Download
memory/4772-5313-0x00007FF653BC0000-0x00007FF653FB2000-memory.dmp

Filesize
3.9MB

Download
memory/5072-465-0x00007FF66FE80000-0x00007FF670272000-memory.dmp

Filesize
3.9MB

Download